Conversation
Accepts valid characters as defined in RFC3261.
This patch lets the parser to work over tcp protocol, taking care of handling data before calling the request/response parsers. Ticket OISF#3351.
This patch permits to set a direction when a new transaction is created in order to avoid 'signature shadowing' as reported by Eric Leblond in commit 5aaf507
glongo
requested review from
a team,
jasonish and
victorjulien
as code owners
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #9483 +/- ##
==========================================
- Coverage 82.18% 82.16% -0.03%
==========================================
Files 968 968
Lines 274199 274336 +137
==========================================
+ Hits 225363 225406 +43
- Misses 48836 48930 +94
Flags with carried forward coverage won't be shown. Click here to find out more. |
| GENEVE_PORTS: 6081 | ||
| VXLAN_PORTS: 4789 | ||
| TEREDO_PORTS: 3544 | ||
| SIP_PORTS: "[5060, 5061]" |
There was a problem hiding this comment.
This is meant to be used in signatures, right ?
git grep SIP_PORTS does not yield anything else
| if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) > 0 { | ||
| return AppLayerResult::ok(); | ||
| } else { | ||
| return AppLayerResult::err(); |
There was a problem hiding this comment.
How can we end up here ? stream_slice.is_empty() && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) == 0
There was a problem hiding this comment.
I'm not really sure it's needed actually, but I thought that it would be good to check if eof is reached.
|
Maybe commit message |
|
Where should we document this change @jufajardini ? upgrade section ? |
It's meant to be |
(Sorry for the belated answer, I obviously missed this.) I think that:
|
catenacyber
left a comment
catenacyber
left a comment
There was a problem hiding this comment.
Thanks Giuseppe. Still need some nit and a bit of doc
|
Since 8 development is now started, we can get this in when you're ready. |
|
Replaced by #9880 |
5 participants
Make sure these boxes are signed before submitting your Pull Request -- thank you.
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3351
Describe changes:
Provide values to any of the below to override the defaults.
To use a pull request use a branch name like
pr/NwhereNis thepull request number.
Alternatively,
SV_BRANCHmay also be a link to anOISF/suricata-verify pull-request.