[draft] dns: dns.response.answer.name sticky buffer - v1#9686
[draft] dns: dns.response.answer.name sticky buffer - v1#9686jasonish wants to merge 5 commits intoOISF:masterfrom
Conversation
The old DetectAppLayerMpmRegister has not been around since 4.1.x. Rename the v2 of this function to a versionless function as there is no documentation referring to what the 2 means.
Rename DetectAppLayerInspectEngine2 to DetectAppLayerInspectEngine as there is no other variant of this function, and the versioning with lack of supporting documentation can lead to confusion.
jasonish
force-pushed
the
dns-response/v1
branch
from
6b9c306 to
edd0e9d
Compare
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #9686 +/- ##
==========================================
- Coverage 82.39% 82.36% -0.04%
==========================================
Files 968 969 +1
Lines 274337 274326 -11
==========================================
- Hits 226047 225937 -110
- Misses 48290 48389 +99
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 16305 |
|
WARNING:
Pipeline 16306 |
jasonish
force-pushed
the
dns-response/v1
branch
2 times, most recently
from
5eaf857 to
9335903
Compare
|
Information: QA ran without warnings. Pipeline 16307 |
|
Information: QA ran without warnings. Pipeline 16309 |
jasonish
force-pushed
the
dns-response/v1
branch
3 times, most recently
from
037f8fc to
783f80d
Compare
|
Information: QA ran without warnings. Pipeline 16314 |
jasonish
force-pushed
the
dns-response/v1
branch
from
783f80d to
8338da4
Compare
jasonish
force-pushed
the
dns-response/v1
branch
from
8338da4 to
06b877d
Compare
jasonish
changed the title
|
Information: QA ran without warnings. Pipeline 16320 |
|
Think it makes sense. Not finding the commit separation entirely logical, I would just squash them all together (the keyword commits, not talking about the API rename) |
Yeah, its more for review of the individual items that were applied over and above the current template for sticky buffers. |
|
Continued in #9813 right ? |
4 participants
This implements the sticky buffer
dns.response.answer.nameto match on names on DNS response answers.The idea is to fill this out with more keywords like:
and so on.
But before I continue on I want to make sure this is the good example of a stick buffer, with prefiltering and multi-buffer support, as it looks like our template is out of date. After this is given an OK, I'll apply the changes to the template.
Then I'd also like to isolate the common patterns of the sticky buffers and abstract the boilerplate away.
SV_BRANCH=OISF/suricata-verify#1444