Conversation
So that we can write enip.revision: 0x203
Ticket: 3958
- enip_command keyword accepts now string enumeration as values.
- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- SEQUENCE_ADDR_ITEM value is fixed to 0x8002 instead of 0xB002
- frames support
- app-layer events
- add enip.status keyword
- add identity keywords :
enip.product_name, enip.protocol_version, enip.revision,
enip.identity_status, enip.state, enip.serial, enip.product_code,
enip.device_type, enip.vendor_id
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #9937 +/- ##
==========================================
- Coverage 82.35% 81.83% -0.52%
==========================================
Files 972 984 +12
Lines 273060 274613 +1553
==========================================
- Hits 224870 224728 -142
- Misses 48190 49885 +1695
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 16818 |
| pub fn AppLayerParserStateIssetFlag(state: *mut c_void, flag: u16) -> u16; | ||
| pub fn AppLayerParserSetStreamDepth(ipproto: u8, alproto: AppProto, stream_depth: u32); | ||
| pub fn AppLayerParserConfParserEnabled(ipproto: *const c_char, proto: *const c_char) -> c_int; | ||
| pub fn AppLayerParserRegisterParserAcceptableDataDirection(ipproto: u8, alproto: AppProto, dir: u8); |
There was a problem hiding this comment.
Should it have its own commit despite being just one line?
There was a problem hiding this comment.
Interesting, why so ?
My logic is to put in the commit, the line using it, ie calling AppLayerParserRegisterParserAcceptableDataDirection from rust
There was a problem hiding this comment.
Your logic is undoubtedly sound.
However, considering that you're introducing a new function for the app layer, which can be reused in other protocols, I thought that creating a specific commit would provide a clear history in the git log.
This way, it can be easily traced back to its introduction if needed.
There was a problem hiding this comment.
The function is not new.
It makes it merely accessible to rust app-layers...
|
Replaced by #9940 |
3 participants
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3958
Describe changes:
Alon the way, also
#9850 rebased +
Draft as is this is not complete but want to get CI impression :
Provide values to any of the below to override the defaults.
OISF/suricata-verify#1485