Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Backport of 6553/6875 to main-7.0.x #11761

Closed
wants to merge 14 commits into from
Closed

Backport of 6553/6875 to main-7.0.x #11761

wants to merge 14 commits into from

Conversation

jlucovsky
Copy link
Contributor

Continuation of #11709

Link to tickets:

Describe changes:

Updates:

  • Added comments to the commit "membuffer: use buffer pointer as flexible array member" stating why the buffer needs to be reset when created.
  • Use SCCalloc to initialize membuffer fields (instead of calling MemBufferReset).

Provide values to any of the below to override the defaults.

  • To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2012
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

@victorjulien @jlucovsky
stream: const args for StreamReassembleLog
d45c615 
Needed a workaround cast for RBTREE use.

(cherry picked from commit a5a6527)
@victorjulien @jlucovsky
eve/frame: implement payload-buffer-size option
5712f7f 
Modeled after the same option in eve/alert. Defaults to 4k.

(cherry picked from commit 829bab2)
@victorjulien @jlucovsky
eve/alert: log payload directly from stream buffer
5e4d86e 
This avoids looping over partly duplicate segments that cause
output data corruption by logging parts of the stream data multiple
times.

For data with GAPs now add a indicator '[4 bytes missing]' similar
to how Wireshark does it.

Bug: OISF#6553.
(cherry picked from commit 43858f7)
@victorjulien @jlucovsky
eve/alert: init membuffer size on missing config
c57203d 
Don't init buffer to 0 size but use the desired default of 4k.

(cherry picked from commit 462a6d7)
@victorjulien @jlucovsky
eve/frames: pass membuffer to API
cfcd85e 
In preparation of stream logging changes.

(cherry picked from commit a205583)
@victorjulien @jlucovsky
eve/frame: improve frame payload logging
c9c8b68 
Log using stream callback API, meaning that data will also
be logged if there are GAPs.

Also implement GAP indicators: '[123 bytes missing]'.

(cherry picked from commit 6e10c66)
@victorjulien @jlucovsky
unix-manager: add \n string to buffer using correct API call
7bab2fb 
(cherry picked from commit ea98df8)
@victorjulien @jlucovsky
membuffer: turn complex macros into functions
99ba333 
For better readability and type checking.

(cherry picked from commit 3ef98f2)
@victorjulien @jlucovsky
membuffer: use buffer pointer as flexible array member
f9208e9 
(cherry picked from commit 9c3669b)

An additional change was made to correct an ASAN issue -- the membuffer
is reset following allocation in MemBufferCreateNew().
@victorjulien @jlucovsky
membuffer: return bytes written
d1c421e 
(cherry picked from commit 7d5b537)
@victorjulien @jlucovsky
eve/frame: break out of logging callback if buffer is full
750bb1b 
(cherry picked from commit 1dea4fe)
@victorjulien @jlucovsky
eve/alert: break out of payload logging callback if buffer is full
c20e1e9 
(cherry picked from commit 926c6e3)
@victorjulien @jlucovsky
membuffer: annotate printf style function
dcbef39 
(cherry picked from commit ff8597d)
@victorjulien @jlucovsky
eve/alert: fix validation check
6280cee 
Bug: OISF#6875.
(cherry picked from commit 0be3ba8)
@jlucovsky jlucovsky requested review from victorjulien and a team as code owners September 11, 2024 21:24
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 22564

@jlucovsky jlucovsky mentioned this pull request Sep 12, 2024
Closed
@victorjulien
Copy link
Member

Blocked by SV issues still.

@jlucovsky jlucovsky mentioned this pull request Sep 13, 2024
Closed
@jlucovsky
Copy link
Contributor Author

Continued in #11775

@jlucovsky jlucovsky closed this Sep 13, 2024
@jlucovsky jlucovsky deleted the 6555/5 branch September 30, 2024 14:24
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers

@victorjulien victorjulien Awaiting requested review from victorjulien victorjulien is a code owner

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jlucovsky @suricata-qa @victorjulien