next/580/20240920/v1 #11804
Merged
next/580/20240920/v1 #11804
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If a stream-only rule matches, and we find a tx where we want to log the app-layer data, store into the tx data that we already logged, so that we do not log again the app-layer metadata Ticket: 7085
No need to first turn it into a flags field.
In case this hits logging an error is harmful, better to silently continue. Remove use of `default` to help the compiler flag new enum additions.
When removing mentions to `prune-flows` a few inconsistencies for how we write and refer to `emergency-recovery` were left behind, still.
Related to Bug OISF#7113
PGSQL's current implementation tracks the transaction progress without taking into consideration flow direction, and also has indirections that make it harder to understand how the progress is tracked, as well as when a request or response is actually complete. This patch introduces tracking such progress per direction and adds completion status per direction, too. This will help when triggering raw stream reassembly or for unidirectional transactions, and may be useful when we implement sub-protocols that can have multiple requests per transaction, as well. CancelRequests and TerminationRequests are examples of unidirectional transactions. There won't be any responses to those requests, so we can also mark the response side as done, and set their transactions as completed. Bug OISF#7113
Once we are tracking tx progress per-direction for PGSQL, we can trigger the raw stream reassembly, for detection purposes, as soon as the transactions are completed in the given direction. Task OISF#7000
victorjulien
requested review from
jufajardini,
jasonish and
a team
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11804 +/- ##
=========================================
Coverage ? 82.59%
=========================================
Files ? 919
Lines ? 249091
Branches ? 0
=========================================
Hits ? 205738
Misses ? 43353
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. |
jufajardini
approved these changes
Sep 20, 2024
|
Information: QA ran without warnings. Pipeline 22757 |
This was referenced Sep 20, 2024
Closed
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Staging:
SV_BRANCH=OISF/suricata-verify#2050