Printable/v14 #10261
Printable/v14 #10261
Conversation
Needed a workaround cast for RBTREE use.
Modeled after the same option in eve/alert. Defaults to 4k.
This avoids looping over partly duplicate segments that cause output data corruption by logging parts of the stream data multiple times. For data with GAPs now add a indicator '[4 bytes missing]' similar to how Wireshark does it. Bug: OISF#6553.
Don't init buffer to 0 size but use the desired default of 4k.
In preparation of stream logging changes.
Log using stream callback API, meaning that data will also be logged if there are GAPs. Also implement GAP indicators: '[123 bytes missing]'.
For better readability and type checking.
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #10261 +/- ##
==========================================
- Coverage 82.28% 82.26% -0.03%
==========================================
Files 977 977
Lines 271950 271995 +45
==========================================
- Hits 223784 223755 -29
- Misses 48166 48240 +74
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: ERROR: QA failed on SURI_TLPW2_autofp_suri_time.
Pipeline 17775 |
|
Bug 6553 is flagged as a backport, but in this PR we are adding extra data. Any thoughts on how this might affect log processing tools? |
Not sure. I think the old output also printed more in some cases than expected due to broken overlap printing. It's certainly a change, so maybe we need a more conservative approach for backports. |
But anyway, this is for master. We can discuss the backport when the backport is done. |
|
replaced by #10592 |
SV_BRANCH=OISF/suricata-verify#1616
https://redmine.openinfosecfoundation.org/issues/6553