Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc/flowint: fix terminology for unset variable - v1 #12159

Closed
wants to merge 1 commit into from

Conversation

jufajardini
Copy link
Contributor

s/isnotset/notset, for flowint

Flowints don't follow the same pattern as other similar keywords, but the docs indicated otherwise.

--

The examples are correct but if someone only read the explanation (as I did, they'd end up with a broken rule).

s/isnotset/notset, for flowint

Flowints don't follow the same pattern as other similar keywords, but
the docs indicated otherwise.
@jufajardini jufajardini added the typo/doc update No code change : only doc or typo fixes label Nov 27, 2024
Copy link

codecov bot commented Nov 27, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 49.84%. Comparing base (bd7d38e) to head (1f0b6c3).
Report is 31 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12159      +/-   ##
==========================================
+ Coverage   49.81%   49.84%   +0.03%     
==========================================
  Files         909      909              
  Lines      257904   257904              
==========================================
+ Hits       128467   128547      +80     
+ Misses     129437   129357      -80     
Flag Coverage Δ
fuzzcorpus 60.99% <ø> (+0.04%) ⬆️
livemode 19.43% <ø> (+<0.01%) ⬆️
pcap 44.43% <ø> (+0.02%) ⬆️
suricata-verify 62.74% <ø> (-0.01%) ⬇️
unittests 8.98% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@@ -143,7 +143,12 @@ Define a var (not required), or check that one is set or not set.
::

flowint: name, < +,-,=,>,<,>=,<=,==, != >, value;
flowint: name, (isset|isnotset);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My instinct is that we should keep such things consistent among the rule keywords. Of course, that comes at an expense of changing and breaking the existing rulesets that use this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we rather change the code to support both historical notset but also generic isnotset ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds very good to me :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair point. Should I create a ticket, then?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why change the code? Why not just keep this to updating the docs to reflect reality?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As mentioned above and in the ticket, to keep consistency among rule keywords syntax. Should we not aim for that?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm more referring to why close this one which corrects the documentation issue. The code change is a somewhat separate issue which is still good to have for consistency.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code change + doc will be a logical unit of some sort...

But let's not overthink it, I am ok either way

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess... We can merge this, and then once the code change happens, another doc update will be due.


.. note::

It's important to observe that while similar keywords use ``isnotset``,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The proper fix here is to add isnotset support, while keeping the notset for compatibility reasons

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this seems trivial enough. But not getting to it, should not prevent correct documentation :)

@jufajardini
Copy link
Contributor Author

Adding isnotset support: #12228

@jufajardini jufajardini closed this Dec 5, 2024
@jufajardini jufajardini deleted the flowint-docs-fix/v1 branch January 3, 2025 19:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
typo/doc update No code change : only doc or typo fixes
Development

Successfully merging this pull request may close these issues.

5 participants