-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
detect: add vlan.id keyword - v6 #12301
Conversation
vlan.id matches on Virtual Local Area Network IDs It is an unsigned 16-bit integer Valid range for the default configuration = [1-4094] Supports prefiltering Ticket: OISF#1065
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12301 +/- ##
=========================================
Coverage ? 83.24%
=========================================
Files ? 914
Lines ? 257834
Branches ? 0
=========================================
Hits ? 214629
Misses ? 43205
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CI : 🟢
Code : cool, just one nit
Commits segmentation : ok
Commit messages : nice
Git ID set : looks fine for me
CLA : you already contributed
Doc update : excellent
Redmine ticket : ok
Rustfmt : looks ok for vlan_id.rs
Tests : nice, thanks, added a remark there
Dependencies added: none
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for highlighting so clearly the changes (and great job!) 👏🏽
I've shared complementary stuff on the comments :)
|
||
vlan.id:300 # exactly 300 | ||
vlan.id:<300,0 # smaller than 300 at layer 0 | ||
vlan.id:>=200,1 # greater or equal than 200 at layer 1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit (missed this the other review x_x ):
vlan.id:>=200,1 # greater or equal than 200 at layer 1 | |
vlan.id:>=200,1 # greater than or equal to 200 at layer 1 |
The id can be matched exactly, or compared using the ``op`` setting:: | ||
|
||
vlan.id:300 # exactly 300 | ||
vlan.id:<300,0 # smaller than 300 at layer 0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
vlan.id:<300,0 # smaller than 300 at layer 0 | |
vlan.id:<300,0 # less than 300 at layer 0 |
Id values for vlan.id keyword: | ||
|
||
======== ================================================ | ||
Value Description | ||
======== ================================================ | ||
1 - 4094 Valid range for vlan id | ||
0 - 3 Valid range of number of layers (with ``count``) | ||
======== ================================================ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can use the .. table::
Sphinx directive and have neat table titles, here and for the following one:
Id values for vlan.id keyword: | |
======== ================================================ | |
Value Description | |
======== ================================================ | |
1 - 4094 Valid range for vlan id | |
0 - 3 Valid range of number of layers (with ``count``) | |
======== ================================================ | |
.. table:: **Id values for vlan.id keyword** | |
======== ================================================ | |
Value Description | |
======== ================================================ | |
1 - 4094 Valid range for vlan id | |
0 - 3 Valid range of number of layers (with ``count``) | |
======== ================================================ |
Ticket: #1065
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/projects/suricata/issues
Link to ticket: https://redmine.openinfosecfoundation.org/issues/1065
Description:
Documentation changes:
id
andlayer
: line 20, line 29;count
: line 77.vlan_id.rs changes:
#no_mangle
from the constants definitions: line 22;pub const
: line 22;DETECT_VLAN_ID
: line 22;.ok()?
: line 35, line 54;count
: line 46;if
to checkcount
range: line 55;i8::MAX
andi8::MIN
withDETECT_VLAN_ID_ALL
andDETECT_VLAN_ID_ANY
: line 45, line 52, line 103;all
andcount
: line 106, line 117.detect-vlan-id.c changes:
rust.h
: line 21;if
chain withswitch-case
: line 32.Commit message:
SV_BRANCH=OISF/suricata-verify#2194
Previous PR= #12290