Output alert applayer v13.4 #9812
Conversation
Especially fix setup-app-layer script to not forget this part This allows, for simple loggers, to have a unique definition of the actual logging function with the jsonbuilder. This way, alerts, files, and app-layer event can share the code to output the same data. Ticket: OISF#3827
Ticket: 6500
Ticket: 6501
Ticket: 5977
Ticket: 3827
as fixed patterns can be enough
| #include "detect-engine-prefilter.h" | ||
| #include "detect-parse.h" | ||
|
|
||
| int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver) |
There was a problem hiding this comment.
All this helper stuff seems generally useful across many keywords... Should it not be integrated directly into detect-engine-register?
There was a problem hiding this comment.
Good idea, will do
There was a problem hiding this comment.
Problem is detect.h depends on detect-engine-register.h for DETECT_TBLSIZE_STATIC
So we cannot have these defined in detect-engine-register.h as they depend on definition in detect.h
Only implemented for snmp.version and mqtt.password But should be implemented for more
So that we can have dynamically registered protocols. Doing it at compile time, with CFLAGS=-DALPROTO_DYNAMIC_NB=1, allows to keep the rest of the code using ALPROTO_MAX Ticket: 5053
catenacyber
force-pushed
the
output-alert-applayer-v13.4
branch
from
ec83079 to
f22c4ae
Compare
Ticket: 5053
catenacyber
force-pushed
the
output-alert-applayer-v13.4
branch
from
f22c4ae to
c52260d
Compare
|
This also solves https://redmine.openinfosecfoundation.org/issues/4683 |
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #9812 +/- ##
==========================================
- Coverage 82.37% 82.35% -0.02%
==========================================
Files 968 957 -11
Lines 273866 273372 -494
==========================================
- Hits 225585 225148 -437
+ Misses 48281 48224 -57
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 16578 |
|
Replaced by #9871 |
Link to redmine tickets:
https://redmine.openinfosecfoundation.org/issues/3827
https://redmine.openinfosecfoundation.org/issues/5977
https://redmine.openinfosecfoundation.org/issues/6500
https://redmine.openinfosecfoundation.org/issues/6501
https://redmine.openinfosecfoundation.org/issues/5053
Describe changes:
#9807 with S-V fixed for files
OISF/suricata-verify#1465