suricata icon indicating copy to clipboard operation
suricata copied to clipboard

pkt-data: add userguide entry, fix typo - v1

Open jufajardini opened this issue 10 months ago • 2 comments

While working for alert metadata testing for PGSQL, I was looking for more info on pkt-data and realized we didn't have a rules-guide entry for it. The description here is based on what I saw in https://docs.snort.org/rules/options/payload/, considering we mention pkt_data in some sections of our documentation that mention Snort.

Link to redmine ticket: none

Describe changes:

  • add pkt_data keyword section to userguide/rules/payload-keywords
  • Updated the comment description for the registering function, replacing file_data with pkt_data.
  • Fix section title formatting for section about PCRE1 and PCRE2 differences

jufajardini avatar Apr 23 '24 23:04 jufajardini

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 82.80%. Comparing base (3a27cfd) to head (c49e7fb). Report is 11 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10938      +/-   ##
==========================================
+ Coverage   82.74%   82.80%   +0.06%     
==========================================
  Files         922      922              
  Lines      247861   248217     +356     
==========================================
+ Hits       205081   205536     +455     
+ Misses      42780    42681      -99     
Flag Coverage Δ
fuzzcorpus 64.15% <100.00%> (+0.16%) :arrow_up:
suricata-verify 62.42% <100.00%> (+<0.01%) :arrow_up:
unittests 62.25% <100.00%> (+0.03%) :arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

codecov[bot] avatar Apr 23 '24 23:04 codecov[bot]

WARNING:

field baseline test %
SURI_TLPR1_stats_chk
.memcap.pressure 57 59 103.51%

Pipeline 20312

suricata-qa avatar Apr 24 '24 02:04 suricata-qa

Are you planning to resubmit soon?

victorjulien avatar Jun 20 '24 07:06 victorjulien

Are you planning to resubmit soon?

As I tried to improve on this one, I felt I was lacking some knowledge to write something that made sense. I'll close it for now, to reduce the open PRs noise.

jufajardini avatar Jun 26 '24 12:06 jufajardini