suricata icon indicating copy to clipboard operation
suricata copied to clipboard

stun: add initial app-proto support - v1

Open jufajardini opened this issue 1 year ago • 4 comments

Sharing a first version, so we know if this is the right direction, and also discuss a few things/ TODOs.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/ https://redmine.openinfosecfoundation.org/issues/7068

Describe changes:

  • Add initial support for STUN app-proto
  • adjust extern C function from STUN to use the new API style
  • apply clang format changes to the json schema

Provide values to any of the below to override the defaults.

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/2016

TODOs:

  • remove left-overs that don't make sense for UDP¬
  • add docs¬
  • add detection (first merge, or later?)¬
  • add frames (first merge, or later?)¬

jufajardini avatar Aug 20 '24 21:08 jufajardini

Codecov Report

Attention: Patch coverage is 78.72763% with 107 lines in your changes missing coverage. Please review.

Project coverage is 82.60%. Comparing base (304271e) to head (d89f6ff). Report is 250 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11648      +/-   ##
==========================================
- Coverage   82.61%   82.60%   -0.02%     
==========================================
  Files         919      923       +4     
  Lines      248997   249500     +503     
==========================================
+ Hits       205717   206097     +380     
- Misses      43280    43403     +123     
Flag Coverage Δ
fuzzcorpus 60.74% <12.85%> (-0.15%) :arrow_down:
livemode 18.68% <17.05%> (+0.02%) :arrow_up:
pcap 44.02% <14.95%> (-0.13%) :arrow_down:
suricata-verify 61.90% <72.89%> (+<0.01%) :arrow_up:
unittests 58.97% <36.38%> (-0.04%) :arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

codecov[bot] avatar Aug 20 '24 21:08 codecov[bot]

ERROR:

ERROR: QA failed on ASAN_TLPR1_suri.

Pipeline 22182

suricata-qa avatar Aug 20 '24 22:08 suricata-qa

Information: QA ran without warnings.

Pipeline 22241

suricata-qa avatar Aug 24 '24 00:08 suricata-qa

Thanks for the work, left a few comments of possible/welcome improvements :-)

catenacyber avatar Aug 27 '24 12:08 catenacyber

Closing this for now as it's stale, not to add noise to the PR queue.

jufajardini avatar Nov 27 '24 14:11 jufajardini

Waiting for the app-layer plugin ;-)

catenacyber avatar Nov 27 '24 15:11 catenacyber