suricata icon indicating copy to clipboard operation
suricata copied to clipboard

protocol-change: sets event in case of failure

Open catenacyber opened this issue 2 years ago • 4 comments

Link to redmine ticket: None

Describe changes:

  • Sets an event if protocol change fails (ie if there is already protocol change going on)

Another way to do this would be to set a packet's app-layer event, but AppLayerRequestProtocolChange does not have access to the current Packet and its caller FTPParseResponse does not have it neither... So, this PR implements different events for the different app-layer protocols. FTP and PGSQL do not have events yet, and are not part of this...

catenacyber avatar Apr 25 '22 06:04 catenacyber

Codecov Report

Merging #7296 (8ec51d8) into master (ddf9c9d) will decrease coverage by 0.04%. The diff coverage is 58.33%.

@@            Coverage Diff             @@
##           master    #7296      +/-   ##
==========================================
- Coverage   75.82%   75.77%   -0.05%     
==========================================
  Files         656      656              
  Lines      190051   190057       +6     
==========================================
- Hits       144102   144020      -82     
- Misses      45949    46037      +88     
Flag Coverage Δ
fuzzcorpus 60.30% <58.33%> (-0.12%) :arrow_down:
suricata-verify 51.50% <63.63%> (-0.03%) :arrow_down:
unittests 61.01% <45.45%> (-0.01%) :arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

codecov[bot] avatar Apr 25 '22 06:04 codecov[bot]

Victor, you requested this event, so assigning this draft to you ;-)

catenacyber avatar Apr 27 '22 12:04 catenacyber

Information:

ERROR: QA failed on tlpw1_files_sha256.

field test baseline %
tlpr1_stats_chk
.flow.memuse 530312768 498197568 106.45%

Pipeline 7251

suricata-qa avatar May 03 '22 06:05 suricata-qa

Are there pcaps to test this scenario? If not can you craft them?

victorjulien avatar May 03 '22 07:05 victorjulien

Replaced by https://github.com/OISF/suricata/pull/7745 with S-V test linked ;-)

catenacyber avatar Aug 22 '22 15:08 catenacyber