suricata
suricata copied to clipboard
protocol-change: sets event in case of failure
Link to redmine ticket: None
Describe changes:
- Sets an event if protocol change fails (ie if there is already protocol change going on)
Another way to do this would be to set a packet's app-layer event, but AppLayerRequestProtocolChange
does not have access to the current Packet
and its caller FTPParseResponse
does not have it neither...
So, this PR implements different events for the different app-layer protocols.
FTP and PGSQL do not have events yet, and are not part of this...
Codecov Report
Merging #7296 (8ec51d8) into master (ddf9c9d) will decrease coverage by
0.04%
. The diff coverage is58.33%
.
@@ Coverage Diff @@
## master #7296 +/- ##
==========================================
- Coverage 75.82% 75.77% -0.05%
==========================================
Files 656 656
Lines 190051 190057 +6
==========================================
- Hits 144102 144020 -82
- Misses 45949 46037 +88
Flag | Coverage Δ | |
---|---|---|
fuzzcorpus | 60.30% <58.33%> (-0.12%) |
:arrow_down: |
suricata-verify | 51.50% <63.63%> (-0.03%) |
:arrow_down: |
unittests | 61.01% <45.45%> (-0.01%) |
:arrow_down: |
Flags with carried forward coverage won't be shown. Click here to find out more.
Victor, you requested this event, so assigning this draft to you ;-)
Information:
ERROR: QA failed on tlpw1_files_sha256.
field | test | baseline | % |
---|---|---|---|
tlpr1_stats_chk | |||
.flow.memuse | 530312768 | 498197568 | 106.45% |
Pipeline 7251
Are there pcaps to test this scenario? If not can you craft them?
Replaced by https://github.com/OISF/suricata/pull/7745 with S-V test linked ;-)