Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dataset set postmatch 5576 v11 #12053

Closed
wants to merge 5 commits into from
Closed

Dataset set postmatch 5576 v11 #12053

wants to merge 5 commits into from

Commits on Oct 29, 2024

  1. ci/live: test for sid 1 existence, not in last position

    @catenacyber
    catenacyber committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    573f578 View commit details
    Browse the repository at this point in the history

  2. detect/http: fix progress for headers keywords 

    Ticket: 7326
    @catenacyber
    catenacyber committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    660a475 View commit details
    Browse the repository at this point in the history

  3. detect: postmatch can run AppLayerTxMatch callbacks 

    Will be useful for dataset, when it needs to find a transaction
buffer again.
    @catenacyber
    catenacyber committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    7e79051 View commit details
    Browse the repository at this point in the history

  4. detect/dataset: delay set operation after signature full match 

    The set operation of dataset keyword was done even if signature
did not fully match, which is not the expected behavior.
We want dataset to behave like flowbits for instance.

This patch changes the behavior of the dataset keyword to do a
match and a post match for the set operation.
The postmatch retrieves the data, using the list identifier
associated to the buffer for this signature.

This avoids to store the buffer(s), when we do not have a
dedicated storage (per signature and per tx) that can own
and clean arbitrary buffers over multiple packets, in
the case the transaction spans over multiple packets
with different tx progresses for instance.
If detection runs on one packet, the InspectionBuffer are
cached and fast to get.
The most expensive case if for multi buffers, where we
need to run detection again, to see which occurences
match all payload keywords and should be added in the dataset.

Ticket: OISF#5576
    @catenacyber
    catenacyber committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    c8906bc View commit details
    Browse the repository at this point in the history

  5. fixup! detect/dataset: delay set operation after signature full match

    @catenacyber
    catenacyber committed Oct 29, 2024
    Configuration menu
    Copy the full SHA
    a89a2ed View commit details
    Browse the repository at this point in the history