Project

General

Profile

Actions
Copy link

Optimization #3304

open
AH OD

generic way to register buffers for logging and detection

Optimization #3304: generic way to register buffers for logging and detection

Added by Andreas Herz over 6 years ago. Updated almost 2 years ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Currently creating support for logging protocol fields and matching protocol fields are distinct steps during development.

Goal is to unify this so the protocol parser implementations simply register a buffer/field once.

Related issues 4 (3 open — 1 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4101: tracking: pluginsIn ProgressJason IshActions
Related to Suricata - Feature #4099: app-layer: allow direct rule keyword registrationClosedVictor JulienActions
Related to Suricata - Feature #7095: rdp: keywords additionsNewOISF DevActions

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #1

  • Subject changed from Make sure output of protocol parsers and keywords are both supported to generic way to register buffers for logging and detection
  • Description updated (diff)

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #2

  • Parent task deleted (#3288)

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #3

  • Related to Task #3288: Suricon 2019 brainstorm added

VJ Updated by Victor Julien over 5 years ago Actions
Copy link
 #4

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #5

As I see it, the main problem is that detection requires redmine ticket + suricata-verify test + documentation when logging does not

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #6

Idea about this : using magic rust derive that would parse a struct and see which fiels are annotated for logging and/or detection and create functions to log them or get the buffer/integer for detection

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #7

  • Related to Feature #4099: app-layer: allow direct rule keyword registration added

PA Updated by Philippe Antoine almost 2 years ago Actions
Copy link
 #8

@Jason Ish was there not a duplicate ticket for this we talked about yesterday ?

PA Updated by Philippe Antoine almost 2 years ago Actions
Copy link
 #9

Actions
Copy link

Also available in: PDF Atom