Project

General

Profile

Actions

Optimization #3304

open

generic way to register buffers for logging and detection

Added by Andreas Herz over 4 years ago. Updated 7 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Currently creating support for logging protocol fields and matching protocol fields are distinct steps during development.

Goal is to unify this so the protocol parser implementations simply register a buffer/field once.


Related issues 2 (2 open0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4101: tracking: pluginsIn ProgressJason IshActions
Actions #1

Updated by Victor Julien over 4 years ago

  • Subject changed from Make sure output of protocol parsers and keywords are both supported to generic way to register buffers for logging and detection
  • Description updated (diff)
Actions #2

Updated by Victor Julien over 4 years ago

  • Parent task deleted (#3288)
Actions #3

Updated by Victor Julien over 4 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions #4

Updated by Victor Julien over 3 years ago

Actions #5

Updated by Philippe Antoine over 1 year ago

As I see it, the main problem is that detection requires redmine ticket + suricata-verify test + documentation when logging does not

Actions #6

Updated by Philippe Antoine 7 months ago

Idea about this : using magic rust derive that would parse a struct and see which fiels are annotated for logging and/or detection and create functions to log them or get the buffer/integer for detection

Actions

Also available in: Atom PDF