Project

General

Profile

Actions
Copy link

Feature #5664

open
PA OD

"Scope" bits should have an expiration

Feature #5664: "Scope" bits should have an expiration

Added by Philippe Antoine over 3 years ago. Updated 10 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
OISF Dev
Target version:
-
Effort:
Difficulty:
Label:

Description

New kind of "bits" need to be implemented. These should be able to have different scope like transaction. This means that the bits should expire when a tx does

Related issues 6 (4 open — 2 closed)

Related to Suricata - Task #4380: tracking: improvements to bits, ints, varsAssignedVictor JulienActions
Related to Suricata - Task #5488: Suricon 2022 brainstormAssignedVictor JulienActions
Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #5665: rules: bidirectional transaction matchingClosedPhilippe AntoineActions
Related to Suricata - Feature #6455: txbits: support for new type of bitsClosedVictor JulienActions
Related to Suricata - Feature #6459: filebits: support for new type of bitsAssignedShivani BhardwajActions

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #1

  • Related to Task #4380: tracking: improvements to bits, ints, vars added

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #2

  • Related to Task #5488: Suricon 2022 brainstorm added

JF Updated by Juliana Fajardini Reichow over 3 years ago Actions
Copy link
 #3

  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 7.0.0-rc1

SB Updated by Shivani Bhardwaj over 3 years ago Actions
Copy link
 #4

  • Subject changed from Flowbit expiration to "Scope" bits with expiration
  • Description updated (diff)
  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1

JF Updated by Juliana Fajardini Reichow about 3 years ago Actions
Copy link
 #5

  • Status changed from New to Assigned

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #6

  • Related to Task #6443: Suricon 2023 brainstorm added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #7

  • Related to Feature #5665: rules: bidirectional transaction matching added

SB Updated by Shivani Bhardwaj over 2 years ago Actions
Copy link
 #8

  • Subject changed from "Scope" bits with expiration to "Scope" bits should have an expiration

filebit and txbit should have an expiration.

SB Updated by Shivani Bhardwaj over 2 years ago Actions
Copy link
 #9

  • Related to Feature #6455: txbits: support for new type of bits added

SB Updated by Shivani Bhardwaj over 2 years ago Actions
Copy link
 #10

  • Related to Feature #6459: filebits: support for new type of bits added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #11

I think #5665 solves most of the needs for this

So, it would be nice to get #5665 and then get feedback again about this one

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #12

  • Target version changed from 8.0.0-beta1 to 9.0.0-beta1

SB Updated by Shivani Bhardwaj 7 months ago Actions
Copy link
 #13

Philippe Antoine wrote in #note-11:

I think #5665 solves most of the needs for this

So, it would be nice to get #5665 and then get feedback again about this one

@Philippe Antoine #5665 was merged sometime ago. Wdyt about this ticket now? ;)

PA Updated by Philippe Antoine 7 months ago Actions
Copy link
 #14

Do people still have a concrete use case for this ?

PA Updated by Philippe Antoine 5 months ago Actions
Copy link
 #15

I think we should let some time, and then close this ticket if no new use case comes that does not currently work with bidirectional transactional rules

SB Updated by Shivani Bhardwaj 10 days ago Actions
Copy link
 #16

  • Status changed from Assigned to Triaged
  • Assignee changed from Shivani Bhardwaj to OISF Dev
  • Target version deleted (9.0.0-beta1)

Giving this up as it's unclear what needs to be done and I have not worked in the affected areas.

Actions
Copy link

Also available in: PDF Atom