Project

General

Profile

Actions
Copy link

Feature #5665

closed
PA PA

rules: bidirectional transaction matching

Feature #5665: rules: bidirectional transaction matching

Added by Philippe Antoine over 3 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

As a HTTP1 rule with uri and response code

Subtasks 1 (0 open — 1 closed)

Feature #2280: http: rules that match both request and responseClosedPhilippe AntoineActions

Related issues 7 (4 open — 3 closed)

Related to Suricata - Task #5488: Suricon 2022 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #4321: http2: Support link between packets in the same stream ClosedPhilippe AntoineActions
Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #5664: "Scope" bits should have an expirationAssignedShivani BhardwajActions
Related to Suricata - Bug #7357: filestore keyword option seems not to workFeedbackEric LeblondActions
Related to Suricata - Bug #7665: transaction rules: support filesizeClosedPhilippe AntoineActions
Blocks Suricata - Story #7124: rules: improve rule languageClosedVictor JulienActions

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #1

  • Related to Task #5488: Suricon 2022 brainstorm added

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #2

  • Related to Feature #2280: http: rules that match both request and response added

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #3

  • Subject changed from Bidirectional transaction matching to rules: bidirectional transaction matching

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #4

  • Related to Feature #4321: http2: Support link between packets in the same stream added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #5

  • Related to Task #6443: Suricon 2023 brainstorm added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #6

  • Related to Feature #5664: "Scope" bits should have an expiration added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #7

Difficulty is file.data buffer is streamed and not retained.

Most keywords like http.uri should be easier...

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #8

  • Assignee changed from OISF Dev to Philippe Antoine

Trying thinking about it

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #9

  • Status changed from New to In Progress

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #10

  • Target version changed from TBD to 8.0.0-beta1

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #11

  • Status changed from In Progress to In Review

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #12

  • Status changed from In Review to In Progress

Today's status : https://github.com/OISF/suricata/pull/10252
Try to lift off the limitations

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #13

  • Status changed from In Progress to In Review

https://github.com/OISF/suricata/pull/10506

POC is good enough...
Rounds of reviews to expect...
And the feature for delaying prefiltering on the toclient direction... may come with this ticket or a next one...

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #14

  • Blocks Story #7124: rules: improve rule language added

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #15

  • Subtask #2280 added

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #16

  • Related to Bug #7357: filestore keyword option seems not to work added

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #17

  • Status changed from In Review to Resolved

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #18

  • Status changed from Resolved to Closed

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #19

  • Related to Bug #7665: transaction rules: support filesize added
Actions
Copy link

Also available in: PDF Atom