Project

General

Profile

Actions

Feature #6350

open
JF IA

Task #6308: tracking: detect/analyzer: add more keyword details

detect/analyzer: add more details for the tcp.flags keyword

Feature #6350: detect/analyzer: add more details for the tcp.flags keyword

Added by Juliana Fajardini Reichow almost 3 years ago. Updated 15 days ago.

Status:
Assigned
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
Beginner, C, Outreachy

Description

Add the value of the options for the tcp.flags keyword
https://github.com/OISF/suricata/pull/4165/files#diff-a553fb7d84945fbc1a2f7b5d0412d751da7317194d944bf103b08dbe74084b1eR264

Please check for more details on the parent ticket.


Related issues 2 (0 open2 closed)

Copied from Suricata - Task #6348: detect/analyzer: add more details for the ipopts keywordClosedJuliana Fajardini ReichowActions
Copied to Suricata - Task #6357: detect/analyzer: add more details for the dsize keywordClosedJeff LucovskyActions

JF Updated by Juliana Fajardini Reichow almost 3 years ago Actions #1

  • Copied from Task #6348: detect/analyzer: add more details for the ipopts keyword added

JF Updated by Juliana Fajardini Reichow almost 3 years ago Actions #2

  • Copied to Task #6357: detect/analyzer: add more details for the dsize keyword added

VJ Updated by Victor Julien about 2 years ago Actions #3

  • Target version changed from 8.0.0-beta1 to TBD

OF Updated by Olusegun Fajobi 11 months ago Actions #4

  • Status changed from New to Assigned

OF Updated by Olusegun Fajobi 10 months ago Actions #5

  • Assignee changed from Community Ticket to Olusegun Fajobi

OF Updated by Olusegun Fajobi 10 months ago Actions #6

  • Assignee changed from Olusegun Fajobi to Community Ticket

PA Updated by Philippe Antoine 4 months ago Actions #7

  • Tracker changed from Task to Feature

PA Updated by Philippe Antoine about 1 month ago Actions #8

  • Status changed from Assigned to Triaged

IA Updated by ILIAS AGORITSAS 15 days ago Actions #9

Hi! I’d like to work on this community ticket if it is still available.

I reviewed the ticket history and saw that the previous assignee relinquished it and that the issue was recently moved back to Triaged status.

My proposed scope is to expose the `tcp.flags` option values in the detect/analyzer output, following the patterns used by already-supported keywords, and add focused regression coverage.

Before I start, could you confirm the expected output format and the preferred location for the tests? If this is still available, may I take it?

Disclosure: I use OpenAI Codex as a learning, code-navigation, and review assistant. I personally review, understand, and test every change, and I will follow any project-specific AI contribution requirements.

JF Updated by Juliana Fajardini Reichow 15 days ago Actions #10

  • Status changed from Triaged to Assigned
  • Assignee changed from Community Ticket to ILIAS AGORITSAS
  • Target version changed from TBD to 9.0.0-beta1

ILIAS AGORITSAS wrote in #note-9:

Hi! I’d like to work on this community ticket if it is still available.

I reviewed the ticket history and saw that the previous assignee relinquished it and that the issue was recently moved back to Triaged status.

My proposed scope is to expose the `tcp.flags` option values in the detect/analyzer output, following the patterns used by already-supported keywords, and add focused regression coverage.

Before I start, could you confirm the expected output format and the preferred location for the tests? If this is still available, may I take it?

Disclosure: I use OpenAI Codex as a learning, code-navigation, and review assistant. I personally review, understand, and test every change, and I will follow any project-specific AI contribution requirements.

Hi, I have assigned the ticket to you, thanks for wanting to contribute to our project!

As for guidelines, please check the parent ticket, other commits adding details to the detect-analyzer output, in particular those for other tcp and/or generic integer fields, and also check the SV tests for the corresponding work. These should give you a good basis to know how to proceed.

If you have more questions, feel free to ask them here or in draft PRs. :)

Actions

Also available in: PDF Atom