Feature #6350
openTask #6308: tracking: detect/analyzer: add more keyword details
detect/analyzer: add more details for the tcp.flags keyword
Added by Juliana Fajardini Reichow almost 3 years ago. Updated 15 days ago.
Description
Add the value of the options for the tcp.flags keyword
https://github.com/OISF/suricata/pull/4165/files#diff-a553fb7d84945fbc1a2f7b5d0412d751da7317194d944bf103b08dbe74084b1eR264
Please check for more details on the parent ticket.
JF Updated by Juliana Fajardini Reichow almost 3 years ago Actions #1
- Copied from Task #6348: detect/analyzer: add more details for the ipopts keyword added
JF Updated by Juliana Fajardini Reichow almost 3 years ago Actions #2
- Copied to Task #6357: detect/analyzer: add more details for the dsize keyword added
VJ Updated by Victor Julien about 2 years ago Actions #3
- Target version changed from 8.0.0-beta1 to TBD
OF Updated by Olusegun Fajobi 11 months ago Actions #4
- Status changed from New to Assigned
OF Updated by Olusegun Fajobi 10 months ago Actions #5
- Assignee changed from Community Ticket to Olusegun Fajobi
OF Updated by Olusegun Fajobi 10 months ago Actions #6
- Assignee changed from Olusegun Fajobi to Community Ticket
PA Updated by Philippe Antoine 4 months ago Actions #7
- Tracker changed from Task to Feature
PA Updated by Philippe Antoine about 1 month ago Actions #8
- Status changed from Assigned to Triaged
IA Updated by ILIAS AGORITSAS 15 days ago Actions #9
Hi! I’d like to work on this community ticket if it is still available.
I reviewed the ticket history and saw that the previous assignee relinquished it and that the issue was recently moved back to Triaged status.
My proposed scope is to expose the `tcp.flags` option values in the detect/analyzer output, following the patterns used by already-supported keywords, and add focused regression coverage.
Before I start, could you confirm the expected output format and the preferred location for the tests? If this is still available, may I take it?
Disclosure: I use OpenAI Codex as a learning, code-navigation, and review assistant. I personally review, understand, and test every change, and I will follow any project-specific AI contribution requirements.
JF Updated by Juliana Fajardini Reichow 15 days ago Actions #10
- Status changed from Triaged to Assigned
- Assignee changed from Community Ticket to ILIAS AGORITSAS
- Target version changed from TBD to 9.0.0-beta1
ILIAS AGORITSAS wrote in #note-9:
Hi! I’d like to work on this community ticket if it is still available.
I reviewed the ticket history and saw that the previous assignee relinquished it and that the issue was recently moved back to Triaged status.
My proposed scope is to expose the `tcp.flags` option values in the detect/analyzer output, following the patterns used by already-supported keywords, and add focused regression coverage.
Before I start, could you confirm the expected output format and the preferred location for the tests? If this is still available, may I take it?
Disclosure: I use OpenAI Codex as a learning, code-navigation, and review assistant. I personally review, understand, and test every change, and I will follow any project-specific AI contribution requirements.
Hi, I have assigned the ticket to you, thanks for wanting to contribute to our project!
As for guidelines, please check the parent ticket, other commits adding details to the detect-analyzer output, in particular those for other tcp and/or generic integer fields, and also check the SV tests for the corresponding work. These should give you a good basis to know how to proceed.
If you have more questions, feel free to ask them here or in draft PRs. :)