Project

General

Profile

Actions
Copy link

Feature #6396

closed
JT SS

rules: add protocol string support for mqtt

Feature #6396: rules: add protocol string support for mqtt

Added by Jason Taylor over 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Sascha Steinbiss
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:
C, Needs Suricata-Verify test, Rust

Description

we would like the ability to sig on the protocol string content on mqtt traffic. The key/value is currently being logged:

"mqtt":{"connect":{"qos":0,"retain":false,"dup":false,"protocol_string":"MQIsdp","protocol_version":3,"client_id":"<snipped>

So something like mqtt.protocol_string would be great.

JT Updated by Jason Taylor over 2 years ago Actions
Copy link
 #1

When looking at the mqtt sources, I noticed what are probably the remnants from a copy/paste in detect-mqtt-type.c:

/** * \brief Registration function for ipopts: keyword
*/

Totally a minor thing of course just figured a fixup could go in with this tickets main work

SS Updated by Sascha Steinbiss over 2 years ago Actions
Copy link
 #2

  • Status changed from New to In Progress
  • Label C, Needs Suricata-Verify test, Rust added

SS Updated by Sascha Steinbiss over 2 years ago Actions
Copy link
 #3

Jason Taylor wrote in #note-1:

When looking at the mqtt sources, I noticed what are probably the remnants from a copy/paste in detect-mqtt-type.c:

/**
  • \brief Registration function for ipopts: keyword
    */

Totally a minor thing of course just figured a fixup could go in with this tickets main work

True, will include that in the PR. Thanks for spotting this!

SS Updated by Sascha Steinbiss over 2 years ago Actions
Copy link
 #5

  • Status changed from In Progress to In Review

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #6

  • Target version changed from TBD to 8.0.0-beta1

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #7

  • Status changed from In Review to Closed

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #8

  • Subject changed from Add protocol string support for mqtt to rules: add protocol string support for mqtt
Actions
Copy link

Also available in: PDF Atom