Project

General

Profile

Actions

Bug #6973

closed

detect: log relevant frames app-layer metdata

Added by Juliana Fajardini Reichow 5 months ago. Updated 3 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Proposed patch already exists (cf https://github.com/OISF/suricata/pull/10924), but was suggested that it had its own ticket


Subtasks 2 (0 open2 closed)

Bug #6974: detect: log relevant frames app-layer metdata (6.0.x backport)RejectedPhilippe AntoineActions
Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport)ClosedPhilippe AntoineActions

Related issues 2 (0 open2 closed)

Related to Suricata - Bug #6846: alerts: wrongly using tx id 0 when there is no txClosedPhilippe AntoineActions
Related to Suricata - Security #6900: http2: timeout logging headersClosedPhilippe AntoineActions
Actions #1

Updated by Juliana Fajardini Reichow 5 months ago

  • Related to Bug #6846: alerts: wrongly using tx id 0 when there is no tx added
Actions #2

Updated by OISF Ticketbot 5 months ago

  • Subtask #6974 added
Actions #3

Updated by OISF Ticketbot 5 months ago

  • Label deleted (Needs backport to 6.0)
Actions #4

Updated by OISF Ticketbot 5 months ago

  • Subtask #6975 added
Actions #5

Updated by OISF Ticketbot 5 months ago

  • Label deleted (Needs backport to 7.0)
Actions #6

Updated by Philippe Antoine 5 months ago

Current master situation :
app-layer data does not get logged for frames, since commit 2b4e10224eaebb613352e9b82556b60035d032a1
Before that, and in main7, app-layer data gets logged, but we log tx id 0 if no specific tx was specified.

Also, the lack of tests suggest that there are many protocols which do not set the tx id for their frames...
Which may be due to the unfriendliness of the rust API to create anew frame with a known tx id...

Actions #7

Updated by Philippe Antoine 5 months ago

  • Status changed from New to In Progress
Actions #8

Updated by Philippe Antoine 5 months ago

  • Status changed from In Progress to In Review
Actions #9

Updated by Philippe Antoine 5 months ago

Actions #10

Updated by Philippe Antoine 5 months ago

  • Status changed from In Review to Resolved
Actions #11

Updated by Philippe Antoine 4 months ago

  • Status changed from Resolved to Closed
Actions #12

Updated by Victor Julien 3 months ago

  • Private changed from Yes to No
Actions

Also available in: Atom PDF