Project

General

Profile

Actions
Copy link

Optimization #7889

closed
PA PA

detect/integers: move keywords from C to rust

Optimization #7889: detect/integers: move keywords from C to rust

Added by Philippe Antoine 7 months ago. Updated 5 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

git grep ByteExtractStringUint src/detect*.c seems to show 2 http2 keywords like error_code and frame_type and ike-chosen-sa.c

On the way, use enumerations or bitflags if needed (#6723 and #6724)

Related issues 2 (1 open — 1 closed)

Related to Suricata - Task #6644: tracking: detect: integer as first-class supportIn ProgressPhilippe AntoineActions
Related to Suricata - Feature #6723: detect: review existing keywords for usage of enumerationsClosedPhilippe AntoineActions

PA Updated by Philippe Antoine 7 months ago Actions
Copy link
 #1

  • Related to Task #6644: tracking: detect: integer as first-class support added

PA Updated by Philippe Antoine 7 months ago Actions
Copy link
 #2

  • Tracker changed from Bug to Optimization

PA Updated by Philippe Antoine 6 months ago Actions
Copy link
 #3

  • Related to Feature #6723: detect: review existing keywords for usage of enumerations added

PA Updated by Philippe Antoine 6 months ago Actions
Copy link
 #4

See usage of StringParseUint or ByteExtractStringUint

PA Updated by Philippe Antoine 6 months ago Actions
Copy link
 #5

ike-chosen-sa is not a pure integer,

typedef struct {
    char *sa_type;
    uint32_t sa_value;
} DetectIkeChosenSaData;

This ticket will remain about pure integers

PA Updated by Philippe Antoine 6 months ago Actions
Copy link
 #6

  • Status changed from New to In Progress

https://github.com/OISF/suricata/pull/13909 ok for all ByteExtractStringUint

PA Updated by Philippe Antoine 6 months ago Actions
Copy link
 #8

After https://github.com/OISF/suricata/pull/14043 only ip_proto will remain

PA Updated by Philippe Antoine 5 months ago Actions
Copy link
 #9

Actually, I am not sure ip_proto is a good fit for the generic integer, as it gets used in signature DetectProto array, and can be used multiple times in a signature to refine (adding exclusions)

PA Updated by Philippe Antoine 5 months ago Actions
Copy link
 #10

  • Status changed from In Progress to In Review

PA Updated by Philippe Antoine 5 months ago Actions
Copy link
 #11

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: PDF Atom