Project

General

Profile

Actions
Copy link

Optimization #7889

closed

detect/integers: move keywords from C to rust

Added by Philippe Antoine 2 months ago. Updated 13 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

git grep ByteExtractStringUint src/detect*.c seems to show 2 http2 keywords like error_code and frame_type and ike-chosen-sa.c

On the way, use enumerations or bitflags if needed (#6723 and #6724)

Related issues 2 (1 open — 1 closed)

Related to Suricata - Task #6644: tracking: detect: integer as first-class supportIn ProgressPhilippe AntoineActions
Related to Suricata - Feature #6723: detect: review existing keywords for usage of enumerationsClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Philippe Antoine 2 months ago

  • Related to Task #6644: tracking: detect: integer as first-class support added
Actions
Copy link
 #2

Updated by Philippe Antoine 2 months ago

  • Tracker changed from Bug to Optimization
Actions
Copy link
 #3

Updated by Philippe Antoine about 2 months ago

  • Related to Feature #6723: detect: review existing keywords for usage of enumerations added
Actions
Copy link
 #4

Updated by Philippe Antoine about 2 months ago

See usage of StringParseUint or ByteExtractStringUint

Actions
Copy link
 #5

Updated by Philippe Antoine about 2 months ago

ike-chosen-sa is not a pure integer,

typedef struct {
    char *sa_type;
    uint32_t sa_value;
} DetectIkeChosenSaData;

This ticket will remain about pure integers

Actions
Copy link
 #6

Updated by Philippe Antoine about 2 months ago

  • Status changed from New to In Progress

https://github.com/OISF/suricata/pull/13909 ok for all ByteExtractStringUint

Actions
Copy link
 #8

Updated by Philippe Antoine about 1 month ago

After https://github.com/OISF/suricata/pull/14043 only ip_proto will remain

Actions
Copy link
 #9

Updated by Philippe Antoine 13 days ago

Actually, I am not sure ip_proto is a good fit for the generic integer, as it gets used in signature DetectProto array, and can be used multiple times in a signature to refine (adding exclusions)

Actions
Copy link
 #10

Updated by Philippe Antoine 13 days ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #11

Updated by Philippe Antoine 13 days ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF