Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Output notx 6846 backport7 v3 #11126

Closed
wants to merge 4 commits into from
Closed

Output notx 6846 backport7 v3 #11126

wants to merge 4 commits into from

Commits on May 23, 2024

  1. output: do not use tx id 0 when there is no tx 

    Ticket: 6846

This led to packet rules logging irrelevant app-layer data

(cherry picked from commit 910f6af)
    @catenacyber
    catenacyber committed May 23, 2024
    Configuration menu
    Copy the full SHA
    aa6ca73 View commit details
    Browse the repository at this point in the history

  2. output/alert: check flag before logging app-layer 

    Ticket: 6846
(cherry picked from commit 2b4e102)
    @catenacyber
    catenacyber committed May 23, 2024
    Configuration menu
    Copy the full SHA
    dafd26b View commit details
    Browse the repository at this point in the history

  3. detect: use direction-based tx for app-layer logging 

    When we only have stream matches.

Ticket: 6846

This solves the case where another transaction was created
by parsing data in the other direction, before running the
detection.

Like
1. get data in direction 1
2. acked data: parse it, but do not run detection in dir 1
3. other data in direction 2
4. other data acked : parse it and create new tx,
then run detection for direction 1 with data from first packet

(cherry picked from commit 7274ad5)
    @catenacyber
    catenacyber committed May 23, 2024
    Configuration menu
    Copy the full SHA
    d7cd2d9 View commit details
    Browse the repository at this point in the history

  4. detect: log relevant frames app-layer metadata 

    Ticket: 6973

Completes commit 2b4e102

(cherry picked from commit 9e01956)
    @catenacyber
    catenacyber committed May 23, 2024
    Configuration menu
    Copy the full SHA
    95d9828 View commit details
    Browse the repository at this point in the history