Conversation
Ticket: 8336 When a packet has flag PKT_PSEUDO_DETECTLOG_FLUSH, we do not expect to rerun detection on the same tx and direction again So, do not set mpm_in_progress whose purpose is to not store the state as we will run again. Allows transactional bidirectional signatures to work on thse log+flush pair of packets
Ticket: 8336 At the end of a TLS handshake, in IDS mode, the client acks, and we parse the server hello and use tls.encryption-handling to know what to do next (for example bypass) Everything is parsed, but we have not run detection yet on neither side. So, in IDS mode, we need to first flush the client side, as the comment on the function already stated.
As we expect a log+flush packet in the other direction Ticket: 8336
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #15087 +/- ##
==========================================
- Coverage 82.59% 82.58% -0.01%
==========================================
Files 990 990
Lines 271761 271763 +2
==========================================
- Hits 224465 224444 -21
- Misses 47296 47319 +23
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: QA ran without warnings. Pipeline = 30469 |
1 similar comment
|
Information: QA ran without warnings. Pipeline = 30469 |
| ts ^= StreamTcpInlineMode(); | ||
| StreamTcpPseudoPacketCreateDetectLogFlush(tv, stt, p, ssn, pq, ts^0); | ||
| StreamTcpPseudoPacketCreateDetectLogFlush(tv, stt, p, ssn, pq, ts^1); | ||
| StreamTcpPseudoPacketCreateDetectLogFlush(tv, stt, p, ssn, pq, ts ^ 0); |
There was a problem hiding this comment.
I guess clang-format doesn't enforce one style here.
There was a problem hiding this comment.
This was indeed clang-format's doing, and I found it strange but 🤷
jasonish
left a comment
jasonish
left a comment
There was a problem hiding this comment.
Unsure about the mpm-in-progres change, but the rest aligns with some initial inspection I did of the issue.
Do you see another fix ? Or did you not look into transactional signatures at all ? |
Didn't look. Unsure as I didn't look into it. Not "unsure" in that I'm not sure its the best idea. |
4 participants
Link to ticket: https://redmine.openinfosecfoundation.org/issues/8336
Describe changes:
SV_BRANCH=OISF/suricata-verify#2983