Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

next/531/20240712/v1 #11488

Merged
merged 8 commits into from
Jul 12, 2024
Merged

Conversation

inashivb and others added 8 commits July 12, 2024 10:47
as its functionality is already covered by the generic code.
This removes APP_LAYER_PARSER_TRUNC_TC and APP_LAYER_PARSER_TRUNC_TS
flags as well as FlowGetDisruptionFlags sets STREAM_DEPTH flag in case
the respective stream depth was reached. This flag tells that whether
all the open files should be truncated or not.

Bug 7044
truncate fn is only active and used by dcerpc and smb parsers. In case
stream depth is reached for any side, truncate fn is supposed to set the
tx entity (request/response) in the same direction as complete so the
other side is not forever waiting for data.

However, whether the stream depth is reached is already checked by
AppLayerParserGetStateProgress fn which is called by:
- DetectTx
- DetectEngineInspectBufferGeneric
- AppLayerParserSetTransactionInspectId
- OutputTxLog
- AppLayerParserTransactionsCleanup

and, in such a case, StateGetProgressCompletionStatus is returned for
the respective direction. This fn following efc9a7a, always returns 1
as long as the direction is valid meaning that the progress for the
current direction is marked complete. So, there is no need for the additional
callback to mark the entities as done in case of depth or a gap.
Remove all such glue code and callbacks for truncate fns.

Bug 7044
Don't set an ACK value if ACK flag is no longer set. This avoids a bogus
`pkt_broken_ack` event set.

Fixes: ebf465a ("tcp: do not assign TCP flags to pseudopackets")

Ticket: OISF#7158.
Missed in the original PR, but update the commented out version to
reflect the default, and a link to the upgrade notes.
Introduce KiB, MiB and GiB. They are case sensitive as a lower case 'b'
means bits in the IEEE 1541 scheme.

KiB = 1024
MiB = 1048576
GiB = 1073741824

Ticket: OISF#1457.
Copy link
Member

@inashivb inashivb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

Copy link

codecov bot commented Jul 12, 2024

Codecov Report

Attention: Patch coverage is 98.61111% with 2 lines in your changes missing coverage. Please review.

Project coverage is 82.56%. Comparing base (090079c) to head (223a419).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11488      +/-   ##
==========================================
+ Coverage   82.52%   82.56%   +0.03%     
==========================================
  Files         938      938              
  Lines      248297   248247      -50     
==========================================
+ Hits       204917   204961      +44     
+ Misses      43380    43286      -94     
Flag Coverage Δ
fuzzcorpus 60.66% <86.66%> (+0.22%) ⬆️
livemode 18.69% <26.66%> (-0.02%) ⬇️
pcap 43.65% <73.33%> (-0.13%) ⬇️
suricata-verify 61.56% <86.66%> (+0.02%) ⬆️
unittests 59.44% <93.75%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 21503

@victorjulien victorjulien merged commit 223a419 into OISF:master Jul 12, 2024
57 checks passed
@victorjulien victorjulien deleted the next/531/20240712/v1 branch July 12, 2024 14:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants