Discard truncate fn/v2 #11411
Closed
Discard truncate fn/v2 #11411
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
truncate fn is only active and used by dcerpc and smb parsers. In case stream depth is reached for any side, truncate fn is supposed to set the tx entity (request/response) in the same direction as complete so the other side is not forever waiting for data. However, whether the stream depth is reached is already checked by AppLayerParserGetStateProgress fn which is called by: - DetectTx - DetectEngineInspectBufferGeneric - AppLayerParserSetTransactionInspectId - OutputTxLog - AppLayerParserTransactionsCleanup and, in such a case, StateGetProgressCompletionStatus is returned for the respective direction. This fn following efc9a7a, always returns 1 as long as the direction is valid meaning that the progress for the current direction is marked complete. So, there is no need for the additional callback to mark the entities as done in case of depth or a gap. Remove all such glue code and callbacks for truncate fns. Bug 7044
victorjulien
reviewed
Jul 3, 2024
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #11411 +/- ##
==========================================
- Coverage 82.45% 82.42% -0.04%
==========================================
Files 938 938
Lines 248036 247976 -60
==========================================
- Hits 204523 204397 -126
- Misses 43513 43579 +66
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 21357 |
catenacyber
reviewed
Jul 4, 2024
|
Commit removing Truncate looks good to me (besides need to remove Other commit looks suspicious... I guess it is ok but it needs more explanations... |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7044
SV_BRANCH=OISF/suricata-verify#1953
Previous PR: #11393
Changes since v1:
TODO:
smbglue code is removed but the truncate fn still exists as it is used at several places. Nothing was affected on tests locally but would like to see if it has an impact in the bigger QA.