(7.0.x backport) Applayer truncate 7044/v3 #11898
Open
+27
−91
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
With the latest brew changes, a virtualenv is required to install pyyaml. (cherry picked from commit 2b16369)
as its functionality is already covered by the generic code. This leaves APP_LAYER_PARSER_TRUNC_TC and APP_LAYER_PARSER_TRUNC_TS to avoid introducing any breaking changes. FlowGetDisruptionFlags sets STREAM_DEPTH flag in case the respective stream depth was reached. This flag tells that whether all the open files should be truncated or not. Bug 7044
truncate fn is only active and used by dcerpc and smb parsers. In case stream depth is reached for any side, truncate fn is supposed to set the tx entity (request/response) in the same direction as complete so the other side is not forever waiting for data. However, whether the stream depth is reached is already checked by AppLayerParserGetStateProgress fn which is called by: - DetectTx - DetectEngineInspectBufferGeneric - AppLayerParserSetTransactionInspectId - OutputTxLog - AppLayerParserTransactionsCleanup and, in such a case, StateGetProgressCompletionStatus is returned for the respective direction. This fn following efc9a7a, always returns 1 as long as the direction is valid meaning that the progress for the current direction is marked complete. So, there is no need for the additional callback to mark the entities as done in case of depth or a gap. Remove all calls to the truncate fn but leave the registration fn intact to avoid introducing any breaking API changes. Bug 7044
inashivb
changed the title
|
Information: QA ran without warnings. Pipeline 23040 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7046
Previous PR: #11891
Changes since v2:
Note: These were not clean cherry-picks and are different from master so didn't use
-x