Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

output/alert: rewrite code for app-layer properties #9499

Closed

Conversation

catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3827
preliminary work for https://redmine.openinfosecfoundation.org/issues/5053 and app-layer plugins
preliminary work for https://redmine.openinfosecfoundation.org/issues/5977 as well
Part of #8961

Describe changes:

  • Fix setup-app-layer script so that it adds app-layer metadata to alerts

After that, there is still from #8961

  • addition of protocols missing alert metadata (like krb5) + behavioral change for dns alert metadata
  • reusing these SimpleTxLogFunc from a JsonGenericLogger to remove many C files

#9252 with some renaming as per code review + reusing code for output-json-file.c

@suricata-qa
Copy link

WARNING:

field baseline test %
build_asan

Pipeline 15991

Especially fix setup-app-layer script to not forget this part

Ticket: OISF#3827
@codecov
Copy link

codecov bot commented Sep 18, 2023

Codecov Report

Merging #9499 (1e77969) into master (af4bb91) will decrease coverage by 0.02%.
The diff coverage is 96.47%.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #9499      +/-   ##
==========================================
- Coverage   82.18%   82.16%   -0.02%     
==========================================
  Files         968      968              
  Lines      274203   274059     -144     
==========================================
- Hits       225352   225181     -171     
- Misses      48851    48878      +27     
Flag Coverage Δ
fuzzcorpus 64.02% <96.47%> (-0.06%) ⬇️
suricata-verify 60.87% <95.29%> (-0.03%) ⬇️
unittests 62.91% <0.00%> (+0.03%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

CANCELED:

| field | baseline | test | % |
|--|--|--|--| Pipline CANCELED. Reruns require manual intervention.

Pipeline 16004

@victorjulien victorjulien marked this pull request as draft September 19, 2023 04:24
@catenacyber
Copy link
Contributor Author

Why did you mark this as draft ? It is ready for me...

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 16042

@catenacyber
Copy link
Contributor Author

Replaced by #9511

@victorjulien
Copy link
Member

Why did you mark this as draft ? It is ready for me...

Messy PR history with failures, force pushes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants