detect: add ldap operation keywords - v3 #12435
Conversation
ldap.request.operation matches on Lightweight Directory Access Protocol request operations It is an unsigned 8-bit integer Doesn't support prefiltering Ticket: OISF#7453
ldap.responses.operation matches on Lightweight Directory Access Protocol response operations It is an unsigned 8-bit integer Doesn't support prefiltering Ticket: OISF#7453
ldap.responses.count matches on the number of LDAP responses It is an unsigned 32-bit integer Doesn't support prefiltering Ticket: OISF#7453
AkakiAlice
requested review from
jasonish,
jufajardini and
victorjulien
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12435 +/- ##
==========================================
+ Coverage 80.62% 80.63% +0.01%
==========================================
Files 920 921 +1
Lines 258697 258921 +224
==========================================
+ Hits 208566 208793 +227
+ Misses 50131 50128 -3
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Could you check CI failures :
|
There was a problem hiding this comment.
Thanks for the work, there is at least CI to fix
CI : some failures
Code : checking
Commits segmentation : ok, the rustfmt commit could come first
Commit messages : good, we can add the json schema field that map to the added keywords
Git ID set : looks fine for me
CLA : you already contributed
Doc update : good
Redmine ticket : ok
Rustfmt : good :-)
Tests : nice, thanks
Dependencies added: none
| } | ||
|
|
||
| impl ProtocolOp { | ||
| pub fn to_u8(&self) -> u8 { |
There was a problem hiding this comment.
@jasonish do you see a rustier way ?
| use std::str::FromStr; | ||
|
|
||
| #[derive(Debug, PartialEq)] | ||
| enum LdapIndex { |
There was a problem hiding this comment.
Did I create a ticket to make this struct generic ? (not specific to ldap)
| LdapIndex::Index(idx) => { | ||
| let index = if idx < 0 { | ||
| // negative values for backward indexing. | ||
| tx.responses.len() + idx as usize |
There was a problem hiding this comment.
@jasonish ideas on how to make this ?
I see
((tx.responses.len() as i32) + idx) as usize
|
Replaced by: #12447 |
Ticket: #7453
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/projects/suricata/issues
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7453
Description:
ldap.request.operation,ldap.responses.operationandldap.responses.countkeywords.Changes:
SV_BRANCH=OISF/suricata-verify#2243
Previous PR= #12343