Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

engine events: fix event names in rules or enum - v2 #12079

Closed
wants to merge 4 commits into from

Conversation

jasonish
Copy link
Member

@jasonish jasonish commented Nov 1, 2024

Changes:

  • Update rule rev.

Fixes these warnings when using engine events:

Warning: detect-app-layer-event: app-layer-event keyword's protocol "dns" doesn't have event "not_a_request" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]
Warning: detect-app-layer-event: app-layer-event keyword's protocol "dns" doesn't have event "not_a_response" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]
Warning: detect-app-layer-event: app-layer-event keyword's protocol "http2" doesn't have event "invalid_http1_settings" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]
Warning: detect-app-layer-event: app-layer-event keyword's protocol "ike" doesn't have event "weak_crypto_nodh" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]
Warning: detect-app-layer-event: app-layer-event keyword's protocol "ike" doesn't have event "weak_crypto_noauth" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]
Warning: detect-app-layer-event: app-layer-event keyword's protocol "modbus" doesn't have event "invalid_unit_identifier" registered [DetectAppLayerEventSetup:detect-app-layer-event.c:262]

Ticket: https://redmine.openinfosecfoundation.org/issues/7361

- not_a_request to not_request
- not_a_response to not_reponse

Ticket: OISF#7361
- weak_crypto_nodh -> weak_crypto_no_dh
- weak_crypto_noauth -> weak_crypto_no_auth

Ticket: OISF#7361
The event "modbus.invalid_unit_identifier" no longer exists.

Ticket: OISF#7361
Rename InvalidHTTP1Settings to InvalidHttp1Settings so it gets the
expected name transformation of "invalid_http1_settings".

Ticket: OISF#7361
Copy link

codecov bot commented Nov 1, 2024

Codecov Report

Attention: Patch coverage is 33.33333% with 2 lines in your changes missing coverage. Please review.

Project coverage is 83.37%. Comparing base (b1e7917) to head (c2d3bac).
Report is 12 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #12079   +/-   ##
=======================================
  Coverage   83.37%   83.37%           
=======================================
  Files         910      910           
  Lines      257556   257556           
=======================================
  Hits       214748   214748           
  Misses      42808    42808           
Flag Coverage Δ
fuzzcorpus 61.54% <33.33%> (ø)
livemode 19.41% <0.00%> (-0.01%) ⬇️
pcap 44.45% <0.00%> (-0.06%) ⬇️
suricata-verify 62.77% <0.00%> (+0.02%) ⬆️
unittests 59.35% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 23239

@victorjulien
Copy link
Member

I think this looks good as a fix, but I was wondering if we should fix the rules or the code? We can make the existing rules work by changing the event names in the code, right? Or would we risk breaking ppls working rules that way?

@jasonish
Copy link
Member Author

jasonish commented Nov 4, 2024

I think this looks good as a fix, but I was wondering if we should fix the rules or the code? We can make the existing rules work by changing the event names in the code, right? Or would we risk breaking ppls working rules that way?

Risk either way:

  • If we change the code, the existing broken rules will start to work. Probably ideal, so probably better fixing the code
  • But if they somehow managed to figure out these rules were broken and fixed them, then they'd break.

@victorjulien victorjulien added this to the 8.0 milestone Nov 4, 2024
@victorjulien
Copy link
Member

Merged in #12088, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants