Skip to content

Conversation

@catenacyber
Copy link
Contributor

@catenacyber catenacyber commented Sep 9, 2025

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7480

Describe changes:

  • detect/integers: generalize multi-integers

SV_BRANCH=OISF/suricata-verify#2644

Draft :
Feedback welcome about general design

TODOs:

  • need to do all keywords
  • need more SV test(s) esp wrt to tx progress
  • maybe add more features, that is more variants to DetectUintIndex, like

List of keywords to do : ./src/suricata --list-keywords=csv | grep uint | grep multi | cut -d\; -f1

  • nfs_procedure (C inclusive)
  • filesize (file iterator)
  • vlan.id (c prefilter)
  • enip.cip_attribute (array of arrays)
  • enip.cip_class (array of arrays)
  • enip.cip_status (array of arrays)
  • enip.cip_instance (array of arrays)
  • enip.cip_extendedstatus (array of arrays)
  • mqtt.reason_code (2 arrays ...)
  • mqtt.flags (flags)
  • mqtt.connect.flags (flags)

@catenacyber catenacyber added this to the 9.0 milestone Sep 9, 2025
@catenacyber catenacyber force-pushed the detect-integers-multi-7480-v2 branch from 366e49f to 01aef0e Compare September 9, 2025 14:28
@codecov
Copy link

codecov bot commented Sep 9, 2025

Codecov Report

❌ Patch coverage is 85.88235% with 24 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.73%. Comparing base (0662736) to head (e4d37a3).
⚠️ Report is 17 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #13823      +/-   ##
==========================================
+ Coverage   83.71%   83.73%   +0.01%     
==========================================
  Files        1011     1011              
  Lines      275116   275097      -19     
==========================================
+ Hits       230321   230345      +24     
+ Misses      44795    44752      -43     
Flag Coverage Δ
fuzzcorpus 63.03% <71.97%> (+0.02%) ⬆️
livemode 19.11% <0.00%> (+0.11%) ⬆️
pcap 44.73% <2.54%> (+0.04%) ⬆️
suricata-verify 65.10% <74.19%> (+0.01%) ⬆️
unittests 59.18% <33.92%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 27366

@catenacyber
Copy link
Contributor Author

Next in #13838

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants