detect/entropy: Unique flowvar names #14008
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Issue: 7814
Support unique flow variable names for entropy-related values.
Since this is a breaking change from Suricata 8, unique names
are configurable (default value off) with this setting
logging:
entropy:
make-unique: on
When `make-unique` is on, entropy-related flow variable names are
structured as:
sid:<sid>;buffer:<buffer>;instance:<instance>
Instance is a small integer value corresponding to the number of
entropy values in the rule. The first entropy usage will create a flow
variable with an instance value of 1; the second will use 2, and so
on. This is necessary to disambiguate the flow variable names.
When `make-unique` is off (default = off), this format is used:
<sticky_buffer>
Discuss the new configuration variable that provides unique names for entropy values in logging output: logging.entropy.make-unique Issue: 7814
jlucovsky
requested review from
a team,
jufajardini and
victorjulien
as code owners
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
| tok = strtok_r(NULL, ";", &saveptr); | ||
| } | ||
| SCFree(tmp_var); |
Check failure
Code scanning / CodeQL
Potential double free Critical
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #14008 +/- ##
==========================================
- Coverage 83.87% 83.84% -0.03%
==========================================
Files 1011 1011
Lines 275671 275729 +58
==========================================
- Hits 231207 231195 -12
- Misses 44464 44534 +70
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Continued in #14009 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Continuation of #14006
Use unique variable names for each flowvar as they come from a global
namespace. The chosen name is:
sid:<signature_id>;buffer:<buffer-name>;instance:<instance#>Describe changes:
Entropy values will be logged into an array named
entropy.Each array element will look like this:
Updates:
logging.entropy.make-uniquesid:<signature_id>;buffer:<buffer-name>;instance:<instance#>Issue: 7814
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7814
Provide values to any of the below to override the defaults.
link to the pull request in the respective
_BRANCHvariable.SV_REPO=
SV_BRANCH=OISF/suricata-verify#2588
SU_REPO=
SU_BRANCH=