Project

General

Profile

Actions

Optimization #5545

open

prefilter keyword: increase code coverage

Added by Juliana Fajardini Reichow about 2 years ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
Outreachy

Description

  • This is an onboarding task for the Outreachy project for increasing code coverage for our rule keywords ***

We have many keywords that have the 'prefilter' feature, for which the prefilter keyword itself isn't yet tested.

This task encompasses the simpler cases, for which one will have to add the 'prefilter' keyword to an already existing suricata-verify test that covers the rule keyword (this would be the case for 'filemagic' for instance). Some cases would also require creating the SV tests themselves. Those will be covered by a different ticket.

Examples of tests for 'filemagic':
- filestore-filecontainer-http
- filestore-filecontainer-smb

How do we know that the prefilter for filemagic needs coverage? We check https://app.codecov.io/gh/OISF/suricata/blob/master/src/detect-filemagic.c

(An example of a case that does not fit in this task is the fragbits keyword. While it supports 'prefilter', we must first add coverage to the 'fragbits' keyword itself: https://app.codecov.io/gh/OISF/suricata/blob/master/src/detect-fragbits.c)


Related issues 1 (1 open0 closed)

Related to Suricata - Documentation #5543: userguide: document which keywords accept the prefilter keywordNewOISF DevActions
Actions

Also available in: Atom PDF