Project

General

Profile

Actions
Copy link

Bug #6973

closed

detect: log relevant frames app-layer metdata

Added by Juliana Fajardini Reichow 6 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Proposed patch already exists (cf https://github.com/OISF/suricata/pull/10924), but was suggested that it had its own ticket

Subtasks 2 (0 open — 2 closed)

Bug #6974: detect: log relevant frames app-layer metdata (6.0.x backport)RejectedPhilippe AntoineActions
Bug #6975: detect: log relevant frames app-layer metdata (7.0.x backport)ClosedPhilippe AntoineActions

Related issues 2 (0 open — 2 closed)

Related to Suricata - Bug #6846: alerts: wrongly using tx id 0 when there is no txClosedPhilippe AntoineActions
Related to Suricata - Security #6900: http2: timeout logging headersClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Juliana Fajardini Reichow 6 months ago

  • Related to Bug #6846: alerts: wrongly using tx id 0 when there is no tx added
Actions
Copy link
 #2

Updated by OISF Ticketbot 6 months ago

  • Subtask #6974 added
Actions
Copy link
 #3

Updated by OISF Ticketbot 6 months ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #4

Updated by OISF Ticketbot 6 months ago

  • Subtask #6975 added
Actions
Copy link
 #5

Updated by OISF Ticketbot 6 months ago

  • Label deleted (Needs backport to 7.0)
Actions
Copy link
 #6

Updated by Philippe Antoine 6 months ago

Current master situation :
app-layer data does not get logged for frames, since commit 2b4e10224eaebb613352e9b82556b60035d032a1
Before that, and in main7, app-layer data gets logged, but we log tx id 0 if no specific tx was specified.

Also, the lack of tests suggest that there are many protocols which do not set the tx id for their frames...
Which may be due to the unfriendliness of the rust API to create anew frame with a known tx id...

Actions
Copy link
 #7

Updated by Philippe Antoine 6 months ago

  • Status changed from New to In Progress
Actions
Copy link
 #8

Updated by Philippe Antoine 6 months ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #9

Updated by Philippe Antoine 6 months ago

Actions
Copy link
 #10

Updated by Philippe Antoine 6 months ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #11

Updated by Philippe Antoine 5 months ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #12

Updated by Victor Julien 4 months ago

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom PDF