-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
detect/transform: from_base64 transform #11300
Conversation
Refactor utility functions/definitions from the byte_math module into the parser module. This includes parse_var and ResultValue Issue: 6487
Issue: 6487 Implement from_base64 option parsing in Rust. The Rust module also contains unit tests.
Issue: 6487 Implement the from_base64 transform: [bytes value] [offset value] [mode strict|rfc4648|rfc2045] The value for bytes and offset may be a byte_ variable or an unsigned integer.
Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)
Issue: 6487 To avoid ambiguity, a single definition for base 64 decoding modes will be used. The Rust base64 transform contains the definitions for the existing mode types: Strict, RFC2045, RFC4648
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11300 +/- ##
==========================================
- Coverage 82.45% 77.69% -4.77%
==========================================
Files 961 963 +2
Lines 251710 252155 +445
==========================================
- Hits 207552 195915 -11637
- Misses 44158 56240 +12082
Flags with carried forward coverage won't be shown. Click here to find out more. |
Information: ERROR: QA failed on SURI_TLPW2_autofp_suri_time. ERROR: QA failed on SURI_TLPW1_suri_time. ERROR: QA failed on SURI_TLPR1_suri_time.
Pipeline 21083 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you review the ASAN SV report ?
Also maybe we want https://redmine.openinfosecfoundation.org/issues/7065 first
We do have 2 pure rust base64 decoders duplicates with the C ones...
I'll work on this next week likely and will make the updates as needed to this keyword. |
Continued in #11346 |
Continuation of #11299
This PR provides the
from_base64
transform used to match on content decoded with base64 using the mode (default rfc4648).Link to redmine ticket: 6487
Describe changes:
from_base64
Updates:
Provide values to any of the below to override the defaults.
To use a pull request use a branch name like
pr/N
whereN
is thepull request number.
Alternatively,
SV_BRANCH
may also be a link to anOISF/suricata-verify pull-request.
SV_BRANCH=OISF/suricata-verify#1670