detect/dataset: delay set operation after signature full match #11662
Conversation
The set operation of dataset keyword was done even if signature did not fully match. This patch changes the behavior of the dataset keyword to do a match and a post match for the set operation. In the match, the buffer data that needs to end up in the set is captured and in post match the dataset is updated (if ever the signature is fully matching). Ticket: OISF#5576
| const SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_POSTMATCH]; | ||
| if (smd != NULL) { | ||
| while (1) { | ||
| (void)sigmatch_table[smd->type].Match(det_ctx, p, NULL, smd->ctx); |
There was a problem hiding this comment.
Thoughts about this hack ?
There was a problem hiding this comment.
detect-engine-state-02: FAILED: got exit code -11, expected 0
DetectFilestorePostMatch detect-filestore.c:214 does not like that hack
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11662 +/- ##
===========================================
- Coverage 82.61% 70.34% -12.28%
===========================================
Files 919 919
Lines 248997 248856 -141
===========================================
- Hits 205717 175049 -30668
- Misses 43280 73807 +30527
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
SV failures to investigate ===> detect-engine-state-02: FAILED: got exit code -11, expected 0 |
|
Information: ERROR: QA failed on SURI_TLPW2_single_alerts_cmp. ERROR: QA failed on SURI_TLPW2_autofp_alerts_cmp. ERROR: QA failed on SURI_TLPR1_alerts_cmp. ERROR: QA failed on IPS_AFP_drop_chk.
Pipeline 22274 |
|
Continued in #11704 |
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5576
Describe changes:
SV_BRANCH=OISF/suricata-verify#2000
#11623 with rebase to get greener CI
Side note: the limitation described for flowvar in https://redmine.openinfosecfoundation.org/issues/7197 also applies here to dataset, and needs a bigger design...
Draft : is it okay to get this in with this limitation ? As it already improves some cases ?
And could we run postmatch clean stuff if there is no complete match...