app-layer: update flow counter if an alproto is detected #12454
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If alproto for the current direction was not detected but the opposite side was successfully detected, if the Pattern Matching and Pattern Probing on the flow was also successfully done and the current direction's alproto is still unknown, a decoder event is set to indicate that the protocol detection only happened in one direction. This event is set after having sent the current data to the applayer parser. Now, the respective applayer parser may or may not successfully parse the data. However, the alproto on flow is already set from the other direction so there will be a flow event generated by Suricata. In order to keep this consistent with the stats, also make sure to increment the flow counter when the decode event is set so that the flow counter is incremented irrespective of the parsing status reported by the applayer parser. This patch makes stats for several specific applayer flow count equal to the number of flow events logged for those specific applayer protocols. Bug 7238
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #12454 +/- ##
=======================================
Coverage 80.63% 80.63%
=======================================
Files 920 920
Lines 258704 258704
=======================================
+ Hits 208595 208603 +8
+ Misses 50109 50101 -8
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
WARNING:
Pipeline 24327 |
|
Passed my QA. Ran this PR with SV master. Local pipeline 5212, run 697. |
|
Do you have SV tests that get improved and can be tested ? |
Sorry not seeing any changes in public s-v tests :( |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7238
Previous PR: #12415
Changes since v1: