detect: add keywords for LDAP attributes - v1 #12708
Conversation
ldap.request.attribute_type matches on LDAP attribute type/description This keyword maps the following eve fields: ldap.request.search_request.attributes[] ldap.request.modify_request.changes[].modification.attribute_type ldap.request.add_request.attributes[].name ldap.request.compare_request.attribute_value_assertion.description It is a sticky buffer Supports prefiltering Ticket: OISF#7533
ldap.responses.attribute_type matches on LDAP attribute type/description This keyword maps the eve field ldap.responses[].search_result_entry.attributes[].type It is a sticky buffer Supports prefiltering Ticket: OISF#7533
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12708 +/- ##
========================================
Coverage 80.71% 80.72%
========================================
Files 936 936
Lines 259393 259528 +135
========================================
+ Hits 209368 209502 +134
- Misses 50025 50026 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Thanks for the work,
CI : ✅
Code : looking now
Commits segmentation : ok
Commit messages : good, we could mention multi-buffer in the commit message as well
Git ID set : looks fine for me
CLA : you already contributed
Doc update : ok, ldap.request.attribute_type nd there is also the multi-buffer page to update ;-)
Redmine ticket : ok
Rustfmt : could you add the rustfmt commit ?
Tests : approved SV PR
Dependencies added: none
| - ``ldap.request.search_request.attributes[]`` | ||
| - ``ldap.request.modify_request.changes[].modification.attribute_type`` | ||
| - ``ldap.request.add_request.attributes[].name`` | ||
| - ``ldap.request.compare_request.attribute_value_assertion.description`` |
|
Code all good :-) |
|
Besides the doc point, this is good. If you want to add the keyword on |
Ticket: #7533
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/issues/7533
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7533
Description:
ldap.request.attribute_typeandldap.responses.attribute_typeSV_BRANCH=OISF/suricata-verify#2331