Skip to content

Conversation

@catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5044

Describe changes:

  • adds a count option to multi-buffers, behaving like a keyword but syntax is email.received: count <3; instead of email.received; count: <3;
  • adds other modes to multi-buffers like all, all_or_absent, nb`, and precise indexing

SV_BRANCH=OISF/suricata-verify#2634

Draft :

  • Feedback about general design ?

#14279 needed rebase, #14345 good branch rebased

TODOs :

  • update doc if design is agreed
  • add support for all multi-buf keywords
  • add more tests
  • rustfmt removes one line in mod.rs

Also rename parse_uint_count as parse_multi_count

This allows to prepare multi-buffers using this code
As for multi-integers, multi-buffers can now have the following
arguments
- count
- nb
- precise index
- all

Ticket: 5044
@codecov
Copy link

codecov bot commented Nov 18, 2025

Codecov Report

❌ Patch coverage is 68.33333% with 76 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.18%. Comparing base (626027a) to head (45d9fbb).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #14346      +/-   ##
==========================================
- Coverage   84.20%   84.18%   -0.02%     
==========================================
  Files        1012     1013       +1     
  Lines      261769   261981     +212     
==========================================
+ Hits       220415   220552     +137     
- Misses      41354    41429      +75     
Flag Coverage Δ
fuzzcorpus 63.23% <21.79%> (-0.06%) ⬇️
livemode 18.71% <5.55%> (-0.02%) ⬇️
pcap 44.59% <10.68%> (-0.06%) ⬇️
suricata-verify 64.97% <68.10%> (+<0.01%) ⬆️
unittests 59.19% <18.06%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 28484

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants