-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
http: move xff logging to alert object #7148
Conversation
Ticket: 4860 instead of root field
I need to update the S-V test... |
Information: QA ran without warnings. Pipeline 6590 |
Codecov Report
@@ Coverage Diff @@
## master #7148 +/- ##
==========================================
+ Coverage 78.06% 78.14% +0.07%
==========================================
Files 628 628
Lines 185266 185272 +6
==========================================
+ Hits 144635 144783 +148
+ Misses 40631 40489 -142
Flags with carried forward coverage won't be shown. Click here to find out more. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me. I think the SV PR should be split so this can be merged without the schema stuff.
Done cf OISF/suricata-verify#797 and OISF/suricata-verify#796 |
Merged in #7187, thanks! |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4860
but also https://redmine.openinfosecfoundation.org/issues/1369
Describe changes:
alert.xff
suricata-verify-pr: 796
OISF/suricata-verify#796
Replaces #7051 with moving into alert instead of taking care of http stuff