Commit Graph

478 Commits (master)

Author SHA1 Message Date
Victor Julien e362a01f8d doc/userguide: document new threshold config options 1 year ago
Victor Julien 405491c3fc detect/detection_filter: add support for track by_flow 1 year ago
Victor Julien 3f04af7c7f doc: add thresholding by_flow 1 year ago
Jeff Lucovsky 01e20c91fb doc/transform: Correct typo 1 year ago
Jeff Lucovsky d205ff82d0 doc/transform: Describe the from_base64 transform
Issue: 6487

Document the new transform and indicate that it's the preferred way to
perform base64 decoding (preferred over base64_decode)
1 year ago
Victor Julien 3d059611c3 detect: add tls.alpn keyword
Ticket: #7108.
1 year ago
Philippe Antoine ae72376ebe detect/snmp: move keywords to rust
Ticket: 4863

On the way, convert unit test DetectSNMPCommunityTest to a SV test.

And also, make snmp.pdu_type use a generic uint32 for detection,
allowing operators, instead of just equality.
1 year ago
Victor Julien 8b42182fee doc/userguide: document iprep isset/isnotset 1 year ago
Victor Julien 2f74d435d3 doc/userguide: add more operators to iprep 1 year ago
Victor Julien 50ef646d45 doc/userguide: add noalert/alert keyword docs 1 year ago
Victor Julien c83e3285ae doc/userguide: give pcre1 to pcre2 proper heading 1 year ago
Philippe Antoine 82c03f72c3 enip: convert to rust
Ticket: 3958

- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
    enip.product_name, enip.protocol_version, enip.revision,
    enip.identity_status, enip.state, enip.serial, enip.product_code,
    enip.device_type, enip.vendor_id, enip.capabilities,
    enip.cip_attribute, enip.cip_class, enip.cip_instance,
    enip.cip_status, enip.cip_extendedstatus
1 year ago
Victor Julien 17b32f98d7 doc/userguide: fix rule container typo
Fixes: 8781e9352a ("doc/userguide: add documentation for SMTP frames")
1 year ago
Victor Julien 8781e9352a doc/userguide: add documentation for SMTP frames 1 year ago
Jason Ish 3eb8c728fd doc: update lua sandbox docs for allowed packages/functions 1 year ago
Jo Johnson ba6a976e06 doc: Initial doc for lua sandbox 1 year ago
Jo Johnson 712496bb3f lua: Remove luajit support
lua 5.4 support is not available in luajit

Ticket: #4776
1 year ago
Shivani Bhardwaj 719fda3967 doc: add description about tls.subjectaltname
Feature 5234
1 year ago
Philippe Antoine 2c305ba37e pop3: protocol detection
Ticket: #6366
1 year ago
Philippe Antoine fcdd7f000a detect: add options to app-layer-protocol keyword
Ticket: 4921

app-layer-protocol keyword accept an optional mode to precise
which protocol we want to match: toclient, toserver, final,
or original
1 year ago
Shivani Bhardwaj 6d92596548 doc: add note about fast_pattern w base64_data
Bug 5220
1 year ago
jason taylor abb74245cc doc: update normalization notes
Ticket: #6781

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 5dacf4d92b doc: add http.connection ref and fix location
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Victor Julien fcca5c7514 detect/iprep: update doc about 0 value
A value of 0 was already allowed by the rule parser, but didn't
actually work.

Bug: #6834.
1 year ago
jason taylor aa919f8081 doc: update flowbits information
Ticket: #6991

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Philippe Antoine 44b6aa5e4b app-layer: websockets protocol support
Ticket: 2695
1 year ago
Sascha Steinbiss 120313f4da ja4: implement for TLS and QUIC
Ticket: OISF#6379
1 year ago
Jeff Lucovsky 7a5a1e2560 doc: Describe noalert keyword
Issue: 6685
1 year ago
jason taylor 7de16809ef doc: update http keyword listing order
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8b3db3c3b5 doc: update file.name keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 49dba7bb94 doc: update file.data keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor bee3aa9709 doc: update http.response_header keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor dcb548106e doc: update http.request_header keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 3f5d228b9e doc: update http.host http.host.raw keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 739dfe5e5e doc: update http.location keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 9ddd8cf9e0 doc: update http.server keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 3af98f3b92 doc: update http.response_body keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 64760e2e75 doc: update http.response_line keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 566bc0d39c doc: update http.stat_msg keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 271321249f doc: update http.stat_code keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 71d8488cb5 doc: update http.request_body keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor c2783e9391 doc: update http.header_names keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 5eadbc2ff0 doc: update http.start keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7e65554462 doc: update http.referer keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 876dfb99ca doc: update http.content_len keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8ff06c1bc0 doc: update http.content_type keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor b2854486dd doc: update http.connection keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 75436dff9c doc: update http.accept_lang keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor f6375e487e doc: update http.accept_enc keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7e3288f5a7 doc: update http keyword normalization notes
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 9e87d89d2e doc: update http.accept keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8307168ae7 doc: update http.user_agent keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 75c4cdfa1c doc: update http.cookie keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7a28874c8d doc: update http.header keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor b3af723486 doc: remove legacy description/duplicated data
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 292b3eb9b3 doc: update http.request_line keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor c7f351bd6e doc: update http.protocol keyword documentation
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 2d0ceedeba doc: update urilen keyword documentation
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor ef118aa582 doc: remove legacy uricontent information
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 96e8c10276 doc: update http.uri and http.uri.raw keywords
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor bf192926a8 doc: update http.method keyword
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 0cce5ba447 doc: add http keyword links
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor fd46175203 doc: update http primer information
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 54fd35c5b4 doc: remove legacy tables and image references
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Hadiqa Alamdar Bukhari 3aa313d0c5 dns: add dns.rcode keyword
dns.rcode matches the rcode header field in DNS messages
It's an unsigned integer
valid ranges = [0-15]
Does not support prefilter
Supports matches in both flow directions

Task #6621
1 year ago
Hadiqa Alamdar Bukhari 4b81851097 dns: add dns.rrtype keyword
It matches the rrtype field in DNS
It's an unsigned integer match
valid ranges = [0-65535]
Does not support prefilter
Supports flow in both directions
Feature #6666
1 year ago
Philippe Antoine e22217bda8 doc: there is no right shift for integer bitmasks
Ticket: 6628
1 year ago
Philippe Antoine f6e1a20215 detect: dns.opcode as first-class integer
Ticket: 5446

That means it can accept ranges
1 year ago
Juliana Fajardini 244a35d539 userguide: fix explanation about bsize ranges
Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.

Cf. from uint.rs:

    DetectUintMode::DetectUintModeRange => {
        if val > x.arg1 && val < x.arg2 {
            return true;
        }
    }

Task #6708
2 years ago
Philippe Antoine b8bc2c7e0f doc: integer keywords
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
2 years ago
Jason Ish 8bf8131c31 doc: note what version "requires" was added in 2 years ago
jason taylor 3cb7112aa5 detect: update smb.version keyword
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Eloy Pérez González a4901a1f70 smb: add smb.keyword documentation 2 years ago
Lukas Sismis 6e4cc79b39 doc: remove references to prehistoric versions
Remove references that are mentioning Suricata 3 or less
As a note - only one Suricata 4 reference found:
(suricata-yaml.rst:"In 4.1.x")
Fast pattern selection criteria can be internally found by inspecting
SupportFastPatternForSigMatchList and SigTableSetup functions.

Ticket: #6570
2 years ago
Philippe Antoine adf5e6da7b detect: strip_pseudo_headers transform
Ticket: 6546
2 years ago
Philippe Antoine 4933b817aa doc: fix byte_test examples
As this keyword has 4 mandatory arguments, and some examples
had only three...

Ticket: 6629
2 years ago
Jason Ish 5d5b0509a5 requires: add requires keyword
Add a new rule keyword "requires" that allows a rule to require specific
Suricata versions and/or Suricata features to be enabled.

Example:

  requires: feature geoip, version >= 7.0.0, version < 8;
  requires: version >= 7.0.3 < 8
  requires: version >= 7.0.3 < 8 | >= 8.0.3

Feature: #5972

Co-authored-by: Philippe Antoine <pantoine@oisf.net>
2 years ago
Jason Ish c1a8dbcb72 doc/userguide: document dns.query.name, dns.answer.name
With some other minor cleanups in the DNS keyword section.
2 years ago
Shivani Bhardwaj b9540df5ad doc: clarify IP-only with iprep 2 years ago
jason taylor fc81c99b58 doc: add file.name information to smtp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 9d1ad0187e doc: add file.name information to nfs keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 327ba7397a doc: add file.name information to smb keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e4077b8803 doc: update ftp keyword doc example rule format
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bb1f7575d3 doc: add file.name information to ftp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bbc17b1c7d doc: add file.name information to http keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Philippe Antoine 32cce122e1 detect: header_lowercase transform
Ticket: 6290
2 years ago
jason taylor c50002978d doc: update file.data keyword documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Sascha Steinbiss 0c55fe3515 detect: add mqtt.connect.protocolstring
Ticket:  OISF#6396
2 years ago
Victor Julien 6b2c33990f doc/userguide: add tag keyword page
Ticket: #3015.
2 years ago
Jeff Lucovsky 9ee55d2394 doc/transform: Document case-changing transforms.
Issue: 6439
2 years ago
Philippe Antoine ab9b6e30b1 detect: adds flow integer keywords
Ticket: #6164

flow.pkts_toclient
flow.pkts_toserver
flow.bytes_toclient
flow.bytes_toserver
2 years ago
jason taylor 535938d7f6 doc: add tls.cert_chain_len docs
Ticket: #6386

Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Travis Green 96a0e7016f doc: add tcp flags documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor be324d7856 doc: update file.magic information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 008cc78a03 doc: update fileext keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e99b1787a2 doc: update file.name keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Andreas Herz da68692547 doc: dataset - add type to be mandatory 2 years ago
jason taylor c95fce39f0 doc: add multi buffer support note to keyword docs
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 88960e909d doc: add multiple buffer matching documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Jeff Lucovsky 47e268d609 detect/byte_math: Document bytes variable name
Issue: 6145

Document that byte_math accepts a variable name for bytes (optional)
2 years ago
Jeff Lucovsky 3a4554fc2b detect/byte-jump: Document var usage for nbytes
Issue: 6105
2 years ago
Jeff Lucovsky 73b943276e doc/byte_test: Document byte_test variable usage
Issue: 6144

This commit updates the byte_test documentation now that a variable name
can be used for the nbytes value.
2 years ago
Shivani Bhardwaj b6f8f5eb3b doc/http: use "sticky buffer" where applicable 2 years ago
Jason Ish 14daa42e0b doc/userguide: dataset upgrade notes 2 years ago
Jason Ish 4a97461f9a doc/userguide: notes about Lua rules being disabled by default 2 years ago
Philippe Antoine 415b036dca http1: implement http.request_header
So that it is generic for HTTP1 and HTTP2

Ticket: #5780
2 years ago
Philippe Antoine 7256ec8a6e detect/http2: do not escape ':' in header name or value
for keywords http.request_header and http.response_header

Ticket: #5780
2 years ago
Philippe Antoine 656554f293 http2: rename http2.header to http.request_header
Or http.response_header based on the direction

http2.header had a different behavior than http.header and this was
confusing.

Ticket: #5780
2 years ago
Eloy Pérez González b3c7130749 krb5: update krb5_msg_type keyword docs 2 years ago
Victor Julien 0903536fd6 doc: spelling
Thanks to Josh Soref.
2 years ago
Philippe Antoine 9bd2b72e2b doc: explain where tls.store stores certificates
By adding a reference/link to the doc about the suricata.yaml
config section pecifying the directory where the certificates
are stored
2 years ago
Victor Julien c0d9b3c078 doc/userguide: spelling 2 years ago
Andreas Herz 3045e75ee1 doc: add note on the hashsize recommendation for datasets 2 years ago
Philippe Antoine 59734d16a1 detect: use http.connection to client
Ticket: #5746
2 years ago
Philippe Antoine 6bc7f02e13 doc: rules can have http1 as protocol
Ticket: #5962
2 years ago
Jeff Lucovsky fd46c93a8f doc/byte_math: Add divide by 0 discussion.
Issue: 5945
2 years ago
Jeff Lucovsky 35bbdf4124 doc/content: Add limits for distance/within
Ticket: 5740
2 years ago
Shivani Bhardwaj 0f3e7761da doc: add dataset examples 2 years ago
Haleema Khan 609df1776e userguide: update tls keywords information
Ticket #5544
2 years ago
jason taylor 0632233791 userguide: update http.cookie description
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Jeff Lucovsky 197ad51138 doc: Update bsize documentation
This commit updates the bsize documentation

1. Describe what happens when "content" immediately precedes "bsize"
2. Include the operators and
3. Include examples using the operators.
3 years ago
jason taylor 9dc8fffe05 userguide: update tos keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 1d9b91a987 userguide: update fragoffset keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 7c73144988 userguide: update fragbits information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 4be9793e36 userguide: update geoip information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor e8eba6e4a1 userguide: update id keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor cfd0da133e userguide: update ipv6.hdr keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 150a04b597 userguide: update ipv4.hdr keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 298f59c2ba userguide: update ip_proto keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 6226492976 userguide: update sameip keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor f97ba44339 userguide: update ipopts keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor 9b4e6e5802 userguide: update ttl keyword information
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine ce710181f6 doc: update doc for HTTP file.data to server
Ticket: #4144

Completes e587f6792a
3 years ago
Aaron Bungay d166c48d28 docs: update for bittorrent-dht app-layer 3 years ago
Eric Leblond 9fb0137d9d doc: add reference to ipaddr in IP matching 3 years ago
Eric Leblond 3bd48d9336 detect: doc link for ip.src and ip.dst 3 years ago
Eric Leblond da8b16eaeb doc: add ip.dst and ip.src doc 3 years ago
Eric Leblond 3599cbf1c4 doc: document new dataset types
Feature: #5383
3 years ago
Eric Leblond a1a22cccd2 doc: document dataset-lookup
Ticket: #5184
3 years ago
Eric Leblond 20973e9e6b doc: add dataset-clear command
Ticket: #5184
3 years ago
Eric Leblond c5559cb68f doc: document dataset-dump command
Ticket: #5184
3 years ago
Lukas Sismis 37cf365e19 docs: remove outdated constraint of negation support for ssl_state
Commit 487cdda93d adds negation support for the SSL state.
3 years ago
Shivani Bhardwaj 2a0cb1f3da doc: update base64_decode notes 3 years ago
Eric Leblond f46f895e8d rust/smb: import NT status code for Microsoft doc
This patch updates the NT status code definition to use the status
definition used on Microsoft documentation website. A first python
script is building JSON object with code definition.

```
import json
from bs4 import BeautifulSoup
import requests

ntstatus = requests.get('https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55')

ntstatus_parsed = BeautifulSoup(ntstatus.text, 'html.parser')

ntstatus_parsed = ntstatus_parsed.find('tbody')

ntstatus_dict = {}

for item in ntstatus_parsed.find_all('tr'):
    cell = item.find_all('td')
    if len(cell) == 0:
        continue
    code = cell[0].find_all('p')
    description_ps = cell[1].find_all('p')
    description_list = []
    if len(description_ps):
        for desc in description_ps:
            if not desc.string is None:
                description_list.append(desc.string.replace('\n ', ''))
    else:
        description_list = ['Description not available']
    if not code[0].string.lower() in ntstatus_dict:
        ntstatus_dict[code[0].string.lower()] = {"text": code[1].string, "desc": ' '.join(description_list)}

print(json.dumps(ntstatus_dict))
```

The second one is generating the code that is ready to be inserted into the
source file:

```
import json

ntstatus_file = open('ntstatus.json', 'r')

ntstatus = json.loads(ntstatus_file.read())

declaration_format = 'pub const SMB_NT%s:%su32 = %s;\n'
resolution_format = '        SMB_NT%s%s=> "%s",\n'

declaration = ""
resolution = ""

text_max = len(max([ntstatus[x]['text'] for x in ntstatus.keys()], key=len))

for code in ntstatus.keys():
    text = ntstatus[code]['text']
    text_spaces = ' ' * (4 + text_max - len(text))
    declaration += declaration_format % (text, text_spaces, code)
    resolution += resolution_format % (text, text_spaces, text)

print(declaration)
print('\n')
print('''
pub fn smb_ntstatus_string(c: u32) -> String {
    match c {
''')
print(resolution)
print('''
        _ => { return (c).to_string(); },
    }.to_string()
}
''')
```

Bug #5412.
3 years ago
Juliana Fajardini 7b0008d4f0 userguide: add section about exception policies
This describes briefly what the exception policies are, what is the
engine's behavior, what options are available and to which parts are
they implemented.

Task #5475
Task #5515
3 years ago
Jeff Lucovsky 33c424f9ed doc/byte_math: Add byte_math differences with snort
Issue: 5077
3 years ago
Jeff Lucovsky 192a31c74e doc: Fixup byte* entries to display tables properly 3 years ago
Philippe Antoine 390cf9248f detect: adds flow.age keyword
Ticket: #5536
3 years ago
Philippe Antoine 5ef259722b dhcp: adds renewal-time keyword
Ticket: #5507
3 years ago
Philippe Antoine 6faf6299e0 dhcp: adds rebinding-time keyword
Ticket: #5506
3 years ago