6 Commits (1487d12aa412d8f4914d48abe6a8b6af423323c4)

Author	SHA1	Message	Date
Shivani Bhardwaj	b472a17130	detect: add dcerpc.is_fragmented keyword ... This keyword accepts a boolean value and issues a check against the header flags in a respective direction per transaction to check if the current PDU is fragmented or not. The classification criteria is very clear for UDP: flags 0x04 have to be set on the PDU explicitly marking it fragmented. The classification criteria for TCP is a bit ambiguous in the RFC but with the current implementation in Suricata only honoring the types REQUEST, BIND, ALTER_CONTEXT, following criteria is used. PFC_FIRST_FRAG && PFC_LAST_FRAG set => it's a complete PDU; unfragmented fragmented otherwise. ref: https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm Feature 8736	2 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	6 months ago
Victor Julien	2480f8c038	doc: fix dcerpc.opnum documentation ... Docs were claiming greater than, less than, etc. support even though this was never supported. Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords") Ticket: #8330.	8 months ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview ... Explain per protocol mechanics for rule matching.	1 year ago
Victor Julien	e2a5bc058c	doc/userguide: fix DCERPC headings	1 year ago
Shivani Bhardwaj	51be8f0238	doc/dcerpc: add proto keywords	5 years ago