518 Commits (270e19191b369481bbad734cb2e0441c9ca9bccd)

Author	SHA1	Message	Date
Adam Kiripolsky	175e690222	dpdk/hw_offload: add support for vlan stripping ... Utilize DPDK API for hardware vlan stripping if supported by NIC. Ticket: 7330	4 months ago
Sascha Steinbiss	285cc29ec0	redis: add automatic trimming support for streams	4 months ago
Sascha Steinbiss	d3d9f1c395	redis: implement XADD stream support ... Ticket: #7082	4 months ago
Jason Ish	cc519beb91	suricata.yaml: add missing custom tls fields ... Also update the suricata.yaml in the userguide.	4 months ago
Juliana Fajardini	55b922ceed	tls/conf: clarify usage of custom vs extended logs ... Since enabling custom logging will replace the extended logging, thus possibly leading to certain fields disappearing from the logs, mention this aspect. Related to Bug #7333	5 months ago
Shivani Bhardwaj	37fa2a6775	detect: rename port whitelisting to priority ... This was done following the fact that this setting was historically named incorrectly. The purpose of the setting was always to define the ports that will be prioritized and have rule groups associated w them on priority. Rename all occurences of this to correctly reflect the purpose of the setting.	5 months ago
Jeff Lucovsky	792f5e1d57	napatech: load plugin by default ... Issue: 7165	5 months ago
Philippe Antoine	bb714c9178	http: have a headers limit ... Ticket: 7191 So as to avoid quadratic complexity in libhtp. Make the limit configurable from suricata.yaml, and have an event when network traffic goes over the limit.	5 months ago
Philippe Antoine	de9413c654	detect: safety for app-layer logging of stream-only rules ... If a stream-only rule matches, and we find a tx where we want to log the app-layer data, store into the tx data that we already logged, so that we do not log again the app-layer metadata Ticket: 7085	5 months ago
Jeff Lucovsky	9bc468e63a	alert/reference: Optionally add reference(s) ... Issue: 4974 Optionally include rule references with the alert. Since there can be multiple reference keywords, they are collected into an array.	6 months ago
Jason Ish	15fe844ae7	syslog: deprecate ... The standalone syslog output is now deprecated for Suricata 8. Display a warning on use and add notes to the userguide. Ticket: #6544	6 months ago
Jason Ish	5853fb922d	tls-log: deprecate ... tls-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the user guide. Ticket: #6542	6 months ago
Jason Ish	ab26323a96	http-log: deprecate ... http-log is now deprecated and will be removed in Suricata 9.0. Display a deprecation notice on use, and add notes to the userguide. Issue: #6543	6 months ago
Victor Julien	688bd538cf	pcap: implement pcap-file-buffer-size option ... Allows easy specification of buffer size on the commandline. Ticket: #7155.	6 months ago
Giuseppe Longo	edf70276d6	rust/ldap: enable parser for udp ... This introduces a new parser registration function for LDAP/UDP, and update ldap configuration in order to be able to enable/disable a single parser independently (such as dns). Also, GAPs are accepted only for TCP parser and not for UDP. Ticket #7203	7 months ago
Philippe Antoine	1e82e20c65	doh: implement dns over http2 app-proto ... Ticket: 5773	8 months ago
Giuseppe Longo	910a5b226c	rust/ldap: implement logger	8 months ago
Giuseppe Longo	93da339975	rust/ldap: implement app-layer	8 months ago
Jason Ish	155501f250	pf-ring: load plugin by default ... Ticket: #7162	8 months ago
Victor Julien	223a4194ea	config: switch default config to IEEE 1541 notation	8 months ago
Jason Ish	ca6e73830c	suricata.yaml: set dns log version to 3; link to docs ... Missed in the original PR, but update the commented out version to reflect the default, and a link to the upgrade notes.	8 months ago
Philippe Antoine	e0fd59a20d	doc: state that payload-length includes the gaps	8 months ago
Sascha Steinbiss	ad02040860	mqtt: enable limiting of logged message length ... Ticket: #6984	8 months ago
Victor Julien	7d4fcc311c	detect/threshold: make hash size and memcap configurable	8 months ago
Philippe Antoine	c9ce43b31e	output: configurable payload_length field for alerts ... Ticket: 7098	8 months ago
Eric Leblond	eecb3440e2	profiling: add option to active rules profiling at start ... When replaying a pcap file, it is not possible to get rules profiling because it has to be activated from the unix socket. This patch adds a new option to be able to activate profiling collection at start so a pcap run can get rules profiling information.	9 months ago
Philippe Antoine	82c03f72c3	enip: convert to rust ... Ticket: 3958 - transactions are now bidirectional - there is a logger - gap support is improved with probing for resync - frames support - app-layer events - enip_command keyword accepts now string enumeration as values. - add enip.status keyword - add keywords : enip.product_name, enip.protocol_version, enip.revision, enip.identity_status, enip.state, enip.serial, enip.product_code, enip.device_type, enip.vendor_id, enip.capabilities, enip.cip_attribute, enip.cip_class, enip.cip_instance, enip.cip_status, enip.cip_extendedstatus	9 months ago
Jo Johnson	712496bb3f	lua: Remove luajit support ... lua 5.4 support is not available in luajit Ticket: #4776	9 months ago
Shivani Bhardwaj	232c44eb4a	output/json: log tls subjectaltname ... Feature 5234	9 months ago
Philippe Antoine	2c305ba37e	pop3: protocol detection ... Ticket: #6366	10 months ago
Giuseppe Longo	01586d884d	output-json/arp: implement logger ... This adds a logger for ARP, disabled by default. Ticket #6827	10 months ago
Juliana Fajardini	bb59124063	yaml: unify 0 stats counter config option terms ... When we added feature #5976 (72146b969), we overlook that we also have a config stats option for the human-readable stats logs to output 0 counters. Due to not seeing this before, we now have two different setting names for basically the same thing, but in different logs: - zero-valued-counters for EVE - null-values for stats.log This ensures we use the same terminology, and change the recently added one to `null-values`, as this one has been around for longer. Task #6962	11 months ago
Juliana Fajardini	d3354555af	yaml/eve/stats: remove mention exception policy ... The stats config for EVE logs have a comment about exception policy stats counters. This went in with 72146b969c, but shouldn't have, as there are no options there.	11 months ago
Philippe Antoine	0291d37009	websocket: configurable logging of payload in alerts	11 months ago
Philippe Antoine	44b6aa5e4b	app-layer: websockets protocol support ... Ticket: 2695	11 months ago
Sascha Steinbiss	120313f4da	ja4: implement for TLS and QUIC ... Ticket: OISF#6379	11 months ago
Juliana Fajardini	72146b969c	eve/stats: allow hiding counters whose valued is 0 ... Some stats can be quite verbose if logging all zero valued-counters. This allows users to disable logging such counters. Default is still true, as that's the expected behavior for the engine. Task #5976	11 months ago
Juliana Fajardini	0f6dbf650e	yaml: minor wording fix on Suricata package version	11 months ago
Juliana Fajardini	8defee93b2	yaml: explicitly mention exception policy in conf ... While our documentation indicated what were the possible configuration settings for exception policies, our yaml only explicitly mentioned exception policy for the master switch. Clearly indicate which config settings are about exception policies. Related to Task #5816	11 months ago
Juliana Fajardini	a71ace8575	applayer: add stats counters for exception errors ... Add stats counters for exception policy are applied for app-layer errors Part of Task #5816	11 months ago
Victor Julien	829bab295b	eve/frame: implement payload-buffer-size option ... Modeled after the same option in eve/alert. Defaults to 4k.	12 months ago
Giuseppe Longo	add95002b9	suricata.yaml: define SIP_PORTS	1 year ago
Philippe Antoine	8f73a0ac55	smtp: config limit maximum number of live transactions ... Ticket: #6477	1 year ago
Philippe Antoine	4175680a8a	http1: configurable max number of live tx per flow ... Ticket: #5921 Co-authored-by: Jason Ish <jason.ish@oisf.net>	1 year ago
Philippe Antoine	aff54f29f8	http2: handle reassembly for continuation frames ... Ticket: 5926 HTTP2 continuation frames are defined in RFC 9113. They allow header blocks to be split over multiple HTTP2 frames. For Suricata to process correctly these header blocks, it must do the reassembly of the payload of these HTTP2 frames. Otherwise, we get incomplete decoding for headers names and/or values while decoding a single frame. Design is to add a field to the HTTP2 state, as the RFC states that these continuation frames form a discrete unit : > Field blocks MUST be transmitted as a contiguous sequence of frames, > with no interleaved frames of any other type or from any other stream. So, we do not have to duplicate this reassembly field per stream id. Another design choice is to wait for the reassembly to be complete before doing any decoding, to avoid quadratic complexity on partially decoding of the data.	1 year ago
Lukas Sismis	2a2898053c	dpdk: add interrupt (power-saving) mode ... When the packet load is low, Suricata can run in interrupt mode. This more resembles the classic approach of processing packets - CPU cores run low and only fetch packets on interrupt. Ticket: #5839	1 year ago
Jeff Lucovsky	ff609f5dc3	conf/log: Remove sguil mode ... Issue: 6347	1 year ago
Juliana Fajardini	0437173848	output/drop: add verdict field ... Related to Bug #5464	2 years ago
Juliana Fajardini	53b8defd79	output/alert: add verdict field ... Related to Bug #5464	2 years ago
Jeff Lucovsky	ac8f91f44f	config: Document cluster_rollover deprecation ... Issue: 6128 cluster_rollover is no longer permitted; using it will generate a warning message and it'll be replaced with cluster_flow	2 years ago