224 Commits (2c95f1ff44e17c3bc8693d5e23e175f2bc90ea10)

Author	SHA1	Message	Date
Shivani Bhardwaj	0f92583702	flow: split elephant flow detection per dir ... The tracking for elephant flow is done per direction however, the flag was set on the flow whenever either of the directions crossed the rate-limit defined in the settings. Given that the tracking was already split, it makes sense to split the detection tracking per direction as well and allow user to have a better control via rule language.	10 months ago
Philippe Antoine	24405a7b76	doc: http fields in json schema ... Ticket: 6075	11 months ago
Philippe Antoine	2f39c8c099	jsonschema: remove obsolete http fields ... These were moved to array request_headers/response_headers Ticket: 6075	11 months ago
Philippe Antoine	cf88ed518c	jsonschema: check for duplicate keys ... Ticket: 6691 And fix the one duplicate found	11 months ago
Philippe Antoine	1df568300c	doc/jsonschema: use dnp3_func instead of its alias	11 months ago
Juliana Fajardini	331bc8aeac	schema: add descriptions to global memcaps/memuses ... For FTP, Host, IP Pair and HTTP. Related to Task #6434	11 months ago
Juliana Fajardini	2855574a2c	schema: add additional properties to stats.capture ... The `stats.capture` object may have different properties based on the capture method used. This adds the ones pertaining to AF_PACKET capture. Related to Task #6434	11 months ago
Juliana Fajardini	12e0e51864	schema: add desc for each main stats module ... Part of the schema documentation effort. Related to Task #6434	11 months ago
Juliana Fajardini	025ffa6135	schema: allow stats.stream event counters ... While the counters exist, they're not present in the schema, causing validation to fail if stats.stream-events is enabled. Task #7858	11 months ago
Juliana Fajardini	173fec81f8	schema/stats: flow_mgr is actually flow.mgr ... The schema accounts for a stats counters group that is a subgroup of the flows stats counters. Remove `flow_mgr`, thus.	11 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	12 months ago
Victor Julien	acb769291a	exception-policy: add 'reject-both' option ... Allow rejecting both sides of a connection. Has the same support as regular reject (which is essentially rejectsrc). Ticket: #5974.	1 year ago
Philippe Antoine	047f1c5080	doc: fix enip_command name in json schema ... enip.command is not a keyword nor an alias	1 year ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	1 year ago
Jason Ish	5e2dc9ace3	ike: don't log empty server objects	1 year ago
Jason Ish	2d86412f46	ike: log attributes as objects ... IKE attributes are an array of TLV style objects, this means there can be duplicate types seen on the wire. However, Suricata logs these as a mapping with the type as the key. This can result in the JSON containing duplicate keys. To address this, log the attributes as an array of objects, allow duplicates to exist, for example: "client": { "proposals": [ { "sa_life_duration": "Unknown", "sa_life_duration_raw": 86400, } } } is now logged as: "client": { "proposals": [ {"key": "sa_life_duration", "value": "Unknown", "raw": 86400} ] } Also adds `"version": 2` to each IKE record to note the change of format from previous versions. Ticket: #7902	1 year ago
Juliana Fajardini	426955782c	schema: add descriptions to capture stats counters ... Task #6434	1 year ago
Juliana Fajardini	3642594e14	schema: add descriptions to decoder stats counters ... Continuation of Task #7793	1 year ago
Juliana Fajardini	42d563f83e	schema: fix typos s/ERPSAN/ERSPAN	1 year ago
Philippe Antoine	4f7fc25a1a	detect/dnp3: make dnp3.ind a generic uint16 bitflags keyword ... Ticket: 6724 Allows operations such as negation	1 year ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder ... Ticket: #3953.	1 year ago
Philippe Antoine	dae9264120	doc: really enforce more the completeness of json schema ... Completes commit f1f32a39ee End better describe exception_policy	1 year ago
Philippe Antoine	2028a3f9f8	doc: complete json schema with integer keywords	1 year ago
Philippe Antoine	f1f32a39ee	doc: enforce more the completenes of json schema ... see jq 'paths( objects | (.type == "object" and (has("additionalProperties") | not) )) | join(".")' etc/schema.json fix and complete bittorrent on the way	1 year ago
Philippe Antoine	421fb8ac31	doc/ldap: complete json schema	1 year ago
Jeff Lucovsky	17e7387ff4	doc/fileinfo: Document fileinfo context/usage ... Issue: 6498	1 year ago
Juliana Fajardini	8f9f414866	schema: document stats.detect counters ... ... that were missing. Task #7795	1 year ago
Juliana Fajardini	051715a7eb	schema/description: capitalize initial letters ... For existing descriptions that weren't like that, yet.	1 year ago
Juliana Fajardini	1d27e268d1	schema: add descriptions for flow stats counters ... Task #7794	1 year ago
Juliana Fajardini	49629f7cb6	schema/decoder: add descriptions for stats counters ... Task #7793	1 year ago
Juliana Fajardini	342c649186	schema/arp: fix invalid pkt event output ... Task #7857	1 year ago
Juliana Fajardini	a8453d73cd	detect: remove unused non-pf stats counters ... Remove unused rule prefilter-related stats counters that aren't in use. 94644ac960 (detect: move non-pf rules into special prefilter engines) removed the logic that made use of and incremented the stats counters: - det_ctx->counter_fnonmpm_list - det_ctx->counter_nonmpm_list Some code was left, registering them, and mentioning them in the json schema. Ticket #7834	1 year ago
Philippe Antoine	fe9da8acd6	http2: do not log empty objects for request or response ... Ticket: 7741	1 year ago
Jeff Lucovsky	97b03b4076	doc/netflow: Discuss netflow ... Add discussion for netflow configuration, event type and fields contained in netflow records. Issue: 5139	1 year ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection ... Ticket: 6022	1 year ago
Philippe Antoine	68827a4ace	schema: document kerberos fields ... Ticket: 6566	1 year ago
Jason Ish	ddb77d061e	eve/schema: map mdns properties that have keywords ... Also add descriptions for the EVE index.	1 year ago
Juliana Fajardini	cbe621fb09	decode: add stats counters for ipv4/ipv6 over ipv4 ... These existed for ipv6 over ipv6, and ipv4 over ipv6, but not for the ipv4 counterpart. Task #7758	1 year ago
Eric Leblond	23f643a4a7	eve/schema: fix ordering	1 year ago
Eric Leblond	b03d4f8e1a	datajson: output context to "context" ... Using `alert.extra` was not really reflecting the nature of what was added. So renaming it to `alert.context`.	1 year ago
Eric Leblond	61ac7b46c1	eve/schema: remove reference to datajson	1 year ago
Eric Leblond	e2d8217934	eve/schema: document datajson output	1 year ago
Eric Leblond	0e88e36020	eve/schema: pktvars is a container ... It can contain any vars so need addition properties.	1 year ago
Alice Akaki	3065374314	json/schema: link file.name to email.attachment ... As a Suricata keyword. Ticket: #7683	1 year ago
Victor Julien	df7fe5b0ce	detect: add pre_flow hook ... Allows dropping of packets before a flow is created/updated. Directionless as direction is inferred from the flow. Ticket: #7714.	1 year ago
Victor Julien	8f2b925e09	detect: add pre_stream hook ... Meant to be used from the detection engine, to allow rules to drop traffic before it modifies the stream state. Ticket: #7712.	1 year ago
Victor Julien	17ed70dcb5	eve/schema: reformat with clang-format	1 year ago
Jeff Lucovsky	a292670443	detect/entropy: Add calculated entropy value to flowvars ... When the entropy keyword is used, record the calculated entropy value to a flow variable for logging use.	1 year ago
Juliana Fajardini	f3aa0085a0	pgsql: rename copy in/out response field ... We used `copy_column_count`, while just `columns` is more accurate with what PostgreSQL describes, and what Wireshark shows. Related to Task #7644 Task #7645	1 year ago
Juliana Fajardini	2086f99d6b	pgsql: add initial support to CopyIn mode/subproto ... This sub-protocol inspects messages sent mainly from the frontend to the backend after a 'COPY FROM STDIN' has been processed by the backend. Parses new messages: - CopyInResponse -- initiates copy-in mode/sub-protocol - CopyData (In) -- data transfer message, from frontend to backend - CopyDone -- signals that no more CopyData messages will be seen from the frontend, for the current transaction - CopyFail -- used by the frontend to signal some failure to proceed with sending CopyData messages Task #7645	1 year ago