27 Commits (2eefb1910dbe3073f944841ac579dd98335b39d8)

Author	SHA1	Message	Date
Jeff Lucovsky	2eefb1910d	doc/fixup: Fixup usages of container-example ... There are several places where transform-related container-example helper wasn't formatting rules properly.	3 weeks ago
Jeff Lucovsky	d2e3bf1d34	doc: document xor transform variable key and offset syntax ... Add user-facing documentation for the xor transform's 'extract <nbytes> <offset>' syntax and offset parameter in rules/transforms.rst. Add a devguide section (devguide/extending/detect/transforms.rst) covering the detection pipeline execution order, how transforms run before detection-time keywords, and how xor reads key bytes directly from the raw buffer at a specified position and width. Explains how the engine deduplicates inspection buffers for rules with variable keys at different buffer positions. Issue: 8671	3 weeks ago
Jeff Lucovsky	5d007ef25e	detect/xor: add inline variable key syntax ... Extend the xor transform to accept a variable-position key using the 'extract <nbytes> <offset>' syntax. The engine reads <nbytes> bytes at buffer position <offset> at transform time. The optional 'offset' parameter specifies where XOR decoding starts in the buffer; bytes before that position are left unchanged. Syntax: xor:"<hex_key>" xor:extract <nbytes> <offset> xor:offset <N>,"<hex_key>" xor:offset <N>,extract <nbytes> <offset> Variable-key helpers (VariableKeyLocation, variable_key_bytes, parse_key_location, strip_keyword_prefix) are imported from the new varkey module. The variable key bytes are copied out of the inspection buffer before decoding, so an in-place transform cannot corrupt the key when the key region overlaps the decoded range. Issue: 8671	3 weeks ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform ... Add documentation for the subslice transform. Issue: 7672	3 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container ... Ticket: 8372 Also remove dead code from script checking the rules	3 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms ... Ticket: 7846	4 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform ... Ticket: 7846	5 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform ... Ticket: 7846	5 months ago
Jeff Lucovsky	845544aad3	doc/luaxform: Clarify luaxform calling convention ... Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function.	7 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	8 months ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values ... Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	11 months ago
Jeff Lucovsky	53c8a0f8f1	doc: Document luaxform transform ... Issue: 2290	1 year ago
Eric Leblond	ed20e7cfe4	doc/userguide: doc domain and tld transforms	1 year ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	2 years ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform ... Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	2 years ago
Philippe Antoine	adf5e6da7b	detect: strip_pseudo_headers transform ... Ticket: 6546	3 years ago
Philippe Antoine	32cce122e1	detect: header_lowercase transform ... Ticket: 6290	3 years ago
Jeff Lucovsky	9ee55d2394	doc/transform: Document case-changing transforms. ... Issue: 6439	3 years ago
Philippe Antoine	0cfdec1266	detect: xor transform ... Ticket: 3285 The xor transform applies xor decoding to a buffer, with a key specified as an option in hexadecimal. Arbitrary key sizes are accepted.	5 years ago
Jason Ish	547afcb983	doc/userguide/transforms: remove not about libnss being required	6 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword ... Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	6 years ago
Jeff Lucovsky	3005dca3fd	doc: pcrexform documentation	6 years ago
Victor Julien	6aa2d550a1	doc/dotprefix: fix example rules	7 years ago
Jeff Lucovsky	ab3d6328ba	detect/transform: add dotprefix keyword to doc	7 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	72dd4a5f92	doc/rules: initial transforms documentation	8 years ago