Commit Graph

806 Commits (34f53f85bcf3ccc168fd3845fbc8a18a5c96e350)

Author SHA1 Message Date
Victor Julien 34f53f85bc systemd: reimplement sd_notify logic using UNIX socket
One of the lessons of the XZ backdoor story was that just linking to
libsystemd to call sd_notify is discouraged by the systemd project:

Lennart Poettering:
"PSA: In context of the xzpocalypse we now added an example reimplementation
of sd_notify() to our man page:

https://www.freedesktop.org/software/systemd/man/devel/sd_notify.html#Notes

It's pretty comprehensive (i.e. uses it for reload notification too), but
still relatively short.

In the past, I have been telling anyone who wanted to listen that if all you
want is sd_notify() then don't bother linking to libsystemd, since the
protocol is stable and should be considered the API, not our C wrapper
around it. After all, the protocol is so trivial"

From: https://mastodon.social/@pid_eins/112202687764571433

This commit takes the example code and uses it to reimplement the notify
logic.

The code is enabled if Linux is detected in configure. Since the code
won't do anything if the NOTIFY_SOCKET env var isn't set, this should
also work fine on systems w/o systemd.

Ticket: #6913.
1 year ago
Jason Ish 51bf1c3510 docs/userguide: use a consistent date for reproducible builds
By default, when Sphinx generates the man pages, the current date will
be embedded in them. This can be set to a specific date with the
"today" variable. Typically the date embedded in manpages in the
release date.

To achieve this, attempt to use the environment variable, RELEASE_DATE
to set the "today" variable, reverting back to the empty string if not
set. It is up to our build system to properly set this date.

Ticket: #6911
1 year ago
Jason Ish 4c16032f63 docs/conf.py: fix python escape warning
/home/jason/oisf/dev/suricata/master/doc/userguide/conf.py:74: SyntaxWarning: invalid escape sequence '\('
  "AC_INIT\(\[suricata\],\s*\[(.*)?\]\)",
1 year ago
Jason Ish 8284df3ed4 devguide: add an upgrade section
Add an upgrade section to the devguide. This should cover any changes
to APIs that users might be using from plugins or as a library user.
1 year ago
Hadiqa Alamdar Bukhari 3aa313d0c5 dns: add dns.rcode keyword
dns.rcode matches the rcode header field in DNS messages
It's an unsigned integer
valid ranges = [0-15]
Does not support prefilter
Supports matches in both flow directions

Task #6621
1 year ago
Juliana Fajardini 7b2bef1bc6 devguide: add chapter and short intro to libsuricata
With this, we intend to make more users aware of this use case, and that
we are working towards this.

Related to
Task #2693
1 year ago
Hadiqa Alamdar Bukhari 4b81851097 dns: add dns.rrtype keyword
It matches the rrtype field in DNS
It's an unsigned integer match
valid ranges = [0-65535]
Does not support prefilter
Supports flow in both directions
Feature #6666
1 year ago
Giuseppe Longo 3dc24a967a doc: add upgrade section for 8 1 year ago
Giuseppe Longo add95002b9 suricata.yaml: define SIP_PORTS 1 year ago
Philippe Antoine e22217bda8 doc: there is no right shift for integer bitmasks
Ticket: 6628
1 year ago
Lukas Sismis 356f9ffa13 doc: mention the limited number of RX/TX descriptors on Intel NICs
Ticket: 6748
1 year ago
jason taylor e891ef3d4e doc: add pcap file logging variable details
Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Jeff Lucovsky ee6208be9d config/nss: Remove libnspr/libnss traces
Issue: 6712
1 year ago
Philippe Antoine 8f73a0ac55 smtp: config limit maximum number of live transactions
Ticket: #6477
1 year ago
Philippe Antoine 4175680a8a http1: configurable max number of live tx per flow
Ticket: #5921

Co-authored-by: Jason Ish <jason.ish@oisf.net>
1 year ago
Philippe Antoine f6e1a20215 detect: dns.opcode as first-class integer
Ticket: 5446

That means it can accept ranges
1 year ago
Juliana Fajardini 244a35d539 userguide: fix explanation about bsize ranges
Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.

Cf. from uint.rs:

    DetectUintMode::DetectUintModeRange => {
        if val > x.arg1 && val < x.arg2 {
            return true;
        }
    }

Task #6708
2 years ago
Philippe Antoine b8bc2c7e0f doc: integer keywords
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
2 years ago
Jason Ish 8bf8131c31 doc: note what version "requires" was added in 2 years ago
jason taylor 3cb7112aa5 detect: update smb.version keyword
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Eloy Pérez González a4901a1f70 smb: add smb.keyword documentation 2 years ago
Juliana Fajardini df6444822e userguide: clarify midstream exception policy
The description of behavior when midstream is enabled and exception
policy is set to ignore wasn't descriptive enough.

Fix typos.
2 years ago
Lukas Sismis 6e4cc79b39 doc: remove references to prehistoric versions
Remove references that are mentioning Suricata 3 or less
As a note - only one Suricata 4 reference found:
(suricata-yaml.rst:"In 4.1.x")
Fast pattern selection criteria can be internally found by inspecting
SupportFastPatternForSigMatchList and SigTableSetup functions.

Ticket: #6570
2 years ago
Lukas Sismis 2a2898053c dpdk: add interrupt (power-saving) mode
When the packet load is low, Suricata can run in interrupt
mode. This more resembles the classic approach of processing
packets - CPU cores run low and only fetch packets
on interrupt.

Ticket: #5839
2 years ago
Lukas Sismis ca6f7c2d00 dpdk: rework hugepage hints to use per-numa information
Previous integration of hugepage analysis only fetched data
from /proc/meminfo. However this proved to be often
deceiving mainly for providing only global information and
not taking into account different hugepage sizes (e.g. 1GB
hugepages) and different NUMA nodes.

Ticket: #6419
2 years ago
Jeff Lucovsky 58f882db94 doc/pcap-log: Remove squil documentation
Issue: 6347
2 years ago
Philippe Antoine adf5e6da7b detect: strip_pseudo_headers transform
Ticket: 6546
2 years ago
Philippe Antoine 4933b817aa doc: fix byte_test examples
As this keyword has 4 mandatory arguments, and some examples
had only three...

Ticket: 6629
2 years ago
Juliana Fajardini a37fa62710 devguide: explain example-rule container usage
Have these options documented, so that whoever writes rule-related
documentation can easily know what they could use to make the doc look
better.
2 years ago
Juliana Fajardini fc2acf8cb0 devguide: fix main channels list
Sphinx and RtD sometimes render lists in weird ways. The communication
channels list barely looked like one, at all...
2 years ago
Juliana Fajardini d15877b2c0 devguide: update branches, refer to backports guide
Update the list of active branches to include 7 renaming and new master,
link to backports document.
2 years ago
Juliana Fajardini 9fbdfd219c devguide: add chapter with backports guide
Task #6568
2 years ago
Juliana Fajardini de8bffd244 devguide: doc from behavior changes needs ticket #
If a commit introduces code that changes Suricata behavior, the related
documentation changes should go in a separate commit, but refer to the
same ticket number.
This reduces the chances of said changes being lost if there are backports
while still keeping the backporting process a bit less bulky, for each
commit.

Related to
Task #6568
2 years ago
Juliana Fajardini 71e4ca81ef devguide: reorganize pr-workflow section
This section seemed to aim both at PR reviewers and PR authors at the
same time, even though some info is probably of low value for
contributors.

Created new section for PR reviewers and maintainers, and kept the info
for PR authors separated. Also highlighted information on requested
changes and stale PRs.
2 years ago
Juliana Fajardini 08eb67f74c devguide: make 'contributing' a chapter
This could be justified from a semantic point of view, and also can help
in bringing more attention to where this information is, as it is less
hidden, now.

Also add Dev Guide as one of our resources in our Readme.
2 years ago
Jason Ish 5d5b0509a5 requires: add requires keyword
Add a new rule keyword "requires" that allows a rule to require specific
Suricata versions and/or Suricata features to be enabled.

Example:

  requires: feature geoip, version >= 7.0.0, version < 8;
  requires: version >= 7.0.3 < 8
  requires: version >= 7.0.3 < 8 | >= 8.0.3

Feature: #5972

Co-authored-by: Philippe Antoine <pantoine@oisf.net>
2 years ago
Juliana Fajardini bba3d4fc63 userguide/eve: explain pgsql requests & responses
Add a more visible explanation of that requests, responses, frontend and
and backend are, in Pgsql context, to avoid having to repeat that over
different portions of the docs.
2 years ago
Juliana Fajardini 30ac77ce65 pgsql: add cancel request message
A CanceldRequest can occur after any query request, and is sent over a
new connection, leading to a new flow. It won't take any reply, but, if
processed by the backend, will lead to an ErrorResponse.

Task #6577
2 years ago
Juliana Fajardini 7dcc2e7a71 doc/eve-format: break pgsql section to char limit 2 years ago
Jason Ish c1a8dbcb72 doc/userguide: document dns.query.name, dns.answer.name
With some other minor cleanups in the DNS keyword section.
2 years ago
Jason Ish b11bb1c412 detect: rename DetectAppLayerInspectEngineRegister2
Rename DetectAppLayerInspectEngineRegister2 to
DetectAppLayerInspectEngineRegister as there is no other variant of
this function, and the versioning with lack of supporting
documentation can lead to confusion.
2 years ago
Jason Ish 50be098839 detect: rename DetectAppLayerMpmRegister2 to DetectAppLayerMpmRegister
The old DetectAppLayerMpmRegister has not been around since 4.1.x.
Rename the v2 of this function to a versionless function as there is no
documentation referring to what the 2 means.
2 years ago
Victor Julien 3456dea276 doc/userguide: update guidance on 5 to 6 upgrading
TCP memory use can be higher than expected in certain configs.

Ticket: #6552.
2 years ago
Shivani Bhardwaj b9540df5ad doc: clarify IP-only with iprep 2 years ago
jason taylor fc81c99b58 doc: add file.name information to smtp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 9d1ad0187e doc: add file.name information to nfs keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor 327ba7397a doc: add file.name information to smb keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor e4077b8803 doc: update ftp keyword doc example rule format
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bb1f7575d3 doc: add file.name information to ftp keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
jason taylor bbc17b1c7d doc: add file.name information to http keyword doc
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago