1423 Commits (376eddbe98e3d683fcc87d2b595e230ce1188a97)

Author	SHA1	Message	Date
Victor Julien	2f9573f84c	doc: address config conversion note ... Message is: ``` Converting `source_suffix = '.rst'` to `source_suffix = {'.rst': 'restructuredtext'}`. ```	3 months ago
Jason Ish	91b9dda0bf	doc: document flow life cycle callback API ... Document for C and Rust, as the C documentation was missing. Ticket: #8446	3 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua ... This includes: - version - mode - stratum - reference_id Ticket: #8533	3 months ago
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	3 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	3 months ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform ... Add documentation for the subslice transform. Issue: 7672	3 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container ... Ticket: 8372 Also remove dead code from script checking the rules	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	4 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	4 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword ... This keyword also accepts strings for known mode names. Ticket: #8429	4 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword ... Ticket: #8431	4 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword ... SNMP was used as a template. Ticket: #8430	4 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	4 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	4 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler ... Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	4 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	4 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule ... Ticket: 8372 And fix another bad rule	4 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule ... As stated, it will refuse to load. Ticket: 8372	4 months ago
Philippe Antoine	15f45be672	doc: fix rules ... Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	4 months ago
Jason Ish	a11aaadd86	plugins: add --plugin command line option to load plugins ... Add --plugin <PATH> to load an additional plugin from the command line. This is more convenient than "--set plugins.X" especially when you may already have a plugins loaded and you want to load an additional one. Ticket: 8463	4 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	4 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	4 months ago
Victor Julien	e6381a3c22	doc/userguide: add note on rule reloads ... Cannot be combined with --firewall-rules-exclusive	4 months ago
Victor Julien	f99b86beab	doc/userguide: document L2 firewall handling of ARP	4 months ago
Victor Julien	2e2132a16f	doc/userguide: improve pkthdr docs	4 months ago
Victor Julien	61a7f47a69	detect: add ether.hdr keyword ... Sticky buffer to inspect the ethernet header. Example rule: alert ether any any -> any any ( \ ether.hdr; content:"|08 06|"; offset:12; depth:2; \ sid:1;) Ticket: #8327.	4 months ago
Jeff Lucovsky	e7dc0d885b	doc/config: Update flushing description ... Update output flushing description to reflect EVE based approach in documentation and config template. Issue: 8286	4 months ago
Juliana Fajardini	c790a9f774	userguide/exceptions: update for qa-simulation use ... The docs still referred to ``debug`` mode. Related to Task #7885	5 months ago
Juliana Fajardini	56917cf8f3	rules: fix typos & missing keywords in examples ... Task #8372	5 months ago
Juliana Fajardini	8c29c471b4	userguide: add references to rules/README to docs ... To make it more visible/easier to find.	5 months ago
Jason Ish	8c7172e707	lib: remove the built-in library run-mode ... This run-mode does not allow for capture ThreadVars to be created at the appropriate place in the application life cycle. Instead, applications should register their own custom run-mode. Ticket: #8259	5 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms ... Ticket: 7846	5 months ago
Jeff Lucovsky	5a3a2d5fd1	doc/output: Document the IPv6 display behavior ... Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their compressed form (per RFC-5952).	5 months ago
Shivani Bhardwaj	0e345c93ca	app-layer: check ipproto enabled setting first ... If the key `app-layer.protocols.PROTO.enabled` is present, the protocol is enabled for all carrier protocols. This is not ideal. Only if the key `app-layer.protocols.PROTO.enabled` is missing, an attempt is made to look for a setting specific to the ipproto passed at the time of registration e.g. `app-layer.protocols.PROTO.udp.enabled`. By default, check for carrier proto specific setting. If it is not found, then fall back to the generic setting. Issue a warning in case an inconsistent combination of global and ipproto specific setting is found. Bug 8205	5 months ago
Victor Julien	2480f8c038	doc: fix dcerpc.opnum documentation ... Docs were claiming greater than, less than, etc. support even though this was never supported. Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords") Ticket: #8330.	5 months ago
Victor Julien	fe3cce895c	doc/userguide: add igmp keyword docs	5 months ago
Victor Julien	7e6fd09e90	doc/userguide: add missing ipopts values	5 months ago
Juliana Fajardini	90823fa90e	devguide: add policy on patches w unasigned ticket	5 months ago
Jason Ish	66473f6ad7	doc: add more public datasets ... Add: - UNSW-NB15 - CIC-IDS2017 - CSE-CIC-IDS2018 - CIC-DDoS2019 Update formatting for better display.	5 months ago
Juliana Fajardini	926fde859e	userguide: fix Deprecations, warn about syslog ... The Deprecation note on Syslog was partly conveying the opposite message, and we were missing a deprecation notice on the Syslog output section.	6 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust ... Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	6 months ago
Sven Cuyt	1246f1cf8c	doc/userguide: add link to differences-from-snort ... Ticket: #8031.	6 months ago
Sven Cuyt	a0cc534471	doc/userguide: fix table showing example payload ... Ticket: #8031.	6 months ago
Sven Cuyt	2d662538e5	doc/userguide: add example with non-zero offset for relative isdataat ... Ticket: #8031.	6 months ago
Victor Julien	7c5285e5e6	doc/userguide: explain isdataat absolute vs relative difference ... Ticket: #8031.	6 months ago
Philippe Antoine	d378610e93	stream: non infinite default value for reassembly.depth ... So that empty config have a safer default. Ticket: 8290	6 months ago
Ofer Dagan	e1f9d8a067	pcap: refactor delete-when-done to support non-alerts ... Refactor pcap file deletion to use a single delete-when-done option with three values instead of separate boolean options: - false (default): No deletion - true: Always delete files - "non-alerts": Delete only files with no alerts Also account for alerts produced by pseudo packets (flow timeout / shutdown flush): - Introduce small capture hooks and invoke on pseudo-packet creation so the capture layer can retain references and observe alerts emitted after the last live packet - Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads Key changes: - Replace should_delete/delete_non_alerts_only bools with enum - Move alert counter from global to per-file PcapFileFileVars - Relocate alert counting from PacketAlertFinalize to pcap module - Ensure thread safety for both single and continuous pcap modes - Add unit tests for configuration parsing and pseudo-packet alert path The --pcap-file-delete command line option overrides YAML config and forces "always delete" mode for backward compatibility. Documentation updated to reflect the new three-value configuration. Fixes OISF#7786	6 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform ... Ticket: 7846	6 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform ... Ticket: 7846	6 months ago
Jason Ish	1b182025bc	output-eve: expose SCEveFileType to Rust with bindgen ... There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.	6 months ago