Commit Graph

353 Commits (44b6aa5e4b3399e0fba13fefbbd16ebd025e8cd2)

Author SHA1 Message Date
Philippe Antoine 44b6aa5e4b app-layer: websockets protocol support
Ticket: 2695
1 year ago
Sascha Steinbiss 120313f4da ja4: implement for TLS and QUIC
Ticket: OISF#6379
1 year ago
Jeff Lucovsky 7a5a1e2560 doc: Describe noalert keyword
Issue: 6685
1 year ago
jason taylor 7de16809ef doc: update http keyword listing order
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8b3db3c3b5 doc: update file.name keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 49dba7bb94 doc: update file.data keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor bee3aa9709 doc: update http.response_header keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor dcb548106e doc: update http.request_header keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 3f5d228b9e doc: update http.host http.host.raw keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 739dfe5e5e doc: update http.location keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 9ddd8cf9e0 doc: update http.server keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 3af98f3b92 doc: update http.response_body keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 64760e2e75 doc: update http.response_line keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 566bc0d39c doc: update http.stat_msg keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 271321249f doc: update http.stat_code keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 71d8488cb5 doc: update http.request_body keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor c2783e9391 doc: update http.header_names keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 5eadbc2ff0 doc: update http.start keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7e65554462 doc: update http.referer keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 876dfb99ca doc: update http.content_len keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8ff06c1bc0 doc: update http.content_type keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor b2854486dd doc: update http.connection keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 75436dff9c doc: update http.accept_lang keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor f6375e487e doc: update http.accept_enc keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7e3288f5a7 doc: update http keyword normalization notes
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 9e87d89d2e doc: update http.accept keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 8307168ae7 doc: update http.user_agent keyword
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 75c4cdfa1c doc: update http.cookie keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 7a28874c8d doc: update http.header keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor b3af723486 doc: remove legacy description/duplicated data
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 292b3eb9b3 doc: update http.request_line keyword information
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor c7f351bd6e doc: update http.protocol keyword documentation
Ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 2d0ceedeba doc: update urilen keyword documentation
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor ef118aa582 doc: remove legacy uricontent information
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 96e8c10276 doc: update http.uri and http.uri.raw keywords
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor bf192926a8 doc: update http.method keyword
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 0cce5ba447 doc: add http keyword links
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor fd46175203 doc: update http primer information
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
jason taylor 54fd35c5b4 doc: remove legacy tables and image references
ticket: 3025

Signed-off-by: jason taylor <jtfas90@gmail.com>
1 year ago
Hadiqa Alamdar Bukhari 3aa313d0c5 dns: add dns.rcode keyword
dns.rcode matches the rcode header field in DNS messages
It's an unsigned integer
valid ranges = [0-15]
Does not support prefilter
Supports matches in both flow directions

Task #6621
1 year ago
Hadiqa Alamdar Bukhari 4b81851097 dns: add dns.rrtype keyword
It matches the rrtype field in DNS
It's an unsigned integer match
valid ranges = [0-65535]
Does not support prefilter
Supports flow in both directions
Feature #6666
1 year ago
Philippe Antoine e22217bda8 doc: there is no right shift for integer bitmasks
Ticket: 6628
1 year ago
Philippe Antoine f6e1a20215 detect: dns.opcode as first-class integer
Ticket: 5446

That means it can accept ranges
1 year ago
Juliana Fajardini 244a35d539 userguide: fix explanation about bsize ranges
Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.

Cf. from uint.rs:

    DetectUintMode::DetectUintModeRange => {
        if val > x.arg1 && val < x.arg2 {
            return true;
        }
    }

Task #6708
1 year ago
Philippe Antoine b8bc2c7e0f doc: integer keywords
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
1 year ago
Jason Ish 8bf8131c31 doc: note what version "requires" was added in 2 years ago
jason taylor 3cb7112aa5 detect: update smb.version keyword
Signed-off-by: jason taylor <jtfas90@gmail.com>
2 years ago
Eloy Pérez González a4901a1f70 smb: add smb.keyword documentation 2 years ago
Lukas Sismis 6e4cc79b39 doc: remove references to prehistoric versions
Remove references that are mentioning Suricata 3 or less
As a note - only one Suricata 4 reference found:
(suricata-yaml.rst:"In 4.1.x")
Fast pattern selection criteria can be internally found by inspecting
SupportFastPatternForSigMatchList and SigTableSetup functions.

Ticket: #6570
2 years ago
Philippe Antoine adf5e6da7b detect: strip_pseudo_headers transform
Ticket: 6546
2 years ago