suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	45a36e961f	doc/byte_jump: Clarify bitmask operation Issue: 6693 Clarify how the bitmask value is used for byte_jump Snort compatibility says: - The bitmask value is applied to the extracted value before the multiplier is applied. - The result of the bitmask operation is to be right shifted by the number of trailing 0's in the bitmask value.	5 months ago
Fupeng Zhao	f7ec1c8813	redis: Add authentication support Add authentication support to the Redis logging output. It introduces `username` and `password` configuration options for Redis, allowing Suricata to authenticate with Redis servers that require it. Ticket: 7062	5 months ago
Ofer Dagan	7627756360	detect/detection_filter: add unique_on option Add optional unique_on {src_port\|dst_port} to detection_filter for exact distinct port counting within the seconds window. Features: - Runtime uses a single 64k-bit (8192 bytes) union bitmap per threshold entry with O(1) updates. - Follows detection_filter semantics: alerting starts after the threshold (> count), not at it. - On window expiry, the window is reset and the current packet's port is recorded as the first distinct of the new window. Validation: - unique_on requires a ported transport protocol; reject rules that are not tcp/udp/sctp or that use ip (protocol any). Memory management: - Bitmap memory is bounded by detect.thresholds.memcap. - New counters: bitmap_memuse and bitmap_alloc_fail. Tests: - C unit tests for parsing, distinct counting, window reset, and allocation failure fallback. - suricata-verify tests for distinct src/dst port counting. Task #7928	6 months ago
Juliana Fajardini	2c216e2b73	devguide/exceptions: minor fixes - cleaner YouTube link - fix weird sentence Follow-up of Task #5612	6 months ago
Philippe Antoine	54cc752cf9	ssh: hassh can be truly disabled Rules will not re-enable it Ticket: 8223	6 months ago
Philippe Antoine	c960b7d7c1	app-layer: AppLayerParserFPtr uses a mut pointer to local storage So, fix the fn prototype in rust ParseFn	6 months ago
Juliana Fajardini	48b15ac152	devguide: add chapter about exception policies Adds a chapter indicating what are the main steps when adding exception policies, how is it possible to extend them, as well as main aspects and files to consider when doing so. Task #5612	6 months ago
Lukas Sismis	56c1552c3e	hs: warn about the same cache directory This is especially relevant for multi-instance simultaneous setups as we might risk read/write races.	6 months ago
Lukas Sismis	15c83be61a	hs: prune stale MPM cache files Hyperscan MPM can cache the compiled contexts to files. This however grows as rulesets change and leads to bloating the system. This addition prunes the stale cache files based on their modified file timestamp. Part of this work incorporates new model for MPM cache stats to split it out from the cache save function and aggregate cache-related stats in one place (newly added pruning). Ticket: 7830	6 months ago
Victor Julien	73a873ecfe	doc/userguide: endswith can be mixed with offset/distance/within Bug: #5030.	6 months ago
Philippe Antoine	dd6baccabd	src: doc: remove more double-space typos Found with git grep -E '[a-z] [a-z]'	6 months ago
Juliana Fajardini	a1f088cc65	docs: use correct suricata version mentions Found with 'git grep suricata-7' Task #8113	6 months ago
Philippe Antoine	7422c97bf2	quic: encryption-handling config parameters Ticket: 8116	6 months ago
Shivani Bhardwaj	6702791a9c	doc: add dcerpc.max-stub-size config param	6 months ago
Jason Ish	2c95f1ff44	dnp3: bound the maximum number of objects per tx Default to 2048, but provide a user configuration value. Ticket: #8181	6 months ago
Jason Ish	3a32bb5743	dnp3: set a bound on the number of points per message 16384 is used as the max, but a configuration parameter has been provided. The reason for setting an upper bound is that bit flags can create a memory amplification as we parse them into individual data structures. Ticket: #8181	6 months ago
Jason Ish	a16f087b93	dnp3: reduce flood threshold to 32 and make configurable Lower the number of unreplied requests from 500 to 32 to consider a flood. At the very least this is an anomaly given the DNP3 spec mentions that DNP3 should only have one outstanding request at a time, with an exception for unsolicited responses, so in practice no more than 2 should be seen. Additionally make this value configurable by introducing the max-tx parameter. Ticket: #8181	6 months ago
Lukas Sismis	b596073a79	src: doc: remove double-space typos	6 months ago
Shivani Bhardwaj	30bdaa44e1	doc: add elephant.flow usage section	7 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	7 months ago
Juliana Fajardini	0ca874b678	userguide: highlight exceptions interactions In corner cases, we assume that a midstream exception policy could be triggered by a prior exception policy in effect. Explain this in the docs. Task #5830	7 months ago
Ambre Iooss	91c9e34419	doc/userguide: update windivert instructions The IPS documentation for Windows had a dead link to a PDF. Update the Windows build page to include WinDivert instructions. Documentation: #8137.	7 months ago
Victor Julien	365ed2a2ff	af-packet: disable hwtimestamp by default Add enable-hwtimestamp option to replace disable-hwtimestamp. Ticket: #7585.	7 months ago
Jeff Lucovsky	845544aad3	doc/luaxform: Clarify luaxform calling convention Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function.	7 months ago
Juliana Fajardini	6c06ab6144	devguide: update backports policy for Suricata 7.0 Also remove mentions to `master` and `6.0x`. Task #7937	7 months ago
Juliana Fajardini	907f4faff8	doc/thresholding: minor fix for backoff subsection	7 months ago
Philippe Antoine	c93e69830a	detect/ssl: properly handle negation in ssl_version keyword Ticket: 3220 DetectSslVersionMatch did not handle properly negation. It could never match on a signatrue with ssl_version: !tls1.3 That is because, if we had such a signature and network traffic with tls1.1, we were looking into DetectSslVersionData field for tls1.1, which was not set, instead of looking at field for tls1.3 which was set with negated flag. Previous DetectSslVersionData was holding redundant information. It did not need to have it for each ssl version, but just globally. Also, it did not need to hold the version as a value in the array, as it was redundant with the index of the array.	7 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos To list the protocols we can use a in a rule header Ticket: 635	7 months ago
Victor Julien	08d625bb10	mpm: remove remaining ac-bs references	7 months ago
Victor Julien	be2c40bde7	doc/af-packet: document disable-hwtimestamp option Ticket: #1954.	7 months ago
Victor Julien	5194c877f2	threads: remove thread group name logic Once used to merge stats. Stats are tracked per thread and merge by counter name in the current code. It was set only for autofp modes.	7 months ago
Juliana Fajardini	1647081b29	doc: remove remaining references to pruned flows These were removed with `a5587fec2e` but these mentions went under the radar.	8 months ago
Philippe Antoine	af8390f2ca	doc: upgrade note for engine-analysis breaking change For keywords that now use the generic integer framework Ticket: 7889	8 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer Ticket: 7889	8 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	8 months ago
Victor Julien	558ab73a7f	doc/devguide: explain alert logging changes	8 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all And all to all_or_absent Ticket: 7929	8 months ago
Victor Julien	ec65fd430e	exception-policy: rename 'reject-both' to 'rejectboth' To align it with the rule action.	8 months ago
Jason Ish	cdd4ea0f11	doc/devguide: document eve callback Document the callback for adding additional data to EVE. Ticket: #4708	8 months ago
Jason Ish	9fffc09ad7	doc/devguide: document eve file types Ticket: #4708	8 months ago
Victor Julien	0c4a8fd183	doc/userguide: document reject-both expection policy Ticket: #5974.	9 months ago
David Wharton	9d2d1c4f8f	doc: minor verbiage tweaks and reST fix	9 months ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN\|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN\|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	9 months ago

1 2 3 4 5 ...

1252 Commits (45a36e961fcfd5dfa23373d22d9e6b930297be3f)