suricata

Commit Graph

Author	SHA1	Message	Date
Hadiqa Alamdar Bukhari	4b81851097	dns: add dns.rrtype keyword It matches the rrtype field in DNS It's an unsigned integer match valid ranges = [0-65535] Does not support prefilter Supports flow in both directions Feature #6666	2 years ago
Giuseppe Longo	3dc24a967a	doc: add upgrade section for 8	2 years ago
Giuseppe Longo	add95002b9	suricata.yaml: define SIP_PORTS	2 years ago
Philippe Antoine	e22217bda8	doc: there is no right shift for integer bitmasks Ticket: 6628	2 years ago
Lukas Sismis	356f9ffa13	doc: mention the limited number of RX/TX descriptors on Intel NICs Ticket: 6748	3 years ago
jason taylor	e891ef3d4e	doc: add pcap file logging variable details Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jeff Lucovsky	ee6208be9d	config/nss: Remove libnspr/libnss traces Issue: 6712	3 years ago
Philippe Antoine	8f73a0ac55	smtp: config limit maximum number of live transactions Ticket: #6477	3 years ago
Philippe Antoine	4175680a8a	http1: configurable max number of live tx per flow Ticket: #5921 Co-authored-by: Jason Ish <jason.ish@oisf.net>	3 years ago
Philippe Antoine	f6e1a20215	detect: dns.opcode as first-class integer Ticket: 5446 That means it can accept ranges	3 years ago
Juliana Fajardini	244a35d539	userguide: fix explanation about bsize ranges Our code handles Uint ranges as exclusive, but for bsize, our documentation stated that they're inclusive. Cf. from uint.rs: DetectUintMode::DetectUintModeRange => { if val > x.arg1 && val < x.arg2 { return true; } } Task #6708	3 years ago
Philippe Antoine	b8bc2c7e0f	doc: integer keywords Ticket: 6628 Document the generic detection capabilities for integer keywords. and make every integer keyword pointing to this section.	3 years ago
Jason Ish	8bf8131c31	doc: note what version "requires" was added in	3 years ago
jason taylor	3cb7112aa5	detect: update smb.version keyword Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Eloy Pérez González	a4901a1f70	smb: add smb.keyword documentation	3 years ago
Juliana Fajardini	df6444822e	userguide: clarify midstream exception policy The description of behavior when midstream is enabled and exception policy is set to ignore wasn't descriptive enough. Fix typos.	3 years ago
Lukas Sismis	6e4cc79b39	doc: remove references to prehistoric versions Remove references that are mentioning Suricata 3 or less As a note - only one Suricata 4 reference found: (suricata-yaml.rst:"In 4.1.x") Fast pattern selection criteria can be internally found by inspecting SupportFastPatternForSigMatchList and SigTableSetup functions. Ticket: #6570	3 years ago
Lukas Sismis	2a2898053c	dpdk: add interrupt (power-saving) mode When the packet load is low, Suricata can run in interrupt mode. This more resembles the classic approach of processing packets - CPU cores run low and only fetch packets on interrupt. Ticket: #5839	3 years ago
Lukas Sismis	ca6f7c2d00	dpdk: rework hugepage hints to use per-numa information Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419	3 years ago
Jeff Lucovsky	58f882db94	doc/pcap-log: Remove squil documentation Issue: 6347	3 years ago
Philippe Antoine	adf5e6da7b	detect: strip_pseudo_headers transform Ticket: 6546	3 years ago
Philippe Antoine	4933b817aa	doc: fix byte_test examples As this keyword has 4 mandatory arguments, and some examples had only three... Ticket: 6629	3 years ago
Juliana Fajardini	a37fa62710	devguide: explain example-rule container usage Have these options documented, so that whoever writes rule-related documentation can easily know what they could use to make the doc look better.	3 years ago
Juliana Fajardini	fc2acf8cb0	devguide: fix main channels list Sphinx and RtD sometimes render lists in weird ways. The communication channels list barely looked like one, at all...	3 years ago
Juliana Fajardini	d15877b2c0	devguide: update branches, refer to backports guide Update the list of active branches to include 7 renaming and new master, link to backports document.	3 years ago
Juliana Fajardini	9fbdfd219c	devguide: add chapter with backports guide Task #6568	3 years ago
Juliana Fajardini	de8bffd244	devguide: doc from behavior changes needs ticket # If a commit introduces code that changes Suricata behavior, the related documentation changes should go in a separate commit, but refer to the same ticket number. This reduces the chances of said changes being lost if there are backports while still keeping the backporting process a bit less bulky, for each commit. Related to Task #6568	3 years ago
Juliana Fajardini	71e4ca81ef	devguide: reorganize pr-workflow section This section seemed to aim both at PR reviewers and PR authors at the same time, even though some info is probably of low value for contributors. Created new section for PR reviewers and maintainers, and kept the info for PR authors separated. Also highlighted information on requested changes and stale PRs.	3 years ago
Juliana Fajardini	08eb67f74c	devguide: make 'contributing' a chapter This could be justified from a semantic point of view, and also can help in bringing more attention to where this information is, as it is less hidden, now. Also add Dev Guide as one of our resources in our Readme.	3 years ago
Jason Ish	5d5b0509a5	requires: add requires keyword Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 \| >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	3 years ago
Juliana Fajardini	bba3d4fc63	userguide/eve: explain pgsql requests & responses Add a more visible explanation of that requests, responses, frontend and and backend are, in Pgsql context, to avoid having to repeat that over different portions of the docs.	3 years ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	3 years ago
Juliana Fajardini	7dcc2e7a71	doc/eve-format: break pgsql section to char limit	3 years ago
Jason Ish	c1a8dbcb72	doc/userguide: document dns.query.name, dns.answer.name With some other minor cleanups in the DNS keyword section.	3 years ago
Jason Ish	b11bb1c412	detect: rename DetectAppLayerInspectEngineRegister2 Rename DetectAppLayerInspectEngineRegister2 to DetectAppLayerInspectEngineRegister as there is no other variant of this function, and the versioning with lack of supporting documentation can lead to confusion.	3 years ago
Jason Ish	50be098839	detect: rename DetectAppLayerMpmRegister2 to DetectAppLayerMpmRegister The old DetectAppLayerMpmRegister has not been around since 4.1.x. Rename the v2 of this function to a versionless function as there is no documentation referring to what the 2 means.	3 years ago
Victor Julien	3456dea276	doc/userguide: update guidance on 5 to 6 upgrading TCP memory use can be higher than expected in certain configs. Ticket: #6552.	3 years ago
Shivani Bhardwaj	b9540df5ad	doc: clarify IP-only with iprep	3 years ago
jason taylor	fc81c99b58	doc: add file.name information to smtp keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	9d1ad0187e	doc: add file.name information to nfs keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	327ba7397a	doc: add file.name information to smb keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	e4077b8803	doc: update ftp keyword doc example rule format Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	bb1f7575d3	doc: add file.name information to ftp keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	bbc17b1c7d	doc: add file.name information to http keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Shivani Bhardwaj	2b73a17bb0	detect: rename whitelist to score The term "whitelist" is actually used to store a list of DetectPort type items for tcp and udp in detect.h. Using the same term for also keeping the score that affects the grouping of rules is confusing. So, rename the variable to "score".	3 years ago
Jason Ish	cc0adaaf4a	userguide: remove old css files In our conf.py we reference some ReadTheDocs stylesheets that appear to be old and break formatting of some items like bulletted lists. Bug: #6589	3 years ago
Philippe Antoine	32cce122e1	detect: header_lowercase transform Ticket: 6290	3 years ago
jason taylor	c50002978d	doc: update file.data keyword documentation Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Juliana Fajardini	a649a92afd	userguide: update tls not_after/not_before mentions Our tls fields not_after and not_before are actually logged as `notafter` and `notbefore`, but were documented with the underscore. Update the documentation, since updating the log format itself would be a breaking change. Task #5494	3 years ago
Juliana Fajardini	58fb559594	userguide: document flow_id, with examples Flow_id explanation expanded from version shared by Peter Manev. Task #6445	3 years ago
Sascha Steinbiss	0c55fe3515	detect: add mqtt.connect.protocolstring Ticket: OISF#6396	3 years ago
Victor Julien	6b2c33990f	doc/userguide: add tag keyword page Ticket: #3015.	3 years ago
Victor Julien	4a02a14df1	doc/userguide: document host table yaml settings	3 years ago
Jeff Lucovsky	9ee55d2394	doc/transform: Document case-changing transforms. Issue: 6439	3 years ago
Ralph Eastwood	9865164e75	napatech: update docs to remove hba reference	3 years ago
Philippe Antoine	ab9b6e30b1	detect: adds flow integer keywords Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver	3 years ago
Kirjan Kohuladas	c8a7204b15	doc/rule-profiling: fix suricatasc typo	3 years ago
Juliana Fajardini	54d8f45afc	userguide: add proper label to RPM install section Use a reference label that is stable, instead of one that could change in case a new section is added above it.	3 years ago
Daniel Olatunji	0e5fdbb8fb	doc: be consistent with the use of "sudo" Issue: #5720	3 years ago
Comfort Amaechi	cf8b630ed2	userguide: cover install-full and install-conf Ticket: #6342	3 years ago
jason taylor	535938d7f6	doc: add tls.cert_chain_len docs Ticket: #6386 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Juliana Fajardini	1a132f454a	docs: adjust readthedocs config to new options Our documentation was failing to build, seems connected to the new way of indicating build options (cf https://readthedocs.org/projects/suricata/builds/22112658/, https://docs.readthedocs.io/en/stable/config-file/v2.html#build, and https://docs.readthedocs.io/en/stable/config-file/v2.html#build-os). Added the build.os required new field, and adjusted the way python version is passed. For the new configuration style for read the docs, one of the ways to pass extra configuration for python is having a requirements file.	3 years ago
Juliana Fajardini	ffed5eb3d3	doc/quickstart: add software-properties instruction This is indicated in the `Installation` section, but not in the quickstart, and it felt like a valid addition, here, too.	3 years ago
Juliana Fajardini	4ab4f711de	doc/install: link to devguide's install from git Although we have an updated version of instructions for installation from git, our install guide was only referring to RedMine, which is less up-to-date. Kept that reference, since it might still be useful for non-Ubuntu cases.	3 years ago
Shivani Bhardwaj	0a4011655f	doc/code-submission: add commit sign guide	3 years ago
Travis Green	96a0e7016f	doc: add tcp flags documentation Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	2b57179d65	readthedocs: pin theme to sphinx_rtd_theme ReadTheDocs changed the default theme.	3 years ago
Jason Ish	ae3b1a9e36	configure: more idiomatic autoconf for sphinx-build checks - Use SPHINX_BUILD instead of HAVE_SPHINX_BUILD, as here we're actually using the path of the program. - Wrap some elements in [] as is done in modern idiomatic autoconf	3 years ago
Victor Julien	c0201d3212	doc/userguide: add reload-tenant(s) doc	3 years ago
Victor Julien	6ba0956a75	multi-tenant: allow reload w/o yaml path Store yaml path in de ctx, for reloads w/o path. This allows for a simpler `reload-tenant N`, where the previously used yaml is reloaded.	3 years ago
Victor Julien	c87803ea0e	detect: add multi-detect.config-path Add option to specify path from which to load the tenants. Mostly meant to be used in testing.	3 years ago
jason taylor	be324d7856	doc: update file.magic information Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	008cc78a03	doc: update fileext keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	e99b1787a2	doc: update file.name keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Alexandre Iooss	c80941dd8d	doc/userguide: improve SCStreamingBuffer example Add direction indication in SCStreamingBuffer usage example. This adds documentation for the changes introduced by commit `5b1d8c7e94`.	3 years ago
Juliana Fajardini	5cef8fdfdf	userguide/ppa: fix typo The launchpad repo for suricata-beta read 'oisd' instead of 'oisf'	3 years ago
Juliana Fajardini	4fd3205bf0	userguide/install: add info on ubuntu ppa installs Bringing info that was only in our Redmine wiki to our documentation. Task #6231	3 years ago
Juliana Fajardini	765b05f139	docs: miscellanea updates - Fix a DPDK reference link, add some line breaks. - Exemplify what a good commit message looks like, for Suricata's commit style.	3 years ago
Jason Ish	3e2a62915b	doc/userguide: display version on front page When viewing the docs online at Readthedocs, or similar it might be immediately apparent what version of the documentation is being displayed. Display the version on the first line before the table of contents to make it clear.	3 years ago
Andreas Herz	26130d903f	doc: add note about cpu prio overwrite behavior	3 years ago
Andreas Herz	da68692547	doc: dataset - add type to be mandatory	3 years ago
Juliana Fajardini	f16d428fd1	userguide/upgrade: link to exception policy FAQ With the release of 7, people are starting to have issues with traffic being blocked. While we don't add a more expansive documentation for this, add a link to the FAQ covering possible fixes for drops caused by the fail closed default behavior of the exception policies.	3 years ago
Juliana Fajardini	24745b3a73	doc/userguide: update ref to installation from git It was still pointing to the redmine wiki and the documentation to be truthful to the new documentation.	3 years ago
Jason Ish	500a7abf57	doc/support-status: add support status page Convert the wiki page, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Support_Status into a page that is versioned along with the user guide. Includes many updates to reflect our current support status.	3 years ago
Jason Ish	ad94ebddb7	doc/userguide: avoid horizontal scroll on rtd Add CSS to avoid horizontal scroll in tables on ReadTheDocs. This will wrap the text instead. Also, vertically align to top so if a cell does wrap, other cells that do not wrap don't place the text in the middle of the cell.	3 years ago
Juliana Fajardini	9900bdc162	userguide/eve: format and reorganize alert section The `field action` portion seemed to be comprised of a more generic section that followed it. Also formatted the section for lines to be within the character limit.	3 years ago
Juliana Fajardini	0437173848	output/drop: add verdict field Related to Bug #5464	3 years ago
Andreas Herz	24bcaf07ae	doc/upgrade: add more 6 to 7 changes and minor improvements Issue: #5473	3 years ago
jason taylor	62170d2fb9	doc: hyperscan information updated Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c95fce39f0	doc: add multi buffer support note to keyword docs Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	88960e909d	doc: add multiple buffer matching documentation Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	0b5dc58e15	doc/userguide: more eve http upgrade notes Add more information with a examples of how the changes to EVE HTTP logging may affect users.	3 years ago
jason taylor	19a0b2b0d2	userguide: add details about tcp flow pass Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jeff Lucovsky	47e268d609	detect/byte_math: Document bytes variable name Issue: 6145 Document that byte_math accepts a variable name for bytes (optional)	3 years ago
Jeff Lucovsky	3a4554fc2b	detect/byte-jump: Document var usage for nbytes Issue: 6105	3 years ago
Jeff Lucovsky	73b943276e	doc/byte_test: Document byte_test variable usage Issue: 6144 This commit updates the byte_test documentation now that a variable name can be used for the nbytes value.	3 years ago
Lukas Sismis	5a3ecbde62	doc: update install instructions Ticket: #5987	3 years ago
Shivani Bhardwaj	b6f8f5eb3b	doc/http: use "sticky buffer" where applicable	3 years ago
Jeff Lucovsky	ac8f91f44f	config: Document cluster_rollover deprecation Issue: 6128 cluster_rollover is no longer permitted; using it will generate a warning message and it'll be replaced with cluster_flow	3 years ago
Jeff Lucovsky	29621c7f0d	doc/afpacket: Document rollover deprecation	3 years ago

1 2 3 4 5 ...

964 Commits (4b492c2dedf96a4c8e331dc8860545a90b63e0f9)