125 Commits (535938d7f67715ec67ab0c8dd99aa3a670f89d0a)

Author	SHA1	Message	Date
Victor Julien	c0201d3212	doc/userguide: add reload-tenant(s) doc	2 years ago
Victor Julien	c87803ea0e	detect: add multi-detect.config-path ... Add option to specify path from which to load the tenants. Mostly meant to be used in testing.	2 years ago
Andreas Herz	26130d903f	doc: add note about cpu prio overwrite behavior	2 years ago
jason taylor	19a0b2b0d2	userguide: add details about tcp flow pass ... Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Juliana Fajardini	e306bc6ecc	exception: fix use of master switch with default ... If an exception policy wasn't set up individually, use the GetDefault function to pick one. This will check for the master switch option and handle 'auto' cases. Instead of deciding what the auto value should be when we are parsing the master switch, leave that for when some of the other policies is to be set via the master switch, when since this can change for specific exception policies - like for midstream, for instance. Update exceptions policies documentation to clarify that the default configuration in IPS when midstream is enabled is `ignore`, not `drop-flow`. Bug #6169	2 years ago
Jeff Lucovsky	d822ba58e1	doc/multi-tenant: Clarify live traffic support ... Issue: 5930 This commit clarifies the live traffic support for multi-tenancy.	2 years ago
Shivani Bhardwaj	aeb408dd9d	doc: fix typo encryption-handling	2 years ago
liaozhiyuan	a748164d58	dpdk: support multiple same EAL arguments ... DPDK apps can specify multiple arguments of the same type. YAML format only allows unique keys within a single node. This commit adds support for multiple EAL arguments of the same type to be used within suricata.yaml. Ticket: #5964	2 years ago
Jason Ish	4a97461f9a	doc/userguide: notes about Lua rules being disabled by default	2 years ago
Juliana Fajardini	c0db25d055	userguide: update exception policy behaviors table ... Some exception policies can only be applied to the triggering packet or only make sense considering the whole flow. Highlight such cases in the table showing each exception policy. Related to Bug #5825	2 years ago
Juliana Fajardini	0c2922f02e	doc: add midstream scenarios for exception policy ... The different interactions between midstream pick-up sessions and the exception policy can be quite difficult to visualize. Add a section for that in the userguide. Related to Bug #5825	2 years ago
Juliana Fajardini	f83c67bbb5	doc: add missing rule to engine-analysis section ... The first report didn't have an example rule to go with.	2 years ago
Jason Ish	5af73b3879	doc/userguide: document include files ... Document how to use include files, plus add a deprecation notice on the use of multiple "include" statements.	2 years ago
Lukas Sismis	1c3cb1e8cc	docs: refactor DPDK docs and add performance tuning section ... Ticket: #5857 Ticket: #5858	2 years ago
Lukas Sismis	03319263db	docs: wrap DPDK doc section at 80 chars	2 years ago
Lukas Sismis	d0bf3ba638	dpdk: add configure option ... Ticket: #5859	2 years ago
Victor Julien	0903536fd6	doc: spelling ... Thanks to Josh Soref.	2 years ago
Philippe Antoine	9bd2b72e2b	doc: explain where tls.store stores certificates ... By adding a reference/link to the doc about the suricata.yaml config section pecifying the directory where the certificates are stored	2 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	2 years ago
Morris Chan	b9aac6dd18	yaml: grammar fixup	2 years ago
Jeff Lucovsky	0ad6d4358f	add to doc/pfring: Document additional cluster types	2 years ago
Jeff Lucovsky	b1918168f9	doc/pfring: Document additional cluster types ... This commit adds brief discussion for additional cluster types for use with the pf-ring packet source. Newly added: - cluster_inner_flow - cluster_inner_flow_2_tuple - cluster_inner_flow_4_tuple - cluster_inner_flow_5_tuple Issue: 5975	2 years ago
Juliana Fajardini	d314b57e6b	userguide/muti-tenant: fix typo	2 years ago
jason taylor	5abcd50142	doc: add tenant id value requirement ... Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Juliana Fajardini	31066c7c3b	docs: clarify exception policy's supported values ... As flow.memcap-policy and defrag.memcap-policy do not support flow actions, clarify that in the documentation. Also fix some typos, and add missing values in some places where the exception policies were explained. Related to Bug #5940	2 years ago
Philippe Antoine	b52293b609	dcerpc: config limit maximum number of live transactions ... As is done for other protocols Ticket: #5779	2 years ago
Juliana Fajardini	918bd7435c	userguide/config: update log format symbols list ... There were some possible format options missing after the recent changes in the log format.	2 years ago
Juliana Fajardini	0d9289014b	exceptions: add master switch config option ... This allows all traffic Exception Policies to be set from one configuration point. All exception policy options are available in IPS mode. Bypass, pass and auto (disabled) are also available in iDS mode Exception Policies set up individually will overwrite this setup for the given traffic exception. Task #5219	2 years ago
Philippe Antoine	55c4834e4e	smb: configurable max number of transactions per flow ... Ticket: #5753	2 years ago
Jason Ish	48f0fd3c74	doc/userguide: update logging section for time formats ... - Update fragment of configuration file to match suricata.yaml with new default-log-format. - Document new %z format specifier.	2 years ago
Juliana Fajardini	377885f420	exception-policies: fix typos	2 years ago
Philippe Antoine	a003640ecf	security: prevents process creation ... with setrlimit NPROC. So that, if Suricata wants to execve or such to create a new process the OS will forbid it so that RCE exploits are more painful to write. Ticket: #5373	2 years ago
Richard McConnell	7f4c1d5e2f	doc/systemd: add documentation for sd_notify	2 years ago
Lukas Sismis	a4a69c3e71	doc/dpdk: add IPS setup docs for DPDK mode ... Ticket: #5511	2 years ago
Juliana Fajardini	7b0008d4f0	userguide: add section about exception policies ... This describes briefly what the exception policies are, what is the engine's behavior, what options are available and to which parts are they implemented. Task #5475 Task #5515	2 years ago
Juliana Fajardini	6f294f2f2d	userguide: minor rewording and typo fixes ... Some of these were recently introduced, some were highlited after the applayer sections got merged. Some paragraphs seem to have been changed due to trying to respect character limits for lines. Also includes a typo pointed out by one of our community members via Discord.	2 years ago
Philippe Antoine	af40873127	pgsql: config limit maximum number of live transactions ... As is done for other protocols Ticket: #5527	2 years ago
Eric Leblond	1b24f4d357	doc: document landlock feature	3 years ago
Philippe Antoine	fe91506320	doc/http2: suricata.yaml max-streams parameter ... Ticket: #4949	3 years ago
Juliana Fajardini	bbd968c738	exceptions: add reject support to exception policy ... This enables the usage of 'reject' as an exception policy. As for both IPS and IDS modes the intended result of sending a reject packet is to reject the related flow, this will effectively mean setting the reject action to the packet that triggered the exception condition, and then dropping the associated flow. Task #5503	3 years ago
Juliana Fajardini	ef54f36e34	userguide: briefly introduce exception policy opts ... Added them in the configuration section so folks can be more aware of them, while a more complete documentation isn't around. Related to Task #5475	3 years ago
Juliana Fajardini	3c74e443bd	userguide: update defrag settings options ... We were still mentioning that there were only three options.	3 years ago
Juliana Fajardini	0cc040cf61	userguide: merge sections about AppLayer Parsers ... We had two sections under the suricata.yaml configuration section describing settings for application layer parsers. This merges them into one and also fixes a few subsection title levels. Task #5364	3 years ago
Jufajardini Reichow	f9c9091bb5	userguide: fix typo in inline mode illustration ... The image describing Suricata's sliding window had two of the "packets" with the same text. Now they actually give the sense of a sliding window. This was found by Zhiyuan-liao.	3 years ago
Andreas Dolp	db73a12540	doc/tls: Add documentation for TLS logging	3 years ago
Andreas Dolp	e4163c4e02	doc: Fix typos	3 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Eric Leblond	0c7e4c13a1	doc: add conditional pcap logging info	3 years ago
Juliana Fajardini	1956dc3d5d	userguide: explain alert queue behavior and stats ... Added sections along packet-alert-max config section explaining packet alert queue overflow (when Suri reaches packet alert max), when alerts are discarded etc. Since from the user perspective it shouldn't matter how we process the alert queue, the term "replace" is used, even though there's not exactly a replacing action happening, with the queue bein pre-processed before being appended to the Packet. Also described the associated stats and added an explanation on when to change packet-alert-max. Task #5178	3 years ago
Juliana Fajardini	49542d0f1b	doc/userguide: explain packet-alert-max config ... Task #4207	3 years ago