suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	9419f15779	detect/firewall: reject unsatisfiable app-layer-state rules An app-layer-state comparison that can never hold - mode '>' at or beyond the completion state, or mode '<' at the starting state - can never match. Both are fatal at rule load, so reject them at parsing. The LTE (<hook) form at the first state (progress 0) is accepted and is equivalent to the plain hook form: there are no prior states to auto-accept. Derive the completion state from the direction the keyword resolved in instead of the rule's flags, and document the new load time rejections. Ticket: #8944.	3 weeks ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule As stated, it will refuse to load. Ticket: 8372	6 months ago
Philippe Antoine	15f45be672	doc: fix rules Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	6 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	7 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	7 months ago
Victor Julien	2e2132a16f	doc/userguide: improve pkthdr docs	7 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos To list the protocols we can use a in a rule header Ticket: 635	11 months ago
Victor Julien	48972d544c	doc/userguide: link to protocol details from transactional rules	1 year ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview Explain per protocol mechanics for rule matching.	1 year ago
Victor Julien	be5c83ed53	doc/userguide: add rule hooks to protocol doc Ticket #7662.	1 year ago
Victor Julien	91f258e2bc	doc/userguide: add missing app-layer protocols	1 year ago
Victor Julien	2623e67a80	doc/userguide: add missing rule protocols	1 year ago
Philippe Antoine	3a092f3027	detect: allow rule which need both directions to match Ticket: 5665 This is done with `alert ip any any => any any` The => operator means that we will need both directions	2 years ago
Philippe Antoine	2c305ba37e	pop3: protocol detection Ticket: #6366	2 years ago
Philippe Antoine	44b6aa5e4b	app-layer: websockets protocol support Ticket: 2695	3 years ago
Jeff Lucovsky	7a5a1e2560	doc: Describe noalert keyword Issue: 6685	3 years ago
Victor Julien	0903536fd6	doc: spelling Thanks to Josh Soref.	4 years ago
Philippe Antoine	6bc7f02e13	doc: rules can have http1 as protocol Ticket: #5962	4 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	4 years ago
Eric Leblond	9fb0137d9d	doc: add reference to ipaddr in IP matching	4 years ago
Juliana Fajardini	7b0008d4f0	userguide: add section about exception policies This describes briefly what the exception policies are, what is the engine's behavior, what options are available and to which parts are they implemented. Task #5475 Task #5515	4 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword As it is logged Ticket: #5435	4 years ago
jason taylor	34e0a384ad	doc: update to include additional rule references Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	4405704372	doc: update intro direction content Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	3eeacf8a3d	doc: fixed HOME_NET/EXTERNAL example formatting Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	f2c7998903	doc: add clarity around HOME_NET/EXTERNAL_NET Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	76cca8b08a	doc: minor example rule description update Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	4f61a35fe7	doc: minor wording restructure Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	845ba154a6	doc: add tcp-pkt/tcp-stream to intro Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	56f49bfe8e	doc: minor punctuation update Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	ab300ab0ae	doc: intro example rule update to simpler example Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
jason taylor	2f240230f0	doc: minor intro wording update Signed-off-by: jason taylor <jtfas90@gmail.com>	4 years ago
frank honza	ecdf9f6b0b	ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' \| xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.	6 years ago
Jeff Lucovsky	06f41f608c	doc: Improve grammar, spelling and clarifications This commit improves the overall documentation's grammar, spelling, and adds clarifications where needed.	6 years ago
Philippe Antoine	999af4f62a	http2: adds documentation	6 years ago
Victor Julien	82ac72782d	doc/userguide: update app-proto list	6 years ago
Victor Julien	e6330c354d	doc/userguide: list valid rule actions	6 years ago
Konstantin Klinger	808ea0dba9	app-layer: remove obsolete msn protocol detection	7 years ago
Jason Ish	fb85822730	dhcp: update user guide	8 years ago
Pierre Chifflier	1e5f5d405f	Kerberos 5: add support for TCP as well	8 years ago
Victor Julien	ccde621ceb	doc: add suricata-update to intro for rules	9 years ago
Pierre Chifflier	6eb48e1e93	Add ikev2 to userguide	9 years ago
Ralph Broenink	f6938933d9	doc: Amend the list of accepted protocols Based on the list in suricata.yaml	9 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	9 years ago
Ralph Broenink	11990c7117	doc: Move the definition of modifier keywords to the introduction	9 years ago
Ralph Broenink	dfae19247d	doc: Completely rewrite the rules introduction for more clearity	9 years ago
Ralph Broenink	a52aacb4ea	doc: Replace images of tables and rules with text in rules docs In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis. Additionally, some tables embedded into images were also replaced by reST tables.	9 years ago
Jason Ish	0c6c9784a2	doc: document that that ;, \, " need to be escaped in rules	10 years ago
Victor Julien	e24c3937b3	doc: add rule-management chapter	10 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	10 years ago

50 Commits (5a5dcdab3ed7da488efd58eb20e8cde43391f2c3)