28 Commits (5b1f50ef0de09c11fb9ba513eb47386911f33521)

Author	SHA1	Message	Date
Jason Ish	35bd603ba3	doc/transforms: avoid lua lexer error in luaxform example ... Pygments 2.21 lexes "x < 0 or x > y" in Lua as a Lua 5.4 variable attribute (e.g. "<const>"), producing an error token on the "0". Sphinx reports this as a highlighting failure warning, and as the PDF build treats warnings as errors, "make dist" fails while building the PDF. Reorder the comparisons so the Lua example is lexed correctly. The logic of the example is unchanged.	4 weeks ago
Jeff Lucovsky	2eefb1910d	doc/fixup: Fixup usages of container-example ... There are several places where transform-related container-example helper wasn't formatting rules properly.	4 months ago
Jeff Lucovsky	d2e3bf1d34	doc: document xor transform variable key and offset syntax ... Add user-facing documentation for the xor transform's 'extract <nbytes> <offset>' syntax and offset parameter in rules/transforms.rst. Add a devguide section (devguide/extending/detect/transforms.rst) covering the detection pipeline execution order, how transforms run before detection-time keywords, and how xor reads key bytes directly from the raw buffer at a specified position and width. Explains how the engine deduplicates inspection buffers for rules with variable keys at different buffer positions. Issue: 8671	4 months ago
Jeff Lucovsky	5d007ef25e	detect/xor: add inline variable key syntax ... Extend the xor transform to accept a variable-position key using the 'extract <nbytes> <offset>' syntax. The engine reads <nbytes> bytes at buffer position <offset> at transform time. The optional 'offset' parameter specifies where XOR decoding starts in the buffer; bytes before that position are left unchanged. Syntax: xor:"<hex_key>" xor:extract <nbytes> <offset> xor:offset <N>,"<hex_key>" xor:offset <N>,extract <nbytes> <offset> Variable-key helpers (VariableKeyLocation, variable_key_bytes, parse_key_location, strip_keyword_prefix) are imported from the new varkey module. The variable key bytes are copied out of the inspection buffer before decoding, so an in-place transform cannot corrupt the key when the key region overlaps the decoded range. Issue: 8671	4 months ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform ... Add documentation for the subslice transform. Issue: 7672	6 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container ... Ticket: 8372 Also remove dead code from script checking the rules	6 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms ... Ticket: 7846	8 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform ... Ticket: 7846	8 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform ... Ticket: 7846	8 months ago
Jeff Lucovsky	845544aad3	doc/luaxform: Clarify luaxform calling convention ... Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function.	11 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	12 months ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values ... Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	1 year ago
Jeff Lucovsky	53c8a0f8f1	doc: Document luaxform transform ... Issue: 2290	1 year ago
Eric Leblond	ed20e7cfe4	doc/userguide: doc domain and tld transforms	2 years ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	2 years ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform ... Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	2 years ago
Philippe Antoine	adf5e6da7b	detect: strip_pseudo_headers transform ... Ticket: 6546	3 years ago
Philippe Antoine	32cce122e1	detect: header_lowercase transform ... Ticket: 6290	3 years ago
Jeff Lucovsky	9ee55d2394	doc/transform: Document case-changing transforms. ... Issue: 6439	3 years ago
Philippe Antoine	0cfdec1266	detect: xor transform ... Ticket: 3285 The xor transform applies xor decoding to a buffer, with a key specified as an option in hexadecimal. Arbitrary key sizes are accepted.	5 years ago
Jason Ish	547afcb983	doc/userguide/transforms: remove not about libnss being required	6 years ago
Philippe Antoine	1569f3e349	transform: adds url_decode keyword ... Fixes https://redmine.openinfosecfoundation.org/issues/2689 Adds a new source file to handle this keyword. And modifies documentation, Makefile, and registration accordingly. url_decode decodes url-encoded data, ie replacing '+' with space and '%HH' with its value.	6 years ago
Jeff Lucovsky	3005dca3fd	doc: pcrexform documentation	6 years ago
Victor Julien	6aa2d550a1	doc/dotprefix: fix example rules	7 years ago
Jeff Lucovsky	ab3d6328ba	detect/transform: add dotprefix keyword to doc	7 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	8 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	8 years ago
Victor Julien	72dd4a5f92	doc/rules: initial transforms documentation	8 years ago