1421 Commits (5bbe99188b71ccd9d9b2d0130857df50b6fd0600)

Author	SHA1	Message	Date
Jason Ish	899e9f045e	ntp: expose logged fields to lua ... This includes: - version - mode - stratum - reference_id Ticket: #8533	2 months ago
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target ... Ticket: 6502 Forbid dashes in json keys for better use by processing tools	2 months ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform ... Add documentation for the subslice transform. Issue: 7672	2 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container ... Ticket: 8372 Also remove dead code from script checking the rules	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword ... Ticket: 8179	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword ... Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword ... This keyword also accepts strings for known mode names. Ticket: #8429	3 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword ... Ticket: #8431	3 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword ... SNMP was used as a template. Ticket: #8430	3 months ago
Jason Ish	31b967b089	ntp: add transaction logging ... Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword ... Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler ... Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	3 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	3 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule ... Ticket: 8372 And fix another bad rule	3 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule ... As stated, it will refuse to load. Ticket: 8372	3 months ago
Philippe Antoine	15f45be672	doc: fix rules ... Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	3 months ago
Jason Ish	a11aaadd86	plugins: add --plugin command line option to load plugins ... Add --plugin <PATH> to load an additional plugin from the command line. This is more convenient than "--set plugins.X" especially when you may already have a plugins loaded and you want to load an additional one. Ticket: 8463	3 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	3 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	3 months ago
Victor Julien	e6381a3c22	doc/userguide: add note on rule reloads ... Cannot be combined with --firewall-rules-exclusive	3 months ago
Victor Julien	f99b86beab	doc/userguide: document L2 firewall handling of ARP	3 months ago
Victor Julien	2e2132a16f	doc/userguide: improve pkthdr docs	3 months ago
Victor Julien	61a7f47a69	detect: add ether.hdr keyword ... Sticky buffer to inspect the ethernet header. Example rule: alert ether any any -> any any ( \ ether.hdr; content:"|08 06|"; offset:12; depth:2; \ sid:1;) Ticket: #8327.	3 months ago
Jeff Lucovsky	e7dc0d885b	doc/config: Update flushing description ... Update output flushing description to reflect EVE based approach in documentation and config template. Issue: 8286	4 months ago
Juliana Fajardini	c790a9f774	userguide/exceptions: update for qa-simulation use ... The docs still referred to ``debug`` mode. Related to Task #7885	4 months ago
Juliana Fajardini	56917cf8f3	rules: fix typos & missing keywords in examples ... Task #8372	4 months ago
Juliana Fajardini	8c29c471b4	userguide: add references to rules/README to docs ... To make it more visible/easier to find.	4 months ago
Jason Ish	8c7172e707	lib: remove the built-in library run-mode ... This run-mode does not allow for capture ThreadVars to be created at the appropriate place in the application life cycle. Instead, applications should register their own custom run-mode. Ticket: #8259	4 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms ... Ticket: 7846	4 months ago
Jeff Lucovsky	5a3a2d5fd1	doc/output: Document the IPv6 display behavior ... Issue: 7399 Document the IPv6 display behavior and how to display IPv6 addresses in their compressed form (per RFC-5952).	4 months ago
Shivani Bhardwaj	0e345c93ca	app-layer: check ipproto enabled setting first ... If the key `app-layer.protocols.PROTO.enabled` is present, the protocol is enabled for all carrier protocols. This is not ideal. Only if the key `app-layer.protocols.PROTO.enabled` is missing, an attempt is made to look for a setting specific to the ipproto passed at the time of registration e.g. `app-layer.protocols.PROTO.udp.enabled`. By default, check for carrier proto specific setting. If it is not found, then fall back to the generic setting. Issue a warning in case an inconsistent combination of global and ipproto specific setting is found. Bug 8205	4 months ago
Victor Julien	2480f8c038	doc: fix dcerpc.opnum documentation ... Docs were claiming greater than, less than, etc. support even though this was never supported. Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords") Ticket: #8330.	4 months ago
Victor Julien	fe3cce895c	doc/userguide: add igmp keyword docs	4 months ago
Victor Julien	7e6fd09e90	doc/userguide: add missing ipopts values	4 months ago
Juliana Fajardini	90823fa90e	devguide: add policy on patches w unasigned ticket	5 months ago
Jason Ish	66473f6ad7	doc: add more public datasets ... Add: - UNSW-NB15 - CIC-IDS2017 - CSE-CIC-IDS2018 - CIC-DDoS2019 Update formatting for better display.	5 months ago
Juliana Fajardini	926fde859e	userguide: fix Deprecations, warn about syslog ... The Deprecation note on Syslog was partly conveying the opposite message, and we were missing a deprecation notice on the Syslog output section.	5 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust ... Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	5 months ago
Sven Cuyt	1246f1cf8c	doc/userguide: add link to differences-from-snort ... Ticket: #8031.	5 months ago
Sven Cuyt	a0cc534471	doc/userguide: fix table showing example payload ... Ticket: #8031.	5 months ago
Sven Cuyt	2d662538e5	doc/userguide: add example with non-zero offset for relative isdataat ... Ticket: #8031.	5 months ago
Victor Julien	7c5285e5e6	doc/userguide: explain isdataat absolute vs relative difference ... Ticket: #8031.	5 months ago
Philippe Antoine	d378610e93	stream: non infinite default value for reassembly.depth ... So that empty config have a safer default. Ticket: 8290	5 months ago
Ofer Dagan	e1f9d8a067	pcap: refactor delete-when-done to support non-alerts ... Refactor pcap file deletion to use a single delete-when-done option with three values instead of separate boolean options: - false (default): No deletion - true: Always delete files - "non-alerts": Delete only files with no alerts Also account for alerts produced by pseudo packets (flow timeout / shutdown flush): - Introduce small capture hooks and invoke on pseudo-packet creation so the capture layer can retain references and observe alerts emitted after the last live packet - Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads Key changes: - Replace should_delete/delete_non_alerts_only bools with enum - Move alert counter from global to per-file PcapFileFileVars - Relocate alert counting from PacketAlertFinalize to pcap module - Ensure thread safety for both single and continuous pcap modes - Add unit tests for configuration parsing and pseudo-packet alert path The --pcap-file-delete command line option overrides YAML config and forces "always delete" mode for backward compatibility. Documentation updated to reflect the new three-value configuration. Fixes OISF#7786	5 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform ... Ticket: 7846	5 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform ... Ticket: 7846	5 months ago
Jason Ish	1b182025bc	output-eve: expose SCEveFileType to Rust with bindgen ... There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.	5 months ago
Jason Ish	2defd5ae5a	userguide/Makefile: don't add "install" to EXTRA_DIST ... Adding the directory "install" to EXTRA_DIST, actually triggers make to run "make install", which is not what we want. Instead, avoid this magic keyword and list the files in the install directory individually. If the user doesn't have permission to install files to the prefix, like "/usr", then "make dist" can fail. Worse, even they do have permission to write into the prefix, a "make dist" will install files there when it shouldn't. Ticket: #8279	5 months ago
Philippe Antoine	a079d1c68a	src: remove unused enum values	5 months ago