408 Commits (73455179d74c7cb84d8b0136c0fe7a428f6c1bfe)

Author	SHA1	Message	Date
Alice Akaki	73455179d7	detect/integers: add support for negated strings when enum is used ... function detect_parse_uint_enum can parse strings like !bind_request Ticket: #7513	5 months ago
Jeff Lucovsky	beec1eac2f	doc/decode-events: new: unknown event description ... Issue: 7129 Document the unknown ethertype event.	6 months ago
Jeff Lucovsky	e9128e66e6	doc/threshold: Threshold keyword clarifications ... Issue: 7129	6 months ago
Juliana Fajardini	a2905ae5d4	userguide: explain rule types and categorization ... Add documentation about the rule types introduced by commit 2696fda041. Add doc tags around code definitions that are referenced in the docs. Task #https://redmine.openinfosecfoundation.org/issues/7031	6 months ago
Jeff Lucovsky	53abe1e5d7	doc: Add ftp.command sticky buffer ... Issue: 7502 This commit documents the new FTP sticky buffer "ftp.command".	6 months ago
Philippe Antoine	c5f3d33e51	detect/smtp: smtp.rcpt_to keyword ... Ticket: 7516 It is a sticky buffer mapping to the smtp.rcpt_to[] log field It is a multi-buffer	6 months ago
Philippe Antoine	32594766b7	detect/smtp: smtp.mail_from keyword ... Ticket: 7517 It is a sticky buffer mapping to the smtp.mail_from log field	6 months ago
Philippe Antoine	3d3b1ade9d	detect/smtp: smtp.helo keyword ... Ticket: 7515 It is a sticky buffer mapping to the smtp.helo log field	6 months ago
Alice Akaki	8416289752	detect: add ldap.responses.count ... ldap.responses.count matches on the number of LDAP responses This keyword maps to the eve field len(ldap.responses[]) It is an unsigned 32-bit integer Doesn't support prefiltering Ticket: #7453	6 months ago
Alice Akaki	da593abd99	detect: add ldap.responses.operation ... ldap.responses.operation matches on Lightweight Directory Access Protocol response operations This keyword maps to the eve field ldap.responses[].operation It is an unsigned 8-bit integer Doesn't support prefiltering Ticket: #7453	6 months ago
Alice Akaki	cdb043810f	detect: add ldap.request.operation ... ldap.request.operation matches on Lightweight Directory Access Protocol request operations This keyword maps to the eve field ldap.request.operation It is an unsigned 8-bit integer Doesn't support prefiltering Ticket: #7453	6 months ago
Alice Akaki	078c6469a0	detect: add vlan.layers keyword ... vlan.layers matches on the number of VLAN layers per packet It is an unsigned 8-bit integer Valid range = [0-3] Supports prefiltering Ticket: #1065	6 months ago
Alice Akaki	b1c2643c87	detect: add vlan.id keyword ... vlan.id matches on Virtual Local Area Network IDs It is an unsigned 16-bit integer Valid range = [0-4095] Supports prefiltering Ticket: #1065	6 months ago
Shivani Bhardwaj	ad7ff1c91b	flow/pkts: allow matching on either direction ... For flow.bytes and flow.pkts keywords, allow matching in either direction. Feature 5646	6 months ago
Shivani Bhardwaj	52fd695e5a	doc: update syntax for flow.pkts & flow.bytes	6 months ago
Juliana Fajardini	6e4a501e7c	flowint: add isnotset support ... Similar keywords use `isnotset`, while `flowint` only accepted `notset` Opted to change the code, not only the regex, to keep the underlying code also following the same patterns. Task #7426	7 months ago
Jason Ish	289ff25f5b	requires: support requires check for keyword ... For example: requires: keyword foo; Will require that Suricata supports the "foo" keyword. Ticket: #7403	8 months ago
Jason Ish	820a3e51b7	requires: treat unknown requires keywords as unmet requirements ... For example, "requires: foo bar" is an unknown requirement, however its not tracked, nor an error as it follows the syntax. Instead, record these unknown keywords, and fail the requirements check if any are present. A future version of Suricata may have new requires keywords, for example a check for keywords. Ticket: #7418	8 months ago
Philippe Antoine	4ec90bd227	detect: absent keyword to test absence of sticky buffer ... Ticket: 2224 It takes an argument to match only if the buffer is absent, or it can still match if the buffer is present, but we test the absence of some content. For multi buffers, absent matches if there are 0 buffers. For file keywords, absent matches if there is no file.	8 months ago
Juliana Fajardini	1860aa81e6	userguide: fix integer keyword matches list format ... List wasn't being properly rendered.	9 months ago
Philippe Antoine	e47598110a	detect/datasets: implement unset command ... Ticket: 7195 Otherwise, Suricata aborted on such a rule	10 months ago
Giuseppe Longo	036b68b0a9	doc: add new sip keywords	10 months ago
jason taylor	f46a8776ec	doc: add note about big endian for icmp_seq match	10 months ago
Philippe Antoine	0ebb84538e	http2: add frames support ... Ticket: 5743 Why ? To add detection capabilities	10 months ago
Juliana Fajardini	246acc7140	userguide: clarify flow:stateless explanation ... While not incorrect, the previous wording made the sentence almost paradoxical. While at it, also highlight a side effect that might not be so clear to users. Related to Bug #6976	11 months ago
Philippe Antoine	62a186ceef	detect/rfb: move keywords to rust ... Ticket: 7178 On the way, convert rfb.secresult to a generic integer with enumeration cf ticket 6723	11 months ago
Philippe Antoine	0b2ed97f36	ssh: frames support ... Ticket: 5734 Adds frames for SSH records, that come after banner, and before the data is encrypted. These records may contain cipher lists for instance.	12 months ago
Philippe Antoine	bce8f4b853	detect/ssh: remove deprecated keywords ... Ticket: 2377	1 year ago
Philippe Antoine	0a1062fad2	detect/mqtt: move keywords to rust ... Ticket: 4863 On the way, convert some keywords to use the first-class integer support. And helpers for pure rust the support for multi-buffer. Move the C unit tests about keyword mqtt.protocol_version to unit tests for generic integer parsing, and test version 5 instead of testing twice version 3. Also iterate all tx's messages for reason code as is done for other keywords. And allow detection on empty topics.	1 year ago
Victor Julien	afc318737a	doc/userguide: document threshold backoff type	1 year ago
Victor Julien	e362a01f8d	doc/userguide: document new threshold config options	1 year ago
Victor Julien	405491c3fc	detect/detection_filter: add support for track by_flow	1 year ago
Victor Julien	3f04af7c7f	doc: add thresholding by_flow	1 year ago
Jeff Lucovsky	01e20c91fb	doc/transform: Correct typo	1 year ago
Jeff Lucovsky	d205ff82d0	doc/transform: Describe the from_base64 transform ... Issue: 6487 Document the new transform and indicate that it's the preferred way to perform base64 decoding (preferred over base64_decode)	1 year ago
Victor Julien	3d059611c3	detect: add tls.alpn keyword ... Ticket: #7108.	1 year ago
Philippe Antoine	ae72376ebe	detect/snmp: move keywords to rust ... Ticket: 4863 On the way, convert unit test DetectSNMPCommunityTest to a SV test. And also, make snmp.pdu_type use a generic uint32 for detection, allowing operators, instead of just equality.	1 year ago
Victor Julien	8b42182fee	doc/userguide: document iprep isset/isnotset	1 year ago
Victor Julien	2f74d435d3	doc/userguide: add more operators to iprep	1 year ago
Victor Julien	50ef646d45	doc/userguide: add noalert/alert keyword docs	1 year ago
Victor Julien	c83e3285ae	doc/userguide: give pcre1 to pcre2 proper heading	1 year ago
Philippe Antoine	82c03f72c3	enip: convert to rust ... Ticket: 3958 - transactions are now bidirectional - there is a logger - gap support is improved with probing for resync - frames support - app-layer events - enip_command keyword accepts now string enumeration as values. - add enip.status keyword - add keywords : enip.product_name, enip.protocol_version, enip.revision, enip.identity_status, enip.state, enip.serial, enip.product_code, enip.device_type, enip.vendor_id, enip.capabilities, enip.cip_attribute, enip.cip_class, enip.cip_instance, enip.cip_status, enip.cip_extendedstatus	1 year ago
Victor Julien	17b32f98d7	doc/userguide: fix rule container typo ... Fixes: 8781e9352a ("doc/userguide: add documentation for SMTP frames")	1 year ago
Victor Julien	8781e9352a	doc/userguide: add documentation for SMTP frames	1 year ago
Jason Ish	3eb8c728fd	doc: update lua sandbox docs for allowed packages/functions	1 year ago
Jo Johnson	ba6a976e06	doc: Initial doc for lua sandbox	1 year ago
Jo Johnson	712496bb3f	lua: Remove luajit support ... lua 5.4 support is not available in luajit Ticket: #4776	1 year ago
Shivani Bhardwaj	719fda3967	doc: add description about tls.subjectaltname ... Feature 5234	1 year ago
Philippe Antoine	2c305ba37e	pop3: protocol detection ... Ticket: #6366	1 year ago
Philippe Antoine	fcdd7f000a	detect: add options to app-layer-protocol keyword ... Ticket: 4921 app-layer-protocol keyword accept an optional mode to precise which protocol we want to match: toclient, toserver, final, or original	1 year ago