suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	9c244c978a	snmp/detect: add snmp.trap_address keyword Ticket: 8486	1 month ago
Philippe Antoine	08b0adf09d	snmp/detect: add snmp.trap_oid keyword Ticket: 8485	1 month ago
Yash Datre	43bc2db41e	detect: extend app-layer-protocol to accept a pipe-separated value list Extend the app-layer-protocol keyword to accept a pipe-separated list of protocol values, so a single rule can match any of several protocols: app-layer-protocol:[!]<proto1>\|<proto2>[\|...][,<qualifier>]...; A non-negated list matches when the flow's protocol equals any listed value (OR); a negated list matches when it equals none of them (NOR). The single-value form and the trailing mode qualifier are unchanged. Matching keeps the historical AppProtoEquals() equivalences by default (dns/doh2, http/http1/http2, dcerpc/smb, ...). An `exact` qualifier selects strict identity matching with no equivalences and no http umbrella; it combines with a direction mode in any order. Because a flow is never the generic ALPROTO_HTTP, `http,exact` is rejected at load. Values are expanded once at rule load into an effective match-set bitmask, so the per-packet match is a single bitmask test. Single-value rules remain prefilterable; multi-value rules are excluded from prefiltering and an explicit prefilter on them is rejected. Conflicting keyword combinations (duplicate or overlapping negations, mixed positive/negated) are rejected at load. Engine-analysis reports the effective match set. Ticket: 7705	1 month ago
Philippe Antoine	2205761bf6	doc: add missing "value" to entropy examples Commit from Hydraze	1 month ago
Philippe Antoine	e08a19a88a	detect/enip: cip_class and cip_instance are now a multi-integer Ticket: 7929 One commit as they share the same code	1 month ago
Philippe Antoine	0bdfe3f571	detect/enip: cip_attribute keyword is now a multi-integer Ticket: 7929	1 month ago
Philippe Antoine	09f0851043	detect/krb5: fix doc about cname and sname keywords These keywords match only in to_client direction, even if the fields are logged in both directions	1 month ago
Philippe Antoine	3327cf42f0	detect/krb5: move krb5_err_code to rust Ticket: 8648 Make it a generic integer on the way	1 month ago
Jason Ish	f59960d42b	ftp: support STOU data transfers Support STOU on the FTP data channel. With STOU a filename is optional. If no filname is provided, use "<stou>". The server does respond with the filename to use, but there can be a race condition in getting this filename and setting up file storage before data starts flowing. Ticket: #8664	1 month ago
Jason Ish	e65bf4c905	ftp: support APPE data transfers Support the APPE (append) command on the ftp data channel. Like STOR, APPE uploads file content on the data channel. Ticket: #8664	1 month ago
Jason Ish	5856ced29c	ftp: support LIST and MLSD data channels Support LIST and MLSD on the ftp data channel. Ticket: #8664	1 month ago
Philippe Antoine	f092d07f6d	decode/sctp: chunk_cnt can be a u16 Ticket: 8661	2 months ago
Jeff Lucovsky	2eefb1910d	doc/fixup: Fixup usages of container-example There are several places where transform-related container-example helper wasn't formatting rules properly.	2 months ago
Jeff Lucovsky	d2e3bf1d34	doc: document xor transform variable key and offset syntax Add user-facing documentation for the xor transform's 'extract <nbytes> <offset>' syntax and offset parameter in rules/transforms.rst. Add a devguide section (devguide/extending/detect/transforms.rst) covering the detection pipeline execution order, how transforms run before detection-time keywords, and how xor reads key bytes directly from the raw buffer at a specified position and width. Explains how the engine deduplicates inspection buffers for rules with variable keys at different buffer positions. Issue: 8671	2 months ago
Jeff Lucovsky	5d007ef25e	detect/xor: add inline variable key syntax Extend the xor transform to accept a variable-position key using the 'extract <nbytes> <offset>' syntax. The engine reads <nbytes> bytes at buffer position <offset> at transform time. The optional 'offset' parameter specifies where XOR decoding starts in the buffer; bytes before that position are left unchanged. Syntax: xor:"<hex_key>" xor:extract <nbytes> <offset> xor:offset <N>,"<hex_key>" xor:offset <N>,extract <nbytes> <offset> Variable-key helpers (VariableKeyLocation, variable_key_bytes, parse_key_location, strip_keyword_prefix) are imported from the new varkey module. The variable key bytes are copied out of the inspection buffer before decoding, so an in-place transform cannot corrupt the key when the key region overlaps the decoded range. Issue: 8671	2 months ago
Giuseppe Longo	d892eb8e0e	doc/sctp: add sctp keywords Add documentation for all sctp keywords. Ticket #4251	2 months ago
Antoine Abou Faysal	b09b04857a	doc/userguide: add dataset match subdomain documentation Ticket: 8385	2 months ago
Shivani Bhardwaj	899eb38691	flowbits: deprecate toggle command toggle command is not used by any major rulesets and increases the state complexity of flowbits management. Also, all operations can be carried out with the combination of other available commands. So, remove it. Task 8595	2 months ago
Giuseppe Longo	143774220e	doc: add llmnr Ticket #8366	2 months ago
Juliana Fajardini	a783007408	detect/bypass: ban bypass keyword for firewall mode Related to Ticket #8551	2 months ago
Juliana Fajardini	edaa912ed9	detect: ban `replace` keyword for firewall mode Ticket #8551	2 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	3 months ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform Add documentation for the subslice transform. Issue: 7672	3 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container Ticket: 8372 Also remove dead code from script checking the rules	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	4 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	4 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	4 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	4 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	4 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	4 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	4 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule Ticket: 8372 And fix another bad rule	4 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule As stated, it will refuse to load. Ticket: 8372	4 months ago
Philippe Antoine	15f45be672	doc: fix rules Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	4 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	4 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	4 months ago
Victor Julien	2e2132a16f	doc/userguide: improve pkthdr docs	4 months ago
Victor Julien	61a7f47a69	detect: add ether.hdr keyword Sticky buffer to inspect the ethernet header. Example rule: alert ether any any -> any any ( \ ether.hdr; content:"\|08 06\|"; offset:12; depth:2; \ sid:1;) Ticket: #8327.	4 months ago
Juliana Fajardini	8c29c471b4	userguide: add references to rules/README to docs To make it more visible/easier to find.	5 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms Ticket: 7846	5 months ago
Victor Julien	2480f8c038	doc: fix dcerpc.opnum documentation Docs were claiming greater than, less than, etc. support even though this was never supported. Fixes: `51be8f0238` ("doc/dcerpc: add proto keywords") Ticket: #8330.	5 months ago
Victor Julien	fe3cce895c	doc/userguide: add igmp keyword docs	5 months ago
Victor Julien	7e6fd09e90	doc/userguide: add missing ipopts values	5 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	6 months ago
Sven Cuyt	1246f1cf8c	doc/userguide: add link to differences-from-snort Ticket: #8031.	6 months ago
Sven Cuyt	a0cc534471	doc/userguide: fix table showing example payload Ticket: #8031.	6 months ago
Sven Cuyt	2d662538e5	doc/userguide: add example with non-zero offset for relative isdataat Ticket: #8031.	6 months ago
Victor Julien	7c5285e5e6	doc/userguide: explain isdataat absolute vs relative difference Ticket: #8031.	6 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform Ticket: 7846	6 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform Ticket: 7846	6 months ago

1 2 3 4 5 ...

589 Commits (88d2f67a3b5cae367cb69c6aec3d9cb77e46dadd)