aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
19,203 Commits
8 Branches
174 Tags
255 MiB
main
main-8.0.x
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.7
suricata-8.0.6
suricata-7.0.17
suricata-8.0.5
suricata-7.0.16
suricata-8.0.4
suricata-7.0.15
suricata-8.0.3
suricata-7.0.14
suricata-8.0.2
suricata-7.0.13
suricata-8.0.1
suricata-7.0.12
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '9cd778b33a'
${ noResults }
Commit Graph

1339 Commits (9cd778b33aba36ea73607a55e1ed17d7197b32ef)

Author SHA1 Message Date
Shivani Bhardwaj 6702791a9c doc: add dcerpc.max-stub-size config param 10 months ago
Jason Ish 2c95f1ff44 dnp3: bound the maximum number of objects per tx 
Default to 2048, but provide a user configuration value.

Ticket: #8181
 10 months ago
Jason Ish 3a32bb5743 dnp3: set a bound on the number of points per message 
16384 is used as the max, but a configuration parameter has been
provided. The reason for setting an upper bound is that bit flags can
create a memory amplification as we parse them into individual data
structures.

Ticket: #8181
 10 months ago
Jason Ish a16f087b93 dnp3: reduce flood threshold to 32 and make configurable 
Lower the number of unreplied requests from 500 to 32 to consider a
flood. At the very least this is an anomaly given the DNP3 spec mentions
that DNP3 should only have one outstanding request at a time, with an
exception for unsolicited responses, so in practice no more than 2
should be seen.

Additionally make this value configurable by introducing the max-tx
parameter.

Ticket: #8181
 10 months ago
Lukas Sismis b596073a79 src: doc: remove double-space typos 10 months ago
Shivani Bhardwaj 30bdaa44e1 doc: add elephant.flow usage section 10 months ago
Shivani Bhardwaj 06eafb79d6 detect/flow-pkts: check for both dir 
The functionality of "both" can already be easily achieved by using both
"toclient" and "toserver" in a rule. This just adds the ease of
expression in rule. As it is added now, check the direction for the
pre-existing users of direction as well.
 10 months ago
Juliana Fajardini 0ca874b678 userguide: highlight exceptions interactions 
In corner cases, we assume that a midstream exception policy could be
triggered by a prior exception policy in effect. Explain this in the
docs.

Task #5830
 11 months ago
Ambre Iooss 91c9e34419 doc/userguide: update windivert instructions 
The IPS documentation for Windows had a dead link
to a PDF. Update the Windows build page to include
WinDivert instructions.

Documentation: #8137.
 11 months ago
Victor Julien 365ed2a2ff af-packet: disable hwtimestamp by default 
Add enable-hwtimestamp option to replace disable-hwtimestamp.

Ticket: #7585.
 11 months ago
Jeff Lucovsky 845544aad3 doc/luaxform: Clarify luaxform calling convention 
Issue: 8135

Clarify the calling convention for the Lua transform's `transform`
function.
 11 months ago
Juliana Fajardini 6c06ab6144 devguide: update backports policy for Suricata 7.0 
Also remove mentions to `master` and `6.0x`.

Task #7937
 11 months ago
Juliana Fajardini 907f4faff8 doc/thresholding: minor fix for backoff subsection 11 months ago
Philippe Antoine c93e69830a detect/ssl: properly handle negation in ssl_version keyword 
Ticket: 3220

DetectSslVersionMatch did not handle properly negation.
It could never match on a signatrue with ssl_version: !tls1.3
That is because, if we had such a signature and network traffic
with tls1.1, we were looking into DetectSslVersionData field
for tls1.1, which was not set, instead of looking at field
for tls1.3 which was set with negated flag.

Previous DetectSslVersionData was holding redundant information.
It did not need to have it for each ssl version, but just globally.
Also, it did not need to hold the version as a value in the array,
as it was redundant with the index of the array.
 11 months ago
Philippe Antoine 1329786f84 detect: new command line option : list-rule-protos 
To list the protocols we can use a in a rule header

Ticket: 635
 11 months ago
Victor Julien 08d625bb10 mpm: remove remaining ac-bs references 11 months ago
Victor Julien be2c40bde7 doc/af-packet: document disable-hwtimestamp option 
Ticket: #1954.
 11 months ago
Victor Julien 5194c877f2 threads: remove thread group name logic 
Once used to merge stats. Stats are tracked per thread and merge by counter
name in the current code.

It was set only for autofp modes.
 11 months ago
Juliana Fajardini 1647081b29 doc: remove remaining references to pruned flows 
These were removed with a5587fec2e but these mentions went under the
radar.
 11 months ago
Philippe Antoine af8390f2ca doc: upgrade note for engine-analysis breaking change 
For keywords that now use the generic integer framework

Ticket: 7889
 12 months ago
Philippe Antoine d94aea8331 detect: tcp.window is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 68bb783e97 detect: tcp.seq is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine ed907bbd78 detect: tcp.ack is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 7a8eb28cae detect: id is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine bff7413488 detect: icmp_seq is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 79e66f76e6 detect: icmp_id is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 09531447d1 detect: fragoffset is now a generic integer 
Ticket: 7889
 12 months ago
Philippe Antoine 85fa894425 detect: dnp3.func is now a generic integer 
Ticket: 7889
 12 months ago
Jeff Lucovsky b02d9bb4f1 doc/luaxform: Remove init function from example 
Issue: 8035

The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
 12 months ago
Victor Julien 558ab73a7f doc/devguide: explain alert logging changes 12 months ago
Philippe Antoine c61f1cb6d0 detect/integers: rename index all1 to all 
And all to all_or_absent

Ticket: 7929
 12 months ago
Victor Julien ec65fd430e exception-policy: rename 'reject-both' to 'rejectboth' 
To align it with the rule action.
 12 months ago
Jason Ish cdd4ea0f11 doc/devguide: document eve callback 
Document the callback for adding additional data to EVE.

Ticket: #4708
 1 year ago
Jason Ish 9fffc09ad7 doc/devguide: document eve file types 
Ticket: #4708
 1 year ago
Victor Julien 0c4a8fd183 doc/userguide: document reject-both expection policy 
Ticket: #5974.
 1 year ago
David Wharton 9d2d1c4f8f doc: minor verbiage tweaks and reST fix 1 year ago
Philippe Antoine d8cb00e795 detect/tcp: make tcp.flags a generic integer with bitflags 
Ticket: 6724

Allows to use numerical values for example

Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
 1 year ago
Philippe Antoine 1f9236a6d8 detect/ipv4: make fragbits a generic uint16 bitflags keyword 
Ticket: 6724

Allows to use numerical values
 1 year ago
Philippe Antoine 633180c93f detect/integers: generalize support for bitflags modifier 
Ticket: 6724

Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
 1 year ago
Philippe Antoine 4b69a31dc3 detect/integers: count argument for multi-integers 
Ticket: 7211

Allows to count the number of elements, without matching on
individual elements
 1 year ago
Philippe Antoine 969739d067 detect: http2.errorcode is now a generic integer 
Ticket: 7889
 1 year ago
Philippe Antoine 401b2fcae6 detect: http2.frametype is now a generic integer 
Ticket: 7889
 1 year ago
Jeff Lucovsky 16d124cfda doc/output: Highlight ethertype value change 
Issue: 7855

Highlight the change to how ether_type values are displayed. Previously,
they were displayed in network order as a decimal value.

They are now displayed in host order as a decimal value.
 1 year ago
Jason Ish ced0c2c466 doc: upgrade notes for changes to ike output 1 year ago
Victor Julien 48972d544c doc/userguide: link to protocol details from transactional rules 1 year ago
Victor Julien 480e664b4c doc/userguide: add xbits tx scope support 
Ticket #7680.
 1 year ago
Victor Julien a1c4167d94 doc/userguide: add initial protocols overview 
Explain per protocol mechanics for rule matching.
 1 year ago
Victor Julien 7034a17d1d doc/devguide: remove WIP mention of files in txs 
Work has been completed, so comment is no longer accurate.
 1 year ago
Victor Julien e2a5bc058c doc/userguide: fix DCERPC headings 1 year ago
Victor Julien be5c83ed53 doc/userguide: add rule hooks to protocol doc 
Ticket #7662.
 1 year ago
Victor Julien 91f258e2bc doc/userguide: add missing app-layer protocols 1 year ago
Victor Julien 2623e67a80 doc/userguide: add missing rule protocols 1 year ago
Philippe Antoine 3641b4eda1 detect/nfs: move nfs_procedure to rust 
Make it able to use strings on the way

Ticket: 6723
 1 year ago
Philippe Antoine 9869fb776b detect/snmp: pdu_type keyword now accepts strings 
Ticket: 6723
 1 year ago
Philippe Antoine 0553dfa814 detect/krb5: move krb5_msg_type to rust 
Makes it a generic u32 on the way

Unit tests are covered by SV tests

Ticket: 6723
 1 year ago
Philippe Antoine da486af881 detect: list-keywords cli shows integers 
Ticket: 7875
 1 year ago
Philippe Antoine b298bce0e7 detect: list-keywords cli shows multi-buffers 
Ticket: 7571
 1 year ago
Andreas Dolp 375b5dd306 doc: fix typo /var/run/suricata in file permissions docs. 1 year ago
Andreas Dolp cc590b54c7 doc: fix typo and missing newline in rules/ssh_keywords. 1 year ago
Andreas Dolp 228abb7da0 doc: fix doc syntax error in rate_filter example. 1 year ago
Juliana Fajardini 21b27597d6 doc/rules/internals: minor fixes 
Fix typo and add a reference about the classtype keyword effect.

Related to
Task #5449
 1 year ago
Fupeng Zhao e79d735374 decode/etag: ETag 802.1BR decoder 
Ticket: #3953.
 1 year ago
Philippe Antoine cb9ab951b9 detect/integers: subslice for multi-integers 1 year ago
Philippe Antoine 82f0e725a2 detect/integers: index or_absent and or_oob 
To match if array is empty, or index is out of bounds
 1 year ago
Philippe Antoine 1480cf47ab detect/integers: nb index to match a specific number of times 
For example
dns.rrtype: !A,nb>3
will match if we have more than 3 dns records which are not A
 1 year ago
Philippe Antoine 6f848eeaaf detect/integers: all1 index to match only on non-empty arrays 1 year ago
Philippe Antoine 5add185f22 http2/detect: http2.window can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 83868778b9 http2/detect: http2.priority can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine 9fc407fd75 mqtt/detect: mqtt.type can now use index 
Ticket: 7480
 1 year ago
Philippe Antoine dad424d74a doc: multi-integers section for rules 
Ticket: 7480

Describing the usage of index
 1 year ago
Fupeng Zhao 4f68cb026f decoder/vxlan: add configurable reserved bits validation for VXLAN 
Add support for two VXLAN reserved bits check modes:
- strict: validate all reserved bits for standard VXLAN format
- permissive: skip all reserved bits validation (allows extensions)

Configuration added to suricata.yaml.in with 'strict' as default.
Includes comprehensive unit tests and documentation updates.

Ticket: 7753
 1 year ago
Alice Akaki 8e0b0ef35f detect: add email.body_md5 keyword 
email.body_md5 matches on md5 hash generated from email body
This keyword maps to the EVE field email.body_md5
It is a sticky buffer
Supports prefiltering

Ticket: #7587
 1 year ago
Victor Julien 46203de0e9 doc: adjust for master to main rename 1 year ago
Victor Julien e62eb00459 doc/userguide: add ips chapter; add concept 
Move setup guides into the new chapter as well.

Explain `stream.inline` logic.

Ticket: #5513.
Ticket: #6284.
 1 year ago
Philippe Antoine 9146fc8957 doc: upgrade note about keyword tls.cert_subject 
Following commit 5379b52af2
rules that use multiple times the keyword tls.cert_subject
will result in

Warning: detect: duplicate instance for tls.cert_subject

These rules likely meant to use a multi-buffer which is not the
case for tls.cert_subject (even if it was documented so).

Ticket: 7890

This is put in a new section of upgrade notes for
upgrading to 8.0.1
 1 year ago
Juliana Fajardini 27e165f760 doc/rules/index: keep rule types doc near the end 
As this chapter is more meta than about rule keywords, keep it by the
end of the index, to have some semantic separation from the other
sections.
 1 year ago
Juliana Fajardini d5810a42e1 userguide: document how suricata processes rules 
Added a page that explains how rules are prioritized by Suri, as well
as what main different types of inspection happen and what elements are
involved when ordering rules.

Task #5449
 1 year ago
Shivani Bhardwaj b21f737aee doc: add doc on internals of inspection of raw data 
Explain briefly the internals of inspection of raw data in the following order:
- Stream Engine
- Stream reassembly
- Role of Detection Engine and Applayer Parsers
- High level communication between Stream and Detection Engine
- Relevant suricata.yaml settings

alongwith some diagrams.

Ticket 4351
 1 year ago
Shivani Bhardwaj 9ed5ac7669 doc: make firewall table names consistent 1 year ago
Shivani Bhardwaj 7fec1883cd doc: add more info to firewall design 
Add information about:
- available tables, default policies and rule ordering
- Packet layer and applayer tables and hooks
- engine analysis output
- commandline options available
- how to load firewall rules

Also, reorganize sections and content to assist the definitions.
 1 year ago
Jeff Lucovsky 17e7387ff4 doc/fileinfo: Document fileinfo context/usage 
Issue: 6498
 1 year ago
Thomas Winter 0b2dfa2b68 doc: Add upgrade note for ppp changes 1 year ago
Philippe Antoine 0026019dcf doc: complete list of multi-buffers 
Ticket: 7867
 1 year ago
Philippe Antoine 646c78269a doc/devguide: section with conceptualized steps for adding app-layer 
Ticket: 6840
 1 year ago
Tommy Wang fc6b96fb85 doc/lualib: fix wrong tuple section markdown in flowlib 
Sections had wrong levels due to wrong markdown.
 1 year ago
Tommy Wang a10053e62c doc/lualib: fix flow timestamps return value order 
Task #7854
 1 year ago
Philippe Antoine d0a513df6a detect/integers: support kibibyte unit 
Ticket: 7869
 1 year ago
Philippe Antoine be9858d3aa detect/integers: document usage of units 
Ticket: 7190
 1 year ago
Theo Buehler 315844ccd8 docs: fix deprecated inclusion of rtd theme path 
Since userguide/conf.py uses the deprecated get_html_theme_path(),
sphinx emits a warning which breaks the build as warnings are treated
as errors.

Issue: 7859
 1 year ago
Juliana Fajardini ec1da6fd3a doc/exceptions: fix wrong section markdown 
Sections had wrong levels due to wrong markdown.
 1 year ago
Jeff Lucovsky 21707ab26c doc/from_base64: Emphasize keyword only values 
Emphasize that specifying the keyword only will result in the defaults
for each option to be used.

Issue: 7853
 1 year ago
Juliana Fajardini a8453d73cd detect: remove unused non-pf stats counters 
Remove unused rule prefilter-related stats counters that aren't in use.

94644ac960 (detect: move non-pf rules into special prefilter engines)
removed the logic that made use of and incremented the stats counters:
- det_ctx->counter_fnonmpm_list
- det_ctx->counter_nonmpm_list

Some code was left, registering them, and mentioning them in the
json schema.

Ticket #7834
 1 year ago
Lukas Sismis 897cdb8571 doc/dpdK: update RX/TX descriptor note for Connect-X 4 
Ticket: 7639
 1 year ago
Jason Ish eaef74af05 lua: document the dnp3 lib 
Ticket: #7631
 1 year ago
Jason Ish 3b7b908fe2 doc/upgrade: mention that lua rules are enabled by default 1 year ago
Jason Ish 7a65ca10e2 doc/lua-detection: fix example script; remove most buffers 
- Reference rule hooks instead

Ticket: #7728
 1 year ago
Jason Ish f56bd4db75 doc/lua-output: fix example script for new apis 
Ticket: #7728
 1 year ago
Jason Ish 7535b5aa1d doc/lua-functions: update lua-function documentation 
- cleanup usage and documentation around needs
- mentiond that rule hooks are used instead of "needs" keywords with
  link with rule hooks (which is still in the firewall-design doc)
 1 year ago
Jason Ish decf795e94 doc/install: remove reference to --enable-lua 
This configure command no longer exists.
 1 year ago
Jason Ish 4791f37ca2 doc/lua-detection: update note to mention rules are enabled by default 
In 8.0, Lua rules are enabled by default.
 1 year ago
Alexandre Iooss 57e0ff0ee0 doc/lua: fix typo in stream toserver and toclient 1 year ago
Jeff Lucovsky 1030e4fa92 doc/suricatasc: Mentioned get-flow-stats-by-id cmd 
Add get-flow-stats-by-id to the list of commands supported by suricatasc

Issue: 7081
 1 year ago
Jeff Lucovsky 07b7f36748 doc/reload: Expand rule-reload discussion 
Clarify the resources involved in a rule reload.

Issue: 5078
 1 year ago
Jeff Lucovsky c0d54d838e gen/typo: Misc. typo fixes 1 year ago
Jeff Lucovsky 97b03b4076 doc/netflow: Discuss netflow 
Add discussion for netflow configuration, event type and fields
contained in netflow records.

Issue: 5139
 1 year ago
Shivani Bhardwaj 58367149cc doc: add upgrade note about change in inspection 1 year ago
Philippe Antoine f4378eb306 doc/devguide: document app-layer protocol detection 
Ticket: 6022
 1 year ago
Philippe Antoine 4d4eb84eca doc: document krb5 event type 
Ticket: 6566
 1 year ago
Philippe Antoine f907216e1a doc: do not have bittorrent in the middle of SMB events 1 year ago
Jason Ish 580a4445cd doc/install: use our recommended header order 1 year ago
Jason Ish 6b94689a44 doc/userguide: remove example with CentOS 7 
CentOS 7 is EOL.

Ticket: #7749
 1 year ago
Jason Ish 8ed506659d doc/userguide: break out package installation 
Break out RPM, Debian, and Ubuntu package installation into their own
pages.

Also break out other distributions like "Arch" into an "Other" section
with a note about how those packages are not supported by the OISF.

Ticket: #6252
Ticket: #6069
 1 year ago
Jason Ish 1de19ee94c doc/userguide: add appendix item on eve schema 
Add some basic documentation on our EVE schema, mainly to show users
that it exists.
 1 year ago
Jeff Lucovsky a300df4c4d detect/entropy: Clarify when entropy is logged 
Clarify when entropy values are logged and associated with non-alert log
records.
 1 year ago
Jason Ish 4a0f278502 doc/install: windows build documentation 
Ticket: #5911
 1 year ago
Jason Ish f35a56fa65 doc/code-style: add rust; minor cleanups 
- Add small section on Rust code, and Rust code exposed to FFI.
- Other minor cleanups.

Ticket: #7078
Ticket: #6955
 1 year ago
Jason Ish 249bd32a9d doc/userguide/code-style: update header ordering 
To match our recommended header ordering.
 1 year ago
Eric Leblond 751f3eef3b doc/userguide: fix some typos 1 year ago
Eric Leblond 6236574b9c doc/userguide: enrichment_key is now context_key 1 year ago
Eric Leblond 20a0575d96 doc/userguide: fix some typos 
Suggestions from Juliana.

Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>
 1 year ago
Eric Leblond 40c545f8d9 doc/userguide: jsonline is now standard ndjson 1 year ago
Eric Leblond f724c75cc9 doc/userguide: improve datajson doc 1 year ago
Eric Leblond a652eee508 doc/userguide: remove left over datajson reference 1 year ago
Eric Leblond 7d28758a54 doc/userguide: improve datajson doc 
Patch adds ``remove_key`` option and clarifies the text.
 1 year ago
Eric Leblond 0ae88a408a doc/userguide: basic doc for jsonline format 1 year ago
Eric Leblond 9873c5d2e1 doc/userguide: add dataset with json 1 year ago
Jason Ish 8e8c3040e7 doc/upgrade: note about dns address swap on responses 
Document the change in DNS addresses for ticket 6400.

Ticket: https://redmine.openinfosecfoundation.org/issues/6400
 1 year ago
Philippe Antoine b29d46d81f rust: bindgen SCAppLayerParserStateIssetFlag 
Ticket: 7667
 1 year ago
Victor Julien f2faba5a23 detect/config: add flow tracking doc 1 year ago
Victor Julien ecbcccf355 detect: add tcp.wscale keyword 
Allows matching on wscale option value in TCP header options.

Ticket: #7713.
 1 year ago
Lukas Sismis 8817a959e8 threading: support thread autopinning and interface-specific affinity 
Using the new configuration format, it is now possible to set CPU affinity
settings per interface.

The threading.autopin option has been added to automatically use CPUs from the
same NUMA node as the interface. The autopin option requires
hwloc-devel / hwloc-dev to be installed and --enable-hwloc flag in configure
script.

Ticket: 7036
 1 year ago
Lukas Sismis 1a1789eb29 doc: remove title in threading section with no content 1 year ago
Lukas Sismis 6c654e30ac threading: support previous threading configuration format 
Provide backward compatibility with the previous configuration
format to allow smooth transition to the new format.
The commit adds docs about the new format and the introduced changes.
 1 year ago
Jeff Lucovsky a8a3780276 doc/entropy: Document the entropy log output 1 year ago
Jeff Lucovsky 62e3c02914 doc: Add missing contributors to ack file 
Add missing contributors as identified by
    git shortlog -s -n --no-merges -- .
 1 year ago
Juliana Fajardini 9614770483 doc/lua: document request_host lua lib 
Seems that we missed bringing this one, when documenting HTTP lua lib
functions.
 1 year ago
Jason Ish 62df7c8e81 doc/lua: remove reference to removed functions 
These have all been replaced by libs and already documented in their
lib format.

Ticket: #7728
 1 year ago
Juliana Fajardini f3aa0085a0 pgsql: rename copy in/out response field 
We used `copy_column_count`, while just `columns` is more accurate with
what PostgreSQL describes, and what Wireshark shows.

Related to
Task #7644
Task #7645
 1 year ago
Juliana Fajardini 2086f99d6b pgsql: add initial support to CopyIn mode/subproto 
This sub-protocol inspects messages sent mainly from the frontend to
the backend after a 'COPY FROM STDIN' has been processed by the
backend.

Parses new messages:
- CopyInResponse -- initiates copy-in mode/sub-protocol
- CopyData (In) -- data transfer message, from frontend to backend
- CopyDone -- signals that no more CopyData messages will be seen from
  the frontend, for the current transaction
- CopyFail -- used by the frontend to signal some failure to proceed
  with sending CopyData messages

Task #7645
 1 year ago
Jason Ish e5faedf7e6 lua/util: move SCThreadInfo into suricata.util lib 
Move the SCThreadInfo global function into the suricata.util library as
thread_info().

This is the last global function to be registered, so remove the
supporting functions.
 1 year ago
Jason Ish 778a699622 lua: simplify streaming output setup 
Setup the init function to simply return:

   {streaming = "tcp"}

or

   {streaming = "http"}

The returned table can have a lot of parameters that don't make sense
together, this should simplify this one case.
 1 year ago
Jason Ish 02bdea2bce lua/streaming: provide streaming buffer as argument 
When setting up a Lua output script for streaming data, we're
explicitly requesting stream data. Just pass the streaming data as
arguments, rather than requiring the script to make an extra call to
get the stream data.

The streaming data will be passed in the "stream" field of the args
passed to the log function.

Eliminates the SCStreamingBuffer Lua function.
 1 year ago
Jason Ish 11b3ebcb5f lua/bytevar: convert SCByteVar to Lua lib 
Similar to flowvars and flowints, but a byte var cannot be registered
from a Lua script, but it still needs to be setup. Instead provide an
"map" function that sets it up, or errors out if the byte var is
unknown.

This also required passing the signature into the Lua init method, as
the state of the Signature object and the time of loading the Lua
keyword is required.
 1 year ago
Jason Ish ce7cdd6f9a lua: create suricata.config lua lib 
Currently only provides "log_path" as a replacement for SCLogPath.
 1 year ago
Juliana Fajardini c5b9277474 doc/payload: fix typo, minor formatting changes 1 year ago
Juliana Fajardini 95560f0966 docs/exceptions: minor improvements 
Add section label and doc reference, add another term to Common terms
section.

Tried to also improve readability for the Midstream behavior tables:
- Highlight key-words when differences are only in `do` vs `no`.
- Change order of sentences in certain descriptions, to align with the
  steps those happen for the engine.
 1 year ago
Juliana Fajardini 0256ce51eb doc/exceptions: clarify ambiguous terminology 
The terms 'inspection' and 'detection' were being used to signify
different engine actions in this document, while throughout the
documentation and code they're many times interchangeable.

Replace 'inspection' with 'parsing' or even 'decoding and parsing' as
more appropriate.

Add a small glossary to clarify what we mean with those terms.
 1 year ago
Juliana Fajardini e5c1e5f792 doc/exceptions: standardize page section markdown 
Following the discussion on #7396, use those symbols for to keep the
standard.
Remove the repeting `Exception Policies` section header, too.

Related to
Task #7396
 1 year ago
Juliana Fajardini 627b8900ef doc/rule-types: fix typo 1 year ago
Jason Ish 278a9c3806 lua: convert log functions to suricata.log lib 
Convert the Lua global functions for logging (SCLogInfo, etc) to a Lua
lib names "suricata.log".

Ticket: #7727
 1 year ago