suricata

Commit Graph

Author	SHA1	Message	Date
Samaresh Kumar Singh	565e138754	pcap-file: skip setvbuf on non-seekable streams Reading a pcap from /dev/stdin or a named pipe currently fails with "failed to get first packet timestamp. pcap_next_ex(): -1" because InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header. On a non-seekable fd glibc cannot recover from that and the next read returns -1. Detect non-regular files via fstat and skip setvbuf in that case so the read keeps working on pipes, fifos and stdin. Accept pcap-file.buffer-size values of 0, which disables setvbuf buffering as an explicit opt-out, or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB). Treat any non-zero setvbuf return value as an error, not just negative values. When pcap-file.buffer-size fails to parse, retain the default buffer size instead of falling through and setting it to 0. The branches are now mutually exclusive so only one of the parse-error, accepted, or out-of-range messages is logged. Update the user guide: --pcap-file-buffer-size now documents valid values of 0 (disables setvbuf buffering) or 4 KiB to 64 MiB, and pcap-file.rst notes that 0 is the opt-out for non-seekable sources such as stdin and named pipes. Bug: #8464.	3 months ago
Giuseppe Longo	d892eb8e0e	doc/sctp: add sctp keywords Add documentation for all sctp keywords. Ticket #4251	3 months ago
Antoine Abou Faysal	b09b04857a	doc/userguide: add dataset match subdomain documentation Ticket: 8385	3 months ago
Shivani Bhardwaj	899eb38691	flowbits: deprecate toggle command toggle command is not used by any major rulesets and increases the state complexity of flowbits management. Also, all operations can be carried out with the combination of other available commands. So, remove it. Task 8595	3 months ago
Samaresh Kumar Singh	af3abf100e	doc: dhcp eve note for option 52 overload Document that DHCP options carried in the overloaded BOOTP sname or file fields are now merged into the EVE log option set alongside the main options area. Bug: #8538.	3 months ago
Juliana Fajardini	04cfd33c59	doc/firewall: update hooks & configuration examples	3 months ago
Philippe Antoine	daf68dc36f	http2: split progress per direction Ticket: 8518 Keywords that work for HTTP2 headers match now as soon as possible A push promise is now considered like a headers frame with regards to the progress (no dedicated "reserved" progress/state) http.protocol and http.stat_msg keywords are now registered at earliest progress, since these are synthetic like "HTTP/2" and not really seen on the wire. http.request_line and http.response_line match only on data, and not on headers, since we must wait the end of headers to be sure to have the full line http2.size_update now matches at headers progress as it should http2.frametype, http2.errorcode, http2.priority now match like http2.window, when the tx is complete from both sides, as a half-closed client may still send priority, rst_stream or window_update frames	3 months ago
Jason Ish	865b7243a0	http-log: remove support for http-log http-log was deprecated in Suricata 8, and marked for removal in Suricata 9.0. Ticket: #7232	3 months ago
Giuseppe Longo	143774220e	doc: add llmnr Ticket #8366	3 months ago
Jason Ish	3dc8b154f3	rust/ffi: add safe thread storage wrapper Add a typed ThreadStorage<T> wrapper around the thread storage bindings. Ticket: #8445	3 months ago
Jason Ish	5e0abf1572	rust/ffi: use ThreadVars wrapper in flow callbacks Update the flow init, update and finish callback registrations to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	3 months ago
Jason Ish	45762aa644	rust/ffi: use ThreadVars wrapper in thread init callback Update the thread init callback registration to pass the safe ThreadVars wrapper instead of a raw pointer. Ticket: #8598	3 months ago
Juliana Fajardini	a783007408	detect/bypass: ban bypass keyword for firewall mode Related to Ticket #8551	4 months ago
Juliana Fajardini	edaa912ed9	detect: ban `replace` keyword for firewall mode Ticket #8551	4 months ago
Victor Julien	0a84015214	doc/userguide: add new constructs to firewall examples	4 months ago
Victor Julien	8728f9ffc0	doc/userguide: document firewall lte rule support	4 months ago
Victor Julien	ac59883c26	doc/userguide: fix default policies for pre_* hooks Minor other cleanups.	4 months ago
Victor Julien	da6af0879e	doc: update firewall design Bring in line with recent changes.	4 months ago
Victor Julien	90a837cef3	detect/firewall: update discarded logic Only count alert queue overflow here, not alerts in the queue after a drop.	4 months ago
Juliana Fajardini	234172a93c	docs: add firewall stats doc Related to Ticket #7699	4 months ago
Juliana Fajardini	32d89072d2	docs/configuration: add firewall mode settings Partly related to Ticket #7699	4 months ago
Jason Ish	b366665ad8	doc: document rust thread life cycle api Ticket: #8605	4 months ago
jason taylor	da827322ba	doc: minor ebpf doc update for fedora/rhel Signed-off-by: jason taylor <jtfas90@proton.me>	4 months ago
Andreas Dolp	2f972b6759	doc: improve manpage of suricatasc - describe all options - describe optional socket path Redmine ticket: #8563	4 months ago
Philippe Antoine	e98d419d96	ldap: bound the number of responses Ticket: 8405	4 months ago
Jason Ish	029fd1be59	eve: add rule generation source to alert record When an alert is generated from firewall context, add an engine value of "fw", otherwise "td" (for threat detect). The engine field is only added when firewall mode is enabled. Ticket: #8456	4 months ago
Philippe Antoine	f0e246de34	detect/mqtt: reason_code keyword is now a multi-integer Ticket: 7929 Builds a vector of the reason code in a tx to do so, except if we use the default "any", where we do not append to the vector, but just run detection while iterating	4 months ago
Victor Julien	2f9573f84c	doc: address config conversion note Message is: ``` Converting `source_suffix = '.rst'` to `source_suffix = {'.rst': 'restructuredtext'}`. ```	4 months ago
Jason Ish	91b9dda0bf	doc: document flow life cycle callback API Document for C and Rust, as the C documentation was missing. Ticket: #8446	4 months ago
Jason Ish	899e9f045e	ntp: expose logged fields to lua This includes: - version - mode - stratum - reference_id Ticket: #8533	4 months ago
Philippe Antoine	54c02e1301	stats: replace dashes by underscores in app-layer protocols Ticket: 6502 Forbid dashes in json keys for better use by processing tools	4 months ago
Philippe Antoine	d030ea7f29	output: rename reject-target to reject_target Ticket: 6502 Forbid dashes in json keys for better use by processing tools	4 months ago
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform Add documentation for the subslice transform. Issue: 7672	5 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container Ticket: 8372 Also remove dead code from script checking the rules	5 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	5 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	5 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	5 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	5 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	5 months ago
Jason Ish	31b967b089	ntp: add transaction logging Adds basic NTP transaction logging for the current supported message types. Includes small cleanups around reference ID. Ticket: #8425	5 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	5 months ago
Jason Ish	eb46d0129e	rust/ffi: add eve callback handler Wrap the EVE callback handler with a Rust friendly variant that allows the user to register a callback as a closure which is provided an already wrapped JsonBuilder object. Ticket: #8477	5 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	5 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule Ticket: 8372 And fix another bad rule	5 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule As stated, it will refuse to load. Ticket: 8372	5 months ago
Philippe Antoine	15f45be672	doc: fix rules Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	5 months ago
Jason Ish	a11aaadd86	plugins: add --plugin command line option to load plugins Add --plugin <PATH> to load an additional plugin from the command line. This is more convenient than "--set plugins.X" especially when you may already have a plugins loaded and you want to load an additional one. Ticket: 8463	5 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	6 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	6 months ago
Victor Julien	e6381a3c22	doc/userguide: add note on rule reloads Cannot be combined with --firewall-rules-exclusive	6 months ago

1 2 3 4 5 ...

1450 Commits (aea9fd73b7e28b83d86c7f049a4c0ccfdaf98711)