suricata

Commit Graph

Author	SHA1	Message	Date
Yash Datre	398687d5d4	detect: add tcp.session keyword for unified TCP lifecycle matching Introduce the tcp.session: keyword that accepts a comma-separated subset of {setup, established, closing} and matches packets whose TCP session state falls within the named phases. This lets a rule writer cover the full TCP lifecycle in one rule instead of separate flow:not_established + flow:established rules. Changes: - New detect-tcp-session.{c,h} with parser, match function, unit tests - Register DETECT_TCP_SESSION in detect-engine-register.{c,h} - Add to Makefile.am source list - Extend engine-analyzer text output for tcp.session: - Extend firewall.json keyword_info with tcp_session phase values - Update flow-keywords.rst documentation - Require TCP protocol and SIG_FLAG_REQUIRE_PACKET at setup Ticket: 7704	2 months ago
Shivani Bhardwaj	899eb38691	flowbits: deprecate toggle command toggle command is not used by any major rulesets and increases the state complexity of flowbits management. Also, all operations can be carried out with the combination of other available commands. So, remove it. Task 8595	5 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule Ticket: 8372 And fix another bad rule	6 months ago
Shivani Bhardwaj	30bdaa44e1	doc: add elephant.flow usage section	10 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	10 months ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	1 year ago
Shivani Bhardwaj	ad7ff1c91b	flow/pkts: allow matching on either direction For flow.bytes and flow.pkts keywords, allow matching in either direction. Feature 5646	2 years ago
Shivani Bhardwaj	52fd695e5a	doc: update syntax for flow.pkts & flow.bytes	2 years ago
Juliana Fajardini	6e4a501e7c	flowint: add isnotset support Similar keywords use `isnotset`, while `flowint` only accepted `notset` Opted to change the code, not only the regex, to keep the underlying code also following the same patterns. Task #7426	2 years ago
Juliana Fajardini	246acc7140	userguide: clarify flow:stateless explanation While not incorrect, the previous wording made the sentence almost paradoxical. While at it, also highlight a side effect that might not be so clear to users. Related to Bug #6976	2 years ago
jason taylor	aa919f8081	doc: update flowbits information Ticket: #6991 Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Philippe Antoine	b8bc2c7e0f	doc: integer keywords Ticket: 6628 Document the generic detection capabilities for integer keywords. and make every integer keyword pointing to this section.	3 years ago
Philippe Antoine	ab9b6e30b1	detect: adds flow integer keywords Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver	3 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword Ticket: #5536	4 years ago
Shivani Bhardwaj	015c9fe1e3	doc: add usage of flowbits OR op Ticket 5130	5 years ago
Andreas Dolp	b25350ee13	doc: Fix typo in documentation of rule keyword flow	5 years ago
Andreas Herz	30fd80b0ef	doc: convert fancy quotes to straight quotes	7 years ago
Pascal Delalande	f2dca46382	doc: fix minor typo	8 years ago
Victor Julien	5afeebf884	doc/flow: updates and cleanups to flow section	8 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	9 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	9 years ago
Jason Ish	1a724ba851	doc: flow: update and add new keywords	10 years ago
Andreas Herz	7806ae8f57	docs: sync up to recent redmine	10 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	10 years ago

24 Commits (b39514269a89c2e834e61bf9c337c4c4f037ac46)