21 Commits (b800ace56fb08c29aadb0f68a3bad1fe3e4a0d67)

Author	SHA1	Message	Date
Yash Datre	b800ace56f	detect: add tcp.session keyword for unified TCP lifecycle matching ... Introduce the tcp.session: keyword that accepts a comma-separated subset of {setup, established, closing} and matches packets whose TCP session state falls within the named phases. This lets a rule writer cover the full TCP lifecycle in one rule instead of separate flow:not_established + flow:established rules. Changes: - New detect-tcp-session.{c,h} with parser, match function, unit tests - Register DETECT_TCP_SESSION in detect-engine-register.{c,h} - Add to Makefile.am source list - Extend engine-analyzer text output for tcp.session: - Extend firewall.json keyword_info with tcp_session phase values - Update flow-keywords.rst documentation - Require TCP protocol and SIG_FLAG_REQUIRE_PACKET at setup Ticket: 7704 (cherry picked from commit 398687d5d4)	4 days ago
Shivani Bhardwaj	36fb9ae59a	flowbits: add deprecation notice for toggle command ... Task 8638	3 months ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules ... Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	1 year ago
Shivani Bhardwaj	ad7ff1c91b	flow/pkts: allow matching on either direction ... For flow.bytes and flow.pkts keywords, allow matching in either direction. Feature 5646	2 years ago
Shivani Bhardwaj	52fd695e5a	doc: update syntax for flow.pkts & flow.bytes	2 years ago
Juliana Fajardini	6e4a501e7c	flowint: add isnotset support ... Similar keywords use `isnotset`, while `flowint` only accepted `notset` Opted to change the code, not only the regex, to keep the underlying code also following the same patterns. Task #7426	2 years ago
Juliana Fajardini	246acc7140	userguide: clarify flow:stateless explanation ... While not incorrect, the previous wording made the sentence almost paradoxical. While at it, also highlight a side effect that might not be so clear to users. Related to Bug #6976	2 years ago
jason taylor	aa919f8081	doc: update flowbits information ... Ticket: #6991 Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Philippe Antoine	b8bc2c7e0f	doc: integer keywords ... Ticket: 6628 Document the generic detection capabilities for integer keywords. and make every integer keyword pointing to this section.	3 years ago
Philippe Antoine	ab9b6e30b1	detect: adds flow integer keywords ... Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver	3 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword ... Ticket: #5536	4 years ago
Shivani Bhardwaj	015c9fe1e3	doc: add usage of flowbits OR op ... Ticket 5130	5 years ago
Andreas Dolp	b25350ee13	doc: Fix typo in documentation of rule keyword flow	5 years ago
Andreas Herz	30fd80b0ef	doc: convert fancy quotes to straight quotes	7 years ago
Pascal Delalande	f2dca46382	doc: fix minor typo	8 years ago
Victor Julien	5afeebf884	doc/flow: updates and cleanups to flow section	8 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	9 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	9 years ago
Jason Ish	1a724ba851	doc: flow: update and add new keywords	10 years ago
Andreas Herz	7806ae8f57	docs: sync up to recent redmine	10 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	10 years ago