1342 Commits (c93e69830a51869a2eac3a4e79fb19d9f7fffde7)

Author	SHA1	Message	Date
Philippe Antoine	c93e69830a	detect/ssl: properly handle negation in ssl_version keyword ... Ticket: 3220 DetectSslVersionMatch did not handle properly negation. It could never match on a signatrue with ssl_version: !tls1.3 That is because, if we had such a signature and network traffic with tls1.1, we were looking into DetectSslVersionData field for tls1.1, which was not set, instead of looking at field for tls1.3 which was set with negated flag. Previous DetectSslVersionData was holding redundant information. It did not need to have it for each ssl version, but just globally. Also, it did not need to hold the version as a value in the array, as it was redundant with the index of the array.	8 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos ... To list the protocols we can use a in a rule header Ticket: 635	8 months ago
Victor Julien	08d625bb10	mpm: remove remaining ac-bs references	8 months ago
Victor Julien	be2c40bde7	doc/af-packet: document disable-hwtimestamp option ... Ticket: #1954.	8 months ago
Victor Julien	5194c877f2	threads: remove thread group name logic ... Once used to merge stats. Stats are tracked per thread and merge by counter name in the current code. It was set only for autofp modes.	8 months ago
Juliana Fajardini	1647081b29	doc: remove remaining references to pruned flows ... These were removed with a5587fec2e but these mentions went under the radar.	9 months ago
Philippe Antoine	af8390f2ca	doc: upgrade note for engine-analysis breaking change ... For keywords that now use the generic integer framework Ticket: 7889	9 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer ... Ticket: 7889	9 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example ... Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	9 months ago
Victor Julien	558ab73a7f	doc/devguide: explain alert logging changes	9 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all ... And all to all_or_absent Ticket: 7929	9 months ago
Victor Julien	ec65fd430e	exception-policy: rename 'reject-both' to 'rejectboth' ... To align it with the rule action.	9 months ago
Jason Ish	cdd4ea0f11	doc/devguide: document eve callback ... Document the callback for adding additional data to EVE. Ticket: #4708	9 months ago
Jason Ish	9fffc09ad7	doc/devguide: document eve file types ... Ticket: #4708	9 months ago
Victor Julien	0c4a8fd183	doc/userguide: document reject-both expection policy ... Ticket: #5974.	9 months ago
David Wharton	9d2d1c4f8f	doc: minor verbiage tweaks and reST fix	10 months ago
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags ... Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	10 months ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword ... Ticket: 6724 Allows to use numerical values	10 months ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier ... Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	10 months ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers ... Ticket: 7211 Allows to count the number of elements, without matching on individual elements	10 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	10 months ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer ... Ticket: 7889	10 months ago
Jeff Lucovsky	16d124cfda	doc/output: Highlight ethertype value change ... Issue: 7855 Highlight the change to how ether_type values are displayed. Previously, they were displayed in network order as a decimal value. They are now displayed in host order as a decimal value.	10 months ago
Juliana Fajardini	ff96c52541	doc/install: fix minor typo	10 months ago
Juliana Fajardini	a3bd4ec324	doc: remove outdated GITGUIDE	10 months ago
Jason Ish	ced0c2c466	doc: upgrade notes for changes to ike output	10 months ago
Victor Julien	48972d544c	doc/userguide: link to protocol details from transactional rules	11 months ago
Victor Julien	480e664b4c	doc/userguide: add xbits tx scope support ... Ticket #7680.	11 months ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview ... Explain per protocol mechanics for rule matching.	11 months ago
Victor Julien	7034a17d1d	doc/devguide: remove WIP mention of files in txs ... Work has been completed, so comment is no longer accurate.	11 months ago
Victor Julien	e2a5bc058c	doc/userguide: fix DCERPC headings	11 months ago
Victor Julien	be5c83ed53	doc/userguide: add rule hooks to protocol doc ... Ticket #7662.	11 months ago
Victor Julien	91f258e2bc	doc/userguide: add missing app-layer protocols	11 months ago
Victor Julien	2623e67a80	doc/userguide: add missing rule protocols	11 months ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust ... Make it able to use strings on the way Ticket: 6723	11 months ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings ... Ticket: 6723	11 months ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust ... Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	11 months ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers ... Ticket: 7875	11 months ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers ... Ticket: 7571	11 months ago
Andreas Dolp	375b5dd306	doc: fix typo /var/run/suricata in file permissions docs.	11 months ago
Andreas Dolp	cc590b54c7	doc: fix typo and missing newline in rules/ssh_keywords.	11 months ago
Andreas Dolp	228abb7da0	doc: fix doc syntax error in rate_filter example.	11 months ago
Juliana Fajardini	21b27597d6	doc/rules/internals: minor fixes ... Fix typo and add a reference about the classtype keyword effect. Related to Task #5449	11 months ago