suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	16d124cfda	doc/output: Highlight ethertype value change Issue: 7855 Highlight the change to how ether_type values are displayed. Previously, they were displayed in network order as a decimal value. They are now displayed in host order as a decimal value.	1 year ago
Jason Ish	ced0c2c466	doc: upgrade notes for changes to ike output	1 year ago
Victor Julien	48972d544c	doc/userguide: link to protocol details from transactional rules	1 year ago
Victor Julien	480e664b4c	doc/userguide: add xbits tx scope support Ticket #7680.	1 year ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview Explain per protocol mechanics for rule matching.	1 year ago
Victor Julien	7034a17d1d	doc/devguide: remove WIP mention of files in txs Work has been completed, so comment is no longer accurate.	1 year ago
Victor Julien	e2a5bc058c	doc/userguide: fix DCERPC headings	1 year ago
Victor Julien	be5c83ed53	doc/userguide: add rule hooks to protocol doc Ticket #7662.	1 year ago
Victor Julien	91f258e2bc	doc/userguide: add missing app-layer protocols	1 year ago
Victor Julien	2623e67a80	doc/userguide: add missing rule protocols	1 year ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust Make it able to use strings on the way Ticket: 6723	1 year ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings Ticket: 6723	1 year ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	1 year ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers Ticket: 7875	1 year ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers Ticket: 7571	1 year ago
Andreas Dolp	375b5dd306	doc: fix typo /var/run/suricata in file permissions docs.	1 year ago
Andreas Dolp	cc590b54c7	doc: fix typo and missing newline in rules/ssh_keywords.	1 year ago
Andreas Dolp	228abb7da0	doc: fix doc syntax error in rate_filter example.	1 year ago
Juliana Fajardini	21b27597d6	doc/rules/internals: minor fixes Fix typo and add a reference about the classtype keyword effect. Related to Task #5449	1 year ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder Ticket: #3953.	1 year ago
Philippe Antoine	cb9ab951b9	detect/integers: subslice for multi-integers	1 year ago
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob To match if array is empty, or index is out of bounds	1 year ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	1 year ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	1 year ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index Ticket: 7480	1 year ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index Ticket: 7480	1 year ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index Ticket: 7480	1 year ago
Philippe Antoine	dad424d74a	doc: multi-integers section for rules Ticket: 7480 Describing the usage of index	1 year ago
Fupeng Zhao	4f68cb026f	decoder/vxlan: add configurable reserved bits validation for VXLAN Add support for two VXLAN reserved bits check modes: - strict: validate all reserved bits for standard VXLAN format - permissive: skip all reserved bits validation (allows extensions) Configuration added to suricata.yaml.in with 'strict' as default. Includes comprehensive unit tests and documentation updates. Ticket: 7753	1 year ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	1 year ago
Victor Julien	46203de0e9	doc: adjust for master to main rename	1 year ago
Victor Julien	e62eb00459	doc/userguide: add ips chapter; add concept Move setup guides into the new chapter as well. Explain `stream.inline` logic. Ticket: #5513. Ticket: #6284.	1 year ago
Philippe Antoine	9146fc8957	doc: upgrade note about keyword tls.cert_subject Following commit `5379b52af2` rules that use multiple times the keyword tls.cert_subject will result in Warning: detect: duplicate instance for tls.cert_subject These rules likely meant to use a multi-buffer which is not the case for tls.cert_subject (even if it was documented so). Ticket: 7890 This is put in a new section of upgrade notes for upgrading to 8.0.1	1 year ago
Juliana Fajardini	27e165f760	doc/rules/index: keep rule types doc near the end As this chapter is more meta than about rule keywords, keep it by the end of the index, to have some semantic separation from the other sections.	1 year ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	1 year ago
Shivani Bhardwaj	b21f737aee	doc: add doc on internals of inspection of raw data Explain briefly the internals of inspection of raw data in the following order: - Stream Engine - Stream reassembly - Role of Detection Engine and Applayer Parsers - High level communication between Stream and Detection Engine - Relevant suricata.yaml settings alongwith some diagrams. Ticket 4351	1 year ago
Shivani Bhardwaj	9ed5ac7669	doc: make firewall table names consistent	1 year ago
Shivani Bhardwaj	7fec1883cd	doc: add more info to firewall design Add information about: - available tables, default policies and rule ordering - Packet layer and applayer tables and hooks - engine analysis output - commandline options available - how to load firewall rules Also, reorganize sections and content to assist the definitions.	1 year ago
Jeff Lucovsky	17e7387ff4	doc/fileinfo: Document fileinfo context/usage Issue: 6498	1 year ago
Thomas Winter	0b2dfa2b68	doc: Add upgrade note for ppp changes	1 year ago
Philippe Antoine	0026019dcf	doc: complete list of multi-buffers Ticket: 7867	1 year ago
Philippe Antoine	646c78269a	doc/devguide: section with conceptualized steps for adding app-layer Ticket: 6840	1 year ago
Tommy Wang	fc6b96fb85	doc/lualib: fix wrong tuple section markdown in flowlib Sections had wrong levels due to wrong markdown.	1 year ago
Tommy Wang	a10053e62c	doc/lualib: fix flow timestamps return value order Task #7854	1 year ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit Ticket: 7869	1 year ago
Philippe Antoine	be9858d3aa	detect/integers: document usage of units Ticket: 7190	1 year ago
Theo Buehler	315844ccd8	docs: fix deprecated inclusion of rtd theme path Since userguide/conf.py uses the deprecated get_html_theme_path(), sphinx emits a warning which breaks the build as warnings are treated as errors. Issue: 7859	1 year ago
Juliana Fajardini	ec1da6fd3a	doc/exceptions: fix wrong section markdown Sections had wrong levels due to wrong markdown.	1 year ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	1 year ago
Juliana Fajardini	a8453d73cd	detect: remove unused non-pf stats counters Remove unused rule prefilter-related stats counters that aren't in use. `94644ac960` (detect: move non-pf rules into special prefilter engines) removed the logic that made use of and incremented the stats counters: - det_ctx->counter_fnonmpm_list - det_ctx->counter_nonmpm_list Some code was left, registering them, and mentioning them in the json schema. Ticket #7834	1 year ago
Lukas Sismis	897cdb8571	doc/dpdK: update RX/TX descriptor note for Connect-X 4 Ticket: 7639	1 year ago
Jason Ish	eaef74af05	lua: document the dnp3 lib Ticket: #7631	1 year ago
Jason Ish	3b7b908fe2	doc/upgrade: mention that lua rules are enabled by default	1 year ago
Jason Ish	7a65ca10e2	doc/lua-detection: fix example script; remove most buffers - Reference rule hooks instead Ticket: #7728	1 year ago
Jason Ish	f56bd4db75	doc/lua-output: fix example script for new apis Ticket: #7728	1 year ago
Jason Ish	7535b5aa1d	doc/lua-functions: update lua-function documentation - cleanup usage and documentation around needs - mentiond that rule hooks are used instead of "needs" keywords with link with rule hooks (which is still in the firewall-design doc)	1 year ago
Jason Ish	decf795e94	doc/install: remove reference to --enable-lua This configure command no longer exists.	1 year ago
Jason Ish	4791f37ca2	doc/lua-detection: update note to mention rules are enabled by default In 8.0, Lua rules are enabled by default.	1 year ago
Alexandre Iooss	57e0ff0ee0	doc/lua: fix typo in stream toserver and toclient	1 year ago
Jeff Lucovsky	1030e4fa92	doc/suricatasc: Mentioned get-flow-stats-by-id cmd Add get-flow-stats-by-id to the list of commands supported by suricatasc Issue: 7081	1 year ago
Jeff Lucovsky	07b7f36748	doc/reload: Expand rule-reload discussion Clarify the resources involved in a rule reload. Issue: 5078	1 year ago
Jeff Lucovsky	c0d54d838e	gen/typo: Misc. typo fixes	1 year ago
Jeff Lucovsky	97b03b4076	doc/netflow: Discuss netflow Add discussion for netflow configuration, event type and fields contained in netflow records. Issue: 5139	1 year ago
Shivani Bhardwaj	58367149cc	doc: add upgrade note about change in inspection	1 year ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection Ticket: 6022	1 year ago
Philippe Antoine	4d4eb84eca	doc: document krb5 event type Ticket: 6566	1 year ago
Philippe Antoine	f907216e1a	doc: do not have bittorrent in the middle of SMB events	1 year ago
Jason Ish	580a4445cd	doc/install: use our recommended header order	1 year ago
Jason Ish	6b94689a44	doc/userguide: remove example with CentOS 7 CentOS 7 is EOL. Ticket: #7749	1 year ago
Jason Ish	8ed506659d	doc/userguide: break out package installation Break out RPM, Debian, and Ubuntu package installation into their own pages. Also break out other distributions like "Arch" into an "Other" section with a note about how those packages are not supported by the OISF. Ticket: #6252 Ticket: #6069	1 year ago
Jason Ish	1de19ee94c	doc/userguide: add appendix item on eve schema Add some basic documentation on our EVE schema, mainly to show users that it exists.	1 year ago
Jeff Lucovsky	a300df4c4d	detect/entropy: Clarify when entropy is logged Clarify when entropy values are logged and associated with non-alert log records.	1 year ago
Jason Ish	4a0f278502	doc/install: windows build documentation Ticket: #5911	1 year ago
Jason Ish	f35a56fa65	doc/code-style: add rust; minor cleanups - Add small section on Rust code, and Rust code exposed to FFI. - Other minor cleanups. Ticket: #7078 Ticket: #6955	1 year ago
Jason Ish	249bd32a9d	doc/userguide/code-style: update header ordering To match our recommended header ordering.	1 year ago
Eric Leblond	751f3eef3b	doc/userguide: fix some typos	1 year ago
Eric Leblond	6236574b9c	doc/userguide: enrichment_key is now context_key	1 year ago
Eric Leblond	20a0575d96	doc/userguide: fix some typos Suggestions from Juliana. Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>	1 year ago
Eric Leblond	40c545f8d9	doc/userguide: jsonline is now standard ndjson	1 year ago
Eric Leblond	f724c75cc9	doc/userguide: improve datajson doc	1 year ago
Eric Leblond	a652eee508	doc/userguide: remove left over datajson reference	1 year ago
Eric Leblond	7d28758a54	doc/userguide: improve datajson doc Patch adds ``remove_key`` option and clarifies the text.	1 year ago
Eric Leblond	0ae88a408a	doc/userguide: basic doc for jsonline format	1 year ago
Eric Leblond	9873c5d2e1	doc/userguide: add dataset with json	1 year ago
Jason Ish	8e8c3040e7	doc/upgrade: note about dns address swap on responses Document the change in DNS addresses for ticket 6400. Ticket: https://redmine.openinfosecfoundation.org/issues/6400	1 year ago
Philippe Antoine	b29d46d81f	rust: bindgen SCAppLayerParserStateIssetFlag Ticket: 7667	1 year ago
Victor Julien	f2faba5a23	detect/config: add flow tracking doc	1 year ago
Victor Julien	ecbcccf355	detect: add tcp.wscale keyword Allows matching on wscale option value in TCP header options. Ticket: #7713.	1 year ago
Lukas Sismis	8817a959e8	threading: support thread autopinning and interface-specific affinity Using the new configuration format, it is now possible to set CPU affinity settings per interface. The threading.autopin option has been added to automatically use CPUs from the same NUMA node as the interface. The autopin option requires hwloc-devel / hwloc-dev to be installed and --enable-hwloc flag in configure script. Ticket: 7036	1 year ago
Lukas Sismis	1a1789eb29	doc: remove title in threading section with no content	1 year ago
Lukas Sismis	6c654e30ac	threading: support previous threading configuration format Provide backward compatibility with the previous configuration format to allow smooth transition to the new format. The commit adds docs about the new format and the introduced changes.	1 year ago
Jeff Lucovsky	a8a3780276	doc/entropy: Document the entropy log output	1 year ago
Jeff Lucovsky	62e3c02914	doc: Add missing contributors to ack file Add missing contributors as identified by git shortlog -s -n --no-merges -- .	1 year ago
Juliana Fajardini	9614770483	doc/lua: document request_host lua lib Seems that we missed bringing this one, when documenting HTTP lua lib functions.	1 year ago
Jason Ish	62df7c8e81	doc/lua: remove reference to removed functions These have all been replaced by libs and already documented in their lib format. Ticket: #7728	1 year ago
Juliana Fajardini	f3aa0085a0	pgsql: rename copy in/out response field We used `copy_column_count`, while just `columns` is more accurate with what PostgreSQL describes, and what Wireshark shows. Related to Task #7644 Task #7645	1 year ago
Juliana Fajardini	2086f99d6b	pgsql: add initial support to CopyIn mode/subproto This sub-protocol inspects messages sent mainly from the frontend to the backend after a 'COPY FROM STDIN' has been processed by the backend. Parses new messages: - CopyInResponse -- initiates copy-in mode/sub-protocol - CopyData (In) -- data transfer message, from frontend to backend - CopyDone -- signals that no more CopyData messages will be seen from the frontend, for the current transaction - CopyFail -- used by the frontend to signal some failure to proceed with sending CopyData messages Task #7645	1 year ago
Jason Ish	e5faedf7e6	lua/util: move SCThreadInfo into suricata.util lib Move the SCThreadInfo global function into the suricata.util library as thread_info(). This is the last global function to be registered, so remove the supporting functions.	1 year ago
Jason Ish	778a699622	lua: simplify streaming output setup Setup the init function to simply return: {streaming = "tcp"} or {streaming = "http"} The returned table can have a lot of parameters that don't make sense together, this should simplify this one case.	1 year ago
Jason Ish	02bdea2bce	lua/streaming: provide streaming buffer as argument When setting up a Lua output script for streaming data, we're explicitly requesting stream data. Just pass the streaming data as arguments, rather than requiring the script to make an extra call to get the stream data. The streaming data will be passed in the "stream" field of the args passed to the log function. Eliminates the SCStreamingBuffer Lua function.	1 year ago

1 2 3 4 5 ...

1247 Commits (c960b7d7c178183150145f867e3d97fb2cea0635)