Juliana Fajardini
1647081b29
doc: remove remaining references to pruned flows
...
These were removed with a5587fec2e but these mentions went under the
radar.
10 months ago
Philippe Antoine
af8390f2ca
doc: upgrade note for engine-analysis breaking change
...
For keywords that now use the generic integer framework
Ticket: 7889
10 months ago
Philippe Antoine
d94aea8331
detect: tcp.window is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
68bb783e97
detect: tcp.seq is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
ed907bbd78
detect: tcp.ack is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
7a8eb28cae
detect: id is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
bff7413488
detect: icmp_seq is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
79e66f76e6
detect: icmp_id is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
09531447d1
detect: fragoffset is now a generic integer
...
Ticket: 7889
10 months ago
Philippe Antoine
85fa894425
detect: dnp3.func is now a generic integer
...
Ticket: 7889
10 months ago
Jeff Lucovsky
b02d9bb4f1
doc/luaxform: Remove init function from example
...
Issue: 8035
The `luaxform` transform doesn't support the `init` function. This
commit removes that from the example and clarifies how functions in the
Lua script are used.
10 months ago
Victor Julien
558ab73a7f
doc/devguide: explain alert logging changes
10 months ago
Philippe Antoine
c61f1cb6d0
detect/integers: rename index all1 to all
...
And all to all_or_absent
Ticket: 7929
10 months ago
Victor Julien
ec65fd430e
exception-policy: rename 'reject-both' to 'rejectboth'
...
To align it with the rule action.
10 months ago
Jason Ish
cdd4ea0f11
doc/devguide: document eve callback
...
Document the callback for adding additional data to EVE.
Ticket: #4708
10 months ago
Jason Ish
9fffc09ad7
doc/devguide: document eve file types
...
Ticket: #4708
10 months ago
Victor Julien
0c4a8fd183
doc/userguide: document reject-both expection policy
...
Ticket: #5974 .
10 months ago
David Wharton
9d2d1c4f8f
doc: minor verbiage tweaks and reST fix
11 months ago
Philippe Antoine
d8cb00e795
detect/tcp: make tcp.flags a generic integer with bitflags
...
Ticket: 6724
Allows to use numerical values for example
Also fixes some unit tests that were returning 1 after goto error
FlagsTestParse05 especially took this path as
de->ignored_flags != (TH_SYN|TH_RST) was false
we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST)
And then, we had a match, instead of what the not-run code
was supposing.
11 months ago
Philippe Antoine
1f9236a6d8
detect/ipv4: make fragbits a generic uint16 bitflags keyword
...
Ticket: 6724
Allows to use numerical values
11 months ago
Philippe Antoine
633180c93f
detect/integers: generalize support for bitflags modifier
...
Ticket: 6724
Allows sugar syntax for bitflags keywords.
While the expressivity does not increase, because we could already
use numerial values with all generic integer modes, this modifier
prefix is used with the strings, and follows the syntax
that is already used for fragbits and tcp.flags keyword.
11 months ago
Philippe Antoine
4b69a31dc3
detect/integers: count argument for multi-integers
...
Ticket: 7211
Allows to count the number of elements, without matching on
individual elements
11 months ago
Philippe Antoine
969739d067
detect: http2.errorcode is now a generic integer
...
Ticket: 7889
11 months ago
Philippe Antoine
401b2fcae6
detect: http2.frametype is now a generic integer
...
Ticket: 7889
11 months ago
Jeff Lucovsky
16d124cfda
doc/output: Highlight ethertype value change
...
Issue: 7855
Highlight the change to how ether_type values are displayed. Previously,
they were displayed in network order as a decimal value.
They are now displayed in host order as a decimal value.
11 months ago
Juliana Fajardini
ff96c52541
doc/install: fix minor typo
11 months ago
Juliana Fajardini
a3bd4ec324
doc: remove outdated GITGUIDE
11 months ago
Jason Ish
ced0c2c466
doc: upgrade notes for changes to ike output
11 months ago
Victor Julien
48972d544c
doc/userguide: link to protocol details from transactional rules
12 months ago
Victor Julien
480e664b4c
doc/userguide: add xbits tx scope support
...
Ticket #7680 .
12 months ago
Victor Julien
a1c4167d94
doc/userguide: add initial protocols overview
...
Explain per protocol mechanics for rule matching.
12 months ago
Victor Julien
7034a17d1d
doc/devguide: remove WIP mention of files in txs
...
Work has been completed, so comment is no longer accurate.
12 months ago
Victor Julien
e2a5bc058c
doc/userguide: fix DCERPC headings
12 months ago
Victor Julien
be5c83ed53
doc/userguide: add rule hooks to protocol doc
...
Ticket #7662 .
12 months ago
Victor Julien
91f258e2bc
doc/userguide: add missing app-layer protocols
12 months ago
Victor Julien
2623e67a80
doc/userguide: add missing rule protocols
12 months ago
Philippe Antoine
3641b4eda1
detect/nfs: move nfs_procedure to rust
...
Make it able to use strings on the way
Ticket: 6723
12 months ago
Philippe Antoine
9869fb776b
detect/snmp: pdu_type keyword now accepts strings
...
Ticket: 6723
12 months ago
Philippe Antoine
0553dfa814
detect/krb5: move krb5_msg_type to rust
...
Makes it a generic u32 on the way
Unit tests are covered by SV tests
Ticket: 6723
12 months ago
Philippe Antoine
da486af881
detect: list-keywords cli shows integers
...
Ticket: 7875
12 months ago
Philippe Antoine
b298bce0e7
detect: list-keywords cli shows multi-buffers
...
Ticket: 7571
12 months ago
Andreas Dolp
375b5dd306
doc: fix typo /var/run/suricata in file permissions docs.
12 months ago
Andreas Dolp
cc590b54c7
doc: fix typo and missing newline in rules/ssh_keywords.
12 months ago
Andreas Dolp
228abb7da0
doc: fix doc syntax error in rate_filter example.
12 months ago
Juliana Fajardini
21b27597d6
doc/rules/internals: minor fixes
...
Fix typo and add a reference about the classtype keyword effect.
Related to
Task #5449
12 months ago
Fupeng Zhao
e79d735374
decode/etag: ETag 802.1BR decoder
...
Ticket: #3953 .
12 months ago
Philippe Antoine
cb9ab951b9
detect/integers: subslice for multi-integers
12 months ago
Philippe Antoine
82f0e725a2
detect/integers: index or_absent and or_oob
...
To match if array is empty, or index is out of bounds
12 months ago
Philippe Antoine
1480cf47ab
detect/integers: nb index to match a specific number of times
...
For example
dns.rrtype: !A,nb>3
will match if we have more than 3 dns records which are not A
12 months ago
Philippe Antoine
6f848eeaaf
detect/integers: all1 index to match only on non-empty arrays
12 months ago