mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
b800ace56f
Introduce the tcp.session: keyword that accepts a comma-separated subset
of {setup, established, closing} and matches packets whose TCP session
state falls within the named phases.
This lets a rule writer cover the full TCP lifecycle in one rule instead
of separate flow:not_established + flow:established rules.
Changes:
- New detect-tcp-session.{c,h} with parser, match function, unit tests
- Register DETECT_TCP_SESSION in detect-engine-register.{c,h}
- Add to Makefile.am source list
- Extend engine-analyzer text output for tcp.session:
- Extend firewall.json keyword_info with tcp_session phase values
- Update flow-keywords.rst documentation
- Require TCP protocol and SIG_FLAG_REQUIRE_PACKET at setup
Ticket: 7704
(cherry picked from commit
|
4 days ago | |
|---|---|---|
| .. | ||
| dataset-examples | ||
| dns-keywords | ||
| fast-pattern | ||
| flow-keywords | ||
| header-keywords | ||
| http-keywords | ||
| intro | ||
| normalized-buffers | ||
| payload-keywords | 7 months ago | |
| pcre | ||
| rule-types | ||
| app-layer.rst | 4 days ago | |
| base64-keywords.rst | ||
| bypass-keyword.rst | 1 year ago | |
| config.rst | 1 year ago | |
| datasets.rst | 3 weeks ago | |
| dcerpc-keywords.rst | 6 months ago | |
| decode-layer.rst | ||
| dhcp-keywords.rst | ||
| differences-from-snort.rst | ||
| dnp3-keywords.rst | ||
| dns-keywords.rst | 1 year ago | |
| email-keywords.rst | 1 year ago | |
| enip-keyword.rst | ||
| fast-pattern-explained.rst | ||
| file-keywords.rst | ||
| flow-keywords.rst | 4 days ago | |
| ftp-keywords.rst | 2 months ago | |
| header-keywords.rst | 6 months ago | |
| http-keywords.rst | 1 year ago | |
| http2-keywords.rst | ||
| ike-keywords.rst | ||
| index.rst | 4 months ago | |
| integer-keywords.rst | 1 year ago | |
| intro.rst | 11 months ago | |
| ip-reputation-rules.rst | ||
| ipaddr.rst | ||
| ja-keywords.rst | ||
| kerberos-keywords.rst | ||
| ldap-keywords.rst | 1 year ago | |
| lua-detection.rst | 1 year ago | |
| mdns-keywords.rst | 1 year ago | |
| meta.rst | 1 year ago | |
| modbus-keyword.rst | ||
| mqtt-keywords.rst | ||
| multi-buffer-matching.rst | 1 year ago | |
| nfs-keywords.rst | ||
| noalert.rst | ||
| ntp-keywords.rst | 4 months ago | |
| payload-keywords.rst | 2 weeks ago | |
| pgsql-keywords.rst | 1 year ago | |
| prefilter-keywords.rst | ||
| quic-keywords.rst | ||
| rfb-keywords.rst | ||
| rule-types.rst | 12 months ago | |
| rules-internals.rst | 1 year ago | |
| sdp-keywords.rst | 1 year ago | |
| sip-keywords.rst | ||
| smb-keywords.rst | ||
| smtp-keywords.rst | ||
| snmp-keywords.rst | 5 months ago | |
| ssh-keywords.rst | 11 months ago | |
| tag.rst | ||
| thresholding.rst | ||
| tls-keywords.rst | 9 months ago | |
| transforms.rst | 6 months ago | |
| vlan-keywords.rst | ||
| websocket-keywords.rst | ||
| xbits.rst | 11 months ago | |