You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide/rules
Victor Julien 9419f15779 detect/firewall: reject unsatisfiable app-layer-state rules
An app-layer-state comparison that can never hold - mode '>' at or beyond
the completion state, or mode '<' at the starting state - can never match.
Both are fatal at rule load, so reject them at parsing.

The LTE (<hook) form at the first state (progress 0) is accepted and is
equivalent to the plain hook form: there are no prior states to auto-accept.

Derive the completion state from the direction the keyword resolved in
instead of the rule's flags, and document the new load time rejections.

Ticket: #8944.
3 weeks ago
..
dataset-examples
…
dns-keywords
…
fast-pattern
…
flow-keywords
…
header-keywords
…
http-keywords
…
intro
…
normalized-buffers
…
payload-keywords doc/userguide: fix within-distance pointer graphics in payload-keywords doc 9 months ago
pcre
…
rule-types
…
app-layer.rst detect/firewall: reject unsatisfiable app-layer-state rules 3 weeks ago
base64-keywords.rst
…
bypass-keyword.rst detect/bypass: ban bypass keyword for firewall mode 5 months ago
config.rst doc: move more rules to dedicated css container 6 months ago
datasets.rst doc/userguide: add dataset match subdomain documentation 5 months ago
dcerpc-keywords.rst detect/dcerpc: support generic integer for opnum keyword 6 months ago
decode-layer.rst
…
dhcp-keywords.rst doc: move more examples to container:: example-rule 6 months ago
differences-from-snort.rst doc: move more rules to dedicated css container 6 months ago
dnp3-keywords.rst detect: dnp3.func is now a generic integer 12 months ago
dns-keywords.rst doc: move more rules to dedicated css container 6 months ago
email-keywords.rst
…
enip-keyword.rst detect/enip: cip_class and cip_instance are now a multi-integer 4 months ago
fast-pattern-explained.rst
…
file-keywords.rst doc: move more rules to dedicated css container 6 months ago
flow-keywords.rst detect: add tcp.session keyword for unified TCP lifecycle matching 2 months ago
ftp-keywords.rst ftp: support STOU data transfers 4 months ago
header-keywords.rst detect: add ether.hdr keyword 7 months ago
http-keywords.rst swf: validate configured depth limits 2 months ago
http2-keywords.rst
…
ike-keywords.rst detect/ike: move ike.ike.chosen_sa_attribute keyword to rust 8 months ago
index.rst doc/sctp: add sctp keywords 5 months ago
integer-keywords.rst detect/integers: rename index all1 to all 12 months ago
intro.rst detect/firewall: reject unsatisfiable app-layer-state rules 3 weeks ago
ip-reputation-rules.rst doc: move more rules to dedicated css container 6 months ago
ipaddr.rst
…
ja-keywords.rst doc: move more rules to dedicated css container 6 months ago
kerberos-keywords.rst detect/krb5: fix doc about cname and sname keywords 4 months ago
ldap-keywords.rst detect/ldap: add BindRequest detection keywords 4 weeks ago
llmnr-keywords.rst doc: add llmnr 5 months ago
lua-detection.rst
…
mdns-keywords.rst doc: move more rules to dedicated css container 6 months ago
meta.rst doc: fix rules 6 months ago
modbus-keyword.rst
…
mqtt-keywords.rst detect/mqtt: reason_code keyword is now a multi-integer 6 months ago
multi-buffer-matching.rst doc: fix rules 6 months ago
nfs-keywords.rst
…
noalert.rst doc: fix rules 6 months ago
ntp-keywords.rst ntp: convert reference_id to buffer and add keyword 6 months ago
payload-keywords.rst doc/pcre: note that flow captures need a flow 2 months ago
pgsql-keywords.rst doc: fix rules 6 months ago
prefilter-keywords.rst doc: move more rules to dedicated css container 6 months ago
quic-keywords.rst
…
rfb-keywords.rst
…
rule-types.rst
…
rules-internals.rst
…
sctp-keywords.rst decode/sctp: chunk_cnt can be a u16 4 months ago
sdp-keywords.rst
…
sip-keywords.rst
…
smb-keywords.rst doc: fix rules 6 months ago
smtp-keywords.rst doc: move more examples to container:: example-rule 6 months ago
snmp-keywords.rst snmp/detect: add snmp.trap_address keyword 4 months ago
ssh-keywords.rst doc: update the SSH docs for the reworked state machine 3 weeks ago
tag.rst
…
thresholding.rst docs/thresholding: clarify keywords limitations 4 weeks ago
tls-keywords.rst doc: move more examples to container:: example-rule 6 months ago
transforms.rst doc/transforms: avoid lua lexer error in luaxform example 4 weeks ago
vlan-keywords.rst
…
websocket-keywords.rst
…
xbits.rst doc: move more rules to dedicated css container 6 months ago