suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	1721ba1ba5	doc/subslice: Document the subslice transform Add documentation for the subslice transform. Issue: 7672	3 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container Ticket: 8372 Also remove dead code from script checking the rules	3 months ago
Philippe Antoine	5f9e436c3f	detect/dcerpc: support generic integer for opnum keyword Ticket: 8179	3 months ago
Jason Ish	713e4eb900	ntp: convert reference_id to buffer and add keyword Store the NTP reference ID as raw network-order bytes so it can be exposed as a sticky buffer and matched with payload keywords. The reference ID is often a 4 character string, or an IP address and not just an integer identifier. Updates the log reference ID to be a string of colon separated hex digits as this matches what tshark does. Ticket: #8488	3 months ago
Jason Ish	991e7f3b1d	ntp: add ntp.mode keyword This keyword also accepts strings for known mode names. Ticket: #8429	3 months ago
Jason Ish	c10c482290	ntp: add ntp.stratum keyword Ticket: #8431	3 months ago
Jason Ish	ec344fe68d	ntp: add ntp.version keyword SNMP was used as a template. Ticket: #8430	3 months ago
Victor Julien	670fdabd32	detect/snmp: add snmp.trap_type keyword Implemented as a U8 integer keyword. Ticket: #8482.	3 months ago
Philippe Antoine	bcbec8d615	doc: fix eol content in http rules	3 months ago
Philippe Antoine	e65643909a	doc: move more examples to container:: example-rule Ticket: 8372 And fix another bad rule	3 months ago
Philippe Antoine	72e13c9774	doc: do not highlight bad transactional rule As stated, it will refuse to load. Ticket: 8372	3 months ago
Philippe Antoine	15f45be672	doc: fix rules Ticket: 8372 Somes rules in the doc had typos, fix them so suricata can load them when you copy/paste the doc	3 months ago
Victor Julien	6c3169cee0	doc/userguide: add ether and arp to intro	3 months ago
Victor Julien	6298c47145	doc/userguide: improve protocol docs	3 months ago
Victor Julien	2e2132a16f	doc/userguide: improve pkthdr docs	3 months ago
Victor Julien	61a7f47a69	detect: add ether.hdr keyword Sticky buffer to inspect the ethernet header. Example rule: alert ether any any -> any any ( \ ether.hdr; content:"\|08 06\|"; offset:12; depth:2; \ sid:1;) Ticket: #8327.	3 months ago
Juliana Fajardini	8c29c471b4	userguide: add references to rules/README to docs To make it more visible/easier to find.	4 months ago
Philippe Antoine	1e0f344ab7	doc: be more precise for decompress transforms Ticket: 7846	4 months ago
Victor Julien	2480f8c038	doc: fix dcerpc.opnum documentation Docs were claiming greater than, less than, etc. support even though this was never supported. Fixes: `51be8f0238` ("doc/dcerpc: add proto keywords") Ticket: #8330.	4 months ago
Victor Julien	fe3cce895c	doc/userguide: add igmp keyword docs	4 months ago
Victor Julien	7e6fd09e90	doc/userguide: add missing ipopts values	4 months ago
Philippe Antoine	d5ea973791	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust Ticket: 8310 And increases expressivity on the way by supporting other modes than equality	5 months ago
Sven Cuyt	1246f1cf8c	doc/userguide: add link to differences-from-snort Ticket: #8031.	5 months ago
Sven Cuyt	a0cc534471	doc/userguide: fix table showing example payload Ticket: #8031.	5 months ago
Sven Cuyt	2d662538e5	doc/userguide: add example with non-zero offset for relative isdataat Ticket: #8031.	5 months ago
Victor Julien	7c5285e5e6	doc/userguide: explain isdataat absolute vs relative difference Ticket: #8031.	5 months ago
Philippe Antoine	539e4ee665	detect/transforms: add zlib_deflate transform Ticket: 7846	5 months ago
Philippe Antoine	dbea660729	detect/transforms: add gunzip transform Ticket: 7846	5 months ago
Andreas Dolp	69eb567dea	doc/userguide: fix within-distance pointer graphics in payload-keywords doc Redmine ticket: #8261 According to [1], the within pointer (if combined with distance) includes the distance pointer, which is not clearly visible in the graphic. Fixed this in a new graphic by some GIMP arts. PS: Special thanks to one of our team members Annika C. for initially spotting this! [1] https://forum.suricata.io/t/is-within-affected-by-distance/1688	5 months ago
Mingyu Jeon	c98112eb67	doc: update tls_cert_notafter/before refs #3065 * add explanation on omitted values	5 months ago
Jeff Lucovsky	45a36e961f	doc/byte_jump: Clarify bitmask operation Issue: 6693 Clarify how the bitmask value is used for byte_jump Snort compatibility says: - The bitmask value is applied to the extracted value before the multiplier is applied. - The result of the bitmask operation is to be right shifted by the number of trailing 0's in the bitmask value.	5 months ago
Ofer Dagan	7627756360	detect/detection_filter: add unique_on option Add optional unique_on {src_port\|dst_port} to detection_filter for exact distinct port counting within the seconds window. Features: - Runtime uses a single 64k-bit (8192 bytes) union bitmap per threshold entry with O(1) updates. - Follows detection_filter semantics: alerting starts after the threshold (> count), not at it. - On window expiry, the window is reset and the current packet's port is recorded as the first distinct of the new window. Validation: - unique_on requires a ported transport protocol; reject rules that are not tcp/udp/sctp or that use ip (protocol any). Memory management: - Bitmap memory is bounded by detect.thresholds.memcap. - New counters: bitmap_memuse and bitmap_alloc_fail. Tests: - C unit tests for parsing, distinct counting, window reset, and allocation failure fallback. - suricata-verify tests for distinct src/dst port counting. Task #7928	6 months ago
Victor Julien	73a873ecfe	doc/userguide: endswith can be mixed with offset/distance/within Bug: #5030.	6 months ago
Shivani Bhardwaj	30bdaa44e1	doc: add elephant.flow usage section	7 months ago
Shivani Bhardwaj	06eafb79d6	detect/flow-pkts: check for both dir The functionality of "both" can already be easily achieved by using both "toclient" and "toserver" in a rule. This just adds the ease of expression in rule. As it is added now, check the direction for the pre-existing users of direction as well.	7 months ago
Jeff Lucovsky	845544aad3	doc/luaxform: Clarify luaxform calling convention Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function.	7 months ago
Juliana Fajardini	907f4faff8	doc/thresholding: minor fix for backoff subsection	7 months ago
Philippe Antoine	c93e69830a	detect/ssl: properly handle negation in ssl_version keyword Ticket: 3220 DetectSslVersionMatch did not handle properly negation. It could never match on a signatrue with ssl_version: !tls1.3 That is because, if we had such a signature and network traffic with tls1.1, we were looking into DetectSslVersionData field for tls1.1, which was not set, instead of looking at field for tls1.3 which was set with negated flag. Previous DetectSslVersionData was holding redundant information. It did not need to have it for each ssl version, but just globally. Also, it did not need to hold the version as a value in the array, as it was redundant with the index of the array.	7 months ago
Philippe Antoine	1329786f84	detect: new command line option : list-rule-protos To list the protocols we can use a in a rule header Ticket: 635	7 months ago
Philippe Antoine	d94aea8331	detect: tcp.window is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	68bb783e97	detect: tcp.seq is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	ed907bbd78	detect: tcp.ack is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	7a8eb28cae	detect: id is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	bff7413488	detect: icmp_seq is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	79e66f76e6	detect: icmp_id is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	09531447d1	detect: fragoffset is now a generic integer Ticket: 7889	8 months ago
Philippe Antoine	85fa894425	detect: dnp3.func is now a generic integer Ticket: 7889	8 months ago
Jeff Lucovsky	b02d9bb4f1	doc/luaxform: Remove init function from example Issue: 8035 The `luaxform` transform doesn't support the `init` function. This commit removes that from the example and clarifies how functions in the Lua script are used.	8 months ago
Philippe Antoine	c61f1cb6d0	detect/integers: rename index all1 to all And all to all_or_absent Ticket: 7929	8 months ago
David Wharton	9d2d1c4f8f	doc: minor verbiage tweaks and reST fix	9 months ago

1 2 3 4 5 ...

567 Commits (5ddd808e9bc737ea0699b4822ac609c456744310)