567 Commits (5ddd808e9bc737ea0699b4822ac609c456744310)

Author	SHA1	Message	Date
Philippe Antoine	d8cb00e795	detect/tcp: make tcp.flags a generic integer with bitflags ... Ticket: 6724 Allows to use numerical values for example Also fixes some unit tests that were returning 1 after goto error FlagsTestParse05 especially took this path as de->ignored_flags != (TH_SYN|TH_RST) was false we had de->ignored_flags == 0xff ^ (TH_SYN|TH_RST) And then, we had a match, instead of what the not-run code was supposing.	9 months ago
Philippe Antoine	1f9236a6d8	detect/ipv4: make fragbits a generic uint16 bitflags keyword ... Ticket: 6724 Allows to use numerical values	9 months ago
Philippe Antoine	633180c93f	detect/integers: generalize support for bitflags modifier ... Ticket: 6724 Allows sugar syntax for bitflags keywords. While the expressivity does not increase, because we could already use numerial values with all generic integer modes, this modifier prefix is used with the strings, and follows the syntax that is already used for fragbits and tcp.flags keyword.	9 months ago
Philippe Antoine	4b69a31dc3	detect/integers: count argument for multi-integers ... Ticket: 7211 Allows to count the number of elements, without matching on individual elements	9 months ago
Philippe Antoine	969739d067	detect: http2.errorcode is now a generic integer ... Ticket: 7889	9 months ago
Philippe Antoine	401b2fcae6	detect: http2.frametype is now a generic integer ... Ticket: 7889	9 months ago
Victor Julien	48972d544c	doc/userguide: link to protocol details from transactional rules	10 months ago
Victor Julien	480e664b4c	doc/userguide: add xbits tx scope support ... Ticket #7680.	10 months ago
Victor Julien	a1c4167d94	doc/userguide: add initial protocols overview ... Explain per protocol mechanics for rule matching.	10 months ago
Victor Julien	e2a5bc058c	doc/userguide: fix DCERPC headings	10 months ago
Victor Julien	be5c83ed53	doc/userguide: add rule hooks to protocol doc ... Ticket #7662.	10 months ago
Victor Julien	91f258e2bc	doc/userguide: add missing app-layer protocols	10 months ago
Victor Julien	2623e67a80	doc/userguide: add missing rule protocols	10 months ago
Philippe Antoine	3641b4eda1	detect/nfs: move nfs_procedure to rust ... Make it able to use strings on the way Ticket: 6723	10 months ago
Philippe Antoine	9869fb776b	detect/snmp: pdu_type keyword now accepts strings ... Ticket: 6723	10 months ago
Philippe Antoine	0553dfa814	detect/krb5: move krb5_msg_type to rust ... Makes it a generic u32 on the way Unit tests are covered by SV tests Ticket: 6723	10 months ago
Philippe Antoine	da486af881	detect: list-keywords cli shows integers ... Ticket: 7875	10 months ago
Philippe Antoine	b298bce0e7	detect: list-keywords cli shows multi-buffers ... Ticket: 7571	10 months ago
Andreas Dolp	cc590b54c7	doc: fix typo and missing newline in rules/ssh_keywords.	10 months ago
Juliana Fajardini	21b27597d6	doc/rules/internals: minor fixes ... Fix typo and add a reference about the classtype keyword effect. Related to Task #5449	10 months ago
Fupeng Zhao	e79d735374	decode/etag: ETag 802.1BR decoder ... Ticket: #3953.	10 months ago
Philippe Antoine	cb9ab951b9	detect/integers: subslice for multi-integers	10 months ago
Philippe Antoine	82f0e725a2	detect/integers: index or_absent and or_oob ... To match if array is empty, or index is out of bounds	10 months ago
Philippe Antoine	1480cf47ab	detect/integers: nb index to match a specific number of times ... For example dns.rrtype: !A,nb>3 will match if we have more than 3 dns records which are not A	10 months ago
Philippe Antoine	6f848eeaaf	detect/integers: all1 index to match only on non-empty arrays	10 months ago
Philippe Antoine	5add185f22	http2/detect: http2.window can now use index ... Ticket: 7480	10 months ago
Philippe Antoine	83868778b9	http2/detect: http2.priority can now use index ... Ticket: 7480	10 months ago
Philippe Antoine	9fc407fd75	mqtt/detect: mqtt.type can now use index ... Ticket: 7480	10 months ago
Philippe Antoine	dad424d74a	doc: multi-integers section for rules ... Ticket: 7480 Describing the usage of index	10 months ago
Alice Akaki	8e0b0ef35f	detect: add email.body_md5 keyword ... email.body_md5 matches on md5 hash generated from email body This keyword maps to the EVE field email.body_md5 It is a sticky buffer Supports prefiltering Ticket: #7587	10 months ago
Victor Julien	46203de0e9	doc: adjust for master to main rename	10 months ago
Juliana Fajardini	27e165f760	doc/rules/index: keep rule types doc near the end ... As this chapter is more meta than about rule keywords, keep it by the end of the index, to have some semantic separation from the other sections.	10 months ago
Juliana Fajardini	d5810a42e1	userguide: document how suricata processes rules ... Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules. Task #5449	10 months ago
Philippe Antoine	0026019dcf	doc: complete list of multi-buffers ... Ticket: 7867	10 months ago
Philippe Antoine	d0a513df6a	detect/integers: support kibibyte unit ... Ticket: 7869	11 months ago
Philippe Antoine	be9858d3aa	detect/integers: document usage of units ... Ticket: 7190	11 months ago
Jeff Lucovsky	21707ab26c	doc/from_base64: Emphasize keyword only values ... Emphasize that specifying the keyword only will result in the defaults for each option to be used. Issue: 7853	11 months ago
Jason Ish	7a65ca10e2	doc/lua-detection: fix example script; remove most buffers ... - Reference rule hooks instead Ticket: #7728	12 months ago
Jason Ish	4791f37ca2	doc/lua-detection: update note to mention rules are enabled by default ... In 8.0, Lua rules are enabled by default.	12 months ago
Philippe Antoine	f4378eb306	doc/devguide: document app-layer protocol detection ... Ticket: 6022	1 year ago
Jeff Lucovsky	a300df4c4d	detect/entropy: Clarify when entropy is logged ... Clarify when entropy values are logged and associated with non-alert log records.	1 year ago
Eric Leblond	751f3eef3b	doc/userguide: fix some typos	1 year ago
Eric Leblond	6236574b9c	doc/userguide: enrichment_key is now context_key	1 year ago
Eric Leblond	20a0575d96	doc/userguide: fix some typos ... Suggestions from Juliana. Co-authored-by: Juliana Fajardini Reichow <jufajardini@gmail.com>	1 year ago
Eric Leblond	40c545f8d9	doc/userguide: jsonline is now standard ndjson	1 year ago
Eric Leblond	f724c75cc9	doc/userguide: improve datajson doc	1 year ago
Eric Leblond	a652eee508	doc/userguide: remove left over datajson reference	1 year ago
Eric Leblond	7d28758a54	doc/userguide: improve datajson doc ... Patch adds ``remove_key`` option and clarifies the text.	1 year ago
Eric Leblond	0ae88a408a	doc/userguide: basic doc for jsonline format	1 year ago
Eric Leblond	9873c5d2e1	doc/userguide: add dataset with json	1 year ago
Victor Julien	f2faba5a23	detect/config: add flow tracking doc	1 year ago
Victor Julien	ecbcccf355	detect: add tcp.wscale keyword ... Allows matching on wscale option value in TCP header options. Ticket: #7713.	1 year ago
Jeff Lucovsky	a8a3780276	doc/entropy: Document the entropy log output	1 year ago
Juliana Fajardini	c5b9277474	doc/payload: fix typo, minor formatting changes	1 year ago
Juliana Fajardini	627b8900ef	doc/rule-types: fix typo	1 year ago
Jason Ish	4a655053e8	mdns: add mdns parser, logger and detection ... The mDNS support is based heavily on the DNS support, reusing the existing DNS parser where possible. This meant adding variations on DNS, as mDNS is a little different. Mainly being that *all* mDNS traffic is to_server, yet there is still the concept of request and responses. Keywords added are: - mdns.queries.rrname - mdns.answers.rrname - mdns.additionals.rrname - mdns.authorities.rrname - mdns.response.rrname They are mostly in-line with the DNS keywords, except mdns.answers.rdata which is a better than that mdns.response.rrname, as its actually looking at the rdata, and not rrnames. mDNS has its own logger that differs from the DNS logger: - No grouped logging - In answers/additionals/authorities, the rdata is logged in a field that is named after the rdata type. For example, "txt" data is no longer logged in the "rdata" field, but instead a "txt" field. We currently already did this in DNS for fields that were not a single buffer, like SOA, SRV, etc. So this makes things more consistent. And gives query like semantics that the "grouped" object was trying to provide. - Types are logged in lower case ("txt" instead of "TXT") - Flags are logged as an array: "flags": ["aa", "z"] Ticket: #3952	1 year ago
Juliana Fajardini	404bb53ce9	pgsql: add query keyword ... Add the `pgsql.query` rule keyword to match on PGSQL's query request message contents. This currently matches on the EVE field: pgsql.request.simple_query `pgsql.query` is a sticky buffer and can be used as a fast_pattern. Task #6259	1 year ago
jason taylor	ca9b29c2d0	doc: update http.header_names normalization info	1 year ago
Jeff Lucovsky	77139e0cb1	doc/ftp: Document ftp.completion_code sticky buffer ... This commit adds documentation for the ftp.completion_code sticky buffer. This is a multi-buffer match. Issue: 7507	1 year ago
Jeff Lucovsky	53c8a0f8f1	doc: Document luaxform transform ... Issue: 2290	1 year ago
Jeff Lucovsky	aec2513799	doc/ftp: Document ftp.reply_received ... Add documentation for the ftp.reply_received keyword.	1 year ago
Jeff Lucovsky	0b02b1d2d1	doc/ftp: Document ftp.mode keyword ... Document the ftp.mode keyword Fixup a typo in the ftp.reply keyword section. Issue: 7505	1 year ago
Philippe Antoine	daabab7381	doc/ssh: document hooks ... Ticket: 7607	1 year ago
Jeff Lucovsky	ff59f215d6	doc/ftp: Document ftp.dynamic_port keyword ... Document the sticky buffer for ftp.dynamic_port	1 year ago
Jason Ish	be483dc873	doc/userguide: document that lua dns rules need hooks ... And remove the old "keywords" that a lua Rule can register with for DNS.	1 year ago
Philippe Antoine	8757ad5fd3	detect/dns: support string for dns.rrtype ... Ticket: 6723	1 year ago
Philippe Antoine	44a6f7f8ca	detect/dns: support string for dns.rcode ... Ticket: 6723	1 year ago
Alice Akaki	bda0890834	detect: add email.received keyword ... email.received matches on MIME EMAIL Received This keyword maps to the EVE field email.received[] It is a sticky buffer Supports multiple buffer matching Supports prefiltering Ticket: #7599	1 year ago
James	deb761367d	doc: Update bypass docs to use new keyword format ... Ticket: #7143 Update documentation to reflect new sticky buffer keyword format	1 year ago
Victor Julien	e3c6554ee6	detect/app-layer-protocol: allow matching on 'unknown'	1 year ago
Alice Akaki	ca429ef5e3	detect: add email.url keyword ... email.url matches on URLs extracted from an email This keyword maps to the EVE field email.url[] Supports multiple buffer matching Supports prefiltering Ticket: #7597	1 year ago
Victor Julien	57c73880db	lua: enable lua rules by default ... Now that sandboxing is in place, lua rule support is enabled by default.	1 year ago
Alice Akaki	d4ec5b9765	detect: add ldap.responses.attribute_type ... ldap.responses.attribute_type matches on LDAP attribute type/description This keyword maps the eve field ldap.responses[].search_result_entry.attributes[].type It is a sticky buffer Supports multiple buffer matching Supports prefiltering Ticket: #7533	1 year ago
Alice Akaki	75fb352bde	detect: add ldap.request.attribute_type ... ldap.request.attribute_type matches on LDAP attribute type/description This keyword maps the following eve fields: ldap.request.search_request.attributes[] ldap.request.modify_request.changes[].modification.attribute_type ldap.request.add_request.attributes[].name ldap.request.compare_request.attribute_value_assertion.description It is a sticky buffer Supports multiple buffer matching Supports prefiltering Ticket: #7533	1 year ago
Jeff Lucovsky	88c38fc4a0	doc/ftp: Document the ftp.reply keyword ... Issue: 7508	1 year ago
Eric Leblond	ed20e7cfe4	doc/userguide: doc domain and tld transforms	1 year ago
Victor Julien	6f5fd77cb9	detect/app-layer-state: keyword for protocol state ... Allow matching on the app-layer protocol state.	1 year ago
Jeff Lucovsky	590c8f6131	doc/ftp: Add ftp.command_data ... This commits adds documentation for the ftp.command_data rule keyword that includes usage examples.	1 year ago
Philippe Antoine	90666c7da1	doc/sdp: fix doc to match real keywords names ... Ticket: 7291	1 year ago
Alice Akaki	341369f203	detect: add email.x_mailer keyword ... email.x_mailer matches on MIME EMAIL X-Mailer This keyword maps to the EVE field email.x_mailer It is a sticky buffer Supports prefiltering Ticket: #7598	1 year ago
Alice Akaki	52e12410ed	detect: add email.message_id keyword ... email.message_id matches on MIME EMAIL Message-Id This keyword maps to the EVE field email.message_id It is a sticky buffer Supports prefiltering Ticket: #7593	1 year ago
Giuseppe Longo	330241b162	doc: add sdp sticky buffers	1 year ago
Jeff Lucovsky	ed2a81dc05	doc/entropy: Add documentation for the entropy keyword ... This commits adds documentation for the entropy keyword. The entropy keyword calculates the Shannon entropy value for content with the calculated value used to determine whether an alert occurs.	1 year ago
Shivani Bhardwaj	5ba0ccaf4b	doc: remove http cookie ua from list of buffers ... as they are available via library using the tx - tx:request_header("Cookie") - tx:response_header("Cookie") - tx:request_header("User-Agent")	1 year ago
Philippe Antoine	3a092f3027	detect: allow rule which need both directions to match ... Ticket: 5665 This is done with `alert ip any any => any any` The => operator means that we will need both directions	1 year ago
Jason Ish	66eb29affd	doc/ndpi: move ndpi docs to new plugins section ... Moves the nDPI documentation to an nDPI page in the plugins section. Remove the duplication of installation and setup documentation. Includes some minor cleanups.	1 year ago
Alfredo Cardigliano	dfd9ef5784	ndpi: initial implementation of nDPI plugin ... Ticket: #7231	1 year ago
Alice Akaki	ce2e7aed74	detect: add email.date keyword ... email.date matches on MIME EMAIL DATE This keyword maps to the EVE field email.date It is a sticky buffer Supports prefiltering Ticket: #7591	1 year ago
Victor Julien	8c9dfafc6d	doc/tls: add more detail on tls.random	1 year ago
Philippe Antoine	879a733c12	doc/http2: explicit behavior for some http keywords ... HTTP/2 does not define a way to carry the version or reason phrase that is included in an HTTP/1.1 status line. Ticket: 6548	1 year ago
Alice Akaki	7ba4ebdc2c	detect: add email.cc keyword ... email.cc matches on MIME EMAIL Carbon Copy This keyword maps to the EVE field email.cc[] It is a sticky buffer Supports prefiltering Ticket: #7588	1 year ago
Alice Akaki	9e7d23d73f	doc: add keywords to the multi-buffer-matching list	1 year ago
Alice Akaki	5d6a072e35	detect: add email.to keyword ... email.to matches on MIME EMAIL TO This keyword maps to the EVE field email.to[] It is a sticky buffer Supports prefiltering Ticket: #7596	1 year ago
Alice Akaki	09db7c7ac1	detect: add mime email.subject keyword ... email.subject matches on MIME EMAIL SUBJECT This keyword maps to the EVE field email.subject It is a sticky buffer Supports prefiltering Ticket: #7595	1 year ago
Alice Akaki	90aab0d62f	detect: add email.from ... email.from matches on MIME EMAIL FROM This keyword maps to the EVE field email.from It is a sticky buffer Supports prefiltering Ticket: #7592	1 year ago
Philippe Antoine	32d0bd2bbb	detect: limit base64_decode `bytes` to 64KiB ... Ticket: 7613 Avoids potential large per-thread memory allocation. A buffer with the size of the largest decode_base64 buffer size setting would be allocated per thread. As this was a u32, it could mean a per-thread 4GiB memory allocation. 64KiB was already the built-in default for cases where bytes size wasn't specified.	1 year ago
Juliana Fajardini	d8523d9d97	userguide/header-keywords: fix typos, adjust format	1 year ago
Juliana Fajardini	28407b2fb8	doc/rule-types: remove trailing underscore ... And other minor fixes that were overseen.	1 year ago
Jason Ish	814e9ffb7a	dns: add keywords for additionals and authorities rrnames ... Add keywords dns.additionals.rrname and dns.authorities.rrname. Along the way, consolidate dns.query.name and dns.answer.name into a single file and register them altogether since there is a lot of common code.	1 year ago
Jason Ish	a026293b42	dns: rename dns.response keyword to dns.response.rrname ... This is a better name as the keyword is looking at all rrname type fields in the response.	1 year ago