suricata

Commit Graph

Author	SHA1	Message	Date
Jason Ish	4a97461f9a	doc/userguide: notes about Lua rules being disabled by default	2 years ago
Juliana Fajardini	c0db25d055	userguide: update exception policy behaviors table Some exception policies can only be applied to the triggering packet or only make sense considering the whole flow. Highlight such cases in the table showing each exception policy. Related to Bug #5825	2 years ago
Juliana Fajardini	0c2922f02e	doc: add midstream scenarios for exception policy The different interactions between midstream pick-up sessions and the exception policy can be quite difficult to visualize. Add a section for that in the userguide. Related to Bug #5825	2 years ago
Philippe Antoine	415b036dca	http1: implement http.request_header So that it is generic for HTTP1 and HTTP2 Ticket: #5780	2 years ago
Philippe Antoine	7256ec8a6e	detect/http2: do not escape ':' in header name or value for keywords http.request_header and http.response_header Ticket: #5780	2 years ago
Philippe Antoine	656554f293	http2: rename http2.header to http.request_header Or http.response_header based on the direction http2.header had a different behavior than http.header and this was confusing. Ticket: #5780	2 years ago
Philippe Antoine	e30f4943ae	doc: GitHub PRs workflow	2 years ago
Jeremy MountainJohnson	435d74d744	userguide/install: add info on arch-based installs Add Arch AUR information for installation on Arch-based distros.	2 years ago
Philippe Antoine	5c419b79b7	doc: upgrade guide for logging http custom headers Ticket: #5320	2 years ago
Juliana Fajardini	f83c67bbb5	doc: add missing rule to engine-analysis section The first report didn't have an example rule to go with.	2 years ago
Lukas Sismis	11c3aa868d	doc: add DPDK Bond PMD docs Ticket: #6099	2 years ago
Philippe Antoine	9287cbc33a	http: logs custom headers in a subobject This subobject is request_headers or response_headers This especially avoids json keys collisions. Ticket: #5320 Also fixes typo referrer/referer	2 years ago
Jason Ish	5af73b3879	doc/userguide: document include files Document how to use include files, plus add a deprecation notice on the use of multiple "include" statements.	2 years ago
Jason Ish	a71dee5516	doc/userguide: merge logging changes in 7.0 upgrade notes Two "Logging changes" sections existed, merge.	2 years ago
Jason Ish	f8620d0ed2	docs: update url to docs.suricata.io	2 years ago
Victor Julien	3de687f30c	profiling/rules: doc updates	2 years ago
Eric Leblond	694bff11ac	doc: add rule profiling information	2 years ago
Jason Ish	b0c329da04	doc/userguide: provide more RPM doc - Address the various RPM distributions - User info - Systemd info Related issue: #5884	2 years ago
Eloy Pérez González	b3c7130749	krb5: update krb5_msg_type keyword docs	2 years ago
Lukas Sismis	1c3cb1e8cc	docs: refactor DPDK docs and add performance tuning section Ticket: #5857 Ticket: #5858	2 years ago
Lukas Sismis	03319263db	docs: wrap DPDK doc section at 80 chars	2 years ago
Lukas Sismis	d0bf3ba638	dpdk: add configure option Ticket: #5859	2 years ago
Victor Julien	0903536fd6	doc: spelling Thanks to Josh Soref.	2 years ago
Philippe Antoine	9bd2b72e2b	doc: explain where tls.store stores certificates By adding a reference/link to the doc about the suricata.yaml config section pecifying the directory where the certificates are stored	2 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	2 years ago
Victor Julien	4dbdaf8a8e	doc/install: point to userguide	2 years ago
Victor Julien	19cabc9a02	doc: remove legacy windows install guide	2 years ago
Victor Julien	01f43604b9	doc: remove legacy pfring install guide	2 years ago
Wes Hurd	aee41957e1	doc: add docutils.conf to disable smart quotes	2 years ago
Andreas Herz	3045e75ee1	doc: add note on the hashsize recommendation for datasets	2 years ago
Victor Julien	a006aef4d0	doc: fix description of iptables rules	2 years ago
Bazzan Don	38b3fffbc7	doc/optimization: move "convert.py" to Python3 Ticket: #5596	2 years ago
Morris Chan	b9aac6dd18	yaml: grammar fixup	2 years ago
Juliana Fajardini	ae2a477978	devguide: clarify clang formatting changes policy It was pointed out by a contributor that our workflow mentioned rewrite-branch as the preferred way, while in fact our policy is to add said changes to a different commit. Updating documentation to prevent other situations like that.	2 years ago
Rafael Girão	6ec3bc189a	docs: remove obsolete af-packet warning	2 years ago
John Dewey	365bec3da6	netmap: Correct LB + Netmap YAML usage Corrected the example YAML configuration when using Netmap and LB.	2 years ago
Jeff Lucovsky	0ad6d4358f	add to doc/pfring: Document additional cluster types	2 years ago
Jeff Lucovsky	b1918168f9	doc/pfring: Document additional cluster types This commit adds brief discussion for additional cluster types for use with the pf-ring packet source. Newly added: - cluster_inner_flow - cluster_inner_flow_2_tuple - cluster_inner_flow_4_tuple - cluster_inner_flow_5_tuple Issue: 5975	2 years ago
Philippe Antoine	59734d16a1	detect: use http.connection to client Ticket: #5746	2 years ago
Philippe Antoine	6bc7f02e13	doc: rules can have http1 as protocol Ticket: #5962	2 years ago
Jeff Lucovsky	fd46c93a8f	doc/byte_math: Add divide by 0 discussion. Issue: 5945	2 years ago
Juliana Fajardini	d314b57e6b	userguide/muti-tenant: fix typo	2 years ago
jason taylor	5abcd50142	doc: add tenant id value requirement Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Juliana Fajardini	31066c7c3b	docs: clarify exception policy's supported values As flow.memcap-policy and defrag.memcap-policy do not support flow actions, clarify that in the documentation. Also fix some typos, and add missing values in some places where the exception policies were explained. Related to Bug #5940	2 years ago
Jeff Lucovsky	35bbdf4124	doc/content: Add limits for distance/within Ticket: 5740	2 years ago
Philippe Antoine	8f9cd8ff1a	doc: security.limit-noproc upgrade note Ticket: #5621	2 years ago
Shivani Bhardwaj	0f3e7761da	doc: add dataset examples	2 years ago
Lancer Cheng	6142593a69	doc: add version filed in NTLMSSP documentation Bug OISF#5783	2 years ago
Haleema Khan	609df1776e	userguide: update tls keywords information Ticket #5544	2 years ago
jason taylor	8e5b1fe8e6	userguide: add DHCP EVE log information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Victor Julien	f4fa51986e	doc: warn IPS users on new exception policy default	2 years ago
Philippe Antoine	e3105a6614	ftp: adds a config option ftp-hash for autofp-scheduler This allows ftp-data and ftp flows to be processed by the same thread. Otherwise, there may be a concurrency issue where the would-be ftp-data flow is first processed, and thus not recognized as such. And the ftp flow gets processed later and the expectation coming from it is never found. To do so, the flow hash gets used as usual, except for flows that may be either ftp or ftp-data, that is either one port is 21, or both ports are high ones. Ticket: #5205	2 years ago
Jason Ish	1b844cd7f7	doc/userguide: document --include command line option	2 years ago
Philippe Antoine	b52293b609	dcerpc: config limit maximum number of live transactions As is done for other protocols Ticket: #5779	2 years ago
Juliana Fajardini	918bd7435c	userguide/config: update log format symbols list There were some possible format options missing after the recent changes in the log format.	2 years ago
Juliana Fajardini	0d9289014b	exceptions: add master switch config option This allows all traffic Exception Policies to be set from one configuration point. All exception policy options are available in IPS mode. Bypass, pass and auto (disabled) are also available in iDS mode Exception Policies set up individually will overwrite this setup for the given traffic exception. Task #5219	2 years ago
jason taylor	0632233791	userguide: update http.cookie description Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Philippe Antoine	55c4834e4e	smb: configurable max number of transactions per flow Ticket: #5753	2 years ago
Jason Ish	48f0fd3c74	doc/userguide: update logging section for time formats - Update fragment of configuration file to match suricata.yaml with new default-log-format. - Document new %z format specifier.	2 years ago
Juliana Fajardini	4c7ca2c367	devguide/install: add note about ubuntu version We want to make it clear with which system the instructions for installing from were tested with.	2 years ago
Juliana Fajardini	377885f420	exception-policies: fix typos	2 years ago
Bazzan Don	6e4a5cee7a	devguide: add page on installing suricata from git As part of the process of moving documentation from redmine to "Read the Docs", this commit moves installing Suricata using git page from redmine wiki into Suricata Developer Guide section. It also updates the necessary steps. Ticket: #5585	2 years ago
Jason Ish	0a4e3d0f82	doc/userguide: ubuntu: install software-properties-common This package likely needs to be installed when starting with an Ubuntu container or other minimal Ubuntu install. Ticket: #5616	2 years ago
Richard McConnell	b39a4c63fe	doc: document AF_XDP feature	2 years ago
Todd Mortimer	15c77be937	swf-decompression: Disable by default. Add an entry to the upgrade guide noting the change. Ticket: #5632	2 years ago
Jeff Lucovsky	197ad51138	doc: Update bsize documentation This commit updates the bsize documentation 1. Describe what happens when "content" immediately precedes "bsize" 2. Include the operators and 3. Include examples using the operators.	2 years ago
jason taylor	9dc8fffe05	userguide: update tos keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	1d9b91a987	userguide: update fragoffset keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	7c73144988	userguide: update fragbits information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	4be9793e36	userguide: update geoip information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	e8eba6e4a1	userguide: update id keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	cfd0da133e	userguide: update ipv6.hdr keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	150a04b597	userguide: update ipv4.hdr keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	298f59c2ba	userguide: update ip_proto keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	6226492976	userguide: update sameip keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	f97ba44339	userguide: update ipopts keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
jason taylor	9b4e6e5802	userguide: update ttl keyword information Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Philippe Antoine	ce710181f6	doc: update doc for HTTP file.data to server Ticket: #4144 Completes `e587f6792a`	2 years ago
Jeff Lucovsky	5a6e68285b	doc/netmap: Describe Netmap IPS usage Issue: 5512 This commit summarizes Netmap usage with Suricata's IPS mode.	2 years ago
Jason Ish	9d653512f9	doc/userguide: update bittorrent-dht eve examples Update the bittorrent-dht examples using real log records with peers and nodes broken down into objects.	2 years ago
Jason Ish	065f3ab9f1	doc: rename bittorrent-dht to bittorrent_dht in eve output	2 years ago
Jason Ish	0ea9ba66d1	userguide/eve-log: remove mentions of requiring Rust Rust is required to build now.	2 years ago
Aaron Bungay	d166c48d28	docs: update for bittorrent-dht app-layer	2 years ago
Philippe Antoine	a003640ecf	security: prevents process creation with setrlimit NPROC. So that, if Suricata wants to execve or such to create a new process the OS will forbid it so that RCE exploits are more painful to write. Ticket: #5373	2 years ago
Richard McConnell	7f4c1d5e2f	doc/systemd: add documentation for sd_notify	2 years ago
Eric Leblond	9fb0137d9d	doc: add reference to ipaddr in IP matching	2 years ago
Eric Leblond	3bd48d9336	detect: doc link for ip.src and ip.dst	2 years ago
Eric Leblond	da8b16eaeb	doc: add ip.dst and ip.src doc	2 years ago
Eric Leblond	3599cbf1c4	doc: document new dataset types Feature: #5383	2 years ago
Eric Leblond	a1a22cccd2	doc: document dataset-lookup Ticket: #5184	2 years ago
Eric Leblond	20973e9e6b	doc: add dataset-clear command Ticket: #5184	2 years ago
Eric Leblond	c5559cb68f	doc: document dataset-dump command Ticket: #5184	2 years ago
Victor Julien	2f6c014f70	doc/devguide: update packet (de)alloc in unittests	2 years ago
Lukas Sismis	37cf365e19	docs: remove outdated constraint of negation support for ssl_state Commit `487cdda93d` adds negation support for the SSL state.	2 years ago
Juliana Fajardini	e4b46e0763	doc/acknowledgements: add a few more names Added some names of known contributors to the documentation	2 years ago
Juliana Fajardini	3c25185e0b	devguide: add section about stale tickets policy Just to set the right expectations, and to have it registered for us, too.	2 years ago
Shivani Bhardwaj	2a0cb1f3da	doc: update base64_decode notes	2 years ago
Lukas Sismis	e101384e7b	transversal: remove suricata-ids.org references	2 years ago
Lukas Sismis	a4a69c3e71	doc/dpdk: add IPS setup docs for DPDK mode Ticket: #5511	2 years ago
Eric Leblond	f46f895e8d	rust/smb: import NT status code for Microsoft doc This patch updates the NT status code definition to use the status definition used on Microsoft documentation website. A first python script is building JSON object with code definition. ``` import json from bs4 import BeautifulSoup import requests ntstatus = requests.get('https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55') ntstatus_parsed = BeautifulSoup(ntstatus.text, 'html.parser') ntstatus_parsed = ntstatus_parsed.find('tbody') ntstatus_dict = {} for item in ntstatus_parsed.find_all('tr'): cell = item.find_all('td') if len(cell) == 0: continue code = cell[0].find_all('p') description_ps = cell[1].find_all('p') description_list = [] if len(description_ps): for desc in description_ps: if not desc.string is None: description_list.append(desc.string.replace('\n ', '')) else: description_list = ['Description not available'] if not code[0].string.lower() in ntstatus_dict: ntstatus_dict[code[0].string.lower()] = {"text": code[1].string, "desc": ' '.join(description_list)} print(json.dumps(ntstatus_dict)) ``` The second one is generating the code that is ready to be inserted into the source file: ``` import json ntstatus_file = open('ntstatus.json', 'r') ntstatus = json.loads(ntstatus_file.read()) declaration_format = 'pub const SMB_NT%s:%su32 = %s;\n' resolution_format = ' SMB_NT%s%s=> "%s",\n' declaration = "" resolution = "" text_max = len(max([ntstatus[x]['text'] for x in ntstatus.keys()], key=len)) for code in ntstatus.keys(): text = ntstatus[code]['text'] text_spaces = ' ' * (4 + text_max - len(text)) declaration += declaration_format % (text, text_spaces, code) resolution += resolution_format % (text, text_spaces, text) print(declaration) print('\n') print(''' pub fn smb_ntstatus_string(c: u32) -> String { match c { ''') print(resolution) print(''' _ => { return (c).to_string(); }, }.to_string() } ''') ``` Bug #5412.	2 years ago
jason taylor	db5cf1f8f9	userguide: Add rule file globbing option details Signed-off-by: jason taylor <jtfas90@gmail.com>	2 years ago
Juliana Fajardini	7b0008d4f0	userguide: add section about exception policies This describes briefly what the exception policies are, what is the engine's behavior, what options are available and to which parts are they implemented. Task #5475 Task #5515	2 years ago
Juliana Fajardini	6f294f2f2d	userguide: minor rewording and typo fixes Some of these were recently introduced, some were highlited after the applayer sections got merged. Some paragraphs seem to have been changed due to trying to respect character limits for lines. Also includes a typo pointed out by one of our community members via Discord.	2 years ago
Jeff Lucovsky	33c424f9ed	doc/byte_math: Add byte_math differences with snort Issue: 5077	2 years ago
Jeff Lucovsky	192a31c74e	doc: Fixup byte* entries to display tables properly	2 years ago
Philippe Antoine	390cf9248f	detect: adds flow.age keyword Ticket: #5536	2 years ago
Philippe Antoine	af40873127	pgsql: config limit maximum number of live transactions As is done for other protocols Ticket: #5527	2 years ago
Eric Leblond	1b24f4d357	doc: document landlock feature	3 years ago
Philippe Antoine	fe91506320	doc/http2: suricata.yaml max-streams parameter Ticket: #4949	3 years ago
Juliana Fajardini	bbd968c738	exceptions: add reject support to exception policy This enables the usage of 'reject' as an exception policy. As for both IPS and IDS modes the intended result of sending a reject packet is to reject the related flow, this will effectively mean setting the reject action to the packet that triggered the exception condition, and then dropping the associated flow. Task #5503	3 years ago
Philippe Antoine	5ef259722b	dhcp: adds renewal-time keyword Ticket: #5507	3 years ago
Philippe Antoine	6faf6299e0	dhcp: adds rebinding-time keyword Ticket: #5506	3 years ago
Juliana Fajardini	ef54f36e34	userguide: briefly introduce exception policy opts Added them in the configuration section so folks can be more aware of them, while a more complete documentation isn't around. Related to Task #5475	3 years ago
Juliana Fajardini	3c74e443bd	userguide: update defrag settings options We were still mentioning that there were only three options.	3 years ago
Juliana Fajardini	0cc040cf61	userguide: merge sections about AppLayer Parsers We had two sections under the suricata.yaml configuration section describing settings for application layer parsers. This merges them into one and also fixes a few subsection title levels. Task #5364	3 years ago
Shivani Bhardwaj	a77977ec62	doc: add description for tls.random	3 years ago
jason taylor	c29942c029	userguide: update dsize documentation/examples Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Philippe Antoine	461725a9bf	dhcp: adds leasetime keyword As it is logged Ticket: #5435	3 years ago
Shivani Bhardwaj	2c4d6b33ae	doc/conf: fix sphinx language setting sphinx-build 5.1.1 and above throws a warning which is treated as an error while building. Invalid configuration value found: 'language = None'. Update your configuration to a valid language code. Falling back to 'en' (English).	3 years ago
Benjamin Wilkins	3b1b9a32fb	doc: Document SCByteVarGet lua function Add documentation for accessing results from byte_extract and byte_math in lua match functions Issue: 2871	3 years ago
Philippe Antoine	5c7b5c5fb5	krb: detection for ticket encryption As is done for logging. Ticket: #5442	3 years ago
Jufajardini Reichow	61f9f0df55	userguide/rules/meta: minor formatting adjustments	3 years ago
Jufajardini Reichow	45f14bb97c	userguide/rules: explain sid uniqueness within gid While Suri will throw an error if two signatures have the same `sid` and no `gid`, or same `sid` and same `gid`, it will just accept same `sid` for different `gid`s. Related to Task #5441	3 years ago
jason taylor	87990b138c	doc: update priority wording userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	a7d739a05b	doc: update to 80 char formatting userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	9bd55ff81b	doc: metadata information update userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	563dc66837	doc: update priority information userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	f73a60eb89	doc: update reference section in userguide meta Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	e611ef5ccb	doc: update userguide meta classtype information Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	39bc56ec97	doc: update rev and gid userguide meta wording Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	b9cb66c58f	doc: add clarity around userguide meta information Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	790ef9a53f	doc: add sid reserved range reference Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	38a179d89d	doc: add clarity to rule msg tips Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	299a931e49	doc: update example rule list Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	98c29da6ec	doc: add clarity to role wording Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	c0bdb6cc10	doc: meta keyword doc example rule update Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	ca9e9009ba	doc: add bsize keyword examples Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jufajardini Reichow	f9c9091bb5	userguide: fix typo in inline mode illustration The image describing Suricata's sliding window had two of the "packets" with the same text. Now they actually give the sense of a sliding window. This was found by Zhiyuan-liao.	3 years ago
jason taylor	34e0a384ad	doc: update to include additional rule references Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	4405704372	doc: update intro direction content Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	3eeacf8a3d	doc: fixed HOME_NET/EXTERNAL example formatting Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	f2c7998903	doc: add clarity around HOME_NET/EXTERNAL_NET Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	76cca8b08a	doc: minor example rule description update Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	4f61a35fe7	doc: minor wording restructure Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	845ba154a6	doc: add tcp-pkt/tcp-stream to intro Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	56f49bfe8e	doc: minor punctuation update Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	ab300ab0ae	doc: intro example rule update to simpler example Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	2f240230f0	doc: minor intro wording update Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Philippe Antoine	c7214be99b	snmp: adds usm keyword as is logged Ticker: #5416	3 years ago
Juliana Fajardini	45b7aad2b5	devguide: incorporate contribution process page That page existed only in our redmine. Updated and added a few things, like a paragraph about our expectations for feature contributors. Also updated links, contacts and some other processes that may have changed since last edition. Added some section labels in related documents, for ease of referencing. Task #4929	3 years ago
Andreas Dolp	db73a12540	doc/tls: Add documentation for TLS logging	3 years ago
Andreas Dolp	f42bb45ccd	doc/tls: Remove redundant example	3 years ago
Andreas Dolp	324f5ec10c	doc: Add missing ")" in example	3 years ago
Andreas Dolp	e4163c4e02	doc: Fix typos	3 years ago
Andreas Dolp	49bd6cfa5d	doc: Fix broken link	3 years ago
Eric Leblond	6f06f7c22c	doc: add info about capture_file key	3 years ago
Eric Leblond	0c7e4c13a1	doc: add conditional pcap logging info	3 years ago
jason taylor	d799956348	doc: add note about file.data and file_data Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	83f2056d20	doc: update file_data to file.data keyword Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	cd54d0dbc8	doc: remove extra newline in order to match style Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
jason taylor	38bd775ca0	doc: remove extraneous + characters Signed-off-by: jason taylor <jtfas90@gmail.com>	3 years ago
Jason Ish	6ceeb08351	doc/userguide: updates for eve dns v1 removal Ticket: #4157	3 years ago
Juliana Fajardini	1956dc3d5d	userguide: explain alert queue behavior and stats Added sections along packet-alert-max config section explaining packet alert queue overflow (when Suri reaches packet alert max), when alerts are discarded etc. Since from the user perspective it shouldn't matter how we process the alert queue, the term "replace" is used, even though there's not exactly a replacing action happening, with the queue bein pre-processed before being appended to the Packet. Also described the associated stats and added an explanation on when to change packet-alert-max. Task #5178	3 years ago
Juliana Fajardini	49542d0f1b	doc/userguide: explain packet-alert-max config Task #4207	3 years ago
Jason Ish	7d6bc60abb	doc/userguide: document ftp max-line-length	3 years ago
Victor Julien	976748b777	doc/smb: add resource limits section	3 years ago
William Harding	f0528afc2d	doc/userguide: sphinx syntax correction	3 years ago
Juliana Fajardini	55843aee8e	devguide: update readme Use it to explain how to go about the sequence diagram images (generation, updating, what is mscgen etc). Also remove portion that referred to Sphinx builds, as these don't make sense now.	3 years ago
Juliana Fajardini	e0c8dba7ac	userguide: dynamically determine copyright date This uses the date of doc generation to determine the copyright date for the trailing date. Based on Jeff Lucovsky solution.	3 years ago
Juliana Fajardini	67af1504b3	devguide: drop use of mscgen script in builds/make Currently, it seems easier to upload the diagram images to git than to try to make the image generation script work with out of the tree builds and other corner cases. This means, however, that one must activelly remember to update msc diagram files, run the script and re-add new png files, if those ever need to be updated. To raise awareness to that, a watermark was added to the diagram images. Also removed configuration steps that added mscgen as dependency (locally and for workflow builds and readthedocs).	3 years ago
Juliana Fajardini	5d63613c4b	devguide: add watermark to sequence diagrams Make it more evident that the sequence diagrams in the transactions page are generated with Mscgen	3 years ago
Juliana Fajardini	6f77c722a2	devguide: move into userguide as last chapter Moved devguide dir into userguide dir. Since the devguide is now incorporated as the last chapter of the userguide, removed build and configuration files from the devguide dir, as these are no longer needed. Task #4909	3 years ago
Juliana Fajardini	69c6657127	devguide: clarify cargo test usage for modules The documentation was showing an invalid path for running single tests.	3 years ago
Philippe Antoine	cfcade58ad	http: move xff logging to alert object Ticket: 4860 instead of root field	3 years ago
Andreas Dolp	d4144c04cd	Doc: Fix typo in documentation of suricata.yaml.	3 years ago
Shivani Bhardwaj	015c9fe1e3	doc: add usage of flowbits OR op Ticket 5130	3 years ago
Juliana Fajardini	6c616d84b1	devguide: clarify style guide for getframe funcs As the GetFrameIdByName can be probed, we must warn developers not to leave any output in them, or misleading messages could be printed. Task #5129	3 years ago
Jeff Lucovsky	117e11b0ae	doc: Describe per-thread stack size config setting Issue: 4550 This commit documents the new per-thread stack-size setting. Some systems have a small default value that is not suitable for Suricata's multi-threaded architecture and adjustment may be required.	3 years ago
Victor Julien	e04fcfcf2f	doc/userguide: minor rewording and reformatting for runmodes	3 years ago
Juliana Fajardini	28b5f4a555	devguide: add page about app-layer frame support This explains the frame support from the perspective of a developer, with introductory explanation on how to add frame support to an applayer proto. Doc #4697	3 years ago
Philippe Antoine	8adf172ab8	nfs: limits the number of active transactions per flow Ticket: 4530	3 years ago
Jason Ish	b9a429e6ce	devguide: move image generation into sphinx setup While ReadTheDocs can't execute arbitrary scripts, we can install mscgen in the container that builds the docs (see .readthedocs.yaml). Then instead of calling generate-images.sh from the Makefile, move this into the setup function defined on conf.yaml, which will generate the scripts as part of a normal Sphinx workflow. This should give us an image generation solution that works on ReadTheDocs, and locally within anyones build system provided they have mscgen installed.	3 years ago
Philippe Antoine	11d3af551b	doc: suricata.yaml fields about maximum transactions For HTTP2, MQTT and FTP.	3 years ago
Juliana Fajardini	579d7dcc01	pgsql: add initial support - add nom parsers for decoding most messages from StartupPhase and SimpleQuery subprotocols - add unittests - tests/fuzz: add pgsql to confyaml Feature: #4241	3 years ago
Victor Julien	cf4ddab6f4	doc/quic: update for new quic.version logic	3 years ago
Emmanuel Thompson	6641efb74f	doc/quic: Add documentation for QUIC keywords	3 years ago
Emmanuel Thompson	9ad60e7661	doc/quic: Add quic to eve json format	3 years ago
Andreas Dolp	f714484591	Doc: Fix typos in documentation of suricata.yaml.	3 years ago
Philippe Antoine	0cfdec1266	detect: xor transform Ticket: 3285 The xor transform applies xor decoding to a buffer, with a key specified as an option in hexadecimal. Arbitrary key sizes are accepted.	3 years ago
Jason Ish	cda11b8d97	doc/update: mention change of default rule path	3 years ago
Jason Ish	8071d8239e	doc: update rule section to current default Update the rule section to better describe whats seen in a default install of Suricata including a link to the rule management section.	3 years ago
Jeff Lucovsky	93842aa14a	doc/yaml: Signal-termination option description	3 years ago
Juliana Fajardini	6ae80b2819	doc: replace ohloh with openhub link	3 years ago
Juliana Fajardini	de0ce26e3f	userguide: update references to Suricata website Many places were still referencing the old Suricata page. Used git grep with replace to update them. Checked that new links work. Left old references when they were only documentation examples (for output or unittests). Task#4915	3 years ago
Juliana Fajardini	7b20488d4e	userguide: fix low-hanging typos Config page	3 years ago
Odin Jenseg	2a5d79e426	doc/eve-json-format/dns: Describing Z-bit	3 years ago
Lukas Sismis	dab3274263	dpdk: add documentation for the DPDK runmode Briefly present the DPDK runmode through configuration file.	3 years ago
Lukas Sismis	e4b5239202	doc: fix typo in "Stream engine" documentation	3 years ago
Philippe Antoine	27dd0c6b3d	eve/ftp-data: log alert metadata in ftp-data object Ticket: 4860 instead of directly in root	3 years ago
Juliana Fajardini	7c636d25c7	userguide: (nit) fix typo in lua-output page	3 years ago

... 2 3 4 5 6 ...

956 Commits (657419b53e5e2d79f45efc2e1f87aabdc3b2cbee)