This commit adds brief discussion for additional cluster types for use
with the pf-ring packet source.
Newly added:
- cluster_inner_flow
- cluster_inner_flow_2_tuple
- cluster_inner_flow_4_tuple
- cluster_inner_flow_5_tuple
Issue: 5975
(cherry picked from commit b1918168f9)
As flow.memcap-policy and defrag.memcap-policy do not support flow
actions, clarify that in the documentation. Also fix some typos, and
add missing values in some places where the exception policies were
explained.
Related to
Bug #5940
(cherry picked from commit 31066c7c3b)
This package likely needs to be installed when starting with an Ubuntu
container or other minimal Ubuntu install.
Ticket: #5616
(cherry picked from commit 0a4e3d0f82)
This describes briefly what the exception policies are, what is the
engine's behavior, what options are available and to which parts are
they implemented.
Task #5475
Task #5515
Some of these were recently introduced, some were highlited after the
applayer sections got merged. Some paragraphs seem to have been changed
due to trying to respect character limits for lines. Also includes a
typo pointed out by one of our community members via Discord.
This enables the usage of 'reject' as an exception policy. As for both
IPS and IDS modes the intended result of sending a reject packet is to
reject the related flow, this will effectively mean setting the reject
action to the packet that triggered the exception condition, and then
dropping the associated flow.
Task #5503
(cherry picked from commit bbd968c738)
Added them in the configuration section so folks can be more aware of
them, while a more complete documentation isn't around.
Related to
Task #5475
(cherry picked from commit ef54f36e34)
We had two sections under the suricata.yaml configuration section
describing settings for application layer parsers. This merges them into
one and also fixes a few subsection title levels.
Task #5364
(cherry picked from commit 0cc040cf61)
sphinx-build 5.1.1 and above throws a warning which is treated as an
error while building.
Invalid configuration value found: 'language = None'. Update your configuration to a valid language code. Falling back to 'en' (English).
(cherry picked from commit 2c4d6b33ae)
This uses the date of doc generation to determine the copyright date
for the trailing date. Based on Jeff Lucovsky solution.
(cherry picked from commit e0c8dba7ac)
Added sections along packet-alert-max config section explaining
packet alert queue overflow (when Suri reaches packet alert max), when
alerts are discarded etc.
Since from the user perspective it shouldn't matter how we process the
alert queue, the term "replace" is used, even though there's not exactly
a replacing action happening, with the queue bein pre-processed before
being appended to the Packet.
Also described the associated stats and added an explanation on when to
change packet-alert-max.
Task #5178
(cherry picked from commit 1956dc3d5d)
Issue: 4550
This commit documents the new per-thread stack-size setting. Some
systems have a small default value that is not suitable for Suricata's
multi-threaded architecture and adjustment may be required.
(cherry picked from commit 117e11b0ae)
This commit updates the documentation of the SCFlow* function names
available to Lua scripts.
Formerly, they used the prefix "Sc"; now they use "SC".
(cherry picked from commit 25e9483168)