suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	ee6208be9d	config/nss: Remove libnspr/libnss traces Issue: 6712	1 year ago
Philippe Antoine	8f73a0ac55	smtp: config limit maximum number of live transactions Ticket: #6477	1 year ago
Philippe Antoine	4175680a8a	http1: configurable max number of live tx per flow Ticket: #5921 Co-authored-by: Jason Ish <jason.ish@oisf.net>	1 year ago
Philippe Antoine	f6e1a20215	detect: dns.opcode as first-class integer Ticket: 5446 That means it can accept ranges	1 year ago
Juliana Fajardini	244a35d539	userguide: fix explanation about bsize ranges Our code handles Uint ranges as exclusive, but for bsize, our documentation stated that they're inclusive. Cf. from uint.rs: DetectUintMode::DetectUintModeRange => { if val > x.arg1 && val < x.arg2 { return true; } } Task #6708	1 year ago
Philippe Antoine	b8bc2c7e0f	doc: integer keywords Ticket: 6628 Document the generic detection capabilities for integer keywords. and make every integer keyword pointing to this section.	1 year ago
Jason Ish	8bf8131c31	doc: note what version "requires" was added in	1 year ago
jason taylor	3cb7112aa5	detect: update smb.version keyword Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
Eloy Pérez González	a4901a1f70	smb: add smb.keyword documentation	1 year ago
Juliana Fajardini	df6444822e	userguide: clarify midstream exception policy The description of behavior when midstream is enabled and exception policy is set to ignore wasn't descriptive enough. Fix typos.	1 year ago
Lukas Sismis	6e4cc79b39	doc: remove references to prehistoric versions Remove references that are mentioning Suricata 3 or less As a note - only one Suricata 4 reference found: (suricata-yaml.rst:"In 4.1.x") Fast pattern selection criteria can be internally found by inspecting SupportFastPatternForSigMatchList and SigTableSetup functions. Ticket: #6570	1 year ago
Lukas Sismis	2a2898053c	dpdk: add interrupt (power-saving) mode When the packet load is low, Suricata can run in interrupt mode. This more resembles the classic approach of processing packets - CPU cores run low and only fetch packets on interrupt. Ticket: #5839	1 year ago
Lukas Sismis	ca6f7c2d00	dpdk: rework hugepage hints to use per-numa information Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419	1 year ago
Jeff Lucovsky	58f882db94	doc/pcap-log: Remove squil documentation Issue: 6347	1 year ago
Philippe Antoine	adf5e6da7b	detect: strip_pseudo_headers transform Ticket: 6546	1 year ago
Philippe Antoine	4933b817aa	doc: fix byte_test examples As this keyword has 4 mandatory arguments, and some examples had only three... Ticket: 6629	1 year ago
Juliana Fajardini	a37fa62710	devguide: explain example-rule container usage Have these options documented, so that whoever writes rule-related documentation can easily know what they could use to make the doc look better.	1 year ago
Juliana Fajardini	fc2acf8cb0	devguide: fix main channels list Sphinx and RtD sometimes render lists in weird ways. The communication channels list barely looked like one, at all...	1 year ago
Juliana Fajardini	d15877b2c0	devguide: update branches, refer to backports guide Update the list of active branches to include 7 renaming and new master, link to backports document.	1 year ago
Juliana Fajardini	9fbdfd219c	devguide: add chapter with backports guide Task #6568	1 year ago
Juliana Fajardini	de8bffd244	devguide: doc from behavior changes needs ticket # If a commit introduces code that changes Suricata behavior, the related documentation changes should go in a separate commit, but refer to the same ticket number. This reduces the chances of said changes being lost if there are backports while still keeping the backporting process a bit less bulky, for each commit. Related to Task #6568	1 year ago
Juliana Fajardini	71e4ca81ef	devguide: reorganize pr-workflow section This section seemed to aim both at PR reviewers and PR authors at the same time, even though some info is probably of low value for contributors. Created new section for PR reviewers and maintainers, and kept the info for PR authors separated. Also highlighted information on requested changes and stale PRs.	1 year ago
Juliana Fajardini	08eb67f74c	devguide: make 'contributing' a chapter This could be justified from a semantic point of view, and also can help in bringing more attention to where this information is, as it is less hidden, now. Also add Dev Guide as one of our resources in our Readme.	1 year ago
Jason Ish	5d5b0509a5	requires: add requires keyword Add a new rule keyword "requires" that allows a rule to require specific Suricata versions and/or Suricata features to be enabled. Example: requires: feature geoip, version >= 7.0.0, version < 8; requires: version >= 7.0.3 < 8 requires: version >= 7.0.3 < 8 \| >= 8.0.3 Feature: #5972 Co-authored-by: Philippe Antoine <pantoine@oisf.net>	1 year ago
Juliana Fajardini	bba3d4fc63	userguide/eve: explain pgsql requests & responses Add a more visible explanation of that requests, responses, frontend and and backend are, in Pgsql context, to avoid having to repeat that over different portions of the docs.	1 year ago
Juliana Fajardini	30ac77ce65	pgsql: add cancel request message A CanceldRequest can occur after any query request, and is sent over a new connection, leading to a new flow. It won't take any reply, but, if processed by the backend, will lead to an ErrorResponse. Task #6577	1 year ago
Juliana Fajardini	7dcc2e7a71	doc/eve-format: break pgsql section to char limit	1 year ago
Jason Ish	c1a8dbcb72	doc/userguide: document dns.query.name, dns.answer.name With some other minor cleanups in the DNS keyword section.	1 year ago
Jason Ish	b11bb1c412	detect: rename DetectAppLayerInspectEngineRegister2 Rename DetectAppLayerInspectEngineRegister2 to DetectAppLayerInspectEngineRegister as there is no other variant of this function, and the versioning with lack of supporting documentation can lead to confusion.	1 year ago
Jason Ish	50be098839	detect: rename DetectAppLayerMpmRegister2 to DetectAppLayerMpmRegister The old DetectAppLayerMpmRegister has not been around since 4.1.x. Rename the v2 of this function to a versionless function as there is no documentation referring to what the 2 means.	1 year ago
Victor Julien	3456dea276	doc/userguide: update guidance on 5 to 6 upgrading TCP memory use can be higher than expected in certain configs. Ticket: #6552.	1 year ago
Shivani Bhardwaj	b9540df5ad	doc: clarify IP-only with iprep	1 year ago
jason taylor	fc81c99b58	doc: add file.name information to smtp keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
jason taylor	9d1ad0187e	doc: add file.name information to nfs keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
jason taylor	327ba7397a	doc: add file.name information to smb keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
jason taylor	e4077b8803	doc: update ftp keyword doc example rule format Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
jason taylor	bb1f7575d3	doc: add file.name information to ftp keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
jason taylor	bbc17b1c7d	doc: add file.name information to http keyword doc Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
Shivani Bhardwaj	2b73a17bb0	detect: rename whitelist to score The term "whitelist" is actually used to store a list of DetectPort type items for tcp and udp in detect.h. Using the same term for also keeping the score that affects the grouping of rules is confusing. So, rename the variable to "score".	1 year ago
Jason Ish	cc0adaaf4a	userguide: remove old css files In our conf.py we reference some ReadTheDocs stylesheets that appear to be old and break formatting of some items like bulletted lists. Bug: #6589	1 year ago
Philippe Antoine	32cce122e1	detect: header_lowercase transform Ticket: 6290	1 year ago
jason taylor	c50002978d	doc: update file.data keyword documentation Signed-off-by: jason taylor <jtfas90@gmail.com>	1 year ago
Juliana Fajardini	a649a92afd	userguide: update tls not_after/not_before mentions Our tls fields not_after and not_before are actually logged as `notafter` and `notbefore`, but were documented with the underscore. Update the documentation, since updating the log format itself would be a breaking change. Task #5494	1 year ago
Juliana Fajardini	58fb559594	userguide: document flow_id, with examples Flow_id explanation expanded from version shared by Peter Manev. Task #6445	1 year ago
Sascha Steinbiss	0c55fe3515	detect: add mqtt.connect.protocolstring Ticket: OISF#6396	1 year ago
Victor Julien	6b2c33990f	doc/userguide: add tag keyword page Ticket: #3015.	1 year ago
Victor Julien	4a02a14df1	doc/userguide: document host table yaml settings	1 year ago
Jeff Lucovsky	9ee55d2394	doc/transform: Document case-changing transforms. Issue: 6439	1 year ago
Ralph Eastwood	9865164e75	napatech: update docs to remove hba reference	1 year ago
Philippe Antoine	ab9b6e30b1	detect: adds flow integer keywords Ticket: #6164 flow.pkts_toclient flow.pkts_toserver flow.bytes_toclient flow.bytes_toserver	1 year ago

1 2 3 4 5 ...

794 Commits (d5a3bfcab6c9b3d9174bc96a281c21237aaf774c)