jason taylor
c0bdb6cc10
doc: meta keyword doc example rule update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
ca9e9009ba
doc: add bsize keyword examples
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Victor Julien
ad3e68f378
detect/file: minor cleanups
3 years ago
Victor Julien
af145ad125
detect/file: reduce scope of keyword data structures
3 years ago
Victor Julien
73eb7744d8
detect/file: update copyright years
3 years ago
Victor Julien
6f8ca41eb3
detect/cip: cleanup includes
3 years ago
Philippe Antoine
11e0eb9c89
quic: do not log empty cyu array
...
Ticket: #5167
3 years ago
Philippe Antoine
16fc78645d
dnp3: do not log empty objects array
...
Ticket: #5167
3 years ago
Philippe Antoine
632581ac95
ike: do not log empty notify array
...
Ticket: #5167
3 years ago
Philippe Antoine
262a93ce18
mqtt: do not log reason_codes if there is none
...
Ticket: #5167
3 years ago
Philippe Antoine
da0be16d36
output: do not log empty arrays for sid
...
Ticket: #5167
3 years ago
Jufajardini Reichow
f9c9091bb5
userguide: fix typo in inline mode illustration
...
The image describing Suricata's sliding window had two of the "packets"
with the same text. Now they actually give the sense of a sliding
window.
This was found by Zhiyuan-liao.
3 years ago
dependabot[bot]
8090cba7c4
github-actions: bump actions/cache from 3.0.4 to 3.0.5
...
Bumps [actions/cache](https://github.com/actions/cache ) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](c3f1317a9e...0865c47f36 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
Philippe Antoine
adeb1fdfc3
threads: cleaner code with one instruction per line
...
As reported by Shchelk
3 years ago
Victor Julien
9fa0033966
detect: reduce datatype scope for various keywords
3 years ago
Victor Julien
ad76502df0
detect/cip: remove dead code
3 years ago
Victor Julien
08e349a8bb
detect: update copyright years
3 years ago
Victor Julien
0ec9379db9
includes: minor cleanups
3 years ago
Victor Julien
21f76773c7
profiling: minor code cleanups
3 years ago
Philippe Antoine
e69e99f820
ci: checks include are necessary in github
3 years ago
Philippe Antoine
36b1344680
util: fix integer warnings in profiling
3 years ago
Philippe Antoine
4411ef785d
src: remove unused header files
3 years ago
Philippe Antoine
02f2602dde
src: rework includes as per cppclean
3 years ago
Jufajardini Reichow
93c2c9743d
detect/engine: init alert queue counters on reload
...
alert_queue_overflow and alerts_suppressed were not being
reinitialized when there was a reload of Suricata rules, leading to
non-valid stats counters if that happened.
Bug #5457
3 years ago
Philippe Antoine
f8bf581775
output: skip files logging for ICMP packets
...
Ticket: #5408
3 years ago
Philippe Antoine
5781631f85
output: use flow's proto for file loggers
...
As there can be an ICMP packet which gets related to a TCP flow.
Ticket: #5408
3 years ago
Philippe Antoine
7f9d25fa86
fuzz: use forced file store
...
to find bugs such as 5408
3 years ago
Philippe Antoine
a2f857ed90
threshold: fix regex to accept by_both and by_rule
...
As is done in detect-threshold.c or in DETECT_RATE_REGEX
and is expected by switch (rule_type) which makes the same
for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE
Ticket: #5327
3 years ago
Philippe Antoine
1621f5e453
detect/nfs: use inclusive ranges
3 years ago
Philippe Antoine
8dbb07e4fe
detect: use generic integer functions for itype
...
Ticket: #4112
3 years ago
Philippe Antoine
2817f1a6ed
detect: use generic integer functions for snmp.version
...
Ticket: #4112
3 years ago
Philippe Antoine
c72571ea28
detect: use generic integer functions for rfb.sectype
...
Ticket: #4112
3 years ago
Philippe Antoine
6c9091c86f
detect: use generic integer functions for nfs.version
...
Ticket: #4112
3 years ago
Philippe Antoine
ddac6165c9
detect: use generic integer functions for nfs.procedure
...
Ticket: #4112
3 years ago
Philippe Antoine
ed6955ee98
detect: use generic integer functions for iprep
...
Ticket: #4112
3 years ago
Philippe Antoine
bdc359bed3
detect: use generic integer functions for bsize
...
Ticket: #4112
3 years ago
Philippe Antoine
cfb60d0fce
detect: use generic integer functions for urilen
...
Ticket: #4112
3 years ago
Philippe Antoine
e87c53bb55
defrag: use util function for timeout
...
To fix timestamp overflow as found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44608
fixu
3 years ago
jason taylor
d600a1603c
detect: update text for nocase used with http.host
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
34e0a384ad
doc: update to include additional rule references
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
4405704372
doc: update intro direction content
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
3eeacf8a3d
doc: fixed HOME_NET/EXTERNAL example formatting
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
f2c7998903
doc: add clarity around HOME_NET/EXTERNAL_NET
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
76cca8b08a
doc: minor example rule description update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
4f61a35fe7
doc: minor wording restructure
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
845ba154a6
doc: add tcp-pkt/tcp-stream to intro
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
56f49bfe8e
doc: minor punctuation update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
ab300ab0ae
doc: intro example rule update to simpler example
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
jason taylor
2f240230f0
doc: minor intro wording update
...
Signed-off-by: jason taylor <jtfas90@gmail.com>
3 years ago
Philippe Antoine
c57052181c
snmp: rustfmt detect.rs
3 years ago