forked from snort3/snort3
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathChangeLog
More file actions
3457 lines (3149 loc) · 163 KB
/
ChangeLog
File metadata and controls
3457 lines (3149 loc) · 163 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2020/10/07 - 3.0.3 build 2
-- appid: Create events for client user name, id and login success
-- appid: Inform third-party about snort's idle state during reload
-- appid: Reload detector patterns on reload_config for the sake of hyperscan
-- appid: Update appid to use instance based reload tuner
-- binder: Allow binding based on address spaces
-- binder: Allow directional binding based on interfaces
-- binder: Enforce directionality, add intfs, rename groups, cleanup
-- framework: Update packet constraints comparison to check only set fields
-- host_tracker: Update host tracker to use instance based reload tuner
-- http2_inspect: Fix frame padding handling
-- http2_inspect: Free up HI flow data when we are finished with it
-- http2_inspect: Stream state tracking
-- http_inspect: Implement can_start_tls(), add support of ssl search abandoned event
-- http_inspect: Support for custom xff type headers
-- main: Change reload memcap framework to use object instances
-- main: Remove deprecated rule_state module
-- main: Update host attribute class to use instance based reload tuner
-- normalizer: Move TTL configuration toggle to inspector configure()
-- perf_monitor: Update perf monitor to use instance based reload tuner
-- policy: Copy uuid, user_policy_id, and policy_mode when an inspection policy is cloned
-- pop: Generate alert for unknown command if file policy is attached.
-- port_scan: Update port scan to use instance based reload tuner
-- rna: Add event_time to rna logger events
-- rna: Add payload discovery logic
-- rna: Check user-agent processor early to skip some work
-- rna: Port host type discovery logic
-- rna: Set the thread local fingerprint processors during reload_config
-- rna: Update rna to use instance based reload tuner
-- rna: Update methods for user-agent processor
-- rna: User discovery for successful login
-- snort2lua: Convert rule_state into ips.states
-- stream_tcp: Update trace messages to use trace framework
-- stream: Update stream to use instance based reload tuner
-- trace: Update parser unit tests
-- wizard: Clean up parameter parsing and make it a bit stricter
2020/09/23 - 3.0.3 build 1
-- ac_bnfa: Disable broken fail state reduction
-- appid: Check third party context version while deleting connections
-- appid: Use third party payload if available for HTTP tunneled
-- cmake: Support cmake build type configuration
-- dce_rpc: Handle compound requests for upload
-- dce_rpc: Modify logs to show if file context is found or not found
-- dump_config: Sort config options before printing
-- file_api: Update lookup and block timeout from config at file cache creation
-- flowbits: Evaluate checkers after setters for fast pattern matches
-- ftp: Add APPE to upload commands
-- http2_inspect: Convert to new stream states
-- http2_inspect: Fix how implement_reassemble uses frame_type
-- http2_inspect: Refactor HI interactions out of frame constructors
-- http_inspect: Extract filename from content-disposition header for HTTP uploads
-- module_manager: Keep a list of modules supporting reload_module
-- netflow: Cache support and more v5 decoding
-- payload_injector: Don't inject if stream id is even
-- profiler: Fix issue where flushed pattern matches caused rule_eval to be profiled under mpse
-- reputation: Change terms used in code, logs, and peg counts
-- rna: Add unit test to validate VLAN handling
-- rna: Avoid conflicts with other fingerprint definitions
-- rna: Service discovery with multiple vendor and version support
-- rna: Support user agent fingerprints
-- s7commplus: V3 header support
-- search_engine: Fix peg type for max_queued
-- stream_tcp: Add an assert to catch tcp state/event combination that should not occur
-- stream_tcp: Add PegCount for tcp packets received with an invalid ack
-- stream_tcp: Arrange TCP tracker member vars to optimize storage requirements, add helper
functions to access private splitter functions
-- stream_tcp: Delete redundant calls to flush data when FIN is received
-- stream_tcp: Delete unused packet action flags, set action flags via its setter
-- stream_tcp: Fix issues with stream_tcp handling of the TCP MSS option
-- stream_tcp: Handle bad tcp packets consistently when normalizing in ips mode
-- stream_tcp: Implement helper function to return true if the TCP packet is a data segment, false
otherwise
-- stream_tcp: Merge the setup methods of the TcpStreamSession and TcpSession classes into a single
method in TcpSession
-- stream_tcp: Refactor tcp handling of no flags to drop packet before any processing, don't
generate event
-- stream_tcp: Refactor tracker and reassembler classes to improve encapsulation and move member
variables to appropriate class
-- stream_tcp: Remove FIXIT-H because by definition an Ack Sent event in TcpStateNone means the
SYN-ACK was not seen, so no way to do the check suggested
-- stream_tcp: Remove FIXIT-H to add ack validation, the ack is already validated when processed on
the listener side
-- target_based: Support reload of host attribute table via signal as well as control channel
command
2020/09/13 - 3.0.2 build 6
-- active: Remove per packet prevent trust action
-- appid: Add check for nullptr before setting tls host
-- appid: Clear services set in host attribute table upon detector reload
-- appid: Detect SMTP after decryption
-- appid: Dump user appid configuration on reload detectors
-- appid: Generate events for service info changes
-- appid: Pass snort protocol id instead of appid while creating future flow
-- appid: Reorder third-party reload to keep only one handle open at a time
-- appid: Send swap response for reload_odp and reload_third_party commands in control thread
-- appid: Set payload to unknown for out-of-order flows
-- appid: Skip detection for existing sessions after detector reload; rename reload_odp command to
reload_detectors
-- appid: Support json logging in appid_listener
-- appid: Update appid stats for decrypted flows
-- appid: Update appid warning messages to print module name in lowercase
-- build: Fix minor cppcheck warnings
-- build: Updates for libdaq changes to interface group field width and naming
-- byte_jump: Fix jump relative to extracted length w/o relative offset
-- cmake: Restore accidentally removed caching of static DAQ modules
-- dce_rpc: Introduce smb2 logs
-- doc: Update the config dump in JSON format (all policies)
-- doc: Update the config dump in JSON format (main policy)
-- doc: Update trace.txt with info about 'trace.modules.all' option
-- dump_config: Add --dump-config="top" to dump the main policy config only
-- dump_config: Dump config in JSON format to stdout
-- file_api: Increase default max_files_per_flow limit to 128
-- flow: Add a deferred trust class to allow plugins to defer trusting sessions
-- flow: Disabled inspection for FlowState::RESET
-- flow: Reset the flow before removing
-- helpers: Add unit tests for special characters escaping
-- helpers: Fix build on systems without sigaction
-- helpers: Rework DiscoveryFilter to monitor IP lists based on interface rather than group
-- helpers: Use sig_t instead of sighandler_t for better BSD compatibility
-- host_tracker: Fix allocator unit test to work on 32-bit systems again
-- http2_inspect: Convert circular_array to std:vector
-- http2_inspect: Fix continuation frame check
-- http2_inspect: Fix hpack dynamic table init
-- http2_inspect: Prepare http2_inspect and http_inspect for HTTP/2 trailers
-- http2_inspect: Refactor hpack decoding and send trailer to http_inspect for processing
-- http_inspect: Declare get_type_expected const
-- http_inspect: Don't use the URL to cache file verdicts for uploads
-- http_inspect: Script detection
-- http_inspect: Script detection and concurrency fixes
-- http_inspect: Support hyperscan literal search for accelerated blocking
-- http_method: Make available for fast pattern with first body section
-- imap: Publish OPPORTUNISTIC_TLS_EVENT on successfull completion on START_TLS, add a new state to
avoid publishing start_tls events multiple times
-- ips_options: Ensure all options use base class hash and compare methods
-- ips: Use the policies in the flow when creating pseudo packet
-- main: Turn off signal handlers later to catch more during snort shutdown
-- managers: Immediately stop executing inspectors when inspection is disabled
-- mime: Fix off-by-1 error with filename and email id capture
-- mime: Minor code cleanup
-- netflow: Introduce netflow as a service inspector
-- packet_io: Added reason for ActiveStatus WOULD
-- packet_io: Do not allow trust unless the action is allow or trust
-- payload_injector: Assume http1, if packet does not have a gadget
-- payload_injector: Fix warning
-- payload_injector: Support http2 injection
-- payload_injector: Support translation of header field value with length > 127
-- perf_monitor: Convert the perf_monitor inspector configure warnings to errors
-- pop: Publish start_tls events, support for ssl search abandoned
-- reputation: Change from group-based to interface-based IP lists
-- rna: Add protocols on logging host trackers
-- rna: Implement update_timeout for MAC hosts
-- rna: Remove dependency on uuid library
-- rna: Remove redefinition of USHRT_MAX
-- rna: Removing unused command and exporting swapper
-- rna: Support client discovery from appid event changes
-- rna: Support service discovery from appid event changes
-- rna: Tcp fingerprints configuration, storage, matching and event generation
-- snort2lua: Remove obsolete and unused code
-- snort2lua: Remove unused unit test files
-- snort: Address fatal shutdown stability issues
-- stream_ip: Fix zero fragment built-in rule triggering for some reassembly policies
-- style: Replace some tabs that snuck in with proper spaces
-- tests: Fix the majority of memory leaks in CppUTest unit tests
-- trace: Add support for modules.all option
-- trace: Update loggers to support extended output with n-tuple packet info
-- utils: Add sys/time.h to util.h for struct timeval definition
-- wizard: Fix the error message about invalid pattern
2020/08/12 - 3.0.2 build 5
-- cip: Fix the trailing parameter for the module
-- dce_rpc: Set dce_rpc as a control channel inspector
-- flow: Check expected flows in flow control and add direction swap flag to expected flows
-- framework: Add an API to check if the module can be bound in the binder
-- ftp: Add opportunistic TLS support
-- ftp: Fix direction for active FTP data transfers
-- helpers: Extend printed JSON syntax
-- http2_inpsect: Fix for flush on data frame boundray w/o end of stream
-- http_inspect: Do finish() after partial inspection
-- lua: Add TCP port 80 binding to the connectivity and balanced tweaks
-- main: Add printing modules help in JSON format
-- managers: Print the instance type of the inspector module with --help-module
-- rna: Add RNA MAC-based discovery logic
-- rna: Discover network and transport protocols
-- stream_tcp: Add check to prevent reentry to TCP session cleanup when flushing a PDU
2020/08/06 - 3.0.2 build 4
-- appid: Clear service appid entries in dynamic host cache on ODP reload
-- appid: Generate event notification when dns host is set
-- dce_rpc: Fix for smb crash while tcp session pruning
-- dce_rpc: Fix for smb session cleanup issue
-- dce_rpc: Use file name hash as file id
-- doc: Add documentation for dumping consolidated config in text format
-- flow: Fixing free_flow_data logic
-- http_inspect: Code clean up
-- http_inspect: Test tool enhancement
-- main: Dump consolidated config in the text format
-- rna: Fix redefined macro warnings in between unit-test tools
-- rna: TCP fingerprint input and retrieval
-- utils: Keep deprecated attribute table pegcounts
2020/07/28 - 3.0.2 build 3
-- active: Move Active enabled flag into SnortConfig
-- appid: For http traffic, if payload cannot be detected, set it to unknown
-- appid: Move appid data needed by external components to stash
-- appid: Support ODP reload for multiple packet threads and new session
-- dce_rpc: Improve PAF autodetection for heavily segmented TCP traffic
-- doc: Split Snort manual into separate user, reference, and upgrade docs.
-- doc: Update default text manuals
-- doc: Update extending.txt about TraceLogger plugin
-- file_api: Log event generated when lookup timedout
-- ftp_telnet: Remove global config variable shared between multiple threads to prevent data race
-- http2_inpsect: Fix interaction with tool tcpclose
-- http2_inspect: Fix stream_in_hi
-- http2_inspect: General code cleanup
-- http_inspect: Do partial inspections incrementally
-- http_inspect: Reduce memory used by partial inspections
-- main: Rename the config options to ignore flowbits and rules warnings
-- parser: Add support for variables with each ips policy
-- payload_injector: Add HTTP page translation
-- payload_injector: Extend utility to support HTTP/2 (no injection)
-- pub_sub: Added a method in HttpEvent to retrieve true client-ip address from HTTP header based
on priority
-- rna: Fingerprint reader class and lookup table for tcp fingerprints
-- snort_defaults: Remove the NOTIFY, SUBSCRIBE, and UPDATE HTTP methods
-- stream_tcp: Only perform paws validation on real packets, skip this on meta-ack packets
-- stream_tcp: When clearing a session during meta-ack processing pass a nullptr as the Packet*
parameter
-- target_based: Add mutex lock to ensure host service accesses are thread safe
-- target_based: Move host attribute peg counts from the process pegs to stats specific to host
attribute operations
-- target_based: Refactor host attribute to use the LruCacheShared data store class to support
thread safe access
-- target_based: Streamline host attribute table activate and swap logic on startup and reload
-- trace: Add support for extending TraceLogger as a passive inspector plugin
-- wizard: Abandon the wizard on UDP flows after the first packet
-- wizard: Abort the splitter once we've hit the max PDU size
-- wizard: Add peg counts for abandoned searches per protocol
-- wizard: Improve wizard tracing to indicate direction and abandonment
-- wizard: Properly terminate hex matching
-- wizard: Report spell and hex configuration errors and warnings
2020/07/15 - 3.0.2 build 2
-- appid: Moving thread local ODP stuff to a new class
-- binder: delete obsolete network_policy parsing code
-- build: Fix static analyzer complaints about unused stored values
-- daq: Fix calculation of outstanding packets stat to properly use the delta
-- dce_rpc: adding support for multiple smbv2 sessions for same tcp connection
-- dce_rpc: Invalid endpoint mapper message
-- dce_rpc: SMB ID invalid memory access
-- http_inspect: send MIME full message body for file processing
-- main: add config options --ignore-warn-rules and --ignore-warn-flowbits to snort module
-- mime: mime no longer overwrites file_data buffer for http packets
-- smtp: generate SSL_SEARCH_ABANDONED event when no STARTTLS is detected
-- smtp: support opportunistic SSL/TLS switch over
-- stream_tcp: coding style improvements
-- stream_tcp: eliminate direct references to the Packet* wherevever possible within the TCP state
machine context
-- stream_tcp: eliminate use of STREAM_INSERT_OK as return code, it conveyed no useful information
and was ultimately unused
-- stream_tcp: implement meta-ack pseudo packet as thread local that is reused on each meta-ack TSD
-- stream_tcp: implement support for processing meta-ack information when present
-- stream_tcp: meta-ack from daq is in network order not host, remove conversion from host to
network
-- stream_tcp: process meta-ack info in any flush policy mode
-- trace: add support for DAQ trace filtering
2020/07/06 - 3.0.2 build 1
-- appid: Appid coverity issues
-- appid: Create lua states and lua detectors in control thread
-- appid: Delete stale third-party connections when reloading third-party on midstream
-- appid: Fix the format of the IPv6 strings in the Service State unit tests
-- appid: include appid session api in appid event
-- appid: use configured search method for multi-pattern matching
-- build: Eradicate u_int usage
-- build: Fix unit tests to build and work properly on a 32-bit system
-- build: Fix various cppcheck warnings about constness
-- build: Increment version to 3.0.2
-- build: Miscellaneous 32-bit build fixes
-- build: Use sanity check results (HAVE_*) for optional packages in CMake
-- cmake: Properly handle SIGNAL_SNORT_* options in configure_cmake.sh
-- codecs: add tunnel bypass logic based on DAQ payload_offset
-- dce_tcp: parse only endpoint mapper messages
-- detection: remove checksum drop fixit
-- detection: remove unused code
-- framework: fix global data bus cloning during reload module and policy
-- helpers: Add a signal-safe formatted printing utility class
-- helpers: Add support for dumping a backtrace via libunwind on fatal signals
-- helpers: Dump additional information to stderr when a fatal signal is received
-- helpers: Revamp signal handler installation and removal
-- http2_inspect: Make print_flow_issues() regtest-only
-- inspectors: add a virtual disable method for controls
-- ips: add http fast pattern buffers
-- ips: add ips service vs buffer checks; add missing services
-- ips: enable non-service rules when service is detected
-- ips: minimize port group construction for any-any and bidirectional rules
-- ips: refactor fast pattern selection.
-- ips: update detection trees for earliest header checks
-- main: configure and set main thread affinity
-- main: set thread type for main thread
-- managers: format lua whitelist output and ignore internal whitelist keywords
-- max_detect: detained inspection disabled pending further work
-- mpse: remove unused pattern trimming support
-- oops_handler: Operate on DAQ message instead of Snort Packets
-- payload_injector: add payload injection utility
-- regex: convert to same syntax as pcre plus fast_pattern option
-- rna: Adding initial support for reload_fingerprint command
-- rna: remove custom_fingerprint_dir from configuration
-- snort_defaults.lua: remove unused AIM_SERVERS var
-- snort: fix --dump-rule-meta with ips.states
-- stream_ip: Avoid modifying the original fragmented packet during rebuild
-- stream_ip: use lowercase fragmentation policy names for verbose output
-- stream: lock xtradata stream_impl to avoid data race on logging
-- trace: add thread type and thread instance id to each log message for stdout logger
-- tweaks: enable file signature for sec and max until depth issue resolved
-- tweaks: updates for efficacy and performance
-- wizard: Add FTP pattern to recognize FileZilla FTP Server
2020/06/18 - 3.0.1 build 5
-- actions: on a reload_config() free the memory allocated for react page on previous configuration
loading
-- actions: refactor to store react page response in std::string
-- active: add a facility to prevent a DAQ whitelist verdict
-- appid: add api to check if appid needs inspection
-- appid: add braces to fix static analysis complaint
-- appid: add response message to reload_third_party
-- appid: check fqn before registering rrt
-- appid: for http2, if metadata doesn't give a match on payload, set payload id to unknown
-- appid: free memory allocated when appid is configured initially and then not configured on a
subsequent reload
-- appid: lua APIs to get IP and port tunneled through a proxy
-- appid: match http2 response to request
-- appid: remove unnecessary stuff from appid apis
-- appid: revert snort protocol id changes and fixed warnings
-- appid: set appid_tlshost_bit when we set tls_cname
-- appid: set snort protocol id on the flow and remove ssl squelch code
-- appid: update cert viz API to handle subject alt name and SNI mismatch
-- codecs: fix issues found by static analysis
-- dce_rpc: suppport for DCE/RPC future session
-- detection: do not apply global rule state to the empty policy
-- doc: update user manual for trace feature
-- file_api: making sure that file malware inspection is turned off and only file-type detection is
enabled when file_id config is defined without any parameter
-- flow: make client_initiated flag depend on the DAQ reverse flow flag
-- hash: replace the cache entry if found
-- host_cache: add new peg to module test
-- host_cache: allowing module to accept 64 bit memcap value
-- http2_inspect: fix hpack infractions
-- http2_inspect: partial inspect with less than 8 bytes of frame header in the same packet
-- http2_inspect: track memory usage for http_inspect flows in http2_inspect
-- log: fix issues found by static analysis
-- managers: add inspector execution and timing traces to InspectorManager
-- packet: add client and server direction methods that use the client initiator flow flag
-- parser: free memory allocated for RTN when SO rule load fails
-- parser: print loaded and shared rules for each ips policy
-- perf_monitor: fix count and interval during disable cli execution
-- port_scan: cleanup port scan memory allocations in module tterm
-- rpc_decode: remove unused config object
-- search_engines: fix potential memory leaks and an error in a printed value
-- service_inspectors: remove some redundant initializations and lookups, move some field
initializations into the constructor
-- shell: if initial load of snort configuration fails release memory allocated for modules and
plugins
-- snort2lua: deprecate react::msg option, display of rule message in react page not currently
supported
-- snort2lua: fix issues found by static analysis
-- snort_config: only perform FatalError cleanup from main thread
-- stream: add final check to free allocated memory when module tterm is called
-- stream: fixed ip family in the flow->key during StreamHAClient::consume
-- stream_tcp: fix issues for tcp simultaneous close
-- stream_tcp: unconditionally release held packets that have timed out, regardless of flushing
-- trace: add control channel command
-- trace: add support for passing in the packet pointer to loggers
-- trace: filter traces by packet constraints
-- trace: fix for trace messages in the test-mode ('-T' option)
-- trace: remove redundant include
2020/05/20 - 3.0.1 build 4
-- appid: Do not allocate DNS session for non-DNS flows and update memory tracker for HTTP sessions
-- appid: Get inspector for the current snort config during reload
-- binder: print configured bindings in show() method
-- build: fix cppcheck warnings and typos
-- coverity: fixed issues discovered by Coverity tool
-- daq: Configure DAQ instances with total instances and instance IDs
-- dce_rpc: code style cleanups
-- dce_rpc: generate alert when dce splitter aborts due to invalid fragment length
-- flow: If a retry packet does not belong to a flow, block it.
-- ftp_telnet: fix FTP race condition
-- http2_inspect: change partial flush handling
-- log: do not truncate config option names in ConfigLogger
-- loggers: when logging alert only use inspector buffers and name when the inspector's paf
splitter is assigned for the direction of the alert"
-- main: Fixing some issues reported by Coverity
-- managers: print alphabetically sorted verbose inspector config output within an inspection
policy
-- mpse: constify snort config args
-- network_inspectors: Fixing a few minor issues reported by Coverity
-- parser: print enabled rules for each ips policy
-- search_tool: refactor initialization
-- snort_config: constify Inspector::show and remove unnecessary logger args
-- snort_config: make const for packet threads
-- snort_config: minimize thread local access to snort_config
-- snort_config: pseudo packet initialization
-- snort_config: refactor access methods
-- snort_config: use provided conf
-- stream: add a configurable timeout for held packets
-- stream: move held packet timeout to Stream and support changing it on reload
-- stream_tcp: call splitter->finish() before reassemble() when flushing when PAF aborts due to gap
in queued data
-- stream_tcp: change the DAQ verdict from drop to blacklist for held packets that timed out
-- stream_tcp: clear gadget from Flow object once fallback has happened in both directions
-- stream_tcp: only clear gadget after both splitters have aborted
-- stream_tcp: when paf aborts due to gap in data set splitter state to ABORT
-- trace: move module trace configuration into the trace module.
2020/05/06 - 3.0.1 build 3
-- appid: Do not process retry packets but continue processing future packets in AppId
-- appid: Extract metadata for tunneled HTTP session
-- appid: Make unit tests multithread safe
-- appid: On API call store new values and publish an event for them immediately
-- appid: remove old http2 support
-- appid: store appids for http traffic in http session
-- appid: support for multi-stream http2 session
-- appid: Update miscellaneous appid on first decrypted packet
-- build: add support for ccache
-- file_api: fix file stats
-- file_api: mark processing of file complete after type detection if signature not enabled
-- http2_inspect: add peg count to track max concurrent http2 file transfers
-- http2_inspect: fix handling leftover data with padding
-- http2_inspect: protect against unexpected eval calls
-- http2_inspect: support stream multiplexing
-- http2_inspect: update padding check only for header and data frames
-- http_inspect: add support for http2 file processing
-- json: add stream formatter helper
-- managers: sort the inspector list in inspection policy using the instance name
-- memory: expose memory_cap.h to plugins
-- parameter: reject reals assigned to ints
-- rna: Update dev notes to describe usage
-- snort: add classtype, priority, and references to --dump-rule-meta output
-- snort: convert --dump-rule-{meta,state,deps} to json format
-- so rules: allow #fragments in references in so rule stubs
-- stream: Fix for stream pegs dumping zero values into perf_monitor_base.csv
2020/04/23 - 3.0.1 build 2
-- appid: Change sessionAPI to accomodate stream_index
-- appid: detect payload for first http2 stream
-- appid: Fix thread-safety issues in appid
-- appid: mark third-party inspection as done for expected flows
-- appid: Populate url for QUIC sessions by extracting QUIC SNI metadata from third-party
-- appid: remove thirdparty processing for http2 traffic
-- appid: remove unused code
-- appid: remove unused config options and rename "debug" option
-- appid: set up packet counters to make sure flows with one-way data don't pend forever
-- appid: Support org unit in SSL lookup API and do not overwrite the API provided data
-- codecs: Clean up CiscoMetaData implementation
-- codecs: GRE checksum updated for injected and rewritten packets
-- codecs: Update GRE flags and offset for injected packets
-- control: Disable request unit-test in cmake if shell is disabled
-- control: Fixing data races in request read and response
-- file: apply cached verdict on already seen file
-- file_magic: Update category for HWP and MSOLE2
-- flowbits: eliminate extraneous FlowBitState
-- flowbits: fix reload mapping
-- flowbits: refactor implementation
-- flowbits: relocate bitop.h to helpers
-- flowbits: remove extraneous count
-- flowbits: remove unused group support
-- flow: track allocations for each flow, update cap_weights
-- framework: Remove unused InspectorData template
-- ftp_data: fix ids flushing at EOF
-- ftp: whitelisting reason support
-- host_tracker: Move all HostCacheAlloc template implementions to the header
-- http2_inspect: discard split connection preface
-- http2_inspect: flush pending data when a non-data frame is received
-- http2_inspect: handle the case of leftover header only (no body)
-- http2_inspect: support 0 length data frames
-- http_inspect: add fragment to http_uri
-- http_inspect: cut over to wizard on successful CONNECT response
-- http_inspect: enhance processing of connect messages
-- http_inspect: fix duplicated detained_inspection print in show()
-- http_inspect: make script tag check case insensitive
-- http_inspect: register extra-data callbacks in constructor
-- hyperscan: simplify scratch memory initialization
-- inspectors: designate service inspectors control channels for avc only
-- inspectors: designate service inspectors for file carving
-- inspectors: designate service inspectors for start tls
-- inspectors: update verbose config output in show() method to a new format
-- ips_context: add support to fallback to avc only
-- ips: fix rule state mapping and policy lookup
-- ips: remove plugins cruft from option tree node (rule body)
-- latency: check if ip header is present before deferring it
-- latency: use test_timeout config option to deterministically trigger latency events for ifdef
REG_TEST
-- loggers: Add SGT field to CSV and JSON loggers
-- main: Make test_log() static in snort_debug.cc
-- managers: print inspectors' config output for every inspection policy configured
-- metadata-filter: apply to so rule stubs
-- output: allow error messages in quiet mode
-- packet_io: log daq batch size
-- packet_io: log daq pool size
-- perf_monitor: Enable or disable flow-ip-profiling using shell commands
-- plugin_manager: make erase from plug_map safer
-- plugin_manager: make sure --show-plugins option picks up SO plugins
-- reload: update ReloadError response messages to use consistent wording across all messages
-- session: remove unused IPS option
-- sip: Support pinhole for sip early media
-- snort2lua: make qos configuration values deleted from firewall
-- snort: add --dump-rule-deps
-- snort: add --dump-rule-state
-- snort: add flowbits set and checked to --dump-rule-meta
-- snort: add rule text to --dump-rule-meta
-- snort: enable --dump-rule-meta to work without a conf
-- snort: initial implementation of --dump-rule-meta
-- snort: remove inappropriate fatal errors
-- snort: remove unused --pcap-reload option
-- so rules: allow stub gid:sid:rev to override so
-- so rules: allow stub header to override so header
-- stream_tcp: remove unused session printing cruft
-- target_based: refactor host attribute table logic into a c++ class, eliminate dead code
-- target_based: refactor to improve design of the host attribute classes
-- target_based: refactor to load host attribute table from file
-- time: make packet_gettimeofday public
-- trace: refactor stdout/syslog logging of trace into logger framework
2020/03/31 - 3.0.1 build 1
-- analyzer: Send detained packet event when a packet is held
-- appid: use http2 inspector for detection even if third-party module is present
-- build: Increment version to 3.0.1
-- dce_rpc: Fixed missing space in string
-- doc: add FIXIT-E description
-- http2_inspect: handle Cl and TE headers, and end_stream flags set on headers frames
-- http2_inspect: multiple data frames support
-- http_inspect: added FIXIT for thread safety
-- http_inspect: eliminate empty body sections for missing message bodies
-- latency: remove action config option and convert the log handler to trace_log message
-- mime: fix data race in mime config
-- modules: Support verbosity level for module trace options, modify trace logging macros.
-- service_inspectors: standardize verbose config startup output for SMTP, POP and IMAP inspectors
-- snort2lua: remove conversion of deprecated options pkt-log and rule-log
-- so_rule: fix reload of shared object rules that use flow data
-- src: update high priority "to be fixed" comments (FIXIT-H)
-- stream_tcp: Out-of-order ACK processing fix
2020/03/25 - build 270
-- active: Base hold_packet() decision on DAQ message pool usage
-- active: Fix direction of RST packet being sent to server
-- active: Move packet hold realization for Stream detainment to verdict handling
-- active: Send entire buffer at once when send_data uses ioctl
-- appid: Adding UT for client_app_aim_test
-- appid: Fix SMB session data memory leak
-- appid: Include DNS over TLS port for classification
-- appid: Restart service detection on start of decryption
-- appid: Support appid detection for outer protocol service
-- appid: Support detection for first stream in http/2 session
-- binder: Ignore the network_policy binding
-- build: Bump the C++ compiler supported feature set requirement to C++14
-- build: Don't try to use libuuid headers/libraries when not found.
Thanks to James Lay <jlay@slave-tothe-box.net> for reporting the issue.
-- build: Refactor included headers
-- codecs: Add new proto bit for udp tunneled traffic
-- codecs: Add vxlan codec
-- dce_rpc: Inspect midstream sessions for file inspection
-- file_api: Reading the new data for the overlapped file_data
-- filters: Update threshold tracking functions
-- flow: Allow the ExpectCache to force prune, so that we can always make room when the cache is
full
-- flow: Change the ExpectCache prune logic to only remove a specified number of oldest entries,
regardless of node expiration time
-- flow: Do away altogether with the loop in ExpectCache::prune, just remove one, only when the
cache is full
-- http2_inspect: Refactor data cutter - preparation for multi packet processing
-- http2_inspect: Support single data frame sent to http, multiple flushes
-- http2_inspect: Update dev notes with memory calculations
-- http_inspect: Create http2 message body type
-- http_inspect: Gzip detained inspection
-- http_inspect: Refactor print_section for message bodies
-- loggers: Update usage to GLOBAL for all loggers
-- lua: Enable a rewrite plugin in a default config
-- main: Check if flow state is blocked while applying verdicts
-- main: Setting higher maximum pruning when idle
-- snort2lua: Convert a replace option to a rewrite plugin/action
-- snort2lua: Don't print out network_policy binding
-- stream: Short-circuit stream when handling retry packets in no-ack mode
-- stream_tcp: Cancel hold requests on the current packet when flushing
-- stream_tcp: Finalize held packets in TcpSession::clear_session()
-- stream_tcp: Moved retry check to TcpSession::process
2020/03/12 - build 269
-- active: Add ability to inject resets and payload via IOCTLs
-- appid: Add support for third-party reload on midstream session
-- appid: detect apps using x-working-with http field in response header
-- appid: Enhance ssl appid lookup api to store SNI and CN provided by SSL for app detection
-- appid: fix thread-safety issues in mdns detector
-- appid: handle CERTIFICATE STATUS handshake type in SSL detector
-- appid: move client/service pattern detectors and service discovery manager to odp context
-- appid: Support third-party reload when snort is running with multiple packet threads
-- base64_decode: use standard detection context data buffer
-- build: fix build on big-endian systems
-- build: Fix LibUUID detection on OS X
-- build: Fix various build issues on FreeBSD and OS X
-- build: refactor trace logs
-- build: tweak includes
-- build: use const and auto references where possible
-- byte_math: Snort2 bug fix port of integer over and under flow detection
-- classifications: update implementation with unordered map
-- classifications: use consistent variable names
-- cmake: Fix building without lzma library
-- detection: added support for trace config option to take a list of strings with verbosity level
instead of bitmask
-- detection: refactoring updates to detection, moved DetectionModule into a separate file
-- flow: added initiator bytes/packets onto flow
-- flow: Add missing time.h include for struct timeval
-- flow: free the flow data before deleting the actual flow
-- flow: turn off deferred whitelist on DONE if no whitelist was seen
-- flow_cache: fix memory deallocation bug due to inverted return value from hash release node
-- framework: add generic conversion of trace strings to bitmaks
-- ftp: Whitelist ftp session after max sig depth reached
-- ghash: fix thread race condition with GHash member variables when a GHash instance is global
-- hash: add unit tests for new HashLruCache class
-- hash: delete unused sfmemcap.[h|cc] and remove unnecessary includes
-- http2_inspect: abort for nhi errors
-- http2_inspect: send data frames to http - full frames only in a single flush
-- http_inspect: change http_uri to only include path and query for absolute and absolute path uris
-- http_inspect: improve precautions for stream interactions
-- http_inspect: Properly mock HttpModule::peg_counts in http_transaction_test
-- main: do FileService::post_init after inspectors are configured
-- parser: remove legacy parsing code
-- plugin_manager: add support for reload so_rule plugins
-- pub_sub: add http2 info to http pub messages
-- reference: update implementation with unordered map
-- reload: add description of reload error to the response message of the reload_config command
-- reputation: remove reputation monitor flag from packet, track verdict on flow
-- rules: add constructors for references and classifications
-- rules: fix warnings and startup counts for duplicates
-- rules: remove cruft
-- rules: simplify implementation of services, classifications, and references by using std::string
-- rules: update --gen-msg-map to include all configured rules with references
-- service_inspectors: added counters to track total number of data bytes processed in SMTP, POP,
SSH and FTP
-- service: update implementation to vector
-- sfdaq: convert parsing related error messages in DAQ init to ParseErrors
-- sfdaq: Made get_stats public for plugins
-- smb: Fix malware over size 131kb not being detected in SMBv2/SMBv3
-- snort_config: footprint REG_TEST, no check for stream inspector add/rm, etc.
-- stats: update shutdown timing stats
-- stream: Addressing inconsistent stream stats and some data races
-- stream_ip: added counters to track total number of data bytes processed
-- stream_tcp: no_ack applies only to ips mode
-- stream_udp: added counters to track total number of data bytes processed
-- style: remove tabs and too long lines
-- utils: add unit tests for MemCapAllocator class
-- utils: create memory allocation class based on sfmemcap functionality
-- utils: handle out-of-range time
-- xhash: refactor XHash and HashFnc to eliminate c-style callbacks and simplify ctor options
-- xhash: rename hashfcn.[cc|h] to hash_keys.[cc|h]
-- xhash/zhash: refactor duplicated code into a common base class, xhash/zhash will subclass this
new base class
-- zhash: make zhash a subclass of xhash, eliminate duplicate code
-- zhash: refactor to use hash_lru_cache and hash_key_operations classes
2020/02/21 - build 268
-- appid: Adding support for appid detection on decrypted SSL sessions
-- appid: Adding support for wildcard ports in static host port cache
-- appid: clean up ENABLE_APPID_THIRD_PARTY from configure_cmake
-- appid: cleanup terminology
-- appid: delete odp context on exit
-- appid: detect payload for http tunnel traffic
-- appid: do not reload third party on reload_config
-- appid: Don't mark HTTP session done if the ssl detector is still in progress
-- appid: Fix array initialization on Appid
-- appid: get rid of ENABLE_APPID_THIRD_PARTY flag
-- appid: handle invalid uri in http tunnel traffic
-- appid: load app mapping data to odp context
-- appid: move dns, sip, ssl and http pattern matchers to odp context; move client discovery
manager to odp context
-- appid: move odp config, host-port cache and length cache to a separate class OdpContext; remove
obsolete port detector code
-- appid: reset tp packet counters each time we do reinspect
-- appid: support third party reload when snort is running with single packet thread
-- bufferlen: match on total length unless remaining is specified
-- build: Clean up accumulated tabs and trailing whitespace in the code
-- build: clean up non-hyperscan builds
-- build: Fix more Clang 9 compiler warnings
-- build: Remove some extraneous semicolons (compiler warnings)
-- build: Rename parameters that shadow class members (compiler warnings)
-- build: Updates across the board for stricter Clang const-casting warnings
-- catch: Update to Catch v2.11.1
-- cip: explicitly include sys/time.h header
-- codecs: Use unions for checksum pseudoheaders
-- content: add hyperscan content literal matching alternative to boyer-moore
-- content: delete flawed hyper search test
-- content: use hs_compile if hs_compile_lit is not available
-- copyright: update year to 2020
-- dce_tcp: fixup flow data handling
-- detection: add config option to enable conversion of pcre expressions to use the regex engine
-- detection: add hyperscan_literals option
-- detection: add pcre_override to enable/disable pcre/O
-- detection: signature evaluation looping based on literal contents only (exclude regex)
-- doc: manual updates for HTTP/2
-- doc: update documentation for lua whitelist
-- doc: update reload_limitations.txt
-- file_api: enable Active when there are reset rules in the file policy
-- framework: introduce ScratchAllocator class to help with scratch memory management
-- gtp_inspect: fix default port binding
-- hash: refactor ghash implementation to convert it to an actual C++ class
-- hash: refactor key compare function prototype and functions to return boolean
-- hash: refactor to move common definitions into hash_defs.h
-- hash: refactor xhash to be a real C++ class
-- host_tracker: Check lock in a separate thread in unit-test
-- host_tracker: make current_size atomic to save some locks
-- host_tracker: Support host_cache reload with RRT when memcap changes
-- http2_inspect: add transfer encoding chunked at end of decoded http1 header block
-- http2_inspect: data frame http inspection walking skeleton first phase
-- http2_inspect: fast pattern support
-- http2_inspect: fix string decode error
-- http2_inspect: frame data no longer in file_data
-- http2_inspect: integration with NHI
-- http2_inspect: support disabling detection for uninteresting HTTP/2 frames
-- http2_inspect: support HPACK dynamic table size updates
-- http_inspect: add http_param rule option
-- http_inspect: gzip splitting beyond request_depth should use correct target size
-- http_inspect: no duplicate built-in events for a flow
-- http_inspect: patch H2I-related xtra data crash
-- http_inspect: process multiple files simultaneously over HTTP/1.1
-- http_inspect: refactoring
-- http_inspect: update test tool to support the HTTP/2 macros and new insert command
-- http_inspect: when detection is disabled, disable all rules not just content rules
-- http_inspect/http2_inspect: H2I unified2 extra data logging
-- hyperscan: convert thread locals to scan context
-- inspectors: ensure correct lookup by type, name, or service
-- inspectors: print label for type and alias in inspector manager. Remove printing module name in
inspectors ::show() method.
-- ips: alert service rules check ports
-- ips_pcre: compile/evaluate pcre rule option regular expressions with the hyperscan regex engine
when possible
-- ips_pcre: support the O & R modifiers when converting pcre to regex
-- ips: refactor rule parsing
-- ips: remove dead code from rule parser
-- ips: use service "file" instead of "user"
-- loggers: update vlan logging in csv and json loggers
-- lua: Added missing file magic pattern for FLIC
-- lua: Added missing file magic pattern for IntelHEX
-- lua: fix typo in default smtp's alt_max_command_line_len
-- lua: update default lua files to whitelist the defined tables
-- main: add verbose inspector output during reload
-- main: make IPS actions (reject, react, replace) configurable per-IPS policy
-- main: move config_lua to Shell::configure
-- memory: Treating config value memory.cap as per thread instead of global
-- metadata: add --metadata-filter to load matching rules only
-- mime: support simultaneous file processing of MIME-encoded files over HTTP/1.1
-- module_manager: add snort_whitelist_append and snort_whitelist_add_prefix FFIs
-- normalizer: disable all normalizations by default except for tcp.ips
-- packet_io: provide default reset action (bidirectional reset for TCP, ICMP unreachable for the
rest)
-- packet_io: refactor Active and IPS Actions to start disentangling them
-- parser: add service http2 to http rules
-- parser: store local copy of service name
-- pcre: ensure use of maximal ovector size and simplify logic
-- port_scan: Supporting reload config when memcap changes
-- protocols: provide direct access to the CiscoMetaData layer
-- regex: convert thread locals to scan context
-- reload: eliminate FatalError calls that can't happen because snort_calloc always returns valid
memory
-- rna: use standard uint8_t type instead of u_int8_t
-- search_engine: trivial reformatting
-- smtp: update defaults to better align with Snort 2
-- snort2lua: conversion of path containing variables
-- snort: add new warn flag warn-conf-strict that will throw out warning when table is not found
-- snort: Adding some verbose logs for appid, file_id, and reputation inspectors
-- stream_tcp: ensure that flows with mss and timestamps are picked up on syn
-- tweaks: set reasonable stream_ip.min_fragment_length values
-- tweaks: update per new normalizer defaults
-- tweaks: update policy configs to better align with Snort 2
2019/12/20 - build 267
-- appid: Adding command for third-party reload
-- appid: cleanup unused code
-- binder: assitant gadget support.
-- build: Const-ify reference arguments as suggested by cppcheck
-- catch: Add infrastructure for standalone Catch unit tests
-- catch: Update to Catch v2.11.0
-- codec: Added GRE::encode method
-- control: Convert IdleProcessing unit tests to standalone Catch
-- dce_rpc: Convert HTTP proxy and server splitter unit tests to standalone Catch
-- file_api: When multiple files are processed simultaneously per flow, store the files on the
flow, not in the cache. Don't cache files until the signature has been computed
-- file_magic: add file magic for .jar, .rar, .alz, .egg, .hwp and .swf files
-- framework: Convert parameter and range unit tests to standalone Catch
-- gtp: alerts should be raised for missing TEID in gtp msg
-- helpers: Convert Base64Encoder unit tests to standalone Catch
-- http2_inspect: add Stream class
-- http2_inspect: parse settings frames
-- http_inspect: support limited response depth
-- ips: do not use includer for any rules file includes
-- ips: fix --show-file-codes for inclusion from -c file
-- lru_cache_shared: added find_else_insert to add user managed objects to the cache
-- lua: Convert LuaStack unit tests to standalone Catch
-- lua: Link lua_stack_test against libdl to handle the static luajit case
-- packet_capture: ignore PDUs and defragged packets, include non-IP packets
-- perf_monitor: Convert CSV, FBS, and JSON formatter unit tests to standalone Catch
-- perf_monitor: tuning for flow_ip_memcap on reload
-- profiler: Convert MemoryContext and ProfilerStatsTable unit tests to standalone Catch
-- reload: fix issue where resource tuning was not being called when in idle context
-- rule_state: allow empty tables
-- search_engine: fix expected count of MPSEs when offloading
-- sfip: Convert SfIp unit tests to standalone Catch
-- sfip: Use REG_TEST-style IP stringification for standalone Catch tests
-- stream_tcp: fix TcpState post increment operator to stop increment at max value (and use
correct max value)
-- stream_tcp: refactor stream_tcp initialization to create reassemblers during plugin init
-- stream_tcp: refactor to initialize tcp normalizers during plugin init
-- stream/tcp: Remove some unused Catch includes
-- time: Convert periodic and stopwatch unit tests to standalone Catch
-- utils: Convert bitop unit tests to standalone Catch
2019/12/04 - build 266
-- appid: Add new pattern to pop3, don't concatenate ssl certs, use openssl-1.1 compliant APIs
-- appid: Enabling host cache for unknown SSL flows
-- appid: Fix for better classification on pinholed data session and control session for
rshell/rexec
-- appid: Format detected apps stats in columns akin to file stats
-- appid: Handle memcap during reload_config using RRT
-- appid: Minor cleanup
-- cmake: Cache static DAQ module info in FindDAQ
-- file_api: Fixed eventing when FILE_SIG_DEPTH failed when store files enabled
-- flow: Add ability to defer whitelist verdict
-- flow: Clean up unit test compiler warnings
-- flow: Disabling the inspection if the Flow state is BLOCK
-- http2_inspect: Generate status lines for responses and be more lenient on RFC violations
-- http2_inspect: Implement hpack dynamic index lookups
-- http_inspect: Implement show method for verbose config output
-- http_inspect: Update user manual for detained inspection
-- hyperscan: Select max scratch from among all compiler threads
-- ips: Add support for parallel fast-pattern MPSE FSM compilation
-- ips: Only use multiple threads for rule group compilation at startup
-- ips: Support 2 rule vars same as Snort 2
-- mpse: Only hyperscan currently supports parallel compilation
-- port_scan: Only update scanner for ICMP if we have one
-- profiler: Fix module profile for multithreaded runs
-- search_engine: Ensure configured search_method is applied to search tools
-- search_engine: Process intermediate fast-pattern matches in batches of 32 same as Snort 2
-- search_engine: Raise an error if any MPSE compilation fails
-- sfip: Replace copy setter with implicit copy constructor
-- stats: Removal of mallinfo as it only support 32bit
-- stream_tcp: Move and update the libtcp source files to the tcp source directory to consolidate
the stream tcp code into one component (libtcp goes away)
-- stream_tcp: Updates from PR review comments
2019/11/22 - build 265
-- analyzer_command: support resource tuning on reload
-- appid: Adding Lua-C API to handle midstream traffic
-- cip: ips rule support for Common Industrial Protocol (CIP)
-- ftp: handling multiple ftp server config validation
-- detection: disable rule evaluation when detection is disabled for offload packets
-- detection: fix post-inspection state clearing issue
-- flow: check if there are offloaded packets in the flow before clearing out the alert count
-- http2_inspect: add frame class and refactor stream splitter
-- http2_inspect: fix unit tests to build without REGTEST defined
-- main: Improve performance of control connection polling
-- plugin_manager: allow loading individual plugin files in plugin-path
-- reject: Setting defaults for reset and control options
-- snort: update reload resource tuner to return status indicating if there is work to be done in
the packet thread
-- stream: register reload resource tuner unconditionally. move checks for config changes to the
tuner tinit method
-- stream_tcp: fix state machine instantiation
-- wizard: handle NBSS startup in dce_smb_curse
2019/11/06 - build 264
-- appid: Handle DNS responses with compression pointers at last record
-- dce_smb: deprecate config for smb_file_inspection, use smb_file_depth only
-- detection: negated fast patterns are last choice
-- http2_inspect: fix bugs in splitting long data frames and padding
-- http_inspect: change accelerated_blocking to detained_inspection
-- http_inspect: remove deprecated @fileclose command from test tool
-- imap, pop, smtp: changed default decode depths to unlimited
-- ips: define a builtin GID range to prevent unloaded SIDs from firing on all packets
-- ips_option::enable: fix dynamic plugin build
-- lua: tweak default conf and add tweaks for various scenarios
-- normalizer: make tcp.ips defaults to true
-- port_scan: increase default memcap to a more reasonable 10M
-- s7commplus: Initial working version of s7commplus service inspector
-- search_engine: stop searching if queue limit is reached
-- stream: implement reload resource tuner for stream to adjust the number of flow objects as
needed when the stream 'max_flows' configuration option changes
-- telnet: fix check_encrypted help string
2019/10/31 - build 263
-- appid: for ssl sessions, set payload id to unknown after ssl handshake is done if the payload id
was not not found
-- appid: check inferred services in host cache only if there were updates
-- appid: Updating the path to userappid.conf
-- build: Clean up snort namespace usage
-- build: generate and tag build 263
-- binder: Use reloaded snort config when getting inspector.
-- codecs: Relax requirement for DAQ packet decode data offsets when bypassing checksums
-- content: rewrite boyer_moore for performance
-- data_bus: add unit test cases
-- detection: enhance fast pattern match queuing
-- dns: made changes to make sure DNS parsing is thread safe
-- doc: update default manuals
-- file_api: Put FileCapture in the snort namespace
-- ftp: fix for missing prototype warning
-- ftp: catch invalid server command format
-- http_inspect: test tool single-direction abort fix
-- http_inspect: add more config initializers
-- http2_inspect: generate request start line from pseudo-headers
-- http2_inspect: abort on header decode error
-- http2_inspect: stop sharing a variable between scan and reassemble
-- http2_inspect: decode indexed header fields in the HPACK static table
-- http2_inspect: Move HPACK decompression out of stream splitter into a separate class.
-- http2_inspect: Abort on bad connection preface
-- http2_inspect: cleanup
-- http2_inspect: discard connection preface
-- ips: add states member, similar to rules, by convention use for rule state stubs with enable
-- mime: Put MailLogConfig in the snort namespace
-- packet: fix reset issues
-- packet_io: do not retry packets that do not have a daq instance.
-- policy: Avoid unintended insertion of policy into map if it does not exist
-- pub_subs: made default pub_subs policy-independent
-- rule_state: deprecat, replace with ips option enable to avoid LuaJIT limitations
-- stream_tcp: fix stability issues
-- stream_tcp: If no-ack is on, rewrite ACK value to be the expected ACK.
2019/10/09 - build 262
-- analyzer: move setting pkth to nullptr to after publishing finalize event
-- analyzer: publish other message event for unknown DAQ messages
-- appid: add support for bittorrent detection over standard ports
-- appid: add support for Lua detector callback mechanism
-- appid: add support for wildcard ports in host tracker
-- appid: extract forward ip from http tunneled traffic and use it for dynamic host cache lookup
-- appid: fix populating dns_query for DNS traffic
-- binder: allow binder to support global level service inspectors
-- binder: remove global check for stream inspectors and revert module_map changes
-- codecs: fix checksumming a single byte of unaligned data
-- codecs: use checksum validation from DAQ packet decode data when available
-- detection: consistently prefer service rules over port rules
-- detection: do not split service groups by ip proto to avoid extra searches
-- detection: map file rules to services
-- detection: non-service rules must match on rule header proto
-- detection: remove cruft from match accumulator
-- detection: remove more cruft from match tracker
-- detection: remove the inappropriate match tracker from mpse batch setup
-- detection: remove unnecessary match data from eval context
-- detection: support alert file rules w/o optional services
-- detection: update trace to indicate eval task
-- detection: use reference for signature eval data
-- doc: add Snort2Lua note on ips rule action rewrite
-- flow: check if control packet has a valid daq instance before setting up daq expected flow and
add pegcounts for expected flows
-- flow: patch to allocate Flow objects individually on demand. Once allocated the Flow objects are
reused until snort exits or reload changes the max_flows setting
-- flow: when walking uni_list stop before reaching head
-- helpers: discovery filter support for zone matching
-- helpers: implement port exclusion in discovery filter
-- http2_inspect: cut headers from frame_data buffer
-- http2_inspect: parse hpack header representations and decode string literals
-- http2_inspect: validate connection preface
-- ips_options: minor code style changes
-- libtcp: turn off no-ack mode if packet is out of order
-- lua: added move constructor and move assignment operator to Lua::State to fix segv
-- lua: fixed whitespace to match style guidelines
-- managers: add null check in reload_module to prevent crash when trying to reload module that has
not been configured
-- profiler: increase width of checks and alloc fields so values don't run together
-- protocols: remove reference to obsolete DAQ_PKT_FLAG_HW_TCP_CS_GOOD flag
-- pub_sub: replace DaqMetaEvent and OtherMessageEvent with DaqMessageEvent
-- reputation: prevent reload module crash when reputation is not configured in lua at startup
-- reputation: SIDs for source and destination-triggered events added
-- snort2lua: convert snort2 port bindings into snort3 service bindings for inspectors configured
in wizard and add --bind-port option to enable port bindings conversion
-- snort2lua: remove identity related options from firewall
-- snort2lua: reset the sticky buffer name while converting unchanged sticky rule options and
file_data
-- stream: clean up cppcheck warnings
-- stream: clean up update_direction
-- stream: code cleanup and dead-code removal
-- unit-tests: fix compiler warnings that snuck into CppUTest unit tests