]>
Commit | Line | Data |
---|---|---|
44a444ba VJ |
1 | 3.0RC3 -- 2015-12-21 |
2 | ||
3 | Bug #1632: Fail to download large file with browser | |
4 | Bug #1634: Fix non thread safeness of Prelude analyzer | |
5 | Bug #1640: drop log crashes | |
6 | Bug #1645: Race condition in unix manager | |
7 | Bug #1647: FlowGetKey flow-hash.c:240 segmentation fault (master) | |
8 | Bug #1650: DER parsing issue (master) | |
9 | ||
e94bf972 VJ |
10 | 3.0RC2 -- 2015-12-08 |
11 | ||
12 | Bug #1551: --enable-profiling-locks broken | |
13 | Bug #1602: eve-log prefix field feature broken | |
14 | Bug #1614: app_proto key missing from EVE file events | |
15 | Bug #1615: disable modbus by default | |
16 | Bug #1616: TCP reassembly bug | |
17 | Bug #1617: DNS over TCP parsing issue | |
18 | Bug #1618: SMTP parsing issue | |
19 | Feature #1635: unified2 output: disable by default | |
20 | ||
737c99dd VJ |
21 | 3.0RC1 -- 2015-11-25 |
22 | ||
23 | Bug #1150: TLS store disabled by TLS EVE logging | |
24 | Bug #1210: global counters in stats.log | |
25 | Bug #1423: Unix domain log file writer should automatically reconnect if receiving program is restarted. | |
26 | Bug #1466: Rule reload - Rules won't reload if rule files are listed in an included file. | |
27 | Bug #1467: Specifying an IPv6 entry before an IPv4 entry in host-os-policy causes ASAN heap-buffer-overflow. | |
28 | Bug #1472: Should 'goodsigs' be 'goodtotal' when checking if signatures were loaded in detect.c? | |
29 | Bug #1475: app-layer-modbus: AddressSanitizer error (heap-buffer-overflow) | |
30 | Bug #1481: Leading whitespace in flowbits variable names | |
31 | Bug #1482: suricata 2.1 beta4: StoreStateTxFileOnly crashes | |
32 | Bug #1485: hostbits - leading and trailing spaces are treated as part of the name and direction. | |
33 | Bug #1488: stream_size <= and >= modifiers function as < and > (equality is not functional) | |
34 | Bug #1491: pf_ring is not able to capture packets when running under non-root account | |
35 | Bug #1493: config test (-T) doesn't fail on missing files | |
36 | Bug #1494: off by one on rulefile count | |
37 | Bug #1500: suricata.log | |
38 | Bug #1508: address var parsing issue | |
39 | Bug #1517: Order dependent, ambiguous YAML in multi-detect. | |
40 | Bug #1518: multitenancy - selector vlan - vlan id range | |
41 | Bug #1521: multitenancy - global vlan tracking relation to selector | |
42 | Bug #1523: Decoded base64 payload short by 16 characters | |
43 | Bug #1530: multitenant mapping relation | |
44 | Bug #1531: multitenancy - confusing tenant id and vlan id output | |
45 | Bug #1556: MTU setting on NIC interface not considered by af-packet | |
46 | Bug #1557: stream: retransmission not detected | |
47 | Bug #1565: defrag: evasion issue | |
48 | Bug #1597: dns parser issue (master) | |
49 | Bug #1601: tls: server name logging | |
50 | Feature #1116: ips packet stats in stats.log | |
51 | Feature #1137: Support IP lists in threshold.config | |
52 | Feature #1228: Suricata stats.log in JSON format | |
53 | Feature #1265: Replace response on Suricata dns decoder when dns error please | |
54 | Feature #1281: long snort ruleset support for "SC_ERR_NOT_SUPPORTED(225): content length greater than 255 unsupported" | |
55 | Feature #1282: support for base64_decode from snort's ruleset | |
56 | Feature #1342: Support Cisco erspan traffic | |
57 | Feature #1374: Write pre-aggregated counters for all threads | |
58 | Feature #1408: multi tenancy for detection | |
59 | Feature #1440: Load rules file from a folder or with a star pattern rather then adding them manually to suricata.yaml | |
60 | Feature #1454: Proposal to add Lumberjack/CEE formatting option to EVE JSON syslog output for compatibility with rsyslog parsing | |
61 | Feature #1492: Add HUP coverage to output json-log | |
62 | Feature #1498: color output | |
63 | Feature #1499: json output for engine messages | |
64 | Feature #1502: Expose tls fields to lua | |
65 | Feature #1514: SSH softwareversion regex should allow colon | |
66 | Feature #1527: Add ability to compile as a Position-Independent Executable (PIE) | |
67 | Feature #1568: TLS lua output support | |
68 | Feature #1569: SSH lua support | |
69 | Feature #1582: Redis output support | |
70 | Feature #1586: Add flow memcap counter | |
71 | Feature #1599: rule profiling: json output | |
72 | Optimization #1269: Convert SM List from linked list to array | |
73 | ||
0e2a4c01 VJ |
74 | 2.1beta4 -- 2015-05-08 |
75 | ||
76 | Bug #1314: http-events performance issues | |
77 | Bug #1340: null ptr dereference in Suricata v2.1beta2 (output-json.c:347) | |
78 | Bug #1352: file list is not cleaned up | |
79 | Bug #1358: Gradual memory leak using reload (kill -USR2 $pid) | |
80 | Bug #1366: Crash if default_packet_size is below 32 bytes | |
81 | Bug #1378: stats api doesn't call thread deinit funcs | |
82 | Bug #1384: tcp midstream window issue (master) | |
83 | Bug #1388: pcap-file hangs on systems w/o atomics support (master) | |
84 | Bug #1392: http uri parsing issue (master) | |
85 | Bug #1393: CentOS 5.11 build failures | |
86 | Bug #1398: DCERPC traffic parsing issue (master) | |
87 | Bug #1401: inverted matching on incomplete session | |
88 | Bug #1402: When re-opening files on HUP (rotation) always use the append flag. | |
89 | Bug #1417: no rules loaded - latest git - rev e250040 | |
90 | Bug #1425: dead lock in de_state vs flowints/flowvars | |
91 | Bug #1426: Files prematurely truncated by detection engine even though force-md5 is enabled | |
92 | Bug #1429: stream: last_ack update issue leading to stream gaps | |
93 | Bug #1435: EVE-Log alert payload option loses data | |
94 | Bug #1441: Local timestamps in json events | |
95 | Bug #1446: Unit ID check in Modbus packet error | |
96 | Bug #1449: smtp parsing issue | |
97 | Bug #1451: Fix list-keywords regressions | |
98 | Bug #1463: modbus parsing issue | |
99 | Feature #336: Add support for NETMAP to Suricata. | |
100 | Feature #885: smtp file_data support | |
101 | Feature #1394: Improve TCP reuse support | |
102 | Feature #1410: add alerts to EVE's drop logs | |
103 | Feature #1445: Suricata does not work on pfSense/FreeBSD interfaces using PPPoE | |
104 | Feature #1447: Ability to reject ICMP traffic | |
105 | Feature #1448: xbits | |
106 | Optimization #1014: app layer reassembly fast-path | |
107 | Optimization #1377: flow manager: reduce (try)locking | |
108 | Optimization #1403: autofp packet pool performance problems | |
109 | Optimization #1409: http pipeline support for stateful detection | |
110 | ||
a5641bc7 VJ |
111 | 2.1beta3 -- 2015-01-29 |
112 | ||
113 | Bug #977: WARNING on empty rules file is fatal (should not be) | |
114 | Bug #1184: pfring: cppcheck warnings | |
115 | Bug #1321: Flow memuse bookkeeping error | |
116 | Bug #1327: pcre pkt/flowvar capture broken for non-relative matches (master) | |
117 | Bug #1332: cppcheck: ioctl | |
118 | Bug #1336: modbus: CID 1257762: Logically dead code (DEADCODE) | |
119 | Bug #1351: output-json: duplicate logging (2.1.x) | |
120 | Bug #1354: coredumps on quitting on OpenBSD | |
121 | Bug #1355: Bus error when reading pcap-file on OpenBSD | |
122 | Bug #1363: Suricata does not compile on OS X/Clang due to redefinition of string functions (2.1.x) | |
123 | Bug #1365: evasion issues (2.1.x) | |
124 | Feature #1261: Request for Additional Lua Capabilities | |
125 | Feature #1309: Lua support for Stats output | |
126 | Feature #1310: Modbus parsing and matching | |
127 | Feature #1317: Lua: Indicator for end of flow | |
128 | Feature #1333: unix-socket: allow (easier) non-root usage | |
129 | Optimization #1339: flow timeout optimization | |
130 | Optimization #1339: flow timeout optimization | |
131 | Optimization #1371: mpm optimization | |
132 | ||
0b289434 VJ |
133 | 2.1beta2 -- 2014-11-06 |
134 | ||
135 | Feature #549: Extract file attachments from emails | |
136 | Feature #1312: Lua output support | |
137 | Feature #899: MPLS over Ethernet support | |
138 | Feature #707: ip reputation files - network range inclusion availability (cidr) | |
139 | Feature #383: Stream logging | |
140 | Feature #1263: Lua: Access to Stream Payloads | |
141 | Feature #1264: Lua: access to TCP quad / Flow Tuple | |
142 | Bug #1048: PF_RING/DNA config - suricata.yaml | |
143 | Bug #1230: byte_extract, within combination not working | |
144 | Bug #1257: Flow switch is missing from the eve-log section in suricata.yaml | |
145 | Bug #1259: AF_PACKET IPS is broken in 2.1beta1 | |
146 | Bug #1260: flow logging at shutdown broken | |
147 | Bug #1279: BUG: NULL pointer dereference when suricata was debug mode. | |
148 | Bug #1280: BUG: IPv6 address vars issue | |
149 | Bug #1285: Lua - http.request_line not working (2.1) | |
150 | Bug #1287: Lua Output has dependency on eve-log:http | |
151 | Bug #1288: Filestore keyword in wrong place will cause entire rule not to trigger | |
152 | Bug #1294: Configure doesn't use --with-libpcap-libraries when testing PF_RING library | |
153 | Bug #1301: suricata yaml - PF_RING load balance per hash option | |
154 | Bug #1308: http_header keyword not matching when SYN|ACK and ACK missing (master) | |
155 | Bug #1311: EVE output Unix domain socket not working (2.1) | |
156 | ||
7fa2b876 VJ |
157 | 2.1beta1 -- 2014-08-12 |
158 | ||
159 | Feature #1155: Log packet payloads in eve alerts | |
160 | Feature #1208: JSON Output Enhancement - Include Payload(s) | |
161 | Feature #1248: flow/connection logging | |
162 | Feature #1258: json: include HTTP info with Alert output | |
163 | Optimization #1039: Packetpool should be a stack | |
164 | Optimization #1241: pcap recording: record per thread | |
165 | ||
2bcff80d VJ |
166 | 2.0.3 -- 2014-08-08 |
167 | ||
168 | Bug #1236: fix potential crash in http parsing | |
169 | Bug #1244: ipv6 defrag issue | |
170 | Bug #1238: Possible evasion in stream-tcp-reassemble.c | |
171 | Bug #1221: lowercase conversion table missing last value | |
172 | Support #1207: Cannot compile on CentOS 5 x64 with --enable-profiling | |
173 | ||
1419e400 VJ |
174 | 2.0.2 -- 2014-06-25 |
175 | ||
176 | Bug #1098: http_raw_uri with relative pcre parsing issue | |
177 | Bug #1175: unix socket: valgrind warning | |
178 | Bug #1189: abort() in 2.0dev (rev 6fbb955) with pf_ring 5.6.3 | |
179 | Bug #1195: nflog: cppcheck reports memleaks | |
180 | Bug #1206: ZC pf_ring not working with Suricata 2.0.1 (or latest git) | |
181 | Bug #1211: defrag issue | |
182 | Bug #1212: core dump (after a while) when app-layer.protocols.http.enabled = yes | |
183 | Bug #1214: Global Thresholds (sig_id 0, gid_id 0) not applied correctly if a signature has event vars | |
184 | Bug #1217: Segfault in unix-manager.c line 529 when using --unix-socket and sending pcap files to be analized via socket | |
185 | Feature #781: IDS using NFLOG iptables target | |
186 | Feature #1158: Parser DNS TXT data parsing and logging | |
187 | Feature #1197: liblua support | |
188 | Feature #1200: sighup for log rotation | |
189 | ||
174a5055 VJ |
190 | 2.0.1 -- 2014-05-21 |
191 | ||
192 | No changes since 2.0.1rc1 | |
193 | ||
7e8f80b3 VJ |
194 | 2.0.1rc1 -- 2014-05-12 |
195 | ||
196 | Bug #978: clean up app layer parser thread local storage | |
197 | Bug #1064: Lack of Thread Deinitialization For Decoder Modules | |
198 | Bug #1101: Segmentation in AppLayerParserGetTxCnt | |
199 | Bug #1136: negated app-layer-protocol FP on multi-TX flows | |
200 | Bug #1141: dns response parsing issue | |
201 | Bug #1142: dns tcp toclient protocol detection | |
202 | Bug #1143: tls protocol detection in case of tls-alert | |
203 | Bug #1144: icmpv6: unknown type events for MLD_* types | |
204 | Bug #1145: ipv6: support PAD1 in DST/HOP extension hdr | |
205 | Bug #1146: tls: event on 'new session ticket' in handshake | |
206 | Bug #1159: Possible memory exhaustion when an invalid bpf-filter is used with AF_PACKET | |
207 | Bug #1160: Pcaps submitted via Unix Socket do not finish processing in Suricata 2 | |
208 | Bug #1161: eve: src and dst mixed up in some cases | |
209 | Bug #1162: proto-detect: make sure probing parsers for all registered ports are run | |
210 | Bug #1163: HTP Segfault | |
211 | Bug #1165: af_packet - one thread consistently not working | |
212 | Bug #1170: rohash: CID 1197756: Bad bit shift operation (BAD_SHIFT) | |
213 | Bug #1176: AF_PACKET IPS mode is broken in 2.0 | |
214 | Bug #1177: eve log do not show action 'dropped' just 'allowed' | |
215 | Bug #1180: Possible problem in stream tracking | |
216 | Feature #1157: Always create pid file if --pidfile command line option is provided. | |
217 | Feature #1173: tls: OpenSSL heartbleed detection | |
218 | ||
bc70fc0f VJ |
219 | 2.0 -- 2014-03-25 |
220 | ||
221 | Bug #1151: tls.store not working when a TLS filter keyword is used | |
222 | ||
03091dfb VJ |
223 | 2.0rc3 -- 2014-03-18 |
224 | ||
225 | Bug #1127: logstash & suricata parsing issue | |
226 | Bug #1128: Segmentation fault - live rule reload | |
227 | Bug #1129: pfring cluster & ring initialization | |
228 | Bug #1130: af-packet flow balancing problems | |
229 | Bug #1131: eve-log: missing user agent reported inconsistently | |
230 | Bug #1133: eve-log: http depends on regular http log | |
231 | Bug #1135: 2.0rc2 release doesn't set optimization flag on GCC | |
232 | Bug #1138: alert fastlog drop info missing | |
233 | ||
845cbcce VJ |
234 | 2.0rc2 -- 2014-03-06 |
235 | ||
236 | Bug #611: fp: rule with ports matching on portless proto | |
237 | Bug #985: default config generates rule warnings and errors | |
238 | Bug #1021: 1.4.6: conf_filename not checked before use | |
239 | Bug #1089: SMTP: move depends on uninitialised value | |
240 | Bug #1090: FTP: Memory Leak | |
241 | Bug #1091: TLS-Handshake: Uninitialized value | |
242 | Bug #1092: HTTP: Memory Leak | |
243 | Bug #1108: suricata.yaml config parameter - segfault | |
244 | Bug #1109: PF_RING vlan handling | |
245 | Bug #1110: Can have the same Pattern ID (pid) for the same pattern but different case flags | |
246 | Bug #1111: capture stats at exit incorrect | |
247 | Bug #1112: tls-events.rules file missing | |
248 | Bug #1115: nfq: exit stats not working | |
249 | Bug #1120: segv with pfring/afpacket and eve-log enabled | |
250 | Bug #1121: crash in eve-log | |
251 | Bug #1124: ipfw build broken | |
252 | Feature #952: Add VLAN tag ID to all outputs | |
253 | Feature #953: Add QinQ tag ID to all outputs | |
254 | Feature #1012: Introduce SSH log | |
255 | Feature #1118: app-layer protocols http memcap - info in verbose mode (-v) | |
256 | Feature #1119: restore SSH protocol detection and parser | |
257 | ||
2421da6e VJ |
258 | 2.0rc1 -- 2014-02-13 |
259 | ||
260 | Bug #839: http events alert multiple times | |
261 | Bug #954: VLAN decoder stats with AF Packet get written to the first thread only - stats.log | |
262 | Bug #980: memory leak in http buffers at shutdown | |
263 | Bug #1066: logger API's for packet based logging and tx based logging | |
264 | Bug #1068: format string issues with size_t + qa not catching them | |
265 | Bug #1072: Segmentation fault in 2.0beta2: Custom HTTP log segmentation fault | |
266 | Bug #1073: radix tree lookups are not thread safe | |
267 | Bug #1075: CUDA 5.5 doesn't compile with 2.0 beta 2 | |
268 | Bug #1079: Err loading rules with variables that contain negated content. | |
269 | Bug #1080: segfault - 2.0dev (rev 6e389a1) | |
270 | Bug #1081: 100% CPU utilization with suricata 2.0 beta2+ | |
271 | Bug #1082: af-packet vlan handling is broken | |
272 | Bug #1103: stats.log not incrementing decoder.ipv4/6 stats when reading in QinQ packets | |
273 | Bug #1104: vlan tagged fragmentation | |
274 | Bug #1106: Git compile fails on Ubuntu Lucid | |
275 | Bug #1107: flow timeout causes decoders to run on pseudo packets | |
276 | Feature #424: App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols | |
277 | Feature #542: TLS JSON output | |
278 | Feature #597: case insensitive fileext match | |
279 | Feature #772: JSON output for alerts | |
280 | Feature #814: QinQ tag flow support | |
281 | Feature #894: clean up output | |
282 | Feature #921: Override conf parameters | |
283 | Feature #1007: united output | |
284 | Feature #1040: Suricata should compile with -Werror | |
285 | Feature #1067: memcap for http inside suricata | |
286 | Feature #1086: dns memcap | |
287 | Feature #1093: stream: configurable segment pools | |
288 | Feature #1102: Add a decoder.QinQ stats in stats.log | |
289 | Feature #1105: Detect icmpv6 on ipv4 | |
290 | ||
d3d745d5 VJ |
291 | 2.0beta2 -- 2013-12-18 |
292 | ||
293 | Bug #463: Suricata not fire on http reply detect if request are not http | |
294 | Bug #640: app-layer-event:http.host_header_ambiguous set when it shouldn't | |
295 | Bug #714: some logs not created in daemon mode | |
296 | Bug #810: Alerts on http traffic storing the wrong packet as the IDS event payload | |
297 | Bug #815: address parsing with negation | |
298 | Bug #820: several issues found by clang 3.2 | |
299 | Bug #837: Af-packet statistics inconsistent under very high traffic | |
300 | Bug #882: MpmACCudaRegister shouldn't call PatternMatchDefaultMatcher | |
301 | Bug #887: http.log printing unknown hostname most of the time | |
302 | Bug #890: af-packet segv | |
303 | Bug #892: detect-engine.profile - custom - does not err out in incorrect toclient/srv values - suricata.yaml | |
304 | Bug #895: response: rst packet bug | |
305 | Bug #896: pfring dna mode issue | |
306 | Bug #897: make install-full fails if wget is missing | |
307 | Bug #903: libhtp valgrind warning | |
308 | Bug #907: icmp_seq and icmp_id keyword with icmpv6 traffic (master) | |
309 | Bug #910: make check fails w/o sudo/root privs | |
310 | Bug #911: HUP signal | |
311 | Bug #912: 1.4.3: Unit test in util-debug.c: line too long. | |
312 | Bug #914: Having a high number of pickup queues (216+) makes suricata crash | |
313 | Bug #915: 1.4.3: log-pcap.c: crash on printing a null filename | |
314 | Bug #917: 1.4.5: decode-ipv6.c: void function cannot return value | |
315 | Bug #920: Suricata failed to parse address | |
316 | Bug #922: trackers value in suricata.yaml | |
317 | Bug #925: prealloc-sessions value bigger than allowed in suricata.yaml | |
318 | Bug #926: prealloc host value in suricata.yaml | |
319 | Bug #927: detect-thread-ratio given a non numeric value in suricata.yaml | |
320 | Bug #928: Max number of threads | |
321 | Bug #932: wrong IP version - on stacked layers | |
322 | Bug #939: thread name buffers are sized inconsistently | |
323 | Bug #943: pfring: see if we can report that the module is not loaded | |
324 | Bug #948: apple ppc64 build broken: thread-local storage not supported for this target | |
325 | Bug #958: SSL parsing issue (master) | |
326 | Bug #963: XFF compile failure on OSX | |
327 | Bug #964: Modify negated content handling | |
328 | Bug #967: threshold rule clobbers suppress rules | |
329 | Bug #968: unified2 not logging tagged packets | |
330 | Bug #970: AC memory read error | |
331 | Bug #973: Use different ids for content patterns which are the same, but one of them has a fast_pattern chop set on it. | |
332 | Bug #976: ip_rep supplying different no of alerts for 2 different but semantically similar rules | |
333 | Bug #979: clean up app layer protocol detection memory | |
334 | Bug #982: http events missing | |
335 | Bug #987: default config generates error(s) | |
336 | Bug #988: suricata don't exit in live mode | |
337 | Bug #989: Segfault in HTPStateGetTxCnt after a few minutes | |
338 | Bug #991: threshold mem leak | |
339 | Bug #994: valgrind warnings in unittests | |
340 | Bug #995: tag keyword: tagging sessions per time is broken | |
341 | Bug #998: rule reload triggers app-layer-event FP's | |
342 | Bug #999: delayed detect inits thresholds before de_ctx | |
343 | Bug #1003: Segmentation fault | |
344 | Bug #1023: block rule reloads during delayed detect init | |
345 | Bug #1026: pfring: update configure to link with -lrt | |
346 | Bug #1031: Fix IPv6 stream pseudo packets | |
347 | Bug #1035: http uri/query normalization normalizes 'plus' sign to space | |
348 | Bug #1042: Can't match "emailAddress" field in tls.subject and tls.issuerdn | |
349 | Bug #1061: Multiple flowbit set in one rule | |
350 | Feature #234: add option disable/enable individual app layer protocol inspection modules | |
351 | Feature #417: ip fragmentation time out feature in yaml | |
352 | Feature #478: XFF (X-Forwarded-For) | |
353 | Feature #602: availability for http.log output - identical to apache log format | |
354 | Feature #622: Specify number of pf_ring/af_packet receive threads on the command line | |
355 | Feature #727: Explore the support for negated alprotos in sigs. | |
356 | Feature #746: Decoding API modification | |
357 | Feature #751: Add invalid packet counter | |
358 | Feature #752: Improve checksum detection algorithm | |
359 | Feature #789: Clean-up start and stop code | |
360 | Feature #813: VLAN flow support | |
361 | Feature #878: add storage api | |
362 | Feature #901: VLAN defrag support | |
363 | Feature #904: store tx id when generating an alert | |
364 | Feature #940: randomize http body chunks sizes | |
365 | Feature #944: detect nic offloading | |
366 | Feature #956: Implement IPv6 reject | |
367 | Feature #957: reject: iface setup | |
368 | Feature #959: Move post config initialisation code to PostConfLoadedSetup | |
369 | Feature #981: Update all switch case fall throughs with comments on false throughs | |
370 | Feature #983: Provide rule support for specifying icmpv4 and icmpv6. | |
371 | Feature #986: set htp request and response size limits | |
372 | Feature #1008: Optionally have http_uri buffer start with uri path for use in proxied environments | |
373 | Feature #1009: Yaml file inclusion support | |
374 | Feature #1032: profiling: per keyword stats | |
375 | Optimization #583: improve Packet_ structure layout | |
376 | Optimization #1018: clean up counters api | |
377 | Optimization #1041: remove mkinstalldirs from git | |
378 | ||
f09f289b VJ |
379 | 2.0beta1 -- 2013-07-18 |
380 | ||
381 | - Luajit flow vars and flow ints support (#593) | |
382 | - DNS parser, logger and keyword support (#792), funded by Emerging Threats | |
383 | - deflate support for HTTP response bodies (#470, #775) | |
384 | - update to libhtp 0.5 (#775) | |
385 | - improved gzip support for HTTP response bodies (#470, #775) | |
386 | - redesigned transaction handling, improving both accuracy and performance (#753) | |
387 | - redesigned CUDA support (#729) | |
388 | - Be sure to always apply verdict to NFQ packet (#769) | |
389 | - stream engine: SACK allocs should adhere to memcap (#794) | |
390 | - stream: deal with multiple different SYN/ACK's better (#796) | |
391 | - stream: Randomize stream chunk size for raw stream inspection (#804) | |
392 | - Introduce per stream thread ssn pool (#519) | |
393 | - "pass" IP-only rules should bypass detection engine after matching (#718) | |
394 | - Generate error if bpf is used in IPS mode (#777) | |
395 | - Add support for batch verdicts in NFQ, thanks to Florian Westphal | |
396 | - Update Doxygen config, thanks to Phil Schroeder | |
397 | - Improve libnss detection, thanks to Christian Kreibich | |
398 | - Fix a FP on rules looking for port 0 and fragments (#847), thanks to Rmkml | |
399 | - OS X unix socket build fixed (#830) | |
400 | - bytetest, bytejump and byteextract negative offset failure (#827) | |
401 | - Fix fast.log formatting issues (#771), thanks to Rmkml | |
402 | - Invalidate negative depth (#774), thanks to Rmkml | |
403 | - Fixed accuracy issues with relative pcre matching (#791) | |
404 | - Fix deadlock in flowvar capture code (#802) | |
405 | - Improved accuracy of file_data keyword (#817) | |
406 | - Fix af-packet ips mode rule processing bug (#819), thanks to Laszlo Madarassy | |
407 | - stream: fix injecting pseudo packet too soon leading to FP (#883), thanks to Francis Trudeau | |
408 | ||
409 | 1.4.4 -- 2013-07-18 | |
410 | ||
411 | - Bug #834: Unix socket - showing as compiled when it is not desired to do so | |
412 | - Bug #835: Unix Socket not working as expected | |
413 | - Bug #841: configure --enable-unix-socket does not err out if libs/pkgs are not present | |
414 | - Bug #846: FP on IP frag and sig use udp port 0, thanks to Rmkml | |
415 | - Bug #864: backport packet action macro's | |
416 | - Bug #876: htp tunnel fix | |
417 | - Bug #877: Flowbit check with content doesn't match consistently, thanks to Francis Trudeau | |
418 | ||
419 | 1.4.3 -- 2013-06-20 | |
420 | ||
421 | - Fix missed detection in bytetest, bytejump and byteextract for negative offset (#828) | |
422 | - Fix IPS mode being unable to drop tunneled packets (#826) | |
423 | - Fix OS X Unix Socket build (#829) | |
424 | ||
425 | 1.4.2 -- 2013-05-29 | |
426 | ||
427 | - No longer force nocase to be used on http_host | |
428 | - Invalidate rule if uppercase content is used for http_host w/o nocase | |
429 | - Warn user if bpf is used in af-packet IPS mode | |
430 | - Better test for available libjansson version | |
431 | - Fixed accuracy issues with relative pcre matching (#784) | |
432 | - Improved accuracy of file_data keyword (#788) | |
433 | - Invalidate negative depth (#770) | |
434 | - Fix http host parsing for IPv6 addresses (#761) | |
435 | - Fix fast.log formatting issues (#773) | |
436 | - Fixed deadlock in flowvar set code for http buffers (#801) | |
437 | - Various signature ordering improvements | |
438 | - Minor stream engine fix | |
439 | ||
440 | 1.4.1 -- 2013-03-08 | |
441 | ||
442 | - GeoIP keyword, allowing matching on Maxmind's database, contributed by Ignacio Sanchez (#559) | |
443 | - Introduce http_host and http_raw_host keywords (#733, #743) | |
444 | - Add python module for interacting with unix socket (#767) | |
445 | - Add new unix socket commands: fetching config, counters, basic runtime info (#764, #765) | |
446 | - Big Napatech support update by Matt Keeler | |
447 | - Configurable sensor id in unified2 output, contributed by Jake Gionet (#667) | |
448 | - FreeBSD IPFW fixes by Nikolay Denev | |
449 | - Add "default" interface setting to capture configuration in yaml (#679) | |
450 | - Make sure "snaplen" can be set by the user (#680) | |
451 | - Improve HTTP URI query string normalization (#739) | |
452 | - Improved error reporting in MD5 loading (#693) | |
453 | - Improve reference.config parser error reporting (#737) | |
454 | - Improve build info output to include all configure options (#738) | |
455 | - Segfault in TLS parsing reported by Charles Smutz (#725) | |
456 | - Fix crash in teredo decoding, reported by Rmkml (#736) | |
457 | - fixed UDPv4 packets without checksum being detected as invalid (#760) | |
458 | - fixed DCE/SMB parsers getting confused in some fragmented cases (#764) | |
459 | - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#697) | |
460 | - FN: IP-only rule ip_proto not matching for some protocols (#689) | |
461 | - Fix build failure with other libhtp installs (#688) | |
462 | - Fix malformed yaml loading leading to a crash (#694) | |
463 | - Various Mac OS X fixes (#700, #701, #703) | |
464 | - Fix for autotools on Mac OS X by Jason Ish (#704) | |
465 | - Fix AF_PACKET under high load not updating stats (#706) | |
466 | ||
467 | 1.3.6 -- 2013-03-07 | |
468 | ||
469 | - fix decoder event rules not checked in all cases (#671) | |
470 | - checksum detection for icmpv6 was fixed (#673) | |
471 | - crash in HTTP server body inspection code fixed (#675) | |
472 | - fixed a icmpv6 payload bug (#676) | |
473 | - IP-only rule ip_proto not matching for some protocols was addressed (#690) | |
474 | - fixed malformed yaml crashing suricata (#702) | |
475 | - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#717) | |
476 | - crash in tls parser was fixed (#759) | |
477 | - fixed UDPv4 packets without checksum being detected as invalid (#762) | |
478 | - fixed DCE/SMB parsers getting confused in some fragmented cases (#763) | |
479 | ||
63370745 VJ |
480 | 1.4 2012-12-13 |
481 | ||
482 | - Decoder event matching fixed (#672) | |
483 | - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#665) | |
484 | - Add more events to IPv6 extension header anomolies (#678) | |
485 | - Fix ICMPv6 payload and checksum calculation (#677, #674) | |
486 | - Clean up flow timeout handling (#656) | |
487 | - Fix a shutdown bug when using AF_PACKET under high load (#653) | |
488 | - Fix TCP sessions being cleaned up to early (#652) | |
489 | ||
490 | 1.3.5 2012-12-06 | |
491 | ||
492 | - Flow engine memory leak fixed by Ludovico Cavedon (#651) | |
493 | - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#664) | |
494 | - Flow manager mutex used unintialized, fixed by Ludovico Cavedon (#654) | |
495 | - Windows building in CYGWIN fixed (#630) | |
496 | ||
e4f25661 VJ |
497 | 1.4rc1 2012-11-29 |
498 | ||
499 | - Interactive unix socket mode (#571, #552) | |
500 | - IP Reputation: loading and matching (#647) | |
501 | - Improved --list-keywords commandline option gives detailed info for supported keyword, including doc link (#435) | |
502 | - Rule analyzer improvement wrt ipv4/ipv6, invalid rules (#494) | |
503 | - User-Agent added to file log and filestore meta files (#629) | |
504 | - Endace DAG supports live stats and at exit drop stats (#638) | |
505 | - Add support for libhtp event "request port doesn't match tcp port" (#650) | |
506 | - Rules with negated addresses will not be considered IP-only (#599) | |
507 | - Rule reloads complete much faster in low traffic conditions (#526) | |
508 | - Suricata -h now displays all available options (#419) | |
509 | - Luajit configure time detection was improved (#636) | |
510 | - Flow manager mutex used w/o initialization (#628) | |
511 | - Cygwin work around for windows shell mangling interface string (#372) | |
512 | - Fix a Prelude output crash with alerts generated by rules w/o classtype or msg (#648) | |
513 | - CLANG compiler build fixes (#649) | |
514 | - Several fixes found by code analyzers | |
515 | ||
b0caeaa5 VJ |
516 | 1.4beta3 2012-11-14 |
517 | ||
518 | - support for Napatech cards was greatly improved by Matt Keeler from Npulse (#430, #619) | |
519 | - support for pkt_data keyword was added | |
520 | - user and group to run as can now be set in the config file | |
521 | - make HTTP request and response body inspection sizes configurable per HTTP server config (#560) | |
522 | - PCAP/AF_PACKET/PF_RING packet stats are now printed in stats.log (#561, #625) | |
523 | - add contrib directory to the dist (#567) | |
524 | - performance improvements to signatures with dsize option | |
525 | - improved rule analyzer: print fast_pattern along with the rule (#558) | |
526 | - fixes to stream engine reducing the number of events generated (#604) | |
527 | - add stream event to match on overlaps with different data in stream reassembly (#603) | |
528 | - stream.inline option new defaults to "auto", meaning enabled in IPS mode, disabled in IDS mode (#592) | |
529 | - HTTP handling in OOM condition was greatly improved (#557) | |
530 | - filemagic keyword performance was improved (#585) | |
531 | - fixes and improvements to daemon mode (#624) | |
532 | - fix drop rules not working correctly when thresholded (#613) | |
533 | - fixed a possible FP when a regular and "chopped" fast_pattern were the same (#581) | |
534 | - fix a false possitive condition in http_header (#607) | |
535 | - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#627) | |
536 | - fixes to rule profiling (#576) | |
537 | - cleanups and misc fixes (#379, #395) | |
538 | - updated bundled libhtp to 0.2.11 | |
539 | - build system improvements and cleanups | |
540 | - fix to SSL record parsing | |
541 | ||
542 | 1.3.4 -- 2012-11-14 | |
543 | ||
544 | - fix crash in flow and host engines in cases of low memory or low memcap settings (#617) | |
545 | - improve http handling in low memory conditions (#620) | |
546 | - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#626) | |
547 | - fix building on OpenBSD 5.2 | |
548 | - update default config's defrag settings to reflect all available options | |
549 | - fixes to make check | |
550 | - fix to SSL record parsing | |
551 | ||
552 | 1.3.3 -- 2012-11-01 | |
553 | ||
554 | - fix drop rules not working correctly when thresholded (#615) | |
555 | - fix a false possitive condition in http_header (#606) | |
556 | - fix extracted file corruption (#601) | |
557 | - fix a false possitive condition with the pcre keyword and relative matching (#588) | |
558 | - fix PF_RING set cluster problem on dma interfaces (#598) | |
559 | - improve http handling in low memory conditions (#586, #587) | |
560 | - fix FreeBSD inline mode crash (#612) | |
561 | - suppress pcre jit warning (#579) | |
562 | ||
d774d6e2 VJ |
563 | 1.4beta2 -- 2012-10-04 |
564 | ||
565 | - New keyword: "luajit" to inspect packet, payload and all HTTP buffers with a Lua script (#346) | |
566 | - Added ability to control per server HTTP parser settings in much more detail (#503) | |
567 | - Rewrite of IP Defrag engine to improve performance and fix locking logic (#512, #540) | |
568 | - Big performance improvement in inspecting decoder, stream and app layer events (#555) | |
569 | - Pool performance improvements (#541) | |
570 | - Improved performance of signatures with simple pattern setups (#577) | |
571 | - Bundled docs are installed upon make install (#527) | |
572 | - Support for a number of global vs rule thresholds [3] was added (#425) | |
573 | - Improved rule profiling performance | |
574 | - If not explicit fast_pattern is set, pick HTTP patterns over stream patterns. HTTP method, stat code and stat msg are excluded. | |
575 | - Fix compilation on architectures other than x86 and x86_64 (#572) | |
576 | - Fix FP with anchored pcre combined with relative matching (#529) | |
577 | - Fix engine hanging instead of exitting if the pcap device doesn't exist (#533) | |
578 | - Work around for potential FP, will get properly fixed in next release (#574) | |
579 | - Improve ERF handling. Thanks to Jason Ish | |
580 | - Always set cluster_id in PF_RING | |
581 | - IPFW: fix broken broadcast handling | |
582 | - AF_PACKET kernel offset issue, IPS fix and cleanup | |
583 | - Fix stream engine sometimes resending the same data to app layer | |
584 | - Fix multiple issues in HTTP multipart parsing | |
585 | - Fixed a lockup at shutdown with NFQ (#537) | |
586 | ||
587 | 1.3.2 -- 2012-10-03 | |
588 | ||
589 | - Fixed a possible FP when a regular and "chopped" fast_pattern were the same (#562) | |
590 | - Fixed a FN condition with the flow:no_stream option (#575) | |
591 | - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) | |
592 | - Fix multiple issues in HTTP multipart parsing | |
593 | - Fix stream engine sometimes resending the same data to app layer | |
594 | - Always set cluster_id in PF_RING | |
595 | - Defrag: silence some potentially noisy errors/warnings | |
596 | - IPFW: fix broken broadcast handling | |
597 | - AF_PACKET kernel offset issue | |
598 | ||
fca70730 VJ |
599 | 1.4beta1 -- 2012-09-06 |
600 | ||
601 | - Custom HTTP logging contributed by Ignacio Sanchez (#530) | |
602 | - TLS certificate logging and fingerprint computation and keyword (#443) | |
603 | - TLS certificate store to disk feature (#444) | |
604 | - Decoding of IPv4-in-IPv6, IPv6-in-IPv6 and Teredo tunnels (#462, #514, #480) | |
605 | - AF_PACKET IPS support (#516) | |
606 | - Rules can be set to inspect only IPv4 or IPv6 (#494) | |
607 | - filesize keyword for matching on sizes of files in HTTP (#489) | |
608 | - Delayed detect initialization. Starts processing packets right away and loads detection engine in the background (#522) | |
609 | - NFQ fail open support (#507) | |
610 | - Highly experimental lua scripting support for detection | |
611 | - Live reloads now supports HTTP rule updates better (#522) | |
612 | - AF_PACKET performance improvements (#197, #415) | |
613 | - Make defrag more configurable (#517, #528) | |
614 | - Improve pool performance (#518) | |
615 | - Improve file inspection keywords by adding a separate API (#531) | |
616 | - Example threshold.config file provided (#302) | |
617 | - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) | |
618 | - Various spelling corrections by Simon Moon (#533) | |
619 | ||
e28835af VJ |
620 | 1.3.1 -- 2012-08-21 |
621 | ||
622 | - AF_PACKET performance improvements | |
623 | - Defrag engine performance improvements | |
624 | - HTTP: add per server options to enable/disable double decoding of URI (#464, #504) | |
625 | - Stream engine packet handling for packets with non-standard flag combinations (#508) | |
626 | - Improved stream engine handling of packet loss (#523) | |
627 | - Stream engine checksum alerting fixed | |
628 | - Various rule analyzer fixes (#495, #496, #497) | |
629 | - (Rule) profiling fixed and improved (#460, #466) | |
630 | - Enforce limit on max-pending-packets (#510) | |
631 | - fast_pattern on negated content improved | |
632 | - TLS rule keyword parsing issues | |
633 | - Windows build fixes (#502) | |
634 | - Host OS parsing issues fixed (#499) | |
635 | - Reject signatures where content length is bigger than "depth" setting (#505) | |
636 | - Removed unused "prune-flows" option | |
637 | - Set main thread and live reload thread names (#498) | |
638 | ||
22957776 VJ |
639 | 1.3 -- 2012-07-06 |
640 | ||
641 | - make live rule reloads optional and disabled by default | |
642 | - fix a shutdown bug | |
643 | - fix several memory leaks (#492) | |
644 | - warn user if global and rule thresholding conflict (#455) | |
645 | - set thread names on FreeBSD (Nikolay Denev) | |
646 | - Fix PF_RING building on Ubuntu 12.04 | |
647 | - rule analyzer updates | |
648 | - file inspection improvements when dealing with limits (#493) | |
649 | ||
583ba460 VJ |
650 | 1.3rc1 -- 2012-06-29 |
651 | ||
652 | - experimental live rule reload by sending a USR2 signal (#279) | |
653 | - AF_PACKET BPF support (#449) | |
654 | - AF_PACKET live packet loss counters (#441) | |
655 | - Rule analyzer (#349) | |
656 | - add pcap workers runmode for use with libpcap wrappers that support load balancing, such as Napatech's or Myricom's | |
657 | - negated filemd5 matching, allowing for md5 whitelisting | |
658 | - signatures with depth and/or offset are now checked against packets in addition to the stream (#404) | |
659 | - http_cookie keyword now also inspects "Set-Cookie" header (#479) | |
660 | - filemd5 keyword no longer depends on log-file output module (#447) | |
661 | - http_raw_header keyword inspects original header line terminators (#475) | |
662 | - deal with double encoded URI (#464) | |
663 | - improved SMB/SMB2/DCERPC robustness | |
664 | - ICMPv6 parsing fixes | |
665 | - improve HTTP body inspection | |
666 | - stream.inline accuracy issues fixed (#339) | |
667 | - general stability fixes (#482, #486) | |
668 | - missing unittests added (#471) | |
669 | - "threshold.conf not found" error made more clear (#446) | |
670 | - IPS mode segment logging for Unified2 improved | |
671 | ||
672 | 1.3beta2 -- 2012-06-08 | |
ed9b07ef VJ |
673 | |
674 | - experimental support for matching on large lists of known file MD5 checksums | |
675 | - Improved performance for file_data, http_server_body and http_client_body keywords | |
676 | - Improvements to HTTP handling: multipart parsing, gzip decompression | |
677 | - Byte_extract can support negative offsets now (#445) | |
678 | - Support for PF_RING 5.4 added. Many thanks to Chris Wakelin (#459) | |
679 | - HOME_NET and EXTERNAL_NET and the other vars are now checked for common errors (#454) | |
680 | - Improved error reporting when using too long address strings (#451) | |
681 | - MD5 calculation improvements for daemon mode and other cases (#449) | |
682 | - File inspection scripts: Added Syslog action for logging to local syslog. Thanks to Martin Holste. | |
683 | - Rule parser is made more strict. | |
684 | - Unified2 output overhaul, logging individual segments in more cases. | |
685 | - detection_filter keyword accuracy problem was fixed (#453) | |
686 | - Don't inspect cookie header with http header (#461) | |
687 | - Crash with a rule with two byte_extract keywords (#456) | |
688 | - SSL parser fixes. Thanks to Chris Wakelin for testing the patches! (#476) | |
689 | - Accuracy issues in HTTP inspection fixed. Thanks to Rmkml (#452) | |
690 | - Improve escaping of some characters in logs (#418) | |
691 | - Checksum calculation bugs fixed | |
692 | - IPv6 parsing issues fixed. Thanks to Michel Saborde. | |
693 | - Endace DAG issues fixed. Thanks to Jason Ish from Endace. | |
694 | - Various OpenBSD related fixes. | |
695 | - Fixes for bugs found by Coverity source code analyzer. | |
696 | ||
fbe0206c VJ |
697 | 1.3beta1 -- 2012-04-04 |
698 | ||
699 | - TLS/SSL handshake parser, tls.subjectdn and tls.issuerdn keywords (#296, contributed by Pierre Chifflier) | |
700 | - Napatech capture card support (contributed by Randy Caldejon -- nPulse) | |
701 | - Scripts for looking up files / file md5's at Virus Total and others (contributed by Martin Holste) | |
702 | - Test mode: -T option to test the config (#271) | |
703 | - Ringbuffer and zero copy support for AF_PACKET | |
704 | - Commandline options to list supported app layer protocols and keywords (#344, #414) | |
705 | - File extraction for HTTP POST request that do not use multipart bodies | |
706 | - On the fly md5 checksum calculation of extracted files | |
707 | - Line based file log, in json format | |
708 | - Basic support for including other yaml files into the main yaml | |
709 | - New multi pattern engine: ac-bs | |
710 | - Profiling improvements, added lock profiling code | |
711 | - Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys) | |
712 | - Unified yaml naming convention, including fallback support (by Nikolay Denev) | |
713 | - Improved Endace DAG support (#431, Jason Ish -- Endace) | |
714 | - New default runmode: "autofp" (#433) | |
715 | - Major rewrite of flow engine, improving scalability. | |
716 | - Improved http_stat_msg and http_stat_code keywords (#394) | |
717 | - Improved scalability for Tag and Threshold subsystems | |
718 | - Made the rule keyword parser much stricter in detecting syntax errors | |
719 | - Split "file" output into "file-store" and "file-log" outputs | |
720 | - Much improved file extraction | |
721 | - CUDA build fixes (#421) | |
722 | - Various FP's reported by Rmkml (#403, #405, #411) | |
723 | - IPv6 decoding and detection issues (reported by Michel Sarborde) | |
724 | - PCAP logging crash (#422) | |
725 | - Fixed many (potential) issues with the help of the Coverity source code analyzer | |
726 | - Fixed several (potential) issues with the help of the cppcheck and clang/scan-build source code analyzers | |
727 | ||
65d1783b VJ |
728 | 1.2.1 -- 2012-01-20 |
729 | ||
730 | - fix malformed unified2 records when writing alerts trigger by stream inspection (#402) | |
731 | - only force a pseudo packet inspection cycle for TCP streams in a state >= established | |
732 | ||
5b42f360 VJ |
733 | 1.2 -- 2012-01-19 |
734 | ||
735 | - improved Windows/CYGWIN path handling (#387) | |
736 | - fixed some issues with passing an interface or ip address with -i | |
737 | - make live worker runmode threads adhere to the 'detect' cpu affinity settings | |
738 | ||
e192ce7e VJ |
739 | 1.2rc1 -- 2012-01-11 |
740 | ||
741 | - app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events | |
742 | - auto detection of checksum offloading per interface (#311) | |
743 | - urilen options to match on raw or normalized URI (#341) | |
744 | - flow keyword option "only_stream" and "no_stream" | |
745 | - unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250) | |
746 | - in IPS mode, reject rules now also drop (#399) | |
747 | - http_header now also inspects response headers (#389) | |
748 | - "worker" runmodes for NFQ and IPFW | |
749 | - performance improvement for "ac" pattern matcher | |
750 | - allow empty/non-initialized flowints to be incremented | |
751 | - PCRE-JIT is now enabled by default if available (#356) | |
752 | - many file inspection and extraction improvements | |
753 | - flowbits and flowints are now modified in a post-match action list | |
754 | - general performance increasements | |
755 | - fixed parsing really high sid numbers >2 Billion (#393) | |
756 | - fixed ICMPv6 not matching in IP-only sigs (#363) | |
757 | ||
c0cd2c85 VJ |
758 | 1.2beta1 -- 2011-12-19 |
759 | ||
760 | - File name, type inspection and extraction for HTTP | |
761 | - filename, fileext, filemagic and filestore keywords added | |
762 | - "file" output for storing extracted files to disk | |
763 | - file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241 | |
764 | - new keyword http_server_body, pcre regex /S option | |
765 | - Option to enable/disable core dumping from the suricata.yaml (enabled by default) | |
766 | - Human readable size limit settings in suricata.yaml | |
767 | - PF_RING bpf support (required PF_RING >= 5.1) (feature #334) | |
768 | - tos keyword support (feature #364) | |
769 | - IPFW IPS mode does now support multiple divert sockets | |
770 | - New IPS running modes, Linux and FreeBSD do now support "worker" and "autofp" | |
771 | - Improved alert accuracy in autofp and single runmodes | |
772 | - major performance optimizations for the ac-gfbs pattern matcher implementation | |
773 | - unified2 output fixes | |
774 | - PF_RING supports privilege dropping now (bug #367) | |
775 | - Improved detection of duplicate signatures | |
776 | ||
777 | 1.1.1 -- 2011-12-07 | |
778 | ||
779 | - Fix for a error in the smtp parser that could crash Suricata. | |
780 | - Fix for AF_PACKET not compiling on modern linux systems like Fedora 16. | |
781 | ||
6256d6b5 VJ |
782 | 1.1 -- 2011-11-10 |
783 | ||
784 | - CUDA build fixed | |
785 | - minor pcap, AF_PACKET and PF_RING fixes (#368) | |
786 | - bpf handling fix | |
787 | - Windows CYGWIN build | |
788 | - more cleanups | |
789 | ||
790 | 1.1rc1 -- 2011-11-03 | |
791 | ||
792 | - extended HTTP request logging for use with (among other things) http_agent for Sguil (#38) | |
793 | - AF_PACKET report drop stats on shutdown (#325) | |
794 | - new counters in stats.log for flow and stream engines (#348) | |
795 | - SMTP parsing code support for BDAT command (#347) | |
796 | - HTTP URI normalization no longer converts to lowercase (#362) | |
797 | - AF_PACKET works with privileges dropping now (#361) | |
798 | - Prelude output for state matches (#264, #355) | |
799 | - update of the pattern matching code that should improve accuracy | |
800 | - rule parser was made more strict (#295, #312) | |
801 | - multiple event suppressions for the same SID was fixed (#366) | |
802 | - several accuracy fixes | |
803 | - removal of the unified1 output plugins (#353) | |
804 | ||
805 | 1.1beta3 -- 2011-10-25 | |
806 | ||
807 | - af-packet support for high speed packet capture | |
808 | - "replace" keyword support (#303) | |
809 | - new "workers" runmode for multi-dev and/or clustered PF_RING, AF_PACKET, pcap | |
810 | - added "stream-event" keyword to match on TCP session anomalies | |
811 | - support for suppress keyword was added (#274) | |
812 | - byte_extract keyword support was added | |
813 | - improved handling of timed out TCP sessions in the detection engine | |
814 | - unified2 payload logging if detection was in the HTTP state (#264) | |
815 | - improved accuracy of the HTTP transaction logging | |
816 | - support for larger (64 bit) Flow/Stream memcaps (#332) | |
817 | - major speed improvements for PCRE, including support for PCRE JIT | |
818 | - support setting flowbits in ip-only rules (#292) | |
819 | - performance increases on SSE3+ CPU's | |
820 | - overhaul of the packet acquisition subsystem | |
821 | - packet based performance profiling subsystem was added | |
822 | - TCP SACK support was added to the stream engine | |
823 | - updated included libhtp to 0.2.6 which fixes several issues | |
824 | ||
825 | 1.1beta2 -- 2011-04-13 | |
826 | ||
827 | - New keyword support: http_raw_uri (including /I for pcre), ssl_state, ssl_version (#258, #259, #260, #262). | |
828 | - Inline mode for the stream engine (#230, #248). | |
829 | - New keyword support: nfq_set_mark | |
830 | - Included an example decoder-events.rules file | |
831 | - api for adding and selecting runmodes was added | |
832 | - pcap logging / recording output was added | |
833 | - basic SCTP protocol parsing was added | |
834 | - more fine grained CPU affinity setting support was added | |
835 | - stream engine inspects stream in larger chunks | |
836 | - fast_pattern support for http_method content modifier (#255) | |
837 | - negation support for isdataat keyword (#257) | |
838 | - configurable interval for stats.log updates (#247) | |
839 | - new pf_ring runmode was added that scales better | |
840 | - pcap live mode now handles the monitor interface going up and down | |
841 | - several QA additions to "make check" | |
842 | - NFQ (linux inline) mode was improved | |
843 | - Alerts classification fix (#275) | |
844 | - compiles and runs on big-endian systems (#63) | |
845 | - unified2 output works around barnyard2 issues with DLT_RAW + IPv6 | |
846 | ||
847 | 1.1beta1 -- 2010-12-21 | |
848 | ||
849 | - New keyword support: http_raw_header, http_stat_msg, http_stat_code. | |
850 | - A new default pattern matcher, Aho-Corasick based, that uses much less memory. | |
851 | - reference.config support as supplied by ET/ETpro and VRT. | |
852 | - Much improved fast_pattern support, including for http_uri, http_client_body, http_header, http_raw_header. | |
853 | - Improved parsers, especially the DCERPC parser. | |
854 | - Much improved performance & accuracy. | |
855 | ||
856 | 1.0.5 -- 2011-07-25 | |
857 | ||
858 | - Fix stream reassembly bug #300. Thanks to Rmkml for the report. | |
859 | - Fix several (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. | |
860 | ||
861 | 1.0.4 -- 2011-06-24 | |
862 | ||
863 | - LibHTP updated to 0.2.6 | |
864 | - Large number of (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. | |
865 | - Large number of (potential) issues fixed after source code scans with the Clang static analizer. | |
866 | ||
867 | 1.0.3 -- 2011-04-13 | |
868 | ||
869 | - Fix broken checksum calculation for TCP/UDP in some cases | |
870 | - Fix errors in the byte_test, byte_jump, http_method and http_header keywords | |
871 | - Fix a ASN1 parsing issue | |
872 | - Improve LibHTP memory handling | |
873 | - Fix a defrag issue | |
874 | - Fix several stream engine issues | |
875 |