3 Bug #1551: --enable-profiling-locks broken
4 Bug #1602: eve-log prefix field feature broken
5 Bug #1614: app_proto key missing from EVE file events
6 Bug #1615: disable modbus by default
7 Bug #1616: TCP reassembly bug
8 Bug #1617: DNS over TCP parsing issue
9 Bug #1618: SMTP parsing issue
10 Feature #1635: unified2 output: disable by default
14 Bug #1150: TLS store disabled by TLS EVE logging
15 Bug #1210: global counters in stats.log
16 Bug #1423: Unix domain log file writer should automatically reconnect if receiving program is restarted.
17 Bug #1466: Rule reload - Rules won't reload if rule files are listed in an included file.
18 Bug #1467: Specifying an IPv6 entry before an IPv4 entry in host-os-policy causes ASAN heap-buffer-overflow.
19 Bug #1472: Should 'goodsigs' be 'goodtotal' when checking if signatures were loaded in detect.c?
20 Bug #1475: app-layer-modbus: AddressSanitizer error (heap-buffer-overflow)
21 Bug #1481: Leading whitespace in flowbits variable names
22 Bug #1482: suricata 2.1 beta4: StoreStateTxFileOnly crashes
23 Bug #1485: hostbits - leading and trailing spaces are treated as part of the name and direction.
24 Bug #1488: stream_size <= and >= modifiers function as < and > (equality is not functional)
25 Bug #1491: pf_ring is not able to capture packets when running under non-root account
26 Bug #1493: config test (-T) doesn't fail on missing files
27 Bug #1494: off by one on rulefile count
28 Bug #1500: suricata.log
29 Bug #1508: address var parsing issue
30 Bug #1517: Order dependent, ambiguous YAML in multi-detect.
31 Bug #1518: multitenancy - selector vlan - vlan id range
32 Bug #1521: multitenancy - global vlan tracking relation to selector
33 Bug #1523: Decoded base64 payload short by 16 characters
34 Bug #1530: multitenant mapping relation
35 Bug #1531: multitenancy - confusing tenant id and vlan id output
36 Bug #1556: MTU setting on NIC interface not considered by af-packet
37 Bug #1557: stream: retransmission not detected
38 Bug #1565: defrag: evasion issue
39 Bug #1597: dns parser issue (master)
40 Bug #1601: tls: server name logging
41 Feature #1116: ips packet stats in stats.log
42 Feature #1137: Support IP lists in threshold.config
43 Feature #1228: Suricata stats.log in JSON format
44 Feature #1265: Replace response on Suricata dns decoder when dns error please
45 Feature #1281: long snort ruleset support for "SC_ERR_NOT_SUPPORTED(225): content length greater than 255 unsupported"
46 Feature #1282: support for base64_decode from snort's ruleset
47 Feature #1342: Support Cisco erspan traffic
48 Feature #1374: Write pre-aggregated counters for all threads
49 Feature #1408: multi tenancy for detection
50 Feature #1440: Load rules file from a folder or with a star pattern rather then adding them manually to suricata.yaml
51 Feature #1454: Proposal to add Lumberjack/CEE formatting option to EVE JSON syslog output for compatibility with rsyslog parsing
52 Feature #1492: Add HUP coverage to output json-log
53 Feature #1498: color output
54 Feature #1499: json output for engine messages
55 Feature #1502: Expose tls fields to lua
56 Feature #1514: SSH softwareversion regex should allow colon
57 Feature #1527: Add ability to compile as a Position-Independent Executable (PIE)
58 Feature #1568: TLS lua output support
59 Feature #1569: SSH lua support
60 Feature #1582: Redis output support
61 Feature #1586: Add flow memcap counter
62 Feature #1599: rule profiling: json output
63 Optimization #1269: Convert SM List from linked list to array
65 2.1beta4 -- 2015-05-08
67 Bug #1314: http-events performance issues
68 Bug #1340: null ptr dereference in Suricata v2.1beta2 (output-json.c:347)
69 Bug #1352: file list is not cleaned up
70 Bug #1358: Gradual memory leak using reload (kill -USR2 $pid)
71 Bug #1366: Crash if default_packet_size is below 32 bytes
72 Bug #1378: stats api doesn't call thread deinit funcs
73 Bug #1384: tcp midstream window issue (master)
74 Bug #1388: pcap-file hangs on systems w/o atomics support (master)
75 Bug #1392: http uri parsing issue (master)
76 Bug #1393: CentOS 5.11 build failures
77 Bug #1398: DCERPC traffic parsing issue (master)
78 Bug #1401: inverted matching on incomplete session
79 Bug #1402: When re-opening files on HUP (rotation) always use the append flag.
80 Bug #1417: no rules loaded - latest git - rev e250040
81 Bug #1425: dead lock in de_state vs flowints/flowvars
82 Bug #1426: Files prematurely truncated by detection engine even though force-md5 is enabled
83 Bug #1429: stream: last_ack update issue leading to stream gaps
84 Bug #1435: EVE-Log alert payload option loses data
85 Bug #1441: Local timestamps in json events
86 Bug #1446: Unit ID check in Modbus packet error
87 Bug #1449: smtp parsing issue
88 Bug #1451: Fix list-keywords regressions
89 Bug #1463: modbus parsing issue
90 Feature #336: Add support for NETMAP to Suricata.
91 Feature #885: smtp file_data support
92 Feature #1394: Improve TCP reuse support
93 Feature #1410: add alerts to EVE's drop logs
94 Feature #1445: Suricata does not work on pfSense/FreeBSD interfaces using PPPoE
95 Feature #1447: Ability to reject ICMP traffic
97 Optimization #1014: app layer reassembly fast-path
98 Optimization #1377: flow manager: reduce (try)locking
99 Optimization #1403: autofp packet pool performance problems
100 Optimization #1409: http pipeline support for stateful detection
102 2.1beta3 -- 2015-01-29
104 Bug #977: WARNING on empty rules file is fatal (should not be)
105 Bug #1184: pfring: cppcheck warnings
106 Bug #1321: Flow memuse bookkeeping error
107 Bug #1327: pcre pkt/flowvar capture broken for non-relative matches (master)
108 Bug #1332: cppcheck: ioctl
109 Bug #1336: modbus: CID 1257762: Logically dead code (DEADCODE)
110 Bug #1351: output-json: duplicate logging (2.1.x)
111 Bug #1354: coredumps on quitting on OpenBSD
112 Bug #1355: Bus error when reading pcap-file on OpenBSD
113 Bug #1363: Suricata does not compile on OS X/Clang due to redefinition of string functions (2.1.x)
114 Bug #1365: evasion issues (2.1.x)
115 Feature #1261: Request for Additional Lua Capabilities
116 Feature #1309: Lua support for Stats output
117 Feature #1310: Modbus parsing and matching
118 Feature #1317: Lua: Indicator for end of flow
119 Feature #1333: unix-socket: allow (easier) non-root usage
120 Optimization #1339: flow timeout optimization
121 Optimization #1339: flow timeout optimization
122 Optimization #1371: mpm optimization
124 2.1beta2 -- 2014-11-06
126 Feature #549: Extract file attachments from emails
127 Feature #1312: Lua output support
128 Feature #899: MPLS over Ethernet support
129 Feature #707: ip reputation files - network range inclusion availability (cidr)
130 Feature #383: Stream logging
131 Feature #1263: Lua: Access to Stream Payloads
132 Feature #1264: Lua: access to TCP quad / Flow Tuple
133 Bug #1048: PF_RING/DNA config - suricata.yaml
134 Bug #1230: byte_extract, within combination not working
135 Bug #1257: Flow switch is missing from the eve-log section in suricata.yaml
136 Bug #1259: AF_PACKET IPS is broken in 2.1beta1
137 Bug #1260: flow logging at shutdown broken
138 Bug #1279: BUG: NULL pointer dereference when suricata was debug mode.
139 Bug #1280: BUG: IPv6 address vars issue
140 Bug #1285: Lua - http.request_line not working (2.1)
141 Bug #1287: Lua Output has dependency on eve-log:http
142 Bug #1288: Filestore keyword in wrong place will cause entire rule not to trigger
143 Bug #1294: Configure doesn't use --with-libpcap-libraries when testing PF_RING library
144 Bug #1301: suricata yaml - PF_RING load balance per hash option
145 Bug #1308: http_header keyword not matching when SYN|ACK and ACK missing (master)
146 Bug #1311: EVE output Unix domain socket not working (2.1)
148 2.1beta1 -- 2014-08-12
150 Feature #1155: Log packet payloads in eve alerts
151 Feature #1208: JSON Output Enhancement - Include Payload(s)
152 Feature #1248: flow/connection logging
153 Feature #1258: json: include HTTP info with Alert output
154 Optimization #1039: Packetpool should be a stack
155 Optimization #1241: pcap recording: record per thread
159 Bug #1236: fix potential crash in http parsing
160 Bug #1244: ipv6 defrag issue
161 Bug #1238: Possible evasion in stream-tcp-reassemble.c
162 Bug #1221: lowercase conversion table missing last value
163 Support #1207: Cannot compile on CentOS 5 x64 with --enable-profiling
167 Bug #1098: http_raw_uri with relative pcre parsing issue
168 Bug #1175: unix socket: valgrind warning
169 Bug #1189: abort() in 2.0dev (rev 6fbb955) with pf_ring 5.6.3
170 Bug #1195: nflog: cppcheck reports memleaks
171 Bug #1206: ZC pf_ring not working with Suricata 2.0.1 (or latest git)
172 Bug #1211: defrag issue
173 Bug #1212: core dump (after a while) when app-layer.protocols.http.enabled = yes
174 Bug #1214: Global Thresholds (sig_id 0, gid_id 0) not applied correctly if a signature has event vars
175 Bug #1217: Segfault in unix-manager.c line 529 when using --unix-socket and sending pcap files to be analized via socket
176 Feature #781: IDS using NFLOG iptables target
177 Feature #1158: Parser DNS TXT data parsing and logging
178 Feature #1197: liblua support
179 Feature #1200: sighup for log rotation
183 No changes since 2.0.1rc1
185 2.0.1rc1 -- 2014-05-12
187 Bug #978: clean up app layer parser thread local storage
188 Bug #1064: Lack of Thread Deinitialization For Decoder Modules
189 Bug #1101: Segmentation in AppLayerParserGetTxCnt
190 Bug #1136: negated app-layer-protocol FP on multi-TX flows
191 Bug #1141: dns response parsing issue
192 Bug #1142: dns tcp toclient protocol detection
193 Bug #1143: tls protocol detection in case of tls-alert
194 Bug #1144: icmpv6: unknown type events for MLD_* types
195 Bug #1145: ipv6: support PAD1 in DST/HOP extension hdr
196 Bug #1146: tls: event on 'new session ticket' in handshake
197 Bug #1159: Possible memory exhaustion when an invalid bpf-filter is used with AF_PACKET
198 Bug #1160: Pcaps submitted via Unix Socket do not finish processing in Suricata 2
199 Bug #1161: eve: src and dst mixed up in some cases
200 Bug #1162: proto-detect: make sure probing parsers for all registered ports are run
201 Bug #1163: HTP Segfault
202 Bug #1165: af_packet - one thread consistently not working
203 Bug #1170: rohash: CID 1197756: Bad bit shift operation (BAD_SHIFT)
204 Bug #1176: AF_PACKET IPS mode is broken in 2.0
205 Bug #1177: eve log do not show action 'dropped' just 'allowed'
206 Bug #1180: Possible problem in stream tracking
207 Feature #1157: Always create pid file if --pidfile command line option is provided.
208 Feature #1173: tls: OpenSSL heartbleed detection
212 Bug #1151: tls.store not working when a TLS filter keyword is used
216 Bug #1127: logstash & suricata parsing issue
217 Bug #1128: Segmentation fault - live rule reload
218 Bug #1129: pfring cluster & ring initialization
219 Bug #1130: af-packet flow balancing problems
220 Bug #1131: eve-log: missing user agent reported inconsistently
221 Bug #1133: eve-log: http depends on regular http log
222 Bug #1135: 2.0rc2 release doesn't set optimization flag on GCC
223 Bug #1138: alert fastlog drop info missing
227 Bug #611: fp: rule with ports matching on portless proto
228 Bug #985: default config generates rule warnings and errors
229 Bug #1021: 1.4.6: conf_filename not checked before use
230 Bug #1089: SMTP: move depends on uninitialised value
231 Bug #1090: FTP: Memory Leak
232 Bug #1091: TLS-Handshake: Uninitialized value
233 Bug #1092: HTTP: Memory Leak
234 Bug #1108: suricata.yaml config parameter - segfault
235 Bug #1109: PF_RING vlan handling
236 Bug #1110: Can have the same Pattern ID (pid) for the same pattern but different case flags
237 Bug #1111: capture stats at exit incorrect
238 Bug #1112: tls-events.rules file missing
239 Bug #1115: nfq: exit stats not working
240 Bug #1120: segv with pfring/afpacket and eve-log enabled
241 Bug #1121: crash in eve-log
242 Bug #1124: ipfw build broken
243 Feature #952: Add VLAN tag ID to all outputs
244 Feature #953: Add QinQ tag ID to all outputs
245 Feature #1012: Introduce SSH log
246 Feature #1118: app-layer protocols http memcap - info in verbose mode (-v)
247 Feature #1119: restore SSH protocol detection and parser
251 Bug #839: http events alert multiple times
252 Bug #954: VLAN decoder stats with AF Packet get written to the first thread only - stats.log
253 Bug #980: memory leak in http buffers at shutdown
254 Bug #1066: logger API's for packet based logging and tx based logging
255 Bug #1068: format string issues with size_t + qa not catching them
256 Bug #1072: Segmentation fault in 2.0beta2: Custom HTTP log segmentation fault
257 Bug #1073: radix tree lookups are not thread safe
258 Bug #1075: CUDA 5.5 doesn't compile with 2.0 beta 2
259 Bug #1079: Err loading rules with variables that contain negated content.
260 Bug #1080: segfault - 2.0dev (rev 6e389a1)
261 Bug #1081: 100% CPU utilization with suricata 2.0 beta2+
262 Bug #1082: af-packet vlan handling is broken
263 Bug #1103: stats.log not incrementing decoder.ipv4/6 stats when reading in QinQ packets
264 Bug #1104: vlan tagged fragmentation
265 Bug #1106: Git compile fails on Ubuntu Lucid
266 Bug #1107: flow timeout causes decoders to run on pseudo packets
267 Feature #424: App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols
268 Feature #542: TLS JSON output
269 Feature #597: case insensitive fileext match
270 Feature #772: JSON output for alerts
271 Feature #814: QinQ tag flow support
272 Feature #894: clean up output
273 Feature #921: Override conf parameters
274 Feature #1007: united output
275 Feature #1040: Suricata should compile with -Werror
276 Feature #1067: memcap for http inside suricata
277 Feature #1086: dns memcap
278 Feature #1093: stream: configurable segment pools
279 Feature #1102: Add a decoder.QinQ stats in stats.log
280 Feature #1105: Detect icmpv6 on ipv4
282 2.0beta2 -- 2013-12-18
284 Bug #463: Suricata not fire on http reply detect if request are not http
285 Bug #640: app-layer-event:http.host_header_ambiguous set when it shouldn't
286 Bug #714: some logs not created in daemon mode
287 Bug #810: Alerts on http traffic storing the wrong packet as the IDS event payload
288 Bug #815: address parsing with negation
289 Bug #820: several issues found by clang 3.2
290 Bug #837: Af-packet statistics inconsistent under very high traffic
291 Bug #882: MpmACCudaRegister shouldn't call PatternMatchDefaultMatcher
292 Bug #887: http.log printing unknown hostname most of the time
293 Bug #890: af-packet segv
294 Bug #892: detect-engine.profile - custom - does not err out in incorrect toclient/srv values - suricata.yaml
295 Bug #895: response: rst packet bug
296 Bug #896: pfring dna mode issue
297 Bug #897: make install-full fails if wget is missing
298 Bug #903: libhtp valgrind warning
299 Bug #907: icmp_seq and icmp_id keyword with icmpv6 traffic (master)
300 Bug #910: make check fails w/o sudo/root privs
302 Bug #912: 1.4.3: Unit test in util-debug.c: line too long.
303 Bug #914: Having a high number of pickup queues (216+) makes suricata crash
304 Bug #915: 1.4.3: log-pcap.c: crash on printing a null filename
305 Bug #917: 1.4.5: decode-ipv6.c: void function cannot return value
306 Bug #920: Suricata failed to parse address
307 Bug #922: trackers value in suricata.yaml
308 Bug #925: prealloc-sessions value bigger than allowed in suricata.yaml
309 Bug #926: prealloc host value in suricata.yaml
310 Bug #927: detect-thread-ratio given a non numeric value in suricata.yaml
311 Bug #928: Max number of threads
312 Bug #932: wrong IP version - on stacked layers
313 Bug #939: thread name buffers are sized inconsistently
314 Bug #943: pfring: see if we can report that the module is not loaded
315 Bug #948: apple ppc64 build broken: thread-local storage not supported for this target
316 Bug #958: SSL parsing issue (master)
317 Bug #963: XFF compile failure on OSX
318 Bug #964: Modify negated content handling
319 Bug #967: threshold rule clobbers suppress rules
320 Bug #968: unified2 not logging tagged packets
321 Bug #970: AC memory read error
322 Bug #973: Use different ids for content patterns which are the same, but one of them has a fast_pattern chop set on it.
323 Bug #976: ip_rep supplying different no of alerts for 2 different but semantically similar rules
324 Bug #979: clean up app layer protocol detection memory
325 Bug #982: http events missing
326 Bug #987: default config generates error(s)
327 Bug #988: suricata don't exit in live mode
328 Bug #989: Segfault in HTPStateGetTxCnt after a few minutes
329 Bug #991: threshold mem leak
330 Bug #994: valgrind warnings in unittests
331 Bug #995: tag keyword: tagging sessions per time is broken
332 Bug #998: rule reload triggers app-layer-event FP's
333 Bug #999: delayed detect inits thresholds before de_ctx
334 Bug #1003: Segmentation fault
335 Bug #1023: block rule reloads during delayed detect init
336 Bug #1026: pfring: update configure to link with -lrt
337 Bug #1031: Fix IPv6 stream pseudo packets
338 Bug #1035: http uri/query normalization normalizes 'plus' sign to space
339 Bug #1042: Can't match "emailAddress" field in tls.subject and tls.issuerdn
340 Bug #1061: Multiple flowbit set in one rule
341 Feature #234: add option disable/enable individual app layer protocol inspection modules
342 Feature #417: ip fragmentation time out feature in yaml
343 Feature #478: XFF (X-Forwarded-For)
344 Feature #602: availability for http.log output - identical to apache log format
345 Feature #622: Specify number of pf_ring/af_packet receive threads on the command line
346 Feature #727: Explore the support for negated alprotos in sigs.
347 Feature #746: Decoding API modification
348 Feature #751: Add invalid packet counter
349 Feature #752: Improve checksum detection algorithm
350 Feature #789: Clean-up start and stop code
351 Feature #813: VLAN flow support
352 Feature #878: add storage api
353 Feature #901: VLAN defrag support
354 Feature #904: store tx id when generating an alert
355 Feature #940: randomize http body chunks sizes
356 Feature #944: detect nic offloading
357 Feature #956: Implement IPv6 reject
358 Feature #957: reject: iface setup
359 Feature #959: Move post config initialisation code to PostConfLoadedSetup
360 Feature #981: Update all switch case fall throughs with comments on false throughs
361 Feature #983: Provide rule support for specifying icmpv4 and icmpv6.
362 Feature #986: set htp request and response size limits
363 Feature #1008: Optionally have http_uri buffer start with uri path for use in proxied environments
364 Feature #1009: Yaml file inclusion support
365 Feature #1032: profiling: per keyword stats
366 Optimization #583: improve Packet_ structure layout
367 Optimization #1018: clean up counters api
368 Optimization #1041: remove mkinstalldirs from git
370 2.0beta1 -- 2013-07-18
372 - Luajit flow vars and flow ints support (#593)
373 - DNS parser, logger and keyword support (#792), funded by Emerging Threats
374 - deflate support for HTTP response bodies (#470, #775)
375 - update to libhtp 0.5 (#775)
376 - improved gzip support for HTTP response bodies (#470, #775)
377 - redesigned transaction handling, improving both accuracy and performance (#753)
378 - redesigned CUDA support (#729)
379 - Be sure to always apply verdict to NFQ packet (#769)
380 - stream engine: SACK allocs should adhere to memcap (#794)
381 - stream: deal with multiple different SYN/ACK's better (#796)
382 - stream: Randomize stream chunk size for raw stream inspection (#804)
383 - Introduce per stream thread ssn pool (#519)
384 - "pass" IP-only rules should bypass detection engine after matching (#718)
385 - Generate error if bpf is used in IPS mode (#777)
386 - Add support for batch verdicts in NFQ, thanks to Florian Westphal
387 - Update Doxygen config, thanks to Phil Schroeder
388 - Improve libnss detection, thanks to Christian Kreibich
389 - Fix a FP on rules looking for port 0 and fragments (#847), thanks to Rmkml
390 - OS X unix socket build fixed (#830)
391 - bytetest, bytejump and byteextract negative offset failure (#827)
392 - Fix fast.log formatting issues (#771), thanks to Rmkml
393 - Invalidate negative depth (#774), thanks to Rmkml
394 - Fixed accuracy issues with relative pcre matching (#791)
395 - Fix deadlock in flowvar capture code (#802)
396 - Improved accuracy of file_data keyword (#817)
397 - Fix af-packet ips mode rule processing bug (#819), thanks to Laszlo Madarassy
398 - stream: fix injecting pseudo packet too soon leading to FP (#883), thanks to Francis Trudeau
402 - Bug #834: Unix socket - showing as compiled when it is not desired to do so
403 - Bug #835: Unix Socket not working as expected
404 - Bug #841: configure --enable-unix-socket does not err out if libs/pkgs are not present
405 - Bug #846: FP on IP frag and sig use udp port 0, thanks to Rmkml
406 - Bug #864: backport packet action macro's
407 - Bug #876: htp tunnel fix
408 - Bug #877: Flowbit check with content doesn't match consistently, thanks to Francis Trudeau
412 - Fix missed detection in bytetest, bytejump and byteextract for negative offset (#828)
413 - Fix IPS mode being unable to drop tunneled packets (#826)
414 - Fix OS X Unix Socket build (#829)
418 - No longer force nocase to be used on http_host
419 - Invalidate rule if uppercase content is used for http_host w/o nocase
420 - Warn user if bpf is used in af-packet IPS mode
421 - Better test for available libjansson version
422 - Fixed accuracy issues with relative pcre matching (#784)
423 - Improved accuracy of file_data keyword (#788)
424 - Invalidate negative depth (#770)
425 - Fix http host parsing for IPv6 addresses (#761)
426 - Fix fast.log formatting issues (#773)
427 - Fixed deadlock in flowvar set code for http buffers (#801)
428 - Various signature ordering improvements
429 - Minor stream engine fix
433 - GeoIP keyword, allowing matching on Maxmind's database, contributed by Ignacio Sanchez (#559)
434 - Introduce http_host and http_raw_host keywords (#733, #743)
435 - Add python module for interacting with unix socket (#767)
436 - Add new unix socket commands: fetching config, counters, basic runtime info (#764, #765)
437 - Big Napatech support update by Matt Keeler
438 - Configurable sensor id in unified2 output, contributed by Jake Gionet (#667)
439 - FreeBSD IPFW fixes by Nikolay Denev
440 - Add "default" interface setting to capture configuration in yaml (#679)
441 - Make sure "snaplen" can be set by the user (#680)
442 - Improve HTTP URI query string normalization (#739)
443 - Improved error reporting in MD5 loading (#693)
444 - Improve reference.config parser error reporting (#737)
445 - Improve build info output to include all configure options (#738)
446 - Segfault in TLS parsing reported by Charles Smutz (#725)
447 - Fix crash in teredo decoding, reported by Rmkml (#736)
448 - fixed UDPv4 packets without checksum being detected as invalid (#760)
449 - fixed DCE/SMB parsers getting confused in some fragmented cases (#764)
450 - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#697)
451 - FN: IP-only rule ip_proto not matching for some protocols (#689)
452 - Fix build failure with other libhtp installs (#688)
453 - Fix malformed yaml loading leading to a crash (#694)
454 - Various Mac OS X fixes (#700, #701, #703)
455 - Fix for autotools on Mac OS X by Jason Ish (#704)
456 - Fix AF_PACKET under high load not updating stats (#706)
460 - fix decoder event rules not checked in all cases (#671)
461 - checksum detection for icmpv6 was fixed (#673)
462 - crash in HTTP server body inspection code fixed (#675)
463 - fixed a icmpv6 payload bug (#676)
464 - IP-only rule ip_proto not matching for some protocols was addressed (#690)
465 - fixed malformed yaml crashing suricata (#702)
466 - parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#717)
467 - crash in tls parser was fixed (#759)
468 - fixed UDPv4 packets without checksum being detected as invalid (#762)
469 - fixed DCE/SMB parsers getting confused in some fragmented cases (#763)
473 - Decoder event matching fixed (#672)
474 - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#665)
475 - Add more events to IPv6 extension header anomolies (#678)
476 - Fix ICMPv6 payload and checksum calculation (#677, #674)
477 - Clean up flow timeout handling (#656)
478 - Fix a shutdown bug when using AF_PACKET under high load (#653)
479 - Fix TCP sessions being cleaned up to early (#652)
483 - Flow engine memory leak fixed by Ludovico Cavedon (#651)
484 - Unified2 would overwrite files if file rotation happened within a second of file creation, leading to loss of events/alerts (#664)
485 - Flow manager mutex used unintialized, fixed by Ludovico Cavedon (#654)
486 - Windows building in CYGWIN fixed (#630)
490 - Interactive unix socket mode (#571, #552)
491 - IP Reputation: loading and matching (#647)
492 - Improved --list-keywords commandline option gives detailed info for supported keyword, including doc link (#435)
493 - Rule analyzer improvement wrt ipv4/ipv6, invalid rules (#494)
494 - User-Agent added to file log and filestore meta files (#629)
495 - Endace DAG supports live stats and at exit drop stats (#638)
496 - Add support for libhtp event "request port doesn't match tcp port" (#650)
497 - Rules with negated addresses will not be considered IP-only (#599)
498 - Rule reloads complete much faster in low traffic conditions (#526)
499 - Suricata -h now displays all available options (#419)
500 - Luajit configure time detection was improved (#636)
501 - Flow manager mutex used w/o initialization (#628)
502 - Cygwin work around for windows shell mangling interface string (#372)
503 - Fix a Prelude output crash with alerts generated by rules w/o classtype or msg (#648)
504 - CLANG compiler build fixes (#649)
505 - Several fixes found by code analyzers
509 - support for Napatech cards was greatly improved by Matt Keeler from Npulse (#430, #619)
510 - support for pkt_data keyword was added
511 - user and group to run as can now be set in the config file
512 - make HTTP request and response body inspection sizes configurable per HTTP server config (#560)
513 - PCAP/AF_PACKET/PF_RING packet stats are now printed in stats.log (#561, #625)
514 - add contrib directory to the dist (#567)
515 - performance improvements to signatures with dsize option
516 - improved rule analyzer: print fast_pattern along with the rule (#558)
517 - fixes to stream engine reducing the number of events generated (#604)
518 - add stream event to match on overlaps with different data in stream reassembly (#603)
519 - stream.inline option new defaults to "auto", meaning enabled in IPS mode, disabled in IDS mode (#592)
520 - HTTP handling in OOM condition was greatly improved (#557)
521 - filemagic keyword performance was improved (#585)
522 - fixes and improvements to daemon mode (#624)
523 - fix drop rules not working correctly when thresholded (#613)
524 - fixed a possible FP when a regular and "chopped" fast_pattern were the same (#581)
525 - fix a false possitive condition in http_header (#607)
526 - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#627)
527 - fixes to rule profiling (#576)
528 - cleanups and misc fixes (#379, #395)
529 - updated bundled libhtp to 0.2.11
530 - build system improvements and cleanups
531 - fix to SSL record parsing
535 - fix crash in flow and host engines in cases of low memory or low memcap settings (#617)
536 - improve http handling in low memory conditions (#620)
537 - fix inaccuracy in byte_jump keyword when using "from_beginning" option (#626)
538 - fix building on OpenBSD 5.2
539 - update default config's defrag settings to reflect all available options
540 - fixes to make check
541 - fix to SSL record parsing
545 - fix drop rules not working correctly when thresholded (#615)
546 - fix a false possitive condition in http_header (#606)
547 - fix extracted file corruption (#601)
548 - fix a false possitive condition with the pcre keyword and relative matching (#588)
549 - fix PF_RING set cluster problem on dma interfaces (#598)
550 - improve http handling in low memory conditions (#586, #587)
551 - fix FreeBSD inline mode crash (#612)
552 - suppress pcre jit warning (#579)
554 1.4beta2 -- 2012-10-04
556 - New keyword: "luajit" to inspect packet, payload and all HTTP buffers with a Lua script (#346)
557 - Added ability to control per server HTTP parser settings in much more detail (#503)
558 - Rewrite of IP Defrag engine to improve performance and fix locking logic (#512, #540)
559 - Big performance improvement in inspecting decoder, stream and app layer events (#555)
560 - Pool performance improvements (#541)
561 - Improved performance of signatures with simple pattern setups (#577)
562 - Bundled docs are installed upon make install (#527)
563 - Support for a number of global vs rule thresholds [3] was added (#425)
564 - Improved rule profiling performance
565 - If not explicit fast_pattern is set, pick HTTP patterns over stream patterns. HTTP method, stat code and stat msg are excluded.
566 - Fix compilation on architectures other than x86 and x86_64 (#572)
567 - Fix FP with anchored pcre combined with relative matching (#529)
568 - Fix engine hanging instead of exitting if the pcap device doesn't exist (#533)
569 - Work around for potential FP, will get properly fixed in next release (#574)
570 - Improve ERF handling. Thanks to Jason Ish
571 - Always set cluster_id in PF_RING
572 - IPFW: fix broken broadcast handling
573 - AF_PACKET kernel offset issue, IPS fix and cleanup
574 - Fix stream engine sometimes resending the same data to app layer
575 - Fix multiple issues in HTTP multipart parsing
576 - Fixed a lockup at shutdown with NFQ (#537)
580 - Fixed a possible FP when a regular and "chopped" fast_pattern were the same (#562)
581 - Fixed a FN condition with the flow:no_stream option (#575)
582 - Fix building of perf profiling code on i386 platform. By Simon Moon (#534)
583 - Fix multiple issues in HTTP multipart parsing
584 - Fix stream engine sometimes resending the same data to app layer
585 - Always set cluster_id in PF_RING
586 - Defrag: silence some potentially noisy errors/warnings
587 - IPFW: fix broken broadcast handling
588 - AF_PACKET kernel offset issue
590 1.4beta1 -- 2012-09-06
592 - Custom HTTP logging contributed by Ignacio Sanchez (#530)
593 - TLS certificate logging and fingerprint computation and keyword (#443)
594 - TLS certificate store to disk feature (#444)
595 - Decoding of IPv4-in-IPv6, IPv6-in-IPv6 and Teredo tunnels (#462, #514, #480)
596 - AF_PACKET IPS support (#516)
597 - Rules can be set to inspect only IPv4 or IPv6 (#494)
598 - filesize keyword for matching on sizes of files in HTTP (#489)
599 - Delayed detect initialization. Starts processing packets right away and loads detection engine in the background (#522)
600 - NFQ fail open support (#507)
601 - Highly experimental lua scripting support for detection
602 - Live reloads now supports HTTP rule updates better (#522)
603 - AF_PACKET performance improvements (#197, #415)
604 - Make defrag more configurable (#517, #528)
605 - Improve pool performance (#518)
606 - Improve file inspection keywords by adding a separate API (#531)
607 - Example threshold.config file provided (#302)
608 - Fix building of perf profiling code on i386 platform. By Simon Moon (#534)
609 - Various spelling corrections by Simon Moon (#533)
613 - AF_PACKET performance improvements
614 - Defrag engine performance improvements
615 - HTTP: add per server options to enable/disable double decoding of URI (#464, #504)
616 - Stream engine packet handling for packets with non-standard flag combinations (#508)
617 - Improved stream engine handling of packet loss (#523)
618 - Stream engine checksum alerting fixed
619 - Various rule analyzer fixes (#495, #496, #497)
620 - (Rule) profiling fixed and improved (#460, #466)
621 - Enforce limit on max-pending-packets (#510)
622 - fast_pattern on negated content improved
623 - TLS rule keyword parsing issues
624 - Windows build fixes (#502)
625 - Host OS parsing issues fixed (#499)
626 - Reject signatures where content length is bigger than "depth" setting (#505)
627 - Removed unused "prune-flows" option
628 - Set main thread and live reload thread names (#498)
632 - make live rule reloads optional and disabled by default
634 - fix several memory leaks (#492)
635 - warn user if global and rule thresholding conflict (#455)
636 - set thread names on FreeBSD (Nikolay Denev)
637 - Fix PF_RING building on Ubuntu 12.04
638 - rule analyzer updates
639 - file inspection improvements when dealing with limits (#493)
643 - experimental live rule reload by sending a USR2 signal (#279)
644 - AF_PACKET BPF support (#449)
645 - AF_PACKET live packet loss counters (#441)
646 - Rule analyzer (#349)
647 - add pcap workers runmode for use with libpcap wrappers that support load balancing, such as Napatech's or Myricom's
648 - negated filemd5 matching, allowing for md5 whitelisting
649 - signatures with depth and/or offset are now checked against packets in addition to the stream (#404)
650 - http_cookie keyword now also inspects "Set-Cookie" header (#479)
651 - filemd5 keyword no longer depends on log-file output module (#447)
652 - http_raw_header keyword inspects original header line terminators (#475)
653 - deal with double encoded URI (#464)
654 - improved SMB/SMB2/DCERPC robustness
655 - ICMPv6 parsing fixes
656 - improve HTTP body inspection
657 - stream.inline accuracy issues fixed (#339)
658 - general stability fixes (#482, #486)
659 - missing unittests added (#471)
660 - "threshold.conf not found" error made more clear (#446)
661 - IPS mode segment logging for Unified2 improved
663 1.3beta2 -- 2012-06-08
665 - experimental support for matching on large lists of known file MD5 checksums
666 - Improved performance for file_data, http_server_body and http_client_body keywords
667 - Improvements to HTTP handling: multipart parsing, gzip decompression
668 - Byte_extract can support negative offsets now (#445)
669 - Support for PF_RING 5.4 added. Many thanks to Chris Wakelin (#459)
670 - HOME_NET and EXTERNAL_NET and the other vars are now checked for common errors (#454)
671 - Improved error reporting when using too long address strings (#451)
672 - MD5 calculation improvements for daemon mode and other cases (#449)
673 - File inspection scripts: Added Syslog action for logging to local syslog. Thanks to Martin Holste.
674 - Rule parser is made more strict.
675 - Unified2 output overhaul, logging individual segments in more cases.
676 - detection_filter keyword accuracy problem was fixed (#453)
677 - Don't inspect cookie header with http header (#461)
678 - Crash with a rule with two byte_extract keywords (#456)
679 - SSL parser fixes. Thanks to Chris Wakelin for testing the patches! (#476)
680 - Accuracy issues in HTTP inspection fixed. Thanks to Rmkml (#452)
681 - Improve escaping of some characters in logs (#418)
682 - Checksum calculation bugs fixed
683 - IPv6 parsing issues fixed. Thanks to Michel Saborde.
684 - Endace DAG issues fixed. Thanks to Jason Ish from Endace.
685 - Various OpenBSD related fixes.
686 - Fixes for bugs found by Coverity source code analyzer.
688 1.3beta1 -- 2012-04-04
690 - TLS/SSL handshake parser, tls.subjectdn and tls.issuerdn keywords (#296, contributed by Pierre Chifflier)
691 - Napatech capture card support (contributed by Randy Caldejon -- nPulse)
692 - Scripts for looking up files / file md5's at Virus Total and others (contributed by Martin Holste)
693 - Test mode: -T option to test the config (#271)
694 - Ringbuffer and zero copy support for AF_PACKET
695 - Commandline options to list supported app layer protocols and keywords (#344, #414)
696 - File extraction for HTTP POST request that do not use multipart bodies
697 - On the fly md5 checksum calculation of extracted files
698 - Line based file log, in json format
699 - Basic support for including other yaml files into the main yaml
700 - New multi pattern engine: ac-bs
701 - Profiling improvements, added lock profiling code
702 - Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys)
703 - Unified yaml naming convention, including fallback support (by Nikolay Denev)
704 - Improved Endace DAG support (#431, Jason Ish -- Endace)
705 - New default runmode: "autofp" (#433)
706 - Major rewrite of flow engine, improving scalability.
707 - Improved http_stat_msg and http_stat_code keywords (#394)
708 - Improved scalability for Tag and Threshold subsystems
709 - Made the rule keyword parser much stricter in detecting syntax errors
710 - Split "file" output into "file-store" and "file-log" outputs
711 - Much improved file extraction
712 - CUDA build fixes (#421)
713 - Various FP's reported by Rmkml (#403, #405, #411)
714 - IPv6 decoding and detection issues (reported by Michel Sarborde)
715 - PCAP logging crash (#422)
716 - Fixed many (potential) issues with the help of the Coverity source code analyzer
717 - Fixed several (potential) issues with the help of the cppcheck and clang/scan-build source code analyzers
721 - fix malformed unified2 records when writing alerts trigger by stream inspection (#402)
722 - only force a pseudo packet inspection cycle for TCP streams in a state >= established
726 - improved Windows/CYGWIN path handling (#387)
727 - fixed some issues with passing an interface or ip address with -i
728 - make live worker runmode threads adhere to the 'detect' cpu affinity settings
732 - app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events
733 - auto detection of checksum offloading per interface (#311)
734 - urilen options to match on raw or normalized URI (#341)
735 - flow keyword option "only_stream" and "no_stream"
736 - unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250)
737 - in IPS mode, reject rules now also drop (#399)
738 - http_header now also inspects response headers (#389)
739 - "worker" runmodes for NFQ and IPFW
740 - performance improvement for "ac" pattern matcher
741 - allow empty/non-initialized flowints to be incremented
742 - PCRE-JIT is now enabled by default if available (#356)
743 - many file inspection and extraction improvements
744 - flowbits and flowints are now modified in a post-match action list
745 - general performance increasements
746 - fixed parsing really high sid numbers >2 Billion (#393)
747 - fixed ICMPv6 not matching in IP-only sigs (#363)
749 1.2beta1 -- 2011-12-19
751 - File name, type inspection and extraction for HTTP
752 - filename, fileext, filemagic and filestore keywords added
753 - "file" output for storing extracted files to disk
754 - file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241
755 - new keyword http_server_body, pcre regex /S option
756 - Option to enable/disable core dumping from the suricata.yaml (enabled by default)
757 - Human readable size limit settings in suricata.yaml
758 - PF_RING bpf support (required PF_RING >= 5.1) (feature #334)
759 - tos keyword support (feature #364)
760 - IPFW IPS mode does now support multiple divert sockets
761 - New IPS running modes, Linux and FreeBSD do now support "worker" and "autofp"
762 - Improved alert accuracy in autofp and single runmodes
763 - major performance optimizations for the ac-gfbs pattern matcher implementation
764 - unified2 output fixes
765 - PF_RING supports privilege dropping now (bug #367)
766 - Improved detection of duplicate signatures
770 - Fix for a error in the smtp parser that could crash Suricata.
771 - Fix for AF_PACKET not compiling on modern linux systems like Fedora 16.
776 - minor pcap, AF_PACKET and PF_RING fixes (#368)
778 - Windows CYGWIN build
783 - extended HTTP request logging for use with (among other things) http_agent for Sguil (#38)
784 - AF_PACKET report drop stats on shutdown (#325)
785 - new counters in stats.log for flow and stream engines (#348)
786 - SMTP parsing code support for BDAT command (#347)
787 - HTTP URI normalization no longer converts to lowercase (#362)
788 - AF_PACKET works with privileges dropping now (#361)
789 - Prelude output for state matches (#264, #355)
790 - update of the pattern matching code that should improve accuracy
791 - rule parser was made more strict (#295, #312)
792 - multiple event suppressions for the same SID was fixed (#366)
793 - several accuracy fixes
794 - removal of the unified1 output plugins (#353)
796 1.1beta3 -- 2011-10-25
798 - af-packet support for high speed packet capture
799 - "replace" keyword support (#303)
800 - new "workers" runmode for multi-dev and/or clustered PF_RING, AF_PACKET, pcap
801 - added "stream-event" keyword to match on TCP session anomalies
802 - support for suppress keyword was added (#274)
803 - byte_extract keyword support was added
804 - improved handling of timed out TCP sessions in the detection engine
805 - unified2 payload logging if detection was in the HTTP state (#264)
806 - improved accuracy of the HTTP transaction logging
807 - support for larger (64 bit) Flow/Stream memcaps (#332)
808 - major speed improvements for PCRE, including support for PCRE JIT
809 - support setting flowbits in ip-only rules (#292)
810 - performance increases on SSE3+ CPU's
811 - overhaul of the packet acquisition subsystem
812 - packet based performance profiling subsystem was added
813 - TCP SACK support was added to the stream engine
814 - updated included libhtp to 0.2.6 which fixes several issues
816 1.1beta2 -- 2011-04-13
818 - New keyword support: http_raw_uri (including /I for pcre), ssl_state, ssl_version (#258, #259, #260, #262).
819 - Inline mode for the stream engine (#230, #248).
820 - New keyword support: nfq_set_mark
821 - Included an example decoder-events.rules file
822 - api for adding and selecting runmodes was added
823 - pcap logging / recording output was added
824 - basic SCTP protocol parsing was added
825 - more fine grained CPU affinity setting support was added
826 - stream engine inspects stream in larger chunks
827 - fast_pattern support for http_method content modifier (#255)
828 - negation support for isdataat keyword (#257)
829 - configurable interval for stats.log updates (#247)
830 - new pf_ring runmode was added that scales better
831 - pcap live mode now handles the monitor interface going up and down
832 - several QA additions to "make check"
833 - NFQ (linux inline) mode was improved
834 - Alerts classification fix (#275)
835 - compiles and runs on big-endian systems (#63)
836 - unified2 output works around barnyard2 issues with DLT_RAW + IPv6
838 1.1beta1 -- 2010-12-21
840 - New keyword support: http_raw_header, http_stat_msg, http_stat_code.
841 - A new default pattern matcher, Aho-Corasick based, that uses much less memory.
842 - reference.config support as supplied by ET/ETpro and VRT.
843 - Much improved fast_pattern support, including for http_uri, http_client_body, http_header, http_raw_header.
844 - Improved parsers, especially the DCERPC parser.
845 - Much improved performance & accuracy.
849 - Fix stream reassembly bug #300. Thanks to Rmkml for the report.
850 - Fix several (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat.
854 - LibHTP updated to 0.2.6
855 - Large number of (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat.
856 - Large number of (potential) issues fixed after source code scans with the Clang static analizer.
860 - Fix broken checksum calculation for TCP/UDP in some cases
861 - Fix errors in the byte_test, byte_jump, http_method and http_header keywords
862 - Fix a ASN1 parsing issue
863 - Improve LibHTP memory handling
865 - Fix several stream engine issues
projects / people / ms / suricata.git / blob