Merge pull request #2012 in SNORT/snort3 from ~RUCOMBS/snort3:new_stuff to master
Squashed commit of the following:
commit
442e97ad2054e74f008a9f800f1e99930e24e8af
Author: russ <rucombs@cisco.com>
Date: Sat Feb 15 10:27:32 2020 -0500
gtp_inspect: fix default port binding
The default snort.lua had a port binding to type = 'gtp' which is a typo.
The service is 'gtp' and the inspector is 'gtp_inspect'. Due to a flaw in
lookup, the inspector was being matched by service. To avoid confusing type
and service the lookups were separated. However, we silenty covert the old
type = 'gtp' bidings to type = 'gtp_inspect' until RC at which point this
deprecated usage support will be removed.
commit
215bd1e4829550183ae36198a3764245a3669cba
Author: russ <rucombs@cisco.com>
Date: Sat Feb 15 10:08:29 2020 -0500
inspectors: ensure correct lookup by type, name, or service
commit
db649915eddbf805d9f587dd985ec9bd254b4f37
Author: russ <rucombs@cisco.com>
Date: Sat Feb 8 10:12:19 2020 -0500
metadata: add --metadata-filter to load matching rules only
Rule metadata is a comma separated list of name-value tokens, eg:
metadata:impact_flag red,policy security-ips drop,ruleset community;
--metadata-filter f will load only rules where f appears in one of
the metadata tokens. "policy security" and "security-ips" would
both match the above example. Rules that are filtered out are
counted as "total rules not loaded" in the startup output.