Merge pull request #2119 in SNORT/snort3 from ~MIALTIZE/snort3:3.0.1_build_1 to master

Squashed commit of the following:

commit fea387971db1f4f7552af4f7a402a5b032efb218
Author: Michael Altizer <mialtize@cisco.com>
Date:   Tue Mar 31 09:59:58 2020 -0400

    build: generate and tag 3.0.1 build 1

diff --git a/ChangeLog b/ChangeLog
index ae6a93a8e59bbfb944afd746b7a8d171b75b9528..8f5e0090bd3e334bb69155ba5a31a6ab1ab8b160 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,23 @@
+2020/03/31 - 3.0.1 build 1
+
+-- analyzer: Send detained packet event when a packet is held
+-- appid: use http2 inspector for detection even if third-party module is present
+-- build: Increment version to 3.0.1
+-- dce_rpc: Fixed missing space in string
+-- doc: add FIXIT-E description
+-- http2_inspect: handle Cl and TE headers, and end_stream flags set on headers frames
+-- http2_inspect: multiple data frames support
+-- http_inspect: added FIXIT for thread safety
+-- http_inspect: eliminate empty body sections for missing message bodies
+-- latency: remove action config option and convert the log handler to trace_log message
+-- mime: fix data race in mime config
+-- modules: Support verbosity level for module trace options, modify trace logging macros.
+-- service_inspectors: standardize verbose config startup output for SMTP, POP and IMAP inspectors
+-- snort2lua: remove conversion of deprecated options pkt-log and rule-log
+-- so_rule: fix reload of shared object rules that use flow data
+-- src: update high priority "to be fixed" comments (FIXIT-H)
+-- stream_tcp: Out-of-order ACK processing fix
+
 2020/03/25 - build 270
 
 -- active: Base hold_packet() decision on DAQ message pool usage

diff --git a/doc/snort_manual.html b/doc/snort_manual.html
index 3d5a5329831f8a3657fd638d1f658ab9acbd8d55..b2dfffb5f8eb0a0f7edfde833982d4b1494d3937 100644 (file)
--- a/doc/snort_manual.html
+++ b/doc/snort_manual.html
@@ -782,7 +782,7 @@ asciidoc.install(2);
 <div class="literalblock">\r
 <div class="content">\r
 <pre><code> ,,_     -*&gt; Snort++ &lt;*-\r
-o"  )~   Version 3.0.0 (Build 270)\r
+o"  )~   Version 3.0.1 (Build 1)\r
  ''''    By Martin Roesch &amp; The Snort Team\r
          http://snort.org/contact#team\r
          Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.\r
@@ -7384,7 +7384,7 @@ string <strong><code>daq.modules[].variables[].variable</code></strong>: DAQ mod
 <div class="ulist"><ul>\r
 <li>\r
 <p>\r
-int <strong>decode.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>decode.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -7501,47 +7501,47 @@ bool <strong>detection.enable_address_anomaly_checks</strong> = false: enable ch
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.detect_engine</strong> = 0: enable detection engine trace logging { 0:max53 }\r
+int <strong>detection.trace.all</strong> = 0: enable detection module trace logging options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.rule_eval</strong> = 0: enable rule evaluation trace logging { 0:max53 }\r
+int <strong>detection.trace.detect_engine</strong> = 0: enable detection engine trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.buf_min</strong> = 0: enable min buffer trace logging { 0:max53 }\r
+int <strong>detection.trace.rule_eval</strong> = 0: enable rule evaluation trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.buf_verbose</strong> = 0: enable verbose buffer trace logging { 0:max53 }\r
+int <strong>detection.trace.buffer</strong> = 0: enable buffer trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.rule_vars</strong> = 0: enable rule variables trace logging { 0:max53 }\r
+int <strong>detection.trace.rule_vars</strong> = 0: enable rule variables trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.fp_search</strong> = 0: enable fast pattern search trace logging { 0:max53 }\r
+int <strong>detection.trace.fp_search</strong> = 0: enable fast pattern search trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.pkt_detect</strong> = 0: enable packet detection trace logging { 0:max53 }\r
+int <strong>detection.trace.pkt_detect</strong> = 0: enable packet detection trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.opt_tree</strong> = 0: enable tree option trace logging { 0:max53 }\r
+int <strong>detection.trace.opt_tree</strong> = 0: enable tree option trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.tag</strong> = 0: enable tag trace logging { 0:max53 }\r
+int <strong>detection.trace.tag</strong> = 0: enable tag trace logging { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -8120,11 +8120,6 @@ bool <strong>latency.packet.fastpath</strong> = false: fastpath expensive packet
 </li>\r
 <li>\r
 <p>\r
-enum <strong>latency.packet.action</strong> = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
 int <strong>latency.rule.max_time</strong> = 500: set timeout for rule evaluation (usec) { 0:max53 }\r
 </p>\r
 </li>\r
@@ -8145,7 +8140,7 @@ int <strong>latency.rule.max_suspend_time</strong> = 30000: set max time for sus
 </li>\r
 <li>\r
 <p>\r
-enum <strong>latency.rule.action</strong> = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
+int <strong>latency.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -9468,7 +9463,7 @@ implied <strong>snort.--trace</strong>: turn on main loop debug trace
 </li>\r
 <li>\r
 <p>\r
-int <strong>snort.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>snort.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -10932,7 +10927,7 @@ bool <strong>appid.log_all_sessions</strong> = false: enable logging of all appi
 </li>\r
 <li>\r
 <p>\r
-int <strong>appid.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>appid.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -11451,7 +11446,7 @@ bool <strong>dce_smb.smb_legacy_mode</strong> = false: inspect only SMBv1
 </li>\r
 <li>\r
 <p>\r
-int <strong>dce_smb.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>dce_smb.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -12171,7 +12166,7 @@ int <strong>dce_udp.max_frag_len</strong> = 65535: maximum fragment size for def
 </li>\r
 <li>\r
 <p>\r
-int <strong>dce_udp.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>dce_udp.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -13120,7 +13115,7 @@ int <strong><code>gtp_inspect[].infos[].length</code></strong> = 0: information
 </li>\r
 <li>\r
 <p>\r
-int <strong>gtp_inspect.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>gtp_inspect.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -13918,6 +13913,21 @@ bool <strong>http_inspect.simplify_path</strong> = true: reduce URI directory pa
 <strong>119:249</strong> (http_inspect) excessive HTTP parameter key repeats\r
 </p>\r
 </li>\r
+<li>\r
+<p>\r
+<strong>119:250</strong> (http_inspect) HTTP/2 Transfer-Encoding header other than identity\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>119:251</strong> (http_inspect) HTTP/2 message body overruns Content-Length header value\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>119:252</strong> (http_inspect) HTTP/2 message body smaller than Content-Length header value\r
+</p>\r
+</li>\r
 </ul></div>\r
 <div class="paragraph"><p>Peg counts:</p></div>\r
 <div class="ulist"><ul>\r
@@ -16533,6 +16543,12 @@ enum <strong>smtp.xlink2state</strong> = alert: enable/disable xlink2state alert
 </ul></div>\r
 </div>\r
 <div class="sect2">\r
+<h3 id="_so_proxy">so_proxy</h3>\r
+<div class="paragraph"><p>What: a proxy inspector to track flow data from SO rules (internal use only)</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Usage: global</p></div>\r
+</div>\r
+<div class="sect2">\r
 <h3 id="_ssh">ssh</h3>\r
 <div class="paragraph"><p>What: ssh inspection</p></div>\r
 <div class="paragraph"><p>Type: inspector</p></div>\r
@@ -16841,7 +16857,7 @@ int <strong>stream.file_cache.cap_weight</strong> = 32: additional bytes to trac
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -17072,7 +17088,7 @@ int <strong>stream_ip.session_timeout</strong> = 30: session tracking timeout {
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream_ip.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream_ip.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -17764,7 +17780,7 @@ int <strong>stream_user.session_timeout</strong> = 30: session tracking timeout
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream_user.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream_user.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -17896,6 +17912,11 @@ string <strong><code>wizard.spells[].to_client[].spell</code></strong>: sequence
 multi <strong>wizard.curses</strong>: enable service identification based on internal algorithm { dce_smb | dce_udp | dce_tcp }\r
 </p>\r
 </li>\r
+<li>\r
+<p>\r
+int <strong>wizard.trace.all</strong> = 0: enable traces in module { 0:255 }\r
+</p>\r
+</li>\r
 </ul></div>\r
 <div class="paragraph"><p>Peg counts:</p></div>\r
 <div class="ulist"><ul>\r
@@ -23903,10 +23924,49 @@ Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a
 </li>\r
 <li>\r
 <p>\r
-Presently using FIXIT-X where X = A | W | P | H | M | L | D, indicating\r
-  analysis, warning, perf, high, med, low priority, or deprecated.  Place A and\r
-  W comments on the exact warning line so we can match up comments and build\r
-  output.  Supporting comments can be added above.\r
+Presently using FIXIT-X where X is one of the characters below.  Place A\r
+  and W comments on the exact warning line so we can match up comments and\r
+  build output.  Supporting comments can be added above.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+A = known static analysis issue\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+D = deprecated - code to be removed after users update\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+E = enhancement - next steps for incomplete features (not a bug)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+H = high priority - urgent deficiency\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+L = low priority - cleanup or similar technical debt (not a bug)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+M = medium priority - suspected non-urgent deficiency\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+P = performance issue (not a bug)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+W = warning - known compiler warning\r
 </p>\r
 </li>\r
 <li>\r
@@ -25348,7 +25408,7 @@ bool <strong>appid.tp_appid_stats_enable</strong>: enable collection of stats an
 </li>\r
 <li>\r
 <p>\r
-int <strong>appid.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>appid.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26073,7 +26133,7 @@ int <strong>dce_smb.smb_max_compound</strong> = 3: SMB max compound size { 0:255
 </li>\r
 <li>\r
 <p>\r
-int <strong>dce_smb.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>dce_smb.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26123,12 +26183,12 @@ int <strong>dce_udp.max_frag_len</strong> = 65535: maximum fragment size for def
 </li>\r
 <li>\r
 <p>\r
-int <strong>dce_udp.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>dce_udp.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>decode.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>decode.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26208,47 +26268,47 @@ bool <strong>detection.pcre_to_regex</strong> = false: enable the use of regex i
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.buf_min</strong> = 0: enable min buffer trace logging { 0:max53 }\r
+int <strong>detection.trace.all</strong> = 0: enable detection module trace logging options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.buf_verbose</strong> = 0: enable verbose buffer trace logging { 0:max53 }\r
+int <strong>detection.trace.buffer</strong> = 0: enable buffer trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.detect_engine</strong> = 0: enable detection engine trace logging { 0:max53 }\r
+int <strong>detection.trace.detect_engine</strong> = 0: enable detection engine trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.fp_search</strong> = 0: enable fast pattern search trace logging { 0:max53 }\r
+int <strong>detection.trace.fp_search</strong> = 0: enable fast pattern search trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.opt_tree</strong> = 0: enable tree option trace logging { 0:max53 }\r
+int <strong>detection.trace.opt_tree</strong> = 0: enable tree option trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.pkt_detect</strong> = 0: enable packet detection trace logging { 0:max53 }\r
+int <strong>detection.trace.pkt_detect</strong> = 0: enable packet detection trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.rule_eval</strong> = 0: enable rule evaluation trace logging { 0:max53 }\r
+int <strong>detection.trace.rule_eval</strong> = 0: enable rule evaluation trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.rule_vars</strong> = 0: enable rule variables trace logging { 0:max53 }\r
+int <strong>detection.trace.rule_vars</strong> = 0: enable rule variables trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>detection.trace.tag</strong> = 0: enable tag trace logging { 0:max53 }\r
+int <strong>detection.trace.tag</strong> = 0: enable tag trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26883,7 +26943,7 @@ int <strong><code>gtp_inspect[].messages[].type</code></strong> = 0: message typ
 </li>\r
 <li>\r
 <p>\r
-int <strong>gtp_inspect.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>gtp_inspect.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -27558,11 +27618,6 @@ interval <strong>itype.~range</strong>: check if ICMP type is in given range { 0
 </li>\r
 <li>\r
 <p>\r
-enum <strong>latency.packet.action</strong> = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
 bool <strong>latency.packet.fastpath</strong> = false: fastpath expensive packets (max_time exceeded)\r
 </p>\r
 </li>\r
@@ -27573,11 +27628,6 @@ int <strong>latency.packet.max_time</strong> = 500: set timeout for packet laten
 </li>\r
 <li>\r
 <p>\r
-enum <strong>latency.rule.action</strong> = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
 int <strong>latency.rule.max_suspend_time</strong> = 30000: set max time for suspending a rule (ms, 0 means permanently disable rule) { 0:max32 }\r
 </p>\r
 </li>\r
@@ -27598,6 +27648,11 @@ int <strong>latency.rule.suspend_threshold</strong> = 5: set threshold for numbe
 </li>\r
 <li>\r
 <p>\r
+int <strong>latency.trace.all</strong> = 0: enable traces in module { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 bool <strong>log_codecs.file</strong> = false: output to log_codecs.txt instead of stdout\r
 </p>\r
 </li>\r
@@ -29633,7 +29688,7 @@ string <strong>snort.-t</strong>: &lt;dir&gt; chroots process to &lt;dir&gt; aft
 </li>\r
 <li>\r
 <p>\r
-int <strong>snort.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>snort.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -29988,7 +30043,7 @@ int <strong>stream_ip.session_timeout</strong> = 30: session tracking timeout {
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream_ip.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream_ip.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -30118,7 +30173,7 @@ bool <strong>stream_tcp.track_only</strong> = false: disable reassembly if true
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -30153,7 +30208,7 @@ int <strong>stream_user.session_timeout</strong> = 30: session tracking timeout
 </li>\r
 <li>\r
 <p>\r
-int <strong>stream_user.trace.all</strong> = 0: enabling traces in module { 0:max32 }\r
+int <strong>stream_user.trace.all</strong> = 0: enable traces in module { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -30348,6 +30403,11 @@ string <strong><code>wizard.spells[].to_server[].spell</code></strong>: sequence
 </li>\r
 <li>\r
 <p>\r
+int <strong>wizard.trace.all</strong> = 0: enable traces in module { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 interval <strong>wscale.~range</strong>: check if TCP window scale is in given range { 0:65535 }\r
 </p>\r
 </li>\r
@@ -35283,6 +35343,21 @@ interval <strong>wscale.~range</strong>: check if TCP window scale is in given r
 </li>\r
 <li>\r
 <p>\r
+<strong>119:250</strong> (http_inspect) HTTP/2 Transfer-Encoding header other than identity\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>119:251</strong> (http_inspect) HTTP/2 message body overruns Content-Length header value\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>119:252</strong> (http_inspect) HTTP/2 message body smaller than Content-Length header value\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>121:1</strong> (http2_inspect) error in HPACK integer value\r
 </p>\r
 </li>\r
@@ -36792,13 +36867,10 @@ change -&gt; perfmonitor: 'snortfile' ==&gt; 'output = 'file''
 change -&gt; perfmonitor: 'time' ==&gt; 'seconds'\r
 change -&gt; policy_mode: 'inline_test' ==&gt; 'inline-test'\r
 change -&gt; pop: 'ports' ==&gt; 'bindings'\r
-change -&gt; ppm: ''both'' ==&gt; ''alert_and_log''\r
 change -&gt; ppm: 'fastpath-expensive-packets' ==&gt; 'packet.fastpath'\r
 change -&gt; ppm: 'max-pkt-time' ==&gt; 'packet.max_time'\r
 change -&gt; ppm: 'max-rule-time' ==&gt; 'rule.max_time'\r
-change -&gt; ppm: 'pkt-log' ==&gt; 'packet.action'\r
 change -&gt; ppm: 'ppm' ==&gt; 'latency'\r
-change -&gt; ppm: 'rule-log' ==&gt; 'rule.action'\r
 change -&gt; ppm: 'suspend-expensive-rules' ==&gt; 'rule.suspend'\r
 change -&gt; ppm: 'suspend-timeout' ==&gt; 'max_suspend_time'\r
 change -&gt; ppm: 'threshold' ==&gt; 'rule.suspend_threshold'\r
@@ -38105,6 +38177,11 @@ deleted -&gt; unified2: 'vlan_event_types'</code></pre>
 </li>\r
 <li>\r
 <p>\r
+<strong>so_proxy</strong> (inspector): a proxy inspector to track flow data from SO rules (internal use only)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>soid</strong> (ips_option): rule option to specify a shared object rule ID\r
 </p>\r
 </li>\r
@@ -38715,6 +38792,11 @@ deleted -&gt; unified2: 'vlan_event_types'</code></pre>
 </li>\r
 <li>\r
 <p>\r
+<strong>inspector::so_proxy</strong>: a proxy inspector to track flow data from SO rules (internal use only)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>inspector::ssh</strong>: ssh inspection\r
 </p>\r
 </li>\r
@@ -39623,7 +39705,7 @@ Adding/removing stream_* inspectors if stream was already configured
 <div id="footer">\r
 <div id="footer-text">\r
 Last updated\r
- 2020-03-25 09:21:03 EDT\r
+ 2020-03-31 10:05:15 EDT\r
 </div>\r
 </div>\r
 </body>\r

diff --git a/doc/snort_manual.pdf b/doc/snort_manual.pdf
index 25d075a4731d73721a8ddebaa4f0fff3dfab7939..3357d45deb1d8674320cf32cd06d6251357d51b5 100644 (file)
Binary files a/doc/snort_manual.pdf and b/doc/snort_manual.pdf differ

diff --git a/doc/snort_manual.text b/doc/snort_manual.text
index 3a796612d2e0959ef6d3e9e125e6aa4179d98c92..2eb05478e48908fcecc91b933bf88451410038cd 100644 (file)
--- a/doc/snort_manual.text
+++ b/doc/snort_manual.text
@@ -182,17 +182,18 @@ Table of Contents
     9.39. s7commplus
     9.40. sip
     9.41. smtp
-    9.42. ssh
-    9.43. ssl
-    9.44. stream
-    9.45. stream_file
-    9.46. stream_icmp
-    9.47. stream_ip
-    9.48. stream_tcp
-    9.49. stream_udp
-    9.50. stream_user
-    9.51. telnet
-    9.52. wizard
+    9.42. so_proxy
+    9.43. ssh
+    9.44. ssl
+    9.45. stream
+    9.46. stream_file
+    9.47. stream_icmp
+    9.48. stream_ip
+    9.49. stream_tcp
+    9.50. stream_udp
+    9.51. stream_user
+    9.52. telnet
+    9.53. wizard
 
 10. IPS Action Modules
 
@@ -410,7 +411,7 @@ Table of Contents
 Snorty
 
  ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.0 (Build 270)
+o"  )~   Version 3.0.1 (Build 1)
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
@@ -5579,7 +5580,7 @@ Usage: context
 
 Configuration:
 
-  * int decode.trace.all = 0: enabling traces in module { 0:max32 }
+  * int decode.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -5628,23 +5629,23 @@ Configuration:
     instead of pcre for compatible expressions
   * bool detection.enable_address_anomaly_checks = false: enable
     check and alerting of address anomalies
+  * int detection.trace.all = 0: enable detection module trace
+    logging options { 0:255 }
   * int detection.trace.detect_engine = 0: enable detection engine
-    trace logging { 0:max53 }
+    trace logging { 0:255 }
   * int detection.trace.rule_eval = 0: enable rule evaluation trace
-    logging { 0:max53 }
-  * int detection.trace.buf_min = 0: enable min buffer trace logging
-    { 0:max53 }
-  * int detection.trace.buf_verbose = 0: enable verbose buffer trace
-    logging { 0:max53 }
+    logging { 0:255 }
+  * int detection.trace.buffer = 0: enable buffer trace logging {
+    0:255 }
   * int detection.trace.rule_vars = 0: enable rule variables trace
-    logging { 0:max53 }
+    logging { 0:255 }
   * int detection.trace.fp_search = 0: enable fast pattern search
-    trace logging { 0:max53 }
+    trace logging { 0:255 }
   * int detection.trace.pkt_detect = 0: enable packet detection trace
-    logging { 0:max53 }
+    logging { 0:255 }
   * int detection.trace.opt_tree = 0: enable tree option trace
-    logging { 0:max53 }
-  * int detection.trace.tag = 0: enable tag trace logging { 0:max53 }
+    logging { 0:255 }
+  * int detection.trace.tag = 0: enable tag trace logging { 0:255 }
 
 Peg counts:
 
@@ -5945,8 +5946,6 @@ Configuration:
     thresholding (usec) { 0:max53 }
   * bool latency.packet.fastpath = false: fastpath expensive packets
     (max_time exceeded)
-  * enum latency.packet.action = none: event action if packet times
-    out and is fastpathed { none | alert | log | alert_and_log }
   * int latency.rule.max_time = 500: set timeout for rule evaluation
     (usec) { 0:max53 }
   * bool latency.rule.suspend = false: temporarily suspend expensive
@@ -5956,8 +5955,7 @@ Configuration:
   * int latency.rule.max_suspend_time = 30000: set max time for
     suspending a rule (ms, 0 means permanently disable rule) {
     0:max32 }
-  * enum latency.rule.action = none: event action for rule latency
-    enable and suspend events { none | alert | log | alert_and_log }
+  * int latency.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -6562,7 +6560,7 @@ Configuration:
   * string snort.--x2s: output ASCII string for given byte code (see
     also --x2c)
   * implied snort.--trace: turn on main loop debug trace
-  * int snort.trace.all = 0: enabling traces in module { 0:max32 }
+  * int snort.trace.all = 0: enable traces in module { 0:255 }
 
 Commands:
 
@@ -7332,7 +7330,7 @@ Configuration:
     on startup
   * bool appid.log_all_sessions = false: enable logging of all appid
     sessions
-  * int appid.trace.all = 0: enabling traces in module { 0:max32 }
+  * int appid.trace.all = 0: enable traces in module { 0:255 }
 
 Commands:
 
@@ -7590,7 +7588,7 @@ Configuration:
     (-1 = disabled, 0 = unlimited) { -1:32767 }
   * string dce_smb.smb_invalid_shares: SMB shares to alert on
   * bool dce_smb.smb_legacy_mode = false: inspect only SMBv1
-  * int dce_smb.trace.all = 0: enabling traces in module { 0:max32 }
+  * int dce_smb.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -7852,7 +7850,7 @@ Configuration:
     defragmentation
   * int dce_udp.max_frag_len = 65535: maximum fragment size for
     defragmentation { 1514:65535 }
-  * int dce_udp.trace.all = 0: enabling traces in module { 0:max32 }
+  * int dce_udp.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -8292,8 +8290,7 @@ Configuration:
   * string gtp_inspect[].infos[].name: information element name
   * int gtp_inspect[].infos[].length = 0: information element type
     code { 0:255 }
-  * int gtp_inspect.trace.all = 0: enabling traces in module {
-    0:max32 }
+  * int gtp_inspect.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -8543,6 +8540,12 @@ Rules:
   * 119:248 (http_inspect) gzip compressed data followed by
     unexpected non-gzip data
   * 119:249 (http_inspect) excessive HTTP parameter key repeats
+  * 119:250 (http_inspect) HTTP/2 Transfer-Encoding header other than
+    identity
+  * 119:251 (http_inspect) HTTP/2 message body overruns
+    Content-Length header value
+  * 119:252 (http_inspect) HTTP/2 message body smaller than
+    Content-Length header value
 
 Peg counts:
 
@@ -9533,7 +9536,19 @@ Peg counts:
   * smtp.non_encoded_bytes: total non-encoded extracted bytes (sum)
 
 
-9.42. ssh
+9.42. so_proxy
+
+--------------
+
+What: a proxy inspector to track flow data from SO rules (internal
+use only)
+
+Type: inspector
+
+Usage: global
+
+
+9.43. ssh
 
 --------------
 
@@ -9571,7 +9586,7 @@ Peg counts:
     (max)
 
 
-9.43. ssl
+9.44. ssl
 
 --------------
 
@@ -9620,7 +9635,7 @@ Peg counts:
     (max)
 
 
-9.44. stream
+9.45. stream
 
 --------------
 
@@ -9661,7 +9676,7 @@ Configuration:
     before retiring session tracker { 1:max32 }
   * int stream.file_cache.cap_weight = 32: additional bytes to track
     per flow for better estimation against cap { 0:65535 }
-  * int stream.trace.all = 0: enabling traces in module { 0:max32 }
+  * int stream.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -9706,7 +9721,7 @@ Peg counts:
     deleted by config reloads (sum)
 
 
-9.45. stream_file
+9.46. stream_file
 
 --------------
 
@@ -9721,7 +9736,7 @@ Configuration:
   * bool stream_file.upload = false: indicate file transfer direction
 
 
-9.46. stream_icmp
+9.47. stream_icmp
 
 --------------
 
@@ -9746,7 +9761,7 @@ Peg counts:
   * stream_icmp.prunes: icmp session prunes (sum)
 
 
-9.47. stream_ip
+9.48. stream_ip
 
 --------------
 
@@ -9770,8 +9785,7 @@ Configuration:
     | linux | bsd | bsd_right | last | windows | solaris }
   * int stream_ip.session_timeout = 30: session tracking timeout {
     1:max31 }
-  * int stream_ip.trace.all = 0: enabling traces in module { 0:max32
-    }
+  * int stream_ip.trace.all = 0: enable traces in module { 0:255 }
 
 Rules:
 
@@ -9818,7 +9832,7 @@ Peg counts:
   * stream_ip.fragmented_bytes: total fragmented bytes (sum)
 
 
-9.48. stream_tcp
+9.49. stream_tcp
 
 --------------
 
@@ -9962,7 +9976,7 @@ Peg counts:
   * stream_tcp.partial_flush_bytes: partial flush total bytes (sum)
 
 
-9.49. stream_udp
+9.50. stream_udp
 
 --------------
 
@@ -9989,7 +10003,7 @@ Peg counts:
   * stream_udp.ignored: udp packets ignored (sum)
 
 
-9.50. stream_user
+9.51. stream_user
 
 --------------
 
@@ -10003,11 +10017,10 @@ Configuration:
 
   * int stream_user.session_timeout = 30: session tracking timeout {
     1:max31 }
-  * int stream_user.trace.all = 0: enabling traces in module {
-    0:max32 }
+  * int stream_user.trace.all = 0: enable traces in module { 0:255 }
 
 
-9.51. telnet
+9.52. telnet
 
 --------------
 
@@ -10041,7 +10054,7 @@ Peg counts:
     sessions (max)
 
 
-9.52. wizard
+9.53. wizard
 
 --------------
 
@@ -10073,6 +10086,7 @@ Configuration:
     wild cards (*)
   * multi wizard.curses: enable service identification based on
     internal algorithm { dce_smb | dce_udp | dce_tcp }
+  * int wizard.trace.all = 0: enable traces in module { 0:255 }
 
 Peg counts:
 
@@ -14221,11 +14235,18 @@ with.
   * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left
     for a day or even just a minute. That way we can find them easily
     and won’t lose track of them.
-  * Presently using FIXIT-X where X = A | W | P | H | M | L | D,
-    indicating analysis, warning, perf, high, med, low priority, or
-    deprecated. Place A and W comments on the exact warning line so
-    we can match up comments and build output. Supporting comments
-    can be added above.
+  * Presently using FIXIT-X where X is one of the characters below.
+    Place A and W comments on the exact warning line so we can match
+    up comments and build output. Supporting comments can be added
+    above.
+  * A = known static analysis issue
+  * D = deprecated - code to be removed after users update
+  * E = enhancement - next steps for incomplete features (not a bug)
+  * H = high priority - urgent deficiency
+  * L = low priority - cleanup or similar technical debt (not a bug)
+  * M = medium priority - suspected non-urgent deficiency
+  * P = performance issue (not a bug)
+  * W = warning - known compiler warning
   * Put the copyright(s) and license in a comment block at the top of
     each source file (.h and .cc). Don’t bother with trivial scripts
     and make foo. Some interesting Lua code should get a comment
@@ -14846,7 +14867,7 @@ these libraries see the Getting Started section of the manual.
     library
   * bool appid.tp_appid_stats_enable: enable collection of stats and
     print stats on exit in third party module
-  * int appid.trace.all = 0: enabling traces in module { 0:max32 }
+  * int appid.trace.all = 0: enable traces in module { 0:255 }
   * ip4 arp_spoof.hosts[].ip: host ip address
   * mac arp_spoof.hosts[].mac: host mac address
   * int asn1.absolute_offset: absolute offset from the beginning of
@@ -15072,7 +15093,7 @@ these libraries see the Getting Started section of the manual.
   * bool dce_smb.smb_legacy_mode = false: inspect only SMBv1
   * int dce_smb.smb_max_chain = 3: SMB max chain size { 0:255 }
   * int dce_smb.smb_max_compound = 3: SMB max compound size { 0:255 }
-  * int dce_smb.trace.all = 0: enabling traces in module { 0:max32 }
+  * int dce_smb.trace.all = 0: enable traces in module { 0:255 }
   * multi dce_smb.valid_smb_versions = all: valid SMB versions { v1 |
     v2 | all }
   * bool dce_tcp.disable_defrag = false: disable DCE/RPC
@@ -15092,8 +15113,8 @@ these libraries see the Getting Started section of the manual.
     per signature per flow
   * int dce_udp.max_frag_len = 65535: maximum fragment size for
     defragmentation { 1514:65535 }
-  * int dce_udp.trace.all = 0: enabling traces in module { 0:max32 }
-  * int decode.trace.all = 0: enabling traces in module { 0:max32 }
+  * int dce_udp.trace.all = 0: enable traces in module { 0:255 }
+  * int decode.trace.all = 0: enable traces in module { 0:255 }
   * int detection.asn1 = 0: maximum decode nodes { 0:65535 }
   * bool detection.enable_address_anomaly_checks = false: enable
     check and alerting of address anomalies
@@ -15122,23 +15143,23 @@ these libraries see the Getting Started section of the manual.
     overrides when pattern matching (ie ignore /O)
   * bool detection.pcre_to_regex = false: enable the use of regex
     instead of pcre for compatible expressions
-  * int detection.trace.buf_min = 0: enable min buffer trace logging
-    { 0:max53 }
-  * int detection.trace.buf_verbose = 0: enable verbose buffer trace
-    logging { 0:max53 }
+  * int detection.trace.all = 0: enable detection module trace
+    logging options { 0:255 }
+  * int detection.trace.buffer = 0: enable buffer trace logging {
+    0:255 }
   * int detection.trace.detect_engine = 0: enable detection engine
-    trace logging { 0:max53 }
+    trace logging { 0:255 }
   * int detection.trace.fp_search = 0: enable fast pattern search
-    trace logging { 0:max53 }
+    trace logging { 0:255 }
   * int detection.trace.opt_tree = 0: enable tree option trace
-    logging { 0:max53 }
+    logging { 0:255 }
   * int detection.trace.pkt_detect = 0: enable packet detection trace
-    logging { 0:max53 }
+    logging { 0:255 }
   * int detection.trace.rule_eval = 0: enable rule evaluation trace
-    logging { 0:max53 }
+    logging { 0:255 }
   * int detection.trace.rule_vars = 0: enable rule variables trace
-    logging { 0:max53 }
-  * int detection.trace.tag = 0: enable tag trace logging { 0:max53 }
+    logging { 0:255 }
+  * int detection.trace.tag = 0: enable tag trace logging { 0:255 }
   * bool dnp3.check_crc = false: validate checksums in DNP3 link
     layer frames
   * string dnp3_func.~: match DNP3 function code or name
@@ -15343,8 +15364,7 @@ these libraries see the Getting Started section of the manual.
   * string gtp_inspect[].messages[].name: message name
   * int gtp_inspect[].messages[].type = 0: message type code { 0:255
     }
-  * int gtp_inspect.trace.all = 0: enabling traces in module {
-    0:max32 }
+  * int gtp_inspect.trace.all = 0: enable traces in module { 0:255 }
   * int gtp_inspect[].version = 2: GTP version { 0:2 }
   * string gtp_type.~: list of types to match
   * int gtp_version.~: version to match { 0:2 }
@@ -15592,14 +15612,10 @@ these libraries see the Getting Started section of the manual.
     buffer
   * interval itype.~range: check if ICMP type is in given range {
     0:255 }
-  * enum latency.packet.action = none: event action if packet times
-    out and is fastpathed { none | alert | log | alert_and_log }
   * bool latency.packet.fastpath = false: fastpath expensive packets
     (max_time exceeded)
   * int latency.packet.max_time = 500: set timeout for packet latency
     thresholding (usec) { 0:max53 }
-  * enum latency.rule.action = none: event action for rule latency
-    enable and suspend events { none | alert | log | alert_and_log }
   * int latency.rule.max_suspend_time = 30000: set max time for
     suspending a rule (ms, 0 means permanently disable rule) {
     0:max32 }
@@ -15609,6 +15625,7 @@ these libraries see the Getting Started section of the manual.
     rules
   * int latency.rule.suspend_threshold = 5: set threshold for number
     of timeouts before suspending a rule { 1:max32 }
+  * int latency.trace.all = 0: enable traces in module { 0:255 }
   * bool log_codecs.file = false: output to log_codecs.txt instead of
     stdout
   * bool log_codecs.msg = false: include alert msg
@@ -16315,7 +16332,7 @@ these libraries see the Getting Started section of the manual.
     talos)
   * string snort.-t: <dir> chroots process to <dir> after
     initialization
-  * int snort.trace.all = 0: enabling traces in module { 0:max32 }
+  * int snort.trace.all = 0: enable traces in module { 0:255 }
   * implied snort.--trace: turn on main loop debug trace
   * implied snort.--treat-drop-as-alert: converts drop, block, and
     reset rules into alert rules when loaded
@@ -16433,8 +16450,7 @@ these libraries see the Getting Started section of the manual.
     | linux | bsd | bsd_right | last | windows | solaris }
   * int stream_ip.session_timeout = 30: session tracking timeout {
     1:max31 }
-  * int stream_ip.trace.all = 0: enabling traces in module { 0:max32
-    }
+  * int stream_ip.trace.all = 0: enable traces in module { 0:255 }
   * int stream.max_flows = 476288: maximum simultaneous flows tracked
     before pruning { 2:max32 }
   * int stream.pruning_timeout = 30: minimum inactive time before
@@ -16486,7 +16502,7 @@ these libraries see the Getting Started section of the manual.
   * int stream_tcp.small_segments.maximum_size = 0: minimum bytes for
     a TCP segment not to be considered small (129:12) { 0:2048 }
   * bool stream_tcp.track_only = false: disable reassembly if true
-  * int stream.trace.all = 0: enabling traces in module { 0:max32 }
+  * int stream.trace.all = 0: enable traces in module { 0:255 }
   * int stream.udp_cache.cap_weight = 128: additional bytes to track
     per flow for better estimation against cap { 0:65535 }
   * int stream.udp_cache.idle_timeout = 180: maximum inactive time
@@ -16499,8 +16515,7 @@ these libraries see the Getting Started section of the manual.
     before retiring session tracker { 1:max32 }
   * int stream_user.session_timeout = 30: session tracking timeout {
     1:max31 }
-  * int stream_user.trace.all = 0: enabling traces in module {
-    0:max32 }
+  * int stream_user.trace.all = 0: enable traces in module { 0:255 }
   * int suppress[].gid = 0: rule generator ID { 0:max32 }
   * string suppress[].ip: restrict suppression to these addresses
     according to track
@@ -16559,6 +16574,7 @@ these libraries see the Getting Started section of the manual.
     wild cards (*)
   * string wizard.spells[].to_server[].spell: sequence of data with
     wild cards (*)
+  * int wizard.trace.all = 0: enable traces in module { 0:255 }
   * interval wscale.~range: check if TCP window scale is in given
     range { 0:65535 }
 
@@ -17827,6 +17843,12 @@ these libraries see the Getting Started section of the manual.
   * 119:248 (http_inspect) gzip compressed data followed by
     unexpected non-gzip data
   * 119:249 (http_inspect) excessive HTTP parameter key repeats
+  * 119:250 (http_inspect) HTTP/2 Transfer-Encoding header other than
+    identity
+  * 119:251 (http_inspect) HTTP/2 message body overruns
+    Content-Length header value
+  * 119:252 (http_inspect) HTTP/2 message body smaller than
+    Content-Length header value
   * 121:1 (http2_inspect) error in HPACK integer value
   * 121:2 (http2_inspect) HPACK integer value has leading zeros
   * 121:3 (http2_inspect) error in HPACK string value
@@ -18307,13 +18329,10 @@ change -> perfmonitor: 'snortfile' ==> 'output = 'file''
 change -> perfmonitor: 'time' ==> 'seconds'
 change -> policy_mode: 'inline_test' ==> 'inline-test'
 change -> pop: 'ports' ==> 'bindings'
-change -> ppm: ''both'' ==> ''alert_and_log''
 change -> ppm: 'fastpath-expensive-packets' ==> 'packet.fastpath'
 change -> ppm: 'max-pkt-time' ==> 'packet.max_time'
 change -> ppm: 'max-rule-time' ==> 'rule.max_time'
-change -> ppm: 'pkt-log' ==> 'packet.action'
 change -> ppm: 'ppm' ==> 'latency'
-change -> ppm: 'rule-log' ==> 'rule.action'
 change -> ppm: 'suspend-expensive-rules' ==> 'rule.suspend'
 change -> ppm: 'suspend-timeout' ==> 'max_suspend_time'
 change -> ppm: 'threshold' ==> 'rule.suspend_threshold'
@@ -18848,6 +18867,8 @@ deleted -> unified2: 'vlan_event_types'
   * smtp (inspector): smtp inspection
   * snort (basic): command line configuration and shell commands
   * so (ips_option): rule option to call custom eval function
+  * so_proxy (inspector): a proxy inspector to track flow data from
+    SO rules (internal use only)
   * soid (ips_option): rule option to specify a shared object rule ID
   * ssh (inspector): ssh inspection
   * ssl (inspector): ssl inspection
@@ -18999,6 +19020,8 @@ deleted -> unified2: 'vlan_event_types'
   * inspector::s7commplus: s7commplus inspection
   * inspector::sip: sip inspection
   * inspector::smtp: smtp inspection
+  * inspector::so_proxy: a proxy inspector to track flow data from SO
+    rules (internal use only)
   * inspector::ssh: ssh inspection
   * inspector::ssl: ssl inspection
   * inspector::stream: common flow tracking

diff --git a/src/main/build.h b/src/main/build.h
index bc92893684c85e38678fd80d68cc36d5379927fd..46eb7321115333ccd7bf745af374aad4258ee8a2 100644 (file)
--- a/src/main/build.h
+++ b/src/main/build.h
@@ -12,7 +12,7 @@
 //                                               //
 //-----------------------------------------------//
 
-#define BUILD_NUMBER 0
+#define BUILD_NUMBER 1
 
 #ifndef EXTRABUILD
 #define BUILD STRINGIFY_MX(BUILD_NUMBER)