]>
Commit | Line | Data |
---|---|---|
d774d6e2 VJ |
1 | 1.4beta2 -- 2012-10-04 |
2 | ||
3 | - New keyword: "luajit" to inspect packet, payload and all HTTP buffers with a Lua script (#346) | |
4 | - Added ability to control per server HTTP parser settings in much more detail (#503) | |
5 | - Rewrite of IP Defrag engine to improve performance and fix locking logic (#512, #540) | |
6 | - Big performance improvement in inspecting decoder, stream and app layer events (#555) | |
7 | - Pool performance improvements (#541) | |
8 | - Improved performance of signatures with simple pattern setups (#577) | |
9 | - Bundled docs are installed upon make install (#527) | |
10 | - Support for a number of global vs rule thresholds [3] was added (#425) | |
11 | - Improved rule profiling performance | |
12 | - If not explicit fast_pattern is set, pick HTTP patterns over stream patterns. HTTP method, stat code and stat msg are excluded. | |
13 | - Fix compilation on architectures other than x86 and x86_64 (#572) | |
14 | - Fix FP with anchored pcre combined with relative matching (#529) | |
15 | - Fix engine hanging instead of exitting if the pcap device doesn't exist (#533) | |
16 | - Work around for potential FP, will get properly fixed in next release (#574) | |
17 | - Improve ERF handling. Thanks to Jason Ish | |
18 | - Always set cluster_id in PF_RING | |
19 | - IPFW: fix broken broadcast handling | |
20 | - AF_PACKET kernel offset issue, IPS fix and cleanup | |
21 | - Fix stream engine sometimes resending the same data to app layer | |
22 | - Fix multiple issues in HTTP multipart parsing | |
23 | - Fixed a lockup at shutdown with NFQ (#537) | |
24 | ||
25 | 1.3.2 -- 2012-10-03 | |
26 | ||
27 | - Fixed a possible FP when a regular and "chopped" fast_pattern were the same (#562) | |
28 | - Fixed a FN condition with the flow:no_stream option (#575) | |
29 | - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) | |
30 | - Fix multiple issues in HTTP multipart parsing | |
31 | - Fix stream engine sometimes resending the same data to app layer | |
32 | - Always set cluster_id in PF_RING | |
33 | - Defrag: silence some potentially noisy errors/warnings | |
34 | - IPFW: fix broken broadcast handling | |
35 | - AF_PACKET kernel offset issue | |
36 | ||
fca70730 VJ |
37 | 1.4beta1 -- 2012-09-06 |
38 | ||
39 | - Custom HTTP logging contributed by Ignacio Sanchez (#530) | |
40 | - TLS certificate logging and fingerprint computation and keyword (#443) | |
41 | - TLS certificate store to disk feature (#444) | |
42 | - Decoding of IPv4-in-IPv6, IPv6-in-IPv6 and Teredo tunnels (#462, #514, #480) | |
43 | - AF_PACKET IPS support (#516) | |
44 | - Rules can be set to inspect only IPv4 or IPv6 (#494) | |
45 | - filesize keyword for matching on sizes of files in HTTP (#489) | |
46 | - Delayed detect initialization. Starts processing packets right away and loads detection engine in the background (#522) | |
47 | - NFQ fail open support (#507) | |
48 | - Highly experimental lua scripting support for detection | |
49 | - Live reloads now supports HTTP rule updates better (#522) | |
50 | - AF_PACKET performance improvements (#197, #415) | |
51 | - Make defrag more configurable (#517, #528) | |
52 | - Improve pool performance (#518) | |
53 | - Improve file inspection keywords by adding a separate API (#531) | |
54 | - Example threshold.config file provided (#302) | |
55 | - Fix building of perf profiling code on i386 platform. By Simon Moon (#534) | |
56 | - Various spelling corrections by Simon Moon (#533) | |
57 | ||
e28835af VJ |
58 | 1.3.1 -- 2012-08-21 |
59 | ||
60 | - AF_PACKET performance improvements | |
61 | - Defrag engine performance improvements | |
62 | - HTTP: add per server options to enable/disable double decoding of URI (#464, #504) | |
63 | - Stream engine packet handling for packets with non-standard flag combinations (#508) | |
64 | - Improved stream engine handling of packet loss (#523) | |
65 | - Stream engine checksum alerting fixed | |
66 | - Various rule analyzer fixes (#495, #496, #497) | |
67 | - (Rule) profiling fixed and improved (#460, #466) | |
68 | - Enforce limit on max-pending-packets (#510) | |
69 | - fast_pattern on negated content improved | |
70 | - TLS rule keyword parsing issues | |
71 | - Windows build fixes (#502) | |
72 | - Host OS parsing issues fixed (#499) | |
73 | - Reject signatures where content length is bigger than "depth" setting (#505) | |
74 | - Removed unused "prune-flows" option | |
75 | - Set main thread and live reload thread names (#498) | |
76 | ||
22957776 VJ |
77 | 1.3 -- 2012-07-06 |
78 | ||
79 | - make live rule reloads optional and disabled by default | |
80 | - fix a shutdown bug | |
81 | - fix several memory leaks (#492) | |
82 | - warn user if global and rule thresholding conflict (#455) | |
83 | - set thread names on FreeBSD (Nikolay Denev) | |
84 | - Fix PF_RING building on Ubuntu 12.04 | |
85 | - rule analyzer updates | |
86 | - file inspection improvements when dealing with limits (#493) | |
87 | ||
583ba460 VJ |
88 | 1.3rc1 -- 2012-06-29 |
89 | ||
90 | - experimental live rule reload by sending a USR2 signal (#279) | |
91 | - AF_PACKET BPF support (#449) | |
92 | - AF_PACKET live packet loss counters (#441) | |
93 | - Rule analyzer (#349) | |
94 | - add pcap workers runmode for use with libpcap wrappers that support load balancing, such as Napatech's or Myricom's | |
95 | - negated filemd5 matching, allowing for md5 whitelisting | |
96 | - signatures with depth and/or offset are now checked against packets in addition to the stream (#404) | |
97 | - http_cookie keyword now also inspects "Set-Cookie" header (#479) | |
98 | - filemd5 keyword no longer depends on log-file output module (#447) | |
99 | - http_raw_header keyword inspects original header line terminators (#475) | |
100 | - deal with double encoded URI (#464) | |
101 | - improved SMB/SMB2/DCERPC robustness | |
102 | - ICMPv6 parsing fixes | |
103 | - improve HTTP body inspection | |
104 | - stream.inline accuracy issues fixed (#339) | |
105 | - general stability fixes (#482, #486) | |
106 | - missing unittests added (#471) | |
107 | - "threshold.conf not found" error made more clear (#446) | |
108 | - IPS mode segment logging for Unified2 improved | |
109 | ||
110 | 1.3beta2 -- 2012-06-08 | |
ed9b07ef VJ |
111 | |
112 | - experimental support for matching on large lists of known file MD5 checksums | |
113 | - Improved performance for file_data, http_server_body and http_client_body keywords | |
114 | - Improvements to HTTP handling: multipart parsing, gzip decompression | |
115 | - Byte_extract can support negative offsets now (#445) | |
116 | - Support for PF_RING 5.4 added. Many thanks to Chris Wakelin (#459) | |
117 | - HOME_NET and EXTERNAL_NET and the other vars are now checked for common errors (#454) | |
118 | - Improved error reporting when using too long address strings (#451) | |
119 | - MD5 calculation improvements for daemon mode and other cases (#449) | |
120 | - File inspection scripts: Added Syslog action for logging to local syslog. Thanks to Martin Holste. | |
121 | - Rule parser is made more strict. | |
122 | - Unified2 output overhaul, logging individual segments in more cases. | |
123 | - detection_filter keyword accuracy problem was fixed (#453) | |
124 | - Don't inspect cookie header with http header (#461) | |
125 | - Crash with a rule with two byte_extract keywords (#456) | |
126 | - SSL parser fixes. Thanks to Chris Wakelin for testing the patches! (#476) | |
127 | - Accuracy issues in HTTP inspection fixed. Thanks to Rmkml (#452) | |
128 | - Improve escaping of some characters in logs (#418) | |
129 | - Checksum calculation bugs fixed | |
130 | - IPv6 parsing issues fixed. Thanks to Michel Saborde. | |
131 | - Endace DAG issues fixed. Thanks to Jason Ish from Endace. | |
132 | - Various OpenBSD related fixes. | |
133 | - Fixes for bugs found by Coverity source code analyzer. | |
134 | ||
fbe0206c VJ |
135 | 1.3beta1 -- 2012-04-04 |
136 | ||
137 | - TLS/SSL handshake parser, tls.subjectdn and tls.issuerdn keywords (#296, contributed by Pierre Chifflier) | |
138 | - Napatech capture card support (contributed by Randy Caldejon -- nPulse) | |
139 | - Scripts for looking up files / file md5's at Virus Total and others (contributed by Martin Holste) | |
140 | - Test mode: -T option to test the config (#271) | |
141 | - Ringbuffer and zero copy support for AF_PACKET | |
142 | - Commandline options to list supported app layer protocols and keywords (#344, #414) | |
143 | - File extraction for HTTP POST request that do not use multipart bodies | |
144 | - On the fly md5 checksum calculation of extracted files | |
145 | - Line based file log, in json format | |
146 | - Basic support for including other yaml files into the main yaml | |
147 | - New multi pattern engine: ac-bs | |
148 | - Profiling improvements, added lock profiling code | |
149 | - Improved HTTP CONNECT support in libhtp (#427, Brian Rectanus -- Qualys) | |
150 | - Unified yaml naming convention, including fallback support (by Nikolay Denev) | |
151 | - Improved Endace DAG support (#431, Jason Ish -- Endace) | |
152 | - New default runmode: "autofp" (#433) | |
153 | - Major rewrite of flow engine, improving scalability. | |
154 | - Improved http_stat_msg and http_stat_code keywords (#394) | |
155 | - Improved scalability for Tag and Threshold subsystems | |
156 | - Made the rule keyword parser much stricter in detecting syntax errors | |
157 | - Split "file" output into "file-store" and "file-log" outputs | |
158 | - Much improved file extraction | |
159 | - CUDA build fixes (#421) | |
160 | - Various FP's reported by Rmkml (#403, #405, #411) | |
161 | - IPv6 decoding and detection issues (reported by Michel Sarborde) | |
162 | - PCAP logging crash (#422) | |
163 | - Fixed many (potential) issues with the help of the Coverity source code analyzer | |
164 | - Fixed several (potential) issues with the help of the cppcheck and clang/scan-build source code analyzers | |
165 | ||
65d1783b VJ |
166 | 1.2.1 -- 2012-01-20 |
167 | ||
168 | - fix malformed unified2 records when writing alerts trigger by stream inspection (#402) | |
169 | - only force a pseudo packet inspection cycle for TCP streams in a state >= established | |
170 | ||
5b42f360 VJ |
171 | 1.2 -- 2012-01-19 |
172 | ||
173 | - improved Windows/CYGWIN path handling (#387) | |
174 | - fixed some issues with passing an interface or ip address with -i | |
175 | - make live worker runmode threads adhere to the 'detect' cpu affinity settings | |
176 | ||
e192ce7e VJ |
177 | 1.2rc1 -- 2012-01-11 |
178 | ||
179 | - app-layer-events keyword: similar to the decoder-events and stream-events, this will allow matching on HTTP and SMTP events | |
180 | - auto detection of checksum offloading per interface (#311) | |
181 | - urilen options to match on raw or normalized URI (#341) | |
182 | - flow keyword option "only_stream" and "no_stream" | |
183 | - unixsock output options for all outputs except unified2 (PoC python script in the qa/ dir) (#250) | |
184 | - in IPS mode, reject rules now also drop (#399) | |
185 | - http_header now also inspects response headers (#389) | |
186 | - "worker" runmodes for NFQ and IPFW | |
187 | - performance improvement for "ac" pattern matcher | |
188 | - allow empty/non-initialized flowints to be incremented | |
189 | - PCRE-JIT is now enabled by default if available (#356) | |
190 | - many file inspection and extraction improvements | |
191 | - flowbits and flowints are now modified in a post-match action list | |
192 | - general performance increasements | |
193 | - fixed parsing really high sid numbers >2 Billion (#393) | |
194 | - fixed ICMPv6 not matching in IP-only sigs (#363) | |
195 | ||
c0cd2c85 VJ |
196 | 1.2beta1 -- 2011-12-19 |
197 | ||
198 | - File name, type inspection and extraction for HTTP | |
199 | - filename, fileext, filemagic and filestore keywords added | |
200 | - "file" output for storing extracted files to disk | |
201 | - file_data keyword support, inspecting normalized, dechunked, decompressed HTTP response body (feature #241 | |
202 | - new keyword http_server_body, pcre regex /S option | |
203 | - Option to enable/disable core dumping from the suricata.yaml (enabled by default) | |
204 | - Human readable size limit settings in suricata.yaml | |
205 | - PF_RING bpf support (required PF_RING >= 5.1) (feature #334) | |
206 | - tos keyword support (feature #364) | |
207 | - IPFW IPS mode does now support multiple divert sockets | |
208 | - New IPS running modes, Linux and FreeBSD do now support "worker" and "autofp" | |
209 | - Improved alert accuracy in autofp and single runmodes | |
210 | - major performance optimizations for the ac-gfbs pattern matcher implementation | |
211 | - unified2 output fixes | |
212 | - PF_RING supports privilege dropping now (bug #367) | |
213 | - Improved detection of duplicate signatures | |
214 | ||
215 | 1.1.1 -- 2011-12-07 | |
216 | ||
217 | - Fix for a error in the smtp parser that could crash Suricata. | |
218 | - Fix for AF_PACKET not compiling on modern linux systems like Fedora 16. | |
219 | ||
6256d6b5 VJ |
220 | 1.1 -- 2011-11-10 |
221 | ||
222 | - CUDA build fixed | |
223 | - minor pcap, AF_PACKET and PF_RING fixes (#368) | |
224 | - bpf handling fix | |
225 | - Windows CYGWIN build | |
226 | - more cleanups | |
227 | ||
228 | 1.1rc1 -- 2011-11-03 | |
229 | ||
230 | - extended HTTP request logging for use with (among other things) http_agent for Sguil (#38) | |
231 | - AF_PACKET report drop stats on shutdown (#325) | |
232 | - new counters in stats.log for flow and stream engines (#348) | |
233 | - SMTP parsing code support for BDAT command (#347) | |
234 | - HTTP URI normalization no longer converts to lowercase (#362) | |
235 | - AF_PACKET works with privileges dropping now (#361) | |
236 | - Prelude output for state matches (#264, #355) | |
237 | - update of the pattern matching code that should improve accuracy | |
238 | - rule parser was made more strict (#295, #312) | |
239 | - multiple event suppressions for the same SID was fixed (#366) | |
240 | - several accuracy fixes | |
241 | - removal of the unified1 output plugins (#353) | |
242 | ||
243 | 1.1beta3 -- 2011-10-25 | |
244 | ||
245 | - af-packet support for high speed packet capture | |
246 | - "replace" keyword support (#303) | |
247 | - new "workers" runmode for multi-dev and/or clustered PF_RING, AF_PACKET, pcap | |
248 | - added "stream-event" keyword to match on TCP session anomalies | |
249 | - support for suppress keyword was added (#274) | |
250 | - byte_extract keyword support was added | |
251 | - improved handling of timed out TCP sessions in the detection engine | |
252 | - unified2 payload logging if detection was in the HTTP state (#264) | |
253 | - improved accuracy of the HTTP transaction logging | |
254 | - support for larger (64 bit) Flow/Stream memcaps (#332) | |
255 | - major speed improvements for PCRE, including support for PCRE JIT | |
256 | - support setting flowbits in ip-only rules (#292) | |
257 | - performance increases on SSE3+ CPU's | |
258 | - overhaul of the packet acquisition subsystem | |
259 | - packet based performance profiling subsystem was added | |
260 | - TCP SACK support was added to the stream engine | |
261 | - updated included libhtp to 0.2.6 which fixes several issues | |
262 | ||
263 | 1.1beta2 -- 2011-04-13 | |
264 | ||
265 | - New keyword support: http_raw_uri (including /I for pcre), ssl_state, ssl_version (#258, #259, #260, #262). | |
266 | - Inline mode for the stream engine (#230, #248). | |
267 | - New keyword support: nfq_set_mark | |
268 | - Included an example decoder-events.rules file | |
269 | - api for adding and selecting runmodes was added | |
270 | - pcap logging / recording output was added | |
271 | - basic SCTP protocol parsing was added | |
272 | - more fine grained CPU affinity setting support was added | |
273 | - stream engine inspects stream in larger chunks | |
274 | - fast_pattern support for http_method content modifier (#255) | |
275 | - negation support for isdataat keyword (#257) | |
276 | - configurable interval for stats.log updates (#247) | |
277 | - new pf_ring runmode was added that scales better | |
278 | - pcap live mode now handles the monitor interface going up and down | |
279 | - several QA additions to "make check" | |
280 | - NFQ (linux inline) mode was improved | |
281 | - Alerts classification fix (#275) | |
282 | - compiles and runs on big-endian systems (#63) | |
283 | - unified2 output works around barnyard2 issues with DLT_RAW + IPv6 | |
284 | ||
285 | 1.1beta1 -- 2010-12-21 | |
286 | ||
287 | - New keyword support: http_raw_header, http_stat_msg, http_stat_code. | |
288 | - A new default pattern matcher, Aho-Corasick based, that uses much less memory. | |
289 | - reference.config support as supplied by ET/ETpro and VRT. | |
290 | - Much improved fast_pattern support, including for http_uri, http_client_body, http_header, http_raw_header. | |
291 | - Improved parsers, especially the DCERPC parser. | |
292 | - Much improved performance & accuracy. | |
293 | ||
294 | 1.0.5 -- 2011-07-25 | |
295 | ||
296 | - Fix stream reassembly bug #300. Thanks to Rmkml for the report. | |
297 | - Fix several (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. | |
298 | ||
299 | 1.0.4 -- 2011-06-24 | |
300 | ||
301 | - LibHTP updated to 0.2.6 | |
302 | - Large number of (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat. | |
303 | - Large number of (potential) issues fixed after source code scans with the Clang static analizer. | |
304 | ||
305 | 1.0.3 -- 2011-04-13 | |
306 | ||
307 | - Fix broken checksum calculation for TCP/UDP in some cases | |
308 | - Fix errors in the byte_test, byte_jump, http_method and http_header keywords | |
309 | - Fix a ASN1 parsing issue | |
310 | - Improve LibHTP memory handling | |
311 | - Fix a defrag issue | |
312 | - Fix several stream engine issues | |
313 |