]> git.ipfire.org Git - thirdparty/snort3.git/commit
Merge pull request #2250 in SNORT/snort3 from ~RUCOMBS/snort3:aimless to master
authorRuss Combs (rucombs) <rucombs@cisco.com>
Tue, 23 Jun 2020 00:20:19 +0000 (00:20 +0000)
committerRuss Combs (rucombs) <rucombs@cisco.com>
Tue, 23 Jun 2020 00:20:19 +0000 (00:20 +0000)
commite520d7479b0c7ab98089599bf7ae5810c00a300d
tree0120b63ad614d091d788da8a9f83e3d35cc44625
parent520ac42fe6ddc969b61fa8daa824c22bcf8a7adb
Merge pull request #2250 in SNORT/snort3 from ~RUCOMBS/snort3:aimless to master

Squashed commit of the following:

commit a88d8e5e36e9c9bdb18261b3fb9994f018d8b76e
Author: russ <rucombs@cisco.com>
Date:   Thu Jun 18 12:50:04 2020 -0400

    max_detect: detained inspection disabled pending further work

commit e0a6c905a965853d6739177c528d2c3cfd317ff2
Author: russ <rucombs@cisco.com>
Date:   Wed Jun 17 01:32:16 2020 -0400

    snort: fix --dump-rule-meta with ips.states

commit df44b9f9fdcc708d23b99e4dd6d4bd250ee73bc5
Author: russ <rucombs@cisco.com>
Date:   Mon Jun 8 10:45:04 2020 -0400

    detection: remove unused code

commit 947fb40131cf9b671bd63c9202dca0eac013bd1d
Author: russ <rucombs@cisco.com>
Date:   Sun Jun 7 11:53:19 2020 -0400

    regex: convert to same syntax as pcre plus fast_pattern option

commit 74fb07f83cb7eca507a9b0708078f1ab0e8f8c21
Author: russ <rucombs@cisco.com>
Date:   Sat Jun 6 21:10:41 2020 -0400

    mpse: remove unused pattern trimming support

commit b3c00fbe13508a83763d06dfe583c76ab6af0763
Author: russ <rucombs@cisco.com>
Date:   Sat Jun 6 00:40:59 2020 -0400

    ips: update detection trees for earliest header checks

commit 07816e253eeba09240df1abc80386303ddbcc691
Author: russ <rucombs@cisco.com>
Date:   Fri Jun 5 03:09:28 2020 -0400

    ips: refactor fast pattern selection.

    Enable content, regex, and sd_pattern options to be deduplicated.

commit 4e671b312dc3d168b48a48a7c8709eaf5cb125c5
Author: russ <rucombs@cisco.com>
Date:   Mon Jun 1 08:53:01 2020 -0400

    tweaks: updates for efficacy and performance

commit 5fc59bd0061a52750b57ff6cdf9e9d23b1da10f4
Author: russ <rucombs@cisco.com>
Date:   Sat May 30 10:43:41 2020 -0400

    appid: use configured search method for multi-pattern matching

commit 838255f2b79c8504a96f0f2d2000c83088b024ab
Author: russ <rucombs@cisco.com>
Date:   Wed Jun 3 01:04:03 2020 -0400

    ips: add http fast pattern buffers

    These additional fast pattern buffers are supported:

    http_raw_uri http_raw_header http_stat_code http_stat_msg http_cookie http_method

    The current implementation handles them somewhat generically, so other
    inspectors can provide a method or a stat_code buffer too.  A future
    iteration will make these buffers extensible.

commit e8b52034c1735e2fa95911967753eec47f6ded26
Author: russ <rucombs@cisco.com>
Date:   Sat May 30 19:34:58 2020 -0400

    ips: add ips service vs buffer checks; add missing services

commit 822d67423914d137399d20a6fc7a462eb138c491
Author: russ <rucombs@cisco.com>
Date:   Fri May 29 12:20:06 2020 -0400

    ips: minimize port group construction for any-any and bidirectional rules

commit e719dad994e1e1f65601bf439ef61dae5f904d66
Author: russ <rucombs@cisco.com>
Date:   Tue May 26 13:07:58 2020 -0400

    ips: enable non-service rules when service is detected

    Do fast pattern searches for port groups after service groups.

    Also, search_engine.detect_raw_tcp is applied to rules w/ or w/o a fast
    pattern (previously, erroneously, only fast-pattern rules).  In addition,
    this no longer applies to flows w/o a service inspector.  Such flows act
    as if detect_raw_tcp is true regardless of setting.

commit f11be51de012d6b6f290484329675c5bc5a7d077
Author: russ <rucombs@cisco.com>
Date:   Tue May 19 22:09:48 2020 -0400

    snort_defaults.lua: remove unused AIM_SERVERS var
52 files changed:
lua/balanced.lua
lua/max_detect.lua
lua/security.lua
lua/snort_defaults.lua
src/detection/detection_options.cc
src/detection/detection_options.h
src/detection/fp_config.cc
src/detection/fp_config.h
src/detection/fp_create.cc
src/detection/fp_detect.cc
src/detection/fp_utils.cc
src/detection/fp_utils.h
src/detection/pattern_match_data.h
src/detection/rules.cc
src/detection/rules.h
src/detection/service_map.cc
src/detection/treenodes.h
src/framework/inspector.h
src/framework/ips_option.h
src/framework/mpse.h
src/ips_options/CMakeLists.txt
src/ips_options/ips_content.cc
src/ips_options/ips_flow.cc
src/ips_options/ips_flow.h [deleted file]
src/ips_options/ips_regex.cc
src/ips_options/ips_sd_pattern.cc
src/ips_options/test/ips_regex_test.cc
src/main/modules.cc
src/managers/ips_manager.cc
src/managers/ips_manager.h
src/managers/mpse_manager.cc
src/managers/mpse_manager.h
src/network_inspectors/appid/appid_discovery.cc
src/network_inspectors/appid/appid_utils/sf_mlmp.cc
src/network_inspectors/appid/detector_plugins/detector_imap.cc
src/network_inspectors/appid/detector_plugins/detector_pattern.cc
src/network_inspectors/appid/detector_plugins/detector_pop3.cc
src/network_inspectors/appid/detector_plugins/dns_patterns.h
src/network_inspectors/appid/detector_plugins/http_url_patterns.cc
src/network_inspectors/appid/detector_plugins/http_url_patterns.h
src/network_inspectors/appid/detector_plugins/ssl_patterns.h
src/network_inspectors/appid/service_plugins/service_mdns.cc
src/parser/parse_rule.cc
src/piglet_plugins/pp_ips_option_iface.cc
src/ports/port_group.h
src/search_engines/search_tool.cc
src/search_engines/test/search_tool_test.cc
src/service_inspectors/http_inspect/http_inspect.cc
src/service_inspectors/http_inspect/ips_http.cc
src/service_inspectors/sip/ips_sip.cc
src/utils/stats.cc
src/utils/stats.h