Merge pull request #2331 in SNORT/snort3 from ~MSTEPANE/snort3:3_0_2_build_2 to master

Squashed commit of the following:

commit a5a8831003f9a69391a06e4488e9314adc96e140
Author: Mike Stepanek <mstepane@cisco.com>
Date:   Wed Jul 15 08:27:56 2020 -0400

    build: generate and tag 3.0.2 build 2

diff --git a/ChangeLog b/ChangeLog
index c3b6211b8c09814391e16f96773d8b484280e197..d6b5c13674ec915b11d21372e841ed60f65da1ba 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,29 @@
+2020/07/15 - 3.0.2 build 2
+
+-- appid: Moving thread local ODP stuff to a new class
+-- binder: delete obsolete network_policy parsing code
+-- build: Fix static analyzer complaints about unused stored values
+-- daq: Fix calculation of outstanding packets stat to properly use the delta
+-- dce_rpc: adding support for multiple smbv2 sessions for same tcp connection
+-- dce_rpc: Invalid endpoint mapper message
+-- dce_rpc: SMB ID invalid memory access
+-- http_inspect: send MIME full message body for file processing
+-- main: add config options --ignore-warn-rules and --ignore-warn-flowbits to snort module
+-- mime: mime no longer overwrites file_data buffer for http packets
+-- smtp: generate SSL_SEARCH_ABANDONED event when no STARTTLS is detected
+-- smtp: support opportunistic SSL/TLS switch over
+-- stream_tcp: coding style improvements
+-- stream_tcp: eliminate direct references to the Packet* wherevever possible within the TCP state
+   machine context
+-- stream_tcp: eliminate use of STREAM_INSERT_OK as return code, it conveyed no useful information
+   and was ultimately unused
+-- stream_tcp: implement meta-ack pseudo packet as thread local that is reused on each meta-ack TSD
+-- stream_tcp: implement support for processing meta-ack information when present
+-- stream_tcp: meta-ack from daq is in network order not host, remove conversion from host to
+   network
+-- stream_tcp: process meta-ack info in any flush policy mode
+-- trace: add support for DAQ trace filtering
+
 2020/07/06 - 3.0.2 build 1
 
 -- appid: Appid coverity issues

diff --git a/doc/snort_manual.html b/doc/snort_manual.html
index ba52b11cf304c7fd585e5912a2023dea13481c0a..342fbbcf70e990ed673f637372233aafc1ad6c48 100644 (file)
--- a/doc/snort_manual.html
+++ b/doc/snort_manual.html
@@ -782,7 +782,7 @@ asciidoc.install(2);
 <div class="literalblock">\r
 <div class="content">\r
 <pre><code> ,,_     -*&gt; Snort++ &lt;*-\r
-o"  )~   Version 3.0.2 (Build 1)\r
+o"  )~   Version 3.0.2 (Build 2)\r
  ''''    By Martin Roesch &amp; The Snort Team\r
          http://snort.org/contact#team\r
          Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.\r
@@ -6918,7 +6918,8 @@ on a flow that packet is related. By default filtering is disabled.</p></div>
 src_ip - match all packets with a flow that has this client IP address (passed as a string)\r
 src_port - match all packets with a flow that has this source port\r
 dst_ip - match all packets with a flow that has this server IP address (passed as a string)\r
-dst_port - match all packets with a flow that has this destination port</code></pre>\r
+dst_port - match all packets with a flow that has this destination port\r
+match - boolean flag to enable/disable whether constraints will ever match (enabled by default)</code></pre>\r
 </div></div>\r
 <div class="paragraph"><p>The following lines placed in snort.lua will enable all trace messages for\r
 detection filtered by ip_proto, dst_ip, src_port and dst_port:</p></div>\r
@@ -6939,6 +6940,25 @@ detection filtered by ip_proto, dst_ip, src_port and dst_port:</p></div>
     }\r
 }</code></pre>\r
 </div></div>\r
+<div class="paragraph"><p>To create constraints that will never successfully match, set the <strong>match</strong>\r
+parameter to <em>false</em>. This is useful for situations where one is relying on\r
+external packet filtering from the DAQ module, or for preventing all trace\r
+messages in the context of a packet. The following is an example of such\r
+configuration:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>trace =\r
+{\r
+    modules =\r
+    {\r
+        snort = { all = 1 }\r
+    },\r
+    constraints =\r
+    {\r
+        match = false\r
+    }\r
+}</code></pre>\r
+</div></div>\r
 </div>\r
 <div class="sect3">\r
 <h4 id="_trace_module_configuring_trace_output_method">Trace module - configuring trace output method</h4>\r
@@ -9665,6 +9685,16 @@ implied <strong>snort.--id-zero</strong>: use id prefix / subdirectory even with
 </li>\r
 <li>\r
 <p>\r
+implied <strong>snort.--ignore-warn-flowbits</strong>: ignore warnings about flowbits that are checked but not set and vice-versa\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--ignore-warn-rules</strong>: ignore warnings about duplicate rules and rule parsing issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.--include-path</strong>: &lt;path&gt; where to find Lua and rule included files; searched before current or config directories\r
 </p>\r
 </li>\r
@@ -10109,6 +10139,11 @@ string <strong><code>suppress[].ip</code></strong>: restrict suppression to thes
 <div class="ulist"><ul>\r
 <li>\r
 <p>\r
+int <strong>trace.modules.latency.all</strong>: enable all trace options { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 int <strong>trace.modules.detection.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
@@ -10154,67 +10189,62 @@ int <strong>trace.modules.detection.tag</strong>: enable tag trace logging { 0:2
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.stream_user.all</strong>: enable all trace options { 0:255 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>trace.modules.stream_ip.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.stream.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.stream.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.gtp_inspect.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.snort.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.stream_user.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.snort.main</strong>: enable main trace logging { 0:255 }\r
+int <strong>trace.modules.dce_smb.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.snort.inspector_manager</strong>: enable inspector manager trace logging { 0:255 }\r
+int <strong>trace.modules.decode.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.dce_smb.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.dce_udp.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.dce_udp.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.appid.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.latency.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.snort.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.wizard.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.snort.main</strong>: enable main trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.gtp_inspect.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.snort.inspector_manager</strong>: enable inspector manager trace logging { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.appid.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.stream_ip.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>trace.modules.decode.all</strong>: enable all trace options { 0:255 }\r
+int <strong>trace.modules.wizard.all</strong>: enable all trace options { 0:255 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -10244,6 +10274,11 @@ int <strong>trace.constraints.dst_port</strong>: destination port filter { 0:655
 </li>\r
 <li>\r
 <p>\r
+bool <strong>trace.constraints.match</strong> = true: use constraints to filter traces\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 enum <strong>trace.output</strong>: output method for trace log messages { stdout | syslog }\r
 </p>\r
 </li>\r
@@ -11852,11 +11887,6 @@ string <strong><code>binder[].use.ips_policy</code></strong>: use ips policy fro
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>binder[].use.network_policy</code></strong>: deprecated, ignored by binder\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
 string <strong><code>binder[].use.service</code></strong>: override automatic service identification\r
 </p>\r
 </li>\r
@@ -12112,6 +12142,16 @@ string <strong>dce_smb.smb_invalid_shares</strong>: SMB shares to alert on
 bool <strong>dce_smb.smb_legacy_mode</strong> = false: inspect only SMBv1\r
 </p>\r
 </li>\r
+<li>\r
+<p>\r
+int <strong>dce_smb.smb_max_credit</strong> = 8192: Maximum number of outstanding request { 1:65536 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>dce_smb.memcap</strong> = 8388608: Memory utilization limit on smb { 512:maxSZ }\r
+</p>\r
+</li>\r
 </ul></div>\r
 <div class="paragraph"><p>Rules:</p></div>\r
 <div class="ulist"><ul>\r
@@ -12495,37 +12535,272 @@ bool <strong>dce_smb.smb_legacy_mode</strong> = false: inspect only SMBv1
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_create</strong>: total number of SMBv2 create packets seen (sum)\r
+<strong>dce_smb.v2_setup</strong>: total number of SMBv2 setup packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_err_resp</strong>: total number of SMBv2 setup error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_inv_str_sz</strong>: total number of SMBv2 setup packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_resp_hdr_err</strong>: total number of SMBv2 setup response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct</strong>: total number of SMBv2 tree connect packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_err_resp</strong>: total number of SMBv2 tree connect error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_ignored</strong>: total number of SMBv2 setup response packets ignored due to failure in creating tree tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_inv_str_sz</strong>: total number of SMBv2 tree connect packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_resp_hdr_err</strong>: total number of SMBv2 tree connect response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt</strong>: total number of SMBv2 create packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_err_resp</strong>: total number of SMBv2 create error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_inv_file_data</strong>: total number of SMBv2 create request packets ignored due to error in getting file name (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_inv_str_sz</strong>: total number of SMBv2 create packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_resp_hdr_err</strong>: total number of SMBv2 create response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_req_hdr_err</strong>: total number of SMBv2 create request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_rtrkr_misng</strong>: total number of SMBv2 create response packets ignored due to missing create request tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_req_ipc</strong>: total number of SMBv2 create request packets ignored as share type is IPC (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_tree_trkr_misng</strong>: total number of SMBv2 create response packets ignored due to missing tree tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt</strong>: total number of SMBv2 write packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_err_resp</strong>: total number of SMBv2 write error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_ignored</strong>: total number of SMBv2 write packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_inv_str_sz</strong>: total number of SMBv2 write packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_req_hdr_err</strong>: total number of SMBv2 write request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read</strong>: total number of SMBv2 read packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_err_resp</strong>: total number of SMBv2 read error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_ignored</strong>: total number of SMBv2 write packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_inv_str_sz</strong>: total number of SMBv2 read packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_rtrkr_misng</strong>: total number of SMBv2 read response packets ignored due to missing read request tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_resp_hdr_err</strong>: total number of SMBv2 read response packets ignored due to corrupted header (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_write</strong>: total number of SMBv2 write packets seen (sum)\r
+<strong>dce_smb.v2_read_req_hdr_err</strong>: total number of SMBv2 read request packets ignored due to corrupted header (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_read</strong>: total number of SMBv2 read packets seen (sum)\r
+<strong>dce_smb.v2_stinf</strong>: total number of SMBv2 set info packets seen (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_set_info</strong>: total number of SMBv2 set info packets seen (sum)\r
+<strong>dce_smb.v2_stinf_err_resp</strong>: total number of SMBv2 set info error response packets seen (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_tree_connect</strong>: total number of SMBv2 tree connect packets seen (sum)\r
+<strong>dce_smb.v2_stinf_ignored</strong>: total number of SMBv2 set info packets ignored due to missing trackers or invalid share type (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_tree_disconnect</strong>: total number of SMBv2 tree disconnect packets seen (sum)\r
+<strong>dce_smb.v2_stinf_inv_str_sz</strong>: total number of SMBv2 set info packets seen with invalid structure size (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_close</strong>: total number of SMBv2 close packets seen (sum)\r
+<strong>dce_smb.v2_stinf_req_ftrkr_misng</strong>: total number of SMBv2 set info request packets ignored due to missing file tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_req_hdr_err</strong>: total number of SMBv2 set info request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls</strong>: total number of SMBv2 close packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_err_resp</strong>: total number of SMBv2 close error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_ignored</strong>: total number of SMBv2 close packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_inv_str_sz</strong>: total number of SMBv2 close packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_req_ftrkr_misng</strong>: total number of SMBv2 close request packets ignored due to missing file tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_req_hdr_err</strong>: total number of SMBv2 close request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn</strong>: total number of SMBv2 tree disconnect packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_ignored</strong>: total number of SMBv2 tree disconnect packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_inv_str_sz</strong>: total number of SMBv2 tree disconnect packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_req_hdr_err</strong>: total number of SMBv2 tree disconnect request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_logoff</strong>: total number of SMBv2 logoff (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_logoff_inv_str_sz</strong>: total number of SMBv2 logoff packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_hdr_err</strong>: total number of SMBv2 packets seen with corrupted hdr (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_bad_next_cmd_offset</strong>: total number of SMBv2 packets seen with invalid next command offset (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_extra_file_data_err</strong>: total number of SMBv2 packets seen with where file data beyond file size is observed (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_inv_file_ctx_err</strong>: total number of times null file context are seen resulting in not being able to set file size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_msgs_uninspected</strong>: total number of SMBv2 packets seen where command is not being inspected (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cmpnd_req_lt_crossed</strong>: total number of SMBv2 packets seen where compound requests exceed the smb_max_compound limit (sum)\r
 </p>\r
 </li>\r
 <li>\r
@@ -18253,6 +18528,11 @@ bool <strong>stream_tcp.track_only</strong> = false: disable reassembly if true
 </li>\r
 <li>\r
 <p>\r
+<strong>stream_tcp.meta_acks</strong>: number of meta acks processed (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>stream_tcp.packets_held</strong>: number of packets held (sum)\r
 </p>\r
 </li>\r
@@ -25458,6 +25738,16 @@ these libraries see the Getting Started section of the manual.</p></div>
 </li>\r
 <li>\r
 <p>\r
+<strong>--ignore-warn-flowbits</strong> ignore warnings about flowbits that are checked but not set and vice-versa\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>--ignore-warn-rules</strong> ignore warnings about duplicate rules and rule parsing issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>--include-path</strong> &lt;path&gt; where to find Lua and rule included files; searched before current or config directories\r
 </p>\r
 </li>\r
@@ -26098,11 +26388,6 @@ string <strong><code>binder[].use.name</code></strong>: symbol name (defaults to
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>binder[].use.network_policy</code></strong>: deprecated, ignored by binder\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
 string <strong><code>binder[].use.service</code></strong>: override automatic service identification\r
 </p>\r
 </li>\r
@@ -26663,6 +26948,11 @@ int <strong>dce_smb.max_frag_len</strong> = 65535: maximum fragment size for def
 </li>\r
 <li>\r
 <p>\r
+int <strong>dce_smb.memcap</strong> = 8388608: Memory utilization limit on smb { 512:maxSZ }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 enum <strong>dce_smb.policy</strong> = WinXP: target based policy to use { Win2000 |  WinXP | WinVista | Win2003 | Win2008 | Win7 | Samba | Samba-3.0.37 | Samba-3.0.22 | Samba-3.0.20 }\r
 </p>\r
 </li>\r
@@ -26708,6 +26998,11 @@ int <strong>dce_smb.smb_max_compound</strong> = 3: SMB max compound size { 0:255
 </li>\r
 <li>\r
 <p>\r
+int <strong>dce_smb.smb_max_credit</strong> = 8192: Maximum number of outstanding request { 1:65536 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 multi <strong>dce_smb.valid_smb_versions</strong> = all: valid SMB versions { v1 | v2 | all }\r
 </p>\r
 </li>\r
@@ -29888,6 +30183,16 @@ implied <strong>snort.--id-zero</strong>: use id prefix / subdirectory even with
 </li>\r
 <li>\r
 <p>\r
+implied <strong>snort.--ignore-warn-flowbits</strong>: ignore warnings about flowbits that are checked but not set and vice-versa\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--ignore-warn-rules</strong>: ignore warnings about duplicate rules and rule parsing issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.-i</strong>: &lt;iface&gt;&#8230; list of interfaces\r
 </p>\r
 </li>\r
@@ -30778,6 +31083,11 @@ int <strong>trace.constraints.ip_proto</strong>: numerical IP protocol ID filter
 </li>\r
 <li>\r
 <p>\r
+bool <strong>trace.constraints.match</strong> = true: use constraints to filter traces\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>trace.constraints.src_ip</strong>: source IP address filter\r
 </p>\r
 </li>\r
@@ -31518,37 +31828,272 @@ interval <strong>wscale.~range</strong>: check if TCP window scale is in given r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_close</strong>: total number of SMBv2 close packets seen (sum)\r
+<strong>dce_smb.v2_bad_next_cmd_offset</strong>: total number of SMBv2 packets seen with invalid next command offset (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_err_resp</strong>: total number of SMBv2 close error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_ignored</strong>: total number of SMBv2 close packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_inv_str_sz</strong>: total number of SMBv2 close packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_req_ftrkr_misng</strong>: total number of SMBv2 close request packets ignored due to missing file tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls_req_hdr_err</strong>: total number of SMBv2 close request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_cls</strong>: total number of SMBv2 close packets seen (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_create</strong>: total number of SMBv2 create packets seen (sum)\r
+<strong>dce_smb.v2_cmpnd_req_lt_crossed</strong>: total number of SMBv2 packets seen where compound requests exceed the smb_max_compound limit (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_read</strong>: total number of SMBv2 read packets seen (sum)\r
+<strong>dce_smb.v2_crt_err_resp</strong>: total number of SMBv2 create error response packets seen (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_set_info</strong>: total number of SMBv2 set info packets seen (sum)\r
+<strong>dce_smb.v2_crt_inv_file_data</strong>: total number of SMBv2 create request packets ignored due to error in getting file name (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_tree_connect</strong>: total number of SMBv2 tree connect packets seen (sum)\r
+<strong>dce_smb.v2_crt_inv_str_sz</strong>: total number of SMBv2 create packets seen with invalid structure size (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_tree_disconnect</strong>: total number of SMBv2 tree disconnect packets seen (sum)\r
+<strong>dce_smb.v2_crt_req_hdr_err</strong>: total number of SMBv2 create request packets ignored due to corrupted header (sum)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-<strong>dce_smb.smbv2_write</strong>: total number of SMBv2 write packets seen (sum)\r
+<strong>dce_smb.v2_crt_req_ipc</strong>: total number of SMBv2 create request packets ignored as share type is IPC (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_resp_hdr_err</strong>: total number of SMBv2 create response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_rtrkr_misng</strong>: total number of SMBv2 create response packets ignored due to missing create request tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt</strong>: total number of SMBv2 create packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_crt_tree_trkr_misng</strong>: total number of SMBv2 create response packets ignored due to missing tree tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_extra_file_data_err</strong>: total number of SMBv2 packets seen with where file data beyond file size is observed (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_hdr_err</strong>: total number of SMBv2 packets seen with corrupted hdr (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_inv_file_ctx_err</strong>: total number of times null file context are seen resulting in not being able to set file size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_logoff_inv_str_sz</strong>: total number of SMBv2 logoff packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_logoff</strong>: total number of SMBv2 logoff (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_msgs_uninspected</strong>: total number of SMBv2 packets seen where command is not being inspected (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_err_resp</strong>: total number of SMBv2 read error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_ignored</strong>: total number of SMBv2 write packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_inv_str_sz</strong>: total number of SMBv2 read packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_req_hdr_err</strong>: total number of SMBv2 read request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_resp_hdr_err</strong>: total number of SMBv2 read response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read_rtrkr_misng</strong>: total number of SMBv2 read response packets ignored due to missing read request tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_read</strong>: total number of SMBv2 read packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_err_resp</strong>: total number of SMBv2 setup error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_inv_str_sz</strong>: total number of SMBv2 setup packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup_resp_hdr_err</strong>: total number of SMBv2 setup response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_setup</strong>: total number of SMBv2 setup packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_err_resp</strong>: total number of SMBv2 set info error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_ignored</strong>: total number of SMBv2 set info packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_inv_str_sz</strong>: total number of SMBv2 set info packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_req_ftrkr_misng</strong>: total number of SMBv2 set info request packets ignored due to missing file tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf_req_hdr_err</strong>: total number of SMBv2 set info request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_stinf</strong>: total number of SMBv2 set info packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_err_resp</strong>: total number of SMBv2 tree connect error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_ignored</strong>: total number of SMBv2 setup response packets ignored due to failure in creating tree tracker (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_inv_str_sz</strong>: total number of SMBv2 tree connect packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct_resp_hdr_err</strong>: total number of SMBv2 tree connect response packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_cnct</strong>: total number of SMBv2 tree connect packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_ignored</strong>: total number of SMBv2 tree disconnect packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_inv_str_sz</strong>: total number of SMBv2 tree disconnect packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn_req_hdr_err</strong>: total number of SMBv2 tree disconnect request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_tree_discn</strong>: total number of SMBv2 tree disconnect packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_err_resp</strong>: total number of SMBv2 write error response packets seen (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_ignored</strong>: total number of SMBv2 write packets ignored due to missing trackers or invalid share type (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_inv_str_sz</strong>: total number of SMBv2 write packets seen with invalid structure size (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt_req_hdr_err</strong>: total number of SMBv2 write request packets ignored due to corrupted header (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dce_smb.v2_wrt</strong>: total number of SMBv2 write packets seen (sum)\r
 </p>\r
 </li>\r
 <li>\r
@@ -34048,6 +34593,11 @@ interval <strong>wscale.~range</strong>: check if TCP window scale is in given r
 </li>\r
 <li>\r
 <p>\r
+<strong>stream_tcp.meta_acks</strong>: number of meta acks processed (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>stream_tcp.overlaps</strong>: overlapping segments queued (sum)\r
 </p>\r
 </li>\r
@@ -40383,7 +40933,7 @@ Adding/removing stream_* inspectors if stream was already configured
 <div id="footer">\r
 <div id="footer-text">\r
 Last updated\r
- 2020-07-06 10:25:58 EDT\r
+ 2020-07-15 08:52:02 EDT\r
 </div>\r
 </div>\r
 </body>\r

diff --git a/doc/snort_manual.pdf b/doc/snort_manual.pdf
index 8b7eb8bcfb5b4e1c49627a864971730593fc59c7..f16145a924fa1d8f559ad251c4e4b35348eb4c36 100644 (file)
Binary files a/doc/snort_manual.pdf and b/doc/snort_manual.pdf differ

diff --git a/doc/snort_manual.text b/doc/snort_manual.text
index 8ca3b0cd62e07c5ad78869c4816f0bcade71365c..1a9a60b2b22e0c35f3a8cf151556085c90b9bf49 100644 (file)
--- a/doc/snort_manual.text
+++ b/doc/snort_manual.text
@@ -409,7 +409,7 @@ Table of Contents
 Snorty
 
  ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.2 (Build 1)
+o"  )~   Version 3.0.2 (Build 2)
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
@@ -5328,6 +5328,7 @@ src_ip - match all packets with a flow that has this client IP address (passed a
 src_port - match all packets with a flow that has this source port
 dst_ip - match all packets with a flow that has this server IP address (passed as a string)
 dst_port - match all packets with a flow that has this destination port
+match - boolean flag to enable/disable whether constraints will ever match (enabled by default)
 
 The following lines placed in snort.lua will enable all trace
 messages for detection filtered by ip_proto, dst_ip, src_port and
@@ -5348,6 +5349,24 @@ trace =
     }
 }
 
+To create constraints that will never successfully match, set the 
+match parameter to false. This is useful for situations where one is
+relying on external packet filtering from the DAQ module, or for
+preventing all trace messages in the context of a packet. The
+following is an example of such configuration:
+
+trace =
+{
+    modules =
+    {
+        snort = { all = 1 }
+    },
+    constraints =
+    {
+        match = false
+    }
+}
+
 5.17.4. Trace module - configuring trace output method
 
 There is a capability to configure the output method for trace
@@ -6909,6 +6928,10 @@ Configuration:
     logdir instead of instance filename prefix
   * implied snort.--id-zero: use id prefix / subdirectory even with
     one packet thread
+  * implied snort.--ignore-warn-flowbits: ignore warnings about
+    flowbits that are checked but not set and vice-versa
+  * implied snort.--ignore-warn-rules: ignore warnings about
+    duplicate rules and rule parsing issues
   * string snort.--include-path: <path> where to find Lua and rule
     included files; searched before current or config directories
   * implied snort.--list-buffers: output available inspection buffers
@@ -7080,6 +7103,7 @@ Usage: global
 
 Configuration:
 
+  * int trace.modules.latency.all: enable all trace options { 0:255 }
   * int trace.modules.detection.all: enable all trace options { 0:255
     }
   * int trace.modules.detection.detect_engine: enable detection
@@ -7098,23 +7122,22 @@ Configuration:
     logging { 0:255 }
   * int trace.modules.detection.tag: enable tag trace logging { 0:255
     }
+  * int trace.modules.stream.all: enable all trace options { 0:255 }
+  * int trace.modules.gtp_inspect.all: enable all trace options {
+    0:255 }
   * int trace.modules.stream_user.all: enable all trace options {
     0:255 }
-  * int trace.modules.stream_ip.all: enable all trace options { 0:255
-    }
-  * int trace.modules.stream.all: enable all trace options { 0:255 }
+  * int trace.modules.dce_smb.all: enable all trace options { 0:255 }
+  * int trace.modules.decode.all: enable all trace options { 0:255 }
+  * int trace.modules.dce_udp.all: enable all trace options { 0:255 }
+  * int trace.modules.appid.all: enable all trace options { 0:255 }
   * int trace.modules.snort.all: enable all trace options { 0:255 }
   * int trace.modules.snort.main: enable main trace logging { 0:255 }
   * int trace.modules.snort.inspector_manager: enable inspector
     manager trace logging { 0:255 }
-  * int trace.modules.dce_smb.all: enable all trace options { 0:255 }
-  * int trace.modules.dce_udp.all: enable all trace options { 0:255 }
-  * int trace.modules.latency.all: enable all trace options { 0:255 }
+  * int trace.modules.stream_ip.all: enable all trace options { 0:255
+    }
   * int trace.modules.wizard.all: enable all trace options { 0:255 }
-  * int trace.modules.gtp_inspect.all: enable all trace options {
-    0:255 }
-  * int trace.modules.appid.all: enable all trace options { 0:255 }
-  * int trace.modules.decode.all: enable all trace options { 0:255 }
   * int trace.constraints.ip_proto: numerical IP protocol ID filter {
     0:255 }
   * string trace.constraints.src_ip: source IP address filter
@@ -7122,6 +7145,8 @@ Configuration:
   * string trace.constraints.dst_ip: destination IP address filter
   * int trace.constraints.dst_port: destination port filter { 0:65535
     }
+  * bool trace.constraints.match = true: use constraints to filter
+    traces
   * enum trace.output: output method for trace log messages { stdout
     | syslog }
 
@@ -7975,7 +8000,6 @@ Configuration:
   * string binder[].use.inspection_policy: use inspection policy from
     given file
   * string binder[].use.ips_policy: use ips policy from given file
-  * string binder[].use.network_policy: deprecated, ignored by binder
   * string binder[].use.service: override automatic service
     identification
   * string binder[].use.type: select module for binding
@@ -8122,6 +8146,10 @@ Configuration:
     (-1 = disabled, 0 = unlimited) { -1:32767 }
   * string dce_smb.smb_invalid_shares: SMB shares to alert on
   * bool dce_smb.smb_legacy_mode = false: inspect only SMBv1
+  * int dce_smb.smb_max_credit = 8192: Maximum number of outstanding
+    request { 1:65536 }
+  * int dce_smb.memcap = 8388608: Memory utilization limit on smb {
+    512:maxSZ }
 
 Rules:
 
@@ -8239,18 +8267,111 @@ Peg counts:
   * dce_smb.max_outstanding_requests: total smb maximum outstanding
     requests (sum)
   * dce_smb.files_processed: total smb files processed (sum)
-  * dce_smb.smbv2_create: total number of SMBv2 create packets seen
+  * dce_smb.v2_setup: total number of SMBv2 setup packets seen (sum)
+  * dce_smb.v2_setup_err_resp: total number of SMBv2 setup error
+    response packets seen (sum)
+  * dce_smb.v2_setup_inv_str_sz: total number of SMBv2 setup packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_setup_resp_hdr_err: total number of SMBv2 setup
+    response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_tree_cnct: total number of SMBv2 tree connect packets
+    seen (sum)
+  * dce_smb.v2_tree_cnct_err_resp: total number of SMBv2 tree connect
+    error response packets seen (sum)
+  * dce_smb.v2_tree_cnct_ignored: total number of SMBv2 setup
+    response packets ignored due to failure in creating tree tracker
     (sum)
-  * dce_smb.smbv2_write: total number of SMBv2 write packets seen
+  * dce_smb.v2_tree_cnct_inv_str_sz: total number of SMBv2 tree
+    connect packets seen with invalid structure size (sum)
+  * dce_smb.v2_tree_cnct_resp_hdr_err: total number of SMBv2 tree
+    connect response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_crt: total number of SMBv2 create packets seen (sum)
+  * dce_smb.v2_crt_err_resp: total number of SMBv2 create error
+    response packets seen (sum)
+  * dce_smb.v2_crt_inv_file_data: total number of SMBv2 create
+    request packets ignored due to error in getting file name (sum)
+  * dce_smb.v2_crt_inv_str_sz: total number of SMBv2 create packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_crt_resp_hdr_err: total number of SMBv2 create
+    response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_crt_req_hdr_err: total number of SMBv2 create request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_crt_rtrkr_misng: total number of SMBv2 create response
+    packets ignored due to missing create request tracker (sum)
+  * dce_smb.v2_crt_req_ipc: total number of SMBv2 create request
+    packets ignored as share type is IPC (sum)
+  * dce_smb.v2_crt_tree_trkr_misng: total number of SMBv2 create
+    response packets ignored due to missing tree tracker (sum)
+  * dce_smb.v2_wrt: total number of SMBv2 write packets seen (sum)
+  * dce_smb.v2_wrt_err_resp: total number of SMBv2 write error
+    response packets seen (sum)
+  * dce_smb.v2_wrt_ignored: total number of SMBv2 write packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_wrt_inv_str_sz: total number of SMBv2 write packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_wrt_req_hdr_err: total number of SMBv2 write request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_read: total number of SMBv2 read packets seen (sum)
+  * dce_smb.v2_read_err_resp: total number of SMBv2 read error
+    response packets seen (sum)
+  * dce_smb.v2_read_ignored: total number of SMBv2 write packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_read_inv_str_sz: total number of SMBv2 read packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_read_rtrkr_misng: total number of SMBv2 read response
+    packets ignored due to missing read request tracker (sum)
+  * dce_smb.v2_read_resp_hdr_err: total number of SMBv2 read response
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_read_req_hdr_err: total number of SMBv2 read request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_stinf: total number of SMBv2 set info packets seen
     (sum)
-  * dce_smb.smbv2_read: total number of SMBv2 read packets seen (sum)
-  * dce_smb.smbv2_set_info: total number of SMBv2 set info packets
-    seen (sum)
-  * dce_smb.smbv2_tree_connect: total number of SMBv2 tree connect
+  * dce_smb.v2_stinf_err_resp: total number of SMBv2 set info error
+    response packets seen (sum)
+  * dce_smb.v2_stinf_ignored: total number of SMBv2 set info packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_stinf_inv_str_sz: total number of SMBv2 set info
+    packets seen with invalid structure size (sum)
+  * dce_smb.v2_stinf_req_ftrkr_misng: total number of SMBv2 set info
+    request packets ignored due to missing file tracker (sum)
+  * dce_smb.v2_stinf_req_hdr_err: total number of SMBv2 set info
+    request packets ignored due to corrupted header (sum)
+  * dce_smb.v2_cls: total number of SMBv2 close packets seen (sum)
+  * dce_smb.v2_cls_err_resp: total number of SMBv2 close error
+    response packets seen (sum)
+  * dce_smb.v2_cls_ignored: total number of SMBv2 close packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_cls_inv_str_sz: total number of SMBv2 close packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_cls_req_ftrkr_misng: total number of SMBv2 close
+    request packets ignored due to missing file tracker (sum)
+  * dce_smb.v2_cls_req_hdr_err: total number of SMBv2 close request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_tree_discn: total number of SMBv2 tree disconnect
     packets seen (sum)
-  * dce_smb.smbv2_tree_disconnect: total number of SMBv2 tree
-    disconnect packets seen (sum)
-  * dce_smb.smbv2_close: total number of SMBv2 close packets seen
+  * dce_smb.v2_tree_discn_ignored: total number of SMBv2 tree
+    disconnect packets ignored due to missing trackers or invalid
+    share type (sum)
+  * dce_smb.v2_tree_discn_inv_str_sz: total number of SMBv2 tree
+    disconnect packets seen with invalid structure size (sum)
+  * dce_smb.v2_tree_discn_req_hdr_err: total number of SMBv2 tree
+    disconnect request packets ignored due to corrupted header (sum)
+  * dce_smb.v2_logoff: total number of SMBv2 logoff (sum)
+  * dce_smb.v2_logoff_inv_str_sz: total number of SMBv2 logoff
+    packets seen with invalid structure size (sum)
+  * dce_smb.v2_hdr_err: total number of SMBv2 packets seen with
+    corrupted hdr (sum)
+  * dce_smb.v2_bad_next_cmd_offset: total number of SMBv2 packets
+    seen with invalid next command offset (sum)
+  * dce_smb.v2_extra_file_data_err: total number of SMBv2 packets
+    seen with where file data beyond file size is observed (sum)
+  * dce_smb.v2_inv_file_ctx_err: total number of times null file
+    context are seen resulting in not being able to set file size
+    (sum)
+  * dce_smb.v2_msgs_uninspected: total number of SMBv2 packets seen
+    where command is not being inspected (sum)
+  * dce_smb.v2_cmpnd_req_lt_crossed: total number of SMBv2 packets
+    seen where compound requests exceed the smb_max_compound limit
     (sum)
   * dce_smb.concurrent_sessions: total concurrent sessions (now)
   * dce_smb.max_concurrent_sessions: maximum concurrent sessions
@@ -10429,6 +10550,7 @@ Peg counts:
   * stream_tcp.syn_acks: number of syn-ack packets (sum)
   * stream_tcp.resets: number of reset packets (sum)
   * stream_tcp.fins: number of fin packets (sum)
+  * stream_tcp.meta_acks: number of meta acks processed (sum)
   * stream_tcp.packets_held: number of packets held (sum)
   * stream_tcp.held_packet_rexmits: number of retransmits of held
     packets (sum)
@@ -15129,6 +15251,10 @@ these libraries see the Getting Started section of the manual.
     of instance filename prefix
   * --id-zero use id prefix / subdirectory even with one packet
     thread
+  * --ignore-warn-flowbits ignore warnings about flowbits that are
+    checked but not set and vice-versa
+  * --ignore-warn-rules ignore warnings about duplicate rules and
+    rule parsing issues
   * --include-path <path> where to find Lua and rule included files;
     searched before current or config directories
   * --list-buffers output available inspection buffers
@@ -15368,7 +15494,6 @@ these libraries see the Getting Started section of the manual.
     given file
   * string binder[].use.ips_policy: use ips policy from given file
   * string binder[].use.name: symbol name (defaults to type)
-  * string binder[].use.network_policy: deprecated, ignored by binder
   * string binder[].use.service: override automatic service
     identification
   * string binder[].use.type: select module for binding
@@ -15541,6 +15666,8 @@ these libraries see the Getting Started section of the manual.
     per signature per flow
   * int dce_smb.max_frag_len = 65535: maximum fragment size for
     defragmentation { 1514:65535 }
+  * int dce_smb.memcap = 8388608: Memory utilization limit on smb {
+    512:maxSZ }
   * enum dce_smb.policy = WinXP: target based policy to use { Win2000
     | WinXP | WinVista | Win2003 | Win2008 | Win7 | Samba |
     Samba-3.0.37 | Samba-3.0.22 | Samba-3.0.20 }
@@ -15556,6 +15683,8 @@ these libraries see the Getting Started section of the manual.
   * bool dce_smb.smb_legacy_mode = false: inspect only SMBv1
   * int dce_smb.smb_max_chain = 3: SMB max chain size { 0:255 }
   * int dce_smb.smb_max_compound = 3: SMB max compound size { 0:255 }
+  * int dce_smb.smb_max_credit = 8192: Maximum number of outstanding
+    request { 1:65536 }
   * multi dce_smb.valid_smb_versions = all: valid SMB versions { v1 |
     v2 | all }
   * bool dce_tcp.disable_defrag = false: disable DCE/RPC
@@ -16673,6 +16802,10 @@ these libraries see the Getting Started section of the manual.
     logdir instead of instance filename prefix
   * implied snort.--id-zero: use id prefix / subdirectory even with
     one packet thread
+  * implied snort.--ignore-warn-flowbits: ignore warnings about
+    flowbits that are checked but not set and vice-versa
+  * implied snort.--ignore-warn-rules: ignore warnings about
+    duplicate rules and rule parsing issues
   * string snort.-i: <iface>… list of interfaces
   * string snort.--include-path: <path> where to find Lua and rule
     included files; searched before current or config directories
@@ -16974,6 +17107,8 @@ these libraries see the Getting Started section of the manual.
     }
   * int trace.constraints.ip_proto: numerical IP protocol ID filter {
     0:255 }
+  * bool trace.constraints.match = true: use constraints to filter
+    traces
   * string trace.constraints.src_ip: source IP address filter
   * int trace.constraints.src_port: source port filter { 0:65535 }
   * int trace.modules.appid.all: enable all trace options { 0:255 }
@@ -17204,19 +17339,112 @@ these libraries see the Getting Started section of the manual.
     reassembled (sum)
   * dce_smb.smb_server_segs_reassembled: total smb server segments
     reassembled (sum)
-  * dce_smb.smbv2_close: total number of SMBv2 close packets seen
+  * dce_smb.v2_bad_next_cmd_offset: total number of SMBv2 packets
+    seen with invalid next command offset (sum)
+  * dce_smb.v2_cls_err_resp: total number of SMBv2 close error
+    response packets seen (sum)
+  * dce_smb.v2_cls_ignored: total number of SMBv2 close packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_cls_inv_str_sz: total number of SMBv2 close packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_cls_req_ftrkr_misng: total number of SMBv2 close
+    request packets ignored due to missing file tracker (sum)
+  * dce_smb.v2_cls_req_hdr_err: total number of SMBv2 close request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_cls: total number of SMBv2 close packets seen (sum)
+  * dce_smb.v2_cmpnd_req_lt_crossed: total number of SMBv2 packets
+    seen where compound requests exceed the smb_max_compound limit
+    (sum)
+  * dce_smb.v2_crt_err_resp: total number of SMBv2 create error
+    response packets seen (sum)
+  * dce_smb.v2_crt_inv_file_data: total number of SMBv2 create
+    request packets ignored due to error in getting file name (sum)
+  * dce_smb.v2_crt_inv_str_sz: total number of SMBv2 create packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_crt_req_hdr_err: total number of SMBv2 create request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_crt_req_ipc: total number of SMBv2 create request
+    packets ignored as share type is IPC (sum)
+  * dce_smb.v2_crt_resp_hdr_err: total number of SMBv2 create
+    response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_crt_rtrkr_misng: total number of SMBv2 create response
+    packets ignored due to missing create request tracker (sum)
+  * dce_smb.v2_crt: total number of SMBv2 create packets seen (sum)
+  * dce_smb.v2_crt_tree_trkr_misng: total number of SMBv2 create
+    response packets ignored due to missing tree tracker (sum)
+  * dce_smb.v2_extra_file_data_err: total number of SMBv2 packets
+    seen with where file data beyond file size is observed (sum)
+  * dce_smb.v2_hdr_err: total number of SMBv2 packets seen with
+    corrupted hdr (sum)
+  * dce_smb.v2_inv_file_ctx_err: total number of times null file
+    context are seen resulting in not being able to set file size
     (sum)
-  * dce_smb.smbv2_create: total number of SMBv2 create packets seen
+  * dce_smb.v2_logoff_inv_str_sz: total number of SMBv2 logoff
+    packets seen with invalid structure size (sum)
+  * dce_smb.v2_logoff: total number of SMBv2 logoff (sum)
+  * dce_smb.v2_msgs_uninspected: total number of SMBv2 packets seen
+    where command is not being inspected (sum)
+  * dce_smb.v2_read_err_resp: total number of SMBv2 read error
+    response packets seen (sum)
+  * dce_smb.v2_read_ignored: total number of SMBv2 write packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_read_inv_str_sz: total number of SMBv2 read packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_read_req_hdr_err: total number of SMBv2 read request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_read_resp_hdr_err: total number of SMBv2 read response
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_read_rtrkr_misng: total number of SMBv2 read response
+    packets ignored due to missing read request tracker (sum)
+  * dce_smb.v2_read: total number of SMBv2 read packets seen (sum)
+  * dce_smb.v2_setup_err_resp: total number of SMBv2 setup error
+    response packets seen (sum)
+  * dce_smb.v2_setup_inv_str_sz: total number of SMBv2 setup packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_setup_resp_hdr_err: total number of SMBv2 setup
+    response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_setup: total number of SMBv2 setup packets seen (sum)
+  * dce_smb.v2_stinf_err_resp: total number of SMBv2 set info error
+    response packets seen (sum)
+  * dce_smb.v2_stinf_ignored: total number of SMBv2 set info packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_stinf_inv_str_sz: total number of SMBv2 set info
+    packets seen with invalid structure size (sum)
+  * dce_smb.v2_stinf_req_ftrkr_misng: total number of SMBv2 set info
+    request packets ignored due to missing file tracker (sum)
+  * dce_smb.v2_stinf_req_hdr_err: total number of SMBv2 set info
+    request packets ignored due to corrupted header (sum)
+  * dce_smb.v2_stinf: total number of SMBv2 set info packets seen
     (sum)
-  * dce_smb.smbv2_read: total number of SMBv2 read packets seen (sum)
-  * dce_smb.smbv2_set_info: total number of SMBv2 set info packets
+  * dce_smb.v2_tree_cnct_err_resp: total number of SMBv2 tree connect
+    error response packets seen (sum)
+  * dce_smb.v2_tree_cnct_ignored: total number of SMBv2 setup
+    response packets ignored due to failure in creating tree tracker
+    (sum)
+  * dce_smb.v2_tree_cnct_inv_str_sz: total number of SMBv2 tree
+    connect packets seen with invalid structure size (sum)
+  * dce_smb.v2_tree_cnct_resp_hdr_err: total number of SMBv2 tree
+    connect response packets ignored due to corrupted header (sum)
+  * dce_smb.v2_tree_cnct: total number of SMBv2 tree connect packets
     seen (sum)
-  * dce_smb.smbv2_tree_connect: total number of SMBv2 tree connect
+  * dce_smb.v2_tree_discn_ignored: total number of SMBv2 tree
+    disconnect packets ignored due to missing trackers or invalid
+    share type (sum)
+  * dce_smb.v2_tree_discn_inv_str_sz: total number of SMBv2 tree
+    disconnect packets seen with invalid structure size (sum)
+  * dce_smb.v2_tree_discn_req_hdr_err: total number of SMBv2 tree
+    disconnect request packets ignored due to corrupted header (sum)
+  * dce_smb.v2_tree_discn: total number of SMBv2 tree disconnect
     packets seen (sum)
-  * dce_smb.smbv2_tree_disconnect: total number of SMBv2 tree
-    disconnect packets seen (sum)
-  * dce_smb.smbv2_write: total number of SMBv2 write packets seen
-    (sum)
+  * dce_smb.v2_wrt_err_resp: total number of SMBv2 write error
+    response packets seen (sum)
+  * dce_smb.v2_wrt_ignored: total number of SMBv2 write packets
+    ignored due to missing trackers or invalid share type (sum)
+  * dce_smb.v2_wrt_inv_str_sz: total number of SMBv2 write packets
+    seen with invalid structure size (sum)
+  * dce_smb.v2_wrt_req_hdr_err: total number of SMBv2 write request
+    packets ignored due to corrupted header (sum)
+  * dce_smb.v2_wrt: total number of SMBv2 write packets seen (sum)
   * dce_tcp.alter_context_responses: total connection-oriented alter
     context responses (sum)
   * dce_tcp.alter_contexts: total connection-oriented alter contexts
@@ -17893,6 +18121,7 @@ these libraries see the Getting Started section of the manual.
   * stream_tcp.max_packets_held: maximum number of packets held
     simultaneously (max)
   * stream_tcp.memory: current memory in use (now)
+  * stream_tcp.meta_acks: number of meta acks processed (sum)
   * stream_tcp.overlaps: overlapping segments queued (sum)
   * stream_tcp.packets_held: number of packets held (sum)
   * stream_tcp.partial_fallbacks: count of fallbacks from assigned

diff --git a/src/main/build.h b/src/main/build.h
index 46eb7321115333ccd7bf745af374aad4258ee8a2..ac84188a7927c4e427460b444d4ff41cd73d03aa 100644 (file)
--- a/src/main/build.h
+++ b/src/main/build.h
@@ -12,7 +12,7 @@
 //                                               //
 //-----------------------------------------------//
 
-#define BUILD_NUMBER 1
+#define BUILD_NUMBER 2
 
 #ifndef EXTRABUILD
 #define BUILD STRINGIFY_MX(BUILD_NUMBER)