Merge pull request #751 in SNORT/snort3 from doc_sdf2x3x to master

Squashed commit of the following:

commit 042b8ad6e168b42e4fd46de8ebd5a10f46a86284
Author: Victor Roemer <viroemer@cisco.com>
Date:   Thu Dec 15 12:08:55 2016 -0500

    SDF 2.x vs 3.x

diff --git a/doc/differences.txt b/doc/differences.txt
index cc4ef6b95fd4aaa17a6d051e7d51d0c8cb06a233..27fb343deade1139c5f492de229d9af1615f617a 100644 (file)
--- a/doc/differences.txt
+++ b/doc/differences.txt
@@ -199,3 +199,21 @@ configure can be found by running the following command:
 
     snort --help-config http_inspect | grep http_inspect.profile
 
+=== SDF Preprocessor
+
+The Snort 2.X SDF Preprocessor is gone, replaced by ips option `sd_pattern`.
+The sd_pattern rule option is synonymous with the sd_pattern option used
+for gid:138 rules, but has a different syntax. A major difference in syntax
+is the use of Hyperscan pattern matching library which provides a regex
+language similar to PCRE.
+
+To facilitate continued performance, sd_pattern rule option is implemented
+with Hyperscan pattern matching library. The rule option is now also utilized
+as a "fast pattern" in the Snort engine which provides a significant performance
+improvement over the separate detection step of earlier implementations.
+
+The preprocessor alert SDF_COMBO_ALERT (139:1) has been removed and has no
+replacement in Snort 3.X. This is because the rule offered no additional
+value over gid:138 rules and was difficult to interpret the result of.
+
+For more information, See Features > Sensitive Data Filtering for details.

diff --git a/tools/snort2lua/rule_states/rule_sd_pattern.cc b/tools/snort2lua/rule_states/rule_sd_pattern.cc
index 6a944095f0f75e5fe9cc2cbe4b2cf917f496fc90..0eb39de89f7a27ddbcccdbe45a57306fc69aba70 100644 (file)
--- a/tools/snort2lua/rule_states/rule_sd_pattern.cc
+++ b/tools/snort2lua/rule_states/rule_sd_pattern.cc
@@ -15,7 +15,7 @@
 // with this program; if not, write to the Free Software Foundation, Inc.,
 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 //--------------------------------------------------------------------------
-// rule_metadata.cc author Josh Rosenbaum <jrosenba@cisco.com>
+// rule_sd_pattern.cc author Victor Roemer <viroemer@cisco.com>
 
 #include <sstream>
 #include <vector>