Pull request #3617: build: generate and tag 3.1.43.0

Merge in SNORT/snort3 from ~PRBG/snort3:build_3.1.43.0 to master

Squashed commit of the following:

commit fd52699dda4b42879d7fc5fbe24a27893a911ff0
Author: Priyanka Gurudev <prbg@cisco.com>
Date:   Wed Oct 5 15:41:09 2022 -0400

    build: generate and tag 3.1.43.0

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f9bec4f4304f21274faca54e42c9e265e8217fb4..02f48ea4c6ef311c3115eba5b58eeb993648b1aa 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,7 +3,7 @@ project (snort CXX C)
 
 set (VERSION_MAJOR 3)
 set (VERSION_MINOR 1)
-set (VERSION_PATCH 42)
+set (VERSION_PATCH 43)
 set (VERSION_SUBLEVEL 0)
 set (VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_SUBLEVEL}")
 

diff --git a/ChangeLog.md b/ChangeLog.md
index 2379fe5de573361996a777d70735622154c602eb..cf1738815c3ace70832e1f34670c4e64d66ed108 100644 (file)
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,15 @@
+2022-10-05: 3.1.43.0
+
+* actions: fix action logging for suppressed events
+* appid: handle multistream http protocols(http2,http3) together
+* appid: return appid set by eve for http/3 if no hsession is present, but prefer hsession appid over eve
+* appid: updating devnotes for first packet API
+* detection: refactor set next packet to use the dummy active object when there is no packet
+* flow: disable inspection for and HA flow unless the state is setup or inspect
+* http2_inspect: std::list - remove indirection from stream list
+* http_inspect: allowed and disallowed methods
+* reputation, sfrt: refactor reputation to remove global variables
+
 2022-09-22: 3.1.42.0
 
 * appid: custom lua detector api to map ip and port to appids on the first packet

diff --git a/doc/reference/snort_reference.text b/doc/reference/snort_reference.text
index 8ac356168b7700ef8fbe7b6cb405bdd67f721276..c847499fc8a28c6609079e26ba1e012a3c419a0d 100644 (file)
--- a/doc/reference/snort_reference.text
+++ b/doc/reference/snort_reference.text
@@ -8,7 +8,7 @@ Snort 3 Reference Manual
 The Snort Team
 
 Revision History
-Revision 3.1.42.0 2022-09-22 15:40:10 EDT TST
+Revision 3.1.43.0 2022-10-05 15:21:03 EDT TST
 
 ---------------------------------------------------------------------
 
@@ -3791,6 +3791,9 @@ Configuration:
   * bool http_inspect.request_body_app_detection = true: make HTTP/2
     request message bodies available for application detection
     (detection requires AppId)
+  * string http_inspect.allowed_methods: list of allowed methods
+  * string http_inspect.disallowed_methods: list of disallowed
+    methods
 
 Rules:
 
@@ -3985,6 +3988,8 @@ Rules:
     63780 bytes
   * 119:286 (http_inspect) HTTP/2 preface received instead of an HTTP
     /1 method
+  * 119:287 (http_inspect) HTTP request method is not on allowed
+    methods list or is on disallowed methods list
 
 Peg counts:
 
@@ -9513,6 +9518,7 @@ libraries see the Getting Started section of the manual.
     examining HTTP message headers
   * implied http_header.with_trailer: parts of this rule examine HTTP
     message trailers
+  * string http_inspect.allowed_methods: list of allowed methods
   * bool http_inspect.backslash_to_slash = true: replace \ with /
     when normalizing URIs
   * bit_list http_inspect.bad_characters: alert when any of specified
@@ -9525,6 +9531,8 @@ libraries see the Getting Started section of the manual.
     Visual Basic for Applications macro files in response bodies
   * bool http_inspect.decompress_zip = false: decompress zip files in
     response bodies
+  * string http_inspect.disallowed_methods: list of disallowed
+    methods
   * string http_inspect.ignore_unreserved: do not alert when the
     specified unreserved characters are percent-encoded in a
     URI.Unreserved characters are 0-9, a-z, A-Z, period, underscore,
@@ -13683,6 +13691,12 @@ method
 
 HTTP/2 preface received instead of an HTTP/1 method
 
+119:287 (http_inspect) HTTP request method is not on allowed methods
+list or is on disallowed methods list
+
+HTTP request method is not on allowed methods list or is on
+disallowed methods list.
+
 121:1 (http2_inspect) invalid flag set on HTTP/2 frame
 
 Invalid flag set on HTTP/2 frame header

diff --git a/doc/upgrade/snort_upgrade.text b/doc/upgrade/snort_upgrade.text
index 8b4af2fb329e646aae926dd96f919ecb09306309..453b5b9ab9b4c9a378e30ed52b1d8c613c7acf19 100644 (file)
--- a/doc/upgrade/snort_upgrade.text
+++ b/doc/upgrade/snort_upgrade.text
@@ -8,7 +8,7 @@ Snort 3 Upgrade Manual
 The Snort Team
 
 Revision History
-Revision 3.1.42.0 2022-09-22 15:41:19 EDT TST
+Revision 3.1.43.0 2022-10-05 15:22:07 EDT TST
 
 ---------------------------------------------------------------------
 

diff --git a/doc/user/snort_user.text b/doc/user/snort_user.text
index b920745e07331209d8dadc4d9939e009e65adf19..0e63f37ad729fceb45d9cf629246f7209e18d7fa 100644 (file)
--- a/doc/user/snort_user.text
+++ b/doc/user/snort_user.text
@@ -8,7 +8,7 @@ Snort 3 User Manual
 The Snort Team
 
 Revision History
-Revision 3.1.42.0 2022-09-22 15:40:33 EDT TST
+Revision 3.1.43.0 2022-10-05 15:21:24 EDT TST
 
 ---------------------------------------------------------------------
 
@@ -3944,7 +3944,29 @@ omit the depth parameter entirely because that is the default.
 These limits have no effect on how much data is forwarded to file
 processing.
 
-5.10.3.2. script_detection
+5.10.3.2. allowed_methods and disallowed_methods
+
+When either of these options are set, HTTP inspector will check if
+the method in the HTTP request is allowed and if not raise alert
+119:287. You can either define a list of allowed methods or a list of
+disallowed methods. Defining both is a configuration error. When a
+list of disallowed methods is defined, any method not present on that
+list is implicitly allowed. Methods on either of these lists are
+considered known methods and will not raise alert 119:31. For example
+if configured for:
+
+allowed_methods = "GET,PUT,BLUE"
+
+HTTP inspector will raise 119:287 for POST and RED, no alert 119:31
+will be raised for BLUE, and 119:31 will be raised for RED. If
+configured for
+
+disallowed_methods = "POST,RED"
+
+HTTP inspector will raise 119:287 for POST and RED, 119:31 for BLUE,
+and no alert 119:31 will be raised for RED.
+
+5.10.3.3. script_detection
 
 Script detection is a feature that enables Snort to more quickly
 detect and block response messages containing malicious JavaScript.
@@ -3956,7 +3978,7 @@ consumes somewhat more of the sensor’s resources.
 This feature is off by default. script_detection = true will activate
 it.
 
-5.10.3.3. gzip
+5.10.3.4. gzip
 
 http_inspect by default decompresses deflate and gzip message bodies
 before inspecting them. This feature can be turned off by unzip =
@@ -3965,14 +3987,14 @@ improvement but at a very high price. It is unlikely that any
 meaningful inspection of message bodies will be possible. Effectively
 HTTP processing would be limited to the headers.
 
-5.10.3.4. normalize_utf
+5.10.3.5. normalize_utf
 
 http_inspect will decode utf-8, utf-7, utf-16le, utf-16be, utf-32le,
 and utf-32be in response message bodies based on the Content-Type
 header. This feature is on by default: normalize_utf = false will
 deactivate it.
 
-5.10.3.5. decompress_pdf
+5.10.3.6. decompress_pdf
 
 decompress_pdf = true will enable decompression of compressed
 portions of PDF files encountered in a message body. http_inspect
@@ -3981,7 +4003,7 @@ locate PDF streams with a single /FlateDecode filter. The compressed
 content is decompressed and made available through the file data rule
 option.
 
-5.10.3.6. decompress_swf
+5.10.3.7. decompress_swf
 
 decompress_swf = true will enable decompression of compressed SWF
 (Adobe Flash content) files encountered in a message body. The
@@ -3991,13 +4013,13 @@ LZMA. The compressed content is decompressed and made available
 through the file data rule option. The compressed SWF file signature
 is converted to FWS to indicate an uncompressed file.
 
-5.10.3.7. decompress_zip
+5.10.3.8. decompress_zip
 
 decompress_zip = true will enable decompression of compressed zip
 archives encountered in a message body. The compressed content is
 decompressed and made available through the file_data rule option.
 
-5.10.3.8. decompress_vba
+5.10.3.9. decompress_vba
 
 decompress_vba = true will enable decompression of RLE (Run Length
 Encoding) compressed vba (Visual Basic for Applications) macro data
@@ -4007,7 +4029,7 @@ Linking and Embedding) file embedded with the files containing RLE
 compressed vba macro data. The decompressed vba macro data is then
 made available through the vba_data ips rule option.
 
-5.10.3.9. normalize_javascript
+5.10.3.10. normalize_javascript
 
 normalize_javascript = true will enable legacy normalizer of
 JavaScript within the HTTP response body. http_inspect looks for
@@ -4020,7 +4042,7 @@ http_inspect also replaces consecutive whitespaces with a single
 space and normalizes the plus by concatenating the strings. Such
 normalizations refer to basic JavaScript normalization.
 
-5.10.3.10. js_norm_bytes_depth
+5.10.3.11. js_norm_bytes_depth
 
 js_norm_bytes_depth = N {-1 : max53} will set a number of input
 JavaScript bytes to normalize. When the depth is reached,
@@ -4036,7 +4058,7 @@ unique names with unified names representation: var_0000:var_ffff.
 The identifiers are variables and function names. The normalized data
 is available through the js_data rule option.
 
-5.10.3.11. js_norm_identifier_depth
+5.10.3.12. js_norm_identifier_depth
 
 js_norm_identifier_depth = N {0 : 65536} will set a number of unique
 JavaScript identifiers to normalize. When the depth is reached, a
@@ -4048,7 +4070,7 @@ response and not a single script. By default, the value is set to
 65536, which is the max allowed number of unique identifiers. The
 generated names are in the range from var_0000 to var_ffff.
 
-5.10.3.12. js_norm_max_tmpl_nest
+5.10.3.13. js_norm_max_tmpl_nest
 
 js_norm_max_tmpl_nest = N {0 : 255} (default 32) is an option of the
 enhanced JavaScript normalizer that determines the deepest level of
@@ -4060,7 +4082,7 @@ require keeping track of every layer for proper normalization. This
 option is present to limit the amount of memory dedicated to template
 nesting tracking.
 
-5.10.3.13. js_norm_max_bracket_depth
+5.10.3.14. js_norm_max_bracket_depth
 
 js_norm_max_bracket_depth = N {1 : 65535} (default 256) is an option
 of the enhanced JavaScript normalizer that determines the maximum
@@ -4069,7 +4091,7 @@ brackets, nested within a matching pair, in any combination. This
 option is present to limit the amount of memory dedicated to bracket
 tracking.
 
-5.10.3.14. js_norm_max_scope_depth
+5.10.3.15. js_norm_max_scope_depth
 
 js_norm_max_scope_depth = N {1 : 65535} (default 256) is an option of
 the enhanced JavaScript normalizer that determines the deepest level
@@ -4077,7 +4099,7 @@ of nested variable scope, i.e. functions, code blocks, etc. including
 the global scope. This option is present to limit the amount of
 memory dedicated to scope tracking.
 
-5.10.3.15. js_norm_ident_ignore
+5.10.3.16. js_norm_ident_ignore
 
 js_norm_ident_ignore = {<list of ignored identifiers>} is an option
 of the enhanced JavaScript normalizer that defines a list of
@@ -4127,7 +4149,7 @@ ought to be included in the ignore list. If for some reason the user
 wants to disable unescape related features, then removing function’s
 name from the ignore list does the trick.
 
-5.10.3.16. js_norm_prop_ignore
+5.10.3.17. js_norm_prop_ignore
 
 js_norm_prop_ignore = {<list of ignored properties>} is an option of
 the enhanced JavaScript normalizer that defines a list of object
@@ -4150,7 +4172,7 @@ out: "string".var_0000().split("").reverse().join("");
 The default list of ignored properties is present in
 "snort_defaults.lua".
 
-5.10.3.17. xff_headers
+5.10.3.18. xff_headers
 
 This configuration supports defining custom x-forwarded-for type
 headers. In a multi-vendor world, it is quite possible that the
@@ -4165,7 +4187,7 @@ they are defined, e.g "x-forwarded-for" will be preferred than
 "true-client-ip" if both headers are present in the stream. The
 header names should be delimited by a space.
 
-5.10.3.18. maximum_host_length
+5.10.3.19. maximum_host_length
 
 Setting maximum_host_length causes http_inspect to generate 119:25 if
 the Host header value including optional white space exceeds the
@@ -4173,7 +4195,7 @@ specified length. In the abnormal case of multiple Host headers, the
 total length of the combined values is used. The default value is -1,
 meaning do not perform this check.
 
-5.10.3.19. maximum_chunk_length
+5.10.3.20. maximum_chunk_length
 
 http_inspect strictly limits individual chunks within a chunked
 message body to be less than four gigabytes.
@@ -4181,17 +4203,17 @@ message body to be less than four gigabytes.
 A lower limit may be configured by setting maximum_chunk_length. Any
 chunk longer than maximum chunk length will generate a 119:16 alert.
 
-5.10.3.20. maximum_header_length
+5.10.3.21. maximum_header_length
 
 http_inspect generates 119:19 when the length of a header exceeds
 maximum_header_length = N {0 : 65535} (default 4096).
 
-5.10.3.21. maximum_headers
+5.10.3.22. maximum_headers
 
 http_inspect generates 119:20 when the number of headers exceeds
 maximum_headers = N {0 : 65535} (default 200).
 
-5.10.3.22. URI processing
+5.10.3.23. URI processing
 
 Normalization and inspection of the URI in the HTTP request message
 is a key aspect of what http_inspect does. The best way to normalize