Pull request #5090: build: generate and tag 3.10.1.0

Merge in SNORT/snort3 from ~PRBG/snort3:build_3.10.1.0 to master

Squashed commit of the following:

commit 6f5e73543576e443e22c2f2f2dd0693cde9bf42a
Author: Priyanka Gurudev <prbg@cisco.com>
Date:   Sun Jan 11 17:57:00 2026 -0500

    build: generate and tag 3.10.1.0

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 10c07afaed17395b667eec351a4bd20084b53ba6..a8df0240372f6c26b72a6691d6b6974c1d87c4ab 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,7 +3,7 @@ project (snort CXX C)
 
 set (VERSION_MAJOR 3)
 set (VERSION_MINOR 10)
-set (VERSION_PATCH 0)
+set (VERSION_PATCH 1)
 set (VERSION_SUBLEVEL 0)
 set (VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_SUBLEVEL}")
 

diff --git a/ChangeLog.md b/ChangeLog.md
index 76f2a286bd45b1d23985d2d3a35387d88cbbff11..895abb5b10b558e960a4d38ca6071d4375b4cb64 100644 (file)
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,57 @@
+2026-01-11: 3.10.1.0
+
+* alert_fast: ensure call_once definition doesn't collide in std vs glibc, thanks to krag on GitHub for suggesting this fix
+* alert_json: add support for logging appid, thanks to ssam18 on GitHub for suggesting this change
+* appid: add check to avoid setting brute force state for pending sessions that are pruned
+* appid: allow out-of-order packet inspection in third-party engine
+* appid: check for Lua table errors during initialization and cleanup
+* appid: enable out-of-order inspection by default
+* appid: fix client process regex mapping logic
+* appid: fix eve process handler event debug logging
+* appid: fix setting global ssh ignore flag
+* appid: fix size check in TFTP service detector
+* appid: mDNS TXT records parsing and deviceinfo event generation
+* appid: prevent multiple out-of-bounds reads in ssl
+* build: address compilation warnings
+* build: fix Coverity warnings in related components
+* cmake: fix pkg-config path for libdir, thanks to brianmcgillion on GitHub for submitting a similar fix
+* decoder: adding encode function for TransbridgeCodec
+* dns: add fix infinite recursion vulnerability
+* file: use new EVP functions rather than deprecated SHA functions
+* flow: add logs to show different ways a flow can fail to create
+* ftp_telnet: fix coverity errors and improve cmd_len configurability
+* ftp_telnet: fix ftp_cmd_pipe_index handling
+* ftp_telnet: Handle malformed traffic in ftp to generate alert
+* hash: update hashes to use new EVP functions, thanks to
+* http_inspect: add urlencoded to content-type list
+* http_inspect: fix coverity error
+* iec104: fix IEC 104 SQ0 bounds checks by removing duplicate asdu_size_map entries and using IO_GROUP sizes, preventing out-of-bounds reads
+* iec104: validate Type I length to prevent ASDU out-of-bounds read
+* ips_options: fix cursor position for byte_extract
+* ips_options: reset PCRE rule counts on new configuration loaded
+* main: update dioctl daqSnort latency common change
+* mime: add unit tests for data fitting memory limit
+* mime: add unit tests for data over memory limit
+* mime: add unit tests for file logging
+* mime: fix mime boundary parsing
+* mime: ignore field collection if not configured
+* mime: implement content parsing of multipart/form_data
+* mime: improve form-data collection for incomplete boundaries
+* mime: leave room for null-character in case of size limit hit
+* mime: remove unused forward-declaration
+* mime: rename class field to comply with the style
+* mime: return error code if cannot add headers for logging
+* pub_sub: add is_urlencoded method
+* sip: fix out-of-bounds reads in sip_parse_sdp_m
+* smb,dlp: update filename,filesize of FileInfo handling to enable dlp evaluation for repeated txns
+* smtp: usage of config cmds
+* snort2lua: fix failure in converting patterns containing commas
+* snort_ml: enable client body scanning by default
+* snort_ml: scan multipart form data
+* ssl: free certificate data if certificate length is 0
+* ssl: tls client hello check out of bounds fix
+* unified2: use proper API for obtaining VLAN ID from packet
+
 2025-11-24: 3.10.0.0
 
 * appid: ftp parsing bounds check

diff --git a/cmake/FindDAQ.cmake b/cmake/FindDAQ.cmake
index 5867a06ea89f8879b37d709dd31b25d4c65e453e..245ce658d7b24b6ea667b97acf1ef52d60da464e 100644 (file)
--- a/cmake/FindDAQ.cmake
+++ b/cmake/FindDAQ.cmake
@@ -16,7 +16,7 @@ This module defines:
 #]=======================================================================]
 
 find_package(PkgConfig)
-pkg_check_modules(PC_DAQ libdaq>=3.0.23)
+pkg_check_modules(PC_DAQ libdaq>=3.0.24)
 
 # Use DAQ_INCLUDE_DIR_HINT and DAQ_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints
 # and then package config information after that.

diff --git a/doc/reference/snort_reference.text b/doc/reference/snort_reference.text
index cbc1f5ef2db10b74a7ddc0499421d50cb6042c73..bbd7a5600e75b80df75ef1a5cea20c98750cb01f 100644 (file)
--- a/doc/reference/snort_reference.text
+++ b/doc/reference/snort_reference.text
@@ -8,7 +8,7 @@ Snort 3 Reference Manual
 The Snort Team
 
 Revision History
-Revision 3.10.0.0 2025-11-24 15:32:19 EST TST
+Revision 3.10.1.0 2026-01-11 17:51:32 EST TST
 
 ---------------------------------------------------------------------
 
@@ -5810,7 +5810,7 @@ Configuration:
 
   * int snort_ml.uri_depth = -1: number of input HTTP URI bytes to
     scan (-1 unlimited) { -1:max31 }
-  * int snort_ml.client_body_depth = 0: number of input HTTP client
+  * int snort_ml.client_body_depth = -1: number of input HTTP client
     body bytes to scan (-1 unlimited) { -1:max31 }
   * real snort_ml.http_param_threshold = 0.95: alert threshold for
     http_param_model { 0:1 }
@@ -6121,6 +6121,24 @@ Peg counts:
     to EOF (sum)
   * stream.excess_to_allowlist: number of flows moved to the
     allowlist due to excess (sum)
+  * stream.no_flow_no_proto_handler: packets without flow: no
+    protocol handler registered (sum)
+  * stream.no_flow_retry_packet: packets without flow: retry packet
+    dropped (sum)
+  * stream.no_flow_tcp_rst: packets without flow: TCP RST packet
+    (sum)
+  * stream.no_flow_unwanted: packets without flow: flow not wanted
+    (sum)
+  * stream.no_flow_midstream_reject: packets without flow: midstream
+    rejected (sum)
+  * stream.no_flow_alloc_failure: packets without flow: flow
+    allocation failed (sum)
+  * stream.no_flow_pkt_type_none: packets without flow: packet type
+    is NONE (sum)
+  * stream.no_flow_no_inspector: packets without flow: no flow
+    tracking inspector configured (sum)
+  * stream.no_flow_paf_no_flow: packets without flow: PAF payload but
+    no flow exists (sum)
   * stream.allowlist_flows: number of flows moved to the allowlist
     (now)
   * stream.current_flows: current number of flows in cache (now)
@@ -9328,7 +9346,7 @@ Configuration:
     stdout
   * multi alert_json.fields = timestamp pkt_num proto pkt_gen pkt_len
     dir src_ap dst_ap rule action: selected fields will be output in
-    given order left to right { action | class | b64_data |
+    given order left to right { action | app_id | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
     eth_dst | eth_len | eth_src | eth_type | flowstart_time |
     geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
@@ -9783,7 +9801,7 @@ libraries see the Getting Started section of the manual.
     (0 is unlimited) { 0:maxSZ }
   * multi alert_json.fields = timestamp pkt_num proto pkt_gen pkt_len
     dir src_ap dst_ap rule action: selected fields will be output in
-    given order left to right { action | class | b64_data |
+    given order left to right { action | app_id | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
     eth_dst | eth_len | eth_src | eth_type | flowstart_time |
     geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
@@ -11533,7 +11551,7 @@ libraries see the Getting Started section of the manual.
     engines
   * string snort.--metadata-filter: <filter> load only rules
     containing filter string in metadata if set
-  * int snort_ml.client_body_depth = 0: number of input HTTP client
+  * int snort_ml.client_body_depth = -1: number of input HTTP client
     body bytes to scan (-1 unlimited) { -1:max31 }
   * int snort_ml_engine.cache_memcap = 0: maximum memory for verdict
     cache in bytes, 0 = disabled { 0:maxSZ }
@@ -13149,6 +13167,24 @@ libraries see the Getting Started section of the manual.
   * stream_ip.trackers_completed: datagram trackers completed (sum)
   * stream_ip.trackers_freed: datagram trackers released (sum)
   * stream.memcap_prunes: sessions pruned due to memcap (sum)
+  * stream.no_flow_alloc_failure: packets without flow: flow
+    allocation failed (sum)
+  * stream.no_flow_midstream_reject: packets without flow: midstream
+    rejected (sum)
+  * stream.no_flow_no_inspector: packets without flow: no flow
+    tracking inspector configured (sum)
+  * stream.no_flow_no_proto_handler: packets without flow: no
+    protocol handler registered (sum)
+  * stream.no_flow_paf_no_flow: packets without flow: PAF payload but
+    no flow exists (sum)
+  * stream.no_flow_pkt_type_none: packets without flow: packet type
+    is NONE (sum)
+  * stream.no_flow_retry_packet: packets without flow: retry packet
+    dropped (sum)
+  * stream.no_flow_tcp_rst: packets without flow: TCP RST packet
+    (sum)
+  * stream.no_flow_unwanted: packets without flow: flow not wanted
+    (sum)
   * stream.pdu_eof_prunes: number of PDU flows pruned due to EOF
     (sum)
   * stream.pdu_memcap_prunes: number of PDU flows pruned due to

diff --git a/doc/upgrade/snort_upgrade.text b/doc/upgrade/snort_upgrade.text
index fe3e61e62c373e1b26b70ebd5caad56d4ca73746..5352ce40a754015314f10e3ccf5b89c19b21f953 100644 (file)
--- a/doc/upgrade/snort_upgrade.text
+++ b/doc/upgrade/snort_upgrade.text
@@ -8,7 +8,7 @@ Snort 3 Upgrade Manual
 The Snort Team
 
 Revision History
-Revision 3.10.0.0 2025-11-24 15:33:13 EST TST
+Revision 3.10.1.0 2026-01-11 17:52:25 EST TST
 
 ---------------------------------------------------------------------
 

diff --git a/doc/user/snort_user.text b/doc/user/snort_user.text
index 2620af49c462d58ed753094d8d441fdb00247df1..7c18bb2a12bd19c453d4af400e299bac05fd0c6b 100644 (file)
--- a/doc/user/snort_user.text
+++ b/doc/user/snort_user.text
@@ -8,7 +8,7 @@ Snort 3 User Manual
 The Snort Team
 
 Revision History
-Revision 3.10.0.0 2025-11-24 15:32:37 EST TST
+Revision 3.10.1.0 2026-01-11 17:51:49 EST TST
 
 ---------------------------------------------------------------------