+17/07/24 - build 238
+
+-- check: update hyperscan and regex tests
+-- cpputests: clean up some header include issues
+-- daq_socket: update to support query of pci
+-- detection: fix debug print of fast pattern only
+-- detection: rule evaluation trace utility
+-- doc: update concepts and differences
+-- file_api: memory leak fixed
+-- file_id: fixes for file capture exit
+-- http_inspect: added 119:97 for lower case letters in version field
+-- http_inspect: alert 119:96 added for unsolicited 206 response.
+-- http_inspect: specific alert added 119:95 for Content-Encoding chunked.
+-- ipv6: fix flow label access method; thanks to schrx3b6 for the patch
+-- loggers: remove units options; all limits expressed in MB
+-- mpse: Remove Intel Soft CPM support
+-- mpse: make regex capability generic
+-- mpse: only use literals for fast patterns if search_method is not hyperscan
+-- output: add packet trace feature
+-- perf_monitor: fixed main table (perf_monitor) having same name as pegs for
+-- perfmon field
+-- regex: fix pass through of mpse flags to hyperscan
+-- replace: do not trip over fast pattern only
+-- rpc: revert to positional params, fix tcp logic, clean up formatting
+-- rules: promote metadata:service to a separate option since it is not metadata
+-- snort2lua: Fixed incorrect file names errors
+-- snort2lua: move footprint to stream from stream_tcp
+-- spell check: fix message and comment typos
+-- stream: add ip_proto as part of flow key
+-- stream: fix user dependency on flush bucket
+-- text logs: fix default unlimited file size
+-- u2: add event3 to u2spewfoo
+-- u2: convert thread local buffers to heap
+-- u2: deprecate ip4 and ip6 specific events and add a single event for both
+-- u2: remove obsolete configurations
+-- u2: support mixed IP versions
+
17/07/13 - build 237
-- build: add support for appending EXTRABUILD to the BUILD string
(Snort 2 supports only 2 IP layers)
* process PDU buffers
(Snort 2 only processes packets)
-* fully stateful http_inspect with 83 builtin alerts
+* fully stateful http_inspect with 97 builtin alerts
(Snort 2 is only partly stateful with 33 builtin alerts)
* output all semantic errors before quitting
(Snort 2 stops at first one)
-* alert service (eg http) and alert file rules
+* alert file rules
+ (Snort 2 must use multiple rules)
+* alert service rules, eg alert http
(Snort 2 must use metadata:service)
+* automatic fast_pattern only
+ (Snort 2 requires explicit fast_pattern:only)
* elided rule headers omit nets and/or ports
(Snort 2 requires explicit 'any')
* dump builtin rule stubs
=== Rules
* all rules must have a sid
+* sid == 0 not allowed
* deleted activate / dynamic rules
+* deleted unused rule_state.action
* deleted metadata engine shared
* deleted metadata: rule-flushing (with PDU flushing rule flushing can cause
missed attacks, the opposite of its intent)
-* deleted unused rule_state.action
-* fastpattern_offset, fast_pattern_length
+* changed metadata:service one[, service two]; to service:one[, two];
+* soid is now a non-metadata option
+* metadata is now truly metadata with no impact on detection
+ (Snort doesn't care about metadata internal structure / syntax)
+* deleted fast_pattern:only; use fast_pattern, nocase
+ (option is not added to detection tree if not required)
+* changed fast_pattern:<offset>,<length> to
+ fastpattern_offset: <offset>, fast_pattern_length <length>
+* fast pattern sensitive data with sd_pattern using hyperscan
+* hyperscan regex fast patterns with regex:"<regex>", fast_pattern;
* no ; separated content suboptions
* offset, depth, distance, and within must use a space separator not colon
(e.g. offset:5; becomes offset 5;)
-* rule option sequence: <stub> soid <hidden>
-* sid == 0 not allowed
-* soid is now a non-metadata option
-* content suboptions http_* are now full options and should be place before content
+* content suboptions http_* are now full options
+* added sticky buffers: buffer selector options must precede contents and remain
+ in effect until changed
* the following pcre options have been deleted: use sticky buffers instead
B, U, P, H, M, C, I, D, K, S, Y
-* deleted uricontent ips rule option.
+* deleted uricontent option; use sticky buffer
uricontent:"foo" --> http_uri; content:"foo"
* deleted urilen raw and norm; must use http_raw_uri and http_uri instead
* deleted unused http_encode option
* urilen replaced with generic bufferlen which applies to current sticky
buffer
* added optional selector to http_header, e.g. http_header:User-Agent;
-* multiline rules w/o \n
-* #begin ... #end comments
+* the all new http_inspect has new buffers and rule options
+* added alert file and alert service rules
+ (service in body not required if there is only one and it is in header;
+ alert service / file rules disable fast pattern searching of raw packets)
+* rule option sequence: <stub> soid <hidden>
+* arbitrary whitespace and multiline rules w/o \n
+* #begin ... #end comments to easily commment out multiple lines
+* add rule remarks option with rem:"arbitrary comment"
+* nets and/or ports may be omitted from rule headers (matches any)
+* parse all rules and output all errors before quitting
+* read rules from conf, separate rules file, or stdin
=== Output
projects / thirdparty / snort3.git / commitdiff
