Merge pull request #1615 in SNORT/snort3 from ~NIHDESAI/snort3:build_256 to master

Squashed commit of the following:

commit 68d6c61b35320abc1301d55a0bac95d57e25ec3c
Author: Nihal Desai <nihdesai@cisco.com>
Date:   Wed May 22 13:42:31 2019 -0400

    build: generate build 256

diff --git a/ChangeLog b/ChangeLog
index eec8027ffe099e37c278c6ae64623e7937c49645..5f5cd92ad033b6c63c85eab4d6ed4e8a258f6df8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,33 @@
+19/05/22 - build 256
+
+-- DAQng: Port Snort and its DAQ modules to DAQ3
+   - Massive refactoring of the Analyzer thread
+   - Handle multiple offloaded wire packets
+   - Port hext and file DAQ modules to DAQng
+   - Reimplement the RETRY verdict internal to Snort
+   - Revamp skip-n/exit-after-n/pause-after-n handling
+   - Update lua tweaks with new DAQ configuration format
+   - Update sfdaq unit tests for DAQng
+   - Update snort2lua to convert to new DAQ configuration
+-- filters: add peg count for when the thd_runtime XHash table gets full.
+-- filters: make thd_runtime and rf_hash thread local and allocate them from thread init 
+   rather than from Module::end()
+-- http_inspect: fix status_code_num bug in HttpMsgHeader::update_flow() that leads to 
+   assert on input.length()>0 in norm_decimal_integer
+-- main: Fix File Descriptor leaks
+-- main: Include analyzer.h in snort.c
+-- packet_io: Refactor the Trough a bit
+-- perf_mon: Fixed time stamp and memory leak issue
+   - Add real timestamp to empty perf_stats data
+   - Updated dbus default subscription code and perf_mon event subscirption code 
+     to resolve memory leak and invalid event subscription from reloading
+   - Moved flow_ip_tracker to thread local
+-- perf_monitor: Fixing heap-use-after-free after reload failure
+-- port_scan: Change minimum memcap value to 1024 to avoid divide by zero crash
+-- rule_state: change enable values "true" / "false" to "yes" / "no"
+-- snort2lua: Remove sticky buffer duplicates
+-- stream: disable inspection of flow on reset
+
 19/05/03 - build 255
 
 -- ips: add includer for better relative path support

diff --git a/doc/snort_manual.html b/doc/snort_manual.html
index 03414af31e16e60b3e27711ca6292a3c5c6bd8ac..4ffb514c9be6a6c84dedb18aa3c4d6562dfa6f19 100644 (file)
--- a/doc/snort_manual.html
+++ b/doc/snort_manual.html
@@ -782,7 +782,7 @@ asciidoc.install(2);
 <div class="literalblock">\r
 <div class="content">\r
 <pre><code> ,,_     -*&gt; Snort++ &lt;*-\r
-o"  )~   Version 3.0.0 (Build 254) from 2.9.11\r
+o"  )~   Version 3.0.0 (Build 256) from 2.9.11\r
  ''''    By Martin Roesch &amp; The Snort Team\r
          http://snort.org/contact#team\r
          Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights reserved.\r
@@ -1203,6 +1203,50 @@ include statement.  In addition you can load rules like:</p></div>
 <div class="paragraph"><p>You can use both approaches together.</p></div>\r
 </div>\r
 <div class="sect3">\r
+<h4 id="_includes">Includes</h4>\r
+<div class="paragraph"><p>Your configuration file file may include other files, either directly via Lua or via\r
+various parameters.  Snort will find relative includes in the following order:</p></div>\r
+<div class="olist arabic"><ol class="arabic">\r
+<li>\r
+<p>\r
+If you specify --include-path, this directory will be tried first.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Snort will try the directory containing the including file.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Snort will try the directory containing the -c configuration file.\r
+</p>\r
+</li>\r
+</ol></div>\r
+<div class="paragraph"><p>Some things to keep in mind:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+If you use the Lua dofile function, then you must specify absolute paths\r
+  or paths relative to your working directory since Lua will execute the\r
+  include before Snort sees the file contents.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+For best results, use include in place of dofile.  This function is\r
+  provided to follow Snort&#8217;s include logic.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+As of now, appid and reputation paths must be absolute or relative to the\r
+  working directory.  These will be updated in a future release.\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect3">\r
 <h4 id="_converting_your_2_x_configuration">Converting Your 2.X Configuration</h4>\r
 <div class="paragraph"><p>If you have a working 2.X configuration snort2lua makes it easy to get up\r
 and running with Snort 3.  This tool will convert your configuration and/or\r
@@ -7110,47 +7154,37 @@ string <strong><code>classifications[].text</code></strong>: description of clas
 <div class="ulist"><ul>\r
 <li>\r
 <p>\r
-string <strong><code>daq.module_dirs[].str</code></strong>: string parameter\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>daq.input_spec</strong>: input specification\r
+string <strong><code>daq.module_dirs[].path</code></strong>: directory path\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong>daq.module</strong>: DAQ module to use\r
+string <strong><code>daq.inputs[].input</code></strong>: input source\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.variables[].str</code></strong>: string parameter\r
+int <strong>daq.snaplen</strong> = 1518: set snap length (same as -s) { 0:65535 }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong><code>daq.instances[].id</code></strong>: instance ID (required) { 0:max32 }\r
+int <strong>daq.batch_size</strong> = 64: set receive batch size (same as --daq-batch-size) { 1: }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.instances[].input_spec</code></strong>: input specification\r
+string <strong><code>daq.modules[].name</code></strong>: DAQ module name (required)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.instances[].variables[].str</code></strong>: string parameter\r
+enum <strong><code>daq.modules[].mode</code></strong> = passive: DAQ module mode { passive | inline | read-file }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>daq.snaplen</strong>: set snap length (same as -s) { 0:65535 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>daq.no_promisc</strong> = false: whether to put DAQ device into promiscuous mode\r
+string <strong><code>daq.modules[].variables[].variable</code></strong>: DAQ module variable (foo[=bar])\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -7258,6 +7292,14 @@ bool <strong>daq.no_promisc</strong> = false: whether to put DAQ device into pro
 <div class="paragraph"><p>What: general decoder rules</p></div>\r
 <div class="paragraph"><p>Type: basic</p></div>\r
 <div class="paragraph"><p>Usage: context</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+int <strong>decode.trace</strong>: mask for enabling debug traces in module { 0:max53 }\r
+</p>\r
+</li>\r
+</ul></div>\r
 <div class="paragraph"><p>Rules:</p></div>\r
 <div class="ulist"><ul>\r
 <li>\r
@@ -7512,6 +7554,19 @@ string <strong><code>event_filter[].ip</code></strong>: restrict filter to these
 </p>\r
 </li>\r
 </ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>event_filter.no_memory_local</strong>: number of times event filter ran out of local memory (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>event_filter.no_memory_global</strong>: number of times event filter ran out of global memory (sum)\r
+</p>\r
+</li>\r
+</ul></div>\r
 </div>\r
 <div class="sect2">\r
 <h3 id="_event_queue">event_queue</h3>\r
@@ -7765,7 +7820,7 @@ enum <strong>inspection.mode</strong> = inline-test: set policy mode { inline |
 <div class="ulist"><ul>\r
 <li>\r
 <p>\r
-enum <strong>ips.default_rule_state</strong> = inherit: enable or disable ips rules { false | true | inherit }\r
+enum <strong>ips.default_rule_state</strong> = inherit: enable or disable ips rules { no | yes | inherit }\r
 </p>\r
 </li>\r
 <li>\r
@@ -7780,7 +7835,12 @@ int <strong>ips.id</strong> = 0: correlate unified2 events with configuration {
 </li>\r
 <li>\r
 <p>\r
-string <strong>ips.include</strong>: legacy snort rules and includes\r
+string <strong>ips.include</strong>: snort rules and includes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>ips.includer</strong>: for internal use; where includes are included from { (optional) }\r
 </p>\r
 </li>\r
 <li>\r
@@ -8322,6 +8382,14 @@ string <strong><code>rate_filter[].apply_to</code></strong>: restrict filter to
 </p>\r
 </li>\r
 </ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>rate_filter.no_memory</strong>: number of times rate filter ran out of memory (sum)\r
+</p>\r
+</li>\r
+</ul></div>\r
 </div>\r
 <div class="sect2">\r
 <h3 id="_references">references</h3>\r
@@ -8356,7 +8424,7 @@ enum <strong><code>rule_state.([0-9]+):([0-9]+)[].action</code></strong> = inher
 </li>\r
 <li>\r
 <p>\r
-enum <strong><code>rule_state.([0-9]+):([0-9]+)[].enable</code></strong> = inherit: enable or disable rule in current ips policy or use default defined by ips policy { false | true | inherit }\r
+enum <strong><code>rule_state.([0-9]+):([0-9]+)[].enable</code></strong> = inherit: enable or disable rule in current ips policy or use default defined by ips policy { no | yes | inherit }\r
 </p>\r
 </li>\r
 </ul></div>\r
@@ -8744,6 +8812,11 @@ string <strong>snort.--daq</strong>: &lt;type&gt; select packet acquisition modu
 </li>\r
 <li>\r
 <p>\r
+int <strong>snort.--daq-batch-size</strong> = 64: &lt;size&gt; set the DAQ receive batch size { 1: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.--daq-dir</strong>: &lt;dir&gt; tell snort where to find desired DAQ\r
 </p>\r
 </li>\r
@@ -8754,6 +8827,11 @@ implied <strong>snort.--daq-list</strong>: list packet acquisition modules avail
 </li>\r
 <li>\r
 <p>\r
+enum <strong>snort.--daq-mode</strong>: &lt;mode&gt; select DAQ module operating mode (overrides automatic selection) { passive | inline | read-file }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.--daq-var</strong>: &lt;name=value&gt; specify extra DAQ configuration variable\r
 </p>\r
 </li>\r
@@ -14296,7 +14374,7 @@ int <strong>pop.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth (-1
 <div class="ulist"><ul>\r
 <li>\r
 <p>\r
-int <strong>port_scan.memcap</strong> = 1048576: maximum tracker memory in bytes { 1:maxSZ }\r
+int <strong>port_scan.memcap</strong> = 1048576: maximum tracker memory in bytes { 1024:maxSZ }\r
 </p>\r
 </li>\r
 <li>\r
@@ -23576,6 +23654,11 @@ these libraries see the Getting Started section of the manual.</p></div>
 </li>\r
 <li>\r
 <p>\r
+<strong>--daq-batch-size</strong> &lt;size&gt; set the DAQ receive batch size (1:)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>--daq-dir</strong> &lt;dir&gt; tell snort where to find desired DAQ\r
 </p>\r
 </li>\r
@@ -23586,6 +23669,11 @@ these libraries see the Getting Started section of the manual.</p></div>
 </li>\r
 <li>\r
 <p>\r
+<strong>--daq-mode</strong> &lt;mode&gt; select DAQ module operating mode (overrides automatic selection) (passive | inline | read-file)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>--daq-var</strong> &lt;name=value&gt; specify extra DAQ configuration variable\r
 </p>\r
 </li>\r
@@ -24751,47 +24839,37 @@ implied <strong>cvs.invalid-entry</strong>: looks for an invalid Entry string
 </li>\r
 <li>\r
 <p>\r
-string <strong>daq.input_spec</strong>: input specification\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong><code>daq.instances[].id</code></strong>: instance ID (required) { 0:max32 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong><code>daq.instances[].input_spec</code></strong>: input specification\r
+int <strong>daq.batch_size</strong> = 64: set receive batch size (same as --daq-batch-size) { 1: }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.instances[].variables[].str</code></strong>: string parameter\r
+string <strong><code>daq.inputs[].input</code></strong>: input source\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong>daq.module</strong>: DAQ module to use\r
+string <strong><code>daq.module_dirs[].path</code></strong>: directory path\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.module_dirs[].str</code></strong>: string parameter\r
+enum <strong><code>daq.modules[].mode</code></strong> = passive: DAQ module mode { passive | inline | read-file }\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-bool <strong>daq.no_promisc</strong> = false: whether to put DAQ device into promiscuous mode\r
+string <strong><code>daq.modules[].name</code></strong>: DAQ module name (required)\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-int <strong>daq.snaplen</strong>: set snap length (same as -s) { 0:65535 }\r
+string <strong><code>daq.modules[].variables[].variable</code></strong>: DAQ module variable (foo[=bar])\r
 </p>\r
 </li>\r
 <li>\r
 <p>\r
-string <strong><code>daq.variables[].str</code></strong>: string parameter\r
+int <strong>daq.snaplen</strong> = 1518: set snap length (same as -s) { 0:65535 }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26141,7 +26219,7 @@ string <strong>ip_proto.~proto</strong>: [!|&gt;|&lt;] name or number
 </li>\r
 <li>\r
 <p>\r
-enum <strong>ips.default_rule_state</strong> = inherit: enable or disable ips rules { false | true | inherit }\r
+enum <strong>ips.default_rule_state</strong> = inherit: enable or disable ips rules { no | yes | inherit }\r
 </p>\r
 </li>\r
 <li>\r
@@ -26156,7 +26234,12 @@ int <strong>ips.id</strong> = 0: correlate unified2 events with configuration {
 </li>\r
 <li>\r
 <p>\r
-string <strong>ips.include</strong>: legacy snort rules and includes\r
+string <strong>ips.includer</strong>: for internal use; where includes are included from { (optional) }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>ips.include</strong>: snort rules and includes\r
 </p>\r
 </li>\r
 <li>\r
@@ -26866,7 +26949,7 @@ int <strong>port_scan.ip_window</strong> = 0: detection interval for all IP scan
 </li>\r
 <li>\r
 <p>\r
-int <strong>port_scan.memcap</strong> = 1048576: maximum tracker memory in bytes { 1:maxSZ }\r
+int <strong>port_scan.memcap</strong> = 1048576: maximum tracker memory in bytes { 1024:maxSZ }\r
 </p>\r
 </li>\r
 <li>\r
@@ -27356,7 +27439,7 @@ enum <strong><code>rule_state.([0-9]+):([0-9]+)[].action</code></strong> = inher
 </li>\r
 <li>\r
 <p>\r
-enum <strong><code>rule_state.([0-9]+):([0-9]+)[].enable</code></strong> = inherit: enable or disable rule in current ips policy or use default defined by ips policy { false | true | inherit }\r
+enum <strong><code>rule_state.([0-9]+):([0-9]+)[].enable</code></strong> = inherit: enable or disable rule in current ips policy or use default defined by ips policy { no | yes | inherit }\r
 </p>\r
 </li>\r
 <li>\r
@@ -27776,6 +27859,11 @@ implied <strong>snort.--create-pidfile</strong>: create PID file, even when not
 </li>\r
 <li>\r
 <p>\r
+int <strong>snort.--daq-batch-size</strong> = 64: &lt;size&gt; set the DAQ receive batch size { 1: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.--daq-dir</strong>: &lt;dir&gt; tell snort where to find desired DAQ\r
 </p>\r
 </li>\r
@@ -27786,6 +27874,11 @@ implied <strong>snort.--daq-list</strong>: list packet acquisition modules avail
 </li>\r
 <li>\r
 <p>\r
+enum <strong>snort.--daq-mode</strong>: &lt;mode&gt; select DAQ module operating mode (overrides automatic selection) { passive | inline | read-file }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 string <strong>snort.--daq</strong>: &lt;type&gt; select packet acquisition module (default is pcap)\r
 </p>\r
 </li>\r
@@ -29831,6 +29924,16 @@ interval <strong>wscale.~range</strong>: check if TCP window scale is in given r
 </li>\r
 <li>\r
 <p>\r
+<strong>event_filter.no_memory_global</strong>: number of times event filter ran out of global memory (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>event_filter.no_memory_local</strong>: number of times event filter ran out of local memory (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>file_connector.messages</strong>: total messages (sum)\r
 </p>\r
 </li>\r
@@ -30641,6 +30744,11 @@ interval <strong>wscale.~range</strong>: check if TCP window scale is in given r
 </li>\r
 <li>\r
 <p>\r
+<strong>rate_filter.no_memory</strong>: number of times rate filter ran out of memory (sum)\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
 <strong>reg_test.packets</strong>: total packets (sum)\r
 </p>\r
 </li>\r
@@ -34737,9 +34845,7 @@ change -&gt; attribute_table: 'STREAM_POLICY' ==&gt; 'hosts: tcp_policy'
 change -&gt; attribute_table: 'filename &lt;file_name&gt;' ==&gt; 'hosts[]'\r
 change -&gt; config ' addressspace_agnostic'  ==&gt; ' packets. address_space_agnostic'\r
 change -&gt; config ' checksum_mode'  ==&gt; ' network. checksum_eval'\r
-change -&gt; config ' daq'  ==&gt; ' daq. module'\r
 change -&gt; config ' daq_dir'  ==&gt; ' daq. module_dirs, true'\r
-change -&gt; config ' daq_var'  ==&gt; ' daq. variables, true'\r
 change -&gt; config ' detection_filter'  ==&gt; ' alerts. detection_filter_memcap'\r
 change -&gt; config ' enable_deep_teredo_inspection'  ==&gt; ' udp. deep_teredo_inspection'\r
 change -&gt; config ' event_filter'  ==&gt; ' alerts. event_filter_memcap'\r
@@ -34777,6 +34883,9 @@ change -&gt; csv: 'tcplen' ==&gt; 'tcp_len'
 change -&gt; csv: 'tcpseq' ==&gt; 'tcp_seq'\r
 change -&gt; csv: 'tcpwindow' ==&gt; 'tcp_win'\r
 change -&gt; csv: 'udplength' ==&gt; 'udp_len'\r
+change -&gt; daq: 'config daq:' ==&gt; 'name'\r
+change -&gt; daq_mode: 'config daq_mode:' ==&gt; 'mode'\r
+change -&gt; daq_var: 'config daq_var:' ==&gt; 'variables'\r
 change -&gt; detection: 'ac' ==&gt; 'ac_full'\r
 change -&gt; detection: 'ac-banded' ==&gt; 'ac_banded'\r
 change -&gt; detection: 'ac-bnfa' ==&gt; 'ac_bnfa'\r
@@ -34937,7 +35046,6 @@ deleted -&gt; attribute_table: '&lt;FRAG_POLICY&gt;unknown&lt;/FRAG_POLICY&gt;'
 deleted -&gt; attribute_table: '&lt;STREAM_POLICY&gt;noack&lt;/STREAM_POLICY&gt;'\r
 deleted -&gt; attribute_table: '&lt;STREAM_POLICY&gt;unknown&lt;/STREAM_POLICY&gt;'\r
 deleted -&gt; config ' cs_dir'\r
-deleted -&gt; config ' daq_mode'\r
 deleted -&gt; config ' decode_data_link'\r
 deleted -&gt; config ' disable_attribute_reload_thread'\r
 deleted -&gt; config ' disable_decode_alerts'\r
@@ -34973,6 +35081,7 @@ deleted -&gt; config ' include_vlan_in_alerts'
 deleted -&gt; config ' interface'\r
 deleted -&gt; config ' layer2resets'\r
 deleted -&gt; config ' log_ipv6_extra_data'\r
+deleted -&gt; config ' no_promisc'\r
 deleted -&gt; config ' nolog'\r
 deleted -&gt; config ' protected_content'\r
 deleted -&gt; config ' sidechannel'\r
@@ -38157,7 +38266,7 @@ Adding/removing stream_* inspectors if stream was already configured
 <div id="footer">\r
 <div id="footer-text">\r
 Last updated\r
- 2019-04-26 17:06:59 EDT\r
+ 2019-05-22 13:47:52 EDT\r
 </div>\r
 </div>\r
 </body>\r

diff --git a/doc/snort_manual.pdf b/doc/snort_manual.pdf
index e95b45548c01e08b21ad35ef1e9e105f810061df..891894a72a18a31ef25f6182ee0366a495701fed 100644 (file)
Binary files a/doc/snort_manual.pdf and b/doc/snort_manual.pdf differ

diff --git a/doc/snort_manual.text b/doc/snort_manual.text
index 22567f3d17bff52be1bbf5a737c83d3aee1eb130..88a6e7a507f46d60a773edd3f8e37ff5056f05a0 100644 (file)
--- a/doc/snort_manual.text
+++ b/doc/snort_manual.text
@@ -386,7 +386,7 @@ Table of Contents
 Snorty
 
  ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.0 (Build 254) from 2.9.11
+o"  )~   Version 3.0.0 (Build 256) from 2.9.11
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights reserved.
@@ -667,7 +667,30 @@ $ sort -c snort.lua -R rules.txt
 
 You can use both approaches together.
 
-1.2.4. Converting Your 2.X Configuration
+1.2.4. Includes
+
+Your configuration file file may include other files, either directly
+via Lua or via various parameters. Snort will find relative includes
+in the following order:
+
+ 1. If you specify --include-path, this directory will be tried
+    first.
+ 2. Snort will try the directory containing the including file.
+ 3. Snort will try the directory containing the -c configuration
+    file.
+
+Some things to keep in mind:
+
+  * If you use the Lua dofile function, then you must specify
+    absolute paths or paths relative to your working directory since
+    Lua will execute the include before Snort sees the file contents.
+  * For best results, use include in place of dofile. This function
+    is provided to follow Snort’s include logic.
+  * As of now, appid and reputation paths must be absolute or
+    relative to the working directory. These will be updated in a
+    future release.
+
+1.2.5. Converting Your 2.X Configuration
 
 If you have a working 2.X configuration snort2lua makes it easy to
 get up and running with Snort 3. This tool will convert your
@@ -5446,16 +5469,16 @@ Usage: global
 
 Configuration:
 
-  * string daq.module_dirs[].str: string parameter
-  * string daq.input_spec: input specification
-  * string daq.module: DAQ module to use
-  * string daq.variables[].str: string parameter
-  * int daq.instances[].id: instance ID (required) { 0:max32 }
-  * string daq.instances[].input_spec: input specification
-  * string daq.instances[].variables[].str: string parameter
-  * int daq.snaplen: set snap length (same as -s) { 0:65535 }
-  * bool daq.no_promisc = false: whether to put DAQ device into
-    promiscuous mode
+  * string daq.module_dirs[].path: directory path
+  * string daq.inputs[].input: input source
+  * int daq.snaplen = 1518: set snap length (same as -s) { 0:65535 }
+  * int daq.batch_size = 64: set receive batch size (same as
+    --daq-batch-size) { 1: }
+  * string daq.modules[].name: DAQ module name (required)
+  * enum daq.modules[].mode = passive: DAQ module mode { passive |
+    inline | read-file }
+  * string daq.modules[].variables[].variable: DAQ module variable
+    (foo[=bar])
 
 Peg counts:
 
@@ -5493,6 +5516,11 @@ Type: basic
 
 Usage: context
 
+Configuration:
+
+  * int decode.trace: mask for enabling debug traces in module {
+    0:max53 }
+
 Rules:
 
   * 116:450 (decode) bad IP protocol
@@ -5596,6 +5624,13 @@ Configuration:
   * string event_filter[].ip: restrict filter to these addresses
     according to track
 
+Peg counts:
+
+  * event_filter.no_memory_local: number of times event filter ran
+    out of local memory (sum)
+  * event_filter.no_memory_global: number of times event filter ran
+    out of global memory (sum)
+
 
 6.9. event_queue
 
@@ -5760,12 +5795,14 @@ Usage: detect
 Configuration:
 
   * enum ips.default_rule_state = inherit: enable or disable ips
-    rules { false | true | inherit }
+    rules { no | yes | inherit }
   * bool ips.enable_builtin_rules = false: enable events from builtin
     rules w/o stubs
   * int ips.id = 0: correlate unified2 events with configuration {
     0:65535 }
-  * string ips.include: legacy snort rules and includes
+  * string ips.include: snort rules and includes
+  * string ips.includer: for internal use; where includes are
+    included from { (optional) }
   * enum ips.mode: set policy mode { tap | inline | inline-test }
   * string ips.rules: snort rules and includes
   * bool ips.obfuscate_pii = false: mask all but the last 4
@@ -6053,6 +6090,11 @@ Configuration:
   * string rate_filter[].apply_to: restrict filter to these addresses
     according to track
 
+Peg counts:
+
+  * rate_filter.no_memory: number of times rate filter ran out of
+    memory (sum)
+
 
 6.25. references
 
@@ -6087,7 +6129,7 @@ Configuration:
     pass | alert | drop | block | reset | inherit }
   * enum rule_state.([0-9]+):([0-9]+)[].enable = inherit: enable or
     disable rule in current ips policy or use default defined by ips
-    policy { false | true | inherit }
+    policy { no | yes | inherit }
 
 
 6.27. search_engine
@@ -6250,10 +6292,14 @@ Configuration:
     Daemon mode
   * string snort.--daq: <type> select packet acquisition module
     (default is pcap)
+  * int snort.--daq-batch-size = 64: <size> set the DAQ receive batch
+    size { 1: }
   * string snort.--daq-dir: <dir> tell snort where to find desired
     DAQ
   * implied snort.--daq-list: list packet acquisition modules
     available in optional dir, default is static modules only
+  * enum snort.--daq-mode: <mode> select DAQ module operating mode
+    (overrides automatic selection) { passive | inline | read-file }
   * string snort.--daq-var: <name=value> specify extra DAQ
     configuration variable
   * implied snort.--dirty-pig: don’t flush packets on shutdown
@@ -8655,7 +8701,7 @@ Usage: global
 Configuration:
 
   * int port_scan.memcap = 1048576: maximum tracker memory in bytes {
-    1:maxSZ }
+    1024:maxSZ }
   * multi port_scan.protos = all: choose the protocols to monitor {
     tcp | udp | icmp | ip | all }
   * multi port_scan.scan_types = all: choose type of scans to look
@@ -13917,9 +13963,12 @@ these libraries see the Getting Started section of the manual.
   * --control-socket <file> to create unix socket
   * --create-pidfile create PID file, even when not in Daemon mode
   * --daq <type> select packet acquisition module (default is pcap)
+  * --daq-batch-size <size> set the DAQ receive batch size (1:)
   * --daq-dir <dir> tell snort where to find desired DAQ
   * --daq-list list packet acquisition modules available in optional
     dir, default is static modules only
+  * --daq-mode <mode> select DAQ module operating mode (overrides
+    automatic selection) (passive | inline | read-file)
   * --daq-var <name=value> specify extra DAQ configuration variable
   * --dirty-pig don’t flush packets on shutdown
   * --dump-builtin-rules [<module prefix>] output stub rules for
@@ -14318,16 +14367,16 @@ these libraries see the Getting Started section of the manual.
   * string content.within: var or maximum number of bytes to search
     from cursor
   * implied cvs.invalid-entry: looks for an invalid Entry string
-  * string daq.input_spec: input specification
-  * int daq.instances[].id: instance ID (required) { 0:max32 }
-  * string daq.instances[].input_spec: input specification
-  * string daq.instances[].variables[].str: string parameter
-  * string daq.module: DAQ module to use
-  * string daq.module_dirs[].str: string parameter
-  * bool daq.no_promisc = false: whether to put DAQ device into
-    promiscuous mode
-  * int daq.snaplen: set snap length (same as -s) { 0:65535 }
-  * string daq.variables[].str: string parameter
+  * int daq.batch_size = 64: set receive batch size (same as
+    --daq-batch-size) { 1: }
+  * string daq.inputs[].input: input source
+  * string daq.module_dirs[].path: directory path
+  * enum daq.modules[].mode = passive: DAQ module mode { passive |
+    inline | read-file }
+  * string daq.modules[].name: DAQ module name (required)
+  * string daq.modules[].variables[].variable: DAQ module variable
+    (foo[=bar])
+  * int daq.snaplen = 1518: set snap length (same as -s) { 0:65535 }
   * select data_log.key = http_request_header_event : name of the
     event to log { http_request_header_event |
     http_response_header_event }
@@ -14796,12 +14845,14 @@ these libraries see the Getting Started section of the manual.
     lsrre|ssrr|satid|any }
   * string ip_proto.~proto: [!|>|<] name or number
   * enum ips.default_rule_state = inherit: enable or disable ips
-    rules { false | true | inherit }
+    rules { no | yes | inherit }
   * bool ips.enable_builtin_rules = false: enable events from builtin
     rules w/o stubs
   * int ips.id = 0: correlate unified2 events with configuration {
     0:65535 }
-  * string ips.include: legacy snort rules and includes
+  * string ips.includer: for internal use; where includes are
+    included from { (optional) }
+  * string ips.include: snort rules and includes
   * enum ips.mode: set policy mode { tap | inline | inline-test }
   * bool ips.obfuscate_pii = false: mask all but the last 4
     characters of credit card and social security numbers
@@ -15055,7 +15106,7 @@ these libraries see the Getting Started section of the manual.
   * int port_scan.ip_window = 0: detection interval for all IP scans
     { 0:max32 }
   * int port_scan.memcap = 1048576: maximum tracker memory in bytes {
-    1:maxSZ }
+    1024:maxSZ }
   * multi port_scan.protos = all: choose the protocols to monitor {
     tcp | udp | icmp | ip | all }
   * multi port_scan.scan_types = all: choose type of scans to look
@@ -15220,7 +15271,7 @@ these libraries see the Getting Started section of the manual.
     pass | alert | drop | block | reset | inherit }
   * enum rule_state.([0-9]+):([0-9]+)[].enable = inherit: enable or
     disable rule in current ips policy or use default defined by ips
-    policy { false | true | inherit }
+    policy { no | yes | inherit }
   * string sd_pattern.~pattern: The pattern to search for
   * int sd_pattern.threshold = 1: number of matches before alerting {
     1:max32 }
@@ -15368,10 +15419,14 @@ these libraries see the Getting Started section of the manual.
     hex)
   * implied snort.--create-pidfile: create PID file, even when not in
     Daemon mode
+  * int snort.--daq-batch-size = 64: <size> set the DAQ receive batch
+    size { 1: }
   * string snort.--daq-dir: <dir> tell snort where to find desired
     DAQ
   * implied snort.--daq-list: list packet acquisition modules
     available in optional dir, default is static modules only
+  * enum snort.--daq-mode: <mode> select DAQ module operating mode
+    (overrides automatic selection) { passive | inline | read-file }
   * string snort.--daq: <type> select packet acquisition module
     (default is pcap)
   * string snort.--daq-var: <name=value> specify extra DAQ
@@ -16021,6 +16076,10 @@ these libraries see the Getting Started section of the manual.
   * domain_filter.checked: domains checked (sum)
   * domain_filter.filtered: domains filtered (sum)
   * dpx.packets: total packets (sum)
+  * event_filter.no_memory_global: number of times event filter ran
+    out of global memory (sum)
+  * event_filter.no_memory_local: number of times event filter ran
+    out of local memory (sum)
   * file_connector.messages: total messages (sum)
   * file_id.cache_failures: number of file cache add failures (sum)
   * file_id.total_file_data: number of file data bytes processed
@@ -16232,6 +16291,8 @@ these libraries see the Getting Started section of the manual.
   * pop.uu_attachments: total uu attachments decoded (sum)
   * pop.uu_decoded_bytes: total uu decoded bytes (sum)
   * port_scan.packets: total packets (sum)
+  * rate_filter.no_memory: number of times rate filter ran out of
+    memory (sum)
   * reg_test.packets: total packets (sum)
   * reg_test.retry_packets: total retried packets received (sum)
   * reg_test.retry_requests: total retry packets requested (sum)
@@ -17239,9 +17300,7 @@ change -> attribute_table: 'STREAM_POLICY' ==> 'hosts: tcp_policy'
 change -> attribute_table: 'filename <file_name>' ==> 'hosts[]'
 change -> config ' addressspace_agnostic'  ==> ' packets. address_space_agnostic'
 change -> config ' checksum_mode'  ==> ' network. checksum_eval'
-change -> config ' daq'  ==> ' daq. module'
 change -> config ' daq_dir'  ==> ' daq. module_dirs, true'
-change -> config ' daq_var'  ==> ' daq. variables, true'
 change -> config ' detection_filter'  ==> ' alerts. detection_filter_memcap'
 change -> config ' enable_deep_teredo_inspection'  ==> ' udp. deep_teredo_inspection'
 change -> config ' event_filter'  ==> ' alerts. event_filter_memcap'
@@ -17279,6 +17338,9 @@ change -> csv: 'tcplen' ==> 'tcp_len'
 change -> csv: 'tcpseq' ==> 'tcp_seq'
 change -> csv: 'tcpwindow' ==> 'tcp_win'
 change -> csv: 'udplength' ==> 'udp_len'
+change -> daq: 'config daq:' ==> 'name'
+change -> daq_mode: 'config daq_mode:' ==> 'mode'
+change -> daq_var: 'config daq_var:' ==> 'variables'
 change -> detection: 'ac' ==> 'ac_full'
 change -> detection: 'ac-banded' ==> 'ac_banded'
 change -> detection: 'ac-bnfa' ==> 'ac_bnfa'
@@ -17439,7 +17501,6 @@ deleted -> attribute_table: '<FRAG_POLICY>unknown</FRAG_POLICY>'
 deleted -> attribute_table: '<STREAM_POLICY>noack</STREAM_POLICY>'
 deleted -> attribute_table: '<STREAM_POLICY>unknown</STREAM_POLICY>'
 deleted -> config ' cs_dir'
-deleted -> config ' daq_mode'
 deleted -> config ' decode_data_link'
 deleted -> config ' disable_attribute_reload_thread'
 deleted -> config ' disable_decode_alerts'
@@ -17475,6 +17536,7 @@ deleted -> config ' include_vlan_in_alerts'
 deleted -> config ' interface'
 deleted -> config ' layer2resets'
 deleted -> config ' log_ipv6_extra_data'
+deleted -> config ' no_promisc'
 deleted -> config ' nolog'
 deleted -> config ' protected_content'
 deleted -> config ' sidechannel'

diff --git a/src/main/build.h b/src/main/build.h
index 16d3c7e22cac9ed2ee3207b2e34405db16ce0f7f..a29f3e7c4c926cc20e03d6d6c1744af1b49d6bcc 100644 (file)
--- a/src/main/build.h
+++ b/src/main/build.h
@@ -12,7 +12,7 @@
 //                                               //
 //-----------------------------------------------//
 
-#define BUILD_NUMBER 255
+#define BUILD_NUMBER 256
 
 #ifndef EXTRABUILD
 #define BUILD STRINGIFY_MX(BUILD_NUMBER)