Merge pull request #2948 in SNORT/snort3 from ~MSTEPANE/snort3:build_3.1.6.0 to master

Squashed commit of the following:

commit dcfadb49048e7fcf325d1e0660092c0d22921b2c
Author: Mike Stepanek <mstepane@cisco.com>
Date:   Wed Jun 16 07:21:42 2021 -0400

    build: generate and tag 3.1.6.0

diff --git a/CMakeLists.txt b/CMakeLists.txt
index c63c31efbd7a2977fc6555003bf913d4f21908d6..22361253b97d7d04735bf79a4da633051ab76261 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,7 +3,7 @@ project (snort CXX C)
 
 set (VERSION_MAJOR 3)
 set (VERSION_MINOR 1)
-set (VERSION_PATCH 5)
+set (VERSION_PATCH 6)
 set (VERSION_SUBLEVEL 0)
 set (VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_SUBLEVEL}")
 

diff --git a/ChangeLog b/ChangeLog
index b444c7faa1c3282a468273caf79054cea2ae44a4..406df0389046723d89ad790da6b16c61306d8c91 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,72 @@
+2021/06/16 - 3.1.6.0
+
+appid: extract auxiliary ip when uri is provided by third-party
+appid: perform detection on request body for HTTP2 traffic.
+appid: remove error message when userappid.conf is not present
+appid: remove unused metadata offset functionality
+appid: support fragmented metadata
+appid: use 32 bits for storing protocol field in RPC port map message
+codecs: geneve - add support for Geneve encapsulation
+codecs: geneve - add vni to alert_csv and alert_json
+codecs: support inner flow NAT
+control: allow compile with shell disabled
+control: clean up cppcheck issues
+control: expose ContrlConn API
+control: refactor control channel management to better handle control responses
+control: remove SHELL compile flag from header
+control: remove unused IdleProcessing functionality
+dce_rpc: SMB multichannel - add smb multichannel file support
+dce_rpc: SMB multichannel - handle negotiate command to create expected flow
+dce_rpc: SMB multichannel - introduce locks
+dce_rpc: SMB multichannel - make session cache global
+dce_rpc: SMB multichannel - own memory tracking in global cache
+dce_rpc: fix warnings
+dce_rpc: handle reload prune for smb session cache
+dce_rpc: store shared pointer of session tracker
+doc: update JS normalizer options
+file_api: increase file count only once per file
+file_api: store processing flow in context
+filters: change rate filter to use network policy id instead of ips policy id
+filters: support rate filter to work with PDUs
+flow: enable support for multiple expected sessions
+ftp: create additional expected session if negotiated IP is different from server IP on packet
+gtp : check protocol type according to gtp version
+host_cache: remove unused lua mock code from the tests
+http2_inspect: don't perform valid sequence check on rst_stream frame
+http2_inspect: improve request line generation and checks
+http2_inspect: rule options and doc clean up
+http2_inspect: track dynamic table memory allocation
+http_inspect: add JS Normalizer to dev_notes
+http_inspect: add JS normalization for external scripts
+http_inspect: additional memory tracking
+http_inspect: extend built-in alerts for Javascript processing
+http_inspect: improve MPSE in HttpJsNorm (script start conditions)
+http_inspect: limit section size target for file processing
+http_inspect: publish event for http/2 request bodies
+http_inspect: support partial detect for Javascripts
+http_inspect: track memory footprint of zlib inflation
+http_inspect: update test mock api
+iec104: delete trailing spaces
+ips_options: fix intrusion alerts generation for tcp rpc PORTMAP traffic when rpc_decode is bound to the flow
+main: add support for resuming particular thread
+main: fix config dump for list-based inspector aliases
+mime: store extra data in stash
+packet_io: enable expected session flags
+protocols: remove inline specifiers for functions defined within a structure declaration
+pub_sub: add get_uri_host() to HttpEvent
+pub_sub: update HttpEvent::get_host to get_authority - now always includes port if there is one
+reputation: daq trace log
+reputation: support auxiliary IP matching upon reload
+rna: filter DHCP events and some refactoring
+rna: update last seen time on deleted host rediscovery
+stream: enable support for multiple expected sessions
+stream_tcp: populate flow contents in context for non-wire packets
+time: make Periodic class SO_PUBLIC
+trace: place trace options under the DEBUG_MSGS macro
+utils: fix warning about empty statement
+utils: refactor JSTokenizer
+utils: rework JSNormalizer class
+
 2021/05/20 - 3.1.5.0
 
 appid: Publish an event when appid debug command is issued

diff --git a/doc/reference/snort_reference.text b/doc/reference/snort_reference.text
index f20a8cca85fb36d9d5ae6b78551a7d39c24ac07b..a0e042f9de301018a5848978e319a35b4f3573f2 100644 (file)
--- a/doc/reference/snort_reference.text
+++ b/doc/reference/snort_reference.text
@@ -8,7 +8,7 @@ Snort 3 Reference Manual
 The Snort Team
 
 Revision History
-Revision 3.1.5.0 2021-05-20 14:02:39 EDT TST
+Revision 3.1.6.0 2021-06-16 07:30:59 EDT TST
 
 ---------------------------------------------------------------------
 
@@ -60,23 +60,24 @@ Table of Contents
     3.7. esp
     3.8. eth
     3.9. fabricpath
-    3.10. gre
-    3.11. gtp
-    3.12. icmp4
-    3.13. icmp6
-    3.14. igmp
-    3.15. ipv4
-    3.16. ipv6
-    3.17. llc
-    3.18. mpls
-    3.19. pbb
-    3.20. pgm
-    3.21. pppoe
-    3.22. tcp
-    3.23. token_ring
-    3.24. udp
-    3.25. vlan
-    3.26. wlan
+    3.10. geneve
+    3.11. gre
+    3.12. gtp
+    3.13. icmp4
+    3.14. icmp6
+    3.15. igmp
+    3.16. ipv4
+    3.17. ipv6
+    3.18. llc
+    3.19. mpls
+    3.20. pbb
+    3.21. pgm
+    3.22. pppoe
+    3.23. tcp
+    3.24. token_ring
+    3.25. udp
+    3.26. vlan
+    3.27. wlan
 
 4. Connector Modules
 
@@ -192,81 +193,79 @@ Table of Contents
     7.44. gtp_info
     7.45. gtp_type
     7.46. gtp_version
-    7.47. http2_decoded_header
-    7.48. http2_frame_header
-    7.49. http_client_body
-    7.50. http_cookie
-    7.51. http_header
-    7.52. http_method
-    7.53. http_param
-    7.54. http_raw_body
-    7.55. http_raw_cookie
-    7.56. http_raw_header
-    7.57. http_raw_request
-    7.58. http_raw_status
-    7.59. http_raw_trailer
-    7.60. http_raw_uri
-    7.61. http_stat_code
-    7.62. http_stat_msg
-    7.63. http_trailer
-    7.64. http_true_ip
-    7.65. http_uri
-    7.66. http_version
-    7.67. icmp_id
-    7.68. icmp_seq
-    7.69. icode
-    7.70. id
-    7.71. iec104_apci_type
-    7.72. iec104_asdu_func
-    7.73. ip_proto
-    7.74. ipopts
-    7.75. isdataat
-    7.76. itype
-    7.77. md5
-    7.78. metadata
-    7.79. modbus_data
-    7.80. modbus_func
-    7.81. modbus_unit
-    7.82. msg
-    7.83. mss
-    7.84. pcre
-    7.85. pkt_data
-    7.86. pkt_num
-    7.87. priority
-    7.88. raw_data
-    7.89. reference
-    7.90. regex
-    7.91. rem
-    7.92. replace
-    7.93. rev
-    7.94. rpc
-    7.95. s7commplus_content
-    7.96. s7commplus_func
-    7.97. s7commplus_opcode
-    7.98. script_data
-    7.99. sd_pattern
-    7.100. seq
-    7.101. service
-    7.102. sha256
-    7.103. sha512
-    7.104. sid
-    7.105. sip_body
-    7.106. sip_header
-    7.107. sip_method
-    7.108. sip_stat_code
-    7.109. so
-    7.110. soid
-    7.111. ssl_state
-    7.112. ssl_version
-    7.113. stream_reassemble
-    7.114. stream_size
-    7.115. tag
-    7.116. target
-    7.117. tos
-    7.118. ttl
-    7.119. urg
-    7.120. window
-    7.121. wscale
+    7.47. http_client_body
+    7.48. http_cookie
+    7.49. http_header
+    7.50. http_method
+    7.51. http_param
+    7.52. http_raw_body
+    7.53. http_raw_cookie
+    7.54. http_raw_header
+    7.55. http_raw_request
+    7.56. http_raw_status
+    7.57. http_raw_trailer
+    7.58. http_raw_uri
+    7.59. http_stat_code
+    7.60. http_stat_msg
+    7.61. http_trailer
+    7.62. http_true_ip
+    7.63. http_uri
+    7.64. http_version
+    7.65. icmp_id
+    7.66. icmp_seq
+    7.67. icode
+    7.68. id
+    7.69. iec104_apci_type
+    7.70. iec104_asdu_func
+    7.71. ip_proto
+    7.72. ipopts
+    7.73. isdataat
+    7.74. itype
+    7.75. md5
+    7.76. metadata
+    7.77. modbus_data
+    7.78. modbus_func
+    7.79. modbus_unit
+    7.80. msg
+    7.81. mss
+    7.82. pcre
+    7.83. pkt_data
+    7.84. pkt_num
+    7.85. priority
+    7.86. raw_data
+    7.87. reference
+    7.88. regex
+    7.89. rem
+    7.90. replace
+    7.91. rev
+    7.92. rpc
+    7.93. s7commplus_content
+    7.94. s7commplus_func
+    7.95. s7commplus_opcode
+    7.96. script_data
+    7.97. sd_pattern
+    7.98. seq
+    7.99. service
+    7.100. sha256
+    7.101. sha512
+    7.102. sid
+    7.103. sip_body
+    7.104. sip_header
+    7.105. sip_method
+    7.106. sip_stat_code
+    7.107. so
+    7.108. soid
+    7.109. ssl_state
+    7.110. ssl_version
+    7.111. stream_reassemble
+    7.112. stream_size
+    7.113. tag
+    7.114. target
+    7.115. tos
+    7.116. ttl
+    7.117. urg
+    7.118. window
+    7.119. wscale
 
 8. Search Engine Modules
 9. SO Rule Modules
@@ -1573,8 +1572,8 @@ Commands:
   * snort.reload_hosts(filename): load a new hosts table
   * snort.pause(): suspend packet processing
   * snort.resume(pkt_num): continue packet processing. If number of
-    packet is specified, will resume for n packets and pause
-  * snort.detach(): exit shell w/o shutdown
+    packets is specified, will resume for n packets and pause
+  * snort.detach(): detach from control shell (without shutting down)
   * snort.quit(): shutdown and dump-stats
   * snort.help(): this output
 
@@ -1632,52 +1631,10 @@ Usage: global
 Configuration:
 
   * int trace.modules.all: enable trace for all modules { 0:255 }
-  * int trace.modules.appid.all: enable all trace options { 0:255 }
-  * int trace.modules.dce_smb.all: enable all trace options { 0:255 }
-  * int trace.modules.dce_udp.all: enable all trace options { 0:255 }
-  * int trace.modules.decode.all: enable all trace options { 0:255 }
-  * int trace.modules.detection.all: enable all trace options { 0:255
-    }
-  * int trace.modules.detection.detect_engine: enable detection
-    engine trace logging { 0:255 }
-  * int trace.modules.detection.rule_eval: enable rule evaluation
-    trace logging { 0:255 }
-  * int trace.modules.detection.buffer: enable buffer trace logging {
-    0:255 }
-  * int trace.modules.detection.rule_vars: enable rule variables
-    trace logging { 0:255 }
-  * int trace.modules.detection.fp_search: enable fast pattern search
-    trace logging { 0:255 }
-  * int trace.modules.detection.pkt_detect: enable packet detection
-    trace logging { 0:255 }
-  * int trace.modules.detection.opt_tree: enable tree option trace
-    logging { 0:255 }
-  * int trace.modules.detection.tag: enable tag trace logging { 0:255
-    }
   * int trace.modules.dpx.all: enable all trace options { 0:255 }
-  * int trace.modules.gtp_inspect.all: enable all trace options {
-    0:255 }
-  * int trace.modules.iec104.all: enable all trace options { 0:255 }
-  * int trace.modules.iec104.identification: enable IEC104 APDU
-    identification trace logging { 0:255 }
-  * int trace.modules.latency.all: enable all trace options { 0:255 }
-  * int trace.modules.react.all: enable all trace options { 0:255 }
-  * int trace.modules.rna.all: enable all trace options { 0:255 }
   * int trace.modules.snort.all: enable all trace options { 0:255 }
-  * int trace.modules.snort.main: enable main trace logging { 0:255 }
   * int trace.modules.snort.inspector_manager: enable inspector
     manager trace logging { 0:255 }
-  * int trace.modules.stream.all: enable all trace options { 0:255 }
-  * int trace.modules.stream_ip.all: enable all trace options { 0:255
-    }
-  * int trace.modules.stream_tcp.all: enable all trace options {
-    0:255 }
-  * int trace.modules.stream_tcp.segments: enable stream TCP segments
-    trace logging { 0:255 }
-  * int trace.modules.stream_tcp.state: enable stream TCP state trace
-    logging { 0:255 }
-  * int trace.modules.stream_user.all: enable all trace options {
-    0:255 }
   * int trace.modules.wizard.all: enable all trace options { 0:255 }
   * int trace.constraints.ip_proto: numerical IP protocol ID filter {
     0:255 }
@@ -1875,7 +1832,27 @@ Rules:
   * 116:467 (fabricpath) truncated FabricPath header
 
 
-3.10. gre
+3.10. geneve
+
+--------------
+
+Help: support for Geneve: Generic Network Virtualization
+Encapsulation
+
+Type: codec
+
+Usage: context
+
+Rules:
+
+  * 116:180 (geneve) insufficient room for geneve header
+  * 116:181 (geneve) invalid version
+  * 116:182 (geneve) invalid header
+  * 116:183 (geneve) invalid flags
+  * 116:184 (geneve) invalid options
+
+
+3.11. gre
 
 --------------
 
@@ -1895,7 +1872,7 @@ Rules:
   * 116:165 (gre) GRE trans header length > payload length
 
 
-3.11. gtp
+3.12. gtp
 
 --------------
 
@@ -1911,7 +1888,7 @@ Rules:
   * 116:298 (gtp) GTP header length is invalid
 
 
-3.12. icmp4
+3.13. icmp4
 
 --------------
 
@@ -1960,7 +1937,7 @@ Peg counts:
   * icmp4.checksum_bypassed: checksum calculations bypassed (sum)
 
 
-3.13. icmp6
+3.14. icmp6
 
 --------------
 
@@ -1999,7 +1976,7 @@ Peg counts:
   * icmp6.checksum_bypassed: checksum calculations bypassed (sum)
 
 
-3.14. igmp
+3.15. igmp
 
 --------------
 
@@ -2014,7 +1991,7 @@ Rules:
   * 116:455 (igmp) DOS IGMP IP options validation attempt
 
 
-3.15. ipv4
+3.16. ipv4
 
 --------------
 
@@ -2055,7 +2032,7 @@ Peg counts:
   * ipv4.checksum_bypassed: checksum calculations bypassed (sum)
 
 
-3.16. ipv6
+3.17. ipv6
 
 --------------
 
@@ -2102,7 +2079,7 @@ Rules:
     the payload protocol field
 
 
-3.17. llc
+3.18. llc
 
 --------------
 
@@ -2118,7 +2095,7 @@ Rules:
   * 116:132 (llc) bad extra LLC info
 
 
-3.18. mpls
+3.19. mpls
 
 --------------
 
@@ -2148,7 +2125,7 @@ Rules:
   * 116:176 (mpls) too many MPLS headers
 
 
-3.19. pbb
+3.20. pbb
 
 --------------
 
@@ -2163,7 +2140,7 @@ Rules:
   * 116:424 (pbb) truncated ethernet header
 
 
-3.20. pgm
+3.21. pgm
 
 --------------
 
@@ -2178,7 +2155,7 @@ Rules:
   * 116:454 (pgm) PGM nak list overflow attempt
 
 
-3.21. pppoe
+3.22. pppoe
 
 --------------
 
@@ -2193,7 +2170,7 @@ Rules:
   * 116:120 (pppoe) bad PPPOE frame detected
 
 
-3.22. tcp
+3.23. tcp
 
 --------------
 
@@ -2234,7 +2211,7 @@ Peg counts:
   * tcp.checksum_bypassed: checksum calculations bypassed (sum)
 
 
-3.23. token_ring
+3.24. token_ring
 
 --------------
 
@@ -2252,7 +2229,7 @@ Rules:
   * 116:143 (token_ring) bad Token Ring MR header
 
 
-3.24. udp
+3.25. udp
 
 --------------
 
@@ -2268,6 +2245,7 @@ Configuration:
     UDP ports (default is only 3544)
   * bit_list udp.gtp_ports = 2152 3386: set GTP ports { 65535 }
   * bit_list udp.vxlan_ports = 4789: set VXLAN ports { 65535 }
+  * bit_list udp.geneve_ports = 6081: set Geneve ports { 65535 }
 
 Rules:
 
@@ -2286,7 +2264,7 @@ Peg counts:
   * udp.checksum_bypassed: checksum calculations bypassed (sum)
 
 
-3.25. vlan
+3.26. vlan
 
 --------------
 
@@ -2301,7 +2279,7 @@ Rules:
   * 116:130 (vlan) bad VLAN frame
 
 
-3.26. wlan
+3.27. wlan
 
 --------------
 
@@ -3626,6 +3604,7 @@ Rules:
   * 121:31 (http2_inspect) invalid HTTP/2 window update frame
   * 121:32 (http2_inspect) HTTP/2 window update frame with zero
     increment
+  * 121:33 (http2_inspect) HTTP/2 request without a method
 
 Peg counts:
 
@@ -3716,6 +3695,9 @@ Configuration:
   * string http_inspect.xff_headers = x-forwarded-for true-client-ip:
     specifies the xff type headers to parse and consider in the same
     order of preference as defined
+  * bool http_inspect.request_body_app_detection = false: make HTTP/2
+    request message bodies available for application detection
+    (detection requires AppId)
 
 Rules:
 
@@ -3759,8 +3741,6 @@ Rules:
   * 119:115 (http_inspect) PDF file unsupported compression type
   * 119:116 (http_inspect) PDF file cascaded compression
   * 119:117 (http_inspect) PDF file parse failure
-  * 119:118 (http_inspect) unexpected script tag within inline
-    javascript
   * 119:201 (http_inspect) not HTTP traffic
   * 119:202 (http_inspect) chunk length has excessive leading zeros
   * 119:203 (http_inspect) white space before or between messages
@@ -3852,6 +3832,13 @@ Rules:
   * 119:262 (http_inspect) HTTP URI scheme longer than 10 characters
   * 119:263 (http_inspect) HTTP/1 client requested HTTP/2 upgrade
   * 119:264 (http_inspect) HTTP/1 server granted HTTP/2 upgrade
+  * 119:265 (http_inspect) bad token in JavaScript
+  * 119:266 (http_inspect) unexpected script opening tag in
+    JavaScript
+  * 119:267 (http_inspect) unexpected script closing tag in
+    JavaScript
+  * 119:268 (http_inspect) JavaScript code under the external script
+    tags
 
 Peg counts:
 
@@ -3903,6 +3890,8 @@ Peg counts:
   * http_inspect.total_bytes: total HTTP data bytes inspected (sum)
   * http_inspect.js_inline_scripts: total number of inline
     JavaScripts processed (sum)
+  * http_inspect.js_external_scripts: total number of external
+    JavaScripts processed (sum)
 
 
 5.25. iec104
@@ -6617,31 +6606,7 @@ Configuration:
   * int gtp_version.~: version to match { 0:2 }
 
 
-7.47. http2_decoded_header
-
---------------
-
-Help: rule option to set detection cursor to the decoded HTTP/2
-header
-
-Type: ips_option
-
-Usage: detect
-
-
-7.48. http2_frame_header
-
---------------
-
-Help: rule option to set detection cursor to the 9-octet HTTP/2 frame
-header
-
-Type: ips_option
-
-Usage: detect
-
-
-7.49. http_client_body
+7.47. http_client_body
 
 --------------
 
@@ -6652,7 +6617,7 @@ Type: ips_option
 Usage: detect
 
 
-7.50. http_cookie
+7.48. http_cookie
 
 --------------
 
@@ -6674,7 +6639,7 @@ Configuration:
     message trailers
 
 
-7.51. http_header
+7.49. http_header
 
 --------------
 
@@ -6699,7 +6664,7 @@ Configuration:
     message trailers
 
 
-7.52. http_method
+7.50. http_method
 
 --------------
 
@@ -6720,7 +6685,7 @@ Configuration:
     message trailers
 
 
-7.53. http_param
+7.51. http_param
 
 --------------
 
@@ -6737,7 +6702,7 @@ Configuration:
   * implied http_param.nocase: case insensitive match
 
 
-7.54. http_raw_body
+7.52. http_raw_body
 
 --------------
 
@@ -6749,7 +6714,7 @@ Type: ips_option
 Usage: detect
 
 
-7.55. http_raw_cookie
+7.53. http_raw_cookie
 
 --------------
 
@@ -6772,7 +6737,7 @@ Configuration:
     HTTP message trailers
 
 
-7.56. http_raw_header
+7.54. http_raw_header
 
 --------------
 
@@ -6795,7 +6760,7 @@ Configuration:
     HTTP message trailers
 
 
-7.57. http_raw_request
+7.55. http_raw_request
 
 --------------
 
@@ -6816,7 +6781,7 @@ Configuration:
     HTTP message trailers
 
 
-7.58. http_raw_status
+7.56. http_raw_status
 
 --------------
 
@@ -6835,7 +6800,7 @@ Configuration:
     HTTP message trailers
 
 
-7.59. http_raw_trailer
+7.57. http_raw_trailer
 
 --------------
 
@@ -6856,7 +6821,7 @@ Configuration:
     HTTP response message body (must be combined with request)
 
 
-7.60. http_raw_uri
+7.58. http_raw_uri
 
 --------------
 
@@ -6885,7 +6850,7 @@ Configuration:
     URI only
 
 
-7.61. http_stat_code
+7.59. http_stat_code
 
 --------------
 
@@ -6903,7 +6868,7 @@ Configuration:
     HTTP message trailers
 
 
-7.62. http_stat_msg
+7.60. http_stat_msg
 
 --------------
 
@@ -6922,7 +6887,7 @@ Configuration:
     HTTP message trailers
 
 
-7.63. http_trailer
+7.61. http_trailer
 
 --------------
 
@@ -6944,7 +6909,7 @@ Configuration:
     message body (must be combined with request)
 
 
-7.64. http_true_ip
+7.62. http_true_ip
 
 --------------
 
@@ -6965,7 +6930,7 @@ Configuration:
     HTTP message trailers
 
 
-7.65. http_uri
+7.63. http_uri
 
 --------------
 
@@ -6993,7 +6958,7 @@ Configuration:
     only
 
 
-7.66. http_version
+7.64. http_version
 
 --------------
 
@@ -7015,7 +6980,7 @@ Configuration:
     HTTP message trailers
 
 
-7.67. icmp_id
+7.65. icmp_id
 
 --------------
 
@@ -7031,7 +6996,7 @@ Configuration:
     0:65535 }
 
 
-7.68. icmp_seq
+7.66. icmp_seq
 
 --------------
 
@@ -7047,7 +7012,7 @@ Configuration:
     given range { 0:65535 }
 
 
-7.69. icode
+7.67. icode
 
 --------------
 
@@ -7063,7 +7028,7 @@ Configuration:
     0:255 }
 
 
-7.70. id
+7.68. id
 
 --------------
 
@@ -7079,7 +7044,7 @@ Configuration:
     }
 
 
-7.71. iec104_apci_type
+7.69. iec104_apci_type
 
 --------------
 
@@ -7094,7 +7059,7 @@ Configuration:
   * string iec104_apci_type.~: APCI type to match
 
 
-7.72. iec104_asdu_func
+7.70. iec104_asdu_func
 
 --------------
 
@@ -7109,7 +7074,7 @@ Configuration:
   * string iec104_asdu_func.~: function code to match
 
 
-7.73. ip_proto
+7.71. ip_proto
 
 --------------
 
@@ -7124,7 +7089,7 @@ Configuration:
   * string ip_proto.~proto: [!|>|<] name or number
 
 
-7.74. ipopts
+7.72. ipopts
 
 --------------
 
@@ -7140,7 +7105,7 @@ Configuration:
     lsrre|ssrr|satid|any }
 
 
-7.75. isdataat
+7.73. isdataat
 
 --------------
 
@@ -7157,7 +7122,7 @@ Configuration:
     buffer
 
 
-7.76. itype
+7.74. itype
 
 --------------
 
@@ -7173,7 +7138,7 @@ Configuration:
     0:255 }
 
 
-7.77. md5
+7.75. md5
 
 --------------
 
@@ -7193,7 +7158,7 @@ Configuration:
     of buffer
 
 
-7.78. metadata
+7.76. metadata
 
 --------------
 
@@ -7210,7 +7175,7 @@ Configuration:
     pairs
 
 
-7.79. modbus_data
+7.77. modbus_data
 
 --------------
 
@@ -7221,7 +7186,7 @@ Type: ips_option
 Usage: detect
 
 
-7.80. modbus_func
+7.78. modbus_func
 
 --------------
 
@@ -7236,7 +7201,7 @@ Configuration:
   * string modbus_func.~: function code to match
 
 
-7.81. modbus_unit
+7.79. modbus_unit
 
 --------------
 
@@ -7251,7 +7216,7 @@ Configuration:
   * int modbus_unit.~: Modbus unit ID { 0:255 }
 
 
-7.82. msg
+7.80. msg
 
 --------------
 
@@ -7266,7 +7231,7 @@ Configuration:
   * string msg.~: message describing rule
 
 
-7.83. mss
+7.81. mss
 
 --------------
 
@@ -7282,7 +7247,7 @@ Configuration:
     }
 
 
-7.84. pcre
+7.82. pcre
 
 --------------
 
@@ -7304,7 +7269,7 @@ Peg counts:
   * pcre.pcre_negated: total pcre rules using negation syntax (sum)
 
 
-7.85. pkt_data
+7.83. pkt_data
 
 --------------
 
@@ -7316,7 +7281,7 @@ Type: ips_option
 Usage: detect
 
 
-7.86. pkt_num
+7.84. pkt_num
 
 --------------
 
@@ -7332,7 +7297,7 @@ Configuration:
     { 1: }
 
 
-7.87. priority
+7.85. priority
 
 --------------
 
@@ -7348,7 +7313,7 @@ Configuration:
     1:max31 }
 
 
-7.88. raw_data
+7.86. raw_data
 
 --------------
 
@@ -7359,7 +7324,7 @@ Type: ips_option
 Usage: detect
 
 
-7.89. reference
+7.87. reference
 
 --------------
 
@@ -7374,7 +7339,7 @@ Configuration:
   * string reference.~ref: reference: <scheme>,<id>
 
 
-7.90. regex
+7.88. regex
 
 --------------
 
@@ -7398,7 +7363,7 @@ Configuration:
     instead of start of buffer
 
 
-7.91. rem
+7.89. rem
 
 --------------
 
@@ -7413,7 +7378,7 @@ Configuration:
   * string rem.~: comment
 
 
-7.92. replace
+7.90. replace
 
 --------------
 
@@ -7428,7 +7393,7 @@ Configuration:
   * string replace.~: byte code to replace with
 
 
-7.93. rev
+7.91. rev
 
 --------------
 
@@ -7443,7 +7408,7 @@ Configuration:
   * int rev.~: revision { 1:max32 }
 
 
-7.94. rpc
+7.92. rpc
 
 --------------
 
@@ -7460,7 +7425,7 @@ Configuration:
   * string rpc.~proc: procedure number or * for any
 
 
-7.95. s7commplus_content
+7.93. s7commplus_content
 
 --------------
 
@@ -7471,7 +7436,7 @@ Type: ips_option
 Usage: detect
 
 
-7.96. s7commplus_func
+7.94. s7commplus_func
 
 --------------
 
@@ -7486,7 +7451,7 @@ Configuration:
   * string s7commplus_func.~: function code to match
 
 
-7.97. s7commplus_opcode
+7.95. s7commplus_opcode
 
 --------------
 
@@ -7501,7 +7466,7 @@ Configuration:
   * string s7commplus_opcode.~: opcode code to match
 
 
-7.98. script_data
+7.96. script_data
 
 --------------
 
@@ -7512,7 +7477,7 @@ Type: ips_option
 Usage: detect
 
 
-7.99. sd_pattern
+7.97. sd_pattern
 
 --------------
 
@@ -7536,7 +7501,7 @@ Peg counts:
   * sd_pattern.terminated: hyperscan terminated (sum)
 
 
-7.100. seq
+7.98. seq
 
 --------------
 
@@ -7552,7 +7517,7 @@ Configuration:
     range { 0: }
 
 
-7.101. service
+7.99. service
 
 --------------
 
@@ -7567,7 +7532,7 @@ Configuration:
   * string service.*: one or more comma-separated service names
 
 
-7.102. sha256
+7.100. sha256
 
 --------------
 
@@ -7587,7 +7552,7 @@ Configuration:
     start of buffer
 
 
-7.103. sha512
+7.101. sha512
 
 --------------
 
@@ -7607,7 +7572,7 @@ Configuration:
     start of buffer
 
 
-7.104. sid
+7.102. sid
 
 --------------
 
@@ -7622,7 +7587,7 @@ Configuration:
   * int sid.~: signature id { 1:max32 }
 
 
-7.105. sip_body
+7.103. sip_body
 
 --------------
 
@@ -7633,7 +7598,7 @@ Type: ips_option
 Usage: detect
 
 
-7.106. sip_header
+7.104. sip_header
 
 --------------
 
@@ -7645,7 +7610,7 @@ Type: ips_option
 Usage: detect
 
 
-7.107. sip_method
+7.105. sip_method
 
 --------------
 
@@ -7660,7 +7625,7 @@ Configuration:
   * string sip_method.*method: sip method
 
 
-7.108. sip_stat_code
+7.106. sip_stat_code
 
 --------------
 
@@ -7675,7 +7640,7 @@ Configuration:
   * int sip_stat_code.*code: status code { 1:999 }
 
 
-7.109. so
+7.107. so
 
 --------------
 
@@ -7692,7 +7657,7 @@ Configuration:
     buffer
 
 
-7.110. soid
+7.108. soid
 
 --------------
 
@@ -7708,7 +7673,7 @@ Configuration:
     like 3_45678_9
 
 
-7.111. ssl_state
+7.109. ssl_state
 
 --------------
 
@@ -7737,7 +7702,7 @@ Configuration:
     unknown
 
 
-7.112. ssl_version
+7.110. ssl_version
 
 --------------
 
@@ -7764,7 +7729,7 @@ Configuration:
     tls1.2
 
 
-7.113. stream_reassemble
+7.111. stream_reassemble
 
 --------------
 
@@ -7785,7 +7750,7 @@ Configuration:
     remainder of the session
 
 
-7.114. stream_size
+7.112. stream_size
 
 --------------
 
@@ -7803,7 +7768,7 @@ Configuration:
     direction(s) { either|to_server|to_client|both }
 
 
-7.115. tag
+7.113. tag
 
 --------------
 
@@ -7822,7 +7787,7 @@ Configuration:
   * int tag.bytes: tag for this many bytes { 1:max32 }
 
 
-7.116. target
+7.114. target
 
 --------------
 
@@ -7838,7 +7803,7 @@ Configuration:
     dst_ip }
 
 
-7.117. tos
+7.115. tos
 
 --------------
 
@@ -7853,7 +7818,7 @@ Configuration:
   * interval tos.~range: check if IP TOS is in given range { 0:255 }
 
 
-7.118. ttl
+7.116. ttl
 
 --------------
 
@@ -7869,7 +7834,7 @@ Configuration:
     0:255 }
 
 
-7.119. urg
+7.117. urg
 
 --------------
 
@@ -7885,7 +7850,7 @@ Configuration:
     { 0:65535 }
 
 
-7.120. window
+7.118. window
 
 --------------
 
@@ -7901,7 +7866,7 @@ Configuration:
     range { 0:65535 }
 
 
-7.121. wscale
+7.119. wscale
 
 --------------
 
@@ -7967,13 +7932,13 @@ Configuration:
     dir src_ap dst_ap rule action: selected fields will be output in
     given order left to right { action | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
-    eth_dst | eth_len | eth_src | eth_type | flowstart_time | gid |
-    icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
-    ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num | priority |
-    proto | rev | rule | seconds | server_bytes | server_pkts |
-    service | sgt| sid | src_addr | src_ap | src_port | target |
-    tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp |
-    tos | ttl | udp_len | vlan }
+    eth_dst | eth_len | eth_src | eth_type | flowstart_time |
+    geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
+    iface | ip_id | ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num
+    | priority | proto | rev | rule | seconds | server_bytes |
+    server_pkts | service | sgt| sid | src_addr | src_ap | src_port |
+    target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win |
+    timestamp | tos | ttl | udp_len | vlan }
   * int alert_csv.limit = 0: set maximum size in MB before rollover
     (0 is unlimited) { 0:maxSZ }
   * string alert_csv.separator = , : separate fields with this
@@ -8051,13 +8016,13 @@ Configuration:
     dir src_ap dst_ap rule action: selected fields will be output in
     given order left to right { action | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
-    eth_dst | eth_len | eth_src | eth_type | flowstart_time | gid |
-    icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
-    ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num | priority |
-    proto | rev | rule | seconds | server_bytes | server_pkts |
-    service | sgt| sid | src_addr | src_ap | src_port | target |
-    tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp |
-    tos | ttl | udp_len | vlan }
+    eth_dst | eth_len | eth_src | eth_type | flowstart_time |
+    geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
+    iface | ip_id | ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num
+    | priority | proto | rev | rule | seconds | server_bytes |
+    server_pkts | service | sgt| sid | src_addr | src_ap | src_port |
+    target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win |
+    timestamp | tos | ttl | udp_len | vlan }
   * int alert_json.limit = 0: set maximum size in MB before rollover
     (0 is unlimited) { 0:maxSZ }
   * string alert_json.separator = , : separate fields with this
@@ -8476,13 +8441,13 @@ these libraries see the Getting Started section of the manual.
     dir src_ap dst_ap rule action: selected fields will be output in
     given order left to right { action | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
-    eth_dst | eth_len | eth_src | eth_type | flowstart_time | gid |
-    icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
-    ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num | priority |
-    proto | rev | rule | seconds | server_bytes | server_pkts |
-    service | sgt| sid | src_addr | src_ap | src_port | target |
-    tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp |
-    tos | ttl | udp_len | vlan }
+    eth_dst | eth_len | eth_src | eth_type | flowstart_time |
+    geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
+    iface | ip_id | ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num
+    | priority | proto | rev | rule | seconds | server_bytes |
+    server_pkts | service | sgt| sid | src_addr | src_ap | src_port |
+    target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win |
+    timestamp | tos | ttl | udp_len | vlan }
   * bool alert_csv.file = false: output to alert_csv.txt instead of
     stdout
   * int alert_csv.limit = 0: set maximum size in MB before rollover
@@ -8504,13 +8469,13 @@ these libraries see the Getting Started section of the manual.
     dir src_ap dst_ap rule action: selected fields will be output in
     given order left to right { action | class | b64_data |
     client_bytes | client_pkts | dir | dst_addr | dst_ap | dst_port |
-    eth_dst | eth_len | eth_src | eth_type | flowstart_time | gid |
-    icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
-    ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num | priority |
-    proto | rev | rule | seconds | server_bytes | server_pkts |
-    service | sgt| sid | src_addr | src_ap | src_port | target |
-    tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp |
-    tos | ttl | udp_len | vlan }
+    eth_dst | eth_len | eth_src | eth_type | flowstart_time |
+    geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type |
+    iface | ip_id | ip_len | msg | mpls | pkt_gen | pkt_len | pkt_num
+    | priority | proto | rev | rule | seconds | server_bytes |
+    server_pkts | service | sgt| sid | src_addr | src_ap | src_port |
+    target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win |
+    timestamp | tos | ttl | udp_len | vlan }
   * bool alert_json.file = false: output to alert_json.txt instead of
     stdout
   * int alert_json.limit = 0: set maximum size in MB before rollover
@@ -9147,6 +9112,9 @@ these libraries see the Getting Started section of the manual.
     encodings
   * bool http_inspect.plus_to_space = true: replace + with <sp> when
     normalizing URIs
+  * bool http_inspect.request_body_app_detection = false: make HTTP/2
+    request message bodies available for application detection
+    (detection requires AppId)
   * int http_inspect.request_depth = -1: maximum request message body
     bytes to examine (-1 no limit) { -1:max53 }
   * int http_inspect.response_depth = -1: maximum response message
@@ -10353,52 +10321,10 @@ these libraries see the Getting Started section of the manual.
   * string trace.constraints.src_ip: source IP address filter
   * int trace.constraints.src_port: source port filter { 0:65535 }
   * int trace.modules.all: enable trace for all modules { 0:255 }
-  * int trace.modules.appid.all: enable all trace options { 0:255 }
-  * int trace.modules.dce_smb.all: enable all trace options { 0:255 }
-  * int trace.modules.dce_udp.all: enable all trace options { 0:255 }
-  * int trace.modules.decode.all: enable all trace options { 0:255 }
-  * int trace.modules.detection.all: enable all trace options { 0:255
-    }
-  * int trace.modules.detection.buffer: enable buffer trace logging {
-    0:255 }
-  * int trace.modules.detection.detect_engine: enable detection
-    engine trace logging { 0:255 }
-  * int trace.modules.detection.fp_search: enable fast pattern search
-    trace logging { 0:255 }
-  * int trace.modules.detection.opt_tree: enable tree option trace
-    logging { 0:255 }
-  * int trace.modules.detection.pkt_detect: enable packet detection
-    trace logging { 0:255 }
-  * int trace.modules.detection.rule_eval: enable rule evaluation
-    trace logging { 0:255 }
-  * int trace.modules.detection.rule_vars: enable rule variables
-    trace logging { 0:255 }
-  * int trace.modules.detection.tag: enable tag trace logging { 0:255
-    }
   * int trace.modules.dpx.all: enable all trace options { 0:255 }
-  * int trace.modules.gtp_inspect.all: enable all trace options {
-    0:255 }
-  * int trace.modules.iec104.all: enable all trace options { 0:255 }
-  * int trace.modules.iec104.identification: enable IEC104 APDU
-    identification trace logging { 0:255 }
-  * int trace.modules.latency.all: enable all trace options { 0:255 }
-  * int trace.modules.react.all: enable all trace options { 0:255 }
-  * int trace.modules.rna.all: enable all trace options { 0:255 }
   * int trace.modules.snort.all: enable all trace options { 0:255 }
   * int trace.modules.snort.inspector_manager: enable inspector
     manager trace logging { 0:255 }
-  * int trace.modules.snort.main: enable main trace logging { 0:255 }
-  * int trace.modules.stream.all: enable all trace options { 0:255 }
-  * int trace.modules.stream_ip.all: enable all trace options { 0:255
-    }
-  * int trace.modules.stream_tcp.all: enable all trace options {
-    0:255 }
-  * int trace.modules.stream_tcp.segments: enable stream TCP segments
-    trace logging { 0:255 }
-  * int trace.modules.stream_tcp.state: enable stream TCP state trace
-    logging { 0:255 }
-  * int trace.modules.stream_user.all: enable all trace options {
-    0:255 }
   * int trace.modules.wizard.all: enable all trace options { 0:255 }
   * bool trace.ntuple = false: print packet n-tuple info with trace
     messages
@@ -10410,6 +10336,7 @@ these libraries see the Getting Started section of the manual.
     0:255 }
   * bool udp.deep_teredo_inspection = false: look for Teredo on all
     UDP ports (default is only 3544)
+  * bit_list udp.geneve_ports = 6081: set Geneve ports { 65535 }
   * bit_list udp.gtp_ports = 2152 3386: set GTP ports { 65535 }
   * bit_list udp.vxlan_ports = 4789: set VXLAN ports { 65535 }
   * bool unified2.legacy_events = false: generate Snort 2.X style
@@ -10987,6 +10914,8 @@ these libraries see the Getting Started section of the manual.
   * http_inspect.get_requests: GET requests inspected (sum)
   * http_inspect.head_requests: HEAD requests inspected (sum)
   * http_inspect.inspections: total message sections inspected (sum)
+  * http_inspect.js_external_scripts: total number of external
+    JavaScripts processed (sum)
   * http_inspect.js_inline_scripts: total number of inline
     JavaScripts processed (sum)
   * http_inspect.max_concurrent_sessions: maximum concurrent http
@@ -11575,6 +11504,7 @@ these libraries see the Getting Started section of the manual.
   * 116: esp
   * 116: eth
   * 116: fabricpath
+  * 116: geneve
   * 116: gre
   * 116: gtp
   * 116: icmp4
@@ -11695,6 +11625,11 @@ these libraries see the Getting Started section of the manual.
   * 116:174 (mpls) MPLS label 3 appears in header
   * 116:175 (mpls) MPLS label 4, 5,.. or 15 appears in header
   * 116:176 (mpls) too many MPLS headers
+  * 116:180 (geneve) insufficient room for geneve header
+  * 116:181 (geneve) invalid version
+  * 116:182 (geneve) invalid header
+  * 116:183 (geneve) invalid flags
+  * 116:184 (geneve) invalid options
   * 116:250 (icmp4) ICMP original IP header truncated
   * 116:251 (icmp4) ICMP version and original IP header versions
     differ
@@ -11870,8 +11805,6 @@ these libraries see the Getting Started section of the manual.
   * 119:115 (http_inspect) PDF file unsupported compression type
   * 119:116 (http_inspect) PDF file cascaded compression
   * 119:117 (http_inspect) PDF file parse failure
-  * 119:118 (http_inspect) unexpected script tag within inline
-    javascript
   * 119:201 (http_inspect) not HTTP traffic
   * 119:202 (http_inspect) chunk length has excessive leading zeros
   * 119:203 (http_inspect) white space before or between messages
@@ -11963,6 +11896,13 @@ these libraries see the Getting Started section of the manual.
   * 119:262 (http_inspect) HTTP URI scheme longer than 10 characters
   * 119:263 (http_inspect) HTTP/1 client requested HTTP/2 upgrade
   * 119:264 (http_inspect) HTTP/1 server granted HTTP/2 upgrade
+  * 119:265 (http_inspect) bad token in JavaScript
+  * 119:266 (http_inspect) unexpected script opening tag in
+    JavaScript
+  * 119:267 (http_inspect) unexpected script closing tag in
+    JavaScript
+  * 119:268 (http_inspect) JavaScript code under the external script
+    tags
   * 121:1 (http2_inspect) invalid flag set on HTTP/2 frame
   * 121:2 (http2_inspect) HPACK integer value has leading zeros
   * 121:3 (http2_inspect) HTTP/2 stream initiated with invalid stream
@@ -12005,6 +11945,7 @@ these libraries see the Getting Started section of the manual.
   * 121:31 (http2_inspect) invalid HTTP/2 window update frame
   * 121:32 (http2_inspect) HTTP/2 window update frame with zero
     increment
+  * 121:33 (http2_inspect) HTTP/2 request without a method
   * 122:1 (port_scan) TCP portscan
   * 122:2 (port_scan) TCP decoy portscan
   * 122:3 (port_scan) TCP portsweep
@@ -12450,8 +12391,8 @@ these libraries see the Getting Started section of the manual.
   * snort.reload_hosts(filename): load a new hosts table
   * snort.pause(): suspend packet processing
   * snort.resume(pkt_num): continue packet processing. If number of
-    packet is specified, will resume for n packets and pause
-  * snort.detach(): exit shell w/o shutdown
+    packets is specified, will resume for n packets and pause
+  * snort.detach(): detach from control shell (without shutting down)
   * snort.quit(): shutdown and dump-stats
   * snort.help(): this output
   * trace.set(modules, constraints, ntuple, timestamp): set modules
@@ -12605,6 +12546,8 @@ and are not applicable elsewhere.
   * ftp_data (inspector): FTP data channel handler
   * ftp_server (inspector): main FTP module; ftp_client should also
     be configured
+  * geneve (codec): support for Geneve: Generic Network
+    Virtualization Encapsulation
   * gid (ips_option): rule option specifying rule generator
   * gre (codec): support for generic routing encapsulation
   * gtp (codec): support for general-packet-radio-service tunneling
@@ -12619,10 +12562,6 @@ and are not applicable elsewhere.
     hosts
   * host_tracker (basic): configure hosts
   * hosts (basic): configure hosts
-  * http2_decoded_header (ips_option): rule option to set detection
-    cursor to the decoded HTTP/2 header
-  * http2_frame_header (ips_option): rule option to set detection
-    cursor to the 9-octet HTTP/2 frame header
   * http2_inspect (inspector): HTTP/2 inspector
   * http_client_body (ips_option): rule option to set the detection
     cursor to the request body
@@ -12846,6 +12785,8 @@ and are not applicable elsewhere.
   * codec::esp: support for encapsulating security payload
   * codec::eth: support for ethernet protocol (DLT 1) (DLT 51)
   * codec::fabricpath: support for fabricpath
+  * codec::geneve: support for Geneve: Generic Network Virtualization
+    Encapsulation
   * codec::gre: support for generic routing encapsulation
   * codec::gtp: support for general-packet-radio-service tunneling
     protocol
@@ -13033,10 +12974,6 @@ and are not applicable elsewhere.
   * ips_option::gtp_info: rule option to check gtp info element
   * ips_option::gtp_type: rule option to check gtp types
   * ips_option::gtp_version: rule option to check GTP version
-  * ips_option::http2_decoded_header: rule option to set detection
-    cursor to the decoded HTTP/2 header
-  * ips_option::http2_frame_header: rule option to set detection
-    cursor to the 9-octet HTTP/2 frame header
   * ips_option::http_client_body: rule option to set the detection
     cursor to the request body
   * ips_option::http_cookie: rule option to set the detection cursor

diff --git a/doc/upgrade/snort_upgrade.text b/doc/upgrade/snort_upgrade.text
index 46ab37de738f99ef92a09bb146a43af110d11d8f..dee4d11e571be9e387bbbb6bc55afd9a35bd2d06 100644 (file)
--- a/doc/upgrade/snort_upgrade.text
+++ b/doc/upgrade/snort_upgrade.text
@@ -8,7 +8,7 @@ Snort 3 Upgrade Manual
 The Snort Team
 
 Revision History
-Revision 3.1.5.0 2021-05-20 14:02:30 EDT TST
+Revision 3.1.6.0 2021-06-16 07:30:48 EDT TST
 
 ---------------------------------------------------------------------
 

diff --git a/doc/user/snort_user.text b/doc/user/snort_user.text
index 26378ad372fcae9d87c7d625d6b72dccc7175cd7..b9c7c684272c89a11019d25522b90aa200b014e1 100644 (file)
--- a/doc/user/snort_user.text
+++ b/doc/user/snort_user.text
@@ -8,7 +8,7 @@ Snort 3 User Manual
 The Snort Team
 
 Revision History
-Revision 3.1.5.0 2021-05-20 14:02:00 EDT TST
+Revision 3.1.6.0 2021-06-16 07:30:48 EDT TST
 
 ---------------------------------------------------------------------
 
@@ -3919,13 +3919,14 @@ enhanced and legacy normalizers have mutual exclusion behaviour, so
 you cannot enable both at the same time (doing so will cause Snort to
 fail to load). When the depth is reached, normalization will be
 stopped. It’s implemented per-script. js_normalization_depth = -1,
-will set the max allowed depth value. By default, the value is set to
-0 which means that normalizer is disabled. The enhanced normalizer
-provides more precise whitespace normalization of JavaScript, that
-removes all redundant whitespaces and line terminators from the
-JavaScript syntax point of view (between identifier and punctuator,
-between identifier and operator, etc.) according to ECMAScript 5.1
-standard. This is currently experimental and still under development.
+will set unlimited depth. By default, the value is set to 0 which
+means that normalizer is disabled. The enhanced normalizer provides
+more precise whitespace normalization of JavaScript, that removes all
+redundant whitespaces and line terminators from the JavaScript syntax
+point of view (between identifier and punctuator, between identifier
+and operator, etc.) according to ECMAScript 5.1 standard. The
+normalized data is available through the script_data rule option.
+This is currently experimental and still under development.
 
 6.10.2.9. xff_headers
 
@@ -4313,14 +4314,12 @@ decompress_pdf, decompress_swf, and normalize_javascript.
 
 6.10.4.14. script_data
 
-The script_data ips option is used as sticky buffer and contains only
-the normalized JavaScript HTTP response body without script tags. In
-scope of rules the script_data option takes place with enabled new
-enhanced normalizer, so it is used in combination with http_inspect =
-{ js_normalization_depth = N }. The js_normalization_depth option is
-described above. In rules the script_data can be used with file_data
-option where file_data would contain the whole HTTP response body for
-content matching.
+The script_data contains normalized JavaScript text collected from
+the whole PDU (inline or external scripts). It requires the Enhanced
+Normalizer enabled: http_inspect = { js_normalization_depth = N },
+js_normalization_depth option is described above. Despite what
+script_data has, file_data still contains the whole HTTP body with an
+original JavaScript in it.
 
 6.10.5. Timing issues and combining rule options
 
@@ -4440,19 +4439,6 @@ http2_inspect = {}
 
 to your snort.lua configuration file.
 
-Everything has a beginning and for http2_inspect this is the
-beginning of the beginning.
-
-Currently http2_inspect will divide an HTTP/2 connection into
-individual frames. Two new rule options are available for looking at
-HTTP/2 frames: http2_frame_header provides the 9-octet frame header.
-
-alert tcp any any -> any any (msg:"Frame type"; flow:established,
-to_client; http2_frame_header; content:"|06|", offset 3, depth 1;
-sid:1; rev:1; )
-
-This will match if the Type byte of the frame header is 6 (PING).
-
 To smooth the transition to inspecting HTTP/2, rules that specify
 service:http will be treated as if they also specify service:http2.
 Thus:
@@ -4478,10 +4464,6 @@ large numbers of existing rules. New rules should explicitly specify
 "service http,http2;" if that is the desired behavior. Eventually
 support for http implies http2 may be deprecated and removed.
 
-In the future, http2_inspect will be fully integrated with
-http_inspect to provide full inspection of the individual HTTP/1.1
-streams.
-
 
 6.12. IEC104 Inspector