From: Russ Combs Date: Tue, 25 Jul 2017 02:22:07 +0000 (-0400) Subject: Squashed commit of the following: X-Git-Tag: 3.0.0-239~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=65b44e2ab8b3a184feecb7c0d437ed7c3a699f8e;p=thirdparty%2Fsnort3.git Squashed commit of the following: commit 29b45abd4e2bd3bc92bfafb0c5b8e423b46ffa95 Author: Russ Combs Date: Mon Jul 24 21:14:47 2017 -0400 build 238 commit 61919ae2037a5a2cdea1fe6a03a4b69e62b2cbcc Author: Russ Combs Date: Mon Jul 24 20:03:27 2017 -0400 ipv6: fix flow label access method; thanks to schrx3b6 for the patch commit d78852a6cd2749b0deb1bd7aa42343d4fd09d6f7 Author: Russ Combs Date: Mon Jul 24 16:36:48 2017 -0400 doc: update rules differences --- diff --git a/ChangeLog b/ChangeLog index 77fea07be..22f2d05bb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,40 @@ +17/07/24 - build 238 + +-- check: update hyperscan and regex tests +-- cpputests: clean up some header include issues +-- daq_socket: update to support query of pci +-- detection: fix debug print of fast pattern only +-- detection: rule evaluation trace utility +-- doc: update concepts and differences +-- file_api: memory leak fixed +-- file_id: fixes for file capture exit +-- http_inspect: added 119:97 for lower case letters in version field +-- http_inspect: alert 119:96 added for unsolicited 206 response. +-- http_inspect: specific alert added 119:95 for Content-Encoding chunked. +-- ipv6: fix flow label access method; thanks to schrx3b6 for the patch +-- loggers: remove units options; all limits expressed in MB +-- mpse: Remove Intel Soft CPM support +-- mpse: make regex capability generic +-- mpse: only use literals for fast patterns if search_method is not hyperscan +-- output: add packet trace feature +-- perf_monitor: fixed main table (perf_monitor) having same name as pegs for +-- perfmon field +-- regex: fix pass through of mpse flags to hyperscan +-- replace: do not trip over fast pattern only +-- rpc: revert to positional params, fix tcp logic, clean up formatting +-- rules: promote metadata:service to a separate option since it is not metadata +-- snort2lua: Fixed incorrect file names errors +-- snort2lua: move footprint to stream from stream_tcp +-- spell check: fix message and comment typos +-- stream: add ip_proto as part of flow key +-- stream: fix user dependency on flush bucket +-- text logs: fix default unlimited file size +-- u2: add event3 to u2spewfoo +-- u2: convert thread local buffers to heap +-- u2: deprecate ip4 and ip6 specific events and add a single event for both +-- u2: remove obsolete configurations +-- u2: support mixed IP versions + 17/07/13 - build 237 -- build: add support for appending EXTRABUILD to the BUILD string diff --git a/doc/differences.txt b/doc/differences.txt index 74b11766b..1ae3559a7 100644 --- a/doc/differences.txt +++ b/doc/differences.txt @@ -46,12 +46,16 @@ Some things Snort++ can do today that Snort can not do as well: (Snort 2 supports only 2 IP layers) * process PDU buffers (Snort 2 only processes packets) -* fully stateful http_inspect with 83 builtin alerts +* fully stateful http_inspect with 97 builtin alerts (Snort 2 is only partly stateful with 33 builtin alerts) * output all semantic errors before quitting (Snort 2 stops at first one) -* alert service (eg http) and alert file rules +* alert file rules + (Snort 2 must use multiple rules) +* alert service rules, eg alert http (Snort 2 must use metadata:service) +* automatic fast_pattern only + (Snort 2 requires explicit fast_pattern:only) * elided rule headers omit nets and/or ports (Snort 2 requires explicit 'any') * dump builtin rule stubs @@ -180,30 +184,48 @@ Some things Snort++ can do today that Snort can not do as well: === Rules * all rules must have a sid +* sid == 0 not allowed * deleted activate / dynamic rules +* deleted unused rule_state.action * deleted metadata engine shared * deleted metadata: rule-flushing (with PDU flushing rule flushing can cause missed attacks, the opposite of its intent) -* deleted unused rule_state.action -* fastpattern_offset, fast_pattern_length +* changed metadata:service one[, service two]; to service:one[, two]; +* soid is now a non-metadata option +* metadata is now truly metadata with no impact on detection + (Snort doesn't care about metadata internal structure / syntax) +* deleted fast_pattern:only; use fast_pattern, nocase + (option is not added to detection tree if not required) +* changed fast_pattern:, to + fastpattern_offset: , fast_pattern_length +* fast pattern sensitive data with sd_pattern using hyperscan +* hyperscan regex fast patterns with regex:"", fast_pattern; * no ; separated content suboptions * offset, depth, distance, and within must use a space separator not colon (e.g. offset:5; becomes offset 5;) -* rule option sequence: soid -* sid == 0 not allowed -* soid is now a non-metadata option -* content suboptions http_* are now full options and should be place before content +* content suboptions http_* are now full options +* added sticky buffers: buffer selector options must precede contents and remain + in effect until changed * the following pcre options have been deleted: use sticky buffers instead B, U, P, H, M, C, I, D, K, S, Y -* deleted uricontent ips rule option. +* deleted uricontent option; use sticky buffer uricontent:"foo" --> http_uri; content:"foo" * deleted urilen raw and norm; must use http_raw_uri and http_uri instead * deleted unused http_encode option * urilen replaced with generic bufferlen which applies to current sticky buffer * added optional selector to http_header, e.g. http_header:User-Agent; -* multiline rules w/o \n -* #begin ... #end comments +* the all new http_inspect has new buffers and rule options +* added alert file and alert service rules + (service in body not required if there is only one and it is in header; + alert service / file rules disable fast pattern searching of raw packets) +* rule option sequence: soid +* arbitrary whitespace and multiline rules w/o \n +* #begin ... #end comments to easily commment out multiple lines +* add rule remarks option with rem:"arbitrary comment" +* nets and/or ports may be omitted from rule headers (matches any) +* parse all rules and output all errors before quitting +* read rules from conf, separate rules file, or stdin === Output diff --git a/src/main/build.h b/src/main/build.h index c9f41270a..6d8fcf153 100644 --- a/src/main/build.h +++ b/src/main/build.h @@ -12,7 +12,7 @@ // // //-----------------------------------------------// -#define BUILD_NUMBER 237 +#define BUILD_NUMBER 238 #ifndef EXTRABUILD #define BUILD STRINGIFY_MX(BUILD_NUMBER) diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h index 386be8ae3..e2d1c1d35 100644 --- a/src/protocols/ipv6.h +++ b/src/protocols/ipv6.h @@ -86,7 +86,7 @@ struct IP6Hdr { return (uint16_t)((ntohl(ip6_vtf) & 0x0FF00000) >> 20); } inline uint32_t flow() const - { return (uint16_t)((ntohl(ip6_vtf) & 0x000FFFFF) >> 20); } + { return (ntohl(ip6_vtf) & 0x000FFFFF); } // because Snort expects this in terms of 32 bit words. inline uint8_t hlen() const