From 88fc6ba07e673d22a11fb5e3a96c8a540ef50bf0 Mon Sep 17 00:00:00 2001
From: Michael Altizer
Date: Thu, 12 Sep 2019 19:40:29 -0400
Subject: [PATCH] build: Generate and tag build 261
---
ChangeLog | 22 +++
doc/snort_manual.html | 208 +++++++++++++++++---
doc/snort_manual.pdf | Bin 823247 -> 823847 bytes
doc/snort_manual.text | 430 ++++++++++++++++++++++++------------------
src/main/build.h | 2 +-
5 files changed, 447 insertions(+), 215 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 984d2dc09..54f4a7e76 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,25 @@
+19/09/12 - build 261
+
+-- analyzer: Process retry queue and onloads when no DAQ messages are received
+-- appid: Enabled API for SSL to lookup appid
+-- appid: Support FTP banners on multiple packets with split response code
+-- build: Address miscellaneous cppcheck warnings
+-- build: Const-ify reference arguments as suggested by cppcheck
+-- build: Update CMake logic for unversioned LibSafeC pkg-config name
+-- doc: add bullets for $var parameter names and maxXX limits.
+-- http_inspect: accelerated blocking for chunked message bodies
+-- http2_inspect: send raw encoded headers to detection
+-- managers: Make InspectorManager::thread_stop() a no-op if thread_init() was never called
+-- rna: generate an RNA_EVENT_CHANGE when a host is seen after the last log event and the current
+ time is past the update timeout.
+-- rna: support for bidirectional flow with UDP, IP, and ICMP traffic
+-- rna: Support for filtering rna events by host ip
+-- rule_state: switch from regex parameter names to simpler parsing
+-- snort2lua: only emit max_flows and pruning_timeout options in converted lua file if the option
+ is used in the snort2 conf file
+-- stream: fix problem with accelerated blocking partial inspection
+-- style: update link for google c++ style guide
+
19/08/28 - build 260
-- appid: handle 'change cipher spec' in 'server hello' to allow some app detection for tls 1.3
diff --git a/doc/snort_manual.html b/doc/snort_manual.html
index fecf85ad8..4d11ba62a 100644
--- a/doc/snort_manual.html
+++ b/doc/snort_manual.html
@@ -782,7 +782,7 @@ asciidoc.install(2);
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0 (Build 260)
+o" )~ Version 3.0.0 (Build 261)
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights reserved.
@@ -1737,6 +1737,12 @@ IPS rules may also have a wild card parameter, which is indicated by a
The snort module has command line options starting with a -.
+
+
+$ denotes variable names, eg rule_state.$gid_sid which would be used
+ like rule_state["1:23456"] = { }.
+
+
Some additional details to note:
@@ -2158,7 +2170,7 @@ lzma >= 5.1.2 from
http://tukaani.org/xz/
-safec from https://github.com/rurban/safeclib/ for runtime bounds
+safec >= 3.5 from https://github.com/rurban/safeclib/ for runtime bounds
checks on certain legacy C-library calls
@@ -7272,6 +7284,26 @@ string
daq.modules[].variables[].variable: DAQ mod
daq.rx_bytes: total bytes received (sum)
+
+
+daq.retries_queued: messages queued for retry (sum)
+
+
+
+
+daq.retries_dropped: messages dropped when overrunning the retry queue (sum)
+
+
+
+
+daq.retries_processed: messages processed from the retry queue (sum)
+
+
+
+
+daq.retries_discarded: messages discarded when purging the retry queue (sum)
+
+
@@ -7393,7 +7425,7 @@ int
detection.trace: mask for enabling debug traces in module {
-
-rna.icmp: count of ICMP packets received (sum)
+rna.icmp_bidirectional: count of bidirectional ICMP flows received (sum)
+
+
+-
+
+rna.icmp_new: count of new ICMP flows received (sum)
+
+
+-
+
+rna.ip_bidirectional: count of bidirectional IP received (sum)
-
-rna.ip: count of IP packets received (sum)
+rna.ip_new: count of new IP flows received (sum)
-
-rna.udp: count of UDP packets received (sum)
+rna.udp_bidirectional: count of bidirectional UDP flows received (sum)
+
+
+-
+
+rna.udp_new: count of new UDP flows received (sum)
-
@@ -15154,6 +15216,11 @@ bool rna.enable_logger = true: enable or disable writing discov
rna.other_packets: count of packets received without session tracking (sum)
+-
+
+rna.change_host_update: count number of change host update events (sum)
+
+
@@ -15239,7 +15306,12 @@ int
rt_global.memcap = 2048: cap on amount of memory used
-
-bool rt_packet.test_daq_retry = true: test daq packet retry feature
+bool rt_packet.retry_targeted = false: request retry for packets whose data starts with A
+
+
+-
+
+bool rt_packet.retry_all = false: request retry for all non-retry packets
@@ -18207,14 +18279,20 @@ int
gtp_version.~: version to match { 0:2 }
+
+
What: rule option to set detection cursor to the decoded HTTP/2 header
+
+
+
+
http2_frame_data
-
What: rule option to see HTTP/2 frame body
+
What: rule option to set detection cursor to the HTTP/2 frame body
-
What: rule option to see 9-octet HTTP/2 frame header
+
What: rule option to set detection cursor to the 9-octet HTTP/2 frame header
@@ -22832,7 +22910,7 @@ yet firm so feedback is welcome to get something we can live with.
Generally try to follow
- http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml,
+ https://google.github.io/styleguide/cppguide.html,
but there are some differences documented here.
@@ -27656,6 +27734,11 @@ string rna.fingerprint_dir: directory to fingerprint patterns
+bool rna.log_when_idle = false: enable host update logging when snort is idle
+
+
+
+
string rna.rna_conf_path: path to RNA configuration
@@ -27686,17 +27769,22 @@ int rt_global.memcap = 2048: cap on amount of memory used
-bool rt_packet.test_daq_retry = true: test daq packet retry feature
+bool rt_packet.retry_all = false: request retry for all non-retry packets
-enum rule_state.([0-9]+):([0-9]+)[].action = inherit: apply action if rule matches or inherit from rule definition { log | pass | alert | drop | block | reset | inherit }
+bool rt_packet.retry_targeted = false: request retry for packets whose data starts with A
-enum rule_state.([0-9]+):([0-9]+)[].enable = inherit: enable or disable rule in current ips policy or use default defined by ips policy { no | yes | inherit }
+enum rule_state.$gid_sid[].action = inherit: apply action if rule matches or inherit from rule definition { log | pass | alert | drop | block | reset | inherit }
+
+
+
+
+enum rule_state.$gid_sid[].enable = inherit: enable or disable rule in current ips policy or use default defined by ips policy { no | yes | inherit }
@@ -29421,6 +29509,26 @@ interval wscale.~range: check if TCP window scale is in given r
+daq.retries_discarded: messages discarded when purging the retry queue (sum)
+
+
+
+
+daq.retries_dropped: messages dropped when overrunning the retry queue (sum)
+
+
+
+
+daq.retries_processed: messages processed from the retry queue (sum)
+
+
+
+
+daq.retries_queued: messages queued for retry (sum)
+
+
+
+
daq.retry: total retry verdicts (sum)
@@ -29976,7 +30084,7 @@ interval wscale.~range: check if TCP window scale is in given r
-detection.analyzed: packets sent to detection (now)
+detection.analyzed: total packets processed (now)
@@ -31096,12 +31204,27 @@ interval wscale.~range: check if TCP window scale is in given r
-rna.icmp: count of ICMP packets received (sum)
+rna.change_host_update: count number of change host update events (sum)
+
+
+
+
+rna.icmp_bidirectional: count of bidirectional ICMP flows received (sum)
+
+
+
+
+rna.icmp_new: count of new ICMP flows received (sum)
-rna.ip: count of IP packets received (sum)
+rna.ip_bidirectional: count of bidirectional IP received (sum)
+
+
+
+
+rna.ip_new: count of new IP flows received (sum)
@@ -31126,7 +31249,12 @@ interval wscale.~range: check if TCP window scale is in given r
-rna.udp: count of UDP packets received (sum)
+rna.udp_bidirectional: count of bidirectional UDP flows received (sum)
+
+
+
+
+rna.udp_new: count of new UDP flows received (sum)
@@ -33831,17 +33959,27 @@ interval wscale.~range: check if TCP window scale is in given r
-121:1 (http2_inspect) Error in HPACK integer value
+121:1 (http2_inspect) error in HPACK integer value
-121:2 (http2_inspect) Integer value has leading zeros
+121:2 (http2_inspect) integer value has leading zeros
-121:3 (http2_inspect) Error in HPACK string value
+121:3 (http2_inspect) error in HPACK string value
+
+
+
+
+121:4 (http2_inspect) missing continuation frame
+
+
+
+
+121:5 (http2_inspect) unexpected continuation frame
@@ -35892,12 +36030,17 @@ deleted -> unified2: 'vlan_event_types'
-http2_frame_data (ips_option): rule option to see HTTP/2 frame body
+http2_decoded_header (ips_option): rule option to set detection cursor to the decoded HTTP/2 header
+
+
+
+
+http2_frame_data (ips_option): rule option to set detection cursor to the HTTP/2 frame body
-http2_frame_header (ips_option): rule option to see 9-octet HTTP/2 frame header
+http2_frame_header (ips_option): rule option to set detection cursor to the 9-octet HTTP/2 frame header
@@ -37267,12 +37410,17 @@ deleted -> unified2: 'vlan_event_types'
-ips_option::http2_frame_data: rule option to see HTTP/2 frame body
+ips_option::http2_decoded_header: rule option to set detection cursor to the decoded HTTP/2 header
+
+
+
+
+ips_option::http2_frame_data: rule option to set detection cursor to the HTTP/2 frame body
-ips_option::http2_frame_header: rule option to see 9-octet HTTP/2 frame header
+ips_option::http2_frame_header: rule option to set detection cursor to the 9-octet HTTP/2 frame header
@@ -37945,7 +38093,7 @@ Adding/removing stream_* inspectors if stream was already configured