From cfbf8fda94771461844b0fc805af5476f92328ce Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Tue, 21 Jan 2025 09:21:24 -0500 Subject: [PATCH] doc/csum: Stream checksum validation change Describe the change of behavior between the stream.checksum-validation setting and checksum-based rule keywords. --- doc/userguide/upgrade.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index 4bf74b6528..f5df98100f 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -82,6 +82,13 @@ Major changes - Unknown requirements in the ``requires`` keyword will now be treated as unmet requirements, causing the rule to not be loaded. See :ref:`keyword_requires`. +- The configuration setting controlling stream checksum checks no longer affects + checksum keyword validation. In Suricata 7.0, when ``stream.checksum-validation`` + was set to ``no``, the checksum keywords (e.g., ``ipv4-csum``, ``tcpv4-csum``, etc) + will always consider it valid; e.g., ``tcpv4-csum: invalid`` will never match. In + Suricata 8.0, ``stream.checksum-validation`` no longer affects the checksum rule keywords. + E.g., ``ipv4-csum: valid`` will only match if the check sum is valid, even when engine + checksum validations are disabled. Removals ~~~~~~~~ -- 2.47.2