kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/snort/PLIST

103 lines
3.7 KiB
Text
Raw Normal View History

Remove example rc.d scripts from PLISTs. These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-03-11 15:04:57 +01:00
@comment $NetBSD: PLIST,v 1.32 2014/03/11 14:05:11 jperkin Exp $
Initial import of snort-1.2.1, a libpcap-based packet sniffer/logger.
1999-09-10 17:48:02 +02:00
bin/snort
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
lib/pkgconfig/snort.pc
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
lib/snort_dynamicengine/libsf_engine.la
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
lib/snort_dynamicpreprocessor/lib_sfdynamic_preprocessor_example.la
lib/snort_dynamicpreprocessor/libsf_dce2_preproc.la
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.la
lib/snort_dynamicpreprocessor/libsf_dns_preproc.la
lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.la
lib/snort_dynamicpreprocessor/libsf_smtp_preproc.la
lib/snort_dynamicpreprocessor/libsf_ssh_preproc.la
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
lib/snort_dynamicpreprocessor/libsf_ssl_preproc.la
lib/snort_dynamicrules/lib_sfdynamic_example_rule.la
Update snort to 1.5.1 Changes are: * fixed a problem with pass rules not being applied properly * fixed a #include ordering statement for Slackware 4.0 installs * fixed banner output for the -V option * Token Ring decoding is now fully functional * Added packet buffer cleanup code to all protocol decoders * fixed a problem with improper TCP option output * Added a Snort man page
2000-02-04 17:18:01 +01:00
man/man8/snort.8
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/AUTHORS
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/BUGS
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/CREDITS
Update snort to 1.8.4 (update was provided by Mipam <mipam@ibb.net> in a private mail -- thanks!) Changes are: * Fixed stream4 offset initialization * Double Open of snort log file * Lots of new rules * Fatal error on problems other than -> and <> * Fixed stream4 several low memory conditions * Error checking in stream4/frag2 argument parsing * snortdb schema updates to 1.05 * --with-pcap-includes should now look at specified pcap * packet statistics now should be more accurate with regards to lost packets werwerwerwerwer * double PID file write * S4 alignment problems on Sparc fixed * new snmptrap code * documentation updates * Stability fixes in frag2
2002-04-02 23:34:08 +02:00
share/doc/snort/INSTALL
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/NEWS
Update to snort-2.1.2. From Adrian Portelli in PR pkg/25029. While here, convert to buildlink3. Changes: * Various portability fixes. * Fixed conversation parsing faults so users can operate this preprocessor * Detect non-rfc standard chunk encodings. Detect abnormal HTTP requests with newlines, spaces, etc. before the request method. * Fix negative stats output on snort exit or SIGUSR1. * Removed escaping of '%' and '_' characters in MySQL * Various documentation fixes/updates. * Added Flowbits detection functionality. * Added utility to parse out perfmon stats. * Tagged Packets no longer have NULL msg name. * Fixed http_inspect double alerting on pkts and rebuilt streams. * http_inspect proxy_alert now supports normal proxy networks setups. http_inspect default server only valid if specified in config. * Close Socket when Snort receives SIGHUP. * Added GID, SID, and Rev to csv output. * config chroot readded. * Added additional error checking for custom rules. * Flow now honors -q (quiet). * Removed non_rfc_chars from default profiles. * Added suppression negation. * Better support for ODBC. Better memory management. Improved escaping of SQL strings. * Other miscellaneous bugfixes.
2004-04-10 05:09:45 +02:00
share/doc/snort/PROBLEMS
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/README
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.ARUBA
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/README.FLEXRESP
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.FLEXRESP2
Update to snort 2.3.0 2005-01-25 - Snort 2.3.0 Final Released * Fixed issue with sfPortscan reporting incorrect IP datagram length. Thanks Jon Hart for the test case and finding the bug, and Marc Norton for resolving the issue. * Threshold/Suppression now prints properly when logging to syslog. Thanks Sekure for pointing out the problem. Thanks Steve Sturges for working on the fix. * Threshold memcap argument now correctly handles non-integer input. Thanks nnposter for the patch. * Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were not decoded properly. Thanks Dan Roelker for the fix. * Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your work on putting it all together. 2004-12-15 - Snort 2.3.0 RC2 Released * Small performance improvement to arpspoof and also fixed a problem where the list of configured IP/MAC entries would contain only one entry and leaked memory (Jeff Nathan). * Fixed a problem affecting MacOS X where linking may fail with non-standard libraries when global symbols are encountered multiple times (Jeff Nathan). * Ignore RST|ACK midstream pickup case so we don't get an evasive TCP alerts. Thanks for the report, Sekure. Thanks Dan Roelker for the fix. * Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the logdir config will work if the default or command-line logdir does not exist on the system. Thanks Dan Roelker. * Fixed bug when setting the doe_ptr on a successful pcre match. It is now set relative to base_ptr. Thanks Steve Sturges for the fix. * Added from_beginning and multiplier options for byte_jump. from_beginning skips bytes from the beginning of the content, instead of from the location immediately following the number of bytes to skip. multiplier takes a numeric argument, and skips x times that number of bytes. Thanks again to Steve Sturges. * In "fast" output, now log only actual packet contents when UDP data length is greater than actual data length. Thanks Brian Caswell for spotting this, and Andrew Mullican for working on the fix. * Please check the ChangeLog for further details. 2004-11-18 - Snort 2.3.0 RC1 Released * Added IPS functionality from Snort-Inline. A big thanks to the Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor Julien). Also, Thanks Dan Roelker for doing the integrating of Snort-Inline into the official Snort project. * Added new portscan detector. The design and implementation was headed up by Dan Roelker, and included Marc Norton and Jeremy Hewlett. * Numerous changes for better 64bit Snort support from Jeremy Hewlett and Marc Norton. Additionally, an --enable-64bit-gcc option was added to configure. However, there are still some memory alignment issues to work out before 64bit mode is fully functional, patches are welcomed. Thanks Chris Baker for doing 64bit testing. * Added not_established keyword to the flow detection option. This allows snort to do dynamic firewall rulesets. Experimental for now. * Added an enforce_state keyword to stream4 so we won't pick up midstream sessions. This works well for asynchronous links and also for just monitoring legitimate traffic. * Relocated ./contrib files to http://www.snort.org/dl/contrib as many are not maintained by Sourcefire and are out of date. The rpm and schema files have been relocated in their respective 'rpm' and 'schemas' directories under the snort parent directory. * perfmonitor config line can now be configured with "accumulate" or "reset." Thanks Marc Norton for the feature, and Barry Basselgia for pointing out the issue. Thanks Scott Dexter and Andreas Ostling for doing some initial testing. * Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson and Clay McClure. Thanks guys. * Fixed reference times to match log time for first packet, for an event generated by a reassembled packet. Incremented event ID to give unique ID for each packet. Also made unified logging compatible with Windows. Thanks Andrew Mullican for the fix. * Fixed linux perfmonitoring stats for the 2.6 kernel. Thanks to everyone that reported this bug. Thanks Dan Roelker for the fix. * Get thresholding/suppression to work for alerts that do not contain an ip header (primarily decode alerts). Thanks Brian Caswell. * Fix conditions where snort would log double web alerts that contained only content options (no uricontents). Thanks to kawa for finding and reporting this bug. * Fix suppression/thresholding bug for non-rule alerts. Thanks to Alex Butcher for reporting it to us. * Many other bug fixes, please check the ChangeLog for details.
2005-01-29 00:02:41 +01:00
share/doc/snort/README.INLINE
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/README.PLUGINS
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.PerfProfiling
share/doc/snort/README.SMTP
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/doc/snort/README.UNSOCK
share/doc/snort/README.WIN32
share/doc/snort/README.alert_order
- Update snort to 2.2.0 - ok'ed snj@, wiz@ - Install database scripts which goes a part-way to addressing PR 18996 Updated database schema diagram from Chris Reid. Schema can be found in ./doc/snort_schema_v106.pdf Added --include-pcre* configuration option to help cross compiling. Thanks Erik de Castro Lopo. Fixed thresholding/suppression issue with queuing multiple events per packet. Thanks Andreas Ostling. When a rebuilt stream causes an alert, log out the original packets instead of the rebuilt packet. Thanks sekure@gmail.com for the report. Turned off http_inspect alerts that were causing false positives in the preset webserver profiles (Thanks Dan Roelker). Turn off encoding alerts in HTTP parameter field. The parameter field is still normalized, it just doesn't alert. This helps reduce alerts that are generated from complex parameter queries (Thanks Dan Roelker). Fixed memory leak in "fast" output. Thanks for your bug report sekure@gmail.com. Clear error code which under Windows was causing a subsequent false failure in parsing threshold rules. (Thanks to Rich Adamson) Further details can be found in Changelog and RELEASE.NOTES.
2004-09-21 17:50:26 +02:00
share/doc/snort/README.asn1
Update snort to 1.9.0. Changes: Lots of new rules, extended analyzing of packages etc. Fixes PR 18637 by Adrian Portelli <adrianp@stindustries.net>
2002-10-13 06:42:12 +02:00
share/doc/snort/README.csv
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/README.database
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.dcerpc
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/README.dcerpc2
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/README.decode
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/README.decoder_preproc_rules
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.dns
- Upgrade snort to 2.1.3 - Grab maintainership of the package (with ok of previous owner) - Use SUBST_* code Ok'ed wiz@, snj@, salo@ From the changelog: 2004-05-06 Daniel Roelker <droelker@sourcefire.com> * src/detection-plugins/sp_pattern_match.c: Fixed rule read up error when parsing hexmode content options. Thanks for pointing it out Toni Maatta. (Roelker) * src/preprocessors/spp_stream4.c: Fixed null pointer dereference when detect_scans were enabled and creating a new session that had funky flags. Thanks to Chad Kreimendahl for reporting the bug and testing the fix. (Roelker) 2004-04-20 Daniel Roelker <droelker@sourcefire.com> * src/event_queue.c: * src/event_queue.h: * src/sfutil/sfeventq.c: * src/sfutil/sfeventq.h: Added multi-event queueing in Snort. Snort now supports logging multiple events per packet, and prioritizing those events using different methods. Thanks to H.D. Moore for illustrating event obfuscations when snort only logged one event per packet. (Roelker) * src/snort.c: * src/decode.c: * src/detect.c: * src/fpcreate.c: * src/fpdetect.c: * src/preprocessors/spp_arpspoof.c: * src/preprocessors/spp_bo.c: * src/preprocessors/spp_frag2.c: * src/preprocessors/snort_httpinspect.c: * src/preprocessors/spp_rpc_decode.c: * src/preprocessors/spp_stream4.c: Updated event generators to use new event queueing sytem. (Roelker) * src/output-plugins/spo_alert_fast.c: Added newline to 'cmg' alert output, so IP decode is easier to read. (Roelker) * src/output-plugins/spo_database.c: Updated how current/utc times are calculated, as well as how they are formatted, thanks Marcus Janoski. (Reid) * src/parser.c: Error on unterminated IP lists. Added 'config event_queue' parameter. Configuration changes to 'config checksum_mode' for specifying which checksums to do. (Norton) * src/plugbase.h: Fixes from Chris Reid for timestamp routines. (Reid) * src/tag.c: Revert to old tag functionality. Will add proposed tagging configurations in the future. (Roelker)
2004-07-01 19:10:22 +02:00
share/doc/snort/README.event_queue
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/README.filters
Update to snort-2.1.2. From Adrian Portelli in PR pkg/25029. While here, convert to buildlink3. Changes: * Various portability fixes. * Fixed conversation parsing faults so users can operate this preprocessor * Detect non-rfc standard chunk encodings. Detect abnormal HTTP requests with newlines, spaces, etc. before the request method. * Fix negative stats output on snort exit or SIGUSR1. * Removed escaping of '%' and '_' characters in MySQL * Various documentation fixes/updates. * Added Flowbits detection functionality. * Added utility to parse out perfmon stats. * Tagged Packets no longer have NULL msg name. * Fixed http_inspect double alerting on pkts and rebuilt streams. * http_inspect proxy_alert now supports normal proxy networks setups. http_inspect default server only valid if specified in config. * Close Socket when Snort receives SIGHUP. * Added GID, SID, and Rev to csv output. * config chroot readded. * Added additional error checking for custom rules. * Flow now honors -q (quiet). * Removed non_rfc_chars from default profiles. * Added suppression negation. * Better support for ODBC. Better memory management. Improved escaping of SQL strings. * Other miscellaneous bugfixes.
2004-04-10 05:09:45 +02:00
share/doc/snort/README.flowbits
Update snort to 2.4.0 If you are using this package make note of the distribution change mentioned below. I have update the MESSAGE to inform users of this and there is now also a net/snort-rules package with the community rules. > [*] Distribution Change > * Rules are no longer distributed as part of the Snort releases, they are > available as a separate download from snort.org. This was done for > three reasons: > 1) To better manage the new rules licensing. > 2) To reduce the size of the engine download. > 3) To move the thousands of documentation files for the rules into > the rules tarballs. If you've ever checked Snort out of CVS you'll > know why this is a Good Thing. > > [*] New additions > * Added new IP defragmentation preprocessor, Frag3. The frag3 preprocessor > is a target-based IP defragmentation module, and is intended as a > replacement for the frag2 module. Check out the README.frag3 for full > info on this new preprocessor. > > * Libprelude support has been added (enable with --enable-prelude). > Thanks Yoann Vandoorselaere! > > * An "ftpbounce" rule detection plugin was added for easier detection of > FTP bounce attacks. > > * Added a new Snort config option, "ignore_ports," to ignore packets > based on port number. This is similar to bpf filters, but done within > snort.conf. > > [*] Improvements > * Snort startup messages printed in syslog now contain a PID before each > entry. Thanks Sekure for initially bringing this up. > > * Stream4: Performance improvements. > > * Stream4: Added 'max_session_limit' option which limits number of > concurrent sessions tracked. Added favor_old/favor_new options that > affect order in which packets are put together for reassembly. > > * Stream4: New configuration options to manage flushpoints for improved > anti-evasion. The flush_behavior option selects flushpoint management > mode. New flush_base, flush_range, and flush_seed manage randomized > flushing. Check out the snort.conf file for full config data on the > new flush options. > > * Added two more alerts for BackOrifice client and server packets. This > allows specific alerts to be suppressed. > > * PerfMon preprocessor updated to include more detailed stats for rebuilt > packets (applayer, wire, fragmented & TCP). Also added 'atexitonly' > option that dumps stats at exit of snort, and command line -Z flag to > specify the file to which stats are logged. > > * Added new Http Inspect config item, "tab_uri_delimiter," which if > specified, lets a tab character (0x09) act as the delimiter for a URI. > > * Added a '-G' command line flag to snort that specifies the Snort > instance log identifier. It takes a single argument that can be either > hex (prefaced with 0x) or decimal. The unified log files will include > the instance ID when the -G flag is used. > > * "Same SRC/DST" (sid 527) and "Loopback Traffic" (sid 528) are now > handled in the IP decoder. Those sids are now considered obsolete. > > * Http_Inspect "flow_depth" option now accepts a -1 value which tells > Snort to ignore all server-side traffic. > > * RPMs have been updated to be more portable, and also now include a > "--with inline" option for those wanting to build Inline RPMs. Thanks > Daniel Wittenberg and JP Vossen for your help! > > * Many, many bug fixes have also gone into this release, please see the > ChangeLog for details.
2005-08-13 21:56:47 +02:00
share/doc/snort/README.frag3
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.ftptelnet
Update to 2.8.1 Includes fix for CVE-2008-1804 [*] New Additions * Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. * Support for GRE encapsulation for both IPv4 & IPv6. * Support for IP over IP tunneling for both IPv4 & IPv6. * SSL preprocessor to allow ability to not inspect encrypted traffic. * Ability to read mulitple PCAPs from the command line. * Support for new CVS rule detection options. [*] Improvements * Update to HTTP Inspect to identify overly long HTTP header fields. * Updates to IPv6 support, including changes to avoid namespace conflicts for certain Operating systems. * Updates to address issues seen on various Sparc platforms. * Stricter enforcement of shared object versions to avoid API conflicts.
2008-05-26 01:49:07 +02:00
share/doc/snort/README.gre
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/doc/snort/README.http_inspect
Update to 2.8.1 Includes fix for CVE-2008-1804 [*] New Additions * Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. * Support for GRE encapsulation for both IPv4 & IPv6. * Support for IP over IP tunneling for both IPv4 & IPv6. * SSL preprocessor to allow ability to not inspect encrypted traffic. * Ability to read mulitple PCAPs from the command line. * Support for new CVS rule detection options. [*] Improvements * Update to HTTP Inspect to identify overly long HTTP header fields. * Updates to IPv6 support, including changes to avoid namespace conflicts for certain Operating systems. * Updates to address issues seen on various Sparc platforms. * Stricter enforcement of shared object versions to avoid API conflicts.
2008-05-26 01:49:07 +02:00
share/doc/snort/README.ipip
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/README.ipv6
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/README.multipleconfigs
Update to 2.8.1 Includes fix for CVE-2008-1804 [*] New Additions * Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. * Support for GRE encapsulation for both IPv4 & IPv6. * Support for IP over IP tunneling for both IPv4 & IPv6. * SSL preprocessor to allow ability to not inspect encrypted traffic. * Ability to read mulitple PCAPs from the command line. * Support for new CVS rule detection options. [*] Improvements * Update to HTTP Inspect to identify overly long HTTP header fields. * Updates to IPv6 support, including changes to avoid namespace conflicts for certain Operating systems. * Updates to address issues seen on various Sparc platforms. * Stricter enforcement of shared object versions to avoid API conflicts.
2008-05-26 01:49:07 +02:00
share/doc/snort/README.pcap_readmode
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/README.ppm
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/README.reload
Update to snort 2.3.0 2005-01-25 - Snort 2.3.0 Final Released * Fixed issue with sfPortscan reporting incorrect IP datagram length. Thanks Jon Hart for the test case and finding the bug, and Marc Norton for resolving the issue. * Threshold/Suppression now prints properly when logging to syslog. Thanks Sekure for pointing out the problem. Thanks Steve Sturges for working on the fix. * Threshold memcap argument now correctly handles non-integer input. Thanks nnposter for the patch. * Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were not decoded properly. Thanks Dan Roelker for the fix. * Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your work on putting it all together. 2004-12-15 - Snort 2.3.0 RC2 Released * Small performance improvement to arpspoof and also fixed a problem where the list of configured IP/MAC entries would contain only one entry and leaked memory (Jeff Nathan). * Fixed a problem affecting MacOS X where linking may fail with non-standard libraries when global symbols are encountered multiple times (Jeff Nathan). * Ignore RST|ACK midstream pickup case so we don't get an evasive TCP alerts. Thanks for the report, Sekure. Thanks Dan Roelker for the fix. * Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the logdir config will work if the default or command-line logdir does not exist on the system. Thanks Dan Roelker. * Fixed bug when setting the doe_ptr on a successful pcre match. It is now set relative to base_ptr. Thanks Steve Sturges for the fix. * Added from_beginning and multiplier options for byte_jump. from_beginning skips bytes from the beginning of the content, instead of from the location immediately following the number of bytes to skip. multiplier takes a numeric argument, and skips x times that number of bytes. Thanks again to Steve Sturges. * In "fast" output, now log only actual packet contents when UDP data length is greater than actual data length. Thanks Brian Caswell for spotting this, and Andrew Mullican for working on the fix. * Please check the ChangeLog for further details. 2004-11-18 - Snort 2.3.0 RC1 Released * Added IPS functionality from Snort-Inline. A big thanks to the Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor Julien). Also, Thanks Dan Roelker for doing the integrating of Snort-Inline into the official Snort project. * Added new portscan detector. The design and implementation was headed up by Dan Roelker, and included Marc Norton and Jeremy Hewlett. * Numerous changes for better 64bit Snort support from Jeremy Hewlett and Marc Norton. Additionally, an --enable-64bit-gcc option was added to configure. However, there are still some memory alignment issues to work out before 64bit mode is fully functional, patches are welcomed. Thanks Chris Baker for doing 64bit testing. * Added not_established keyword to the flow detection option. This allows snort to do dynamic firewall rulesets. Experimental for now. * Added an enforce_state keyword to stream4 so we won't pick up midstream sessions. This works well for asynchronous links and also for just monitoring legitimate traffic. * Relocated ./contrib files to http://www.snort.org/dl/contrib as many are not maintained by Sourcefire and are out of date. The rpm and schema files have been relocated in their respective 'rpm' and 'schemas' directories under the snort parent directory. * perfmonitor config line can now be configured with "accumulate" or "reset." Thanks Marc Norton for the feature, and Barry Basselgia for pointing out the issue. Thanks Scott Dexter and Andreas Ostling for doing some initial testing. * Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson and Clay McClure. Thanks guys. * Fixed reference times to match log time for first packet, for an event generated by a reassembled packet. Incremented event ID to give unique ID for each packet. Also made unified logging compatible with Windows. Thanks Andrew Mullican for the fix. * Fixed linux perfmonitoring stats for the 2.6 kernel. Thanks to everyone that reported this bug. Thanks Dan Roelker for the fix. * Get thresholding/suppression to work for alerts that do not contain an ip header (primarily decode alerts). Thanks Brian Caswell. * Fix conditions where snort would log double web alerts that contained only content options (no uricontents). Thanks to kawa for finding and reporting this bug. * Fix suppression/thresholding bug for non-rule alerts. Thanks to Alex Butcher for reporting it to us. * Many other bug fixes, please check the ChangeLog for details.
2005-01-29 00:02:41 +01:00
share/doc/snort/README.sfportscan
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.ssh
Update to 2.8.1 Includes fix for CVE-2008-1804 [*] New Additions * Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. * Support for GRE encapsulation for both IPv4 & IPv6. * Support for IP over IP tunneling for both IPv4 & IPv6. * SSL preprocessor to allow ability to not inspect encrypted traffic. * Ability to read mulitple PCAPs from the command line. * Support for new CVS rule detection options. [*] Improvements * Update to HTTP Inspect to identify overly long HTTP header fields. * Updates to IPv6 support, including changes to avoid namespace conflicts for certain Operating systems. * Updates to address issues seen on various Sparc platforms. * Stricter enforcement of shared object versions to avoid API conflicts.
2008-05-26 01:49:07 +02:00
share/doc/snort/README.ssl
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/README.stream5
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/README.tag
Update to version 2.0.2. Patch from Adrian Portelli via PR pkg/22900. Changes: - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-09-23 17:43:50 +02:00
share/doc/snort/README.thresholding
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/doc/snort/README.variables
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/doc/snort/README.wireless
Update snort to 1.9.0. Changes: Lots of new rules, extended analyzing of packages etc. Fixes PR 18637 by Adrian Portelli <adrianp@stindustries.net>
2002-10-13 06:42:12 +02:00
share/doc/snort/TODO
Upgrade snort to 1.8.1. Changes: * SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22 20:07:50 +02:00
share/doc/snort/USAGE
Update to snort-2.1.2. From Adrian Portelli in PR pkg/25029. While here, convert to buildlink3. Changes: * Various portability fixes. * Fixed conversation parsing faults so users can operate this preprocessor * Detect non-rfc standard chunk encodings. Detect abnormal HTTP requests with newlines, spaces, etc. before the request method. * Fix negative stats output on snort exit or SIGUSR1. * Removed escaping of '%' and '_' characters in MySQL * Various documentation fixes/updates. * Added Flowbits detection functionality. * Added utility to parse out perfmon stats. * Tagged Packets no longer have NULL msg name. * Fixed http_inspect double alerting on pkts and rebuilt streams. * http_inspect proxy_alert now supports normal proxy networks setups. http_inspect default server only valid if specified in config. * Close Socket when Snort receives SIGHUP. * Added GID, SID, and Rev to csv output. * config chroot readded. * Added additional error checking for custom rules. * Flow now honors -q (quiet). * Removed non_rfc_chars from default profiles. * Added suppression negation. * Better support for ODBC. Better memory management. Improved escaping of SQL strings. * Other miscellaneous bugfixes.
2004-04-10 05:09:45 +02:00
share/doc/snort/WISHLIST
Update to snort 2.3.0 2005-01-25 - Snort 2.3.0 Final Released * Fixed issue with sfPortscan reporting incorrect IP datagram length. Thanks Jon Hart for the test case and finding the bug, and Marc Norton for resolving the issue. * Threshold/Suppression now prints properly when logging to syslog. Thanks Sekure for pointing out the problem. Thanks Steve Sturges for working on the fix. * Threshold memcap argument now correctly handles non-integer input. Thanks nnposter for the patch. * Fixed issue reported by Allan Jensen, where on MacOS X, ppp links were not decoded properly. Thanks Dan Roelker for the fix. * Snort manual and FAQ are updated for 2.3. Thanks Jen Harvey for your work on putting it all together. 2004-12-15 - Snort 2.3.0 RC2 Released * Small performance improvement to arpspoof and also fixed a problem where the list of configured IP/MAC entries would contain only one entry and leaked memory (Jeff Nathan). * Fixed a problem affecting MacOS X where linking may fail with non-standard libraries when global symbols are encountered multiple times (Jeff Nathan). * Ignore RST|ACK midstream pickup case so we don't get an evasive TCP alerts. Thanks for the report, Sekure. Thanks Dan Roelker for the fix. * Moved CheckLogDir() to after parsing snort.conf (for IDS mode) so the logdir config will work if the default or command-line logdir does not exist on the system. Thanks Dan Roelker. * Fixed bug when setting the doe_ptr on a successful pcre match. It is now set relative to base_ptr. Thanks Steve Sturges for the fix. * Added from_beginning and multiplier options for byte_jump. from_beginning skips bytes from the beginning of the content, instead of from the location immediately following the number of bytes to skip. multiplier takes a numeric argument, and skips x times that number of bytes. Thanks again to Steve Sturges. * In "fast" output, now log only actual packet contents when UDP data length is greater than actual data length. Thanks Brian Caswell for spotting this, and Andrew Mullican for working on the fix. * Please check the ChangeLog for further details. 2004-11-18 - Snort 2.3.0 RC1 Released * Added IPS functionality from Snort-Inline. A big thanks to the Snort-Inline guys (Jed Haile, Rob McMillen, William Metcalf, and Victor Julien). Also, Thanks Dan Roelker for doing the integrating of Snort-Inline into the official Snort project. * Added new portscan detector. The design and implementation was headed up by Dan Roelker, and included Marc Norton and Jeremy Hewlett. * Numerous changes for better 64bit Snort support from Jeremy Hewlett and Marc Norton. Additionally, an --enable-64bit-gcc option was added to configure. However, there are still some memory alignment issues to work out before 64bit mode is fully functional, patches are welcomed. Thanks Chris Baker for doing 64bit testing. * Added not_established keyword to the flow detection option. This allows snort to do dynamic firewall rulesets. Experimental for now. * Added an enforce_state keyword to stream4 so we won't pick up midstream sessions. This works well for asynchronous links and also for just monitoring legitimate traffic. * Relocated ./contrib files to http://www.snort.org/dl/contrib as many are not maintained by Sourcefire and are out of date. The rpm and schema files have been relocated in their respective 'rpm' and 'schemas' directories under the snort parent directory. * perfmonitor config line can now be configured with "accumulate" or "reset." Thanks Marc Norton for the feature, and Barry Basselgia for pointing out the issue. Thanks Scott Dexter and Andreas Ostling for doing some initial testing. * Fixed 64-bit bug in sfmemcap.c found and tested by Ryan Matteson and Clay McClure. Thanks guys. * Fixed reference times to match log time for first packet, for an event generated by a reassembled packet. Incremented event ID to give unique ID for each packet. Also made unified logging compatible with Windows. Thanks Andrew Mullican for the fix. * Fixed linux perfmonitoring stats for the 2.6 kernel. Thanks to everyone that reported this bug. Thanks Dan Roelker for the fix. * Get thresholding/suppression to work for alerts that do not contain an ip header (primarily decode alerts). Thanks Brian Caswell. * Fix conditions where snort would log double web alerts that contained only content options (no uricontents). Thanks to kawa for finding and reporting this bug. * Fix suppression/thresholding bug for non-rule alerts. Thanks to Alex Butcher for reporting it to us. * Many other bug fixes, please check the ChangeLog for details.
2005-01-29 00:02:41 +01:00
share/doc/snort/faq.pdf
share/doc/snort/faq.tex
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/doc/snort/generators
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/schemas/create_db2
share/doc/snort/schemas/create_mssql
Include database schemas in the install Bump snort{-mysql,-pgsql} to nb1
2006-01-03 18:34:40 +01:00
share/doc/snort/schemas/create_mysql
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/doc/snort/schemas/create_oracle.sql
Include database schemas in the install Bump snort{-mysql,-pgsql} to nb1
2006-01-03 18:34:40 +01:00
share/doc/snort/schemas/create_postgresql
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/doc/snort/snort_manual.pdf
share/doc/snort/snort_manual.tex
- Update snort to 2.2.0 - ok'ed snj@, wiz@ - Install database scripts which goes a part-way to addressing PR 18996 Updated database schema diagram from Chris Reid. Schema can be found in ./doc/snort_schema_v106.pdf Added --include-pcre* configuration option to help cross compiling. Thanks Erik de Castro Lopo. Fixed thresholding/suppression issue with queuing multiple events per packet. Thanks Andreas Ostling. When a rebuilt stream causes an alert, log out the original packets instead of the rebuilt packet. Thanks sekure@gmail.com for the report. Turned off http_inspect alerts that were causing false positives in the preset webserver profiles (Thanks Dan Roelker). Turn off encoding alerts in HTTP parameter field. The parameter field is still normalized, it just doesn't alert. This helps reduce alerts that are generated from complex parameter queries (Thanks Dan Roelker). Fixed memory leak in "fast" output. Thanks for your bug report sekure@gmail.com. Clear error code which under Windows was causing a subsequent false failure in parsing threshold rules. (Thanks to Rich Adamson) Further details can be found in Changelog and RELEASE.NOTES.
2004-09-21 17:50:26 +02:00
share/doc/snort/snort_schema_v106.pdf
Updated to version 1.9.1. This version fixes the buffer overflow issue noted in: http://www.kb.cert.org/vuls/id/916785 Changes: - follow PKG_SYSCONFDIR - added rc.d script - create own user and group - added MESSAGE with post-install instructions - removed DEINSTALL - minor cleanups (this package was really half-baked..) 1.9.1: ====== - src/preprocessors/spp_rpc_decode.c (PreprocRpcDecode): - alignment errors on non-x86 platforms - added new space delimited options alert_fragments no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete - corrected buffer overflow in fragment normalization - src/snort.c - Win32 '-s' parameter wasn't configured to accept an optarg, but code expected one, causing null-pointer violation. - Backport of 2.0 fixes for stream4 ( off by one errors on reassembly )
2003-03-04 02:02:25 +01:00
share/examples/snort/classification.config
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/examples/snort/gen-msg.map
share/examples/snort/generators
Updated to version 1.9.1. This version fixes the buffer overflow issue noted in: http://www.kb.cert.org/vuls/id/916785 Changes: - follow PKG_SYSCONFDIR - added rc.d script - create own user and group - added MESSAGE with post-install instructions - removed DEINSTALL - minor cleanups (this package was really half-baked..) 1.9.1: ====== - src/preprocessors/spp_rpc_decode.c (PreprocRpcDecode): - alignment errors on non-x86 platforms - added new space delimited options alert_fragments no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete - corrected buffer overflow in fragment normalization - src/snort.c - Win32 '-s' parameter wasn't configured to accept an optarg, but code expected one, causing null-pointer violation. - Backport of 2.0 fixes for stream4 ( off by one errors on reassembly )
2003-03-04 02:02:25 +01:00
share/examples/snort/reference.config
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/examples/snort/sid-msg.map
Updated to version 1.9.1. This version fixes the buffer overflow issue noted in: http://www.kb.cert.org/vuls/id/916785 Changes: - follow PKG_SYSCONFDIR - added rc.d script - create own user and group - added MESSAGE with post-install instructions - removed DEINSTALL - minor cleanups (this package was really half-baked..) 1.9.1: ====== - src/preprocessors/spp_rpc_decode.c (PreprocRpcDecode): - alignment errors on non-x86 platforms - added new space delimited options alert_fragments no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete - corrected buffer overflow in fragment normalization - src/snort.c - Win32 '-s' parameter wasn't configured to accept an optarg, but code expected one, causing null-pointer violation. - Backport of 2.0 fixes for stream4 ( off by one errors on reassembly )
2003-03-04 02:02:25 +01:00
share/examples/snort/snort.conf.default
Update to version 2.1.0. Changes: 2.1.0: ====== - A new connection tracking module, Flow (replaces conversation) - A new portscan detector based off of Flow, Flow-Portscan (replaces portscan2) - A new http preprocessor, HttpInspect (replaces http_decode) - Alert Thresholding and Suppression - PCRE rule keyword (Perl Compat Regular Expressions) - isdataat rule keyword (buffer length detection) - A ton of new and updated rules. 2.0.6: ====== - 64-bit update for detection engine. (Thanks, Silio d'Angelo) - Added better PPP decoding. (Thanks Jesper Peterson) - Updated ip_proto optimization for high-speed detection engine. - Fixed infinite loop problem that was introduced by the recursive pattern matching patch. Reported by Lawrence Reed, thanks for testing out the changes for us! - Various changes to help respond (version 1) work a little better. - spp_http_decode 64-bit patch from Dirk Mueller. - Out-of-order ACK problem from Andrew Rucker. Also, updated stream4 to the most recent version from HEAD. - Minor fixes to tagging related to 'src' and 'dst' directives - When counting one byte patterns in 'ningroup' added a check for psLen==1 (wu-manber pattern matcher). Thanks Josh Sakofsky and Dennis McGuire for helping us test this. 2.0.5: ====== - Stream4 fixes from Andrew Rucker Jones. - Allow memcap to be configured for threshold features. 2.0.4: ====== - Fixed a core dump introduced with 2.0.3 when dealing with negated patterns 2.0.3: ====== - doe_ptr handling in byte_test/byte_jump slightly modified to work better with the pcre patch - content processing is now recursive to make distance/within processing better ( thanks to Shai Rubin for patch! ) - fixed a bug in the mwm.c pattern matcher that resulted in some alerts not firing in a particular configuration of rules 2.0.2: ====== - Added Thresholding and Suppression features (Marc Norton/Sourcefire) - Fixed TCP RST processing bug found (Shai Rubin) - Cleanup of spp_arpspoof (Jeff Nathan) - Cleanup of win32 version including proper Event Log support (Chris Reid) - Munged data fixes for stream4 (Chris Green)
2003-12-31 15:11:42 +01:00
share/examples/snort/threshold.conf
share/examples/snort/unicode.map
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/snort/src/snort_dynamicsrc/bitop.h
share/snort/src/snort_dynamicsrc/debug.h
Update to 2.8.0 * Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-10-21 02:22:53 +02:00
share/snort/src/snort_dynamicsrc/pcap_pkthdr32.h
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/snort/src/snort_dynamicsrc/preprocids.h
share/snort/src/snort_dynamicsrc/profiler.h
Update to 2.8.5.1, to resolve a security issue. Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2011-04-01 18:48:36 +02:00
share/snort/src/snort_dynamicsrc/sfPolicyUserData.c
share/snort/src/snort_dynamicsrc/sfPolicyUserData.h
Update to snort 2.6.1.2 2.6.1 provides new functionality including the following: * New pattern matcher with a significantly reduced memory footprint * Introduction of stream5 for experimental use * Improvements to stream4, including UDP session tracking and optimizations for the reassembly buffer * Handling for reassembly of SMB fragmented data in DCE/RPC * An ssh preprocessor for experimental use * Updated Snort decoder that can decode GRE encapsulated packets * Output plugin to allow Snort to configure Aruba access control Snort 2.6.0: * Tcp stream properly reassembled after failed sequence check, which may lead to possible detection evasion. * Added configurable stream flushpoints. * Improved rpc processing. * Improved portscan detection. * Improved http request processing and handling of possible evasion cases. * Improved performance monitoring. The Snort 2.6 release also introduces the ability to use dynamic rules and dynamic preprocessors and contains further improvements to the Snort detection engine. Remove snort-{pgsql,mysql,prelude}. The new snort package uses options.mk to specify build options.
2007-02-17 20:08:05 +01:00
share/snort/src/snort_dynamicsrc/sf_dynamic_common.h
share/snort/src/snort_dynamicsrc/sf_dynamic_meta.h
share/snort/src/snort_dynamicsrc/sf_dynamic_preproc_lib.c
share/snort/src/snort_dynamicsrc/sf_dynamic_preproc_lib.h
share/snort/src/snort_dynamicsrc/sf_dynamic_preprocessor.h
share/snort/src/snort_dynamicsrc/sf_snort_packet.h
share/snort/src/snort_dynamicsrc/sf_snort_plugin_api.h
share/snort/src/snort_dynamicsrc/sfghash.h
share/snort/src/snort_dynamicsrc/sfhashfcn.h
share/snort/src/snort_dynamicsrc/sfsnort_dynamic_detection_lib.c
share/snort/src/snort_dynamicsrc/sfsnort_dynamic_detection_lib.h
share/snort/src/snort_dynamicsrc/str_search.h
share/snort/src/snort_dynamicsrc/stream_api.h
Reference in a new issue Copy permalink