ChangeLog:
https://github.com/snort3/snort3/releases/tag/3.3.4.0
* appid: notify binder on service change
* appid: replaced hsessions vector of raw pointers into vector of smart
pointers
* ftp_telnet: refactoring ftp-data
* latency, dce, stream_ip: fix max pegs incorrectly declared sum
* telnet: avoid flush when cr or lf is between commands
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ChangeLog:
https://github.com/snort3/snort3/releases/tag/3.3.3.0
* control: code cleanup
* control: handle control commands after packet threads are fully
initialised
* daq: add outstanding packets counter
* extractor: add flow hash key
* file_api: max depth is set as part of initial config
* file: remove unused variable in FileFlows destructor
* filters: update dev_notes.txt with details for event_filter
* flow: optimize timeout handling for different packet type
* http_inspect: add peg counts for gzip, known-not-supported, and
unknown
* http_inspect: log normalized URI in extra data
* ips_options: separate main thread pcre counts from packet threads
stats
* memory: account memory for profiler only when packet thread is
involved
* src: resolve various warnings
* stream_tcp: make sure ports are correctly swapped when filling a
meta-ACK packet
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Replace references of WORKDIR with UNPACKDIR where it makes sense to do
so in preparation for changing the default value of UNPACKDIR.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* fixes:
ERROR: lib32-snort3-3+git-r0 do_populate_sysroot: QA Issue: snort.pc failed sanity test (tmpdir) in path lib32-snort3/3+git/sysroot-destdir/usr/lib/pkg
* it's broken for non-multilib builds as well, the issue is that
FLEX_CPPFLAGS points to native include dir, e.g.
FLEX_CPPFLAGS=-I/OE/../lib32-snort3/3+git/recipe-sysroot-native/usr/include
and the work around from:
https://github.com/openembedded/meta-openembedded/commit/973647848049abda6f2adbee0189720109863731
sed -i "s#${RECIPE_SYSROOT}##g" ${D}${libdir}/pkgconfig/snort.pc
strips the "/OE/../lib32-snort3/3+git/recipe-sysroot" part in non-multilib
case, but leaves:
FLEX_CPPFLAGS=-I-native/usr/include
which is still wrong, but not detected by buildpaths QA check anymore
and in multilib case, this didn't strip the first part because the
target sysroot is:
"/OE/../lib32-snort3/3+git/lib32-recipe-sysroot"
so it didn't strip anything from native sysroot:
"/OE/../lib32-snort3/3+git/recipe-sysroot-native"
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
If llvm unwind is present then disable unwinding support since it will
not have all unw_* functions eg. unw_strerror
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* src/dynamic-preprocessors/appid/service_plugins/service_ssl.c :
Fixed a scenario where SSL traffic was not detected correctly.
* src/dynamic-preprocessors/smtp/snort_smtp.c :
Fixed a possible memory corruption.
* src/dynamic-preprocessors/imap/imap_util.c
src/dynamic-preprocessors/pop/pop_util.c
src/dynamic-preprocessors/smtp/smtp_util.c
src/preprocessors/spp_httpinspect.c :
Fixed malformed packet debug engine output.
* src/preprocessors/Stream6/snort_stream_tcp.c :
Fixed security zones info in intrusion events.
* src/dynamic-preprocessors/appid/fw_appid.c :
Fixed URL lookup failure.
* src/preprocessors/HttpInspect/server/hi_server.c :
Fixed a possible memory leak.
* src/dynamic-preprocessors/appid/detector_plugins/detector_dns.c
src/dynamic-preprocessors/appid/fw_appid.c
src/dynamic-preprocessors/appid/fw_appid.h
src/dynamic-preprocessors/appid/detector_plugins/service_plugins/service_api.h :
Added support for dns root queries and underflow.
* src/dynamic-preprocessors/smtp/snort_smtp.c
src/Makefile.am
src/dynamic-examples/Makefile.am
src/dynamic-plugins/sf_dynamic_plugins.c
src/dynamic-plugins/sf_dynamic_preprocessor.h
src/dynamic-preprocessors/Makefile.am
src/dynamic-preprocessors/smtp/snort_smtp.h
src/dynamic-preprocessors/smtp/spp_smtp.c
src/smtp_api.h :
Added support to get extra data from SMTP and HTTP into IPS event.
* src/dynamic-preprocessors/appid/detector_plugins/detector_imap.c
src/dynamic-preprocessors/appid/detector_plugins/detector_pop3.c :
Added support for login success and failure eventing for IMAP and POP3.
* src/dynamic-preprocessors/appid/hi_server.c :
Added support to handle empty string for SNI/CN/SAN/ORG.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
changelog:
=========
* src/snort.c :
Fixed an issue where verdict will be applied onto next session when timeout
occurs in some scenarios.
* rc/file-process/file_service.c :
Removed an excessively flooding log.
* src/dynamic-preprocessors/modbus/modbus_decode.c :
Fixed possible integer overflow.
* src/fpcreate.c :
Added fix to GCC compiled snort to use AC-BNFA-Q search-method when Intel-cpm
is enabled.
* src/generators.h
src/preprocessors/Stream6/snort_stream_tcp.c :
Added fix to not to drop packets when window size is 0 by TCP normalizer
and Added new alert with GID 129 and SID 21 when such packets are seen.
* src/dynamic-preprocessors/appid/detector_plugins/detector_imap.c
src/dynamic-preprocessors/appid/detector_plugins/detector_pop3.c :
Added support for Appid to detect login success and failure for IMAP and POP3
protocols.
* src/dynamic-preprocessors/reputation/reputation_config.c
src/dynamic-preprocessors/reputation/spp_reputation.c
src/dynamic-preprocessors/reputation/spp_reputation.h
src/pkt_tracer.c
src/snort.c
src/util.c :
Fixed terminology to be bias-free in log/error messages.
* src/snort.c :
Fixed a potential race condition.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
this is another option for reproducibility which can be used by
compilers, and here consider processing it as well
Signed-off-by: Khem Raj <raj.khem@gmail.com>
-0001-chdeck-for-gettid-API-during-configure.patch
Removed since this is included in 2.9.16
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The Fedora 28+ does not have inbuilt SunRPC support in glibc and is
separately availble in tirpc package. So it enables tirpc checking for
fedora in configure.
Drop this piece of code since we had specify '-ltirpc' in LDFLAGS
explicitly. Otherwise it will cause a compile-host-path QA issue if the
host is Fedora 28+:
cc1: warning: include location "/usr/include/tirpc" is unsafe for
cross-compilation [-Wpoison-system-directories]
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Add PACKAGECONFIG[appid] for application identification support.
* Set the variables 'have_daq_packet_trace' and
'have_daq_verdict_reason' to 'no' since they are only supported in daq
2.2.2 but not in 2.0.6.
* Cleanup snort.init script and fix the incorrect argument of mkdir
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Update SRC_URI
* Drop 0001-fix-do_package-failed-since-snort-2.9.7.0.patch since the
issue had been fixed upstream.
* Drop the following patches and merge their modifications to
disable-run-test-program-while-cross-compiling.patch:
disable-dap-address-space-id.patch
disable-daq-flow-id.patch
disable-daq-verdict-retry.patch
disable-inaddr-none.patch
* Add disable-run-test-program-while-cross-compiling.patch to fix
configure error: cannot run test program while cross compiling.
The variables have_daq_real_addresses, have_daq_ext_modflow,
have_daq_queryflow, have_daq_data_channel_flags and
have_daq_data_channel_separate_ip_versions are set to no since they
are for daq 2.2.2 but we have daq 2.0.6 in meta-networking layer.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
WARNING:
Some of the context lines in patches were ignored. This can lead to incorrectly applied patches.
The context lines in the patches can be updated with devtool:
devtool modify <recipe>
devtool finish --force-patch-refresh <recipe> <layer_path>
Then the updated patches and the source tree (in devtool's workspace)
should be reviewed to make sure the patches apply in the correct place
and don't introduce duplicate lines (which can, and does happen
when some of the context is ignored). Further information:
http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.htmlhttps://bugzilla.yoctoproject.org/show_bug.cgi?id=10450
Details:
checking file configure.in
Hunk #1 succeeded at 698 with fuzz 2 (off
and others
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The /etc/snort/snort.conf doesn't work since
there are hardcoded paths and lib names, and
it tries to include many rules that are not
provided.
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
When start snort, it shows error and quit:
| --== Initializing Snort ==--
| Initializing Output Plugins!
| ERROR: Can't find pcap DAQ!
| Fatal Error, Quitting..
Fix by enable static daq for snort and enable static build for daq. snort calls
command daq-modules-config which is from daq-native to get required daq static
libraries and library path. Add package daq-native and add patch for snort to
filter library path out to avoid host contamination issue.
Add daq-native's dependency libnet-native too. And daq-native also depends on
libpcap-native from layer oe-core.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Add lzma to PACKAGECONFIG to remove below warning:
WARNING: snort-2.9.7.5-r0 do_package_qa: QA Issue:
snort rdepends on liblzma, but it isn't a build dependency,
missing xz in DEPENDS or PACKAGECONFIG? [build-deps]
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Fix paths in pkgconfig files and remove snort from blacklist.
Also add 'xz' to DEPENDS to avoid the following QA issue.
WARNING: snort-2.9.7.5-r0 do_package_qa: QA Issue: snort rdepends on liblzma, but it isn't a build dependency, missing xz in DEPENDS or PACKAGECONFIG? [build-deps]
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Upgrade snort from 2.9.6.0 to 2.9.7.5, as its dependency upgrade daq from
2.0.2 to 2.0.6, and accordingly update the patches:
* Add 2 new patches for snort to solve the cross compile issues
* Discard 2 snort patches since it is not needed
* Refresh the patch for daq new version
* Remove redundant '/' to getting round the rpm debugedit bug:
canonicalization unexpectedly shrank character
Signed-off-by: Zhiquan Li <zhiquan.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
There is an incorrect m4_define() in configure.in which will result in an
infinite recursion, and it doesn't make sense, since snort 2.9.7 it has been
commented out. We follow this solution to fix it.
Signed-off-by: Zhiquan Li <zhiquan.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
SECTION has been used inconsistently throughout the recipes in this layer.
Convert them to all use the same convention.
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* fixes floating dependency:
WARNING: QA Issue: snort rdepends on util-linux-libuuid but it isn't a build dependency? [build-deps]
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Yi Zhao
Khem Raj
Martin Jansa
Khawaja Shaheryar
Mingli Yu
wangmy
zangrc
zhengruoqin
zangrc
Armin Kuster
Jackie Huang
Kai Kang
Qi.Chen@windriver.com
Zhiquan Li
Joe MacDonald
Roy.Li