summaryrefslogtreecommitdiff
path: root/net/snort
AgeCommit message (Collapse)AuthorFilesLines
2020-05-22revbump after updating security/nettleadam1-2/+2
2020-05-06revbump after boost updateadam1-2/+2
2020-04-25net/snort: clean up SUBST_FILESrillig1-2/+2
src/snort.c neither contains "/usr" nor "../".
2020-03-08*: recursive bump for libffiwiz1-1/+2
2020-02-18Update to Snort 2.9.15.1sevan5-27/+48
2019-12-15 - Snort 2.9.15.1 New Additions Added support for glibc version 2.30. Improvements/Fix Fixed Snort core seen during SSL re-configuration. Fixed file access issues on files from SMB share. Snort 2.9.15.0 New Additions Added new debugs to print detection, file_processing and Preproc time consumption info and verdict. Added support to detect new Korean file formats .egg and .alg in the file preprocessor. Added support to detect new RAR file-type in the file preprocessor. Improvements / Fix Fix to generate ALERT if TEID value is zero in GTP v1 and v2 packets. Fix to whitelist FTP data sessions when no file policy exists. Fix RTF file magic to a more generic value to prevent evasions. Added debug logs during HTTP reload. Added rule SID check during validation. Fix an issue where HTTP was processing non-HTTP traffic on port 443. Added new debugs to print detection, file processing, and Prepro time consumption info and verdicts. Snort 2.9.14.1 [*] New Additions * Added support for wild card port numbers in host cache and overwriting port service AppId. * Added support for new STLS client patterns to help better detect POP3S over SSL. * Added support for detecting Mac based SMTP Microsoft Outlook client application. * Added a new preprocessor alert 120:27 to alert if there is no proper end of header. [*] Improvements / Fix * Improved appId detection for proxied traffic. * Fix for enabling flow profiling mode without restarting snort detection engine. * Fixed packet drop scenario. Snort 2.9.13.0 New Additions Snort now supports reload on snort rules update. Addition of a scenario to add a packet to blacklist verdict to ensure the new session will be allowed. Handled a new pre-processor alert in case of the improper end of t HTTP header. Improvements Modified the calculation of file hash for FTP/HTTP with offset values. Fixed portal authentication connection stuck in half closed state. Updated UDP global timeout for a non-standard port. This release also patched the following two vulnerabilities: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-smb-snort Snort 2.9.12.0 New Additions Parsing HTTP CONNECT to extract the tunnel IP and port information. Alerting and dechunking for chunked encoding in HTTP1.0 request and response. Improvements Fixed an issue where, if we have a junk line before HTTP response header, the header was wrongly parsed. Fixed GZIP evasions where an HTTP response with content-encoding:gzip contains a body that has a GZIP-related anomaly. Fixed an issue in certain scenarios where a BitTorrent pattern is seen only on the third packet of the session, causing us to miss our client detection. SMB improvements for file detection and processing. 2017-12-06 - Snort 2.9.11.1 New Additions Added support to block portscan. In addition to tracking the scanning packets, action(drop/sdrop/reject) will be taken for all the packets, which means Snort will block the packet and generate logs. Added support to re-evaluate reputation after reputation update for all flows except those that have already been blacklisted. Improvements Fixed issue to detect RTP up to two SSRC switches in each traffic direction. Fixed issues related to HTTP POST header flushing, calling file processing directly if it is not a multipart header and changes to avoid expensive copy of segment data by not splitting them when flushing headers. Fixed issue of triggering protocol sweep alert when there are multiple destinations from single source ip protocol scan. Added changes to fix IP portscan for protocol other than ICMP and fixed issue of bad fragment size event not being generated for oversized packets. Added changes to use raw data in case of PDF and SWF files during file processing for SHA calculation and Malware Cloud Lookup. Fixed issue of correct session matching for TCP SYN packets without window scale option so that FTP data channels match the same rule as FTP control channels. Fixed issue of applying new configuration in file inspection after Snort reload. Snort 2.9.11 [*] New additions Changes to eliminate Snort restart when there are changes to the memory allocated for preprocessors, by releasing unused or least recently used memory when needed. Added support for storing filenames in Unicode for SMB protocol. Added implementation of hostPortCache versioning for unknown flows in AppID to detect and block BitTorrent. [*] Improvements Enhanced RTSP metadata parsing to match the user-agent field to detect RTSP traffic over Windows Media. Performance improvement when SYN rate limit has reached and drop is configured as next action Control-socket and side-channel support for FreeBSD platform. Fixed issue in file signature lookup for retransmitted FTP packet. Enhanced the processing of SIP/RTP future flows without ignoring them. Changes made in PDF/SWF decompression by adding boundary to the size of the decompressed data. Added a null check to prevent copy unless debugHostIp is configured in AppId. Fixed issue where FTP file type block doesn't work for retried download. Resolved issue where Snort is inappropriately handling traffic for which AppId was creating future flow. Performance improvements for SIP/RTP audio and video data flow in AppId. Performance and stability improvements in FTP preprocessor like incorrect referencing of ftp_data_session after its pruned. Stability improvement by resolving valgrind reported issues in AppId. Improved flushing mechanism for HTTP POST header. Added changes to display AppId for IPv6 unified events. Fixed issues with printing of messages for out-of-order packets. Fixed issue in increment of detection filter counter when rule is used in multiple configurations. Fixed dynamic preprocessor compilation failure in OpenBSD platform. Added changes to improve performance of ipvar list comparison. Enhanced SMTP client detection by allowing line folding and all authentication methods.
2019-07-20*: recursive bump for nettle 3.5.1wiz1-2/+2
2018-07-04*: Move SUBST_STAGE from post-patch to pre-configurejperkin1-2/+2
Performing substitutions during post-patch breaks tools such as mkpatches, making it very difficult to regenerate correct patches after making changes, and often leading to substituted string replacements being committed.
2018-04-17Add p11-kit to gnutls/bl3.mk and bump dependencies.wiz1-1/+2
2017-08-01Follow some http -> https redirects.wiz1-2/+2
2017-06-22this is a leftover from the previous version, thanks leot@ for noticing !nils1-19/+0
2017-06-16forgot to add black_list.rules and white_list.rulesnils2-0/+2
2017-06-15Upgraded to version 2.9.9.0.nils12-263/+142
This is a HUGE bump, so look at the changelog on the Snort website ! For example, Snort does not natively handle MySQL anymore. As for the pkgsrc changes : - updated deps (net/daq) ; - updated config files ; - updated MASTER_SITE ; - some substitution to handle pkgsrc paths ; - updated compile options.
2017-01-19Convert all occurrences (353 by my count) ofagc1-4/+4
MASTER_SITES= site1 \ site2 style continuation lines to be simple repeated MASTER_SITES+= site1 MASTER_SITES+= site2 lines. As previewed on tech-pkg. With thanks to rillig for fixing pkglint accordingly.
2016-10-09Recursive bump for all users of pgsql now that the default is 95.wiz1-2/+2
2016-09-19Recursive PKGREVISION bump for gnutls shlib major bump.wiz1-2/+2
2015-11-04Add SHA512 digests for distfiles for net categoryagc1-1/+2
Problems found with existing digests: Package haproxy distfile haproxy-1.5.14.tar.gz 159f5beb8fdc6b8059ae51b53dc935d91c0fb51f [recorded] da39a3ee5e6b4b0d3255bfef95601890afd80709 [calculated] Problems found locating distfiles: Package bsddip: missing distfile bsddip-1.02.tar.Z Package citrix_ica: missing distfile citrix_ica-10.6.115659/en.linuxx86.tar.gz Package djbdns: missing distfile djbdns-1.05-test25.diff.bz2 Package djbdns: missing distfile djbdns-cachestats.patch Package djbdns: missing distfile 0002-dnscache-cache-soa-records.patch Package gated: missing distfile gated-3-5-11.tar.gz Package owncloudclient: missing distfile owncloudclient-2.0.2.tar.xz Package poink: missing distfile poink-1.6.tar.gz Package ra-rtsp-proxy: missing distfile rtspd-src-1.0.0.0.tar.gz Package ucspi-ssl: missing distfile ucspi-ssl-0.70-ucspitls-0.1.patch Package waste: missing distfile waste-source.tar.gz Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-08-23Bump PKGREVISION for nettle shlib major bump.wiz1-2/+2
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-2/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-01-01Recursive PKGREVISION bump for libgcrypt-1.6.0 shlib major bump.wiz1-2/+2
2013-07-12Bump PKGREVISION of all packages which create users, to pick up change ofjperkin1-2/+2
sysutils/user_* packages.
2013-03-02Bump PKGREVISION for mysql default change to 55.wiz1-2/+2
2013-02-22Sun's ar needs at least one symbol in a library.jperkin2-1/+19
Fixes SunOS build.
2013-02-06PKGREVISION bumps for net/libpcap update.jperkin1-2/+2
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-09-12Instead of overwrite PKG_OPTIONS.snort with -inet6, drop inet6 fromobache2-7/+6
PKG_SUGGESTED_OPTIONS for SunOS. PR 46947.
2012-06-12Add inet6 to default suggested options. It's 2012.wiz1-2/+2
2012-03-03Recursive bump for pcre-8.30* (shlib major change)wiz1-2/+2
2011-10-07PR/29576 -- Use @RCD_SCRIPTS_SHELL@ in rc.d scripts, not /bin/shshattered1-2/+2
2011-04-22recursive bump from gettext-lib shlib bump.obache1-1/+2
2011-04-01Update to 2.8.5.1, to resolve a security issue.gdt6-47/+46
Upstream NEWS is weak; release notes for 2.8.5.1 follow. [*] Improvements * Fixed syslog output when running on Windows. * Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue. * Fixed segfault when additional policies were added during a configuration reload.
2009-12-09Add user-destdir support.obache1-13/+13
2009-07-17Give up MAINTAINERadrianp1-2/+2
2009-06-14Convert @exec/@unexec to @pkgdir or drop it.joerg1-2/+1
2009-06-14Remove @dirrm entries from PLISTsjoerg1-10/+1
2008-10-25Update to 2.8.3.1adrianp2-7/+8
* Update rule latency thresholding * The flow and stream4 preprocessors will be deprecated in a future release. * DCE/RPC preprocessor changes to handle abnormal TCP segmentation. Added option to reassemble fragmentation buffers early. Updated documentation. * Fixed handling of MPLS label in checking Stream session uniqueness when IPv4 packets are received and build is IPv6. See the ChangeLog for all the details
2008-08-03Set MAKE_JOBS_SAFE=NOadrianp3-7/+15
Fix non-priv'ed builds which should fix PR 39260 2008-07-24 - Snort 2.8.2.2 [*] Improvements * Fix issue with evaluating PCRE rule options with /U modifier that are followed by a relative content rule option. * Fix issue with dsize range check. 2008-06-12 - Snort 2.8.2.1 [*] Improvements * Fix support for pass rules that sometimes did not take precedence over alert and/or drop rules.
2008-06-21Use stdbool.h instead of defining bool manually.joerg3-1/+35
Fixes issues e.g. on NetBSD where bool is defined by system headers.
2008-06-11Add 'old' MASTER_SITE just in case we're running a little behind in versionsadrianp1-2/+3
2008-05-25Update to 2.8.1adrianp3-8/+13
Includes fix for CVE-2008-1804 [*] New Additions * Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. * Support for GRE encapsulation for both IPv4 & IPv6. * Support for IP over IP tunneling for both IPv4 & IPv6. * SSL preprocessor to allow ability to not inspect encrypted traffic. * Ability to read mulitple PCAPs from the command line. * Support for new CVS rule detection options. [*] Improvements * Update to HTTP Inspect to identify overly long HTTP header fields. * Updates to IPv6 support, including changes to avoid namespace conflicts for certain Operating systems. * Updates to address issues seen on various Sparc platforms. * Stricter enforcement of shared object versions to avoid API conflicts.
2008-01-06Update to 2.8.0.1adrianp3-7/+11
[*] Improvements * Updates to build with new versions of libPCRE. * Fix Stream5 debugging output to actually compile and have correct output for normal & IPv6 enabled builds. * Correct perfmonitor statistic calculation for pattern matcher percentage.
2007-12-19Remove an obsolete configuration file which already deleted from PLIST.taca1-3/+1
This change should fix a problem with CHECK_FILES=yes.
2007-11-11snort ipv6 support does not work on SunOSadrianp1-1/+6
2007-10-31Snort 2.8.x supports IPv6adrianp1-2/+9
2007-10-21Update to 2.8.0adrianp6-27/+118
* Port lists * IPv6 support * Packet performance monitoring * Experimental support for target-based stream and IP frag reassembly * Ability to take actions on preprocessor events * Detection for TCP session hijacking based on MAC address * Unified2 output plugin * Improved performance and detection capabilities
2007-09-09Remove libpreludedb dependency for snort-prelude builds. Apparently it'sadrianp1-2/+1
not required. From John R. Shannon.
2007-08-20Update to 2.7.0.1adrianp3-17/+18
Fixed header files to avoid conflicts with system files on BSD for IPv6 data structures. Added code to prevent URI-related alerts from firing when the body is being normalized. Make Stream5 the default stream engine. Add alert for multiple GRE encapsulations. Added ability for Snort to track fragmented ICMPv6 to check for the remote BSD exploit (Bugtraq ID 22901, CVE-2007-1365). Code cleanup, change malloc/calloc to SnortAlloc, use safer functions SnortSnprintf, SnortStrncpy, etc. Check pointers before use. Additional updates for bounds checking. And many more . . . check the ChangeLog for all the details
2007-07-04Make it easier to build and install packages "unprivileged", wherejlam1-1/+3
the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
2007-05-18Update to 2.6.1.5adrianp4-22/+22
Snort v2.6.1.5 includes: * A new http_post rule keyword used to search for content in normalized HTTP posts * A fix for a potential memory leak when generating HTTP Inspection events Snort v2.6.1.4 includes detection functionality for a BSD IPv6 fragmentation overflow, and addresses a number of potential security-related issues in Snort as reported by customers, uncovered by internal investigations, and through third-party code audits.
2007-03-23Fix typos in options.mkadrianp1-8/+23
Fix snort-flexresp{2} so that they actually can be tested and work properly with the new libnet{10,11} laoyout Pointed out by wiz@ in private email
2007-02-20Kill an useless, unportable check.joerg2-1/+16
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-15 08:12:01 +0000