From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] suricata: Update to 6.0.0.
Date: Fri, 23 Oct 2020 10:54:26 +0100
Message-ID: <1D9ACC64-2FFF-4C7C-AC68-A54ACAC2F75F@ipfire.org>
In-Reply-To: <20201021182010.3072-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2106767799033191563=="
List-Id: <development.lists.ipfire.org>

--===============2106767799033191563==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Good morning Stefan,

Great to see that you are working on upgrading Suricata to a new major versio=
n. The changes look quite exciting.

Since you posted a patch for suricata 5.0.4, I will assume that this is what =
was supposed to be merged into the next core update and suricata 6 is for som=
e time after that.

There are some additional tickets open which I think we should tackle all wit=
h suricata 6 and then drop another improved IPS for our users.

  https://bugzilla.ipfire.org/showdependencytree.cgi?id=3D12052&hide_resolved=
=3D1

Do you plan working on those, too?

Have there been any testers for suricata 6.0.0, yet?

Best,
-Michael

> On 21 Oct 2020, at 19:20, Stefan Schantl <stefan.schantl(a)ipfire.org> wrot=
e:
>=20
> * Enable RDP and SIP parsers.
> * Enable new introduced parsers for RFB and DCERPC.
>=20
> Because HTTP2 support and parser currently is experimental the suricata
> developers decided to disable it at default - we keep this default
> setting for now.
>=20
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> config/rootfiles/common/suricata |  1 +
> config/suricata/suricata.yaml    | 24 ++++++++++++++++++++++--
> lfs/suricata                     |  4 ++--
> 3 files changed, 25 insertions(+), 4 deletions(-)
>=20
> diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/sur=
icata
> index 41b02525d..f891fa449 100644
> --- a/config/rootfiles/common/suricata
> +++ b/config/rootfiles/common/suricata
> @@ -3,6 +3,7 @@ etc/suricata/suricata.yaml
> #root/.cargo
> #root/.cargo/.package-cache
> usr/bin/suricata
> +#usr/include/suricata-plugin.h
> #usr/share/doc/suricata
> #usr/share/doc/suricata/AUTHORS
> #usr/share/doc/suricata/Basic_Setup.txt
> diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
> index 43f10c89d..743a4716c 100644
> --- a/config/suricata/suricata.yaml
> +++ b/config/suricata/suricata.yaml
> @@ -271,14 +271,16 @@ outputs:
>=20
>         #- dnp3
>         - ftp
> -        #- rdp
> +        - rdp
>         - nfs
>         - smb
>         - tftp
>         - ikev2
> +        - dcerpc
>         - krb5
>         - snmp
> -        #- sip
> +        - rfb
> +        - sip
>         - dhcp:
>             enabled: yes
>             # When extended mode is on, all DHCP messages are logged
> @@ -287,6 +289,12 @@ outputs:
>             # to an IP address is logged.
>             extended: no
>         - ssh
> +        - mqtt:
> +            # passwords: yes           # enable output of passwords
> +        # HTTP2 logging. HTTP2 support is currently experimental and
> +        # disabled by default. To enable, uncomment the following line
> +        # and be sure to enable http2 in the app-layer section.
> +        #- http2
>         - stats:
>             totals: yes       # stats for all threads merged together
>             threads: no       # per thread stats
> @@ -358,6 +366,14 @@ nfq:
> # "detection-only" enables protocol detection only (parser disabled).
> app-layer:
>   protocols:
> +    rfb:
> +      enabled: yes
> +      detection-ports:
> +        dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
> +    # MQTT, disabled by default.
> +    mqtt:
> +      # enabled: no
> +      # max-msg-length: 1mb
>     krb5:
>       enabled: yes
>     snmp:
> @@ -388,6 +404,10 @@ app-layer:
>       enabled: yes
>     ssh:
>       enabled: yes
> +      #hassh: yes
> +    # HTTP2: Experimental HTTP 2 support. Disabled by default.
> +    http2:
> +      enabled: no
>     smtp:
>       enabled: yes
>       # Configure SMTP-MIME Decoder
> diff --git a/lfs/suricata b/lfs/suricata
> index f981232a2..e89bf1e63 100644
> --- a/lfs/suricata
> +++ b/lfs/suricata
> @@ -24,7 +24,7 @@
>=20
> include Config
>=20
> -VER        =3D 5.0.4
> +VER        =3D 6.0.0
>=20
> THISAPP    =3D suricata-$(VER)
> DL_FILE    =3D $(THISAPP).tar.gz
> @@ -40,7 +40,7 @@ objects =3D $(DL_FILE)
>=20
> $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
>=20
> -$(DL_FILE)_MD5 =3D c08809d5641a790a95a56d4dc7eba2f2
> +$(DL_FILE)_MD5 =3D bbddcf2f209930206ef21977d40120d2
>=20
> install : $(TARGET)
>=20
> --=20
> 2.20.1
>=20


--===============2106767799033191563==--