* [PATCH] suricata: Update to 6.0.0.
@ 2020-10-21 18:20 Stefan Schantl
2020-10-23 9:54 ` Michael Tremer
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Schantl @ 2020-10-21 18:20 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3282 bytes --]
* Enable RDP and SIP parsers.
* Enable new introduced parsers for RFB and DCERPC.
Because HTTP2 support and parser currently is experimental the suricata
developers decided to disable it at default - we keep this default
setting for now.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
config/rootfiles/common/suricata | 1 +
config/suricata/suricata.yaml | 24 ++++++++++++++++++++++--
lfs/suricata | 4 ++--
3 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suricata
index 41b02525d..f891fa449 100644
--- a/config/rootfiles/common/suricata
+++ b/config/rootfiles/common/suricata
@@ -3,6 +3,7 @@ etc/suricata/suricata.yaml
#root/.cargo
#root/.cargo/.package-cache
usr/bin/suricata
+#usr/include/suricata-plugin.h
#usr/share/doc/suricata
#usr/share/doc/suricata/AUTHORS
#usr/share/doc/suricata/Basic_Setup.txt
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index 43f10c89d..743a4716c 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -271,14 +271,16 @@ outputs:
#- dnp3
- ftp
- #- rdp
+ - rdp
- nfs
- smb
- tftp
- ikev2
+ - dcerpc
- krb5
- snmp
- #- sip
+ - rfb
+ - sip
- dhcp:
enabled: yes
# When extended mode is on, all DHCP messages are logged
@@ -287,6 +289,12 @@ outputs:
# to an IP address is logged.
extended: no
- ssh
+ - mqtt:
+ # passwords: yes # enable output of passwords
+ # HTTP2 logging. HTTP2 support is currently experimental and
+ # disabled by default. To enable, uncomment the following line
+ # and be sure to enable http2 in the app-layer section.
+ #- http2
- stats:
totals: yes # stats for all threads merged together
threads: no # per thread stats
@@ -358,6 +366,14 @@ nfq:
# "detection-only" enables protocol detection only (parser disabled).
app-layer:
protocols:
+ rfb:
+ enabled: yes
+ detection-ports:
+ dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
+ # MQTT, disabled by default.
+ mqtt:
+ # enabled: no
+ # max-msg-length: 1mb
krb5:
enabled: yes
snmp:
@@ -388,6 +404,10 @@ app-layer:
enabled: yes
ssh:
enabled: yes
+ #hassh: yes
+ # HTTP2: Experimental HTTP 2 support. Disabled by default.
+ http2:
+ enabled: no
smtp:
enabled: yes
# Configure SMTP-MIME Decoder
diff --git a/lfs/suricata b/lfs/suricata
index f981232a2..e89bf1e63 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -24,7 +24,7 @@
include Config
-VER = 5.0.4
+VER = 6.0.0
THISAPP = suricata-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_MD5 = c08809d5641a790a95a56d4dc7eba2f2
+$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2
install : $(TARGET)
--
2.20.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] suricata: Update to 6.0.0.
2020-10-21 18:20 [PATCH] suricata: Update to 6.0.0 Stefan Schantl
@ 2020-10-23 9:54 ` Michael Tremer
0 siblings, 0 replies; 2+ messages in thread
From: Michael Tremer @ 2020-10-23 9:54 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 4196 bytes --]
Good morning Stefan,
Great to see that you are working on upgrading Suricata to a new major version. The changes look quite exciting.
Since you posted a patch for suricata 5.0.4, I will assume that this is what was supposed to be merged into the next core update and suricata 6 is for some time after that.
There are some additional tickets open which I think we should tackle all with suricata 6 and then drop another improved IPS for our users.
https://bugzilla.ipfire.org/showdependencytree.cgi?id=12052&hide_resolved=1
Do you plan working on those, too?
Have there been any testers for suricata 6.0.0, yet?
Best,
-Michael
> On 21 Oct 2020, at 19:20, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
>
> * Enable RDP and SIP parsers.
> * Enable new introduced parsers for RFB and DCERPC.
>
> Because HTTP2 support and parser currently is experimental the suricata
> developers decided to disable it at default - we keep this default
> setting for now.
>
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> config/rootfiles/common/suricata | 1 +
> config/suricata/suricata.yaml | 24 ++++++++++++++++++++++--
> lfs/suricata | 4 ++--
> 3 files changed, 25 insertions(+), 4 deletions(-)
>
> diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suricata
> index 41b02525d..f891fa449 100644
> --- a/config/rootfiles/common/suricata
> +++ b/config/rootfiles/common/suricata
> @@ -3,6 +3,7 @@ etc/suricata/suricata.yaml
> #root/.cargo
> #root/.cargo/.package-cache
> usr/bin/suricata
> +#usr/include/suricata-plugin.h
> #usr/share/doc/suricata
> #usr/share/doc/suricata/AUTHORS
> #usr/share/doc/suricata/Basic_Setup.txt
> diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
> index 43f10c89d..743a4716c 100644
> --- a/config/suricata/suricata.yaml
> +++ b/config/suricata/suricata.yaml
> @@ -271,14 +271,16 @@ outputs:
>
> #- dnp3
> - ftp
> - #- rdp
> + - rdp
> - nfs
> - smb
> - tftp
> - ikev2
> + - dcerpc
> - krb5
> - snmp
> - #- sip
> + - rfb
> + - sip
> - dhcp:
> enabled: yes
> # When extended mode is on, all DHCP messages are logged
> @@ -287,6 +289,12 @@ outputs:
> # to an IP address is logged.
> extended: no
> - ssh
> + - mqtt:
> + # passwords: yes # enable output of passwords
> + # HTTP2 logging. HTTP2 support is currently experimental and
> + # disabled by default. To enable, uncomment the following line
> + # and be sure to enable http2 in the app-layer section.
> + #- http2
> - stats:
> totals: yes # stats for all threads merged together
> threads: no # per thread stats
> @@ -358,6 +366,14 @@ nfq:
> # "detection-only" enables protocol detection only (parser disabled).
> app-layer:
> protocols:
> + rfb:
> + enabled: yes
> + detection-ports:
> + dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
> + # MQTT, disabled by default.
> + mqtt:
> + # enabled: no
> + # max-msg-length: 1mb
> krb5:
> enabled: yes
> snmp:
> @@ -388,6 +404,10 @@ app-layer:
> enabled: yes
> ssh:
> enabled: yes
> + #hassh: yes
> + # HTTP2: Experimental HTTP 2 support. Disabled by default.
> + http2:
> + enabled: no
> smtp:
> enabled: yes
> # Configure SMTP-MIME Decoder
> diff --git a/lfs/suricata b/lfs/suricata
> index f981232a2..e89bf1e63 100644
> --- a/lfs/suricata
> +++ b/lfs/suricata
> @@ -24,7 +24,7 @@
>
> include Config
>
> -VER = 5.0.4
> +VER = 6.0.0
>
> THISAPP = suricata-$(VER)
> DL_FILE = $(THISAPP).tar.gz
> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
>
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>
> -$(DL_FILE)_MD5 = c08809d5641a790a95a56d4dc7eba2f2
> +$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2
>
> install : $(TARGET)
>
> --
> 2.20.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-10-23 9:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-21 18:20 [PATCH] suricata: Update to 6.0.0 Stefan Schantl
2020-10-23 9:54 ` Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox