From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] suricata: Update to 6.0.0.
Date: Wed, 21 Oct 2020 20:20:10 +0200
Message-ID: <20201021182010.3072-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2782973711171754234=="
List-Id: <development.lists.ipfire.org>

--===============2782973711171754234==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

* Enable RDP and SIP parsers.
* Enable new introduced parsers for RFB and DCERPC.

Because HTTP2 support and parser currently is experimental the suricata
developers decided to disable it at default - we keep this default
setting for now.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 config/rootfiles/common/suricata |  1 +
 config/suricata/suricata.yaml    | 24 ++++++++++++++++++++++--
 lfs/suricata                     |  4 ++--
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suric=
ata
index 41b02525d..f891fa449 100644
--- a/config/rootfiles/common/suricata
+++ b/config/rootfiles/common/suricata
@@ -3,6 +3,7 @@ etc/suricata/suricata.yaml
 #root/.cargo
 #root/.cargo/.package-cache
 usr/bin/suricata
+#usr/include/suricata-plugin.h
 #usr/share/doc/suricata
 #usr/share/doc/suricata/AUTHORS
 #usr/share/doc/suricata/Basic_Setup.txt
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index 43f10c89d..743a4716c 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -271,14 +271,16 @@ outputs:
=20
         #- dnp3
         - ftp
-        #- rdp
+        - rdp
         - nfs
         - smb
         - tftp
         - ikev2
+        - dcerpc
         - krb5
         - snmp
-        #- sip
+        - rfb
+        - sip
         - dhcp:
             enabled: yes
             # When extended mode is on, all DHCP messages are logged
@@ -287,6 +289,12 @@ outputs:
             # to an IP address is logged.
             extended: no
         - ssh
+        - mqtt:
+            # passwords: yes           # enable output of passwords
+        # HTTP2 logging. HTTP2 support is currently experimental and
+        # disabled by default. To enable, uncomment the following line
+        # and be sure to enable http2 in the app-layer section.
+        #- http2
         - stats:
             totals: yes       # stats for all threads merged together
             threads: no       # per thread stats
@@ -358,6 +366,14 @@ nfq:
 # "detection-only" enables protocol detection only (parser disabled).
 app-layer:
   protocols:
+    rfb:
+      enabled: yes
+      detection-ports:
+        dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
+    # MQTT, disabled by default.
+    mqtt:
+      # enabled: no
+      # max-msg-length: 1mb
     krb5:
       enabled: yes
     snmp:
@@ -388,6 +404,10 @@ app-layer:
       enabled: yes
     ssh:
       enabled: yes
+      #hassh: yes
+    # HTTP2: Experimental HTTP 2 support. Disabled by default.
+    http2:
+      enabled: no
     smtp:
       enabled: yes
       # Configure SMTP-MIME Decoder
diff --git a/lfs/suricata b/lfs/suricata
index f981232a2..e89bf1e63 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -24,7 +24,7 @@
=20
 include Config
=20
-VER        =3D 5.0.4
+VER        =3D 6.0.0
=20
 THISAPP    =3D suricata-$(VER)
 DL_FILE    =3D $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects =3D $(DL_FILE)
=20
 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
=20
-$(DL_FILE)_MD5 =3D c08809d5641a790a95a56d4dc7eba2f2
+$(DL_FILE)_MD5 =3D bbddcf2f209930206ef21977d40120d2
=20
 install : $(TARGET)
=20
--=20
2.20.1


--===============2782973711171754234==--