Re: [PATCH] suricata: Update to 6.0.0.

Good morning Stefan,

Great to see that you are working on upgrading Suricata to a new major version. The changes look quite exciting.

Since you posted a patch for suricata 5.0.4, I will assume that this is what was supposed to be merged into the next core update and suricata 6 is for some time after that.

There are some additional tickets open which I think we should tackle all with suricata 6 and then drop another improved IPS for our users.

https://bugzilla.ipfire.org/showdependencytree.cgi?id=12052&hide_resolve...

Do you plan working on those, too?

Have there been any testers for suricata 6.0.0, yet?

Best, -Michael

On 21 Oct 2020, at 19:20, Stefan Schantl stefan.schantl@ipfire.org wrote:

• Enable RDP and SIP parsers.
• Enable new introduced parsers for RFB and DCERPC.

Because HTTP2 support and parser currently is experimental the suricata developers decided to disable it at default - we keep this default setting for now.

Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org

config/rootfiles/common/suricata | 1 + config/suricata/suricata.yaml | 24 ++++++++++++++++++++++-- lfs/suricata | 4 ++-- 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suricata index 41b02525d..f891fa449 100644 --- a/config/rootfiles/common/suricata +++ b/config/rootfiles/common/suricata @@ -3,6 +3,7 @@ etc/suricata/suricata.yaml #root/.cargo #root/.cargo/.package-cache usr/bin/suricata +#usr/include/suricata-plugin.h #usr/share/doc/suricata #usr/share/doc/suricata/AUTHORS #usr/share/doc/suricata/Basic_Setup.txt diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 43f10c89d..743a4716c 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -271,14 +271,16 @@ outputs:

    #- dnp3
    - ftp

•    #- rdp
  

•    - rdp
    - nfs
    - smb
    - tftp
    - ikev2
  

•    - dcerpc
    - krb5
    - snmp
  

•    #- sip
  

•    - rfb
  

•    - sip
    - dhcp:
        enabled: yes
        # When extended mode is on, all DHCP messages are logged
  

@@ -287,6 +289,12 @@ outputs: # to an IP address is logged. extended: no - ssh

•    - mqtt:
  

•        # passwords: yes           # enable output of passwords
  

•    # HTTP2 logging. HTTP2 support is currently experimental and
  

•    # disabled by default. To enable, uncomment the following line
  

•    # and be sure to enable http2 in the app-layer section.
  

•    #- http2
    - stats:
        totals: yes       # stats for all threads merged together
        threads: no       # per thread stats
  

@@ -358,6 +366,14 @@ nfq: # "detection-only" enables protocol detection only (parser disabled). app-layer: protocols:

• rfb:

•  enabled: yes
  

•  detection-ports:
  

•    dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
  

• # MQTT, disabled by default.
• mqtt:

•  # enabled: no
  

•  # max-msg-length: 1mb
  

  krb5: enabled: yes snmp:

@@ -388,6 +404,10 @@ app-layer: enabled: yes ssh: enabled: yes

•  #hassh: yes
  

• # HTTP2: Experimental HTTP 2 support. Disabled by default.
• http2:

•  enabled: no
  

  smtp: enabled: yes # Configure SMTP-MIME Decoder

diff --git a/lfs/suricata b/lfs/suricata index f981232a2..e89bf1e63 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@

include Config

-VER = 5.0.4 +VER = 6.0.0

THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_MD5 = c08809d5641a790a95a56d4dc7eba2f2 +$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2

install : $(TARGET)

-- 2.20.1