Snort

Recent Commits

• Priyanka Gurudev(23 Jul 26)

  build: generate and tag 3.12.4.0 (#5554)

• Vitalii Tron(22 Jul 26)

  flow: preserve selected policies on new flows (#5445)

• Michael Matirko(21 Jul 26)

  flow: improve handling of sticky whitelist verdict with tunnel traffic (#5496)

• Karthik Subramanya(21 Jul 26)

  dce_rpc: fix uid, tid, fid quadratic search for splayed list

• Oleksii Shumeiko(21 Jul 26)

  loggers: keep metadata in alert_syslog (#5503) * loggers: keep available metadata in alert_syslog Thanks to BharatDeva for addressing the issue. * loggers: rearrange formatting strings to avoid trailing spaces

• Viktor Chyzhovych(21 Jul 26)

  extractor: read ClientHello fields from HandshakeComplete event (#5420)

• Shijin Bose(21 Jul 26)

  sip: fix cppcheck constParameterPointer warning (#5531)

• Priyanka Gurudev(20 Jul 26)

  build: generate and tag 3.12.3.0 (#5533)

• Shijin Bose(17 Jul 26)

  sip: add fix to prevent unbounded memory exhaustion (#5467)

• Pranav Balakumar(17 Jul 26)

  dce_udp: bound connectionless tracker retention

• Davis McPherson(16 Jul 26)

  stream_tcp: flush segments to detection before hole-skip purge (#5343) * stream_tcp: flush segments to detection before hole-skip purge - skip_holes() called from kickstart_asymmetric_flow() purged pre-hole segments via purge_segments_left_of_hole() without flushing them through IPS detection; an attacker could plant payload before a crafted hole, trigger queue overflow, and evade inspection entirely - add flush_before_purge() helper: sets cur_rseg=head and calls the new flush_queued_sequenced() to force a direct flush_to_seq() of all contiguous data before any purge; segment cursors stay at 0 until actual flush so get_q_sequenced() returns the full unscanned byte count - add flush_queued_sequenced() to TcpReassemblerBase interface with IPS/IDS implementations and a no-op override in TcpReassemblerIgnore - change skip_holes() signature to accept Packet* and return bool; insert flush_before_purge() call before each purge_segments_left_of_hole() - update kickstart_asymmetric_flow() to pass tsd.get_pkt() to skip_holes() stream_tcp: loop flush_before_purge to inspect all pre-hole segments flush_before_purge() called flush_queued_sequenced() exactly once. Since get_q_sequenced() caps its walk at splitter->max() (default 16384 bytes), a contiguous pre-hole region larger than one PDU would have its tail silently discarded by purge_segments_left_of_hole() without IPS inspection, creating an evasion window. Fix: loop flush_queued_sequenced() until it returns 0 so every byte before the hole is inspected before purge. * stream_tcp: add trace_seq_relative option; default is absolute seq numbers - Add trace_seq_relative bool config option to stream_tcp; when true, state trace displays ISN-relative seq/ack values instead of absolute - TraceState() previously always computed UA, NS, RN, RW, BS as ISN-relative values; add an else branch that emits raw absolute values (snd_una, snd_nxt, rcv_nxt, r_win_base, seglist_base_seq) when stream_tcp_trace_seq_relative is false (the default) - ISS and IRS are reference points and remain absolute in both modes; relative mode preserves the zero-guard for uninitialized trackers - Widen all sequence and size fields (UA, NS, LW, RN, RW, ISS, IRS, SL, BS) to %-10u so columns align with 10-digit absolute seq numbers - Keep SC, FL, FP threshold at %-4u (small counts, no alignment needed) - Tighten ST=xxx-to-UA gap from 6 spaces to 1 to offset the wider fields stream_tcp: overhaul TCP trace event format - Replace flag format %s=0x%02x with binary flags display - Widen Seq/Ack fields from %-4u to %-6u for better alignment with TraceState - Add CP/SP/ST/SF fields to TraceEvent line (client port, server port, session state, session flags) - Remove TraceSession() function; session info now inline in TraceEvent - Simplify rseq/rack computation to single ternary expression

• Duane Palmer(16 Jul 26)

  perf_monitor: snapshot global stats cppcheck fix (#5505) CSCwv49042

• Brian Morris(15 Jul 26)

  perf_monitor: snapshot global stats for tracker reload (#5493) * perf_monitor: snapshot global stats for tracker reload

• Oleksandr Fedorych(15 Jul 26)

  http_inspect: move infractions into HttpFlowData on incomplete request (#5487)

• Brian Morris(14 Jul 26)

  main: avoid global log quiet changes during stats (#5490)

• Juweria Ali Imran(14 Jul 26)

  stream_tcp: add asymmetric specific sequence span normalization checks (#5463)

• Shijin Bose(14 Jul 26)

  dns: fix bound decoded name (#5466)

• Oleksii Shumeiko(14 Jul 26)

  js_norm: check whether normalization makes progress (#5486)

• Karthik Subramanya(14 Jul 26)

  dce_rpc: migrate rtracker to unoredered_map

• Karthik Subramanya(14 Jul 26)

  file_api: convert file segment to doubly linked list to optimize traversal and insertion

• Karthik Subramanya(14 Jul 26)

  dce_rpc: replace c-style cast with reinterpret_cast for cppcheck

• Savitha Ramappa(14 Jul 26)

  stream: Fix empty CBD trace entries in shell format mode

• Andrii Demianenko(13 Jul 26)

  appid: code cleanup & fixes

• Oleksii Shumeiko(13 Jul 26)

  extractor: refactor FTP number parsing (#5473)

• Oleg Buldumac(10 Jul 26)

  flow: set flow start time on HA flow import (#5369)

• Andres Avila Segura(09 Jul 26)

  appid: stop service inspection immediately if we exhausted all service candidates and the flow is out-of-order

• Karthik Subramanya(09 Jul 26)

  dce_smb:Fix List insertion and traversal based on the shortest distance from head/tail

• Savitha Ramappa(09 Jul 26)

  logger: add dynamic enable/disable commands for buffered logging with configurable stop_after_match

• Shilpa Nagpal(08 Jul 26)

  decompress: prevent off-by-one read and unsigned underflow

• Shilpa Nagpal(08 Jul 26)

  file_api: FileMPEvent serialization fix