forked from shrtsn/snort
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
19092 lines (16881 loc) · 786 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2015-22-04 Joel Cornett <jocornet@cisco.com>
Snort 2.9.7.3
* src/build.h:
updating build number to 217
* src/: decode.h, detection-plugins/sp_clientserver.c,
dynamic-plugins/sf_engine/sf_snort_packet.h,
dynamic-plugins/sf_engine/sf_snort_plugin_api.c,
dynamic-preprocessors/dcerpc2/dce2_session.h,
dynamic-preprocessors/sdf/spp_sdf.c,
preprocessors/HttpInspect/server/hi_server.c,
preprocessors/Stream6/snort_stream_tcp.c,
preprocessors/snort_httpinspect.c, preprocessors/spp_normalize.c:
Added mode safety checks to normalization.
Fixed an issue in PAF where the start of the PDU after flushing was not
being set correctly in some case.
Improved Stream reassembly of HTTPS sessions
* src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c:
Stability improvements for ftp_telnet preprocessor
* doc/snort_manual.pdf, doc/snort_manual.tex,
src/detection-plugins/sp_base64_decode.c,
src/detection-plugins/sp_base64_decode.h,
src/detection-plugins/sp_file_data.c:
Improved performance for file preprocessor
Documentation changes
* src/dynamic-preprocessors/appid/: service_plugins/service_base.c,
service_state.c:
Various OpenAppId improvements
* configure.in:
Fixed issue with configure script handling of -Werror compiler flags
* src/decode.c:
Improved decoding of IPv6 extensions
* src/detection-plugins/detection_options.c:
Fixed an issue where the protected_content rule option was not
backtracking correctly in some cases
* src/snort.c:
Fixed snort handling of PID files
* tools/: u2openappid/u2openappid.c, u2spewfoo/u2spewfoo.c:
Fixed usage info.
* src/dynamic-preprocessors/sip/: Makefile.am, sf_sip.dsp, sip_dialog.c,
sip_parser.c, spp_sip.c:
Added PAF support for TCP traffic
* src/: log_text.c, log_text.h, output-plugins/spo_alert_fast.c,
output-plugins/spo_alert_full.c:
Extended support for OpenAppId logging to cmg and console output loggers
* src/dynamic-preprocessors/appid/service_plugins/service_ssl.c:
Improved SSLv3 handling for OpenAppId
2014-24-12 Victor Roemer <viroemer@cisco.com>
Snort 2.9.7.2
* src/build.h:
updating build number to 177
* src/preprocessors/Stream6/snort_stream_tcp.c:
Resolved an issue where the inline normalization preprocessor
incorrectly resized packets when 'preprocessor normalize_tcp: trim'
was enabled.
* src/decode.c, src/encode.c:
Added support for Cisco FabricPath decoding/encoding.
Ensure flow_id is copied into the DAQ_PktHdr_t.
* src/snort.h, src/sfutil/sfrt.c, src/sfutil/sfrt.h
src/target-based/sftarget_reader.c:
Moved ntohl conversion inside of the sfrt api for both IPv4 and IPv6.
* src/target-based/sftarget_protocol_reference.c
Lookup application protocol id only after the session is established.
Assign application protocol id to the session when using host attribute table.
* src/util.c:
Changes for suppressing configuration logging.
* src/file-process/file_service.c:
Assign the file config to a file context prior to checking if HTTP continuation.
2014-10-10 Carter Waxman <cwaxman@cisco.com>
Snort 2.9.7.0
* src/build.h: updating build number to 149
* src/dynamic-preprocessors/appid/spp_appid.c:
Fixed issue in which AppID would be disabled after a reload.
* configure.in:
Added dependency for OpenSSL when building with --enable-openappid
* doc/: README.http_inspect, snort_manual.pdf, snort_manual.tex:
Added documentation for the new Extended X-Forwarded-For
capabilities
* src/preprocessors/Stream6/snort_stream_tcp.c:
Reused the TcpSessionCleanup logic to add a function to flush queued unacked segments.
2014-09-15 Joel Cornett <jocornet@cisco.com>
Snort 2.9.7.0-rc
* src/build.h:
updating build number to 147
* configure.in,
src/sfdaq.c:
Fixed C99 compliance issue with DAQ.
* src/preprocessors/:
Stream6/snort_stream_tcp.c,
spp_session.c:
Improved stability of TCP session decoding.
* tools/u2streamer/u2streamer.c:
Improved stability of u2streamer tool.
* src/snort.c:
Fixed issue with daemonization mode. Thanks to Eugenio Perez
for noting the issue and proposing a fix.
* src/:
dynamic-plugins/sf_dynamic_plugins.c,
dynamic-plugins/sf_dynamic_preprocessor.h,
preprocessor/Stream6/snort_stream_tcp.c,
encode.c, encode.h, snort.c, snort.h:
Added support to detect heartbleed attacks.
* build/dobuild.sh,
rpm/README.build_rpms, rpm/generate-all-rpms, rpm/snort.spec,
src/dynamic-preprocessors/appid/Makefile.am:
Added OpenAppID to snort RPM.
* doc/: README.active, README.file_ips, INSTALL, snort_manual.tex:
Updated documentation.
* doc/INSTALL:
Added common configuration mistakes and fixes to INSTALL.
Thanks to Bill Parker for the documentation.
* src/dynamic-preprocessors/ftptelnet/pp_ftp.c:
Improved FTP traffic handling.
* src/dynamic-preprocessors/appid/detector_plugins:
detector_http.c, detector_imap.c, detector_pop3.c:
Improved stability of OpenAppID preprocessor parsing HTTP
headers.
* src/:
parser.c, snort.c, snort.h, util.c:
Added a new option `--suppress-config-log` to Snort command
line arguments. This option suppresses logging of
configuration information to output.
* src/:
active.c, active.h,
preprocessors/Stream6/snort_stream_ip.c,
preprocessors/Stream6/snort_stream_tcp.c,
preprocessors/Stream6/snort_stream_udp.c:
Fixed issue with blacklisting of flow traffic.
* src/preprocessors:
spp_session.c, spp_stream6.c:
Improved stability of Stream6 preprocessor.
* configure.in,
src/dynamic-preprocessors/ftptelnet/ftpp_si.c,
src/dynamic-preprocessors/ftptelnet/ftpp_si.h,
src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
src/dynamic-preprocessors/imap/snort_imap.c,
src/dynamic-preprocessors/imap/snort_imap.h,
src/dynamic-preprocessors/pop/snort_pop.c,
src/dynamic-preprocessors/pop/snort_pop.h,
src/dynamic-preprocessors/smtp/snort_smtp.c,
src/dynamic-preprocessors/smtp/snort_smtp.h,
src/dynamic-preprocessors/ssl_common/ssl_include.h,
src/dynamic-preprocessors/ssl_common/ssl_inspect.c,
src/dynamic-preprocessors/ssl_common/ssl_session.h,
src/encode.c:
Fixed encoding issue with DAQ packet headers.
* doc/README.ssl,
doc/snort_manual.pdf,
doc/snort_manual.tex,
etc/gen-msg.map,
preproc_rules/preprocessor.rules,
src/dynamic-preprocessors/ssl_common/ssl.c,
src/dynamic-preprocessors/ssl_common/ssl.h,
src/dynamic-preprocessors/ssl_common/ssl_config.c,
src/dynamic-preprocessors/ssl_common/ssl_config.h,
src/dynamic-preprocessors/ssl_common/ssl_inspect.c,
src/dynamic-preprocessors/ssl_common/ssl_inspect.h,
src/dynamic-preprocessors/ssl_common/ssl_session.h:
Added support to detect heartbleed attacks.
* doc/snort_manual.tex,
src/dynamic-examples/dynamic-rule/detection_lib_meta.h,
src/dynamic-plugins/sf_dynamic_engine.h,
src/dynamic-plugins/sf_dynamic_meta.h,
src/dynamic-plugins/sf_dynamic_preprocessor.h,
src/dynamic-plugins/sf_engine/examples/detection_lib_meta.h,
src/dynamic-plugins/sf_engine/sf_snort_packet.h,
src/preprocessors/Stream6/snort_stream_tcp.c,
src/decode.c, src/decode.h, src/encode.c, src/parser.c,
src/parser.h, src/snort.c, src/snort.h:
Added a new config option `max_ip6_extensions` to change the
maximum number of IPv6 extension headers decoded. Thanks to
Antonio Atlasis for providing data to the ChangeLog.
* src/dynamic-preprocessors/modbus/:
modbus_paf.h, modbus_roptions.c, spp_modbus.c:
Improved traffic handling by modbus preprocessor
* src/:
dynamic-preprocessors/dns/spp_dns.c,
dynamic-preprocessors/imap/spp_imap.c,
dynamic-preprocessors/pop/spp_pop.c,
dynamic-preprocessors/smtp/spp_smtp.c,
dynamic-preprocessors/ssh/spp_ssh.c,
preprocessors/spp_session.c:
Fixed issue with stream configuration state changing across
reloads. Thanks to Eugenio Perez for noting the issue.
* src/dynamic-preprocessors/appid/Makefile.am:
Fixed compilation issue with OpenAppID on OpenBSD.
* src/plugbase.c:
Improved implementation of plugin API.
* src:
detection-plugins/sp_ftpbounce.c,
dynamic-preprocessors/ftptelnet/snort_ftptelnet.c:
Improved stability of FTP preprocessor.
* configure.in,
src/dynamic-preprocessors/appid/appIdConfig.c,
src/dynamic-preprocessors/appid/appIdConfig.h,
src/dynamic-preprocessors/appid/flow.h,
src/dynamic-preprocessors/appid/fw_appid.c,
src/dynamic-preprocessors/appid/fw_appid.h,
src/dynamic-preprocessors/appid/luaDetectorApi.h:
Fixed compilation issues with OpenAppID on Mac OS X.
* src/preprocessors/:
perf-flow.c, spp_perfmonitor.c:
Minimum flow-ip-memcap changed to 8200.
* src/sf_sdlist.c:
Fixed implementation of `sf_sdlist`. Thanks to Yang Zhang
for noting the issue.
* src/:
preprocessors/Stream6/snort_stream_tcp.c,
preprocessors/spp_frag3.c,
preprocessors/spp_normalize.c:
active.h, decode.c,
Check checksum configuration as well as na_policy_mode
setting before drop.
* src/preprocessors/snort_httpinspect.c:
Improved handling in HTTPInspect preprocessor.
* src/sfutil/mpse.c:
Fixed building snort with --disable-perfprofiling. Thanks to
Yonatan Ben-David for noting the issue.
* src:
encode.c, encode.h:
Fixed ICMPv6 encoding issue.
* etc/snort.conf,
src/detection-plugins/sp_file_type.c,
src/dynamic-preprocessors/Makefile.am,
src/dynamic-preprocessors/ftptelnet/Makefile.am,
src/dynamic-preprocessors/imap/Makefile.am,
src/dynamic-preprocessors/pop/Makefile.am,
src/dynamic-preprocessors/sf_dynamic_initialize/sf_dynamic_initialize.dsp,
src/dynamic-preprocessors/smtp/Makefile.am,
src/dynamic-preprocessors/ssl/Makefile.am,
src/preprocessors/Session/Makefile.am,
src/win32/WIN32-Prj/sf_engine.dsp,
src/win32/WIN32-Prj/snort.dsp,
src/win32/WIN32-Prj/snort.dsw,
src/win32/WIN32-Prj/snort_installer.nsi:
Fixed Win32 and distcheck build issues.
* doc/OpenDetectorDeveloperGuide.docx,
doc/OpenDetectorDeveloperGuide.pdf,
src/dynamic-preprocessors/appid/Makefile.am,
src/dynamic-preprocessors/appid/appInfoTable.c,
src/dynamic-preprocessors/appid/detector_plugins/detector_http.c,
src/dynamic-preprocessors/appid/detector_plugins/detector_http.h,
src/dynamic-preprocessors/appid/fw_appid.c,
src/dynamic-preprocessors/appid/httpCommon.h,
src/dynamic-preprocessors/appid/luaDetectorApi.c,
src/dynamic-preprocessors/appid/service_plugins/service_base.c,
src/dynamic-preprocessors/appid/service_plugins/service_rtmp.c,
src/dynamic-preprocessors/appid/service_plugins/service_rtmp.h:
Added RTMP detector (w/ metadata) to OpenAppID and updated
Lua API.
2014-06-04 Carter Waxman <cwaxman@cisco.com>
Snort 2.9.7.0.beta
* src/build.h:
updating build number to 109
* src/: detection-plugins/sp_base64_decode.c,
dynamic-plugins/sf_engine/sf_snort_plugin_api.c:
Use correct buffer size for base64 decoding.
Fix the bound check for base64_decode rule. Thanks Joshua providing the
patch.
* src/: detect.c,
dynamic-preprocessors/reputation/spp_reputation.c,
dynamic-preprocessors/reputation/shmem/shmem_config.h,
dynamic-preprocessors/reputation/shmem/shmem_mgmt.c,
preprocessors/session_api.h, preprocessors/spp_session.c:
Improved reputation performance by only checking IPs once per
session. Changed control socket to respond 0 when reloading empty IP
reputation lists. Avoid registering reputation preprocessor when there are no IP lists
* src/: active.c, fpdetect.c,
dynamic-preprocessors/dcerpc2/dce2_smb.c,
file-process/file_resume_block.c:
Fixed build issue when configuring with --disable-active-response
--disable-react --disable-flexresp3 (Reported by Jeremy Hoel)
* src/parser.c
src/preprocessors/Session/stream5_ha.c,
src/preprocessors/Stream6/snort_stream_icmp.c,
src/preprocessors/Stream6/snort_stream_tcp.c,
src/preprocessors/Stream6/snort_stream_udp.c,
src/preprocessors/spp_session.c:
Fixed configuration parsing issues.
* src/: fpcreate.c, fpdetect.c:
Fixed rule protocol mapping when using target-based detection.
* src/preprocessors/perf-base.c:
Added field in now files for number of normalizers used.
* src/preprocessors/Stream6/snort_stream_tcp.c:
Fix handling of data on syn for Mac OSX reassembly.
* src/dynamic-plugins/sf_dynamic_plugins.c:
Remove optional field check to improve compatiblity for DragonFlyBSD.
Thanks Joshua Kinard providing patch.
* src/detect.c:
Fixed AppID not correctly handling packets without sessions (Discovered by
James Lay)
* src/preprocessors/snort_httpinspect.c:
Fixed issue with HTTP session data handling. (Discovered by James Lay)
* src/snort.c:
Fixed parsing of custom rule types on reload.
* src/util.c:
Fixed timestamp arithmetic error (Reported by David Turnbull)
* src/: sf_protocols.h, preprocessors/perf-base.c,
preprocessors/perf-base.h, preprocessors/session_api.h,
preprocessors/spp_session.c, preprocessors/spp_stream6.c,
preprocessors/stream_api.h,
preprocessors/Stream6/stream_common.c,
preprocessors/Stream6/stream_common.h:
Fixed IP protocol number type (Reported by Joshua Kinard)
* src/: strlcatu.h, strlcpyu.h:
Wrap function signatures for strlcat/strlcpy. Thanks to James
Golab for reporting the issue.
* doc/: snort_manual.pdf, snort_manual.tex:
Typos fixed (Credit to Jenah J. Sigurdson)
* src/: encode.h, parser.c, dynamic-preprocessors/imap/imap_paf.c,
dynamic-preprocessors/pop/pop_paf.c,
dynamic-preprocessors/smtp/smtp_paf.c,
file-process/file_mail_common.h, preprocessors/stream_api.h,
preprocessors/Stream6/stream_paf.c:
Fixed PAF flushing behavior when encountering gaps.
paf_max now has a hard flush limit of ~64,000. Email protocols will
flush within 1500 characters of paf_max.
* src/: dynamic-preprocessors/dns/spp_dns.c,
dynamic-preprocessors/imap/snort_imap.c,
dynamic-preprocessors/pop/snort_pop.c,
preprocessors/session_api.h, preprocessors/spp_rpc_decode.c,
preprocessors/spp_session.c,
preprocessors/Stream6/snort_stream_tcp.c:
Changed flushing to use receiver's flush policy in all functions.
Updated POP, IMAP, DNS, RPC, and SSL to use the correct directions.
Added SSN_TO_SERVER(SSN_FROM_CLIENT) and SSN_TO_CLIENT(SSN_FROM_SERVER)
to make code more readable (Discovered by John Enure).
* src/detection_util.c:
Fixed Http buffer name initialization.
* src/preprocessors/HttpInspect/normalization/hi_norm.c:
Fixed URI parsing and normalization.
* doc/README.file_ips, src/plugbase.c, src/rule_option_types.h,
src/detection-plugins/Makefile.am,
src/detection-plugins/detection_options.c,
src/detection-plugins/sp_file_type.c,
src/file-process/file_api.h, src/file-process/file_service.c,
src/file-process/libs/file_config.c,
src/file-process/libs/file_config.h,
src/file-process/libs/file_identifier.c,
src/file-process/libs/file_lib.c,
src/file-process/libs/file_lib.h:
Allow registration of the same file type callback.
Harden file_type and file_group rule options.
Fix file id to always use the matched file id.
File identifier rule options 'type' and 'ver' no longer accept
arbitrary ASCII characters as valid arguments, only
permitting [A-Za-z0-9_.] characters.
Snort's 'file_type' rule option now checks for trailing comma (,)
and pipe (|) separators and other typo like mistakes.
* configure.in,
src/active.c,
src/active.h,
src/decode.c,
src/detection-plugins/detection_options.c,
src/detection-plugins/sp_replace.c,
src/dynamic-plugins/sf_dynamic_plugins.c,
src/parser.c,
src/parser.h,
src/preprocessors/Stream6/snort_stream_tcp.c,
src/preprocessors/normalize.c,
src/preprocessors/normalize.h,
src/preprocessors/perf-base.c,
src/preprocessors/perf-base.h,
src/preprocessors/spp_normalize.c,
src/preprocessors/spp_normalize.h,
src/preprocessors/spp_session.c,
src/snort.c,
src/snort.h:
Added would-normalize normalization statistics for inline_test mode.
Normalization behavior now enabled / configured using na_policy_mode.
Fix typos in spp_normalize.c (Thanks to Gregory S Thomas for mentioning).
* doc/README.normalize, doc/snort_manual.pdf, doc/snort_manual.tex,
src/preprocessors/normalize.c, src/preprocessors/perf-base.c,
src/preprocessors/perf-base.h, src/preprocessors/spp_normalize.c,
src/preprocessors/spp_normalize.h,
src/preprocessors/Stream6/snort_stream_tcp.c:
TCP normalization configurations have been split into more granular options.
URP normalization is now ENABLED with the "urp" keyword instead of
DISABLED. New performance monitor stats have been introduced for these
changes.
* src/decode.h,
src/detect.c,
src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
src/preprocessors/Session/session_expect.c,
src/preprocessors/Stream6/snort_stream_tcp.c,
src/preprocessors/spp_stream6.c,
src/preprocessors/stream_api.h:
Changed priority of ftp-telnet reassembly to improve performance.
Process end of file data correctly for ftp data channel.
* etc/file_magic.conf,
src/sfutil/sf_email_attach_decode.c:
File type UUENCODED is now all caps.
Set file data pointer correctly after UU decoding ends.
* src/: dynamic-preprocessors/imap/imap_config.c,
dynamic-preprocessors/pop/pop_config.c,
dynamic-preprocessors/smtp/smtp_config.c,
file-process/file_mime_config.c, file-process/file_mime_config.h:
+0 and -0 are no longer valid values for decoding depth.
* src/dynamic-preprocessors/dnp3/spp_dnp3.c:
Validate DNP3 packets before processing.
* src/: snort.c, snort.h, sfutil/intel-soft-cpm.c,
sfutil/intel-soft-cpm.h:
Fixed issues during reload.
* configure.in,
doc/README.http_inspect,
doc/snort_manual.pdf,
doc/snort_manual.tex,
etc/gen-msg.map,
preproc_rules/preprocessor.rules,
src/generators.h,
src/preprocessors/HttpInspect/Makefile.am,
src/preprocessors/HttpInspect/event_output/hi_eo_log.c,
src/preprocessors/HttpInspect/files/Makefile.am,
src/preprocessors/HttpInspect/files/file_decomp.c,
src/preprocessors/HttpInspect/files/file_decomp_PDF.c,
src/preprocessors/HttpInspect/files/file_decomp_SWF.c,
src/preprocessors/HttpInspect/files/include/file_decomp.h,
src/preprocessors/HttpInspect/files/include/file_decomp_PDF.h
src/preprocessors/HttpInspect/include/Makefile.am,
src/preprocessors/HttpInspect/include/file_decomp.h,
src/preprocessors/HttpInspect/include/file_decomp_PDF.h,
src/preprocessors/HttpInspect/include/file_decomp_SWF.h,
src/preprocessors/HttpInspect/include/hi_eo_events.h,
src/preprocessors/HttpInspect/include/hi_include.h,
src/preprocessors/HttpInspect/include/hi_ui_config.h,
src/preprocessors/HttpInspect/server/hi_server.cr,
src/preprocessors/snort_httpinspect.c,
src/preprocessors/snort_httpinspect.h,
src/preprocessors/spp_httpinspect.c,
src/util.c:
Added ability for HttpInspect to decompress DEFLATE and LZMA encoded
SWF content and DEFLATE encoded pdf content.
* src/preprocessors/spp_perfmonitor.c:
Fixed race condition in perf montitor during reload.
* src/preprocessors/HttpInspect/client/hi_client.c,
src/preprocessors/HttpInspect/include/hi_client.h,
src/preprocessors/HttpInspect/include/hi_ui_config.h,
src/preprocessors/HttpInspect/user_interface/hi_ui_config.c,
src/preprocessors/snort_httpinspect.c:
Added Enhanced XFF support to HttpInspect.
* src/profiler.c:
Fixed duplicate profiler entries when using multiple policies.
* configure.in, src/Makefile.am, src/dump.c, src/dump.h,
src/snort.c, src/control/sfcontrol.h, tools/control/Makefile.am,
tools/control/README.snort_dump_packets_control,
tools/control/sfcontrol.c, tools/control/snort_dump_packets.c:
Added control socket command to dump packets.
* src/: preprocessors/snort_httpinspect.c,
preprocessors/snort_httpinspect.h,
preprocessors/HttpInspect/client/hi_client.c,
preprocessors/HttpInspect/include/hi_ui_config.h,
preprocessors/HttpInspect/include/hi_ui_iis_unicode_map.h,
preprocessors/HttpInspect/session_inspection/hi_si.c,
preprocessors/HttpInspect/user_interface/hi_ui_config.c,
preprocessors/HttpInspect/user_interface/hi_ui_iis_unicode_map.c,
sfutil/util_jsnorm.c, sfutil/util_jsnorm.h:
Removed dead max_pipeline and inspection_type configurations.
Improved memory efficiency of unicode->ascii map.
Expanded possible number of preprocessor alerts for HttpInspect from 31 to 63.
* src/dynamic-preprocessors/sdf/sdf_pattern_match.c:
Fixed FindPiiRecursively to better handle partial matches.
* src/dynamic-preprocessors/sip/sip_parser.c:
Fixed handling SDP when caller and callee have identical session
ids.
* src/: dynamic-preprocessors/Makefile.am,
dynamic-preprocessors/sip/sip_config.h,
dynamic-preprocessors/sip/sip_dialog.c,
dynamic-preprocessors/sip/spp_sip.h, preprocessors/Makefile.am,
preprocessors/sip_common.h, preprocessors/spp_stream6.c,
preprocessors/stream_api.h:
Support better SIP parsing and call handling.
* Makefile.am,
configure.in,
doc/Makefile.am,
doc/README,
doc/README.frag3,
doc/USAGE,
doc/WISHLIST,
doc/snort_manual.tex,
dynamic-plugins/sf_dynamic_plugins.c,
dynamic-plugins/sf_dynamic_preprocessor.h,
dynamic-preprocessors/ftptelnet/ftpp_si.c,
dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
dynamic-preprocessors/imap/snort_imap.c,
dynamic-preprocessors/pop/snort_pop.c,
dynamic-preprocessors/smtp/snort_smtp.c,
dynamic-preprocessors/ssl_common/ssl_config.c,
dynamic-preprocessors/ssl_common/ssl_include.h,
dynamic-preprocessors/ssl_common/ssl_inspect.c,
etc/Makefile.am,
etc/gen-msg.map,
libs/ssl_include.h,
rpm/snort.spec,
snort.8,
src/Makefile.am,
src/active.c,
src/active.h,
src/byte_extract.c,
src/checksum.h,
src/debug.c,
src/decode.c,
src/decode.h,
src/detect.c,
src/detect.h,
src/detection-plugins/detection_options.c,
src/detection-plugins/detection_options.h,
src/detection-plugins/sp_asn1.c,
src/detection-plugins/sp_asn1_detect.c,
src/detection-plugins/sp_byte_check.c,
src/detection-plugins/sp_byte_check.h,
src/detection-plugins/sp_byte_jump.c,
src/detection-plugins/sp_byte_jump.h,
src/detection-plugins/sp_clientserver.c,
src/detection-plugins/sp_clientserver.h,
src/detection-plugins/sp_dsize_check.c,
src/detection-plugins/sp_dsize_check.h,
src/detection-plugins/sp_flowbits.c,
src/detection-plugins/sp_flowbits.h,
src/detection-plugins/sp_ftpbounce.c,
src/detection-plugins/sp_ftpbounce.h,
src/detection-plugins/sp_icmp_code_check.c,
src/detection-plugins/sp_icmp_code_check.h,
src/detection-plugins/sp_icmp_id_check.c,
src/detection-plugins/sp_icmp_id_check.h,
src/detection-plugins/sp_icmp_seq_check.c,
src/detection-plugins/sp_icmp_seq_check.h,
src/detection-plugins/sp_icmp_type_check.c,
src/detection-plugins/sp_icmp_type_check.h,
src/detection-plugins/sp_ip_fragbits.c,
src/detection-plugins/sp_ip_fragbits.h,
src/detection-plugins/sp_ip_id_check.c,
src/detection-plugins/sp_ip_id_check.h,
src/detection-plugins/sp_ip_proto.c,
src/detection-plugins/sp_ip_proto.h,
src/detection-plugins/sp_ip_same_check.c,
src/detection-plugins/sp_ip_same_check.h,
src/detection-plugins/sp_ip_tos_check.c,
src/detection-plugins/sp_ip_tos_check.h,
src/detection-plugins/sp_ipoption_check.c,
src/detection-plugins/sp_ipoption_check.h,
src/detection-plugins/sp_isdataat.c,
src/detection-plugins/sp_isdataat.h,
src/detection-plugins/sp_pattern_match.c,
src/detection-plugins/sp_pattern_match.h,
src/detection-plugins/sp_pcre.c,
src/detection-plugins/sp_react.c,
src/detection-plugins/sp_react.h,
src/detection-plugins/sp_replace.c,
src/detection-plugins/sp_replace.h,
src/detection-plugins/sp_respond.h,
src/detection-plugins/sp_respond3.c,
src/detection-plugins/sp_rpc_check.c,
src/detection-plugins/sp_rpc_check.h,
src/detection-plugins/sp_session.c,
src/detection-plugins/sp_session.h,
src/detection-plugins/sp_tcp_ack_check.c,
src/detection-plugins/sp_tcp_ack_check.h,
src/detection-plugins/sp_tcp_flag_check.c,
src/detection-plugins/sp_tcp_flag_check.h,
src/detection-plugins/sp_tcp_seq_check.c,
src/detection-plugins/sp_tcp_seq_check.h,
src/detection-plugins/sp_tcp_win_check.c,
src/detection-plugins/sp_tcp_win_check.h,
src/detection-plugins/sp_ttl_check.c,
src/detection-plugins/sp_ttl_check.h,
src/detection_filter.c,
src/detection_filter.h,
src/detection_util.c,
src/detection_util.h,
src/dynamic-examples/Makefile.am,
src/dynamic-plugins/sf_convert_dynamic.c,
src/dynamic-plugins/sf_convert_dynamic.h,
src/dynamic-plugins/sf_dynamic_plugins.c,
src/dynamic-plugins/sf_dynamic_preprocessor.h,
src/dynamic-plugins/sf_preproc_example/sf_dynamic_preproc_lib.c,
src/dynamic-plugins/sf_preproc_example/sf_dynamic_preproc_lib.h,
src/dynamic-plugins/sf_preproc_example/spp_nfs_setup.c,
src/dynamic-plugins/sf_preproc_example/spp_nfs_setup.h,
src/dynamic-plugins/sf_src/dynamic_plugins.c,
src/dynamic-plugins/sf_src/dynamic_preprocessor.h,
src/dynamic-plugins/sp_dynamic.c,
src/dynamic-plugins/sp_dynamic.h,
src/dynamic-plugins/sp_preprocopt.c,
src/dynamic-plugins/sp_preprocopt.h,
src/dynamic-preprocessors/Makefile.am,
src/dynamic-preprocessors/ftptelnet/Makefile.am,
src/dynamic-preprocessors/ftptelnet/ftpp_si.c,
src/dynamic-preprocessors/ftptelnet/ftpp_si.h,
src/dynamic-preprocessors/ftptelnet/pp_ftp.c,
src/dynamic-preprocessors/ftptelnet/pp_telnet.c,
src/dynamic-preprocessors/ftptelnet/sf_ftptelnet.dsp,
src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
src/dynamic-preprocessors/imap/Makefile.am,
src/dynamic-preprocessors/imap/imap_config.c,
src/dynamic-preprocessors/imap/imap_config.h,
src/dynamic-preprocessors/imap/imap_log.c,
src/dynamic-preprocessors/imap/imap_log.h,
src/dynamic-preprocessors/imap/imap_util.c,
src/dynamic-preprocessors/imap/imap_util.h,
src/dynamic-preprocessors/imap/sf_imap.dsp,
src/dynamic-preprocessors/imap/snort_imap.c,
src/dynamic-preprocessors/imap/snort_imap.h,
src/dynamic-preprocessors/imap/spp_imap.c,
src/dynamic-preprocessors/imap/spp_imap.h,
src/dynamic-preprocessors/libs/Makefile.am,
src/dynamic-preprocessors/libs/sfdynamic_preproc_libs.dsp,
src/dynamic-preprocessors/libs/ssl.c,
src/dynamic-preprocessors/libs/ssl.h,
src/dynamic-preprocessors/libs/ssl_include.h,
src/dynamic-preprocessors/pop/Makefile.am,
src/dynamic-preprocessors/pop/pop_config.c,
src/dynamic-preprocessors/pop/pop_config.h,
src/dynamic-preprocessors/pop/pop_log.c,
src/dynamic-preprocessors/pop/pop_log.h,
src/dynamic-preprocessors/pop/pop_util.c,
src/dynamic-preprocessors/pop/pop_util.h,
src/dynamic-preprocessors/pop/sf_pop.dsp,
src/dynamic-preprocessors/pop/snort_pop.c,
src/dynamic-preprocessors/pop/snort_pop.h,
src/dynamic-preprocessors/pop/spp_pop.c,
src/dynamic-preprocessors/pop/spp_pop.h,
src/dynamic-preprocessors/reputation/shmem/sflinux_helpers.c,
src/dynamic-preprocessors/reputation/shmem/sflinux_helpers.h,
src/dynamic-preprocessors/reputation/shmem/shmem_common.h,
src/dynamic-preprocessors/reputation/shmem/shmem_config.c,
src/dynamic-preprocessors/reputation/shmem/shmem_config.h,
src/dynamic-preprocessors/reputation/shmem/shmem_datamgmt.c,
src/dynamic-preprocessors/reputation/shmem/shmem_datamgmt.h,
src/dynamic-preprocessors/reputation/shmem/shmem_lib.c,
src/dynamic-preprocessors/reputation/shmem/shmem_lib.h,
src/dynamic-preprocessors/reputation/shmem/shmem_mgmt.c,
src/dynamic-preprocessors/reputation/shmem/shmem_mgmt.h,
src/dynamic-preprocessors/sf_dynamic_initialize/sf_dynamic_initialize.dsp,
src/dynamic-preprocessors/sip/sf_sip.dsp,
src/dynamic-preprocessors/smtp/Makefile.am,
src/dynamic-preprocessors/smtp/sf_smtp.dsp,
src/dynamic-preprocessors/smtp/snort_smtp.c,
src/dynamic-preprocessors/smtp/snort_smtp.h,
src/dynamic-preprocessors/ssl/Makefile.am,
src/dynamic-preprocessors/ssl/sf_ssl.dsp,
src/dynamic-preprocessors/ssl_common/ssl.c,
src/dynamic-preprocessors/ssl_common/ssl.h,
src/dynamic-preprocessors/ssl_common/ssl_config.c,
src/dynamic-preprocessors/ssl_common/ssl_config.h,
src/dynamic-preprocessors/ssl_common/ssl_ha.c,
src/dynamic-preprocessors/ssl_common/ssl_ha.h,
src/dynamic-preprocessors/ssl_common/ssl_include.h,
src/dynamic-preprocessors/ssl_common/ssl_inspect.c,
src/dynamic-preprocessors/ssl_common/ssl_inspect.h,
src/dynamic-preprocessors/ssl_common/ssl_session.h,
src/encode.c,
src/encode.h,
src/event.h,
src/event_queue.c,
src/event_wrapper.c,
src/fpcreate.c,
src/fpcreate.h,
src/fpdetect.c,
src/fpdetect.h,
src/generators.h,
src/hashstring.c,
src/hashstring.h,
src/idle_processing.c,
src/log.c,
src/log.h,
src/log_text.c,
src/mempool.c,
src/mempool.h,
src/mstring.c,
src/mstring.h,
src/output-plugins/spo_alert_fast.c,
src/output-plugins/spo_alert_fast.h,
src/output-plugins/spo_alert_full.c,
src/output-plugins/spo_alert_full.h,
src/output-plugins/spo_alert_sf_socket.c,
src/output-plugins/spo_alert_syslog.c,
src/output-plugins/spo_alert_syslog.h,
src/output-plugins/spo_alert_test.c,
src/output-plugins/spo_alert_test.h,
src/output-plugins/spo_alert_unixsock.c,
src/output-plugins/spo_alert_unixsock.h,
src/output-plugins/spo_csv.c,
src/output-plugins/spo_csv.h,
src/output-plugins/spo_log_ascii.c,
src/output-plugins/spo_log_ascii.h,
src/output-plugins/spo_log_null.c,
src/output-plugins/spo_log_null.h,
src/output-plugins/spo_log_tcpdump.c,
src/output-plugins/spo_log_tcpdump.h,
src/output-plugins/spo_unified2.h,
src/packet_time.c,
src/parser.c,
src/parser.h,
src/parser/IpAddrSet.c,
src/parser/IpAddrSet.h,
src/pcrm.c,
src/pcrm.h,
src/plugbase.c,
src/plugbase.h,
src/plugin_enum.h,
src/ppm.c,
src/preprocessors/HttpInspect/include/hi_client.h,
src/preprocessors/HttpInspect/include/hi_paf.h,
src/preprocessors/HttpInspect/utils/hi_paf.c,
src/preprocessors/Session/stream5_ha.c,
src/preprocessors/normalize.c,
src/preprocessors/normalize.h,
src/preprocessors/perf-base.c,
src/preprocessors/perf-base.h,
src/preprocessors/perf-event.c,
src/preprocessors/perf-event.h,
src/preprocessors/perf-flow.c,
src/preprocessors/perf-flow.h,
src/preprocessors/perf.c,
src/preprocessors/perf.h,
src/preprocessors/session_api.h
src/preprocessors/sfprocpidstats.c,
src/preprocessors/sfprocpidstats.h,
src/preprocessors/spp_arpspoof.c,
src/preprocessors/spp_arpspoof.h,
src/preprocessors/spp_bo.c,
src/preprocessors/spp_bo.h,
src/preprocessors/spp_frag3.c,
src/preprocessors/spp_frag3.h,
src/preprocessors/spp_normalize.c,
src/preprocessors/spp_normalize.h,
src/preprocessors/spp_perfmonitor.c,
src/preprocessors/spp_perfmonitor.h,
src/preprocessors/spp_rpc_decode.c,
src/preprocessors/spp_rpc_decode.h,
src/preprocessors/spp_session.c,
src/preprocessors/spp_stream5.c,
src/preprocessors/spp_stream5.h,
src/preprocessors/stream_api.c,
src/preprocessors/stream_api.h,
src/preprocessors/stream_expect.c,
src/preprocessors/stream_expect.h,
src/profiler.c,
src/profiler.h,
src/rate_filter.c,
src/rate_filter.h,
src/rules.h,
src/sf_protocols.h,
src/sf_sdlist.c,
src/sf_sdlist.h,
src/sf_sdlist_types.h,
src/sfdaq.c,
src/sfdaq.h,
src/sfthreshold.c,
src/sfutil/acsmx.c,
src/sfutil/acsmx.h,
src/sfutil/acsmx2.c,
src/sfutil/bitop.h,
src/sfutil/bitop_funcs.h,
src/sfutil/getopt.h,
src/sfutil/mpse.c,
src/sfutil/mpse.h,
src/sfutil/sf_email_attach_decode.c,
src/sfutil/sf_email_attach_decode.h,
src/sfutil/sf_ip.c,
src/sfutil/sf_iph.c,
src/sfutil/sf_sechash.c,
src/sfutil/sf_sechash.h,
src/sfutil/sha2.h,
src/sfutil/util_jsnorm.c,
src/sfutil/util_jsnorm.h,
src/sfutil/util_unfold.c,
src/sfutil/util_unfold.h,
src/signature.h,
src/snort.c,
src/snort.h,
src/snort_debug.h,
src/spo_plugbase.h,
src/tag.c,
src/tag.h,
src/util.c,
src/util.h,
src/win32/WIN32-Code/getopt.c,
src/win32/WIN32-Code/inet_aton.c,
src/win32/WIN32-Code/misc.c,
src/win32/WIN32-Includes/config.h,
src/win32/WIN32-Includes/getopt.h,
src/win32/WIN32-Prj/snort_installer.nsi,
ssl/ssl_setup.c,
tools/control/sfcontrol.c:
Refactor SSL code to make a library for state processing across
non-native protocols that use SSL via STARTTLS. Update IMAP/POP/FTP/SSL
preprocessors to use new SSL library, and activation of PAF for those
protocols. Add ability to share basic state for SSL.
* configure.in,
doc/README.session,
doc/README.stream5,
doc/snort_manual.pdf,
doc/snort_manual.tex,
dynamic-preprocessors/dns/spp_dns.c,
dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
dynamic-preprocessors/gtp/spp_gtp.c,
dynamic-preprocessors/imap/spp_imap.c,
dynamic-preprocessors/modbus/spp_modbus.c,
dynamic-preprocessors/pop/spp_pop.c,
dynamic-preprocessors/sip/spp_sip.c,
dynamic-preprocessors/smtp/spp_smtp.c,
dynamic-preprocessors/ssh/spp_ssh.c,
etc/sf_rule_options,
preprocessors/Session/session_common.c,
preprocessors/Session/session_common.h,
preprocessors/Session/session_expect.c,
preprocessors/Stream6/snort_stream_ip.c,
preprocessors/Stream6/snort_stream_tcp.c,
preprocessors/Stream6/snort_stream_tcp.h,
preprocessors/Stream6/snort_stream_udp.c,
preprocessors/Stream6/stream_common.h,
preprocessors/session_api.h,
preprocessors/snort_httpinspect.c,
preprocessors/spp_rpc_decode.c,
preprocessors/spp_session.c,
preprocessors/spp_stream6.c,
preprocessors/stream_api.h,
preprocids.h,
src/Makefile.am,
src/active.c,
src/active.h,
src/build.h,
src/detect.c,
src/detect.h,
src/detection-plugins/Makefile.am,
src/detection-plugins/sp_clientserver.c,
src/detection-plugins/sp_flowbits.c,
src/detection-plugins/sp_pattern_match.c,
src/detection-plugins/sp_pattern_match.h,
src/dynamic-examples/Makefile.am,
src/dynamic-examples/dynamic-preprocessor/spp_example.c,
src/dynamic-output/plugins/output_lib.h,
src/dynamic-output/plugins/output_plugin.c,
src/dynamic-plugins/sf_convert_dynamic.c,
src/dynamic-plugins/sf_dynamic_plugins.c,
src/dynamic-plugins/sf_dynamic_preprocessor.h,
src/dynamic-plugins/sf_engine/sf_snort_detection_engine.c,
src/dynamic-plugins/sf_engine/sf_snort_packet.h,
src/dynamic-plugins/sf_engine/sf_snort_plugin_api.h,
src/dynamic-plugins/sf_engine/sf_snort_plugin_content.c,
src/dynamic-plugins/sp_preprocopt.c,
src/dynamic-preprocessors/Makefile.am,
src/dynamic-preprocessors/dcerpc2/dce2_cl.c,
src/dynamic-preprocessors/dcerpc2/dce2_config.c,
src/dynamic-preprocessors/dcerpc2/dce2_config.h,
src/dynamic-preprocessors/dcerpc2/dce2_paf.c,
src/dynamic-preprocessors/dcerpc2/dce2_roptions.c,
src/dynamic-preprocessors/dcerpc2/dce2_session.h,
src/dynamic-preprocessors/dcerpc2/dce2_smb.c,
src/dynamic-preprocessors/dcerpc2/snort_dce2.c,
src/dynamic-preprocessors/dcerpc2/snort_dce2.h,
src/dynamic-preprocessors/dcerpc2/spp_dce2.c,
src/dynamic-preprocessors/dnp3/dnp3_roptions.c,
src/dynamic-preprocessors/dnp3/spp_dnp3.c,
src/dynamic-preprocessors/dnp3/spp_dnp3.h,
src/dynamic-preprocessors/dns/spp_dns.c,
src/dynamic-preprocessors/dns/spp_dns.h,
src/dynamic-preprocessors/file/file_agent.c,
src/dynamic-preprocessors/file/file_event_log.c,
src/dynamic-preprocessors/file/spp_file.c,
src/dynamic-preprocessors/ftptelnet/ftpp_si.c,
src/dynamic-preprocessors/ftptelnet/ftpp_si.h,
src/dynamic-preprocessors/ftptelnet/pp_ftp.c,
src/dynamic-preprocessors/ftptelnet/pp_telnet.c,
src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.h,
src/dynamic-preprocessors/ftptelnet/spp_ftptelnet.c,
src/dynamic-preprocessors/gtp/gtp_roptions.c,
src/dynamic-preprocessors/gtp/spp_gtp.c,
src/dynamic-preprocessors/imap/imap_config.c,
src/dynamic-preprocessors/imap/imap_config.h,
src/dynamic-preprocessors/imap/sf_imap.dsp,
src/dynamic-preprocessors/imap/snort_imap.c,
src/dynamic-preprocessors/imap/snort_imap.h,
src/dynamic-preprocessors/imap/spp_imap.c,
src/dynamic-preprocessors/libs/sfdynamic_preproc_libs.dsp,
src/dynamic-preprocessors/modbus/modbus_decode.c,
src/dynamic-preprocessors/modbus/modbus_roptions.c,
src/dynamic-preprocessors/modbus/spp_modbus.c,
src/dynamic-preprocessors/modbus/spp_modbus.h,
src/dynamic-preprocessors/pop/pop_config.c,
src/dynamic-preprocessors/pop/pop_config.h,
src/dynamic-preprocessors/pop/pop_util.c,
src/dynamic-preprocessors/pop/sf_pop.dsp,
src/dynamic-preprocessors/pop/snort_pop.c,
src/dynamic-preprocessors/pop/snort_pop.h,
src/dynamic-preprocessors/pop/spp_pop.c,
src/dynamic-preprocessors/reputation/spp_reputation.c,
src/dynamic-preprocessors/sdf/spp_sdf.c,
src/dynamic-preprocessors/sip/sip_dialog.c,
src/dynamic-preprocessors/sip/sip_roptions.c,
src/dynamic-preprocessors/sip/spp_sip.c,
src/dynamic-preprocessors/smtp/sf_smtp.dsp,
src/dynamic-preprocessors/smtp/smtp_config.c,
src/dynamic-preprocessors/smtp/smtp_config.h,
src/dynamic-preprocessors/smtp/smtp_util.c,
src/dynamic-preprocessors/smtp/snort_smtp.c,
src/dynamic-preprocessors/smtp/spp_smtp.c,
src/dynamic-preprocessors/ssh/spp_ssh.c,
src/encode.c,
src/encode.h,
src/event_queue.c,
src/event_wrapper.c,
src/file-process/file_api.h,
src/file-process/file_mime_process.c,
src/file-process/file_mime_process.h,