Archive | news RSS for this section

Release Notes for 5.0.0

New installations

In the default configuration Suricata-Update will download the ET Open ruleset. In the Suricata 5.0 optimized version, JA3 rules are added and enabled by default. See below for instructions on how to disable these rules with Suricata-Update.

The new default configuration has a number of extra EVE loggers enabled by default. These are the ‘anomaly’ logger, and loggers for the snmp, ftp protocols. In 4.1 Rust was optional, unlike in 5.0. This means that loggers for smb, nfs, tftp, ikev2, krb5 are now also enabled by default. As a result, logging volume may be higher than expected. Logging for these protocols can be enabled/disabled in the eve-log section in the suricata.yaml. 

Upgrading notes

When using Suricata with ET (Open or Pro) rules managed by Suricata-Update, the ruleset will automatically switch to the 5.0 version of the ruleset. This has a number of consequences.

  1. The ET 5.0 ruleset use a different classification scheme. Suricata 5.0 will issue warnings if rules use an unknown classtype. Update your classification.config from the one Suricata 5.0 ships or the ET ruleset version to suppress these warnings.
  2. If JA3 is enabled in the Suricata configuration (or not specified), the ET5 JA3 rules will be enabled by Suricata-Update. These rules have been quite noisy in the past. If they are alerting too frequently, the rules can be disabled in Suricata-Update.

Read more about upgrading https://suricata.readthedocs.io/en/latest/upgrade.html

Telling Suricata-Update to disable JA3 rules

  1. By filename. If all the JA3 rules are in a specific file like you find in ET Open and ET Pro, you can use Suricata update to disable all files in a rule. In /etc/suricata/disable.conf add the line: filename: rules/emerging-ja3.rules
  2. By regular expression. As all the rules we see in the ET Open and Pro ruleset are using the ja3_hash keyword, we can disable JA3 rules by using a regular expression looking for the ja3_keyword. This has the benefit of matching across all filenames. In your /etc/suricata/disable.conf, add the line: re: ja3_hash;

Read more  at https://suricata-update.readthedocs.io/en/1.1.0/update.html#example-configuration-to-disable-rules-disable-conf

EVE DNS Logging

Suricata 5.0 will default to the version 2 style of DNS logging in EVE if a version is not provided in the configuration. This is something to note if you are upgrading from 4.0, or 4.1 without Rust, as your EVE DNS log format will change. To continue using the version 1 format, you must update your configuration to include “version: 1”. See the documentation at https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format for more information. However, we recommend moving to the version 2 style output, as it is more compact, and where enhancements to DNS logging will occur.

Reporting issues

To see what issues are already reported, see https://redmine.openinfosecfoundation.org/versions/138. If you run into an issue that isn’t listed, please open a new ticket.

Announcing Suricata 5.0.0

The OISF’s Suricata development team is proud to announce Suricata 5.0.0. This release brings many new features and improvements.

RDP, SNMP, FTP and SIP

Three new protocol parsers and loggers, all community contributions. Zach Kelly created a Rust RDP parser, while Giuseppe Longo created SIP support. Rust master Pierre Chifflier contributed SNMP support. Since RDP and SIP were merged late in our development cycle they are disabled by default in the configuration. For FTP we have added an EVE logging facility.

JA3S

After contributing JA3 support in Suricata 4.1, Mats Klepsland has been working on JA3S support. JA3S is now available to the rule language and in the TLS logging output.

Datasets

Still experimental at this time, the initial work to support datasets is part of this release. It allows matching on large amounts of data. It is controlled from the rule language and will work with any ‘sticky buffer’.

See documentation at https://suricata.readthedocs.io/en/suricata-5.0.0/rules/datasets.html

We’ve already heard of people using this with millions of IOCs.

Documentation

With the help of many community members we’ve been improving the user documentation. Please see: https://suricata.readthedocs.io/en/suricata-5.0.0/

HTTP evader

We’ve been working hard to cover the final set of HTTP evader cases. This work has mostly gone into the bundled libhtp 0.5.31.

Rust

The most visible is that our Rust support is no longer optional. We’re convinced that Rust is a perfect match for Suricata, and we plan to increase its footprint in our code base steadily. By making it mandatory we’re able to remove parallel implementations and focus fully on making the Rust code better.

Protocol Detection

The protocol detection engine has been extended to provide better accuracy as well as support for dealing with asynchronous flows. These async flows are sometimes picked up in the wrong direction and the protocol detection engine can now reverse them.

Decoder Anomaly records in EVE

A new log record type has been added: ‘anomaly’. This logs the stream and decoder events that are set by the packet decoders. This is inspired by Zeeks (Bro) ‘weird’ log.

EVE improvements

VLAN and capture interface is now part of many more EVE records, even if they are flow records or records based on flow time out.

An option to log all HTTP headers to the EVE http records has been added.

Packet Capture

Eric Leblond has been working hard to getting hardware offload support working for eBPF. On Netronome cards the eBPF based flow bypass can now be offloaded to the NIC. As eBPF is becoming a standard in the Linux space, we are hoping to see other hardware offload soon as well.

Netmap support has been rewritten so the more advanced features of netmap, such as vale switches, can be used now.

Napatech usability has been improved.

Rule language: Sticky Buffers

As discussed at the Suricon 2018 brainstorm session, a new rule keyword scheme is being introduced. It takes the existing ‘sticky buffer’ approach with new keyword names to avoid confusion. The new scheme is <proto>.<buffer>, so for example ‘http.uri’ for the URI inspection.

A number of HTTP keywords have been added.

Unified Lua inspection mixed with the sticky buffers has also been implemented.

Python 3

With Python 2’s EOL approaching, we’ve made sure that all Suricata’s python code is Python 3 compliant.

Removals

Following our deprecation policy, we have removed the following parts: the plain text dns.log, the old files-json.log and support for the Tilera architecture.

https://suricata-ids.org/about/deprecation-policy/

All tickets

Beta 1 tickets: https://redmine.openinfosecfoundation.org/versions/115

RC 1 tickets: https://redmine.openinfosecfoundation.org/versions/128

Final tickets: https://redmine.openinfosecfoundation.org/versions/129

Download

https://suricata-ids.org/download/

Please help us test Suricata 5.0.0-rc1

We are looking for testers for a new development release in the Suricata 5 series: Suricata 5.0.0-rc1. Please help us test so we can release the final on October 15th.

Curious about whats new? Here are the highlights:

RDP, SNMP, FTP and SIP

Three new protocol parsers and loggers, both community contributions. Zach Kelley created a Rust RDP parser, while Giuseppe Longo created SIP support. Rust master Pierre Chifflier contributed SNMP support. Since RDP and SIP were merged late in our development cycle they are disabled by default in the configuration. For FTP we have added a EVE logging facility.

JA3S

After contributing JA3 support in Suricata 4.1, Mats Klepsland has been working on JA3S support. JA3S is now available to the rule language and in the TLS logging output.

eBPF/XDP

Eric Leblond has been working hard to getting hardware offload support working for eBPF. On Netronome cards the eBPF based flow bypass can now be offloaded to the NIC.

Datasets

Still experimental at this time, the initial work to support datasets is part of this release. It allows matching on large amounts of data. It is controlled from the rule language and will work with any ‘sticky buffer’. https://suricata.readthedocs.io/en/suricata-5.0.0-rc1/rules/datasets.html

HTTP evader

We’ve been working hard to cover the final set of HTTP evader cases. This work has mostly gone into the bundled libhtp 0.5.31.

More 5.0 changes

Please see the beta1 announcement for many more changes in the upcoming 5.0 release: https://suricata-ids.org/2019/04/30/call-for-testing-announcing-suricata-5-0-0-beta1/

For a complete list of closed tickets in 5.0.0-rc1, please see https://redmine.openinfosecfoundation.org/versions/128

Release schedule

This release has been delayed quite a bit. We had originally hoped to have it ready for you in July. This means that to get the final out before Suricon next month we have quite an aggressive schedule. We want to release the final no later than October 15th. We can use all the help we can get with testing and polishing to meet that goal. Thanks in advance!

Download from:

https://www.openinfosecfoundation.org/downloads/suricata-5.0.0-rc1.tar.gz

Suricata 4.1.5 released

We’re pleased to announce Suricata 4.1.5. This release fixes a number of issues found in the 4.1 branch. Some of the issues are security issues, so upgrading is highly recommended.

This release also adds VXLAN support, contributed by Henrik Lund Kramshoej. This was accepted into the stable branch to support Suricata deployment in AWS. Next GeoIP2 support was contributed by Bill Meeks. This was added to stable as GeoIP1 is end of life and the databases are no longer updated.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.1.5.tar.gz

Changes

  • Feature #3068: protocol parser: vxlan (4.1.x)
  • Bug #2841: False positive alerts firing after upgrade suricata 3.0 -> 4.1.0 (4.1.x)
  • Bug #2966: filestore (v1 and v2): dropping of “unwanted” files (4.1.x)
  • Bug #3008: rust: updated libc crate causes depration warnings (4.1.x)
  • Bug #3044: tftp: missing logs because of broken tx handling (4.1.x)
  • Bug #3067: GeoIP keyword depends on now discontinued legacy GeoIP database (4.1.x)
  • Bug #3094: Fedora rawhide af-packet compilation err (4.1.x)
  • Bug #3123: bypass keyword: Suricata 4.1.x Segmentation Faults (4.1.x)
  • Bug #3129: Fixes warning about size of integers in string formats (4.1.x)
  • Bug #3159: SC_ERR_PCAP_DISPATCH with message “error code -2” upon rule reload completion (4.1.x)
  • Bug #3164: Suricata 4.1.4: NSS Shutdown triggers crashes in test mode
  • Bug #3168: tls: out of bounds read
  • Bug #3170: defrag: out of bounds read
  • Bug #3173: ipv4: ts field decoding oob read
  • Bug #3175: File_data inspection depth while inspecting base64 decoded data (4.1.x)
  • Bug #3184: decode/der: crafted input can lead to resource starvation
  • Bug #3186: Multiple Content-Length headers causes HTP_STREAM_ERROR (4.1.x)
  • Bug #3187: GET/POST HTTP-request with no Content-Length, http_client_body miss (4.1.x)

Special thanks

Bill Meeks, Henrik Lund Kramshoej, Yujie Zhao, Alexander Bluhm

Sirko Höer — Code Intelligence GmbH, DCSO.

Trainings

See https://suricata_events.eventbrite.com/ for the current list of planned training sessions.

Suricon

Suricon 2019 will happen in Amsterdam in little over a month! For tickets, trainings and sponsorships, see: https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Call for testing: announcing Suricata 5.0.0-beta1

We’re happy to present the first beta in the upcoming Suricata 5.0 series. In 5.0 we’re making a couple of large changes.

Rust

The most visible is that our Rust support is no longer optional. We’re convinced that Rust is a perfect match for Suricata, and we plan to increase its footprint in our code base steadily. By making it mandatory we’re able to remove parallel implementations and focus fully on making the Rust code better.

Protocol Detection

The protocol detection engine has been extended to provide better accuracy as well as support for dealing with asynchronous flows. These async flows are sometimes picked up in the wrong direction and the protocol detection engine can now reverse them.

Decoder Anomaly records in EVE

A new log record type has been added: ‘anomaly’. This logs the stream and decoder events that are set by the packet decoders. This is inspired by Zeeks (Bro) ‘weird’ log.

EVE improvements

VLAN and capture interface is now part of many more EVE records, even if they are flow records or records based on flow time out.

An option to log all HTTP headers to the EVE http records has been added.

Packet Capture

Netmap support has been rewritten so the more advanced features of netmap, such as vale switches, can be used now.

Napatech usability has been improved.

Rule language: Sticky Buffers (in progress)

As discussed at the Suricon 2018 brainstorm session, a new rule keyword scheme is being introduced. It takes the existing ‘sticky buffer’ approach with new keyword names to avoid confusion. The new scheme is <proto>.<buffer>, so for example ‘http.uri’ for the URI inspection.

A number of HTTP keywords have been added.

Unified Lua inspection mixed with the sticky buffers has also been implemented.

Python 3

With Python 2’s EOL approaching, we’ve made sure that all Suricata’s python code is Python 3 compliant.

Removals

Following our deprecation policy, we have removed the following parts: the plain text dns.log, the old files-json.log and support for the Tilera architecture.

https://suricata-ids.org/about/deprecation-policy/

Many more things

https://redmine.openinfosecfoundation.org/versions/115

Time line

We’re planning the first release candidate in about a month, with the final about a month later. So early July.

Get involved

If you’re interested in helping out, we’d be happy to accept patches, documentation, test reports and other kind of feedback.

Download from:

https://www.openinfosecfoundation.org/downloads/suricata-5.0.0-beta1.tar.gz

Suricata 4.1.4 released

We’re pleased to announce Suricata 4.1.4. This release fixes a number of issues found in the 4.1 branch.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.1.4.tar.gz

Changes

  • Bug #2870: pcap logging with lz4 coverity warning
  • Bug #2883: ssh: heap buffer overflow
  • Bug #2884: mpls: heapbuffer overflow in file decode-mpls.c
  • Bug #2887: decode-ethernet: heapbuffer overflow in file decode-ethernet.c
  • Bug #2888: 4.1.3 core in HCBDCreateSpace
  • Bug #2894: smb 1 create andx request does not parse the filename correctly
  • Bug #2902: rust/dhcp: panic in dhcp parser
  • Bug #2903: mpls: cast of misaligned data leads to undefined behavior
  • Bug #2904: rust/ftp: panic in ftp parser
  • Bug #2943: rust/nfs: integer underflow
  • This release includes Suricata-Update 1.0.5

Special thanks

Alexander Bluhm, Giuseppe Longo, Max Fillinger, Wesley van der Ree, Jason Taylor
Sirko Höer — Code Intelligence GmbH, DCSO.

Trainings

See https://suricata_events.eventbrite.com/ for the current list of planned training sessions.

Suricon

The CFP for Suricon 2019 is open! Submit your talk proposal at: https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Suricata 4.1.3 released

We’re pleased to announce Suricata 4.1.3. This release fixes a number of issues found in the 4.1-series.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.1.3.tar.gz

Changes

  • Bug #2225: when stats info dumping in redis,the decoder.ipv4.trunc_pkt can’t output.In the same time, in the stats.log this can output
  • Bug #2362: rule reload with workers mode and NFQUEUE not working stable
  • Bug #2761: Include ebpf files in distributed sources
  • Bug #2762: SSLv3 – AddressSanitizer heap-buffer-overflow
  • Bug #2770: TCP FIN/ACK, RST/ACK in HTTP – detection bypass
  • Bug #2788: afpacket doesn’t wait for all capture threads to start
  • Bug #2805: dns v1/2 with rust results in less app layer data available in the alert record (for dns related alerts/rules) (4.1.x)
  • Bug #2811: netmap/afpacket IPS: stream.inline: auto broken
  • Bug #2823: configure.ac: broken –{enable,disable}-xxx options (4.1.x)
  • Bug #2842: IPS mode crash under load
  • Bug #2855: Suricata does not bridge host <-> hw rings (Affects FreeBSD 11-STABLE, FreeBSD 12 and FreeBSD 13-CURRENT)
  • Bug #2862: pcre related FP in HTTP inspection (4.1.x)
  • Bug #2865: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works (4.1.x)
  • Feature #2774: pcap multi dev support for Windows

Special thanks

Edwin van Vliet, Mats Klepsland, Pierre Chifflier, Alexander Gozman, Fabrice Fontaine, Jingyu Yang, Murat Balaban, Pascal Delalande

Trainings

2019 Training Calendar has been posted. There are still seats available for next weeks Advanced Deployment and Threat Hunting training in Washington, D.C. See https://suricata-ids.org/training/

Suricon

Suricon 2018 was a great success and the 2019 location has been announced: Amsterdam. Please consider becoming a sponsor! https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Suricata 4.0.7 available!

We’re pleased to announce Suricata 4.0.7.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.0.7.tar.gz

EOL announcement

The Suricata 4.0.x branch will go end of life in 2 months, after which it will no longer be updated. If you are still on 4.0.x, it’s recommended that you start planning the upgrade to 4.1.x.

Changes

  • Bug #2714: Failed Assertion, Suricata Abort – util-mpm-hs.c line 163
  • Bug #2735: unix runmode deadlock when using too many threads (4.0.x)
  • Bug #2794: Python 3 unicode issue in Rust C header generator on FreeBSD
  • Bug #2824: rule reload with workers mode and NFQUEUE not working stable (4.0.x)
  • Bug #2825: TCP FIN/ACK, RST/ACK in HTTP – detection bypass (4.0.x)
  • Bug #2826: afpacket doesn’t wait for all capture threads to start (4.0.x)
  • Bug #2827: DNS Golden Transaction ID – detection bypass (4.0.x)
  • Bug #2828: Invalid detect-engine config could lead to segfault (4.0.x)
  • Bug #2830: suricata.c ConfigGetCaptureValue – PCAP/AFP fallthrough to strip_trailing_plus (4.0.x)
  • Bug #2831: Stats interval are 1 second too early each tick (4.0.x)
  • Bug #2832: rust/dns/lua – The Lua calls for DNS values when using Rust don’t behave the same as the C implementation. (4.0.x)
  • Bug #2863: out of bounds read in detection
  • Feature #2829: smtp: improve pipelining support (4.0.x)

Special thanks

Philippe Antoine, Alexander Gozman, Fabrice Fontaine, Murat Balaban

Trainings

The 2019 Training Calendar has been posted. There are still seats available for next weeks Advanced Deployment and Threat Hunting training in Washington, D.C. See https://suricata-ids.org/training/

SuriCon

Suricon 2018 was a great success and the 2019 location and dates have been announced: October 30 – November 1, 2019 in Amsterdam. Please consider becoming a sponsor! https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Suricata 4.1.2 released

Much sooner than planned we are releasing 4.1.2. The 4.1.1 process didn’t go as planned. First the tarball was missing the vendored Rust crates. Then we found that Suricata-Update didn’t properly function on CentOS 7, Ubunut 14.04 and other slightly older distros. Then last minute we found yet another Suricata-Update bug.

So despite it being so close to the holidays for many, we decided to push 4.1.2 out already. Apologies for the inconvenience this may cause.

Other than the issues mention above, we did also fix some additional issues. SMB logging accuracy was improved, DNS detection and logging accuracy was improved and some documentation updates are included as well.

After the holidays are over we’re going to review our QA for both Suricata and Suricata-Update, so we can avoid issue like this in the future.

Changes

  • Feature #1863: smtp: improve pipelining support
  • Feature #2748: bundle libhtp 0.5.29
  • Feature #2749: bundle suricata-update 1.0.3
  • Bug #2682: python-yaml Not Listed As Ubuntu Prerequisite
  • Bug #2736: DNS Golden Transaction ID – detection bypass
  • Bug #2745: Invalid detect-engine config could lead to segfault
  • Bug #2752: smb: logs for IOCTL and DCERPC have tree_id value of 0

Special thanks

Philippe Antoine, Alexey Vishnyakov

Download

https://www.openinfosecfoundation.org/downloads/suricata-4.1.2.tar.gz

Suricata 4.1.1 available!

suri-400x400

We are pleased to announce Suricata 4.1.1. This release fixes a number of issues found 4.1. It also adds EVE DNSv1 support for Rust builds.

Changes

  • Feature #2637: af-packet: improve error output for BPF loading failure
  • Feature #2671: Add Log level to suricata.log when using JSON type
  • Bug #2502: suricata.c ConfigGetCaptureValue – PCAP/AFP fallthrough to strip_trailing_plus
  • Bug #2528: krb parser not always parsing tgs responses
  • Bug #2633: Improve errors handling in AF_PACKET
  • Bug #2653: llc detection failure in configure.ac
  • Bug #2677: coverity: ja3 potential memory leak
  • Bug #2679: build with profiling enabled on generates compile warnings
  • Bug #2704: DNSv1 for Rust enabled builds.
  • Bug #2705: configure: Test for PyYAML and disable suricata-update if not installed.
  • Bug #2716: Stats interval are 1 second too early each tick
  • Bug #2717: nfs related panic in 4.1
  • Bug #2719: Failed Assertion, Suricata Abort – util-mpm-hs.c line 163 (4.1.x)
  • Bug #2723: dns v2 json output should always set top-level rrtype in responses
  • Bug #2730: rust/dns/lua – The Lua calls for DNS values when using Rust don’t behave the same as the C implementation.
  • Bug #2731: multiple instances of transaction loggers are broken
  • Bug #2734: unix runmode deadlock when using too many threads
  • Bundled Suricata-Update was updated to 1.0.1

Download

https://www.openinfosecfoundation.org/download/suricata-4.1.1.tar.gz

Special thanks

Jason Taylor, Eric Urban, Mats Klepsland, Pierre Chifflier

Trainings

The 2019 calendar of trainings will be out soon – check back here or follow us on Twitter (@OISFoundation) for all training announcements

Suricon

Suricon 2018 was a great success and the 2019 location has been announced: Amsterdam. Please consider becoming a sponsor! https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.