This patch resolves all uid/gid conflicts except for nobody/nogroup (seems
to make sense that these are the same).
All conflicts where determined mechanically, but resolutions were manual.
This patch also marks uids/gids with no corresponding group/user as "unused"
(aka. reserved).
Briefly,
- tss group conflicts with dhcpcd
The tss group id conflicts with dhcpcd: assign
a new number and add a corresponding tss user.
- elasticsearch uid conflicts with haproxy gid
- resolve firebird/munin conflict
- fix fourstorehttp{,d} typo
- fix ghostOne typo: the service module refers to gids.ghostone, so use that
in ids
- memcached uid conflicts with users gid
- nagios uid conflicts with disks gid
- nscd uid conflicts with wheel gid
- ntp uid conflicts with tty gid
- resolve postfix/postdrop id uid
- redis uid conflicts with keys gid
- sshd uid conflicts with kmem gid
- tcryptd uid conflicts with openldap gid
- unifi uid conflicts with docker gid
- uptimed uid conflicts with utmp gid
- zope2 uid conflicts with connman gid
- tomcat uid/gid mismatch
This includes a slight refactor.
2014-11-24 - Snort 2.9.7.2
[*] New additions
* Application Identification Preprocessor, when used in conjunction with
open app ID detector content, that will identify application protocol,
client, server, and web applications (including those using SSL) and
include the info in Snort alert data. In addition, a new rule option
keyword 'appid' that can be used to constrain Snort rules based on one
or more applications that are identified for the connection.
See README.appid for details.
* A new protected_content rule option that is used to match against a content
that is hashed. It can be used to obscure the full context of the rule from
the administrator.
* Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to
more accurately process different portions of email messages and file
attachments.
* Added ability to test normalization behavior without modifying network traffic.
When configured using na_policy_mode:inline-test, statistics will be gathered
on packet normalizations that would have occurred, allowing less disruptive
testing of inline deployments.
* The HTTP Inspection preprocessor now has the ability to decompress
DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF
content from http responses when configured with the new decompress_swf
and decompress_pdf options. This enhancement can be used with existing rule
options that already match against decompressed equivalents.
* Added improved XFF support to HttpInspect. It is now possible to specify custom
HTTP headers to use in place of 'X-Fowarded-For'. In situations where traffic may
contain multiple XFF-like headers, it is possible to specify which headers hold
precedence.
* Added control socket command to dump packets.
* The Stream5 preprocessor functionality is now split between the new Session and Stream preprocessors.
* Added decoding capaiblity for Cisco FabricPath
[*] Improvements
* Update active response to allow for responses of 1500+ bytes that span
multiple TCP packets.
* Check limits of multiple configurations to not exceed a maximum ID of 4095.
* Updated the error output of byte_test, byte_jump, byte_extract to
including details on offending options for a given rule.
* Update build and install scripts to install preprocessor and engine libraries
into user specified libdir.
* Improved performance of IP Reputation preprocessor.
* The control socket will now report success when reloading empty IP Reputation whitelists/blacklists.
* All TCP normalizations can now be enabled individually. See README.normalize for details on using
the new options. For consistency with other options, the "urp" tcp normalization keyword now
enables the normalization instead of disabling it.
* Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.
* Updated profiler output to remove duplicate results when using multiple configurations.
* Improved performance of FTP reassembly.
Notable upstream changes:
- Support for multiple ports per task
- Records generated for mesos master nodes
- SRV records resolve to hostnames rather than IPs
- Query handling is now properly case-insensitive
- Better AAAA record handling
