Suricata 1.3.2 is out

Today we released Suricata 1.3.2. Not a big update, but there are some important fixes in the stream engine, fast_pattern:chop handling, HTTP multipart parsing and the flow keyword with “nostream”.

As the diff stat output shows, it’s a rather light maintenance update over 1.3.1: [sourcecode] ChangeLog | 12 ++ libhtp/configure.ac | 2 +- libhtp/htp.pc.in | 2 +- libhtp/htp/htp.h | 2 +- src/app-layer-htp-file.c | 145 ++++++++++++++++++++++++ src/app-layer-htp.c | 192 ++++++++++++++++++++++++++—— src/decode.c | 3 + src/decode.h | 1 + src/defrag.c | 4 +- src/detect-engine-content-inspection.c | 9 – src/detect-flow.c | 68 ++++++++++- src/source-af-packet.c | 9 ++ src/source-ipfw.c | 13 ++- src/source-pfring.c | 28 ++— src/stream-tcp-reassemble.c | 1 + src/util-cpu.c | 10 +- 16 files changed, 435 insertions(+), 66 deletions(-) [/sourcecode]

Only the HTTP changes look big, but that is due to adding some unittests. Same for flow keyword.

Because of the fixes updating is still highly recommended. Most fixes improve detection accuracy.

Full notes at our new website: http://suricata-ids.org/2012/10/03/suricata-1-3-2-available/