From a83eeb288b207321e711d38a88dfb8a6a1edbb66 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Tue, 21 Jan 2025 09:21:24 -0500 Subject: [PATCH] doc/csum: Stream checksum validation change Describe the change of behavior between the stream.checksum-validation setting and checksum-based rule keywords. --- doc/userguide/upgrade.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index 4bf74b65284..f5df98100fb 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -82,6 +82,13 @@ Major changes - Unknown requirements in the ``requires`` keyword will now be treated as unmet requirements, causing the rule to not be loaded. See :ref:`keyword_requires`. +- The configuration setting controlling stream checksum checks no longer affects + checksum keyword validation. In Suricata 7.0, when ``stream.checksum-validation`` + was set to ``no``, the checksum keywords (e.g., ``ipv4-csum``, ``tcpv4-csum``, etc) + will always consider it valid; e.g., ``tcpv4-csum: invalid`` will never match. In + Suricata 8.0, ``stream.checksum-validation`` no longer affects the checksum rule keywords. + E.g., ``ipv4-csum: valid`` will only match if the check sum is valid, even when engine + checksum validations are disabled. Removals ~~~~~~~~