+++ /dev/null
-128
--- fixed RangeCheck
--- doc tweaks, defined peg count
--- ensure fp_length / fp_offset are applied correctly
--- allow \a\b\f\n\r\t\v in content strings
--- fixed capture for prune counts
--- don't fp only when following option is relative
--- fixed implied equal range checks (ie just a #, no op)
--- fixed !content
--- support \xFF style hex chars in content strings
--- fix icmp session cleanup counting
--- fix null flow_con in print mode
--- fixed udp session timeout counting
--- patched around shutdown issue after reload
--- fixed calls to Inspector::tterm()
--- snort2lua updates from josh
--- suppress repeated 129:20 on same session
--- fixed legacy HI scanner events
--- fixed whitelist / blacklist enforcement
--- josh fixed a decoding issue affecting fragged packets
--- fixed byte_test config of compare value
--- fixed byte_test endian
--- flush available data for non-paf splitters
--- fixed inspector reinit
--- fixed byte_extract and byte_jump endianisms
--- suspend active when purging caches
--- temporary support for legacy paf_max
--- zero frag tweak from josh
--- fix / redefine --dirty-pig - no shutdown flushes
--- fixed pcre reload init
--- refactored main init / reload code
--- fixed cmake -ldl issue
--- fixed normalization broke by the init/reload refactoring :(
--- fixed 296-9 tcp segfault
--- update from josh
--- ensure stream normalizations get proper header iff needed
--- fixed stream_reassemble.direction
--- initial integration of hosts into binder
--- don't log redecode events (from shutdown rebuilds)
--- changed normalizer ip4.base and tcp.base to default to true
--- session flag clean up
--- fix wizard dtor
--- fixed norm module handling of tcp opts
--- fixed ecn normalization
--- fixed pm backtracking
--- tweaked build doc foo
--- gak! - fixed conf slots
-
-127
--- REG_TEST out logging tcp options for rebuilt packets to match snort bug
--- tweaked S5_TRACE output for consistency
--- disabled new_http_inspect from REG_TEST (accidentally enabled)
--- squelch 129:9 and 129:10 if link addrs are swapped
--- tweaks from Josh
--- tweaked inspector execution
--- fixed parsing of reference with \;
--- fixed ips classtype segfault on ctor after parse error
--- new_http_inspect now gid 219 and other Tom Tweaks
--- new_http_inspect reactiveated (no longer REG_TEST only)
--- ip defrag fixes from Josh
--- added default bindings for stream only configs
--- added --warn-all
--- refactored normalizer flags
--- fixed port_scan logfile to default to off
--- fixed flowbits init
--- fixed byte extract var init
--- changed doc to use "legacy" instead of "classic"
--- restricted reload to basic modules and inspectors only
--- commented out snort.process() and snort.reload_hosts() for alpha 1
--- codec fix from Josh
--- prevent repeated small chunk length alerts from HI
--- fixed normalization config init
--- fixed block etc. rule parsing
--- added comment for binder bug
--- fixed non-paf splitter init
--- fixed splitter update calls
--- fixed boyer-moore init
--- removed content extract var cruft
--- latest from Josh
--- initial /* comments */ for text rules (needs to ignore \")
--- latest from Josh
--- added --c2x and --x2c since i'm tired of looking this stuff up!
--- added hi event squelch
--- fixed stream_ip defaults
--- fixed binder[2] = { { when = { }, user = { } } } (extra { })
--- fixed static flush points
--- added stream_tcp.segs_split peg
--- snort2lua patch
--- changed from 2.10 to 3.0
-
-126
--- pulled latest from tom
--- added paramaters to doc reference section
--- flow state updates
--- plug tcp session leak
--- fix paf abort to resume with atom splitter
--- delete bogus code introduced into hi paf
--- ip defrag fixes
--- refactored splitter fallback
--- fix binder.use.service
--- refactored flow state
--- latest from tom and josh 10/22 15:27
--- doc tweaks
--- fixed flow reset ordering of operations
--- changed stream to not generate rebuilt packets when the splitter doesn't
- reassemble packets (ie nhttp internal buffers)
--- added rebuilt buffers count
--- fixed partial flushes
--- fixed use of bytes copied vs actual length
--- patched force flushes to do memcpy
--- patched session clear flushed to be forced
--- fixed up --dump-defaults so that it can be validated unedited
--- fixed normalizer init of flow
--- pulled latest from Tom
--- removed force from session clear
--- updated http_server/inspect defaults
--- updated binder to bind data, session, and gadget
--- http_inspect -> http_global, http_server -> http_inspect,
- nhttp_inspect -> new_http_inspect
--- REG_TEST patches to make -A cmg look more like Snort
--- adding some FIXIT-H-J due to segfaults
--- removed REG_TEST http_server; now http_global/inspect only
--- added missing ip|tcp|udp|icmp options to checksum_drop/eval
--- pulled in latest from Josh
--- pulled in HI defaults patch from Bhagya
--- refactored inspector groups
--- moved normal_mask out of flow into inspector policy
--- patched around flow key issue with icmp ipproto vs pkt type
--- changed builtin rules to rev:1; priority:3;
--- update from Josh to fix codec FPs
--- added REG_TEST support for -N (ignored) and -A console (alert_fast)
--- tweaked alert_fast whitespace
--- fixed stream is-paf? bug
--- set default id and priority based on class
--- fixed segfaults due to unitialized cleanup_pkt and unset stream_tcp
--- matched up stream_tcp.policy enum with defines
--- tweaked S5_TRACE output
--- streamlined session restart handling
--- changed #begin & #end to have to start beginning of line
--- fixed alert_fast to default to not print payload
--- fixed tcp options log format
--- fixed bogus 120:3 alerts
-
-125
--- discovered can't catch exceptions thrown from Lua to C++; need to
- build liblua differently
--- changed most static const char* s to #define s or static const char*
- const s
--- updated style guide - please read and follow or comment on it!
--- silenced bogus -O2 warnings
--- updated ChangeLog terms; added env vars
--- latest from Tom
--- minor doc updates
--- converted fast pattern errors to warnings
--- add check for null gadget in binder
--- remove cruft from fast pattern config
--- updates from tom and josh
--- renamed doc/tips.txt to doc/start.txt for users getting started
--- added doc/features.txt for configure features that must be explicitly
- enabled
--- added --enable-shell and BUILD_SHELL to opt in to --shell and -j
- functionality
--- latest snort2lua updates from Josh
--- added cursor to so:eval function to match IpsOption::eval()
--- added --rule-to-hex and --rule-to-text to generate protected and
- unprotected so rules
--- latest from tom
--- fixed explicit stream_* bindings
--- latest from josh - snort2lua changes
--- added override to most derived virtual declarations
--- update from josh
--- adding sid_18758.h back to extra/src/so_rules/ so that makes work
--- fixed enum, select, and multi validation
--- fixed some bogus semantic warnings from xcode
--- update from josh
--- updated doc
-
-124
--- valgrind cleanup
--- fixed incorrect casting of ftp, ftp-data, and telnet flow data
--- fixed reload_config()
--- tweak error for x = { 1 } where x is a table not a list
--- some make distcheck fixes (still broken)
--- changed version to 2.10.0 and build to 123
--- removed --enable-sourcefire and reformatted configure --help
--- removed obsolete etc/ and its unicode.map and attribute_table.dtd
--- josh's changes for snort2lua config binding by file
--- fixed stream_icmp flow key init
--- added --warn-flowbits
--- tweaked flowbits counts start up output
--- updates to snort.lua and snort_defaults.lua
--- fixed stream_icmp counts
--- added markup for signal help and put in doc
--- change snort.lua normalize to normalizer
--- change parse time LogMessage("WARNING...") to ParseWarning()
--- changed --enable-perfprofiling to --enable-perf-profiling
--- changed --enable-profile to --enable-gprof-profiling
--- added --warn-unknown to warn about unknown symbols
--- added SNORT_IGNORE env var to ignore unkonwn symbols
--- commented out ppm, profile, and normalizer in snort.lua since these
- require special conditions to be enabled
--- added --dump-defaults to get Lua formatted defaults
--- split doc for modules into separate sections by type
--- reworked manual again to include terms and lists of modules and plugins
--- added non-Lua error message
--- updated .gitignore and sorted it
--- fixed --help, etc.
--- added doc sections for snort2lua, new http, binder, and wizard
-
-123
--- refactored documentation
--- changed max_ip6_options to max_ip6_extensions to avoid confusion
--- disabled markup sanitizer() for correct asciidoc results
--- tweaked snort.lua and snort_defaults.lua
--- updated usage
--- removed ! from error messages
--- fixed command line vs conf output configs
--- moved log_tcpdump to log_pcap
--- changed all output filename configs to be based on module name
--- fixed -K handling
--- fixed laulert when rule has no msg
--- made some packet data available to alert_luajit
--- fixed flow init when not bound
--- tweaked stats output - no section if all counts zero
--- fixed pause/resume
--- comment out assert that doesn't apply to alert_sf_socket
--- split parse warning count out of error count
--- added workaround and FIXIT-T for nhttp test
--- added path to dynamically loaded plugins output with --list-plugins
--- commented out mpse start up foo - needs reformatting
--- added snort.detach() and fixed -j parsing
--- various parsing changes for improved error handling
--- fixed some Xcode analyzer issues
--- pulled in cmake updates from Josh
--- pulled in nhttp updates from Tom
--- applied cmake inc dir order patch from Josh
-
-122
--- pulled thread pinning from Josh
--- snort.lua tweaks to back out random test foo
--- additional valgrind tweaks
--- fixed several Xcode static analysis warnings
--- updated config_changes
--- commented out pcre_free_study() - issue on mac
--- more refactoring of tcp session - still incomplete
--- patched cd_tcp.cc and packet_manager.cc for length underflow issue
--- fix active.max_responses default, etc.
--- always change both directions to atom splitter
--- fixed byte_extract leak, session flow data leak
--- changed pcre JIT to be optional by #define; need autofoo
--- added support for name / type bindings
--- added value type checks
--- updated tips
--- updated stream_tcp counts
--- fix -A log_null etc (ie w/o module)
--- fixed --help-module format for asciidoc (again)
--- tweaked snort.lua snort_defaults.lua
--- parsing fixes
--- updated config_changes.txt
--- fixed doc format and added errors.txt
--- revised help options (again) to be more consistent with other (gnu style) programs
--- added overview page to documentation
--- pulled in latest from Josh
--- reworked pkt type vs proto bits
--- updated builtin rules for consistent format
-
-121
--- valgrind fixes
--- basic reload restoration
--- support cmd() form of snort.cmd()
--- misc FIXITs
--- converted wizard to fully stateful
--- implemented paf rescan upon auto service id
--- changed StreamSplitter::max() from uint32_t to unsigned
--- changed stream_tcp.paf_max to max_pdu
--- added parse errors for module begin()/end() fails
--- changed reload to not fatal on parse errors
-
-120
--- tweaked --help!
--- added unused stringify(enum)
--- fixed piroir typo
--- fixed normalizer.tcp.ips
--- pulled in latest from Josh
--- fixed valgrind issues
--- refactored Shells to support multiple files/policies
--- changed detect reset to accommodate buffer population before reassembly
--- initial multiple policy binding
--- pulled in codec Makefile fix from Josh
-
-119
--- updated binder
--- fixed packet direction
--- added default service bindings when wizard is configured but binder is not
--- updated snort.lua
--- added snort_defaults.lua
--- latest from Josh
-
-118
--- fixed bind action
--- tweaked main loop
--- added module 1-line help
--- latest from josh
--- added plugin 1-line help (should be same as module, if plugin has module)
-
-117
--- added --stdin-rules
--- added #begin / #end comments for rules
--- changed PAF_Status to StreamSplitter::Status
--- removed target reader current host/app
--- fixed error / warning line number issue
--- changed --conf-error-out to --pedantic
--- more FIXIT-H fixed
--- removed process.plugin_path and process.script_path since they are
- needed ahead of parsing
--- added idle processing, though still as sketchy as Snort until alpha 2
--- pulled latest from Josh - snort2lua tweaks and ... hidden symbols, yay!;
--- made ips_dsize static only and changed RangeCheck to SO_PUBLIC so we can
- use just one copy
-
-116
--- fixed valgrind leak
--- observed memory corruption on Linux when loading dynamic plugins
- (not fixed)
--- fixed action leak
--- testing visibility=hidden
--- more FIXITs
--- fp related FIXITs
--- deleted profile.rules.file and profile.modules.file
--- deleted alerts.alert_file
--- changed --help to just cmd line options and added --help!
--- fixed Xcode warnings
--- fixed sflsq cursor
--- additional cleanup
--- fixed --max-threads configuration
--- fixed PKT_RESIZED bits
--- pulled the latest from Josh
-
-115
--- remove share.h
--- misc FIXITs
--- refactored cmd line parsing and moved options to SnortModule
--- prioritized all FIXITs; FIXIT-J are for josh to reprioritize
--- got latest from Josh
-
-114
--- more FIXIT cleanup
--- fixed flush bucket dumping
--- fixed cmake ips_replace.h
--- refactored script support
--- added lua logger support
--- added extra lualert (alert.lua) to demo lua loggers
--- updated snort.lua
--- pulled in Tom's latest as of 08/20-11:45
-
-113
--- initial FlushBucket implementation
--- converted ips_resp and ips_react to actions
--- implemented byte code parser to replace bad juju in ips_content and
- ips_replace
--- stream workarounds for new packet / protocol foo and shutdown sequencing
--- fixed end of rule parsing to not require ; and recognize incomplete rules
--- fixed executing a command while paused
--- added act_replace
--- eliminated generators.h
--- misc FIXIT cleanup
--- made ac_bnfa/q mpse static only so dynamic build runs w/o any plugins
-
-112
--- initial action plugin - reject
--- added total to StreamSplitter::reassemble()
--- removed StreamTcpModule ports and protos settings
-
-111
--- fix up luajit ips rule option
--- fix up rule loading
--- fixed so rule parsing
--- added pcre jit
--- fixed --help-module to use exact match on module for params instead of
- prefix
--- added ParseAbort() so ParseError() doesn't fatal immediately
--- fixed ftp_client.bounce_to handling in module
-
-110
--- converted rule meta options to ips options (w/o eval)
--- rewrote rule parsing
--- split so manager out from ips manager
-
-109
--- changed --help to give overview of help
--- fixed stream_ip alerts (defrag -> stream_ip)
--- added missing help to parameters
--- pulled in latest from Josh
--- added Flow* to StreamSplitter::reassemble()
-
-108
--- added IpsAction for ips rule action plugins
--- renamed various api *init() and *term() for consistency and possible
- move to base api
-
-107
--- fixed stats output
--- deleted code that skipped over TCP urgent data when flushing
--- added StreamSplitter::reassemble() etc for PAR
--- updated ppm output to use stats functions for consistency
--- fixed old HI chunk splitting
--- changed stream tcp to use StreamSplitter::reassemble() instead of
- direct memcpy()
--- several new Xcode warnings cleaned up (mostly unused funcs)
--- fixed dynamic build of ips options
-
-106
--- converted fpdetect.cc to pull fast pattern buffers from inspector gadget
-
-105
--- changed PREPROC to MODULE in profiling defines
--- added --rule "<rule>" for easy command line testing
--- added --list-plugins to see which plugins don't have modules
--- added helpers/markup.{h,cc}
--- added optional header selector to http_header
-
-104
--- changed configure --with-libpcre-* to --with-pcre-* for consistency
--- same for pcap (again!)
--- made ppm and perfprofiling disabled by default in configure.ac
--- added stream_size and stream_reassemble ips options
-
-103
--- added modules to ips options
--- removed ips option sameip which was obsoleted by 116:152
--- content args offset, depth, distance, and within must be followed by a
- space not a colon
--- latest snort2lua updates from josh
-
-102
--- moved stats (peg counts) to module
--- removed sum() and stats() from InspectApi
--- tweaked --help-module
-
-101
--- tweaked startup output
--- fixed pattern matcher
--- pulled in latest from Tom
-
-100
--- adding profiling to module
--- profile.preprocs is now profile.modules
-
-99
--- updated wizard
--- removed service / app id from inspectors
-
-98
--- initial wizard implementation
-
-97
--- latest from Tom
--- some valgrind fixes
-
-96
--- finished default fp selection
--- added NHttpInspect::get_buf() and related
-
-95
--- added some wizard module foo
--- fixed cmake build with static inspectors for wizard and binder
-
-94
--- pulled in latest from Tom
-
-93
--- updated example inspector dpx.cc api
--- misc tweaks
--- changed binder to inspector with designated type
--- added prototype wizard inspector for service selection magic
--- fixed plugin instantiation when top level table is a list
--- changed http_inspect to optionally build dynamically
-
-92
--- fixed fast_pattern only auto configuration
--- more detection buffer cleanup
-
-91
--- eliminated more RULE_OPTION_TYPE_*
--- converted remaining rule options over to use cursor
--- added IpsOption CursorActionType
--- finally eliminated doe_ptr and friends ... yay!
--- merged ips_option_base64_{data,decode}.cc
--- fast_pattern_only (previously fast_pattern:only) is gone
-
-90
--- added InspectApi.buffers and Inspector::getbuf()
--- changed http_* rule options to use Inspector::getbuf()
--- changed luajit rule option to use the cursor
-
-89
--- pulled in the latest from tom and josh
-
-88
--- overhauled content and pcre detection to use Cursor
--- http_* are now first class rule options
--- removed experimental contents and get_buf() from InspectApi
--- changed call to acquire daq with count 0 (all)
--- changed replace to be 1st class rule option
--- split boyer-moore functions out of mstring module
-
-87
--- renamed api function typedefs to camel case for consistency and to match
- style guide
--- fixed some Xcode static analysis issues
--- removed http_encode rule option
--- removed ftpbounce rule option
--- removed examples/
--- pulled in latest from Tom with start line changes
-
-86
--- pulled in tom's latest nhttp_inpsect code
-
-85
--- swapped use of range and deflt for PT_TABLE and PT_LIST Parameters
- (Parameter* is now in range so that deflt may be used for tabl/list
- defaults)
--- removed -b, -N, -Z and, --perfmon-file options
--- removed uricontent ips rule option
--- added contents and getbuf to InspectApi for content buffers
-
-
-84
--- pulled in latest codecs
--- removed src/mempool/
--- converted attribute table from xml to lua
--- removed lex/yacc foo from configure.ac
-
-83
--- fixed linux linker ordering
-
-82
--- fixed atom splitter instantiation for fallback in tcp_session.cc
-
-81
--- deleted service registration for paf
--- added StreamSplitter to Inspector
--- added service name to InspectApi
--- deleted ports configs from inspector
--- added port-based bindings lookups
-
-80
--- deleted port monitor foo; will be obviated by binder
--- removed ttl norm checks from codecs; made no sense; drop iff rule is drop
--- moved stream_* bindings to binder
--- removed --enable-inline-init-failopen, --enable-pthread, --enable-ha
-
-79
--- pulled in latest codecs
-
-78
--- deleted ha code; too much churn to support now
--- refactored session and related
--- changed inspector api (priority -> type, purge -> get ssn)
-
-77
--- pulled in josh's changes to make on Linux
--- updated snort.lua for bindings
-
-76
--- moved all src/*.{h,cc} except main.{h,cc} to src/main/
--- updated prototype bindings
--- Xcode warnings cleanup
--- added basic git commands to doc
--- codec updates
-
-75
--- added back InspectApi.pinit() and InspectApi.pterm()
--- eliminated InspectApi.stop()
--- changed signature to Inspector::configure()
--- Inspector::init() and term() are now pinit() and pterm()! beware!
- (for consistency with naming scheme)
--- other changes to InspectApi / Inspector per comments in header
-
-74
--- started this ChangeLog for internal use only
--- fixed -A none and -K none
--- more refactoring of ftp/telnet and modularization
--- changed lua/*.lua to EXTRA_DIST to avoid installation overwrites
--- updated snort.lua wrt the legacy include - read comments therein
-
projects / thirdparty / snort3.git / commitdiff
