CVS log for snort/Makefile.am
	Help

Request diff between arbitrary revisions

* 2.8.0 beta prep.

* 2.8.0 beta prep.

* Fix configuration errors with prelude output plugin.
* Fix Stream4 Solaris problem
* Added new OpenBSD pflog support
* Added ETH_LOOPBACK statistics counter
* Merging docs, configure.in, Makefile(s), and rpm changes from 2.4 tree

* rpm/snort.spec
* rpm/generate-all-rpms
    Setup for 2.4.0 release, removed inline build option from RPM generation
    for the time being

* configure.in
* Makefile.am
* doc/Makefile.am
    Updated for 2.4.0 release to remove references to sig docs and rules,
    which are now external to the distro

* etc/snort.conf
    Updated snort.conf for 2.4.0 release

* Added check for MUST_SPECIFY_DEVICE #ifdef, which if used,
requires either a -i or -r commandline switch to start snort.  If
not used, current behavior remains (Marc Norton).
* Added support for prelude, enable with --enable-prelude. Thanks
Yoann Vandoorselaere!

* Added check for MUST_SPECIFY_DEVICE #ifdef, which if used,
  requires either a -i or -r commandline switch to start snort.  If
  not used, current behavior remains (Marc Norton).
* Added support for prelude, enable with --enable-prelude. Thanks
  Yoann Vandoorselaere!

* Moving contribs to www.snort.org

* Removed obsolete contribs, relocated to www.snort.org

* Fix makefile for release.notes

* sync with sforge current

* Bringing RC1 up to 2.1.1

* Fixed tab vs space problem on Solaris. Thanks for the report, Chad
  Kreimendahl!
* Fixed alert_once bug that was discovered by Kevin Amorin. Thanks for the
  help!

* Added perfstats.c utility for perfmon output parsing
* Added RELEASE.NOTES

* Added perfstats.c for perfmon parsing
* Added RELEASE.NOTES

* change to using a perl command to avoid permissions problems

* add rpm to 2.0 (JP Vossen <vossenjp@netaxs.com>
	          Daniel Wittenberg <daniel-wittenberg@starken.com>)

* Made content processing recursive (Shai Rubin)
* bug fixes for mwm.c (Thanks to Raul Siles & David Pereze)

* Major add/commit of 2.1 feature set...

  Will do a tag and then remove the "moved" files

* more build cleanups
* arpspoof stuff from jnathan
* marking as 2.0.2 beta

* adding verstuff.pl to ensure that the win32 version build # never
  becomes out of date again in an official "release"
* added verstuff.pl to dist-hook

* preprocessor telnet_decode: 21 23 25 119
* updated docs
* added contrib back to the tarball
* Your Ad Here (fees negotiable) :^)

* don't forget the sid-msg.map

* improved ICMP decoder ASCII output (BETA, someone hit with icmpsic please)
* tweaked and re-indented some of the decoder code
* added Phil Wood's code to improve stats calculation
* added Chris Green's code to improve frag2 options parsing
* added Chris Green's code to fix pattern match exit conditions

* fixed no-packet bug in spo_unified
* moved alert code in spp_frag2 around so that packet is logged for teardrop
  attacks

INCLUDES fixes.. (lets' make them configurable from a single place
(configure.in))

* all unstable/orphaned/unmaintained/deprecated code is getting the axe
  before we proceed to 2.0

* 1.9 "make it compile" commit

* Win32 code now gets built into the source tarball, may god have mercy on
  my soul

* fixed stupid crash bug in stream4_reassemble parser

* last minute check ins

* Added 47 rules from the guys at CGISecurity.com
* cleaned up Makefile.am

* added spo_log_null

* fixed casting bug in stream4
* fixed default logging dir for -b logging mode (set default dir before call
  to ParseCommandLine()
* Added check for Sparc CPUs to configure.in for 64-bit lovin'
* Added a all rules files to the Makefile.am

* added timestamping to the tag and event code
* moved the event struct declaration into its own file

* new and improved tag prune code

* tweaked the IP decoder, saw some weirdness with fragmented packets
* added rule to pick up winnuke
* new version of SnortSnarf
* added detect for teardrop/overlap DoS attacks to frag2

* added Id's to the SNMP alerters

* added SNMP plugin
* tweaks and cleanup in snort.conf

* IDMEF XML plugin installed by default now (activate with --enable-idmef)
* quieted down the database plugin
* fixed a crash bug in http_decode where the URI pointer would get a bad len
* tweaked the frag2 code, looks stable to me

* fixed crash bug in tag code

* turned off chatty tag code
* fix to crash reported by Colin Haxton in stream4
* turned on portscan detection reporting in stream4 code by defaul (snort.conf option)

* added new users manual

* 1.8 commit
* New arpspoof detection plugin from Jeff Nathan

* new IP defragmenter, this one is stable, doesn't leak, and uses a hell of a
  lot less memory, plus it's Marty-ware so it's got to be good...
* BTW, I wrote it in ~6 hours, new land speed record for writing an IP
  defragmenter I think. ;)
* other tweakage, stable smarter faster
* build 40

* added a needed file to the Makefile.am

* oops, forgot a file...

* splay tree lib added to make node lookups a hell of a lot faster
* tweakage throughout to improve performance
* added designations for stream4 and its alerts in generators.h
* other stuff... :)

* added new command line switch -k, sets checksum verification modes
* added new command line switch -z, used in concert with spp_stream4 it
  allows snort to perform stateful inspection and only fire alerts when
  packets that are part of an established TCP session come in
* added spp_stream4, experimental stateful inspection and stream reassembly,
  stil in the works, use at your own risk!

* deprecated spp_minfrag
* deprecated spp_tcp_stream
* deprecated spp_tcp_stream3
* deprecated avl_tree
* added headings in snort.conf for spo_unified
* tweaked other plugins in snort.conf
* made spp_unidecode the default unicode decoder for the time being

* Added the new Event data structure to move signature id/rev/generator data
  around in Snort
* some tweaks to the tag code
* modified syslog, fast and full alerters to display new event data
* added code to support new "SID" & "REV" built-in options, sid = snort rules
  ID number, rev = rule revision
* Generators are stored in generators.h file, generators indicate the subsystem
  within snort that's generating an alert
* preprocessor alert id's are also stored in generators.h
* turned off IP checksum generation by default, pretty much all routers drop
  IP packets with bad IP checksums
* other stuff, more fixes to come...

* New stream reassembler code (can handle more streams faster with fewer
  memory leaks)

* Added new rule protocol, "ip"
* Added checks for plugins to make sure they're only used with the proper
  protocols
* Added new detection plugin, ip_proto

* Added sp_priority to let people do prioritization and classification in rules
* Added sp_reference support to full & fast alerts
* Added sp_priority support to full & fast alerts
* new config directive added: "classification"

Automake fix.

* Many changes, read the diffs or see the mailing list

* Added TCP window size check

New debugging routines.

* Build 5
* Added big patch for str* functions from Eugene Tsyrklevich
* Added strlcat and strlcpy safe string functions (from OpenBSD)
* Added new safe malloc, free, error functions (see smalloc.h and fatal.h)

Misc changes to use the new tcp stream reassembly code.

* switched rules for libs

* Build 3
* updated man page from Brian Caswell
* http_ignorehosts added from Matt Wachinski
* enhanced some error messages for variable subst. code
* fixed SIGUSR1 stats dump to syslog on Solaris
* PID code now defaults to /var/run->/var/log-><logdir>
* couple other tweaks

MACOS support (lets try to commit it too ;))

* looks like another bug hunt...

* Added session and host tagging, Snort can now follow hosts causing alerts

SNORT 1.7 RELEASE

* Updated more documentation
* Added Silicon Defenses' IDMEF XML output plugin to the contrib directory

* Updated Copyright notice on all files
* copied the COPYING file to LICENSE so that people will know where to find it
* added check code to the parser to make sure people put ports in (even when
  they're writing icmp rules)
* Added a bunch of deserving people to the CREDITS file

* Added in Spade to the snort.conf file, added Spade reading material to
  the distro

* added Spade, changed configure.in to support it

* Phil Wood's mods for bidirectional rules, IP lists back to using []
* re-indented the code goddamn it!
* beta 8 check in

* Added sp_referrence plugin

BSD compatible makefile :) (old story ;))

Updated the latest version of ACID in /contrib.

Fixed compiler warnings in snort.c and spo_xml.h.
Added ACID and Spade in /contrib
Updated SnortSnarf in /contrib
Updated contrib/README

* Integrated Chris Cramers checksum patch
* Updated comments in decode.c & .h
* re-indented decode.c
* general fiddling around

* fixed snprintf issues on Tru64
* redefined all types in decoder to tighter definition on 64-bit architectures
* fixed configure scripts to include snprintf foo
* major tweakage in plugbase code for ioctls on various OSs
* XML plugin is still broken on OpenBSD with namespace collision in crypto code
* tcpdump plugin now automatically erases log file if not written to
* various comments and UID=0 checking added
* shaky beginnings at IP addres sets included as well, but non-functional

Got Makefile.am and Makefile.in in sync with the current state of
CVS so a "make distcheck" will work now.

We still need to update a number of files in contrib/ before we
do a 1.7 release.

October 2, 2000 - Let it be stated on the record that snort-1.7beta
                  is now capable of tcp stream reassembly. How about a
                  virtual high five to Christopher Cramer for making
                  this happen.

This update includes the spp_tcp_stream beta3 preprocessor from
Christopher Cramer and a fix for a minor crashbug in plugbase.c
found when testing this update.

* Added configuration option enabling user to connect the plugin to the
        alert or log facility
* Changed name from spo_log_database to spo_database
* Removed all old references to the log facility
* Fixed a logic error that prevented messages from the portscan preprocessor
        to be logged.

Moved `resp' keyword into detection/keywords base. It isn't really detection
but it speeds up response, which makes difference if machines scanned, are connected
to the same ethernet network (so even short delay makes difference for nmap f.e).

Starting the process of bring the CVS tree in sync with the 1.6.4-beta1
code. Note there is still one differing section in README. I don't know
which of the two is newer.

This commit includes the following updates.

  CREDITS (added material from 1.6.4 beta)
  ChangeLog (Updated ChangeLog with stuff from 1.6.4 release)
  Makefile.am (added mans_MAN variable)
  Makefile.in --- results of running automake on new Makefile.am
  NEWS (Updated news with stuff from 1.6.4 release)
  README (still one different section in README -- not sure which
          one is the most up to date)
  RULES.SAMPLE (changed URL)
  acconfig.h  (added #undef NEED_DECL_PUTC)
  config.in.h (added #undef NEED_DECL_PUTC)

`tos' keyword support (code from  Erich Meier <Erich.Meier@informatik.uni-erlangen.de>)

Just adding the files in /contrib that were just comitted.

Makefile.am - added spo_xml.c and spo_xml.h
              also modified the file to have multiple lines (thus making
              it more readable and editable)
plugbase.c  - added one line for XML plugin
              added a null check in the str2s routine to avoid a possible
                    core dump condition
plugbase.h  - added one line for XML plugin
spo_xml.c   - new file just added
spo_xml.h   - new file just added

The XML plugin will be shortly moved to Fyodors new directory structure.
I did the commit now because people have been asking for it.

Initial Import

Initial revision