changelog

关于网络渗透技术的详细讲解

    * src/fpdetect.c:
      Return value for fpEvalPacket and reset BITOP array on HTTP 
      pipelines (Marty/Roelker).

    * src/generators.h:
    * src/preprocessors/HttpInspect/client/hi_client.c:
    * src/preprocessors/HttpInspect/client/hi_client_norm.c:
    * src/preprocessors/HttpInspect/event_output/hi_eo_log.c:
    * src/preprocessors/HttpInspect/include/hi_eo_events.h:
    * src/preprocessors/HttpInspect/include/hi_ui_config.h:
    * src/preprocessors/HttpInspect/normalization/hi_norm.c:
    * src/preprocessors/HttpInspect/user_interface/hi_ui_config.c:
      Added non-rfc chunk length encoding support, thanks for pointing it out
      H.D. Moore, and added webroot alert which alerts on webroot directory
      traversals (Roelker).

    * src/debug.h:
    * src/preprocessors/Makefile.am:
    * src/preprocessors/spp_stream4.c:
    * src/preprocessors/spp_stream4.h:
    * src/preprocessors/stream.h:
      Added new TCP state engine (Marty).

    * src/output-plugins/spo_unified.c:
      Added stream packet logging for unified output, when alerting on
      rebuilt streams (Marty). 

    * src/preprocessors/spp_conversation.c:
      Fixed conversation parsing faults so users can operate this 
      preprocessor (Roelker).

    * src/snort_packet_header.h:
      Added for future support (Marty).

    * src/snort.h:
      Now on build 25.
      
>>>>>>> 1.326
2004-02-25 Jeremy Hewlett <[e-mail]>

    * src/output-plugins/spo_csv.c:
      Additional fixes from Alan Milligan with CSV output, thanks!

    * src/sfutil/bitop.h:
      Cleaning up unsigned/signed warnings

    * src/snort.h:
      Moving to build 24

2004-02-25 Chris Reid <[e-mail]>

    * src/output-plugins/spo_database.c:
      Removed escaping of '%' and '_' characters in MySQL (thanks
      Kristofer Karas).

2004-02-23 Jeremy Hewlett <[e-mail]>

    * snort.8:
      Updated -T info to include where snort looks for "snort.conf." Thanks
      Drew Smith for pointing that out.

    * doc/snort_manual.tex:
      Doc updates for thresholding - rule thresholds must contain a sid.

    * src/detect.c:
    * src/plugbase.c:
      Changed some startup messages from printf to LogMessage to be more
      consistent. Thanks for the patch, nnposter(at)users.sourceforge.net.

    * src/snort.h:
      Touched source code - bumping to 23

2004-02-17 Jeremy Hewlett <[e-mail]>

    * src/output-plugins/spo_csv.c:
      Fixed minor problems with CSV output not printing out src,srcport, 
      dst,dstport properly.  Thanks for the patch, Bill Guyton. Good spot!

    * src/snort.h:
      Now at build 22

2004-02-13 mfr <[e-mail]>
    * templates/sp_template.h:
    * templates/sp_template.c:
    * templates/spp_template.h:
    * templates/spp_template.c:
      Updated to match the current reality of Snort.

2004-02-10 Jeremy Hewlett <[e-mail]>

    * src/bounds.h:
    * src/event.h:
    * src/signature.h:
      Added fix for compiling on Tru64 - bitypes.h now wrapped in an ifdef.
      Thanks Hari Gopal and Darryl Cook for pointing out the problem and 
      testing.

    * etc/snort.conf:
    * doc/snort_manual.tex:
      Various fixes pointed out by JP Vossen and Felipe Franciosi.

2004-02-09 Jeremy Hewlett <[e-mail]>

    * src/Makefile.am:
      Removed unnecessary libintsnort.a, which was causing problems for some
      trying to compile on Solaris without the default system tools (ie: the
      "ar" problem).

2004-02-05 Jeremy Hewlett <[e-mail]>

    * Makefile.am:
      Fixed tab vs space problem on Solaris. Thanks for the report, Chad
      Kreimendahl!

2004-02-05 Daniel Roelker <[e-mail]>

    * src/preprocessors/flow/portscan/flowps.c:
    * src/preprocessors/flow/portscan/flowps_snort.c:
      Fixed alert_once bug that was discovered by Kevin Amorin.  Thanks for
      pointing out the particulars of the problem, so we could do a quick
      fix.

2004-01-30 Daniel Roelker <[e-mail]>

    * src/decode.h:
    * src/detection-plugins/Makefile.am:
    * src/detection-plugins/sp_flowbits.c:
    * src/detection-plugins/sp_flowbits.h:
    * src/parser.c:
    * src/plugbase.c:
    * src/preprocessors/flow/flow_cache.c:
    * src/preprocessors/flow/flow_cache.h:
    * src/preprocessors/flow/flow.h:
    * src/preprocessors/spp_flow.c:
    * src/preprocessors/spp_flow.h:
    * src/sfutil/bitop.h:
    * src/snort.c:
      Added Flowbits detection functionality.  Thanks Brian Caswell for
      initial code prototype.

    * src/sys_include.h:
    * src/ubi_BinTree.c:
    * src/ubi_BinTree.h:
    * src/ubi_SplayTree.c:
    * src/ubi_SplayTree.h:
      No more Log variables.  Die, die, die . . .

2004-01-21 Jeremy Hewlett <[e-mail]>
    
    * contrib/perfstats.c:
      Added utility to parse out perfmon stats

    * RELEASE.NOTES:
      Added file to keep track of release notes. ChangeLog will migrate to
      more detailed, code-oriented comments.

2004-01-20 Jeremy Hewlett <[e-mail]>

    * src/detect.c:
      Tagged Packets no longer have NULL msg name.

    * src/output-plugins/spo_csv.c:
      Minor CSV fixes from Elias Levy (Thanks Elias!)

    * doc/snort_manual.pdf:
    * doc/snort_manual.tex:
      Minor LaTeX fixes from Jen Harvey (Thanks Jen!)

2004-01-16 Jeremy Hewlett <[e-mail]>

    * src/decode.h:
    * src/preprocessors/spp_stream4.c:
      Fixed http_inspect double alerting on pkts and rebuilt streams.  (Thanks
      Andreas Ostling)

    * src/detect.c:
      Fixed double incrementing of pc.log_pkts on non-rule events.

    * src/detect.h:
       Removed duplicated SnortEvent() function.

    * src/event_wrapper.c:
      Added additional checks to GenerateSnortEvent().

    * src/preprocessors/HttpInspect/client/hi_client.c:
    * src/preprocessors/HttpInspect/include/hi_si.h:
    * src/preprocessors/HttpInspect/session_inspection/hi_si.c:
    * src/preprocessors/snort_httpinspect.c:
      http_inspect proxy_alert now supports normal proxy networks setups.
      http_inspect default server only valid if specified in config. (Thanks
      Brent Erickson)

    * src/snort.c:
      Error on multiple interfaces on command line.
      Corrected pcap_compile error.  (Thanks Andreas Ostling).

    * src/output-plugins/spo_csv.c:
      Added string escaping for the msg.

2004-01-13  Chris Reid  <[e-mail]>

    * Added Oracle support into Win32 version.  Much appreciation
      to Adam Peterson and SPL Worldgroup Inc. for sponsoring this
      development!  This option will now be available within the
      Win32 installer thanks to their contribution.

2004-1-13 Jeremy Hewlett <[e-mail]>

    * src/detection-plugins/sp_session.c:
      Fixed vague error message with directory creation problems (Thanks
      Kenneth Ingham)

    * src/event_wrapper.c:
    * src/event_wrapper.h:
    * src/preprocessors/flow/flow.c:
    * src/preprocessors/flow/flow_cache.h:
    * src/preprocessors/flow/flow_callback.h:
    * src/preprocessors/flow/flow.h:
    * src/preprocessors/flow/flow_stat.c:
    * src/preprocessors/flow/flow_stat.h:
    * src/preprocessors/flow/portscan/flowps.c:
    * src/preprocessors/flow/portscan/flowps.h:
    * src/preprocessors/flow/portscan/flowps_snort.c:
    * src/preprocessors/flow/portscan/scoreboard.c:
    * src/preprocessors/flow/portscan/scoreboard.h:
    * src/preprocessors/flow/portscan/server_stats.c:
    * src/preprocessors/flow/portscan/server_stats.h:
    * src/preprocessors/flow/portscan/unique_tracker.c:
    * src/sfutil/util_net.c:
    * src/sfutil/util_net.h:
      Fixed compilation problems on Solaris and some versions of BSD.
      Thanks to the Snort community for your support. These fixes change the
      variable type to u_int32 to remove the need for stdint.h

    * src/output-plugins/spo_alert_unixsock.c:
      Close Socket when Snort receives SIGHUP (Based on patch submitted by
      Neetu Nangia)

    * src/output-plugins/spo_csv.c:
      Added GID, SID, and Rev to csv output (Thanks Brennen Reynolds)

    * src/output-plugins/spo_log_tcpdump.c:
    * src/output-plugins/spo_unified.c:
    * src/preprocessors/perf-base.c:
    * src/preprocessors/spp_stream4.c:
      Fixed build warnings on FreeBSD 5.0

    * src/parser.c:
      config chroot readded

    * src/parser.c:
    * src/parser.h:
      Added additional error checking for custom rules (Thanks Andreas
      Ostling)

    * src/preprocessors/flow/flow_print.c:
      Flow now honors -q (quiet)

    * src/preprocessors/HttpInspect/client/hi_client.c:
    * src/preprocessors/HttpInspect/normalization/hi_norm.c:
      Fixed issue with no_alert not quieting some alerts

    * src/preprocessors/HttpInspect/user_interface/hi_ui_config.c:
      Removed non_rfc_chars from default profiles

    * src/sfthreshold.c:
    * src/sfutil/sfthd.c:
    * src/sfutil/sfthd.h:
      Added suppression negation (Thanks Andreas Ostling)

    * src/sfthreshold.c:
      Fixed backwards display of IP addresses on Solaris

    * doc/FAQ:
    * doc/README.csv:
    * doc/README.http_inspect:
    * doc/README.thresholding:
    * doc/snort_manual.pdf:
    * doc/snort_manual.tex:
      Minor clarifications and additions.

2004-1-5  Daniel Roelker <[e-mail]>

    * src/fpdetect.c:
      Fixes the signature error that user's were getting after changes
      to the AddMatch and SelectEvent routines.  Thanks Andreas Ostling,
      Ron Shuck, Jon Hart, and Chris Keladis.

2003-12-22  Daniel Roelker <[e-mail]>

    * src/parser.c:
      Andreas Ostling parser fixes and updated error messages.

2003-12-20  Chris Reid  <[e-mail]>

    * Win32 version wouldn't run as a service.  Thanks to
      Michael Steele for pointing this out.

2003-12-17  Chris Reid  <[e-mail]>

    * Updated Win32 to 2.1.
    * src/output-plugins/spo_database.c:
      Better support for ODBC.  Better memory management (thanks
      Jeff Nathan).  Improved escaping of SQL strings.

2003-12-17  Daniel Roelker <[e-mail]>

    * Snort 2.1 Release

    * src/decode.h:
      Options struct element len, changed to octet.  Thanks
      Andrew Rucker.

    * src/detection-plugins/sp_pattern_match.c:
      Infinite looping patch during specific recursion processing.
      Thanks Lawrence Reed.

    * src/detection-plugins/sp_pcre.c:
      Fixed pcre URI matching.  Thanks Jeremy Hewlett.

    * sp_respond.c:
      Fixes to help respond actions to correlate more closely to
      RFCs and now doesn't allow users to shoot themselves in
      the foot.

    * src/preprocessors/HttpInspect/normalization/hi_norm.c:
      Only log DOUBLE DECODE alerts if it's in the URL and not
      the parameter section.

    * src/preprocessors/spp_stream4.c:
      Sync stream4 up with the various versions of it.  Fix
      problem of out-of-order ACKS that was recognized by
      Andrew Rucker.  Also fixed off-by-one bug on reassembled
      streams that was introduced by previous stream4 patch.

    * src/sfutil/mwm.c:
    * src/sfutil/mwm.h:
      Fixed memory access bug in mwm content matching that multiple 
      users were able to reproduce. 

    * src/tag.c:
      Pkt tagging configuration now works correctly.  Thanks Jeremy
      Hewlett for pointing this out.

2003-12-08  Chris Reid  <[e-mail]>

    * Updated Snort 2.1 Win32 installer
    * Updated spo_database.c to escape sensor name strings.
      This had been causing a problem under Windows with MySQL
      because of WinPcap sensor names having embedded backslashes.

2003-12-03  Chris Reid  <[e-mail]>

    * Updated Snort 2.1 beta to support Win32

2003-11-18  Daniel Roelker <[e-mail]>

    * src/detection-plugins/sp_ip_proto.c:
      Re-added ip_proto structure to ds_list so that the high-speed
      detection engine once again optimizes on ip_proto rules.

2003-11-14  Chris Green  <[e-mail]>

	* src/preprocessors/flow/portscan/flowps_snort.c:

	  * wh