2003-02-23  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_rpc_decode.c (PreprocRpcDecode):
	   - alignment errors on non-x86 platforms
	   - added new space delimited options
             alert_fragments
             no_alert_multiple_requests
             no_alert_large_fragments
             no_alert_incomplete
	   - corrected buffer overflow in fragment normalization

2003-02-19  Chris Reid  <chris.reid@codecraftconsultants.com>
    * src/snort.c
       - Win32 '-s' parameter wasn't configured to accept an optarg,
         but code expected one, causing null-pointer violation.

2003-02-14  Chris Green  <cmg@sourcefire.com>

	* Backport of 2.0 fixes for stream4 ( off by one errors on reassembly )

2003-02-02 Chris Reid <chris.reid@codecraftconsultants.com>
    * src/snort.c
        Added sanity checks on command-line parameters, for whenever a user
        forgets to put spaces between (ie.) /SERVICE/INSTALL.  This only
        applies to /SERVICE parameter for Win32.

    * src/util.c
        Modified FatalError() (Win32 Service compile only) to log errors
        to the Win32 event log, since a service has no stdout/stderr to
        view text of error messages.

    * src/win32/WIN32-Code/win32_service.c
        Changed how Win32 registry is opened for reading (was KEY_ALL_ACCESS,
        now is KEY_READ).  Problem (and patch) was reported by Michael Miller.

    * src/win32/WIN32-Includes/config.h
        - Removed mention of SFStats (see description of snort.dsp changes).
        - Changed VERSION to 1.9.0 (removed the word 'beta').
        - Got rid of obsolete comments.

    * src/win32/WIN32-Prj/snort.dsp
        Removed all references to SFStats compile options, since these stats
        provide little useful information under Win32 due to API differences
        between Win32 and Unix, specifically the lack of a native getrusage().

    * src/win32/WIN32-Prj/snort.ncb
      src/win32/WIN32-Prj/snort.opt
      src/win32/WIN32-Prj/snort.plg
        Truncated the contents of these files.


2003-01-09  mfr <roesch@sourcefire.com>
    * src/detection_plugins/sp_ip_proto.c
        Changed data references to use the OptFpList context pointer, ip_proto
        options can now be stacked

    * src/util.h
      src/util.c
         Added two new basic memory allocation functions, one of which is
         built for use with self-preserving Snort modules

    * src/plugbase.c
      src/plugbase.h
         Changed the AddOptFuncToList return to send back the OptFpList
         pointer to ease connection of contextual data to the context
         pointer for a specific OptFpList node

2003-01-07  mfr <roesch@sourcefire.com>
    * configure.in
        Added patch from Jeff Nathan for libnet detection and configuration

2002-12-24  Andrew R. Baker <andrewb@sourcefire.com>
    * src/snort.c:
        Relocate output plugin initialization to prevent unwanted messages 
        from being printed.

2002-12-16  mfr <roesch@sourcefire.com>
    * src/plugbase.c:
	    Fixed error in output plugin activation code for setting default
   	    log output

2002-12-12  Daniel Roelker <droelker@sourcefire.com>

    * src/detect.c:
        Fix bi-directional rules when a unique port is in the destination
        port.  Problem was reported by Brian Caswell.

2002-11-26  Daniel Roelker <droelker@sourcefire.com>

    * src/checksum.h:  
        Problem with ICMP checksum.  Routine did not return the compliment
        of the checksum.  Thanks to Del Armstrong for point this out.

    * src/decode.c:
        Also, UDP checksums are only done if the checksum is 0.  Otherwise,
        we don't do them, even if the config is set for that.  Again,
        thanks to Del Armstrong for pointing this out.
    
2002-11-12  Andrew R. Baker <andrewb@sourcefire.com>

    * src/output-plugins/spo_log_ascii.c (LogAscii):
        added OpenLogFile call for non IP/non ARP packets

2002-11-04  Chris Green  <cmg@sourcefire.com>

	* src/detect.c (EvalOpts):
	  detect_offset_end fixes from 2.0 to 1.9	  

2002-11-02  Chris Green  <cmg@sourcefire.com>

	* HAVE_STRINGS_H all over the place for bzero/Solaris
	  first reported by John Whitson

2002-11-01  mfr <roesch@sourcefire.com>
    * fixed distance/within calculators to be (vastly) more accurate
    * removed exponentially redundent multi-content checks

2002-10-23  Chris Green  <cmg@snort.org>

	* src/log.c more output clean ups from James Hoagland

2002-10-22  Chris Green  <cmg@sourcefire.com>

	* strtol fixes ( Dave Ockwell-Jenner )
	* Merged in Glenns changes for net-snmp port declartion


2002-10-18  Chris Green  <cmg@sourcefire.com>

	* src/detection-plugins/sp_clientserver.c (CheckFromClient):
	  hide this under a DEBUG_CS

	* src/preprocessors/spp_stream4.c (AlertFlushStream):
	  make AlertFlushStream adjust the base_seq upon a flush point
	  (Thanks so much to qru for a reproducable test case... this was
	  a PITA)

2002-10-16  Chris Green  <cmg@sourcefire.com>

	* src/util.c (CreatePidFile): 
          use pv.log_dir instead of local variable (Cameron Humpries)
	
	* src/log.c (PrintICMPHeader):
	  Removed newline amidst a sea of complains from James Hoagland & other
	  users :)

2002-10-16  Roman Danyliw <roman@danylw.com>
        * src/output-plugin/database.c:
          - escape the signature name before trying to write it to the
            signature.sig_name field (Dirk Geschke)

2002-10-14  Roman Danyliw <roman@danyliw.com>
        * src/output-plugin/database.c:
          - Transaction abstraction functions (Begin/Commit/Rollback)
          - Fixed transaction SQL for MS-SQL
          - Fixed incorrect return value for MS-SQL Insert()
            (Hans Nilsson)

2002-10-13  Chris Green  <cmg@sourcefire.com>

	* src/log.c (PrintXrefs):
	  newlines on Xrefs... pointed out by too many people to count :)

	* src/preprocessors/spp_portscan2.c (targetCompareFunc):
	  - target compare function incorrect logic
	    (pointed out by Pat Gorman)

2002-10-12  Roman Danyliw <roman@danyliw.com>
	* src/output-plugin/database.c:
          - Fixed (PostgreSQL) sensor initialization to the sensor table 
            by setting a default last_cid value
          - Fixed schema detection bug on MS-SQL enabled builds
 
2002-10-09  Chris Green  <cmg@sourcefire.com>

	* src/snort.c (ParseCmdLine):
	   - syslog option on non-win32 does not take the extra argument
	     (Andrea Barisani)
	* updated snort.dsp to not require getrusage

2002-10-01  Chris Green  <cmg@sourcefire.com>

	* Fixes from Chris Reid

	  - varchar sql arguments for mssql
	  - usertime -> systemtime misses
	  - snort project file updates

2002-09-26  Chris Green  <cmg@sourcefire.com>

	* configure scripts updated to handle net-snmp as well as ucd
	  (Glenn Mansfield Keeni and Abe Katsuhisa)

2002-09-25  Chris Green  <cmg@sourcefire.com>
	           
	* src/preprocessors/spp_http_decode.c:
           moved setting the uri_count to this preprocessor to handle false
    	   alerts on reassembled packets.


2002-09-17  Roman Danyliw <roman@danyliw.com>
	* src/output-plugin/spo_database.c
         - make sure that a packet payload larger than those supported
           in the SQL INSERT are properly terminated.

2002-09-12  Roman Danyliw <roman@danyliw.com>

	* src/output-plugin/spo_database.c
         - made the updating of the sensor.last_cid more efficient by
           only storing the new cid value at shutdown
         - removed extranous CR/LF from sensor name

2002-09-05  Chris Green  <cmg@sourcefire.com>

	* src/log.c (PrintICMPHeader): off by one error in printing
          Thanks to Dave Goldsmith

2002-09-05  Roman Danyliw <roman@danyliw.com>

       * src/output-plugin/spo_database.c: (DatabaseInit)
         - added ignore_bpf configuration option (from Michael Boman)

         ignore_bpf - Do we want to create a new sensor definition everytime
                the BPF filter is changed? The options are:

                [no|0]: (default) Create a new sensor definition if BPF
                        filter has been modified

                [yes|1]: Ignore the BPF part when looking for the server
                         definition

2002-09-03  Roman Danyliw <roman@danyliw.com>

       * src/output-plugin/spo_database.c

         - DB schema v106
         - Added the sensor.last_cid field to the schema so the
           database can store the last used cid for a given sensor.
           This field will ensure that a cid will never be reused.

           Upgrading from v105 -> v106 is as simple as:

           mysql> ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL;
           mysql> UPDATE schema SET vseq=106;

            psql> ALTER TABLE sensor ADD last_cid INT8;
            psql> UPDATE schema SET vseq=106;
          
         - Improved error messages

2002-09-02  Chris Green  <cmg@sourcefire.com>

	* configure.in:
	  - cleaned up win32 source packaging	 

2002-08-27  Andrew R. Baker <andrewb@sourcefire.com>
    * src/preprocessors/spp_asn1.c:
        do not check fragments

2002-08-26  mfr	<roesch@sourcefire.com>
    * src/threshold.c src/threshold.h src/detect.c src/rules.h src/parser.c
	added thresholds to snort rules language, docs to come

2002-08-26  Andrew R. Baker <andrewb@sourcefire.com>
    * src/util.c:
        fix GenHomenet and GetObsfMask functions

2002-08-19  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_perfmonitor.c (ParsePerfMonitorArgs): typo in fmt string

2002-08-18  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_rpc_decode.c:
	  Port changes from Andreas Ostling ( just like all the other ones now )
	* win32/perf stuff from Chris Reid
	  Will probably break again later
	  the perf stuff is very highly subject to change
	* project fixes from Chris Reid

2002-08-16  Brian Caswell <bmc@snort.org>
        * src/util.c
          - allow daemon mode to dump stats to syslog

2002-08-15  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c
	(ParseStream4Args):
	 - FatalError on unknown argument
	(ReassembleStream4):
	 - Correctly mark sessigons as established with
	   asynchronous_link enabled	

2002-08-14  Chris Green  <cmg@sourcefire.com>

	* src/snort.c (ParseCmdLine): 
         -R <id>    Include 'id' in snort_intf<id>.pid file name
	 (Phil Wood)
	
	* src/snort.c (ProcessPacket):
	  reset uri_count (test case pointed out by Dan Roelker/Sourcefire)
           
	* src/preprocessors/spp_http_decode.c:
	  uri_count set if not alerting.
	  
	

2002-08-13  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_conversation.c:
	  new option alert_odd_protocols
	  set allowed_ip_protocols to the numbers you like and it will alert on all bad protocols

	* src/detection-plugins/sp_session.c (LogSessionData):
           sp_session.c:221: warning: suggest parentheses around && within ||

	* src/detection-plugins/sp_pattern_match.c (CheckANDPatternMatch):
	   bug with mutliple decoded alternative contents

2002-08-13  Roman Danyliw <roman@danyliw.com>
        * src/output-plugins/spo_database.c (CheckDBVersion):
          fixed logic to detect the DB schema version correctly when support for
          MS-SQL and another database are present

2002-08-13  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_telnet_negotiation.c:
	  - cleaner alt_dsize checks
	  - make sure that we don't decode 1 byte
	    past the end of the buffer
	  -(SetTelnetPorts):
	    preprocessor telnet_decode: 21 23 25 119
	    (now with port lists!)

	* src/detection-plugins/sp_pattern_match.c (PayloadSearchRawbytes):
	  new pattern match option!

	  rawbytes -- used to inspect the raw packet data instead of the
	  alternatively decode application packet buffer	

	* src/decode.h (DECODE_BLEN): my favorite constant typo.

	* src/preprocessors/spp_stream4.c (Stream4InitReassembler):
	  turning off server side reassembly by default ( was what the
	  default said it was )

	* src/detection-plugins/sp_tcp_flag_check.c (ParseTCPFlags):
	  adding mask bits to the flag checks
	      (limitation pointed out by Dirk Mueller)

	  example: flags: S,12

	  This checks the SYN flag is set regardless of the values of the
	  ECN bits.  tcp_flags & (0xFF ^ tcp_mask); for those of you that
	  like to think in C

	* src/detection-plugins/sp_pattern_match.c (Check{AND|OR}PatternMatch):
	  - normalization of telnet stuff into a separate buffer
	    (this means logged packets will now look like they should on the wire)

2002-08-12  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_telnet_negotiation.c (SetupTelNeg):
	  - only allow this to be called telnet_decode
	  - removing redundant function calls

	* src/perf-event.c (ProcessEventStats):
	   - set to 0 (djr@sourcefire)
	
2002-08-12  Roman Danyliw <roman@danyliw.com>
        * src/output-plugins/spo_database.c (Database)
          - Fixed length bug in code that generates the SQL INSERT statement 
            into signature table

2002-08-08  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_arpspoof.c (ARPspoofPreprocFunction):
	  - include packet w/ alert (Jeff Nathan)

2002-08-07  Chris Green  <cmg@sourcefire.com>

	* preprocessor perfmonitor
	   --enable-perfmonitor
	  lots of statistics from Dan/Marc/Sourcefire

2002-08-06  Chris Green  <cmg@sourcefire.com>

	* src/checksum.h:
	   Integrated fix from Marc Norton/Sourcefire
	   occasional endianess bug in checksum routines
	   inlined checksum

2002-08-05  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (UpdateState):
	   make session initiators more lenient

2002-08-04  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (BuildPacket):
	  - Session fix ( a different approach from Andreas Ostling )
	(UpdateState)
	(UpdateStateAsync)
	  - Move == TH_ACK checks to nearly the last of the checks and make catch all
	    odder flag combinations	    
	  - ttl_limit will only alert if the packet ttl is less than 10

	(TcpAction*):
  	  - removed stream_pkt->packet_flag sets new ( makes
	    no sense because we overwrite the packet_flags in BuildPacket
	    ( pointed out by arron walters -- ended up
	      being the source of a few other bugs )


2002-07-30  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (BuildPacket):
	 - Mark the session direction establishments correctly
	   (thanks to Andreas Ostling for noticing )

2002-07-29  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (ReassembleStream4):
	  - make unestablished sessions and established sessions mutually
	   exclusive
	  - use &
	

2002-07-26  Chris Green  <cmg@sourcefire.com>

	* src/decode.c:
	  added decode_alert_flag

	  one may disable decoder alerts by using

	  config disable_decode_alerts

	* src/preprocessors/spp_portscan2.c (PrunePortscanners):
	  Portscan2 fixes from Jed Haile ( thanks :-) )

	* src/decode.c (DecodeICMP):
	  8 bytes of extra info in a redirect, not 4
	

2002-07-23  Chris Green  <cmg@sourcefire.com>

	* Phil Wood ASN.1 fix
	* Phil Wood Classification fix
	* Andreas Ostling's BPF comment improvement
	* Just for the record, marty added distance/width as content options
	   distance means there must be atleast N bytes between 2 matches
	   width means that there must be a match within N bytes
	

2002-07-23  Andrew R. Baker <andrewb@sourcefire.com>
    * src/output-plugins/spo_SnmpTrap.c:
        - fix null pointer dereference for non-IP packets

2002-07-09  Chris Green  <cmg@sourcefire.com>

	* src/detection-plugins/sp_dsize_check.c (CheckDsizeRange):
	   - changed dsize check to always return 0 on fake tcp pkts
	     ( mirrors change made on all other functions .. )

2002-07-08  Chris Green  <cmg@sourcefire.com>

	*  Merged in win32 fixes from Chris Reid (thanks again!)

2002-07-05  Andrew R. Baker <andrewb@sourcefire.com>
    * src/preprocessors/spp_frag2.c:
    * src/preprocessors/spp_stream4.c:
        - fixed packet_flags problem with rebuilt packets

2002-07-03  Chris Green  <cmg@sourcefire.com>

	* src/output-plugins/spo_SnmpTrap.c:
	  - lots of *nArgs = 0 instead of NULL
	  - added prototype for ipv6_print_hashing

2002-07-02  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (TcpAction):
	   - switched to using psuedo random flush points

	* src/preprocessors/spp_portscan2.c (PrunePortscanners):
	   - fixed double delete of a tree node

	* compilation fixes from Chris Reid for win32 (Thanks!)

2002-07-01  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_conversation.c
	  (ConvCompareFunc):

       	   - fixed session equalness bug ( portscan2
	      should actually seem reasonable now )
	  (ConvFunc):
	   - changed to use conf_flags for session initiation
	 
	  

2002-06-28  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c
	* src/decode.h (PKT_STREAM_INSERT):
	  added a packet marker for inserted stream packets

2002-06-27  Chris Green  <cmg@sourcefire.com>

	* src/util.c (FatalError): fflush(*)

	* src/detection-plugins/sp_dsize_check.c:
	  dsize checks always will return 0 for
	  rebuilt stream packets	  

	(CheckDsizeRange):
	  added min<>max range support for dsize option
	  Thanks to Andreas stling

	* src/parser.c (ParseConfig): missing return
	   for config daemon
	
	   thanks to Bill McCarty <bmccarty@apu.edu>

2002-06-26  Chris Green  <cmg@sourcefire.com>

	*  From Jeff Nathan:
	   Moved resp* stuff to the OTN instead of RTN

	*  spp_conversation rewrite
	*  portscan2

	*  SNMP updates from Glenn Mansfield Keeni <glenn@cysols.com>
	
2002-06-24  Chris Green  <cmg@sourcefire.com>

	* src/detection-plugins/sp_icmp_seq_check.c (ParseIcmpSeq):
	   htons(ds_ptr->icmp_seq) from Andereas Ostling

2002-06-20  Andrew R. Baker     <andrewb@sourcefire.com>    
    * src/detect.c:
        fix event reference time for unified output

2002-06-20  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_portscan2.c
	  - parsing fixes from Phil Wood
	* src/util.c:
	  - FreeToks fixes from Phil Wood

2002-06-16  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c
	   Andrew Hintz bug reports
	
	   (BuildPacket):
	   - reinjected packets are now marked as established as well as rebuilt
	   (UpdateState):
	   - Server initiated: APF -> AF -> A was not
	     properly terminating session

2002-06-13  Chris Green  <cmg@sourcefire.com>

	* src/output-plugins/spo_log_tcpdump.c (LogTcpdump):
	   fixed broken -b -l . mode
	      ( assuming iph is set doesn't work )

2002-06-12  Chris Green  <cmg@sourcefire.com>

	* src/util.c (read_infile):
	   close fd for -F

2002-06-11  Chris Green  <cmg@sourcefire.com>
	* src/preprocessors/spp_arpspoof.c:
	   Fixes from Jeff Nathan

	* src/preprocessors/spp_asn1.c (ASN1Decode):
	   ASN1 fix from Chris Reid

2002-06-08  Chris Green  <cmg@sourcefire.com>

	* src/generators.h (FRAG2_TTL_EVASION_STR):
	   changed TTL Limit exceeded message to make more clear

2002-06-08  Andrew R. Baker <andrewb@sourcefire.com>

    * src/output-plugins/spo_log_tcpdump.c:
    * src/detect.c:
    * src/decode.h:
        make obfuscation work for all output plugins


2002-06-07  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (ReassembleStream4):
	   - accidentally inverted logic for async/normal sessions
	   - marking streams as established correctly	

2002-06-05  Chris Green  <cmg@sourcefire.com>

	* src/generators.h (STREAM4_TTL_EVASION_STR):
	  changed so that people recognize message as ttl_limit related
	  and not message related

2002-06-04  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_http_decode.c:
	 - fixed include order ( fixes compile on FreeBSD )

	* src/preprocessors/spp_frag2.c (InsertFrag):
	 - allow duplicate first fragment to be disabled

2002-06-03  Chris Green  <cmg@sourcefire.com>

	* src/detection-plugins/sp_clientserver.c (ParseFlowArgs):
	  - added {no_stream,only_stream} keywords to flow:
	    used to suppress reassembled streams from being alerted on

	* src/plugbase.h: changed machine/param.h -> sys/param.h

2002-06-03  Andrew R. Baker <andrewb@sourcefire.com>
    * src/output-plugins/log_tcpdump.c:
        fix obfuscation

2002-06-02  Chris Green  <cmg@sourcefire.com>

	* src/Makefile.am:
	  added plug_base.h  ( pointed out by Jeff Nathan )

2002-05-30  mfr <roesch@sourcefire.com>
	* src/log.c
      src/decode.c:
        Fixed non-functional embedded packet decode and printout for ICMP
        UNREACH and REDIRECT packets

2002-05-30  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_frag2.c (Frag2Init):
	  - left frag2 alerts on by default by accident
	    (diabled)

2002-05-28  Chris Green  <cmg@sourcefire.com>

	* src/detect.c (CallLogFuncs): 
	   moved the traversal of the plugins ahead of the setting the
	   packet logged flag since both check ( should both check? )
	
2002-05-28  Andrew R. Baker <andrewb@sourcefire.com>
    * src/log.c:
        fix NULL pointer deref problem printing priority/class info

2002-05-27  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_http_decode.c
	  (SetPorts): 
    	- fatal error on invalid port description

	* rules.c
	 (VarGet):
	  - fatal error if undefined variable is called
	 (ExpandVars):
	  - don't expand variables inside "'s

2002-05-21  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (StoreStreamPkt):
	  - sheltered fast restransmission under evasion_alerts
	  - missing returns

2002-05-20  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_http_decode.c:
	  - added newer unidecode function from rfp
	  - added "internal_alerts" keyword
               
	
2002-05-19  Andrew R. Baker <andrewb@sourcefire.com>
    * src/output-plugins/spo_log_ascii.c:
    * src/preprocessors/spp_conversation.c:
    * src/preprocessors/spp_conversation.h:
    * src/preprocessors/spp_portscan2.c:
    * src/preprocessors/spp_portscan2.h:
        - corrected some global namespace pollution


2002-05-15  mfr <roesch@sourcefire.com>
    * looked over and indented the hell out of spp_conversation and 
      spp_portscan2
    * put a FreeToks() function into util.c to clean up after mSplit()'s
    * other sundry stuff, conversation and portscan2 should be ready for
      testing from what I can see now

2002-05-15  Andrew R. Baker <andrewb@sourcefire.com>

    * src/output-plugins/spo_SnmpTrap.c:
    * src/output-plugins/spo_alert_smb.c:
    * src/detections-plugins/sp_react.c:
        - fixes for new SigInfo system

    * src/output-plugins/spo_idmef.c:
    * src/output-plugins/spo_idmef.h:
    * doc/README.IDMEF:
    * src/plugbase.c:
    * src/plugin_enum.h:
        - remove IDMEF instead of leaving it in a broken state
    
2002-05-14  Chris Green  <cmg@sourcefire.com>

	* src/util.h (GenObfuscationMask):
	  make compile on OS X

2002-05-14  Andrew R. Baker <andrewb@sourcefire.com>
    * *.[ch]:
       - proper implementation of priority and reference signature metadata
       - other work surrouding signature metadata

2002-05-14  Chris Green  <cmg@sourcefire.com>

	* templates/sp_template.[ch]:
	  - updated template for plugbase and modularity

	* src/preprocessors/spp_stream4.c (CreateNewSession):
	   - added SYN_SENT initialization state 

	* src/preprocessors/spp_http_decode.c:
	  - fixed includes for WIN32 (Chris Reid)
	
	* src/preprocessors/spp_stream4.c (_Stream4Data):
	  - added asynchronous_link
	    useful for places that only see one side of a conversation
	
	  - (UpdateState):
	     mark session as established on asynch links

2002-05-13  Chris Green  <cmg@sourcefire.com>

	* src/snort.c (ProcessPacket): 
         - added min_ttl check in front of Preprocess Check
	* src/snort.h (_progvars):
	  - added min_ttl as a snort-wide configuration option
	    config min_ttl: 1 to drop all things less than 1
	    config min_ttl: 0 to have none (default)

	* src/decode.c
	  (DecodeTCP):
	   - fixed bug where we didn't just toss invalid packet after
	   alerting on it in decoder
	  (DecodeEapolKey):
	   - removed CallLogPlugins redundant call

	* src/generators.h
	   - moved all plugin alert descriptions here

	* src/plugin_enum.h:
	   - moved all PLUGIN_ constants to a single header

	* src/detection-plugins/sp_pattern_match.h: 
	   - cleaned up commented define 

	* src/preprocessors/spp_http_decode.c (PreprocUrlDecode):
	   - commented out spurious debug code
	
	* src/preprocessors/spp_stream4.c  (StoreStreamPkt):
	   - disable evasion alerts
	   
2002-05-12  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_http_decode.c
	     (PreprocUrlDecode):
	  - more debug code
	  - set p->uri_count 

	* src/parser.c (ParseConfig):
	   - cleaned up some NULL dereferences

2002-05-09  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c:
	  - moved SSNFLAG defines to decode.h so that we have access to the
	          Session data outside of spp_stream4
          - added SSNFLAG_HTTP_1_1, SSNFLAG_SEEN_PMATCH
	  - moved Session,Stream to decode.h
	
	   (ReassembleStream4):
	     session_flags converted to & check instead of == for establishment

	* src/decode.h
	  - added HTTP version constants

2002-05-08  Chris Green  <cmg@sourcefire.com>

	* src/decode.h
	(_Packet):
	   - removed URI
	   - added uri_count
        (_HttpUri):
	   - changed to added parameters
        (_UriParam):
	   - added parameter datastructure
        (VTH_VLAN):
	   - fixed missing paren

	* src/preprocessors/spp_http_decode.c
	(SetPorts):
          - removing strncasecmp
	(PreprocUrlDecode):
	  - moved to using UriBufs

	* src/decode.c:
	  Added UriBufs

	* src/decode.h:
	  - changed to use TRH and VLAN macros
	    bitpacked notation expunging should be done

2002-05-07  Chris Green  <cmg@sourcefire.com>

	* src/decode.h (_TCPHdr):
	   - changed to use TCP_OFFSET, TCP_X2 Macros

	* src/parser.c (ParseConfig):
	* src/snort.c (ParseCmdLine):
	
  	-  Fixed notcp,noicmp,noudp,noip to only disable
	- strcasecmp instead of strncasecmp

	* src/preprocessors/spp_http_decode.c:
	  integrated spp_http_decode.c from rfp
	  new option set:
	    * unicode:  decode unicode
	    * iis_alt_unicode: %u000 encoding
	    * double_encode  : detect IIS decoding
	    * abort_invalid_hex: detect only up
	                         until the first broken encoding
	    * drop_url_parm: don't decode the stuff following ?
	    * iis_flip_slash: substitute / for \ ( C:\DOS\RUN )
	    * full_whitespace:  treat \r and <tab> as <space>	    

2002-05-06  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c:
	  fixed retranmission checksum alerts to live under evasion 

	* src/detection-plugins/sp_pattern_match.h:
	   commented out PATTERN_FAST until it works

	* src/generators.h:
	   internal alerts from spp_http_decode

2002-05-01  Andrew R. Baker <andrewb@sourcefire.com>
    * src/plugbase.c:
    * src/output-plugins/spo_unified.c:
        cleaned up startup message printing

2002-04-25  Chris Green  <cmg@sourcefire.com>

	* Introduced IP_VER, IP_HLEN, SET_IP_VER, SET_IP_HLEN after
	thinking about tcpdump and what Fyodor had talked to me about
	months ago regarding cross platform compatiblity.  No more
	twiddling.

	Plugins that use ip_ver, ip_hlen should be tested.  No more bit
	packed notation allowed in the source tree.

	* src/preprocessors/spp_stream4.c:
	   separated evasion alerts from retransmission/state

	   evasion alerts default to being on now

	   disable with disable_evasion_alerts

2002-04-24  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_frag2.c (Frag2Init):
	  fixex argument parsing

	* src/preprocessors/spp_http_decode.c:
	  don't process fragments

	* src/preprocessors/spp_frag2.c
	(InsertFrag):
	  make sure that we don't run out of memory if someone sends us the
      	  same fragment over and over again

	  duplicate first frag is a special case

2002-04-23  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_frag2.c
	  (InsertFrag):
	- adding detection of attack where we would start
	  reassembling packet fully before the full fragtracker is there

	* src/detect.c (EvalPacket):
	  - fixed alert ip rules
	     (got clobbered when playing detection engine optimizations )

	  - generate proper events when decode errors happen

	* src/plugbase.c (InitPlugIns): SetupFragOffset()

	* src/detection-plugins/sp_ip_fragbits.c:
	  - added fragoffset:

	    fragoffset: [!<>] <integer>

	    defined in fragbits so that I can backport it.

	* src/preprocessors/spp_frag2.c (InsertFrag):
	-  alert on frag2 overlaps

	    To do this requires keeping the packets around for a while
	    longer to detect all the multiple fragments and overlaps

	    Changed the PruneCache to notice when things are completed and
	    prune them in addition to just by time. Frag mem faults are
	    going to increase because of this but each time one occurs,
	    there should be plenty to expire.
	

2002-04-22  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_frag2.c
	  (Frag2Defrag):
	    Warn/Discard on fragments with IP Options set.
	  (ParseFrag2Args):
	    min_ttl
	    ttl_limit
	    detect_state_problems
	    
	* src/debug.h
	   DEBUG_FRAG2

	* src/preprocessors/spp_stream4.c
 	(TraverseFunc):
 	  - added next seq check on reassembly
 	  - added alerts on retransmitted sequences...
 	              its ugly as sin right now
        (_Stream):
 	  - next_seq added
 
 	(StoreStreamPkt):
 	  - added check for restranmitting too fast w/ a different data size
 	  - added tcp checksum retransmission checking
 	    (how much do I need to worry about
 	     data with the same checksum and different payloads...
 	     just throw it away for the moment)
	

2002-04-19  Chris Green  <cmg@sourcefire.com>

	* More win32 Service patches from Chris Reid ( Thanks! )

2002-04-18  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_frag2.c (Frag2Defrag):
	                  added ttl_limit detection

	* src/generators.h (FRAG2_TTL_EVASION): added
	

	* src/preprocessors/spp_stream4.c (StoreStreamPkt):
	   -- first cut at TTL evasion detection
	      keyword: ttl_limit <count> for TCP Sessions
	 

2002-04-16  Andrew R. Baker <andrewb@sourcefire.com>

    * src/preprocessors/spp_stream4.c:
    * src/preprocessors/spp_frag2.c:
    * src/preprocessors/spp_asn1.c:
    * src/log.c:
    * src/detect.c:
        fix broken event reference info for unified output

2002-04-15  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (ParseStream4Args):
	  added missing parsing line back in

2002-04-10  Andrew R. Baker <andrewb@sourcefire.com>
    * src/output-plugins/spo_unified.c:
        fix unified brokeness

2002-04-10  Andrew R. Baker <andrewb@sourcefire.com>
    * src/plugbase.h:
    * src/plugbase.c:
    * src/parser.h:
    * src/parser.c:
        Plugin API cleanup
    
    * src/output-plugins/spo_log_tcpdump.c:
        make log file timestamps work the same as in unified

2002-04-09  Chris Green  <cmg@sourcefire.com>

	*  src/spp_portscan2.c:  new changes from Jed/Jason

2002-04-08  Andrew R. Baker <andrewb@sourcefire.com>
    * add profiling configuration option
    * src/parser.c:
        correct NULL pointer dereference 

2002-04-08  Chris Green  <cmg@sourcefire.com>

	* src/debug.c (GetDebugLevel):
	   accidenatlly returning debuglevel instead of debug_level

	* src/log.c (PrintIPHeader):
	   Modified fragment offset calculation (reported by Judy Novak)

2002-04-07  Chris Green  <cmg@sourcefire.com>
	* Fixed --enable-debug
	* src/preprocessors/spp_asn1.c:
	   Missing includes

2002-04-06  Chris Green  <cmg@sourcefire.com>
	* src/detect.c (EvalHeader):
	   Corrected incorrect ignore with -z est and PKT_REBUILT_STREAM

	* src/detection-plugins/sp_tcp_ack_check.c (ParseTcpAck): 
	* src/detection-plugins/sp_tcp_seq_check.c (ParseTcpSeq):
	   Phil Wood's Parsing Change

2002-04-05  Martin Roesch <roesch@sourcefire.com>
	* detection engine now walks RTN and OTN lists iteratively instead of
                    recursively, I guess we should cowtow to the x86 crowd...

	* RTNs are now sorted by destination port number allowing for earlier exit
	from the detection engine in the average case and improving performance

	* destination port is now the first thing checked when an RTN is processed
	(for UDP/TCP traffic)

2002-04-05  Chris Green  <cmg@sourcefire.com>

	* Merged in Nick L. Petroni, Jr.'s 802.11b stuff

	* src/detection-plugins/sp_pattern_match.c:
            Integrated Mike Fisk's SetMatch stuff ( large performance
	    increase -- thanks for being so patient with me )
	

2002-04-04  Chris Green  <cmg@sourcefire.com>

	* src/snort.c (SnortMain):
	    Extra call to initoutput plugins commented out..

	* src/detect.c (CallAlertPlugins):
	    DEBUG_WRAPPED Andrew's printfs'

2002-04-03  Chris Green  <cmg@sourcefire.com>

	* src/debug.h:
	   DEBUG_WRAP defined
	DEBUG WRAP used everywhere...

	* src/preprocessors/spp_conversation.c:
	  ignore rebuilt stream

2002-04-02  Andrew R. Baker <andrewb@sourcefire.com>

    * Modularization cleanup

2002-04-02  Chris Green  <cmg@sourcefire.com>

	* src/debug.c (GetDebugLevel):
	  only initialize debug_level once ( now easier to use gdb set command )

	* src/preprocessors/spp_portscan.c:
	   No processing on reassembled stream packets
	* lots of compilation fixes
	* started added spp_conversation

2002-04-01  Andrew R. Baker <andrewb@sourcefire.com>

    * config.h should be included almost everywhere....


2002-03-31  Chris Green  <cmg@sourcefire.com>

	* src/detection-plugins/sp_pattern_match.c (CheckUriPatternMatch):
	   Check for URI.uri with a packet flag
	* src/preprocessors/spp_http_decode.c (PreprocUrlDecode):
	 - Moved decode ignore check up ( I don't think this is actually
	    used anywhere )
	 - Moved  somefunctions into CheckHTTPDecode
	* decode.h:
	 - Changed URI.uri to u_int_8t[URI_SIZE]
	 - URI_SIZE is 512 (should create an alert when that size is exceeded)
         - Added PKT_HTTP_DECODE to show if URI was filled in
	
2002-03-31  Andrew R. Baker <andrewb@sourcefire.com>

    * start work on cleaning up the output API

2002-03-30  Chris Green  <cmg@sourcefire.com>

    * src/output-plugins/spo_alert_unixsock.c:
	    lots more checking for valid packets on
	    things like portscan alerts

2002-03-29  Andrew R. Baker <andrewb@sourcefire.com>

    * src/parser.c :
        Add support for "special" output plugins

    * src/output-plugins/spo_unified.h :
    * src/output-plugins/spo_unified.c :
        Initial work towards a true unified output.

2002-03-29  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c (ReassembleStream4):
	* src/snort.h:
		removed pv.fake_packet check (old stream stuff)

2002-03-27  Chris Green  <cmg@sourcefire.com>

	* src/preprocessors/spp_stream4.c :
		More debug messages in Stream4 	 

	* doc/PROBLEMS:
	       Added file to document bugs that we really can't work
	       around easily and aren't necessarily ours.

	* src/parser.c (ParseRuleOptions): filename -> file_name for compilation

2003-03-26  Andrew R. Baker <andrewb@sourcefire.com>
    * src/output-plugins/spo_unified.c:
        fix file rotation bug in spo_unified
        write IPs in host order like everything else is
    * src/parser.c:
        updates to the rule parser.  now we only complain for unrecognized
            rule options.
        
2002-03-26  Chris Green  <cmg@sourcefire.com>

	* src/detect.c (DumpChain):
		DebugMessage stuff..

2002-03-25  Chris Green  <cmg@sourcefire.com>

	* stop stream4 from clobbering itself (Pascal Bouchaeine)


2002-03-24  Chris Green  <cmg@sourcefire.com>

	* src/plugbase.c (RegisterPlugin):
		- allow multiple plugins to start with same prefix

2002-03-23 Brian Caswell <bmc@snort.org>
   * initial add of flow: to signatures

2002-03-21  Chris Green  <cmg@sourcefire.com>

   * Place IP checks after port checks for 1.9
	(based on patch from Christian Mock)
   * Fixed test header checks (greatly responsible for
	slowness on multiple CIDR blocks) (Christian Mock)
	
	
2002-03-19  Chris Green  <cmg@sourcefire.com>

    * Fixed Teardrop detection in frag2 ( Forward bugfix from Marty )
    * Replaced most instances of #ifdef DEBUG\nprintf(...) with
	DebugMessage

2002-03-11 bmc <bmc@snort.org>
    * readded this file :)
    * renabled udp portscan detection
    * updated ICMP text printing (few bugs, few new features)
    * updated BUGS for jackasses on Bugtraq
    * fixed a bunch of stream4 stuff 
    * cleaned a ton of signatures (see signature CVS logs for info)
    * number of FAQ updates
    * removed unstable/orphaned/unmaintained/deprecated code as we
      get ready for 2.0
    * massive directory structure reordering
    * frag2 options code cleanup (cmg)
    * fixed pattern match exit conditions (cmg)
    * improved stats calculation (phil wood)
    * tweaked decoder code
    * improved ICMP ASCII output
    * fixed no-packet bug in spo_unified
    * moved alert code in spp_frag2 so packet is logged for teardrop
    * many stream4 fixes
    * added sp_clientserver (to client, to server, from client, from server)
    * cleaned infinate loop in regex
    * fix double PID write (reported by phil wood)
    * updated docs
    * ton of new signatures
    * split rules.c into parser.c|h and detect.c|h
    * smarter pruning for segments that have only partially been streamed
    * ethernet headers are now filled in for rebuilt packets
    * added case for stream segments that hadn't been completely handled in
      previous flush
    * added another interface init call when entering daemon mode for linux
      boxen that lose promisc mode when the process forks
    * strncat in sp_reference
    * opts[1] fix to plugin args passing
    * updated changes to db stuff from Roman
    * removed $default_directory from mysql_directory definition to allow
      --with-mysql to work again and select a non-default installation
    * fixed calloc call for PPPoE debug #ifdef DEBUG
    * Fixed pointer math for Stream4 sesesion
      ( IOU: Phil Wood; 1 Bar tab )
    * Fixed suicidal tree pruning
    * ifdef AF_INET6 for decode.c and removal of spp_asn1.h from plugbase.h
    * cleaned up decode.c indentation, etc
    * added classifications for spp_fnord
    * mods to icmp ASCII log code for more informational printouts
    * added enhanced conf file parsing for frag2 (Chris Green)
    * added pattern match fixes (Chris Green)
    * other stuff that escapes me right now
    * pflog decoder support from Robert Fleck <rfleck@cigital.com> added

    * cleaned up decode.c indentation, etc
    * added classifications for spp_fnord
    * mods to icmp ASCII log code for more informational printouts
    * added enhanced conf file parsing for frag2 (Chris Green)
    * added pattern match fixes (Chris Green)
    * added enhanced resolution of TCP retransmissions to stream4
    * changed default behavior of frag2 to favor old data over new
    
    * fixed screwed up fragbits printout
    * Fixed pointer arithmetic in calls to PrintNetData (thanks to Andreas 
     stling bugreports)
    * ntohs(p->iph->ip_len) -- should we have a p->ip_len?
    * don't complain about NULL ptr if p->dsize == 0
    * Still has one nit in that a badly framed packet is counted twice in -v 
      mode2 

2001-11-29 bmc <bmc@snort.org>
    * Fixed crash in frag2 under Linux 
    * Fixed flexresp code, session sniping should work again and be faster 
      to boot 
    * Fixed ICMP decoder and printout routines for new ICMP header data 
      structs in decode.h 
    * Added -B command line switch to translate IP addresses in pcap files 
      from one subnet to another (see the man page). 
    * Added spo_log_null to give users an option to deactivate logging 
      output from the snort.conf file. 

2001-11-02 mfr <roesch@sourcefire.com>
    * fixed UTC timestamps
    * fixed SIGUSR1 handling, should reset properly now after getting a signal
    * fixed PID path generation code, PID files go in the right place now
    * fixed stability problems in stream4
    * fixed stability problems in frag2
    * tweaks to spo_unified for better integration with barnyard
    * added -f switch to turn off fflush() calls in binary logging mode
    * added new config keyword to stream4, "log_flushed_streams", which causes
      all buffered packets in the stream reassembler for that session to be 
      logged in the event of an event on that stream (must be used in 
      conjunction with spo_log_tcpdump)
    * added packet precacheing for flexresp TCP packets, responses should be 
      generated more quickly
    * fixed rules parser code for various failure modes
    * several new rules files and a new classification system

2001-08-14 mfr <roesch@sourcefire.com>
    * SNMP alerting support added by Glenn Mansfield Keeni & K. Jayanthi
    * IDMEF output support compiled in by default now
    * regex keyword code repaired, limited wildcard regex now available 
    * new packet counters added to Snort stats output for frags and streams
    * http_decode preprocessor modified to normalize %u encoding
    * new detection modes in frag2, Snort picks up fragmentation 
      attacks (teardrop, etc) much better now
    * repaired frag2 IP defragmenter, now 100% stable and functional
    * tweaks made to stream4 TCP stream reassembler, now 100% stable
    * Win32 code integrated with main Snort source now
    * fix for -r mode crash when no other command line options specified
    * fix for logfile names using ":" under win32
    * tag code repaired
    * spp_arpspoof repaired
    * stream4 alerts are now off by default
    * syslog alerts now support standard GEN:SID:REV data

2001-08-04 fy <fygrave@tigerteam.net>
    * A couple of coredump fixes from Phil Wood
    * Solaris compilation fixes (and other minor tweaks I don't
      remember)
    * Incorporated WIN32 patches (and fixes) from Chris Reid
    * ms-sql support from Chris Reid
    * contrib/create_mssql

2001-07-09 mfr <roesch@sourcefire.com>
    * added new IP defragmenter, spp_frag2
    * added new stateful inspection/tcp stream reassembly plugin, spp_stream4
    * Snort can now statefully detect ECN traffic (less false alarms)
    * stream4 can now keep session statistics in a "session.log" file
    * added new high-speed unified binary output system, spo_unified
    * added new data structs/management for tag code
    * added -k switch to tune checksum verification behavior
    * added -z switch to provide stateful verification of alerts
    * modified bahavior of http_decode, now only alerts once per packet
    * added unique Snort ID's to every Snort rule, plus generator, revision
      and event ID info to each alert
    * detection engine only alerts once per packet now, tcp stream code doesn't
      generate another alert packet if a previous one already alerted for that
      stream
    * fixed signal handling on svr4 systems
    * added enhanced cross reference printout to full/fast/syslog alert modes
    * added new high speed checksum verification (on x86) routines
    * added new ARP spoof detection preprocessor from Jeff 
      Nathan <jeff@wwti.com>

2001-04-20 fy <fygrave@tigerteam.net>
    * a couple of fixes in spp_defrag.c
    * spelling fixes in 'classification.config' file

2001-04-19 bmc <bmc@mitre.org>
    * added ability to tag sessions & hosts (By Seconds, Bytes, and Packets) 
    * ip protocol rule support 
    * added 802.1q VLAN support  
    * extensive configuration file config options (you can put your 
      commandline options in snort.conf now)
    * priority & classification plugin by Brian Caswell
    * output plugin support for priority, classification, and refs  
    * rpc_decode plugin (Defeats attacks laid out by Robert Graham's SideStep) 
    * telnet negotiation normalization plugin (Defeats attacks laid out 
      by Robert Graham's SideStep) 
    * BackOrifice plugin (Can bruteforce BO keys.  Defeats attacks laid out 
      by Robert Graham's SideStep) 
    * uricontent keyword pattern match.  (Now you can look at the URL instead 
      of the entire packet) 
    * added -T commandline option  (Does entire setup process, but stops 
      after its done setting up) great for snort.conf testing!! 
    * added -L commandline option.  Specify filename of the binary output 
      log when combined with "-b"
    * added -G commandline option.  Turn on "ghetto" backwards 
      compatability for people that need
      references in the MSG field
    * added -I commandline option.  Prints the interface that the 
      alert was received on
    * added -y commandline option.  Adds YEAR to the timestamps
    * Fixed timestamp output problem on some ARCHs
    * ability for non-root users to sniff.  (If the user can usually 
      sniff from pcap) By Brian Caswell
    * Improved UNICODE detection by Koji Shikata
    * added sp_tcp_win_check.  TCP Window Size can be looked now 
    * added CSV output (see README.csv for more information) By Brian Caswell
    * added sp_same_ip_check.  Checks for the same SRC & DST (Usually sign 
      of a DOS attack) by Phil Wood
    * added variable lookups for include directives (eg 'include 
      $RULESPATH/myrules.rules')
    * linux_sll (interface 'any') support fixed (According to the new 
      libpcap spec) By Fyodor
    * new debugging code.  No more #ifdef DEBUG.  (see debug.c for more 
      info) Idea from Eugene Tsyrklevich
    * strl* family functions (mostly for future developers, we'd encourage 
      these to be used) (original code also supplied by Eugene)
    * new tcp stream reassembly module by Chris Cramer
    * include directives now are relative to snort.conf file location 
      (unless full path in a config file is given) 
    * snort will look for /etc/snort.conf and ./snort.conf if no config 
      is given on the commandline 
    * minor null ptr fixes and patches there and here (thanks to all of 
      you guys who helped tracking them down, really :-) - Fyodor)
    * optiomized database schema (Support for references, added 
      signature normalization, ....)
    * UTC cleanup by Andrew Baker
    * http_ignorehosts added from Matt Wachinski

2001-03-14 fy <fygrave@tigerteam.net>
    * tcp stream reassembly updates by Chris Cramer
    * path fixes for include <file> (now relative path'es will be substituted 
      by path of the main file)
    * DLT_LINUX_SLL support fixes
    * strlcat/stlcpy functions are being incorporated
    * Attempt to support MacOS platform. 
    * A bunch of fixes for MTU dicovery routine
    * New debugging routines. (see BUGS file for more info). 

2001-01-02  mfr <roesch@md.prestige.net> fy <fygrave@tigerteam.net>
    * tcp stream reassembly preprocessor (beta) by Chris Cramer
    * Defragmentation plugin is now fully functional on all architectures
    * SPADE (Statistical anomaly detection) preprocessor has been added by
      James Hoagland
    * Added IIS/UNICODE attack detection to HTTP decoder
    * Reference plugin has been added by Joe McAlerney
    * New active response module: sp_react
    * Added "any" keyword to IP options (ipopts) plugin
    * IP fragmentation bits detection plugin added
    * Added TOS detection plugin from Erich Meier 
      <Erich.Meier@informatik.uni-erlangen.de> 
    * Database output plugin improved in many ways by Jed Pickel
    * Oracle support added to database output plugin
    * XML output plugin by Jed Pickel/Roman Danyliw/CERT
    * IP address list support added with lots of help from Phil Wood
    * <interface>_ADDRESS variable implementation, specifying an interface name
      in the rules file as part of this variable automatically sets the IP/mask
      as the IP address/netmask of the specified interface
    * Rule parser is more anal about rule verification now, doesn't crash as 
      readily
    * Arbitrary output types support added by Andrew Baker
    * Activate/dynamic rules allow rules to turn on/off other rules!
    * ICMP unreach. printout dumps encapsulated headers now
    * Improved TCP/IP options printout code, doesn't flood on 0 length options
    * Packet checksumming implemented for all supported protocols by Chris 
      Cramer
    * TCP flags now print out in proper (bitwise) order
    * Added new fields to the packet header dumps including IP header length,
      TCP/UDP header length, Urgent pointer printout, IP Reserved bit printout,
      ICMP Type/Code explicit value printout
    * -X switch dumps packet byte data for data link through application layer
    * -L switch to privde a filename for binary log files specified with the -b
      switch
    * Added -I switch to print interface name in Snort alerts (first i/f only)
    * Fixed -S command line switch so it isn't overridden by variables in the
      rules file
    * Corrected PID file misadventures
    * Added a bunch of new statistics to the packet stats printout
    * Added SIGUSR1 handler, Snort will dump packet stats to console/syslog 
      when it receives a SIGUSR1
    * Memory management cleaned up/lots more free()'s to match up with 
      malloc()'s
    * Added snprintf code to the distro for safety
    * UID = 0 code added for sniffer mode
    * fixed default alert filename for daemon mode
    * Updated USAGE file to resemble Snort's current reality
    * Changed snort-lib to snort.conf, Jed Pickel added lots of documentation
      to the file as well (thanks Jed!)
    * Pid file will not be created if -D switch is not used.
    * chroot behaviour has been changed, now, if chroot is used, you have
      to have snort.conf file within chroot directory (and all the other
      relevant files as well). The only file which will be placed outside
      chroot directory is snort pid file.

2000-07-22  mfr <roesch@md.prestige.net>
    * Fixed compilation problems on all non-BSD operating systems
    * Added better configuration support for locating libpcap
    * Fixed    ICMP ping packet id/sequence printouts
    * Made allowances for 64-bit machines in the decoders
    * Updated the portscan detector to the latest version
    * Disabled the defragmenter by default (in the rules file)
    * Added a patch from Dave Dittrich to make daemon mode alerts 
      filenames conform to the data in the documentation
    * Revamped the ICMP data structures to mimic those found in *BSD
      and provide for higher fidelity decoding/printout in the future
    * Repaired the output plugins so that they operate properly now
    * For the record, the payload dump conforms to the length of the 
      IP datagram now and does not show pad bytes added by the minimum
      Ethernet frame size

2000-07-08  mfr <roesch@md.prestige.net>
    * Fixed Tru64 u_int* type declarations
    * Added check for pcap.h into configuration script
    * Fixed timeval problems on Linux boxen

2000-07-06  mfr <roesch@md.prestige.net>
    * New preprocessor plugin: IP defragmentation!!
    * New output plugins cover all old logging and alerting options
        * New output plugin now logs to MySQL, PostgreSQL, unixODBC databases 
    * Updated portscan detection functionality
        * Added quote removal for most plugin parsers
        * -C crash bug fixed
        * PID/PATH_VARRUN file fixes
        * Converted many putc(3) calls to fputc(3) for portability
        * Transport layer decoders use ip_len field for length metric now
        * String tokenizer code modified for more reliable operation
        * Fixed flexible response code sequence prediction
        * Fixed DEBUG ifdef's so DEBUG mode code will compile correctly on all
          platforms
        * Set automake options so that people don't need gmake anymore to build
          Snort on BSD systems
        * Fixed SMB alert code large tmp file hole
        * Added sigsetmask code to fix SIGHUP weirdness
        * Added execvp option for SIGHUP restart code
        * Added ARP header printout validation
        * Added Session logging file integrity checking
        * Added -u/-g setuid/gid capability switches
        * Added -O IP address obfuscation switch
        * Added -t chroot switch
        * Fixed non-TCP/UDP/ICMP transport layer decoding & logging
        * Fixes and additions to the portscan preprocessor
        * Database logging plugin has been modified extensively, see the 
          www.incident.org website for more information
        * Switched TCP flags printout routine to ensure proper RFP output
          scan output. ;)
        * Fixed default log/alert function code so that these functions are
          never NULL

2000-03-20  mfr <roesch@md.prestige.net>
    * Version 1.6 released!

2000-03-18  mfr <roesch@md.prestige.net>
    * Modified the PID write out code to work in all run modes, and made
      the system detect/verify the _PATH_VARRUN variable and define it
      if necessary.
    * Integrated a HUP patch from J Cheeseman to prevent the command line
      parser from screwing up the command line at HUP time.
    * Added a little tweak from Fyodor for Makefile.in
    * Made exit code delete the PID file in all run modes.

2000-03-16  mfr <roesch@md.prestige.net>
    * Activated the BPF compiler optimization switch in snort.c
    * Added support for unconfigured/stealthed network interfaces
    * CP added a default definition for _PATH_VARRUN
    * CP added checks for paths.h existence
     
2000-03-15  mfr <roesch@md.prestige.net>
    * Moved the "session" keyword code to a plugin
    * Added Postgres database logging module from Jed Pickel
    * Added Token Ring layer 2 printout routine
    * Added "-q" support to the output plugin modules
    * Revamped the output plugin subsystem so that it conforms to the
      API standards laid out in the rest of Snort
    * CP set defaults for the alerting and logging facilities
    * Added Tru64/Alpha support

2000-02-26  mfr <roesch@md.prestige.net>
    * modified minfrag proprocessor to only catch tiny frags on the home 
      net ("home" keyword) or any traffic ("any" keyword)
    * implemented command line override of output plugins, alert and log
      switches on the command line will disable output plugins in favor of
      their configured activity
    * added -C command line switch to print packet payloads as ASCII only,
      with no hexdump
    * fixed a stupid crash bug on the "logto" keyword parser
    * put in a couple of command line switch validators to catch potential
      invalid arguments
    * fixed a potential crash bug in the ClearDumpBuf() function

2000-02-07  mfr <roesch@md.prestige.net>
    * Added INADDR_BROADCAST patch from Steve Beaty <beaty@emess.mscd.edu>
    * Added syslog PID patch from Ralf Hildebrant
    * Added IPv6 counter from Erich Meier 
      <Erich.Meier@informatik.uni-erlangen.de>
    * Added SunOS patch from Denis Ducamp <Denis.Ducamp@hsc.fr>
    * Added content-list rules from 

2000-01-17 cp <fygrave@tigerteam.net>
    * Update of Patrick's portscan preprocessor. (and apropriate fixes)
    * Minor fix to configure.in from Herb Commodore.

2000-01-12 cp <fygrave@tigerteam.net>
    * John Wilson's update to insensitive pattern match code added.
    * Patrick Mullen's patch to log.c applied.
    * Patrick Mullen's changes to rules.c added.
    * Source Port traffic rules ajusted not to pull alerts on 53<-->53 UDP 
      traffic.
    * Changed name ParseFlags to --> ParseTCPFlags in sp_tcp_flag_check.*
      since that's what it really is.
    * Added RCS Id tags to all the files and libs. Once they are commited
      at md.prestige.net, they should take proper values. :)

2000-01-08 cp <fygrave@tigerteam.net>
    * Patch from Herb Commodore <herb@nc.rr.com> to configure applied
    * Imrovements to content-matching code and implementation of
      case-insensitive matching from John Wilson <tug@wilson.co.uk)
      are added.
    * "zero netmask" problem fixed.
    * Patrick Mullen's portscan preprocessor is added. log.c routines
      have been fixed to handle NULL pointers.
    * binary logging routines have been changed to use libpcap procedures
      which should fix certain problems with binary logging.
    * Fix in rules.c to complain about bogus preprocessor names.

2000-01-03  mfr  <roesch@clark.net>
        * fixed a problem with pass rules not being applied properly
        * fixed a #include ordering statement for Slackware 4.0 installs
        * fixed banner output for the -V option
        * Token Ring decoding is now fully functional
        * Added packet buffer cleanup code to all protocol decoders
        * fixed a problem with improper TCP option output
        * Added a Snort man page
    
1999-12-08  mfr  <roesch@clark.net>
    * preprocessor plugins (major new functionality!)
    * detection plugins (major new functionality!)
    * variables can now be specified in the rules file
    * include files can now be specified in the rules file
    * Session recording capability
    * Rules may now contain multiple "content" match keywords
    * New IP options detection module, allows IP option inspection
    * New HTTP decoder preprocessor defeats evasive web scans (whisker.pl)
    * detection engine has been heavily modified to implement the new 
      "linked-list-of-function-pointers" concept, which makes the detection
      engine more efficient, more flexible, and faster!
    * TCP options decoder split into decode/log modules and recoded 
    * IP options decoder split into decode/log modules and recoded 
    * Token Ring layer 2 decoder (still in development)
    * ISDN-Raw layer 2 decoder (I4L)
    * ISDN-IP layer 2 decode (I4L)
    * ISDN-Cisco layer 2 decode (I4L)
    * Fixed PPP layer 2 decoder
    * NULL/Loopback layer 2 decoder
    * daemon mode code cleanup
    * tcpdump readback mode code cleanup
    * experimental support for UNIX socket alerting
    * fixed C++ comments in snort.c
    * binary log files now update properly (fflush added)
    * internal rules list integrity testing
    * IP fragments are no longer sent to the detection engine, just
      the preprocessor's.  This is incentive for me (or someone) to write
      an IP defragmentation preprocessor!
    * post-decode call function call sequence has been modified to go into 
      the preprocessor system instead of the detection engine

1999-10-18  mfr  <roesch@clark.net>
    * snort.c: * added session dump command line switch

    * log.c: * added sesion data logging functionsi: OpenSessionFile(),
           DumpSessionData().
    
    * decode.c: * fixes snaplen issues with reading back tcpdump files.


1999-10-13  mfr  <roesch@clark.net>
    * snort.c: * threw out tcpdump file readback code and implemented
             open_pcap_offline solution.  Has addded benefit of 
             allowing BPF filters to be used to modify file readback
             streams.  
           * Fixed MTU snafu.

    * decode.c: * Rewrote ARP decoder.  The decoder is much simpler (but 
              the log routines are far more complex)
            * Horsed around with the TCP and IP option decoders.  I 
              think they work better now...

    * log.c: * Added ARP printout and logging routines.  ARP is now 
           handled in a much more consistent and correct manner.
         * Fixed stupid crash bug in LogPkt()

    * rules.c: * Added in greater-than and less-than modifiers for dsize
             option keyword.  You now have another (cheap!) way to look
             for buffer overflows

           * Removed range checking for the ICMP icode and itype
             option keywords so that DoS attacks and covert activity 
             could be more easily filtered/monitored

1999-09-26  mfr  <roesch@clark.net>
    * snort.c: * new command line options -A, -F, -N, -p, -b
           * logging and alerting functions are now selected and 
             assigned to function pointers for faster/more efficient
             logging
           * got rid of -f command line option (superceded by -b)
           * put in new cleanup code for readback mode
           * ripped read_infile from tcpdump to read BPF filter files
    
    * decode.c: * code cleanup in support of new functionality

    * rules.c: * added support for the exception operator to work for ports
           * fixed stupid pointer initialization bug in 
             ProcessHeadNode() file, fixed crashes on non-PC arch.
           * new option keywords: dsize, offset, depth
           * cleaned up crappy logic around the logging functions with
             nice clean function pointers (aaaahhhh....)
           * added bidirectional rules functionality (now Snort goes
             both ways....)

    * log.c: * broke out alerting function into seperate subfunctions
         * ditto logging functions
         * fixed string termination code in the SMB alerter so that it
           can now alert to more than one box at a time
         * cleaned up syslog messages
         * finally fixed the SMB "alert once" problem (kudos to Gandalf
           Schaufelberger for that one)

1999-08-06  mfr  <roesch@clark.net>
    * log.c: * added code to AlertMsg to make sure that there was in fact
           an alert message to print out

    * libraries: * fixed the backdoor and scan libraries so they should 
               flase alarm less often

1999-08-05  mfr  <roesch@clark.net>
    * snort.c: * activated CyberPsychotic's daemon mode code (use the 
             -D switch for daemon mode
           * default logging directory changed from "." to 
             /var/log/snort
                   * sanity checks performed on the default log dir now

    * decode.c: * changed the truncated Ethernet header notification to
              only go off in verbose mode
            * removed cruft

    * rules.c: * Added Ron Snyder's "address negation" patch.  Rules may
             now contain "!" on the IP addresses to indicate anything
             BUT the given address

    * log.c: * added support for the new default logging directory

    * configure.in: * fixed some more sparc configuration problems

    * other: * CyberPsychotic sent a new ftp buffer overflow rule in

1999-08-04  mfr  <roesch@clark.net>
    * snort.c: * fixed some DEBUG statements
           * enabled the daemon mode code (this is still 
             experimental)
    * decode.c: * fixed various and sundry DEBUG code
            * fixed the TCP option decoder so it wouldn't overflow
              its prinout buffer and cleaned up the temp buffer
    * rules.c: * fixed some DEBUG code
           
    * log.c: * fixed a buffer copy problem with the daemon mode alert
           logging 
         * fixed the SMB alerting code and the standard log output 
           when in SMB alerting mode
         * cleaned up some of the fragment logging code
         * fixed the logto rules option coding to work properly
    * configure.in: * fixed a whole bunch of little problems that are
              screwing up big endian/non-PC machines.  This
              version should work and compile much more cleanly
               on all architectures!

    * other: fixed a bad rule in the RULES.SAMPLE file and another bad
         one in the misc-lib file

1999-08-01  mfr  <roesch@clark.net>
    * rules.c: Wrote brand new detection engine.  The new engine uses
               a 2-dimensional linked list with recursive node walking.
               Rules are grouped by address/port commonality and then
               option chains are linked to common head blocks.  This
               reduces the number of tests required to find a specific
               test to perform, and reduces the total number of tests
               performed on a given packet in all cases by 200-500%
               over version 1.1.

    * decode.c: Rewrote the packet decode engine.  The new engine 
            performs far fewer copies and tries to set pointers
            to defer expensive function calls as late as possible.
            The PrintIP and Net data structures have been eliminated
            so that there is no global data required to perform tests
            or log a given packet.  This will make any future multi-
            threading efforts much easier. 

    * log.c: * Much of the logging system was rewritten to take advantage 
               of the new detection and decoding engines.
        
         * Made the SMB alerting a configure-time option.  If you 
           want to use the SMB alerting feature, you need to specify
           a "--enable-smbalerts" when you run configure.  This is a 
           safety measure, read the INSTALL file for the reasons why!

    * snort.c: Fixed a bug in the netmask generation code that wouldn't
           allow certain CIDR blocks to be represented.  Thanks to 
           Nick Rogness <nick@trinux.rapidnet.com> for the heads
           up on this one!

1999-06-21  mfr  <roesch@clark.net>
    
    * snort.c: * Added new command line switches: -f, -M, -r.  
               -f: Record fragmented packets in tcpdump format
               -M: Send alerts via WinPopup messages (requires Samba)
               -r: Read and process files generated by tcpdump 

           * Fixed startup dumpout code to not drop people if they just
             want to log all packets to the system

           * Added static netmask generation, this rids Snort of the
             need to link to libm, which makes it more Trinux friendly.

    * rules.c: * Added new rule option types:
              logto: log packets matching this rule to the specified
                             log file
              minfrag: set the minimum size of fragmented packets, which
                   allows alerts to be generated for traffic coming
                   from things like nmap or fragrouter
              tcp flags: Added the ability to include the reserved bits
                     of the tcp flags into the rules set.  These
                     flags are specified with a "1" and "2.  
                     Inclusion of these flags allows Queso 
                                 fingerprinting attempts to be detected.
              id: The IP ID field may be specified.  This is nice for 
              picking up handcrafted packets with recognizable ID
              fields, like 31337 or other "elite" numbers.
              ack: The TCP ack field.  Using this, nmap tcp "pings" may
               be detected.
              seq: The TCP sequence number.  This is provided for 
               completeness (I figured since I was putting in the 
               ack field, I may as well include the sequence as 
               well)
           * Rewrote the content parser.  It now accepts "\" as a 
             literal character, so things like "\|" or "\~" will work
             properly.

           * fixed the parenthesis finder for the options code

           * adjusted the acceptable character range in the rule
             parsers

    * log.c: * fragment logging more descriptive and correct

         * fixed IP header logging for ICMP and fragmented packets

         * improved "bad packet" printing/logging

         * fixed IP option output code

         * IP packet ID field now displayed

    * decode.c: * fixed IP fragment decoders and logic streams.

            * fragments are now fed thru the rules set (sorta)

1999-05-17  mfr  <roesch@clark.net>

    * snort.c: Added "-x" command line switch to explicitly activate IPX
           packet notification so people in mixed protocol environments
                   can maintain sanity.  Also added in the new packet counter to
           generate statistics on exit of the number/percentage of 
           each type of packet that Snort sees.

    * decode.h: Removed the references to u_int16_t and u_int32_t and 
            replaced them with u_short and u_long.  The u_int*_t 
            variables caused portability headaches.  Also added in the 
            new patch from Chris S. for the  WORDS_MUSTALIGN definition
            for S/Linux version.

    * log.h: Fixed the LOG_AUTH/LOG_AUTHPRIV problem that Solaris users 
         were having.

    * decode.c: Added the new packet statistics counters throughout the 
            code.  Cleaned up the IPX code a bit.  

    * rules.c: Cleaned up the isspace(3) (et al) calls.

    * etc: Made lots of tweaks to the autoconf stuff to get the S/Linux
           and HP-UX versions to compile cleanly out of the box.

1999-04-28  mfr  <roesch@clark.net>

    * rules.c: Added the code to change the order the rules are applied in.

    * snort.c: Added two new command line switches: "-o" and "-s".

    * decode.c: Added in new layer 2 decoding for SLIP and RAW packet 
                types.

        * log.c: Added code to send alert notification to syslog.

1999-04-17  mfr  <roesch@clark.net>

    * rules.c: Rewrote the rules option parser.  It's now a much more
                   consistant interface for both reading rules into the program
                   and writing them as a user.  Added in new rule types to 
                   alert on TTL values, and ICMP types/codes.

    * log.c: Most of the logging code has been dramatically rewritten as 
                 well, and it now works much better. 

    * mstring.c: Added the notion of a meta character to mSplit() so that
                     it was possible to not split on every single occurence of
                     a character in a string.

    * decode.c: Smoothed out all the logging system calls to work nicely
                    with the new log code.

1999-04-08  mfr  <roesch@clark.net>

    * rules.c: Moved AlertPkt() and LogPkt() to log.c

    * log.c: Totally revamped the logging code to be more logical and 
                 have less duplication in the code.  There are now seperate 
                 logging functions for each of the layers of the packet.  
                 PrintIPPkt() has been totally rewritten, PrintFragHeader has
                 been eliminated, and two functions have been moved over from
                 rules.c and completely rewritten as well.

    * decode.c: Reworked the routines which called the logging functions.

1999-04-06  mfr  <roesch@clark.net>

    * decode.c: added code to display/log the Fragment ID field of the IP
                    header.  Got a nice patch from Sebastian to add in TOS 
                    decoding as well.  Added ethernet header logging and 
                    display code.

    * mstring.c: fixed the match() routine.  It had a tendency to miss some
                     things some of the time.  (oops!)  Content based matching
                     should work all the time now.

    * log.c: added code to display some of the new stuff that's decoded.

    * snort.c: add a new command line switch: "-e".  This will display the 
                   ethernet header data in both the log files and on the screen.

1999-03-24  mfr  <roesch@clark.net>
        
        * decode.c: fixed the damned TCP and IP options decoders.  These things
                    were a friggin pain in the ass to program up properly.
                    Recoding them stopped the huge loop that they had a bad
                    tendancy to get stuck in, thereby making the rest of the 
                    program nigh infinitely more useful for just about any
                    friggin problem under the friggin sun.  Frig it.

    * log.c: Stopped the insanity of unnessary carriage returns in the log
                 files and on screen printouts.  Another PITA.

        * rules.c: Fixed output formatting yet again.


1999-03-21  mfr  <roesch@clark.net>

    * snort.c: fixed a bug in the timestamp code so the month prints out
                   right

    * decode.c: added code to detect and decode IP and TCP Options.  Also
                 added code to print packet fragments with truncated headers
                 into a PACKET_FRAG file which gets dumped in the default log
                 directory.

    * log.c: added code and data structures to print out IP and TCP Options
                 plus I fixed the f'd up fragment print out logic.  Changed
                 OpenLogFile() to include a mode argument for packet fragment
                 print out.

    * rules.c: rewired the entire rules test routine and added some long
                   needed goto's into the program.  I feel manly now.  Also
                   added a new rule field: TCP flags.  This allows us to 
                   alert/log/pass on tcp flags.  Also added in port range 
                   functionality, you can now specify a range of ports, or 
                   greater than/less than a specified port.
 

1999-03-08  mfr  <roesch@clark.net>

    * snort.c: Ripped off the timestamp printout routines from tcpdump
           and stuffed them into snort.c, yum yum.  This gives us
           millisecond timestamping on the packets for those of you
           interested in such things.


1999-03-06  mfr  <roesch@clark.net>

    * mstring.c: mContainsSubstring has been replaced.  mContainsSubstring 
             is a brute force pattern matcher, and is therefore very
             slow and not too efficient.  The new routine, match(), 
             implements a Boyer-Moore string search algorithm and is 
             much faster in the general case and much more tolerent of
             "poor" pattern selection.

    * log.c: PrintNetData has been completely rewritten.  It should now be
                 much faster and only needs to generate the print out buffer
                 once per packet.  This routine was a major source of slow 
                 down/dropped packets before.  You still shouldn't use verbose 
                 mode with the "-d" command line switch if you're using Snort 
                 as an IDS, because it's still slow enough to drop some large
                 packets.  Packet print out has changed as well, with the 
                 different packet layers seperated by onto their own lines
                 (well, mostly).  Fragmented packets are now recorded in a 
                 "FRAG" file.

    * decode.c: Snort now detects fragmented packets, plus the DF and MF 
                    bits, and decodes the fragment offset.  
     
    * snort.c: Now displays packet collected/dropped statistics when 
                   shutting down.


1999-02-18  mfr  <roesch@clark.net>

    * snort.c: Code cleanup and some error checking was added.  The system
           now accepts the interface name you give it at the command
           line.  Fixed a problem with underallocating the interface
           name buffer for names specified on the command line.  
           Suprisingly, this only came to light when tested on the 
             Sparc architecture.

    * log.c: ICMP logging now includes the ICMP code description in the 
         filename.  This makes it easier to see what you're interested
         in without having to go digging into the log files.

    * decode.c: Made the ICMP types and codes a little more compatible with
            being used as a filename.


1999-01-28  mfr  <roesch@clark.net>

        * rules.c: Rules sorting is now implemented.  There are actually three
                   seperate lists (Pass, Log, Alert) now, with the rules being
                   placed on to the lists in the order they're read from the 
                   rules file.  The rule execution order was changed, now
                   Alert rules are applied first, then Pass Rules, the Log 
                   rules.  Content based rules are available now, the actual
                   application layer data can be searched, both binary and 
                   text, for a specific pattern to activate a rule on.

        * decode.c: Minor changes to reflect the new rules structure.


1999-01-19  mfr  <roesch@clark.net>

        * snort.c: Modularized the code, big time!  New source modules are log,
                   rules, decode, and mstring.  Dumped SetFlow() for now.

        * rules.c: Rules based packet logging now enabled!

        * log.c: Now keeps track of TCP/UDP conversations better!

        * decode.c: Enhanced decoding of packets, including ICMP ECHO seq and
                    id!
 

1999-01-08  mfr  <roesch@clark.net>

        * snort.c: Made a fix to SetFlow() so that it wouldn't dump the
                   program if it got traffic from 0.0.0.0 or 255.255.255.255.

        * snort.h: Removed the "#define VERSION" since it's handled in config.h.

        * README: Proper README file included with this distro


1998-12-21  mfr  <roesch@clark.net>
    * snort.c: Made this file, figured out autoconf
    

