prelude-correlator: Changes to 'refs/tags/0.9.0-beta4'

Tag '0.9.0-beta4' created by Yoann Vandoorselaere <[email protected]> at 2009-06-17 17:37 +0200

0.9.0-beta4
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAko5G84ACgkQD4LqTXjyBR/BswCeNF3JZD54pjxv2fkibVOcYg8S
FNsAnirjzkyuE6uREEaRJjH5f+u+5Q5z
=usDB
-----END PGP SIGNATURE-----

Changes since the dawn of time:
Gene Ramon Gomez (6):
      Add credit header to brute-force.rules, start worm.rules
      Default disables added
      Fix documentation
      Implement Eventscan/Eventsweep/Eventstorm rules
      Fix required field regex
      Implement floating threshold windows

Sebastien Tricaud (3):
      (typo): Not LML but Correlator
      (feature): Add the possibility to daemonize the correlator
      Add correlation rule to match IP addresses against the dshield database. Do not add this rule in Makefile.am since the dshield mirror installation is required before using this rule (it can't be used as is).

Yoann Vandoorselaere (256):
      prelude-correlator module.
      r8188@arwen:  yoann | 2006-04-27 16:12:55 +0200
      r8189@arwen:  yoann | 2006-04-27 18:12:09 +0200
      Correct last/silent usage.
      Correct the way correlation check are done.
      Implement --dry-run mode.
      Detailed error message
      Correctly set dry-run option callback.
      Cosmetic changes
      Prevent last keyword from affecting other rules
      Fix some parser problem.
      Implement support for creating multiple context from retrieved value that
      Print context name
      Port worm.rules from old SEC format.
      In the near future, correlation rule are going to be able to use IDMEF object
      Preliminary support for object to object copy. Won't work until recent object copy
      Fix potential double free.
      Configuration file handling. Install default file.
      Install worm.rules
      Don't check for ambiguous IDMEF path. Now allowed for copy. Miscelaneous bug fixes
      Add missing
      Implement capture_string_get_parent().
      Ooops.
      Avoid un-necessary copy, by using capture_string_get_parent()
      Fix typo.
      All list are now flat. Make handling multiple value much simpler.
      Remove last keyword, which prevented processing of further rules. Use add_context rather than new_context, in order to not miss packet drop. Make use of object copy in the generated alerts.
      Use multiple context + IDMEF object copy feature.
      Fix IDMEF path leak on error.
      Require libprelude >= 0.9.10
      Fix dist.
      Introduce pcre_context_set_idmef() to set the IDMEF object after context creation.
      Do not install correlation-plugins.h private header
      Declare pcre_context_set_idmef() function
      Fix brute-force ruleset
      Implement automatic object comparison, when copying IDMEFAlert data to the generated CorrelationAlert. That way, we never end up with duplicated object within the generated CorrelationAlert. Require latest libprelude work.
      Fix a warning.
      Add missing copyright notice.
      Handle NULL value.
      Fix a bug with context that both require and create context.
      Using the pre_action keyword, this detection can be performed in 1 rules instead of 2.
      Alway copy source/target object to the created CorrelationAlert.
      Handle context destruction of listed value.
      Make capture-string handle negative index, so that listed value can be handled backward.
      Modify value-container so that we can now handle listed value. That is, when a pattern
      Fix parsing of value with escaped character.
      Use the left operand as the path, since it's where append/prepend attribute might be used.
      Fix linked list corruption on prelude_string_destroy().
      New rules format. The new format take into account the order in which the operation
      Make sure the destroy() function is called once for each plugin instance on exit.
      - Require libprelude 0.9.11. Define a runtime savedir.
      Cache the prelude_msg_t object since it's used by the IDMEF message.
      Revert un-necessary code modification
      The alert might remain cached after it is sent, only add the analyzer object once, remove it afterwise.
      Complete rework of the pcre plugin. Support for dynamic rule scripting:
      Demonstration of newer feature
      Fix double free
      Slight reordering
      Check that context name is always prefixed with '$', error out if it is not. Fix a bug with 'alert' operation not being added to the good path (out of if/for branch).
      Allow 'if' command without comparison value. Useful to check whether a context exist. Ability to check several context at once.
      Move context save/restore to pcre-context.c. pcre_context_set_value_from_string() can now resolve IDMEF context. Various bugfix.
      removed.
      As of now, context require the '$' prefix.
      Let pcre-context resolve the IDMEF message.
      Remove unused global
      Remove old unused code.
      Error handling cleanup
      Datatype fix. Fix a possible memory leak on context destruction.
      Remove debugging spew.
      Fix raw IDMEF list copy (example: target = target).
      Round float values before converting them to string.
      Cleanup. Make it possible to have a variable list index.
      List initialization.
      Implement "else if" and "else" command. Various bug fix in "if" command handling. Implement assignement of multiple values.
      Keep the '$' variable prefix, so that we can do more checking at higher level
      - Handle addition on IDMEF context assignement.
      Try to avoid code duplication. All context operation now have regexp searching capability.
      Correct context pattern matching.
      Slight ruleset fix
      Remove un-needed check. s/prelude-lml/prelude-correlator/
      Fixes time.h inclusion.
      Make timeout explicit int32_t: we need to know it's size for portable context saving.
      Use RETSIGTYPE
      More error checking when loading context from disk. Use prelude_extract_int32_safe() to read context timeout. Fix an useless warning.
      Add support for GnuLib.
      Format string fixes.
      GnuLib + distcheck work.
      GnuLib + distcheck work.
      Add plugin subdir.
      Remove netdb.h inclusion.
      Implement pcre_context_print() and pcre_context_print_all(). Restore timer for any type of context.
      Fix print-input / print-output option, so that they use their optional arguments. Additionally, add a small API for plugin to register signal.
      Register SIGQUIT signal. This signal can now be used to get a dump of all available contexts, and their value.
      Fix EVENTSCAN detection. Correct correlation_alert.name.
      Fix problem with if/for parsing.
      Fix leak due to missing prelude_io_close().
      When merging message, compare field by field, and explicitly skip port and portlist comparison. This is done to avoid merge failure since source->service tend to be different for each correlated message. In the future, it might be a good idea to generate a portlist.
      Improve merging. Require libprelude-0.9.13.2.
      Improve merging. Require libprelude-0.9.13.2.
      Update.
      Correctly set Analyzer->model, Analyzer->class and Analyzer->Version.
      Module path migration: move /trunk/prelude-correlator /prelude-correlator/trunk
      Remove debug spew.
      Add a new "unique" keyword that might now be used when creating a context. Upon
      Remove debug spew.
      New ruleset: business-hour.rules
      Hook business-hour.rules.
      Call prelude_deinit() on exit().
      Whitespace police.
      Whitespace police.
      Add missing prototype.
      Add not equal (!=) if operator.
      Whitespace police.
      Rework logging priority, use prelude_plugin_instance_unsubscribe().
      Fix regression with if comparison returning always true.
      Whitespace police.
      Whitespace police.
      The user can now provide infinite number of "elseif" command.
      Whitespace police.
      Initial LUA support for prelude-correlator. The only
      Implement alert_on_expire keyword, add a debug function.
      Return nil if match can not find match.
      Moved dump() debugging function to lib.lua, handle new match
      Port PCRE firewall.rules to LUA plugin.
      Remove explicit call to lua_gc().
      Proper LUA indentation for LUA class support code.
      Ruleset fixes and optimisation: take advantage of provided LUA
      Port scan.rules and worm.rules to the LUA plugin.
      Cleanup table dump function, rename to tabledump()
      Implement IDMEF:match() method, replacing global match function.
      Fix memory leak.
      Implement IDMEF:get2(), allowing to retrieve an IDMEF value converted
      Implement IDMEF:getAnalyzerID(), allowing to retrieve the last
      Fix broken string initialization.
      We now have two specialized method, IDMEF:get(), which return
      Add some utility function, make the code compatible with LUA < 5.1
      Run each ruleset independantly, this require that all ruleset
      Error handling improvements, bug fixes.
      distcheck fixes.
      Rename option to something more obvious.
      Setup a default instance of the LUA plugin.
      Print out the number of rulesets loaded.
      Correct polling timeout.
      Fix warnings.
      Allow the user to run LUA code out of the LUA rule running function,
      Implement IDMEFTime retrieval. Kill warning.
      Port old PCRE business-hour ruleset to LUA.
      Deprecate PCRE plugin: remove from the build.
      Remove debug output, coding style fixes.
      Build system update.
      Update GnuLib code.
      Initial Prelude-Correlator beta release.
      Always use $(DESTDIR), thanks to Steve Grubb <[email protected]> for
      Check for both lua5.1.pc and lua.pc: differents distributions seems
      Update NEWS, bump version number.
      Fix invalid installation path under certain conditions, thanks
      Correct multi-path detection (was not working with exactly two IDMEF
      Always return a table when retrieving multiple path (even
      Fix problem with business-hour ruleset, of updating a non
      Update GnuLib code.
      Update NEWS, bump version number.
      Fix ctx:set() typo, this fixes one of the problem referenced
      Allow to set 'nil' IDMEF value. This fixes the second issue
      Add AUTHORS file.
      Update GnuLib code.
      Update NEWS, bump version number.
      Fix impact severity / description path, thanks
      s/Prelude-LML/Prelude-Correlator/
      Include signal.h, should fix #318.
      Handle idmef-data type.
      Implement multiple OpenSSH authentication type correlation, courtesy of
      Implement patch by Jeffrey C. Ollie <[email protected]>, which make IDMEF:getraw()
      Whitespace police.
      Replace dshield split() function implementation with a generic string.split()
      Rename table_lookup to table.find
      Re-implement normalize_ip() using string.format(). This speedup and simplify
      Fix Lua compilation problem.
      Complete Lua Timer() implementation. An Lua callback function can
      Do not stop loading if a given Lua ruleset fail.
      Define PRELUDE_CORRELATOR_LIB_DIR, and make it available from Lua ruleset.
      Use PRELUDE_CORRELATOR_LIB_DIR
      Now default to install dshield.lua
      Rewrite of the DShield ruleset featuring:
      Add logging from Lua ruleset. Define info(), warn(), and error() logging function,
      Use local.
      Initial infrastructure.
      Initial Correlation rule port from Lua.
      Rename to pycor
      Add missing IDMEF import.
      Install rulesets, create siteconfig.
      Use siteconfig.lib_dir to store internal data.
      Use path provided by siteconfig as base plugins path.
      Avoid exception if path already exist.
      Fix exception on NULL value.
      Fix typo.
      Launch the plugin by ourself. Additionally, handle plugin exception.
      Fixup indentation.
      flatten the list before looping through it.
      Improved exception printing. Implement getPluginCount().
      Implement __getstate__ and __setstate__ method, so that an IDMEF instance can be pickled() and unpickled().
      Update all ruleset to use the context.search, and context.destroy method.
      Implement simple context timer. Context() will now return the currently
      Wake up timer every second, implement signal handling and context loading/saving.
      Only alert on expire if destroy() is called from a timer. Always stop context timer on destroy()
      Port scan ruleset from Lua.
      Fix typo.
      Improved dry-run mode. Print statistics on SIGQUIT.
      Rewrite Timer() implementation. Implement the stats() function.
      Automatic reloading of DShield data.
      Implement match() as an IDMEF method. Cache compiled regex. Remove
      Fix reset().
      Remove debug spew.
      Use idmef.match().
      Ability to provide a replacement value with the Get() method.
      Reset attribute on expire.
      Port firewall ruleset from Lua.
      Add flatten argument to the Get() method, which default value is True. When retrieving a listed path, the default is to flatten it.
      Remove explicit flatten() usage, the Get() method now automatically perform it
      Code cleanup.
      Add template method.
      Make Get() return an empty list if flatten is specified and there is no value. Remove regex cache since recent Python version already does that. Force the caller to compile the regex by himself.
      Compile the regexp.
      Avoid duplicate check, and compile the regex ourselve.
      Prefix with OPERATOR_, as done in libprelude 0.9.22.
      Update permission prefix.
      Add option usage, and version option.
      Fix exception, use Python hasattr().
      If IDMEF.Get() return None, and flatten is set, only return an empty tuple
      Handle Pickle EOFError, and fixes possible exception when pickling the
      Make dry-run actually work.
      Correctly set IDMEFAnalyzer class, model, manufacturer and version.
      Basic configuration handling. Ability for a plugin to be disabled by default.
      Make it possible to modify default server, uri, and reload time from the configuration.
      Remove debug spew.
      Fix exception.
      Remove everything in preparation for the import of the Python Correlator version.
      Rename from pycor to prelude-correlator
      Merge git://github.com/yoannv/pycor
      Correct business hour detection, thanks J. Ignacio Ormeño <[email protected]> for pointing this out.
      Whitespace police.
      Libprelude version check, require 0.9.23.
      Rename from pycor to prelude-correlator.
      Fix for Python 2.6 deprecation warning, no need to provide arguments to the parent method.
      Initial README file.
      Use setuptools for distribution and plugins.
      Fix typo.
      More typo fixes.
      Automate reference of IDMEF Alert within CorrelationAlert.
      Fix multiple IDMEF.match() issues
      Fix missing argument to BruteForce plugins function.
      Fix DShield host list download address, raise exception if download fail
      Do not reset threshold and alert_on_expire on update.
      Catch exception to secure Timer callback.
      Increase default threshold for bruteUser to 5
      Include GIT generated Changelog when making source distribution
      Update NEWS, bump version number.

_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog