2002-08-29  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* configure.in: bump version number to 0.8.1.

	* NEWS: update release notes.

	* src/file-server.c (file_server_monitor_file): 
	added a log() telling the file doesn't exist and that
	we'll try to re-open it periodically.

2002-08-24  Guillaume Pelat  <endymion@linux-secure.com>

	* src/log-common.c (log_container_new):
	* src/pconfig.c (set_pidfile):
	(set_udp_server_addr):
	checking strdup return value.

	* src/udp-server.c (udp_server_new):
	fixing memory leak

2002-08-21  Guillaume Pelat  <endymion@linux-secure.com>

	* src/file-server.c (check_modification_time):
	fixed assert problem when two modifications are
	done in the log file at the same second.

2002-08-21  Guillaume Pelat  <endymion@linux-secure.com>

	* src/file-server.c (logfile_alert): 
	* src/regex.c(regex_init):
	replace strncpy by snprintf.

2002-08-21  Guillaume Pelat  <endymion@linux-secure.com>

	* src/file-server.c (logfile_alert): fix unterminated
	string.
	
	* plugins/simple/simple.c (parse_include): fix unterminated
	string. Close the open file.

	* src/regex.c: coding style fixes
	(regex_init): fix unterminated strings.
	
2002-08-20  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-common.c (format_syslog_header): 
	return -1 if buf is NULL.
	
	(log_container_new): some of the argument might be NULL.
	(log_container_delete): ditto.

	* configure.in: require autoconf >= 2.53.

2002-08-16  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (file_server_wake_up): cleanup.
	(logfile_alert): new function.
	(process_logfile): new function.

	(is_file_already_used): check the logfile hard link count, emit an
	alert if we reach 0.
	
	(check_modification_time): emit an alert if modification time got
	modified, but file size didn't increase.

	* src/lml-alert.c (lml_emit_alert): 
	there might be no log entry.

	* plugins/simple/simple.c (emit_alert): 
	coding style fix.

	* src/file-server.c: last_size is off_t, not time_t.
	new last_mtime member.
	
	(file_server_monitor_file): dup the filename before
	checking if opening the file suceeded, so that reopening
	inactive file work again.

2002-07-30  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* configure.in: update version number to 0.8.0.

2002-07-29  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	Thanks to DINH Viet Hoa <dinh.viet.hoa@free.fr>, 
	for reporting all theses problem:
	
	* src/include/queue.h: 
	rename queue_t to lml_queue_t to avoid namespace
	conflict.

	* src/file-server.c (read_logfile): 
	clearerr_unlocked is not standard. Use clearerr.

	* src/log-common.c: include string.h.

	
	* src/regex.c (trim): 
	* src/log-common.c (format_syslog_header): 
	cast to int when calling isalnum and isspace.

	
2002-07-11  Yoann Vandoorselaere  <yoann@prelude-ids.org>

	* plugins/debug/debug.c (set_debug_state): 
	(set_output): fix the latest prelude getopt API
	change.

2002-06-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* fit latest prelude-getopt API change.

2002-06-26  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c (read_multiline): 
	moved to libprelude, common function.
	(parse_ruleset): use prelude_read_multiline().

2002-06-16  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c: 
	Included patch from Arnaud Guignard <arnaud.guignard@free.fr> 
	to handle the process IDMEF object.

2002-06-14  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* Makefile.am (install-data-local): 
	use $(DESTDIR) as the top prefix for installing stuff.

2002-06-13  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

        Patch from Arnaud Guignard <arnaud.guignard@free.fr> :

	* plugins/simple/simple.c (parse_ruleset):
	fixed a bug when a TAB was at a beginning of a line in a
	multiline rule.

2002-06-10  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* configure.in: only enable gtkdoc if requested.

	* plugins/simple/ruleset/simple.rules (include): 
	include grsecurity.rules.

	* plugins/simple/simple.c (read_multiline): 
	new function, handle multiline (line ending with \).

	(parse_ruleset): use read_multiline().
	(parse_ruleset): handle TAB at the begining of the line.
	

2002-06-06  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/lml-alert.c (generate_analyzer): 
	generate analyzer. Use prelude_analyzer_fill_infos().
	(send_heartbeat_cb): use generate_analyzer()
	(lml_emit_alert): ditto.

	* plugins/simple/ruleset/grsecurity.rules: 
	Included GRsecurity ruleset, from Brad Spengler 
	<spender@grsecurity.net>. 

	Hand modified it a little to add some missing parenthesis, 
	and change /d and /w to \d and \w respectively.

	* plugins/simple/ruleset/Makefile.am (ruleset_DATA): 
	install grsecurity.rules.

2002-06-03  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/lml-alert.c (lml_alert_init): 
	setup analyzer here; register heartbeat callback.
	(lml_emit_alert): copy global analyzer.
	(send_heartbeat_cb): new function, send an heartbeat
	message.

	* src/main.c (main): 
	call lml_alert_init() after pconfig_set, because
	lml_alert_init now call libprelude function.

	* src/lml-alert.c (send_heartbeat_cb): 
	new function, send an heartbeat.
	(lml_alert_init): 

2002-05-31  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-common.c (format_syslog_header): 
	format the syslog timestamp. 

	(format_syslog_header): 
	don't show parsing error... We parse file that don't have the
	syslog format...

	We use strptime() in order to do that, combined with localtime()
	to get missing information, and mktime() to convert back to a
	timeval.

2002-05-31  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* plugins/simple/ruleset/ipfw.rules: updated to use new SimpleMod
	capabilities.

2002-05-30  Laurent Oudot  <oudot.laurent@wanadoo.fr>

	* plugins/simple/simple.c
	remove a debuging printf() in the changelog (suggested by yoann)

2002-05-30  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/lml-alert.c (lml_emit_alert):
	include string.h for strlen()... Thanks to 
	Razvan Cosma (razvan.cosma@catv.telemach.ro) for pointing this out.
	
	* plugins/pax/pax.c (pax_log_processing): 
	* plugins/debug/debug.c (debug_run): 
	* src/lml-alert.c (lml_emit_alert): 

	use idmef_additional_data_set_data().

2002-05-30  Laurent Oudot  <oudot.laurent@wanadoo.fr>

        * plugins/simple/ruleset/netfilter.rules:
        upgrade of the rules owing to the new simple.c possibilities

2002-05-30  Laurent Oudot  <oudot.laurent@wanadoo.fr>

        * plugins/simple/ruleset/zyxel.rules:
        upgrade of the rules owing to the new simple.c possibilities

2002-05-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (try_reopening_inactive_fd): 
	remove unused variable.

2002-05-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>
	
	Patch from Arnaud Guignard <arnaud.guignard@free.fr> :
	
	* plugins/simple/simple.c: added patch to handle
	IDMEF source node category, source node location,
	source node name, source spoofed, source interface,
	source service port, source service protocol,
	source service name, source service portlist,
	target node address, target node category, target
	node location, target node name, target decoy,
	target interface, target service port, target
	service protocol, target service name, target
	service portlist.

	(record_source_fields): fix the impossibility to have
	several source/target node addresses.

	* plugins/simple/ruleset/simple.rules: added definitions
	for each new IDMEF tag.
	
2002-05-21  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/pconfig.c (set_file): 
	file_server_monitor_file() now open the file by itself.

	* src/file-server.c: 
	use list instead of array to store monitor. Now we have
	an active FD list and an inactive FD list.
	
	(file_server_monitor_file): don't take the file handle as
	argument anymore, we open the file by ourselve. Mark the file
	as inactive if we can't open it.

	(file_server_wake_up): 
	if st_nlink is 0, then the file doesn't exist on the filesystem
	anymore, mark as inactive, and try reopening later.
	
	(try_reopening_inactive_fd): new function, try opening
	monitor marked as inactive.

2002-05-16  Baptiste Malguy <baptiste@malguy.net>

        * src/*-plugins.c (*_plugins_init):
        don't return an error if the plugin directory doesn't exist.
        But do so in case of permission problem.

2002-05-05  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/include/Makefile.am (include_HEADERS): 
	install needed include file.

	* Makefile.am (preludeconfdir): fix make distcheck.

2002-04-30  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c: included patch from
	Arnaud Guignard <arnaud.guignard@free.fr> to handle 
	IDMEF source node address.

2002-04-29  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/ruleset/netfilter.rules:
	MAC content can be empty.

2002-04-28  Laurent Oudot <oudot.laurent@wanadoo.fr>

	* plugin/simple/ruleset/netfilter.rules: new file. Rules for netfilter 
	firewall on Linux 2.4.x boxes.

	* plugins/simple/ruleset/Makefile.am: added netfilter.rules

	* plugins/simple/ruleset/zyxel.rules and cisco.rules: added comments. 

2002-04-27  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* plugins/simple/ruleset/ipfw.rules: fixes, cleanup, ICMP support. 

	* plugins/simple/ruleset/Makefile.am: added ifpw.rules

2002-04-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* configure.in: use AM_PROG_LIBTOOL, for older 
        libtool/automake installation.

	* src/file-server.c (read_logfile): 
	return the number of byte read.
	
	(file_server_wake_up): if we get EOF, without reading all
	the new available byte, remeber how many byte are left to 
	be read, and retry even thought st_size isn't modified.

	* src/log-plugins.c (subscribe): 
	(unsubscribe): be more verbose - not only debug.

	* src/file-server.c (file_server_monitor_file): 
	(file_server_wake_up): use st_size, not st_mtime.

	also include libprelude/timer.h

2002-04-27  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* file-server.c: (read_logfile): 
	use clearerr_unlocked() after hitting EOF on observed file. 
	Fixes problem on FreeBSD. 

2002-04-27  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>
	
	* plugins/simple/ruleset/ipfw.rules: new file. Rules for ipfw
	firewall on FreeBSD.

	* plugins/simple/ruleset/simple.rules: include ipfw.rules

2002-04-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-plugins.c (subscribe): 
	(unsubscribe): be more verbose about subscribed plugins.

	* src/file-server.c: include timer.h.

	* plugins/simple/simple.c: 
	(parse_ruleset): 
	make rulesnum global, this is because of the way we parse include.

	(filter_string): fix off by one error resulting in trailing whitespace
	not being removed.

	(set_simple_ruleset): move the printf telling number of rules loaded
	here, so that we don't get duplicate printf() for each included file.

2002-04-27  Laurent Oudot  <oudot.laurent@wanadoo.fr>

	* plugins/simple/ruleset/simple.rules:
	Added include directive for specific rules in cisco.rules and
	zyxel.rules.
	The include directive is very cool because it will help at maintaining
	the rules (if you don't need for example zyxel rules, you can put a
	simple # character before the include directive). 
	
	* plugins/simple/ruleset/cisco.rules:
	New file dedicated to cisco rules.
	
	* plugins/simple/ruleset/zyxel.rules:
	New file dedicated to zyxel rules.

2002-04-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (file_server_monitor_file): 
	use calloc() to allocate the monitor_fd_t object.
	This fix a possible unitialized read.

	* plugins/simple/simple.c (parse_include): 
	return -2 on success.
	
	(parse_rule): -1 mean error, other value < 0 just
	mean to stop the processing for this line.

2002-04-27  Laurent Oudot  <oudot.laurent@wanadoo.fr>

	* plugins/simple/ruleset/simple.rules :
	Added ZyXEL routers and firewalls support.
	It will help at dealing with ZyXEL network equipments used with 
	security filtering features.

2002-04-26  Laurent Oudot  <oudot.laurent@wanadoo.fr>

	* plugins/simple/ruleset/simple.rules :
	Added a contrib from Arnaud Guignard <arnaud.guignard@free.fr> 
	(plugin regex rules) and me (for the cisco part) that aims at
	dealing with cisco security routers alerts.
	It's just a beginning that will be improved in the future.

2002-04-26  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c (parse_ruleset): 
	strip out \n.
	
	(parse_rule): handle include rule.

	(parse_include): new function, parse include rule.
	If the path is not absolute, then we append the current
	rulesetdir to this filename.

2002-04-25  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-common.c (format_syslog_header): 
	revert 2002-04-24, which was not needed (sscanf don't need
	precision).

2002-04-24  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-common.c (format_syslog_header): 
	In order for the printf() family function to put a limit to 
	the len of a copied string, a precision have to be given
	(%255s is not valid, %.255s is).

2002-04-12  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (read_logfile): 
	(file_server_wake_up): 

	stop using fgets to read the logfile: we now use getc_unlocked,
	and handle fine the case where :

	- the buffer is too small.
	- we meet EOF before meeting EOL.

	which avoid us being desynchronized. The read buffer is now
	per file monitor.
	
2002-04-08  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c: try to do time consuming stuff
	at initialisation time.

	* src/regex.c: 
	instead of searching at runtime for the plugin to use
	(using string compareason), resolve plugin dependency
	at initialisation time, and store a pointer to the plugin
	that need to be ran for a given regex.

	(regex_exec): the callback now take the plugin as argument.

	(regex_init): call regex_create_entry instead of doing
	everything ourselve.
	
	(regex_create_entry): new function.
	

	* src/log-plugins.c: 
	we do not use hashkey anymore.

	(log_plugin_run): take the plugin to run as argument.
	It's now up to the caller to know which plugin to run.

	* src/hashkey.c: removed.

	* Makefile.am (install-data-local): 
        Only install default configuration file if it does not
        exit... If a configuration file is already present, warn
        the user and install in prelude-lml.conf-dist.

2002-04-05  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* src/lml-alert.c: include <inttypes.h> and <sys/types.h>
	(FreeBSD compat. fix)

2002-04-04  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (file_server_wake_up): 
	use buffered IO.

	* plugins/simple/simple.c: 
	(store_runtime_variable): new function, keep pointer
	to string that use backward reference.

	(simple_run): call resolve_variable and free_variable_allocated_data().

	(free_variable_allocated_data): 
	new function.
	
	(resolve_variable): new function. Use backward reference
	associated with the matched regex to resolve variable.

	(replace_str): replace a given variable in a string.

	The Simple plugin now support backward reference in IDMEF field setting. 
	This mean you can have dynamic text in IDMEF field. 

2002-04-03  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* plugins/simple/simple.c (filter_string): 
	use strchr, not strchrr, to search key - value
	delimiter. 

	* src/udp-server.c (udp_server_standalone): 
	save the set and restore it when select() return.

2002-04-02  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/log-common.c (format_syslog_header): 
	new function, parse the syslog header. 

	* src/lml-alert.c (generate_target): 
	new function, take care of including target_program and
	target_hostname in the IDMEF alert.
	(lml_emit_alert): call generate_target().

	* src/file-server.c (file_server_wake_up): 
	set backslash 0 at the end of the buffer.

	* src/pconfig.c (set_file): now that we do not
	rely on server logic to add file monitor, we can add
	monitor from the option callback.

	* src/udp-server.c: make the size of our buffer 
	compliant with what is specified in RFC 3164 (1024
	bytes max per syslog messages).

	* plugins.rules.in: comment the Debug plugin entry 
	by default.

2002-03-29  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/file-server.c (file_server_monitor_file): 
	set current mtime.

	* plugins/simple/simple.c (parse_impact_desc): 
	new function, parse impact description.
	(parse_rule): 
	Handle impact description.

	(simple_run): detail debuging output a little more.

	* plugins/simple/ruleset/simple.rules: 
	some more rules, and some documentation.

	* src/main.c (lml_dispatch_log): 
	new public function that should be called when we have a new log
	line. This function handle both the case when we're threaded
	(UDP + file monitor), or when there is no thread (file monitor only).

	* src/udp-server.c (udp_server_standalone): 
	select with a timeout of one second. Call file_server_wake_up
	every seconds.

	* src/file-server.c: 
	stop using server-logic.c. We now have an array of FD to monitor.
	In order to do so, we check the FDs modification time and read 
	data if available, then we go to sleep (as tail does).

	(file_server_wake_up): 
	to be called by a working thread instead of file_server_standalone()
	(for exemple if we also have an UDP server).

	(file_server_standalone): 
	new function for starting the file monitor.
	
	* src/server-logic.c:
	Because there is no way to tell read() / select() to block on
	EOF for regular file, server-logic.c isn't an adapted solution.
	Removed.
	
2002-03-29  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/server-logic.c (server_logic_process_requests): 
	(child_reader): don't accept connection before the thread
	install the signal handler for SIGUSR1.

	* prelude-lml.conf.in (file): 
	now that we are able to have the same entry with different
	value several time in config file (libprelude), add new file
	to monitor.

2002-03-28  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* plugins/simple/simple.c: include <inttypes.h> and <sys/types.h>
	(needed for libprelude/* on FreeBSD)

2002-03-28  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/lml-alert.c (lml_emit_alert): 
	fill in more informations... Still many work to do.

	* src/file-server.c (read_file): 
	remove debugging printf().

	* src/udp-server.c (udp_server_standalone): 
	use a bigger buffer. We don't want to rely on ethernet stuff.

	* plugins/pax/pax.c (pax_log_processing): 
	* plugins/simple/simple.c (emit_alert): 
	use lml_emit_alert().

	* src/lml-alert.c: 
	new file providing facility for alert emition.
	Every plugin should use theses functions.

	* plugins/simple/simple.c: 

	This is the start of the Simple plugin. This plugin
	have a ruleset, composed of regex, and of information
	to fill in the alert if the regex match.

2002-03-28  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* plugins/debug/debug.c: revert to including <inttypes.h> instead of
	<stdint.h> for compatibility with FreeBSD 4.x and conformance
	with other Prelude modules. 

2002-03-27  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/hashkey.c (hash_position): 
	cast to unsigned int, lot of cleanup.

	* src/file-server.c (file_server_monitor_file): 
	take an already open FD as argument (so that we don't 
	require root access here).

	* src/udp-server.c (udp_server_start): 
	reader and queue are passed to udp_server_start,
	not udp_server new.

	* src/pconfig.c (pconfig_set): 
	new -u (--user) option. Prelude LML can now run as a
	simple user.

	* src/udp-server.c (udp_server_new): 
	resolve the provided address if any. Else use INADDR_ANY.

	* src/pconfig.c (pconfig_set): 
	add configuration hook for enabling the UDP server,
	setting server address, setting server port.

	* src/main.c (sig_handler): 
	only call udp_server_close if an UDP server is active.

	(main): only start the UDP server if the user want it.

	* prelude-lml.conf.in: 
	Update default configuration file.

2002-03-26  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* src/regex.c: 
	* src/main.c:
	more cleanup, performance fix.

	* src/regex.c (regex_destroy): 
	use list_for_each_safe

	* src/file-server.c: 
	monitor local files.

	* src/server-logic.c: 
	used by file-server implementation.

	* src/pconfig.c: 
	(pconfig_set): add the --file option.

	* src/main.c: 
	* src/queue.c: 
	* src/udp-server.c: 
	* src/log-plugins.c: coding style fix.

	
2002-03-22  Krzysztof Zaraska  <kzaraska@student.uci.agh.edu.pl>

	* plugins/pax/pax.c: include <inttypes.h> and <sys/types.h>
	for compatibility with *BSD systems

2002-03-22  Yoann Vandoorselaere  <yoann@mandrakesoft.com>

	* AUTHORS: 
	Pierre-Jean Turpeau, not me :-)
	
	* src/Makefile.am (DEFS): local include before anything else.

