summaryrefslogtreecommitdiff
path: root/net/snort
AgeCommit message (Collapse)AuthorFilesLines
2002-12-09Replace "true" by "${TRUE}".tron1-2/+2
2002-11-09COMMENT should be set in Makefile, not any common Makefile parts.wiz2-3/+3
2002-10-13Update snort to 1.9.0. Changes:hubertf6-78/+120
Lots of new rules, extended analyzing of packages etc. Fixes PR 18637 by Adrian Portelli <adrianp@stindustries.net>
2002-10-10Use BUILDLINK_PREFIX.libpcap.wiz1-3/+3
2002-10-10buildlink1 -> buildlink2.wiz1-3/+4
2002-10-10Remove libpcap buildlink.mk inclusion -- it's included in all the files thatwiz1-3/+1
include this file.
2002-07-15Update to 1.8.7, prompted by Mipam.wiz3-10/+10
Changes: The main purpose of this release is a stable target with many fragroute and tcp connection oriented fixes. This is also the last release of the 1.8.7 line and signals the start of the beta cycle for the 1.9 branch.
2002-04-15Remove SNORT_USE_PGSQL option. This will be split out into a separaterh2-44/+45
package. For that purpose, move most of Makefile into a new Makefile.common.
2002-04-14Add a SNORT_USE_PGSQL option to compile in PostgreSQL support (and addrh1-2/+5
the appropriate dependency). Patch provided by ww@GROOVY.NET
2002-04-10Update snort to 1.8.6. Patch provided in private mail by Mipamrh2-5/+5
<mipam@ibb.net>. From the release notes: 1.8.4 and 1.8.5 both had bugs that were found right as we were ready to do a full release and represented good midway points but 1.8.6 should be the stable target. Changes include: * The ICMP decoders have been rewritten. * (This is a summary of recent changes -- not all mine) * Fixed stream4 offset initialization * Double Open of snort log file * Lots of new rules * Fatal error on problems other than -> and <> * Fixed stream4 several low memory conditions * Error checking in stream4/frag2 argument parsing * snort-db schema updates to 1.05 * --with-pcap-includes should now look at specified pcap * packet statistics now should be more accurate with regards to lost frags * double PID file write * S4 alignment problems on SPARC fixed ( rpc_decode still has SPARC alignment errors ) * new snmptrap code * documentation updates * Stability fixes in frag2 * SEQ / ACK checking should be correct * Reassembled packets with stream4 will now also be inspected when using -z est * ip fragments are now calculated correctly * rule headers correctly matched ( multiple CIDR performance greatly increased )
2002-04-02Update snort to 1.8.4 (update was provided by Mipam <mipam@ibb.net> in arh5-27/+36
private mail -- thanks!) Changes are: * Fixed stream4 offset initialization * Double Open of snort log file * Lots of new rules * Fatal error on problems other than -> and <> * Fixed stream4 several low memory conditions * Error checking in stream4/frag2 argument parsing * snortdb schema updates to 1.05 * --with-pcap-includes should now look at specified pcap * packet statistics now should be more accurate with regards to lost packets werwerwerwerwer * double PID file write * S4 alignment problems on Sparc fixed * new snmptrap code * documentation updates * Stability fixes in frag2
2002-03-29add leftovershubertf1-1/+2
2002-03-13Add powerpc/macppc supportjmc2-1/+15
2002-02-15mkdir -> ${MKDIR}skrll1-2/+2
rmdir -> ${RMDIR} rm -> ${RM} (${RM} added to PLIST_SUBST) chmod -> ${CHMOD} chown -> ${CHOWN}
2001-12-05Normalise all the uses of "wheel", and "root" for ${ROOT_GROUP}, now thatagc1-10/+2
the definition is available in all the defs.${OPSYS}.mk files.
2001-12-02Update snort to 1.8.3; changes since 1.8.2 include:kleink2-5/+5
Major repairs include a fix to frag2 on Linux platforms, the icmp decoder and printout routines were updated to match the data structures that I implemented in 1.8.1 and the flexresp code was repaired and should now be faster, plus the usual rule updates. I also added a new "-B" command line switch to convert IP addresses in a pcap file to a new specified IP subnet addresses.
2001-11-28Update snort to 1.8.2; changes since 1.8.1 include:kleink4-14/+20
* fixed UTC timestamps * fixed SIGUSR1 handling, should reset properly now after getting a signal * fixed PID path generation code, PID files go in the right place now * fixed stability problems in stream4 * fixed stability problems in frag2 * tweaks to spo_unified for better integration with barnyard * added -f switch to turn off fflush() calls in binary logging mode * added new config keyword to stream4, "log_flushed_streams", which causes all buffered packets in the stream reassembler for that session to be logged in the event of an event on that stream (must be used in conjunction with spo_log_tcpdump) * added packet precacheing for flexresp TCP packets, responses should be generated more quickly * fixed rules parser code for various failure modes * several new rules files and a new classification system
2001-11-07Only use DLT_PPP_{SERIAL,ETHER} on systems that actually have ithubertf2-7/+26
(i.e. on 1.5 and up). (I *love* digging such stuff out of CVS logs...) Requested by wiz in private mail.
2001-10-31Move pkg/ files into package's toplevel directoryzuntum3-2/+2
2001-09-11Use libpcap buildlink.mk instead of OS test. By Stoned Elipot from pkg/13928.wiz1-2/+4
2001-08-24At least depend on the right version of pcal for SunOS or Linux.abs1-3/+3
2001-08-22Upgrade snort to 1.8.1. Changes:hubertf3-37/+50
* SNMP alerts * IDMEF XML output (the Silicon Defense plugin is integrated into the main codebase now) * Limited regex support in the rules language * New packet counters for stream4 and frag2 * New normalization mode for http_decode
2001-08-22regenwiz1-1/+2
2001-08-22Teach snort about our DLT_PPP_*hubertf1-0/+15
2001-08-03upgrade to 1.8p1.itojun3-28/+44
for list of changes, see http://www.snort.org/snort-files.htm default rule files are now named *.rules, not *-lib.
2001-04-21Move to sha1 checksum, and/or add distfile sizes.wiz1-2/+3
2001-04-17+ move the distfile digest/checksum value from files/md5 to distinfoagc2-7/+1
+ move the patch digest/checksum values from files/patch-sum to distinfo
2001-02-26Update to 1.7, provided by Mipam in private mail.wiz3-12/+17
Changes: lots of bugfixes, many new plugins, SPADE (statistical anomaly detector), and more.
2001-02-17Update to new COMMENT style: COMMENT var in Makefile instead of pkg/COMMENT.wiz2-2/+2
2000-12-27Update snort to 1.6.3.2. Notable changes include:rh3-13/+32
Fixes and additions: * Fixed compilation problems on all non-BSD operating systems * Added better configuration support for locating libpcap * Fixed ICMP ping packet id/sequence printouts * Made allowances for 64-bit machines in the decoders * Updated the portscan detector to the latest version * Disabled the defragmenter by default (in the rules file) * Added a patch from Dave Dittrich to make daemon mode alerts filenames conform * to the data in the documentation * Revamped the ICMP data structures to mimic those found in *BSD and provide for higher fidelity decoding/printout in the future * Repaired the output plugins so that they operate properly now * For the record, the payload dump conforms to the length of the IP datagram now and does not show pad bytes added by the minimum Ethernet frame size * Applied Chris Cramer's byte ordering patch to the flexresp code Other updates and changes since version 1.6: * New preprocessor plugin: IP defragmentation!! * New output plugins cover all old logging and alerting options * New output plugin no logs to MySQL, PostgreSQL, unixODBC databases * Updated portscan detection functionality * Added quote removal for most plugin parsers * -C crash bug fixed * PID/PATH_VARRUN file fixes * Converted many putc(3) calls to fputc(3) for portability * Transport layer decoders use ip_len field for length metric now * String tokenizer code modified for more reliable operation * Fixed flexible response code sequence prediction * Fixed DEBUG ifdef's so DEBUG mode code will compile correctly on all platforms * Set automake options so that people don't need gmake anymore to build Snort on BSD systems * Fixed SMB alert code large tmp file hole * Added sigsetmask code to fix SIGHUP weirdness * Added execvp option for SIGHUP restart code * Added ARP header printout validation * Added Session logging file integrity checking * Added -u/-g setuid/gid capability switches * Added -O IP address obfuscation switch * Added -t chroot switch * Fixed non-TCP/UDP/ICMP transport layer decoding & logging * Fixes and additions to the portscan preprocessor * Fixed Tru64 u_int* type declarations * Added check for pcap.h into configuration script * Fixed timeval problems on Linux boxen * Database logging plugin has been modified extensively, see the www.incident.org website for more information * Switched TCP flags printout routine to ensure proper RFP output scan output. ;) * Fixed default log/alert function code so that these functions are never NULL
2000-05-28Update checksum, distfile seems to have changed. Fixes pkg/9892.wiz1-2/+2
2000-03-20Upgrade snort to version 1.6. Changes since version 1.5.1 include:agc4-25/+9
New features: * Token Ring and FDDI decoder support * Snort ported to Tru64/Alpha, IRIX 6.X, and AIX * Output plugins added (modular output system) * John Wilson greatly improved the speed of the content pattern matcher * Added FlexResp (active response) plugin from Christian Lademann * Snort man page now ships with the distribution * Snort now generates a PID file for easier integration with scripting * Added support for "stealthed" network interfaces New command line switches: * -q => quiet mode (no stdout printing) * -C => print payload ASCII content only * -P => set explicit snaplen for packet collection Plugins: * Added Postgres SQL DB logging output module from Jed Pickel * Added portscan detection plugin from Patrick Mullen * HTTP decode preprocessor largely rewritten and much more accurate * Minfrag rule moved to preprocessor module * Added ICMP ECHO ID check plugin * Added ICMP ECHO sequence check plugin * Added RPC analysis plugin from Mark Hindess * Added IP option analysis plugin * Added nocase plugin (makes content rules work with case insensitivity) * Added syslog output module with user definable syslog facility * Added tcpdump output module (and building without patches on Solaris).
2000-02-04Update snort to 1.5.1rh3-5/+7
Changes are: * fixed a problem with pass rules not being applied properly * fixed a #include ordering statement for Slackware 4.0 installs * fixed banner output for the -V option * Token Ring decoding is now fully functional * Added packet buffer cleanup code to all protocol decoders * fixed a problem with improper TCP option output * Added a Snort man page
2000-02-02Make this package work on Solaris.agc3-2/+33
2000-01-15update snort to 1.5; added distribution sites, install example configs.wiz4-8/+44
From the Readme: Version 1.5 adds major new functionality! Detection and preprocessing plugins, session logging, rules file variables and includes, five new network layer decoders including ISDN and Token Ring support, new detection functionality, and a bunch of other cool stuff.
2000-01-05Strip trailing '.', and/or leading '(a|an) 'abs1-1/+1
1999-09-10Initial import of snort-1.2.1, a libpcap-based packet sniffer/logger.rh5-0/+40
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-19 16:03:11 +0000