root/psad/tags/psad_1_3_1_r1/ChangeLog

psad-1.3.1 (12/25/2003):
    - Added the ability to import /var/log/psad/<ip> directories
      back into memory so scan data remains persistent across
      psad restarts or system reboots.
    - Added --Analyze-msgs to run psad in analysis mode against an
      iptables logfile (/var/log/psad/fwdata by default).  The logfile
      path can be changed with --messages-file.
    - Added icmp type and code validation against RFC 792.
    - Bugfix for being too strict with FW_MSG_SEARCH.
    - Added port ranges for tcp and udp scans in <ip>/<dst>_packet_ctr.
    - Added <ip>/<dst>_start_time and <ip>/os_guess.
    - Bugfix for missing --no-signatures code.
    - Updated to Snort-2.1 signatures.

psad-1.3 (11/30/2003):
    - Replaced all signatures in psad_signatures with updated snort
      rules.
    - Added support for source and destination ip addresses in
      signature matching code.  A new variable "HOME_NET" makes this
      possible.
    - Added support for the iptables output chain.
    - Added chain tracking for all signatures.
    - Replaced match_fastsigs() with two new routines for tcp and
      udp signature matching that don't autovivify hash keys.
    - Removed support for ipchains.
    - Added support for metalog.
    - Removed all "Undefined Code" signatures from psad_signatures.
    - Re-worked %auto_blocked_ips hash and corresponding blocking
      routines.  This (hopefully) fixes a restart bug seen on older
      systems such as those that are still running versions of perl
      less than 5.6.
    - Re-worked firewall policy parsing routines.  Chains that have
      a default policy of DROP are handled properly now.
    - Bugfix for missing NULL char in kmsgsd.c.
    - Updated scan alerting format.  Put current interval protocol
      status before source and destination addresses.
    - Buffer overflow fix in kmsgsd.c for size of buf[MAX_LINE_BUF]
      buffer in read() call.
    - Added --no-kmsgsd option to aid in psad --debug mode.

psad-1.2.4 (10/15/2003):
    - Added danger level to subject line in email alerts.
    - Removed diskmond altogether since psad now handles disk space
      thresholds directly.  This allows filehandles to be handled
      properly.
    - Added auto_block_ignore_ip() to prevent 0.0.0.0, 127.0.0.1,
      and local interface ips from being included in auto blocking
      routines.
    - Added Bit::Vector module to stop installation warnings from
      Date::Calc.
    - Made get_local_ips() called periodically since local addresses
      may change (dhcp, etc.).
    - Added installation code and init script for Gentoo Linux.
    - Bugfix for INIT_DIR in uninstall() routine in install.pl.
    - Bugfix for auto-blocking loop after timeouts are hit.
    - Added --status-dl [N] to display status information only for
      those scans that reach at least [N].

psad-1.2.3 (09/12/2003):
    - Added interface tracking for scans.
    - Bugfix for not opening /etc/hosts.deny the right way in
      tcpwr_block().
    - Bugfix for psadfifo path in syslog-ng config.
    - Better format for summary stats section in email alerts.
    - Bugfix for INIT_DIR path on non-RedHat systems.
    - Bugfix for gzip path.
    - Make Psad.pm installed last of all perl modules installed
      by psad.
    - Added additional call to incr_syscall_ctr() in psadwatchd.c

psad-1.2.2 (08/24/2003):
    - psad is finally available as an RPM package.
    - Added chain tracking for iptables.
    - Added chain counts to --Status output.
    - Bugfix for psad not taking into account multiple scan
      destinations.
    - Reworked auto-blocking code for both tcpwrappers and
      iptables.  Lines added to /etc/hosts.deny will no longer be
      duplicated.  Added IPTABLES_AUTO_RULENUM and
      IPCHAINS_AUTO_RULENUM so auto rules can be inserted at a
      configurable point within iptables and ipchains policies.
    - Psad now installs all perl modules within /usr/lib/psad.
    - Removed /var/log/psad/<ip>/scanlog file since it was wasting
      too much disk.
    - Made psad, psadwatchd, and diskmond take the machine hostname
      from their respective config files.  This makes installation
      via the rpm easier, and is generally cleaner.
    - Added scan destination in --Status output.
    - Added --status-sort-dl (the default status output is now
      sorted by ip address by default).

psad-1.2.1 (07/11/2003):
    - Bugfix for multiple processes being spawned by psadwatchd
      due to lack of proper config variables in the new split
      daemon config files.
    - Bugfix for old scan messages being regenerated if a HUP
      signal is received.
    - Bugfix for incorrectly calculating disk utilization in
      diskmond.c.
    - Extended install.pl to include compression for archived
      files in /etc/psad.
    - Added preserve questions in install.pl for the psad
      signature and auto ips files.
    - Bugfix for --USR1 command line switch not mapping to the
      correct subroutine.
    - Bugfix for psad man page missing the pipe character in
      psadfifo line for syslog.conf.

psad-1.2 (06/18/2003):
    - Added passive OS fingerprinting based on packet ttl, length,
      tos, and id fields.
    - Added dshield.org alerting capability.
    - Added exec_external_script() for external script execution.
    - Added auto blocked timeouts.
    - Implemented config re-imports via HUP signals in a manner
      similar to various other system daemons (sysylog, apache
      etc.)
    - Better --Status output that shows packet counts per protocol
      for each ip.
    - Added --ip-status for more verbose status output for a
      particular ip address.
    - Added config preservation code to install.pl.
    - Added Psad::psyslog().
    - Split psad.conf into a separate config file for each of the
      four psad daemons.
    - Completely re-worked the auto blocking code (made dedicated
      files for iptables and ipchains block methods).
    - Added danger level hash.
    - Minor code cleanups (shorter hash keys, etc.).

psad-1.1.1 (04/26/2003):
    - Bugfix for incorrect usage of %scan hash keys associated
      with tcp/udp when the current protocol is icmp.
    - Bugfix for being too strict on iptable default log string.
    - Reworked USR1 signal handler so the Data::Dumper function
      call is made in the main part of the psad code.
    - Added a startup message for psad.
    - Minor bugfix for leading whitespace in auto_ips.

psad-1.1 (04/20/2003):
    - Added the IPTables::Parse module for better processing of
      the iptables ruleset.
    - Added --snort-sids so that iptables messages generated by
      fwsnort can be included in alerts.  Such alerts now include
      the content fields of packets (fwsnort uses the iptables
      string match module).
    - Added the ability to specify entire networks in the auto
      ips file through the use of the Net::IPv4Addr module.
    - Better logging format that reinstates the current interval,
      and adds an "overall stats" section that includes packet
      counters per protocol.
    - Removed the PROTO hash key since it was unnecesssary.
    - Better benchmarking code.
    - Bug fix for incorrectly looking for the "MAC" string in
      iptables messages that could have been generated by the
      FORWARD chain.

psad-1.0 (02/27/2003):
    - Added --Benchmark and --packets command line options to support
      psad benchmarking.
    - Bugfix for improperly detecting NULL scans.
    - Completely redesigned website.

psad-1.0.0-pre4 (11/26/2002):
    - Rewrote kmsgsd and psadwatchd in C.