-
Notifications
You must be signed in to change notification settings - Fork 0
/
NEWS
513 lines (266 loc) · 14.6 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
* 2010-03-16, libpreludedb-1.0.0:
- No changes since rc1.
* 2010-01-29, libpreludedb-1.0.0rc1:
- Fixes insertion failure for ProcessEnv
- Retrieve the correct table for application of Time criteria. The old
implementation could use the CreateTime table in place of a DetectTime
table, when asked for the table handling a detect_time element.
- [preludedb-admin]: Do not account for EOF in loaded messages
statistics
- [preludedb-admin]: Fix a problem where the offset was not correctly
calculated when retrieving events to be copied, if the number of
events copied in the previous transaction didn't exceed the
events_per_transaction limit.
- [preludedb-admin]: Correctly propagate error return on loaded messages
read error. Fix a possible crash in case of invalid input message.
- [preludedb-admin]: Fix events deletion/move bugs. When deleting events
without specifying the --count parameters, only half of the events
would be moved/deleted.
* 2009-07-15, libpreludedb-0.9.15.3:
- libpreludedb distribution was missing SWIG generated bindings.
* 2009-07-10, libpreludedb-0.9.15.2:
- Fix regression introduced in libpreludedb 0.9.15:
libpreludedb-config --plugin-dir would return incorrect result.
- Improve mysql, postgresql, and sqlite3 detection method, should
work on 64 bits architecture, and make it easy to cross compile.
- Minor fixes.
* 2008-09-09, libpreludedb-0.9.15.1:
- Fix handling of preludedb-admin --offset parameter.
* 2008-08-27, libpreludedb-0.9.15:
- preludedb-admin has a bew 'count' command, printing the result of a
COUNT() on the database.
- preludedb-admin work on smaller set of data, to prevent large
retrieval error (fix #220, refs #305).
- preludedb-admin handling of interrupted transaction was improved.
- Fix MySQL and SQLite MacOSX detection, by
Uwe Schwartz <usx303 at googlemail.com>. (fix #296).
- Check PostgreSQL version is higher or equal than 8.2.0, and use the
new E'value' escape method when available to avoid a warning.
* 2008-01-03, libpreludedb-0.9.14.1:
- Fix PostgreSQL upgrade script (fix #271).
* 2007-12-19, libpreludedb-0.9.14:
- Improved thread safety: all query are now mutex protected, and the
mutex won't be released until the transaction is over.
- Use TEXT in place of VARCHAR for alert.assessment.impact.description (fix #265).
- Fix OpenBSD compilation issue, thanks Alexandre Anriot <aanriot@atlantilde.com>
for pointing out this (fix #227).
- [preludedb-admin] Make it possible to specify an offset with no limit.
- [mysql] Prevent MySQL session from timing out after 8 hours of inactivity.
- [pgsql] Fix PostgreSQL warning when inserting binary data.
- [preludedb-admin] Fix a problem handling the offset option with the
load command.
- [preludedb-admin] Fix possible wraparound in statistics computation
code.
- Allow Python threads to run while executing libpreludedb C function.
* 2007-08-20, libpreludedb-0.9.13:
- Source and Target now use a 16 bits index (required for CorrelationAlert with
large number of source/target). CorrelationAlert Alertident now use a 32 bits
index (required to link large number of Alert together).
- Fix compilation on system without ENOTSUP (fix #227):
Include modified patch from Alexandre Anriot <aanriot@atlantilde.com>.
- [pgsql] Patch by Pierre Chifflier <chifflier@inl.fr>, that fixes type
conversions preventing PostgreSQL to use indexes (fix #225).
- [preludedb-admin] Use separate alert / heartbeat command: this is done to
have a coherent implementation of the --offset and --count command line
options.
- [preludedb-admin] Fix --offset with the load command.
- [preludedb-admin] Give the delete table a decent size, should speedup the
delete command.
- [documentation] preludedb-admin manpage (fix #230), by Pierre Chifflier
<chifflier@inl.fr>.
* 2007-03-17, libpreludedb-0.9.12:
- [sqlite3] Provide case-insensitive regex.
- [preludedb-admin] Loading of multiple file and improved reporting.
- Provide substring match for AdditionalData value.
- Fix insertion issue for ProcessArg and File Linkage.
- Fix a bug when retrieving an empty time field (following retrieved fields
where not the one expected).
- When a given SQL function is not implemented by the driver, return a detailed
error message with information concerning the missing function.
- Implement Python only get_values, get_heartbeat_idents, get_alert_idents.
Return the number of rows as well as the rows in a tupple.
- Make sure we have an exception to process: fix a crash with Python bindings
upon signal reception. Fix #200.
* 2007-02-07, libpreludedb-0.9.11.3:
- Fix invalid free() in the SQLite plugin.
- Fix preludedb-admin copy/move operations.
* 2007-01-08, libpreludedb-0.9.11.2:
- Fix make installation error when Perl bindings are disabled.
* 2007-01-05, libpreludedb-0.9.11.1:
- Prevent binding generation error when using old SWIG version.
- Generate bindings for the error handling API.
- Small Perl/Python detection improvement. Fix #182.
- Fix bindings compilation when using make -j.
- New configure --with-perl-installdirs flags: might be used to override
default site perl installation.
- Various bug fixes.
* 2006-12-20, libpreludedb-0.9.11:
- Avoid using GNU sed extension when generating postgresql/sqlite schema.
- Fix a Python binding memory leak upon alert list deletion.
- Compile and run on OS X.
- Various bugfixes.
- Various portability fixes.
* 2006-10-06, libpreludedb-0.9.10:
- Fix PostgreSQL schema update version 5.
- Only export symbol starting with preludedb_.
- Verbose error reporting in case of libpreludedb initialization failure.
* 2006-08-11, libpreludedb-0.9.9:
- Implement an idea from Lex van Roon <r3boot@r3blog.nl.eu.org> providing
an alert/heartbeat deletion performance improvement in the order of
3000% (preludedb-admin already benefit from it, next Prewikka release
will benefit from it too).
- Fix --with-(perl|python|swig) detection path ordering.
- Verbose error reporting on logfile opening error.
- Various bug fixes.
* 2006-07-03, libpreludedb-0.9.8.1:
- Bump database schema version (fix invalid database version error).
* 2006-06-06, libpreludedb-0.9.8:
- Always use prelude_escape_binary() when inserting additional data, even in case
we're inserting a string, since the database field might be of a type that require
binary kind of escaping. Fix #143.
- Implement reading of message_processing_model, security_model, security_level.
Handling of community member is deprecated (IDMEFv16 update).
- Fix a bug where Service->ip_version would not be read from database.
- Upon connection to a PostgreSQL database, set default date style to ISO:
this is needed since libpreludedb assume ISO format to parse database timestamp.
Fix #140.
- Error reporting improvement.
* 2006-03-30, libpreludedb-0.9.7.1:
- Flush the SQL query logfile after each query.
- Add --events-per-transaction option to preludedb-admin, default
value is 1000, which prevent heavy VM pressure on large database
operation.
* 2006-03-24, libpreludedb-0.9.7:
- Fix Perl/Python bindings uint64 handling on 32 bits machine.
- Make preludedb_check_version available from Perl/Python bindings.
- Use new IDMEF_LIST_APPEND primitive, require libprelude 0.9.6.
- Add libprelude dependencie to SQL plugins, since they depend on
libprelude symbols. Fix compilation problem with some distribution.
- Use global transaction surrounding all operation in preludedb-admin,
this bring a major performance improvement for insert operation.
- Fix PostgreSQL FileAccess query failure.
- Dynamic PostgreSQL schema generation (this fix certain inefficient
datatype that were used in the old version). Update schema would be hard
to do for all postgreSQL version, thus using preludedb-admin copy for
the update is required.
- API improvement.
* 2006-03-08, libpreludedb-0.9.6:
- Fix PostgreSQL plugin compilation problem.
- Update database schema: enforce that AdditionalData data field is not NULL.
- Improve Swig basic type mapping situation regarding to the target architecture.
- Fix query time calculation.
* 2006-02-22, libpreludedb-0.9.5.1:
- Correctly read database schema version.
* 2006-02-22, libpreludedb-0.9.5:
- Fix important memory leak in Python bindings, Prewikka should end-up
consuming way less memory than it used to.
- Fix PostgreSQL plugin compilation problem.
- Fix for preludedb-admin --count handling when --offset was used.
- Provide more information in preludedb-admin error message.
- Various cleanup.
* 2006-02-08, libpreludedb-0.9.4:
- Fix for filtering IDMEF field using the '!=' operator, which resulted in
filtering of events where the field did not exist (#129).
- Implement a "move" command in preludedb-admin.
- When SQL query logging is enabled, log the time taken to execute the query.
- Improve plugin API by making it opaque so that existing plugin don't break
if we add more SQL plugin function.
- Verbose error reporting, make the plugin error API viable for more drivers.
- Fix error reporting from perl and python bindings.
- Make libpreludedb header files c++ compiler friendly.
- Enforce listed IDMEF value ordering. IDMEF value were sometime unordered
because of an uninitialized list position problem.
* 2005-01-16, libpreludedb-0.9.3:
- SQLite support.
- More accurate error reporting in preludedb-admin.
- Fix NULL error in case the buffer is too small, truncate.
- Fix license notice, stating clearly that linking from a program
using a GPL compatible license is allowed. Required for Debian package
inclusion.
* 2005-12-12, libpreludedb-0.9.2:
- Fix character escaping issue with two consecutive backslash
followed by a wildcard (we were escaping the wildcard, which
is not supposed to be escaped in this case).
* 2005-11-28, libpreludedb-0.9.1:
- Fix automated reconnection to the database server.
- Allow saving to standard output with preludedb-admin.
- Make preludedb-admin delete command safer to use: forbid deletion
unless a criteria is provided.
- Workaround invalid library run path added through MakeMaker generated Makefile.
- Fix Perl bindings Makefile generated with DESTDIR appended twice.
* 2005-09-20, libpreludedb-0.9.0:
- 0.9.0 final.
- Make Perl/Python bindings more fault tolerant.
* 2005-09-15, libpreludedb-0.9.0-rc14:
- Correct Python bindings exception handling.
- Fix alert saving in preludedb-admin.
- Perl bindings would fail to compile if perl was compiled using
the platform (non gcc) compiler.
- Fix warnings.
* 2005-08-25, libpreludedb-0.9.0-rc13:
- Fix broken table comparison.
- Empty additional data are valid.
* 2005-08-17, libpreludedb-0.9.0-rc12:
- Fix preludedb-admin link on some systems.
* 2005-08-17, libpreludedb-0.9.0-rc11:
- More useful Python exception on PreludeDB error.
- Fix insertion of FileAccess Permission.
- Add missing retrieval of UserID tty.
- Fine grained libprelude operator now allow us to have similar behavior
between different database implementation.
- Support for more operator, including case insensitive version of most
operator, and a new regexp operator.
- Fix invalid UTC offset applied to broken down time match.
- New preludedb-admin tool. Allow save/load/delete/copy/print of PreludeDB database.
- When no database password is set, don't default to "prelude".
This failed on user trying to access a database with no password.
* 2005-08-02, libpreludedb-0.9.0-rc10:
- Include missing database schema update.
* 2005-08-01, libpreludedb-0.9.0-rc9:
- Fix IDMEF SNMPService mapping problem.
- Fix IDMEF FileAccess permission mapping problem.
- Set close on exec flags on the logging file descriptor.
- Escape '%' character within query, since the caller is expected to use '*'.
* 2005-07-08, libpreludedb-0.9.0-rc8:
- Fix Perl bindings Makefile generation with some MakeMaker version.
- Use GnuLib for portability issue.
- Handle broken down criteria match.
- Improve error reporting.
- Various bugfixes.
* 2005-05-30, libpreludedb-0.9.0-rc7:
- Fix alert deletion query issue.
* 2005-05-30, libpreludedb-0.9.0-rc6:
- Fix portability problem with %hh convertion specifier (exampe: Solaris
selection problem).
- Fix potential problem on 64 bits systems.
- Fix IDMEF FileAccess insertion.
- Fix bad indexes.
- Improve DELETE operation speed.
- Handle IDMEFv14 file_type attribute.
- Fix several PostgreSQL incompatibility in generated request.
- Update PostrgreSQL schema.
- Various bugfix.
* 2005-04-17, libpreludedb-0.9.0-rc5:
- Fix truncated error code on some INSERT.
- Handle confidence as a float, not as an integer.
- Fix GMT offset and USEC invertion.
- Fix checksum field insertion.
- Fix PgSQL schema update.
- Update PgSQL/MySQL schema version.
* 2005-04-09, libpreludedb-0.9.0-rc4:
- Fix error with bindings Makefile when using BSD make.
- Add missing 'info' severity to the MySQL schema.
Provide a schema for upgrading.
- Check database schema version on initialization.
- Fix broken libpreludedb.m4 detection routine.
- Fix Perl/Python bindings regeneration problem.
- Fix database schema for MySQL 3.23.
- Fix broken MySQL error check.
* 2005-03-31, libpreludedb-0.9.0-rc3:
- Fix PgSQL plugin loading problem.
* 2005-03-31, libpreludedb-0.9.0-rc2:
- Fix Python/Perl bindings linking order. Was linking to old version
of the library on system where old libprelude-0.8 was installed.
- Fix an issue with the Perl bindings on make clean.
* 2005-03-29, libpreludedb-0.9.0-rc1:
- Initial release.