|
|
|
|
|
|
|
|
|
|
|
2009-05-18 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* configure.ac: Incremented version to 3.0.5. This contains |
|
|
|
|
|
SNF4SA version 0.9.2 (contribution to SA score submitted correctly |
|
|
|
|
|
by $permsgstatus->{conf}->{scoreset). This addresses the problem |
|
|
|
|
|
with amavisd-new always having a score of 1. |
|
|
|
|
|
|
|
|
|
|
|
2009-02-06 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* SNFMulti/SNFMulti.cpp: Replaced with file from Pete, Jan 29, |
|
|
|
|
|
2009. |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Update list of required software (curl replaces |
|
|
|
|
|
gzip and wget). |
|
|
|
|
|
|
|
|
|
|
|
* configure.ac: Removed check for wget and gzip, added check for |
|
|
|
|
|
curl. |
|
|
|
|
|
|
|
|
|
|
|
* cleanForDist: Added script to clean developer distribution. |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/getRulebase.in: Modified to use curl instead of wget and |
|
|
|
|
|
gzip. |
|
|
|
|
|
|
|
|
|
|
|
2009-01-27 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Renamed user tarball name from SNFServer to |
|
|
|
|
|
snf-server. |
|
|
|
|
|
|
|
|
|
|
|
* configure.ac: Changed docs to Docs. |
|
|
|
|
|
|
|
|
|
|
|
* Makefile.am (SUBDIRS): Changed docs to Docs. |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Updated to include prerequisites for building, |
|
|
|
|
|
and other new features (OTL #19). |
|
|
|
|
|
|
|
|
|
|
|
2008-12-18 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/Makefile.am: Install snfServer in final destination. |
|
|
|
|
|
|
|
|
|
|
|
2008-12-17 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/Makefile.am (snfServerControl.sample): Replace |
|
|
|
|
|
configuration file path and name |
|
|
|
|
|
@sysconfdir@/@PACKAGE_NAME@/@PACKAGE_NAME@.xml. |
|
|
|
|
|
|
|
|
|
|
|
2008-12-16 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* INSTALL: Added instructions for integration with sendmail. |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/Makefile.am: Added snfSnifferFilter script. |
|
|
|
|
|
|
|
|
|
|
|
2008-12-09 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/snfSniffer.in: Generate additional temporary filenames |
|
|
|
|
|
by adding a suffix to MSGFILE rather than a prefix. |
|
|
|
|
|
|
|
|
|
|
|
* SNFServer/main.cpp: Made VERSION_INFO const char *. |
|
|
|
|
|
|
|
|
|
|
|
* SNFClient/main.cpp: Made VERSION_INFO const char *. |
|
|
|
|
|
|
|
|
|
|
|
* SNFMulti/SNFMulti.cpp (enum PatternResultTypes): Remove |
|
|
|
|
|
'typedef'. |
|
|
|
|
|
|
|
|
|
|
|
(snf_EngineHandler::scanMessageFile): Make XHDRInjState const char *. |
|
|
|
|
|
|
|
|
|
|
|
(snf_EngineHandler::scanMessage): Make DebugInfo const char *. |
|
|
|
|
|
|
|
|
|
|
|
* SNFMulti/GBUdb.cpp (GBUdbAlert::toXML): Make FlagName a pointer |
|
|
|
|
|
to const char *. |
|
|
|
|
|
|
|
|
|
|
|
* SNFMulti/FilterChain.hpp (class FilterChainHeaderAnalysis): Pass |
|
|
|
|
|
const char * to SetFollowPattern. Make MatchPattern a pointer to |
|
|
|
|
|
const char *. |
|
|
|
|
|
|
|
|
|
|
|
* Scripts/snfSniffer.in: Copied from |
|
|
|
|
|
snfv2-3.5-PostfixExample/sniffer. |
|
|
|
|
|
|
|
|
|
|
|
* SNFServer/Makefile.am: Moved configuration files to |
|
|
|
|
|
config_files. |
|
|
|
|
|
|
|
|
|
|
|
* Makefile.am (SUBDIRS): Added config_files. |
|
|
|
|
|
|
|
|
|
|
|
2008-12-08 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* SNFServer/main.cpp: Use PACKAGE_VERSION for version string. |
|
|
|
|
|
|
|
|
|
|
|
* SNF2Check/main.cpp: Removed reference to SNF_Service in #include |
|
|
|
|
|
directives. |
|
|
|
|
|
|
|
|
|
|
|
* SNFClient/main.cpp: Removed reference to SNF_Service in #include |
|
|
|
|
|
directives. Use PACKAGE_VERSION for version string. |
|
|
|
|
|
|
|
|
|
|
|
* configure.ac: Split SNF_Service into CodeDweller and SNFMulti |
|
|
|
|
|
directories. |
|
|
|
|
|
|
|
|
|
|
|
2008-10-01 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.openbsd: Start with /bin/sh rather than /bin/bash. Rename |
|
|
|
|
|
function stop to stopFunction. Removed $ from beginning of string |
|
|
|
|
|
constants. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-30 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Added -O3 switch, and change first line back to |
|
|
|
|
|
/bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2008-09-30 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Changed first line back to /bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-30 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Changed first line back to /bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2008-09-30 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* install: Changed the first line to /bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
* clean: Changed the first line to /bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
* build: Changed first line to /bin/sh. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-24 Alban Deniz <adeniz@snuffy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.freebsd (stop_cmd): Added message when stopping. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-24 Charlie Root <adeniz@snuffy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Corrected installation for FreeBSD. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-21 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Updated. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-20 <adeniz@puffy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.openbsd: Initial revision. |
|
|
|
|
|
|
|
|
|
|
|
* snf.freebsd: Renamed from snf.bsd. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-20 <adeniz@puffy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* install (destdir): Added -m to su command on last line. |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Updated for OpenBSD. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-15 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.redhat (snfStartCmd): Use su to start daemon, and specify |
|
|
|
|
|
shell. |
|
|
|
|
|
|
|
|
|
|
|
* snf.suse (SNFServer_BIN): Specify shell when issuing su command. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-13 Alban Deniz <adeniz@wormy.home> |
|
|
|
|
|
|
|
|
|
|
|
* snf.bsd: Tested. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-13 Alban Deniz <adeniz@wormy.home> |
|
|
|
|
|
|
|
|
|
|
|
* DEVELOPER_NOTES: Initial revision. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-10 Alban Deniz <adeniz@sleepy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.ubuntu: Tested start, stop, reload, status commands. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-09 Alban Deniz <adeniz@> |
|
|
|
|
|
|
|
|
|
|
|
* FilterChain.hpp: Included string.h. |
|
|
|
|
|
|
|
|
|
|
|
* GBUdb.hpp: included stdlib.h. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-09 Alban Deniz <adeniz@sleepy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* snf.suse: Added description to structured comment after |
|
|
|
|
|
chkconfig. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-09 Alban Deniz <adeniz@> |
|
|
|
|
|
|
|
|
|
|
|
* snf.suse: Initial revision. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-09 Alban Deniz <adeniz@sleepy.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* install (destdir): Create the user and group first. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-09 Alban Deniz <adeniz@> |
|
|
|
|
|
|
|
|
|
|
|
* install (destdir): Corrected useradd command. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-08 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Removed .exe extension. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-08 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Removed the .exe extension. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-08 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* compile: Removed the .exe extension. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-08 root <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* getRulebase: Removed .exe from program names. |
|
|
|
|
|
|
|
|
|
|
|
* snf.redhat: Initial revision. |
|
|
|
|
|
|
|
|
|
|
|
2008-09-08 Alban Deniz <adeniz@skidmark.localdomain> |
|
|
|
|
|
|
|
|
|
|
|
* clean: Create script to remove executables generated by build. |
|
|
|
|
|
|
|
|
|
|
|
* install: Created script to install applications, files, and |
|
|
|
|
|
download rulebase. |
|
|
|
|
|
|
|
|
|
|
|
* build: Created script to build applications. |
|
|
|
|
|
|
|
|
|
|
|
SNF Command Line & SNFMulti Engine / Client Change Log |
|
|
|
|
|
------------------------------------------------------------------------------ |
|
|
|
|
|
|
|
|
|
|
|
20080710 - Version 3.0.1 |
|
|
|
|
|
|
|
|
|
|
|
Minor change to SNFServer main.cpp:59 - removed cast to (int) which caused |
|
|
|
|
|
a precision loss error when compiling on 64 bit systems. This changes the |
|
|
|
|
|
thread pointer info in debug mode slightly (better). |
|
|
|
|
|
|
|
|
|
|
|
20080626 - Version 3.0, It's official. |
|
|
|
|
|
|
|
|
|
|
|
Changed build information. |
|
|
|
|
|
Removed extraneous comments from configuration file. |
|
|
|
|
|
|
|
|
|
|
|
20080524 - Version V2-9rc2.25.7 |
|
|
|
|
|
|
|
|
|
|
|
Optimized networking library for additional speed & stability by moving |
|
|
|
|
|
receive buffer allocation from heap to stack (automatic). |
|
|
|
|
|
|
|
|
|
|
|
Optimized timing parameters in SNFClient for improved speed. Polling dealys |
|
|
|
|
|
are now reduced to 10ms from 30ms. |
|
|
|
|
|
|
|
|
|
|
|
Removed speed-bug in SNFClient, 100ms guard time between retries was always |
|
|
|
|
|
executed after an attempt (even a successful attempt). The guard time is now |
|
|
|
|
|
condition and only fires on unsuccessful attempts. |
|
|
|
|
|
|
|
|
|
|
|
Updated XCI server logic to ensure non-blocking sockets for clients in all |
|
|
|
|
|
socket implementations. |
|
|
|
|
|
|
|
|
|
|
|
20080424 - Version V2-9rc2.24.6 |
|
|
|
|
|
|
|
|
|
|
|
Refactored snfScanData.clear() to reduce heap work and fragments. |
|
|
|
|
|
|
|
|
|
|
|
Added mutex to scanMessageFile() entry point just in case some app attempts to |
|
|
|
|
|
put multiple threads through a single engine handler. scanMessage() is already |
|
|
|
|
|
protected and fully wraped by the new scanMessageFile() mutex. |
|
|
|
|
|
|
|
|
|
|
|
Added non-specific runtime exception handling to XHDR injection code. |
|
|
|
|
|
|
|
|
|
|
|
Added 2 retries w/ 300ms delay to remove original message in XHDR inject code. |
|
|
|
|
|
If remove fails after 3 attempts the injector throws. |
|
|
|
|
|
|
|
|
|
|
|
Added 2 retries w/ 300ms delay to rename temp file to msg in XHDR inject code. |
|
|
|
|
|
If rename fails after 3 attempts the injector throws. |
|
|
|
|
|
|
|
|
|
|
|
20080416 - Version V2-9rc2.23.6 |
|
|
|
|
|
|
|
|
|
|
|
Fixed bug where SNCY open() would fail on some Win* platforms with |
|
|
|
|
|
WSAEINVAL instead of the standard EINPROGRESS or EALREADY which were expected. |
|
|
|
|
|
Also added WSAEWOULDBLOCK to cover other "ambiguities" in windows sockets |
|
|
|
|
|
implementations. InProgress() on Win* now test for any of: |
|
|
|
|
|
|
|
|
|
|
|
WSAEINPROGRESS, WSAEALREADY, WSAEWOULDBLOCK, WSAEINVAL |
|
|
|
|
|
|
|
|
|
|
|
20080413 - Version V2-9rc2.22.6 |
|
|
|
|
|
|
|
|
|
|
|
Fixed bug in TCPHost.open() where EALREADY was not counted as a version of |
|
|
|
|
|
EINPROGRESS. This would cause open() to throw an unnecessary exception when |
|
|
|
|
|
an open() required extra time. |
|
|
|
|
|
|
|
|
|
|
|
20080413 - Version V2-9rc2.21.6 |
|
|
|
|
|
|
|
|
|
|
|
Extended timeout for SYNC session open() to the full session length. This way |
|
|
|
|
|
if a session takes a long time to open it still has a shot at success. |
|
|
|
|
|
|
|
|
|
|
|
20080411 - Version V2-9rc2.20.6 |
|
|
|
|
|
|
|
|
|
|
|
Adjusted snfNETmgr to use non-blocking open in SYNC sessions. Open timeout |
|
|
|
|
|
is 1/3 of the session timeout. Session timeout is 2 * Session pacing. Open |
|
|
|
|
|
polling uses golden spiral delay from 10ms to 340ms. |
|
|
|
|
|
|
|
|
|
|
|
20080410 - Version V2-9rc2.19.6 |
|
|
|
|
|
|
|
|
|
|
|
Adjusted XCI manager to use new snfCFGPacket paradigm in checkCFG(). |
|
|
|
|
|
|
|
|
|
|
|
Adjusted snf_RulebaseHandler::addRulePanic() to use MyMutex and eliminated |
|
|
|
|
|
the AutoPanicMutex and waiting scheme. |
|
|
|
|
|
|
|
|
|
|
|
Refactored scanMessage() to use a ScopeMutex() rather than lock()/unlock(). |
|
|
|
|
|
|
|
|
|
|
|
Refactored scanMessage() to use MyCFGPacket.isRulePanic() test. |
|
|
|
|
|
|
|
|
|
|
|
Redesigned snfCFGPacket handling to automate grab() / drop() functions. |
|
|
|
|
|
|
|
|
|
|
|
Fixed lock-up bug: Redesigned AutoPanic posting and checking mechanisms to |
|
|
|
|
|
eliminate potential dead-lock condition. Under some conditions a precisely |
|
|
|
|
|
timed auto-panic posting could cause the RulebaseHandler mutex and the |
|
|
|
|
|
AutoPanicMutex to become intertwined leading to a cascading deadlock. When |
|
|
|
|
|
this occurred all XCI processing threads and eventually the XCI listener |
|
|
|
|
|
thread would become blocked waiting to get the current configuration. |
|
|
|
|
|
|
|
|
|
|
|
20080409 - Version V2-9rc2.18.6 |
|
|
|
|
|
|
|
|
|
|
|
Enhanced XCI exception handling and logging to provide additional detail. |
|
|
|
|
|
|
|
|
|
|
|
Added code to explicitely check for zero length files in scanMessagFile(). |
|
|
|
|
|
Previously a zero length file would cause the CBFR module of the filter |
|
|
|
|
|
chain to throw an invalid buffer exception. Now if the message file is empty |
|
|
|
|
|
scanMessageFile() will throw a FileError stating FileEmpty!. |
|
|
|
|
|
|
|
|
|
|
|
20080407 - Version V2-9rc2.17.6 |
|
|
|
|
|
|
|
|
|
|
|
Enhanced exception reporting in snfXCImrg |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
20080405 - SNFServer V2-9rc2.16.6 |
|
|
|
|
|
|
|
|
|
|
|
Reduced safetly limits on status reports to 100K for status reports and 100K |
|
|
|
|
|
for samples. Previous values were 10M. Most full sessions from the busiest |
|
|
|
|
|
systems are < 50K total. |
|
|
|
|
|
|
|
|
|
|
|
Recoded sendDataTimeout() to break uploads into 512 byte chunks and insert |
|
|
|
|
|
delays only when a chunk is fragmented. This methodology improves reliability |
|
|
|
|
|
on Win* systems without any significant penalty on systems that don't need |
|
|
|
|
|
socket sends() to be in smaller chunks. |
|
|
|
|
|
|
|
|
|
|
|
Fixed TCPClient::transmit() and TCPHost::transmit() bug where returned byte |
|
|
|
|
|
count might be -1. Now returned byte counts can only be 0 or more. |
|
|
|
|
|
|
|
|
|
|
|
20080403 - SNFServer V2-9rc2.15.5 |
|
|
|
|
|
|
|
|
|
|
|
Minor modifications to networking module to better support non-blocking open() |
|
|
|
|
|
|
|
|
|
|
|
Updated SNFClient with new timing and non-blocking open(). Worst case return |
|
|
|
|
|
time from SNFClient estimated at 200 seconds (theoretically impossible). No- |
|
|
|
|
|
connection return time from SNFClient estimated at 20 seconds. |
|
|
|
|
|
|
|
|
|
|
|
20080326 - SNFServer V2-9rc2.15.4 |
|
|
|
|
|
|
|
|
|
|
|
Refactored snfNETmgr::sync() to consolidate non-blocking io routines. |
|
|
|
|
|
|
|
|
|
|
|
Added detailed thread status data to XCI listener thread. |
|
|
|
|
|
|
|
|
|
|
|
Fixed minor bug in main (not changing revision), Debug flag for internal use |
|
|
|
|
|
was left on in the last build cycle. It is commented out now. |
|
|
|
|
|
|
|
|
|
|
|
20080325 - SNFServer V2-9rc2.14.4 |
|
|
|
|
|
|
|
|
|
|
|
Updated snfNETmgr with comprehensive thread status data. |
|
|
|
|
|
|
|
|
|
|
|
Refactored snfNETmgr::sync() to check a Timeout, removed TCPWatchdog. |
|
|
|
|
|
|
|
|
|
|
|
20080325 - SNFServer V2-9rc2.13.4 |
|
|
|
|
|
|
|
|
|
|
|
Upgraded TCPWatcher code to use new threading features (type, status). |
|
|
|
|
|
|
|
|
|
|
|
20080324 - SNFServer v2-9rc2.12.4 |
|
|
|
|
|
|
|
|
|
|
|
Added a "Rulebase Getter" feature as part of the snf_Reloader. When enabled |
|
|
|
|
|
the Rulebase Getter will launch a user defineable system() call whenever a |
|
|
|
|
|
new rulebase file is available. The call will be repeated until the condition |
|
|
|
|
|
is cleared by a successful update of the rulebase file. The Rulebase Getter |
|
|
|
|
|
will wait a configurable "guard time" between attempts. The default system() |
|
|
|
|
|
call is "getRulebase" with a guard time of 3 minutes. In most cases this will |
|
|
|
|
|
launch the provided getRulebase script which should be present in the start |
|
|
|
|
|
location of SNFServer on most systems. Best practice is to configure the full |
|
|
|
|
|
path to the update script. The system() call is made in a separate thread so |
|
|
|
|
|
that if the system() call hangs for some reason only the Rulebase Getter is |
|
|
|
|
|
stuck. |
|
|
|
|
|
|
|
|
|
|
|
Built thread monitoring function for SNFServer.exe (Full status report / sec). |
|
|
|
|
|
The thread monitoring report is turned on when the program is renamed to |
|
|
|
|
|
SNFDebugServer.exe or if "debug" appears in the file path to the program. |
|
|
|
|
|
|
|
|
|
|
|
Refactored XCI channels to leverage new thread monitoring. |
|
|
|
|
|
|
|
|
|
|
|
Refactored Threading to eliminate inline code. |
|
|
|
|
|
|
|
|
|
|
|
Improved exception handling/reporting in scanMessageFile(). |
|
|
|
|
|
|
|
|
|
|
|
Updated scanMessagFile() header injection code to accommodate messages with |
|
|
|
|
|
no body. Previous version would throw an exception when it could not find an |
|
|
|
|
|
injection point. The new version makes the injection point byte 0 and puts |
|
|
|
|
|
the injected headers at the top of the message using it's best guess about the |
|
|
|
|
|
type of line endings (CRLF or LF) to use. |
|
|
|
|
|
|
|
|
|
|
|
Updated Threading library to include high level thread state tracking and |
|
|
|
|
|
naming. Also creates a global Threads object that can produce a real-time |
|
|
|
|
|
status report on all threads. |
|
|
|
|
|
|
|
|
|
|
|
Updated Networking library to use SO_REUSEADDR by default on listeners. |
|
|
|
|
|
|
|
|
|
|
|
20080318 - SNF2-9rc1.11.exe Consolidated several mods/fixes |
|
|
|
|
|
|
|
|
|
|
|
Corrected scan error logging bug. Was posting <s/> now posts <e/>. |
|
|
|
|
|
|
|
|
|
|
|
Updated scan error logging to be more uniform with non-scan errors. |
|
|
|
|
|
|
|
|
|
|
|
Developed various script prototypes for postfix integration & automated |
|
|
|
|
|
updates on win* systems using the new UpdateReady.txt file mechanism. |
|
|
|
|
|
|
|
|
|
|
|
Fixed a bug in scanMessageFile() where an \n\n style insertion point |
|
|
|
|
|
would never be detected. |
|
|
|
|
|
|
|
|
|
|
|
Modified scanMessageFile() header injection to strip <CR> from line ends |
|
|
|
|
|
when the message file provided does not use them. The line-end style of |
|
|
|
|
|
the message file is detected while locating the insertion point. If the |
|
|
|
|
|
insertion point (first blank line) does not use <CR><LF> then the SNF |
|
|
|
|
|
generated X-Headers are stripped of <CR> in a tight loop before injection. |
|
|
|
|
|
|
|
|
|
|
|
Enhanced error and exception reporting in SNFMulti.cpp scanMessageFile(). |
|
|
|
|
|
|
|
|
|
|
|
Enhanced exception handling in networking module. All exceptions now |
|
|
|
|
|
throw descriptive runtime_error exceptions. |
|
|
|
|
|
|
|
|
|
|
|
20080306 - SNF2-9rc1.8.exe (FIRST RELEASE CANDIDATE for VERSION 3!) |
|
|
|
|
|
|
|
|
|
|
|
Added Drilldown Header Directive Functions - When the candidate source IP |
|
|
|
|
|
comes from a header matching a drilldown directive the IP is marked "Ignore" |
|
|
|
|
|
in GBUdb and the candidate is no longer eligible to be the source for that |
|
|
|
|
|
message. This allows SNF to follow the trusted chain of devices (by IP) down |
|
|
|
|
|
to the actual source of the message. It is handy for ignoring net blocks |
|
|
|
|
|
because it can match partial IPs but it is designed to allow SNF to learn |
|
|
|
|
|
it's way through the servers at large ISPs so that the original source for |
|
|
|
|
|
each message can be evaluated directly. |
|
|
|
|
|
|
|
|
|
|
|
Added Source Header Directive Functions - This feature allows SNF to acquire |
|
|
|
|
|
the source IP for a message from a specific header rather than searching |
|
|
|
|
|
through the Received headers in the message. This is useful when the original |
|
|
|
|
|
source for a message is not represented in Received headers. For example: |
|
|
|
|
|
Hotmail places the originating source IP in a special header and does not |
|
|
|
|
|
provide a Received header for that IP. This feature is protected from abuse |
|
|
|
|
|
by a "Context" feature which only activates the source header directive when |
|
|
|
|
|
specific content is found in a specific received header. Using the above |
|
|
|
|
|
example, this feature can be configured so that a Hotmail source header would |
|
|
|
|
|
only be read if the top Recieved header contained "hotmail.com [" indicating |
|
|
|
|
|
that the ptr lookup for the header matched the hotmail domain. Note: When a |
|
|
|
|
|
source is pulled from a header directive that source is put into a synthetic |
|
|
|
|
|
Received header and injected into the scanning stream (not the message) as |
|
|
|
|
|
the first Received header. |
|
|
|
|
|
|
|
|
|
|
|
Added forced source IP to XCI - It is now possible to "inject" or "force" |
|
|
|
|
|
the source IP for any message by providing that IP in the XCI request or |
|
|
|
|
|
directly in a scan...() function call. This allows the calling application |
|
|
|
|
|
to provide the source IP for a message ahead of any Received headers that |
|
|
|
|
|
might be in the message. This is useful when the calling application knows |
|
|
|
|
|
the original source IP for the message but that IP is not represented in |
|
|
|
|
|
the Received headers and it is not desireable to use the Source Header |
|
|
|
|
|
Directive mechanism. |
|
|
|
|
|
|
|
|
|
|
|
Added forced source IP mode to SNFClient - It is now possible to call the |
|
|
|
|
|
SNFClient utility with an IP4Address using the syntax: |
|
|
|
|
|
|
|
|
|
|
|
SNFClient -source=12.34.56.78 |
|
|
|
|
|
|
|
|
|
|
|
The -source mode of SNFClient exercises the forced source IP feature in |
|
|
|
|
|
the XCI (see above) |
|
|
|
|
|
|
|
|
|
|
|
Added Status Report features to SNFClient and XCI - It is now possible to |
|
|
|
|
|
request the latest status.second, status.minute, or status.hour data via |
|
|
|
|
|
the XCI and SNFClient. The syntax for requesting a status report using the |
|
|
|
|
|
SNFClient is: |
|
|
|
|
|
|
|
|
|
|
|
SNFClient -status.second |
|
|
|
|
|
SNFClient -status.minute |
|
|
|
|
|
SNFClient -status.hour |
|
|
|
|
|
|
|
|
|
|
|
In addition to providing status reports the SNFClient in this mode will |
|
|
|
|
|
return a nonzero value (usually 99) if it is unable to get a status report |
|
|
|
|
|
from SNFServer. This feature can be used to verify that SNFServer is up |
|
|
|
|
|
and responding. If SNFServer is OK then the result code returned is 0. |
|
|
|
|
|
|
|
|
|
|
|
Added result codes to SNFClient -test and XCI IP test functions - The XCI |
|
|
|
|
|
engine has been upgraded to provide the range value for the IP under test |
|
|
|
|
|
as well as the symbolic result code associated with that range. This allows |
|
|
|
|
|
the -test function to provide results that are consistent with the GBUdb |
|
|
|
|
|
configuration without additional processing: For example, if the IP falls |
|
|
|
|
|
in the Caution range then the Caution result code will be returned just |
|
|
|
|
|
as if a message had been scanned with the same IP and no pattern match |
|
|
|
|
|
occurred. The same is true for Truncate and Black range hits. |
|
|
|
|
|
|
|
|
|
|
|
Added Timestamp and Command Line Parameter data to SNFClient.exe.err - When |
|
|
|
|
|
an error occurs with SNFClient that may not appear in the SNFServer logs an |
|
|
|
|
|
entry is appended to the SNFClient.exe.err file. That in itself is not new. |
|
|
|
|
|
The new feature is that the entries added to the SNFClient.exe.err file now |
|
|
|
|
|
include timestamp and command line data to aid in debugging. |
|
|
|
|
|
|
|
|
|
|
|
Added BIG-ENDIAN Conversion - When the SNFServer program is compiled on a |
|
|
|
|
|
system that uses a BIG-ENDIAN processor (such as a power-mac) the rulebase |
|
|
|
|
|
load process now includes a routine to convert the token matrix from it's |
|
|
|
|
|
native LITTLE-ENDIAN format to a BIG-ENDIAN format. This solves a bug where |
|
|
|
|
|
Power-Mac (and presumably other BIG-ENDIAN systems) could compile and run |
|
|
|
|
|
the SNF* software but were unable to capture spam because the token matrix |
|
|
|
|
|
in the rulebase file was misinterpreted. |
|
|
|
|
|
|
|
|
|
|
|
Note: The BIG-ENDIAN Conversion feature is still considered experimental |
|
|
|
|
|
because it has not yet been thoroughly tested. |
|
|
|
|
|
|
|
|
|
|
|
Updated the Configuration Log to include all of the current configuration |
|
|
|
|
|
features and to improve it's readability. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
20080207 - SNF2-9b1.7.exe |
|
|
|
|
|
|
|
|
|
|
|
SYNC Timeout now 2x SYNC Schedule |
|
|
|
|
|
|
|
|
|
|
|
SNFServer now produces an UpdateReady.txt file when the UTC timestamp on |
|
|
|
|
|
the SYNC server is newer than the UTC timestamp of the active rulebase. It |
|
|
|
|
|
is presumed that a suitable update script or program will run periodically |
|
|
|
|
|
and download a fresh rulebase file if the UpdateReady.txt file is present. |
|
|
|
|
|
The update script should remove the UpdateReady.txt file when it completes |
|
|
|
|
|
a successful download of the new rulebase file. |
|
|
|
|
|
|
|
|
|
|
|
Added available rulebase UTC in status reports <udate utc.../> |
|
|
|
|
|
|
|
|
|
|
|
Added Automatic path fixup for ending / or \ |
|
|
|
|
|
|
|
|
|
|
|
Added option to use local time in log rotation <rotation localtime='no'/> |
|
|
|
|
|
The default is still utc. |
|
|
|
|
|
|
|
|
|
|
|
20071102 - SNF2-9b1.6.exe |
|
|
|
|
|
|
|
|
|
|
|
Increased MAX_EVALS from 1024 to 2048. |
|
|
|
|
|
|
|
|
|
|
|
Adjusted defult range envelopes in snf_engine.xml to be more conservative. |
|
|
|
|
|
|
|
|
|
|
|
20071017 - SNF2-9b1.5.exe |
|
|
|
|
|
|
|
|
|
|
|
Added a missing #include directive to the networking.hpp file. The |
|
|
|
|
|
missing #include was not a factor on Linux and Windows systems but |
|
|
|
|
|
caused compiler errors on BSD systems. |
|
|
|
|
|
|
|
|
|
|
|
Corrected a bug in the GBUdb White Range code where any message with a |
|
|
|
|
|
white range source IP was being forced to the white result code. The |
|
|
|
|
|
engine now (correctly) only forces the result and records the event when |
|
|
|
|
|
a black pattern rule was matched and the White Range IP causes that |
|
|
|
|
|
scan result to be overturned. If the scan result was not a black pattern |
|
|
|
|
|
match then the original scan result is allowed to pass through. |
|
|
|
|
|
|
|
|
|
|
|
Corrected a bug in the Header Analysis filter chain module that would |
|
|
|
|
|
cause the first header in the message to be ignored in some cases. |
|
|
|
|
|
|
|
|
|
|
|
Corrected an XML log format problem so that <s/> elements are correctly |
|
|
|
|
|
open ended <s ....> or closed (empty) <s..../> according to whether they |
|
|
|
|
|
have subordinate elements. |
|
|
|
|
|
|
|
|
|
|
|
Adjusted the GBUdb header info format. The order of the Confidence |
|
|
|
|
|
figure and Probabilty figure is now the same as in the XML log files |
|
|
|
|
|
(C then P). The confidence and probability figures are now preceeded |
|
|
|
|
|
with c= and p= respectively so that it's easy to tell which is which. |
|
|
|
|
|
|
|
|
|
|
|
20071009 - SNF2-9b1.4.exe |
|
|
|
|
|
|
|
|
|
|
|
Tightened up the XCI handler code and removed the watchdog. The watchdog |
|
|
|
|
|
would restart the listener if there were no connections in 5 minutes. It |
|
|
|
|
|
was originally added to provide additional stability, however in practice |
|
|
|
|
|
there have been no "stalled listeners". Also, a stalled listener would |
|
|
|
|
|
likely be a sign of a different problem that the watchdog would tend to |
|
|
|
|
|
hide. |
|
|
|
|
|
|
|
|
|
|
|
Modified and refactored the XCI configuration management code. All XCI config |
|
|
|
|
|
changes and up-down operations are now handled in a single function except |
|
|
|
|
|
upon exit from the main XCI thread where XCI_shutdown() is always called. |
|
|
|
|
|
|
|
|
|
|
|
Added some more detailed exception handling code to the XCI component so that |
|
|
|
|
|
more data will be logged in the event of an error. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
20071008 - SNF2-9b1.2.exe |
|
|
|
|
|
|
|
|
|
|
|
Added support for passing Communigate Message Files directly. Communigate adds |
|
|
|
|
|
data to the top of the message file. That data stops at the first blank line and |
|
|
|
|
|
the rfc822 message begins. The SNFServer engine can now be told to ignore this |
|
|
|
|
|
extra data using the following option: |
|
|
|
|
|
|
|
|
|
|
|
<msg-file type='cgp'/> <!-- type='cgp' for communigate message files --> |
|
|
|
|
|
|
|
|
|
|
|
If the msg-file type is anything other than 'cgp' then it will treat the message |
|
|
|
|
|
file as a standard rfc822 message in the usual way. The default setting is |
|
|
|
|
|
|
|
|
|
|
|
<msg-file type='rfc822'/> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|