forked from gitpan/LaBrea-Tarpit
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChanges
530 lines (397 loc) · 15.8 KB
/
Changes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
Revision history for Perl extension LaBrea::Tarpit
1.36 Sat Nov 1 17:56:40 PST 2008
update prerequisites
1.35 Tue Sep 30 16:47:48 PDT 2008
add prerequisites to Makefile.PL
1.34 Sat Feb 5 11:49:13 PST 2005
updated Report/examples/localTrojans.pl
1.33 Sat Nov 13 16:31:56 PST 2004
update documentation
1.32 Sun Nov 7 11:34:42 PST 2004
Report v1.14
updated html list of trojans on
Report/examples/paged_report.plx page
1.31 Sat Nov 6 12:39:13 PST 2004
Get: v1.05
add 'sleep' to Get/examples/web_scan.pl to eliminate excess
processor utilization while waiting to reap kids
1.30 Thu Sep 2 12:14:52 PDT 2004
update Report/examples/whois.plx to show PTR lookup for IP's
1.29 Tue Jul 6 16:47:36 PDT 2004
Add patch to not send empty DShield messages that might get
created when sending to multiple destinations.
Petter Reinholdtsen <[email protected]>
1.28 Tue Jul 6 09:57:45 PDT 2004 -- NOT RELEASED
Add patch to DShield 0.08, courtesy of Petter Reinholdtsen <[email protected]>
to allow delivery of DShield reports to multiple destinations
1.27 Sun Mar 28 11:16:35 PST 2004
revert to previous 1.24 behavior on not writing out cache file
kept some code clean up.
1.26 Sat Mar 27 15:32:14 PST 2004
NOT RELEASED
The previous modification had the wrong scope for the tarpit hash,
removed _cullingquish and implemented in-line code instead
1.25 Thu Mar 4 10:43:54 PST 2004
add subroutine '_cullnsquish' to augment '_check4cull'
to collapse tarpit hash if a data removal is detected.
This should reduce memory bloat.
1.24 Tue Nov 11 16:46:20 PST 2003
include patch for labrea-2.5-stable-1
and original LaBrea2_4b3.tgz in the distribution
1.23 Wed Oct 29 09:20:48 PST 2003
update html_report and paged_report to list the sourceforge site for the labrea daemon
1.22 Tue Oct 21 12:18:00 PDT 2003
fixed typo in 1.21 :-((
1.21 Tue Oct 21 11:56:25 PDT 2003
fixed bug in Report.pm that caused html_report.plx pop up whois to
fail. Reported by Mike Brown [email protected]
1.20 Fri Oct 10 17:48:23 PDT 2003
modify function 'daemon' to remove its PID file on exit
1.19 Tue Sep 30 09:11:50 PDT 2003
Update sub module Report.pm 1.09 and paged_report.plx
no changes to Tarpit.pm
added robots meta tag to paged_report
add javascript function to Report.pm to close popped window on page unload
to prevent multiple sites from trying to use the same named window
1.18 Mon Sep 29 16:24:01 PDT 2003
In Report.pm v 1.08, workaround for MSIE windown pop-up problem
for compatitbility with SpamCannibal. There are just some
things that MSIE doesnt' do very well. sigh...
1.17 Tue Sep 9 13:51:56 PDT 2003
update Report.pm to support SpamCannibal
1.16 Wed Sep 3 19:42:22 PDT 2003
separate out daemon start and stop routines
to facilitate support of Mail::SpamCannibal
Fix duplicated 'my' max_kids
1.15 Tue Aug 12 10:06:40 PDT 2003
remove case sensitivity from server authentication
in Report/examples/whois.plx
cosmetic changes to Report.pm, paged_report.plx
see Report/Changes
1.14 Mon Aug 11 21:21:39 PDT 2003
wrapped call to Net::Whois::IP in 'eval' to trap
fatal error when whois server can't be reached
1.13 Thu Aug 7 16:55:44 PDT 2003
fix scoping error in whois.plx
1.12 Wed Aug 6 14:23:44 PDT 2003
Report.pm updated to eliminate use of Geek Tools
add page 'whois.plx'
1.11 Mon Jan 20 16:28:21 PST 2003
corrected error in calculating midnight epoch in Tarpit.pm
1.10 Tue Oct 8 16:01:51 PDT 2002
Type in 1.09 Report.pm corrected
1.09 Tue Oct 8 08:21:21 PDT 2002
Updated Report v1.04
removed "image" checking from Report::port_stats.
see Report::Changes
1.08 Thu Sep 19 08:09:51 PDT 2002
NO MODULE CODE CHANGES in 1.08 or 1.07
Changes to various test modules to accomodate perl
'flock' implementations that use 'fcntl'
Util/t/lockf.t
Util/t/daemon2_cache.t
DShield/t/move2_Q.t
1.07 Wed Sep 18 18:26:00 PDT 2002
Correct documentation typo in Report/examples/localTrojans.pl
Modified test procedure in t/append_open.t, hopefully to accomodate
'flock' pecularities in solaris 2.8 sun4-solaris. These changes are
UNTESTED, I don't have a sun box. There are no changes to the
modules themselves.
1.06 Tue Aug 20 13:29:43 PDT 2002
Update t/find_old_threads.t to allow tests to succeed
in timezones other than US-Pacific.
There are no changes to any modules, only the test suite,
no update is required for existing installations
1.05 Fri Aug 16 15:36:12 PDT 2002
changed match string in 'DShield::move2_Q' to
recognize single digit destination ports
1.04a Fri Aug 2 14:56:20 PDT 2002
added "please wait" capability to "other sites"
in Report/examples/paged_report.plx
since there were no functional changes to the modules,
no new release has been made.
1.04 Wed Jul 31 17:07:11 PDT 2002
added "please wait" message to Report/examples/paged_report.plx
REMINDER, copy Report/examples/pwait01.gif to your images directory
1.03 Wed Jun 5 10:41:36 PDT 2002
Changes to Makefile.PL only. Some users have reported that on
certain platforms, 'make' does not seem to like to build the README
files but expects a target with a .c or .o extension. I've removed
the README builds and place them in a separate shell file which
can be run manually. Similarly, the dependency check for Codes.pm
is no longer in the Makefile, instead the build is done
unconditionally each time Makefile.PL is executed. This might not
be 'slick', but it does the job.
1.02 Tue May 21 20:51:10 PDT 2002
fix 'timezone' so it works properly for end of year
and all time zones
add 'tz2_sec' so non integer hour tz's convert properly
move Util::their_date to Tarpit.pm since it
needs to use tz2_sec only when Tarpit is loaded
in Report v1.01
update paged_report.plx and html_report.plx, removed some extra
stuff, the pervious version from 1.00 will work fine.
edit for move of 'their_date' from Util.pm to Tarpit.pm
add a color to 'Trends' report and extend range to > 100,000
move javascript precache standard list into Report.pm module
add bonehead checking for images and image directory
in Util v0.05
move 'their_date' to Tarpit.pm
1.01 Mon May 20 22:30:52 PDT 2002
corrected condition in Get/examples/web_scans.pl
where sites.stats file could be improperly truncated
IMPORTANT *** update your copy of web_scan.pl
regex in daemon.pl caused some packed ipaddrs to be
rejected as valid clients. change to '=='
change daemon.pl logic to default to allow all
client connections instead of allow none
1.00 Wed May 15 16:54:43 PDT 2002
Updated 'daemon' to use sockets instead of FIFO
to eliminate session overlap problems on busy server,
this also facilitates remote daemon interrogation.
THIS MEANS !!!
you must update the following scripts:
tell_me.pl
html_report.xxx
paged_report.xxx
added module 'NetIO.pm'
replace 'array2_tarpit' 'if' tree with recursive regenerator
in Get.pm v0.04
moved Socket function 'open_tcp'
to LaBrea::Tarpit::NetIO
in Report.pm v0.23
add 'make_image_cache' to generate
javascript to force browser to precache the
images for 'port_stats'
update Report/examples/paged_report.plx
and Report/examples/html_report.plx to use image cache
in Util.pm v0.04
move 'reap_kids' to NetIO.pm,
leave a pointer for backwards compatibility
move 'reap_kids' to NetIO.pm
rename 'cache_time' to 'daemon2_cache'
to more accurately reflect function
################ DEPRECATED ##########################
0.28 Wed May 15 09:52:23 PDT 2002
Add multi page reporting
./Report/examples/paged_report.plx v1.01
and associated support changes
in DShield.pm v0.05
add 'mail2_Q'
rename deliver2_DShield -> 'process_Q'
and alias deliver2_DShield -> 'process_Q'
rearrange some things to improve code usage
in Report.pm v0.22
add 'make_buttons'
export 'time2local'
export 'other_sites'
update ./examples/html_report.plx to use 'make_buttons'
increased FIFO timeout to 30 seconds
in Util.pm v0.03
add 'cache_time'
add 'upd_cache', a better version of 'update_cache'
'update_cache' now does a goto to upd_cache
add 'script_name'
add 'page_is_current'
0.27 Wed May 8 09:43:19 PDT 2002
Add IANA subdirectory for network protocols and icmp codes.
Add IANA/build_codes.pl to Makefile for Codes.pm auto-generation.
This is for future enhancement of reporting data captured
by Tom Liston's LaBrea program.
Changed test suite to accomodate persistent codes instead
of true - false, preliminary changes to Tarpit.pm to support
protocol types.
add 'old_threads' and examples/tell_me.pl
to allow automatic reporting of very old threads
by email ... see DShield::mail2_Q
in DShield.pm v0.05 Fri May 10 12:35:47 PDT 2002
add 'mail2_Q'
rename deliver2_DShield -> 'process_Q'
and alias deliver2_DShield -> 'process_Q'
rearrange some things to improve code usage
in Report.pm v0.21 Wed May 8 10:58:57 PDT 2002
Differentiate 'my_IPs' error colors into 'INDIGO' and 'VIOLET'
for type 5 and 6 ERRORS -- undocumented
move $time calculation in 'other_sites' into non error
'if' statement to avoid spurious calls to 'Util::their_time'
that complains in the http error log
preset %phantoms values to 1 or 0 when TCP/persistent in
'my_IPs' to accommodate 'protocol' enhancements in Tarpit.pm
0.26 Mon May 6 17:03:19 PDT 2002
Test for the presence of O_SYNC in the Fcntl module
and ignore for BSD? and OS-X systems that do not have it.
Thanks to Wayne Wenzlaff <[email protected]> for spotting this.
initialize some un-inited variables in Report.pm that some
platforms complain about.
0.25 Thu May 2 12:11:57 PDT 2002
correct bareword 'tzb' => $tzb
various fixes in t/append_open.t to properly
do the lock tests
Thanks to Wayne Wenzlaff <[email protected]>
and Robert Wagner <[email protected]> for spotting these
0.24 Wed May 1 12:01:29 PDT 2002 -- not released
remove Range: request in 'Get::short_response',
it makes some not-so-smart web servers barf
correct 'Report::short_report' to recognize '+ timezones'
in LaBrea::Tarpit::Get
add routines 'not_hour', 'not_day', and 'auto_update'
support for automatic update of 'other_sites.txt'
in 'examples/web_scan.pl'
MAKE SURE and use the new version of 'web_scan.pl'
0.23 Tue Apr 30 13:14:21 PDT 2002
Add comments in Report/examples/html_report.plx
to assist users in suppressing portions of the report,
in particular the report on local ip addresses
time zone format for DShield change to -XX:XX, not -XXXX
in Tarpit.pm and DShield.pm
Thanks to Oliver Rizzi <[email protected]>
for spotting this.
fix illegal reference to glob in
Get::open_http
Get::open_tcp
DShield::deliver2_DShield
correct typo in DShield to add USERID to subject line
0.22 Mon Apr 29 18:30:06 PDT 2002
error in handling TZ's starting with +
fixed in 'DShield::move2_Q'
Thanks to Oliver Rizzi <[email protected]>
for spotting this.
0.21 Mon Apr 29 10:04:10 PDT 2002
correct error in t/append_open.t
0.20 Fri Apr 26 12:56:58 PDT 2002
Add support for DShield reporting
Release DShield.pm -- see LaBrea::Tarpit::DShield
corrections to Report::generate -- see Report v0.18, Changes
update examples/daemon.pl v1.02 config array
to include support for DShield
0.19 Sun Apr 15 17:41:21 PDT 2002
release LaBrea::Tarpit::Get to collect statistics
from other LaBrea::Tarpit user web sites for
world wide reporting of Tarpit activity
release LaBrea::Tarpit::Util to hold utility
routines used in other Tarpit modules
add $umask to Util.pm v0.02
moved utility routines from Report.pm to Util.pm
cache_is_valid
update_cache
share_open
ex_open
close_file
http_date
their_date
add blocking timer to 'daemon' to force pipe
to settle down for at least a second before
subsequent dump operations
removed un-needed eval in 'prep_report'
split 'array2_tarpit' from 'restore_tarpit'
in support of future enhancements
conditionalize 'phantoms' total, it was conditional
anyway, but returned '0' unless ph_dip was enabled.
this updates the document and removes the empty
array value
modified 'update_cache' and add 'short_report',
'gen_short', to Report.pm v0.15
See: Report/Changes for details
updated Report/examples/html_report.plx
to include 'other_sites" and to return a
short report when queried with ?short
0.18 Fri Apr 12 11:19:35 PDT 2002
add 'http_date', to Report.pm v0.14
returns date string per the http 'DATE'
spec. Nice for cgi when Apache::Utility
is not available.
add 'shared_open', 'ex_open', 'close_file',
'cache_is_valid, 'update_cache' locking file
access utilities and their test routines
to Report.pm v0.14
add html FILE CACHING to
'Report/examples/html_report.plx'
change 'write_cache_file' to return undef
if missing filename rather than waiting
for failed open.
correct font name VERANDA -> VERDANA
nice catch by Thomas Liston <[email protected]>
fixes for bugs found by by Thomas Liston <[email protected]>
LaBrea version number overwritten by cache restore,
changed the order to give preference to LaBrea daemon
add test routine 'tz_test_adj.pl' to account
for timezone and year differences in dates
encountered when dates are processed from
human readable log strings. i.e. LaBrea
logging to 'syslog' or using '-o' option
NOTE: for those that bother to read the
Changes file, the preferred operating mode
for LaBrea is with the '-O' option.
0.17 Wed Apr 10 13:42:21 PDT 2002
change _cache2txt to only insert {now} into
tarpit if it is missing in order to preserve
correct time for old syslog writes to tarpit
cache files.
add 'syslog2_txt' to Report.pm 0.13
add syslog analyze capability
to Report/examples/html_report.plx
0.16 Tue Apr 9 16:59:15 PDT 2002
added sort to cull_threads to correct ambiguity
caused by unknown order of keys %tarpit hash
0.15 Tue Apr 9 12:16:12 PDT 2002
add LaBrea daemon version reporting
add README for examples/daemon.pl
add 'get_versions' to Report.pm 0.12
add button bars and version reporting
to LaBrea/Report/examples/html_report.plx
0.14 Mon Apr 8 22:35:19 PDT 2002
final cleanup of Report.pm version 0.11
see Report Changes file
0.13 Mon Apr 8 20:57:21 PDT 2002
corrected subtle bug in &timezone where
my ($now) = @_ || time
returned incorrect value, should be
my ($now) = $_[0] || time
corrected type in Report/examples/html_reports.plx
0.12 Mon Apr 8 16:06:11 PDT 2002
In Report.pm
fix sort by 'max' error in port activity reporting.
add 'threshold' parameter to %look_n_feel.
add version reporting to html_report.plx
0.11 Mon Apr 8 13:59:35 PDT 2002
minor corrections to Report module,
include missing cleardot.gif in MANIFEST
0.10 Thu Apr 4 18:57:22 PST 2002
add caching of daily port hits for each port
to Tarpit daemon and report generator.
add 'port_stats.t'.
update Tarpit.pm to produce batch reports based
on the "now" time of the batch file.
correct test programs to run with "now" time
of input data instead of real time.
add hit graphs by port to Report.pm
other major changes to Reports more generic
0.09 Thu Apr 4 13:39:25 PST 2002
upgrades to work with LaBrea version 2.4b3
remove -L option in examples/daemon.pl
0.08 Fri Mar 8 10:52:34 PST 2002
no changes to Tarpit.pm since 0.05
upgrade to Report.pm v 0.06, correct
error in LaBreaConfig file parsing
see Report/Changes
0.07 Fri Mar 8 09:45:34 PST 2002
update Report.pl to support windoze LaBrea.cfg
and fail gracefully if dameon is not running
and an attempt is made to read the daemon fifo
0.06 Wed Mar 6 19:44:53 PST 2002
upgrade Report.pm to use both LaBreaConfig
and the OLDSTYLE configuration file pair
0.05 Tue Jan 1 17:03:40 PST 2002
upgrade tests so nextsec uses select delay of 0.1 sec
0.04 Thu Dec 13 15:15:33 PST 2001
upgrade to Report 0.03
changes are to examples/html_report.plx
see Report/Changes
0.03 Tue Dec 11 16:39:50 PST 2001
point STDIN,STDOUT,STDERR to null for clean daemon
0.02 Tue Nov 27 21:05:31 PST 2001
add 'phantom_report'
use non-blocking checkfor Labrea data
to eliminate memory race condition
0.01 Mon Nov 26 15:39:41 PST 2001
initial release