* 2003-10-22, prelude-lml 0.8.6:

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Automatically translate a value from base 8 and 16 to base 10. 

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Add a workaround for log using hexadecimal value without 0x prefix.
	  This permit to handle, for example, the way ZyXel modem output the 
	  packet port. 

	- Stphane Loeuillet <stephane.loeuillet@tiscali.fr>:
	  Add a new portsentry rule concerning dropped packets.

	- Stphane Loeuillet <stephane.loeuillet@tiscali.fr>:
	  New ZyXel rules for PPP logs, as well as ruleset improvment
	  and bugfix.

	- Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>:
	  Fixed handling return value of prelude_inet_getaddrinfo. Fix
	  a BSD crash.

	- Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>:
	  Fixed Ipfw ICMP rules. Thanks to mark@fantoma.net for the report. 

* 2003-10-06, prelude-lml 0.8.5:

	- Nicolas Delon <delon.nicolas@wanadoo.fr>:
	  Handle case where a file is rotated by being
	  compressed and renamed. Not only deleted.

	- Nicolas Delon <delon.nicolas@wanadoo.fr>:
	  Make it work on OpenBSD.

* 2003-09-21, prelude-lml 0.8.4:	
	
	- Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>:
	  Removed bogus pcre.h test in configure.
	  Handle situation where $fam_include_dir is undefined correctly.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Make sure we always have a target hostname to use in alert.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Avoid duplicate rotation alert. In case there was a rotation or 
          a checksum error, we have to analyze the file from the beginning.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Use new libprelude IPv6 aware function in order to populate
	  Node and Address members. 

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Fix a possible crash within metadata handling. I wonder
	  how it worked before.
	  
	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  New --group (-g) option that take a groupname argument: 
	  LML will setgid to the specified group if requested. This
	  fix bug #0000081.

	- Stephane Loeuillet <stephane.loeuillet@tiscali.fr>:
	  Add a new variable type for [source/target].service.port
          (VARIABLE_TYPE_PORT). now, ports could either contain a 
	  port number or a service name (www would resolve to 80, 
	  depending your /etc/services).

	- Simon Castro <scastro@entreelibre.com>:
	  New IPChains ruleset.

	- John Green <john@giggled.org>:
	  Add Vigor xDSl router built-in firewall support.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Stop using getc_unlocked(). This function is not available
	  on some plateform, and we don't need it anymore as we droped
	  the threaded architecture.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Be verbose when we fail opening a logfile.

* 2003-04-24, prelude-lml 0.8.3:
	
	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Implement logfile metadata:

	  If there is metadata available and current logfile size is
	  less than the specified metadata offset, assume the log got 
	  rotated, and start analyzing the file at offset 0.

	  If there are metadata available and current logfile size is
	  more or equal than the specified metadata offset: start analyzing
	  the logfile from the specified offset. Unless the checksum doesn't
	  match, in which case we'll issue an alert, and restart from 0.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Should now be able to read up to 2 ^ (64-1) bytes logfile.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Implemented runtime detection and workaround of the FAM (Dnotify)
	  writev() bug. We go back to simple file polling if the bug is 
	  present.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Restart LML on SIGHUP, so that log rotation program might
	  restart it.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Implemented handling of the source and destination address,
	  by the Simple (signature) plugin.
	
	- Vincent Glaume <vglaume@exaprobe.com>:
	  Implemented handling of the "last" keyword, telling LML to stop
	  matching regex against a line of log once one of them has been 
	  matched.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  LML alert now carry LML version.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>:
	  Modified the Debug plugin so that it use the shared LML API
	  for sending alert. Also, Debug alert are now low priority.

	- Laurent Oudot <oudot.laurent@wanadoo.fr>:
	  Exim ruleset.

	- Stphane Loeuillet <LeRoutier@wanadoo.fr>:
	  ProFTPD, vpopmail, qpopper rulesets.

	- Vincent Glaume <vglaume@exaprobe.com>:
	  Squid, NtSyslog, Ipso, Checkpoint, rulesets.

	
* 2002-12-06, prelude-lml-0.8.2:

	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  LML doesn't use pthread anymore, but use more favorable technic
	  where several file descriptor are monitored from a single thread.
	
	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  Massive reorganisation of the way we're doing file monitoring,
	  we are now able to monitor file change throught FAM instead of
	  polling every file descriptor every second. Be warned that a bug
	  in current Linux Kernel (up to 2.4.20 and 2.5.50) prevent FAM from
	  being enabled cause the kernel won't send file notification event 
	  for writev() issued change. FAM support will only be activated in 
	  case the bug is not present.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  Fix Solaris compilation problem.

	- Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>:
	  Fix a build problem on FreeBSD
	  
	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  The Simple plugin now support setting User and UserID fields.

	- Brad Spengler <spender@grsecurity.net>:
	  Update grsecurity ruleset. The new ruleset should handle event 
	  generated by grsecurity up to version 1.9.7.
	
	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  Prevent signatures without regex to be compiled in. This fix a 
	  possible SIGSEGV due to a NULL pointer dereference in case a 
	  signatures didn't provide a regex.

	- Nicolas Delon <delon.nicolas@wanadoo.fr>:
	  New sshd ruleset.

	- Laurent Oudot <oudot.laurent@wanadoo.fr>
	  New ZyWall ruleset.

	- Nicolas Delon <delon.nicolas@wanadoo.fr>:
	  Updated the Netfilter ruleset so that it is able to match 
	  packets not received from the LAN.

	- Yoann Vandoorselaere <yoann@prelude-ids.org>: 
	  Add a COPYING.OPENSSL file, containing the OpenSSL license.
	  Permit linking with OpenSSL so that Debian package might be distributed.

* 2002-08-29, prelude-lml-0.8.1:
	- Check strdup() return value, and fix a possible
	  memory leak in the udp-server code.
	  (Guillaume Pelat).

	- Fix possible assertion when two modifications
	  are done in the logfile at the same second.
	  (Guillaume Pelat).

	- Fix possible unterminated string.
	  (Guillaume Pelat).

	- Fix possible file descriptor leak.
	  (Guillaume Pelat).

	- Dup the filename before checking if opening the file
	  suceeded, so that re-opening inactive file work again.
	  (Yoann Vandoorselaere).

	- Emit an alert if the modification time get modified,
	  but file size doesn't increase.
	  (Yoann Vandoorselaere).

	- Emit an alert if logfile hard link count reach 0.
          (Yoann Vandoorselaere).

* 2002-07-30, prelude-lml-0.8.0:
	- Initial release.
	- Support for (GrSecurity, NetFilter, Cisco, ZyXel, IpFw, Pax).
