# $Id: ChangeLog,v 1.186 2006/02/18 12:16:47 andreas_o Exp $ #
Oinkmaster v2.0 - 20060218
o Major version bump to celebrate that Oinkmaster has now turned 5
o When using the -U argument to merge new variables, you can now also
specify -S to specify which files in the downloaded rules
archive(s) to search for new variables. If -S is not specified, only
snort.conf is searched, just like before. As usual, no variable
merge is done unless -U is specified. You may specify multiple
-S arguments to search for variables in multiple files, e.g.
"... -S snort.conf -S foo.conf ...".
o Handle multi-line variable definitions when merging variables.
o Obfuscate the oinkcode when printing URLs, unless running in verbose
o Added ability to grab rules files from a local directory by
specifying dir:// as URL.
o Suppress warnings about using modifysid on non-existent SIDs when
running in quiet mode.
o Added some modifysid sanity checks
o Added Q33 to the FAQ on how to disable all rules by default and
only activate specific ones, with example how to automatically
update only a few selected rules from Bleeding Snort.
o Other documentation updates.
o Misc improvements to the config file parser.
o You can now set the HTTP User-Agent header string for Oinkmaster by
specifying "user_agent = ..." in oinkmaster.conf. The default
User-Agent string is unchanged, i.e. the string that LWP or wget set
it to by default. Based on patch from Derek Edwards.
o Make contrib/addmsg.pl handle some multi-line statements.
- don't ignore rules that are commented out
- ignore the file deleted.rules by default (you don't use it, do you?!)
Oinkmaster v1.2 - 20050417
o Slightly improved modifysid/template documentation and examples.
For example, added a new template to disable a SID but only if it has
a specific revision number so you can disable a rule temporarily and
automatically start using it again if it becomes updated. Thanks to
Russell Fulton for this suggestion.
o Suppress warnings about non-matching modifysid expressions when
running in super quiet mode (-Q).
o Permit .tgz suffix for rules archive.
o Permit filename as argument to modifysid (and use_template) to apply
a substitution expression on all rules in the specified files(s).
o You can now download multiple rules archives from different URLs at
the same time, either by specifying several -u on the command
line or by using several url= directives in the Oinkmaster
configuration file(s). See the default oinkmaster.conf and the FAQ
for more information.
o Many updates to the FAQ, especially regarding how to update rules
from multiple sources. Also added info about how to use Oinkmaster
after Sourcefire changed the license of the rules.
o Because of the license change, no URL is specified in the default
oinkmaster.conf anymore. You will have to follow the instructions
in there and activate the requested URL(s).
o modifysid/use_template statements of all types will now be processed
in the exact order as specified in the config file. Previously, all
the wildcards were processed last.
o Slightly improved error handling when running under Windows.
o Removed some useless buttons and changed default URL list in the GUI.
o Misc other minor fixes.
Oinkmaster v1.1 - 20041009
o Support template-based modifysid expressions so you can define a
template once and then use that one instead of repeating complex
modifysid expressions. Documentation for this is found in
README.templates and usage examples is found in template-examples.conf.
o New option -s for summarized output (aka bmc mode) to leave out the
details when printing results for added/removed/modified rules.
Only the sid and msg string of the rules are printed, plus the
filename. Non-rule changes are printed as usual.
o New option -m to minimize/simplify the resulting output for modified
rules. This means that identical leading and trailing parts of the
new and old rule are removed so the actual change is much easier to
see. Some characters to the left and right of the diffing parts
are kept to get some context. More information and example output can
be found in the updated manual page (oinkmaster.1).
o Support -s and -m in the GUI as well (the "diff mode" buttons)
o Better handling of duplicate rules (i.e. rules with the same SID) for
files in the downloaded archive:
- If all the duplicates are disabled, only one of them is passed on to
the local rules file
- If one of the rules is enabled and the other one disabled, the
disabled one is discarded
- If both rules are active, the one with the highest 'rev' is used
- If one of the rules has a rev and the other does not, the one with
the rev is used
- If the duplicate rules have the same rev, the one appearing last
in the file is used
o You can now split long configuration directives in oinkmaster.conf to
multiple lines using the regular trailing \ syntax.
o All modifysid substitutions on multi-line rules (including when using
templates) now work on the single-line version of the rule so that you
don't have to care about where the trailing backslashes and newlines are.
o When running in super quiet mode (-Q), possible warnings about
duplicate SIDs in the downloaded rules are suppressed.
o Allow location of editor to be set in the GUI and do not search for a
default one in a predefined list anymore.
o Removed 'P' flag from tar as it is incompatible together with 't' in
gtar, which is now used by default on FreeBSD 5.2-CURRENT and later
(PR ports/70806). Thanks to Saneto Takanori for reporting.
o The GUI will now always use the same Perl binary when executing
oinkmaster.pl as the one running the GUI itself.
o By popular demand: support marking rules as locally modified to prevent
them from being overwritten. See oinkmaster.conf and the FAQ for
documentation about "localsid". Do not use this unless you really have
to as it's very easy to end up with lots of sigs that aren't maintained
o The default URL in oinkmaster.conf is now
http://www.snort.org/dl/rules/snortrules-snapshot-2_2.tar.gz as 2.2
is the latest stable version of Snort at the time of this release.
o The FAQ has been updated, especially the sections about local
customization of rules.
o Fixed bug so -e works correctly in conjunction with modifysid.
Thanks to Alex Butcher.
o Fixed bug that prevented ability to load multiple configs under Win32.
o Fixed bug so that modifysid expressions are case-insensitive again
o Fixed a bunch of documentation typos (thanks to JP Vossen!).
Oinkmaster v1.0 - 20040515
o Default URL in distribution oinkmaster.conf is now
forget to change it if it's not the right one for your version
o You can now set "rule_actions = ..." in oinkmaster.conf to tell
Oinkmaster what keywords are valid as the start of a Snort rule. Useful
if you create your own ruletypes and want those lines to be regarded as
rules instead of non-rule lines. If unset,
"alert|drop|log|pass|reject|sdrop|activate|dynamic" will be used
(same as before).
o You can now run without external binaries if you have the required
Perl modules installed (Archive::Tar, IO::Zlib and LWP::UserAgent).
You can set use_external_bins to 0 or 1 in oinkmaster.conf to override
the default. 0 means to use the Perl modules, 1 means to use external
binaries. It's set to 0 by default on Win32 (since the required
Perl modules are already included in ActivePerl 5.8.1+), and 1 on other
systems (i.e. same behavior as before). This makes it much easier to
install Oinkmaster on Windows/ActivePerl. See the new default
oinkmaster.conf for more information.
o A simple graphical multi-platform front-end to Oinkmaster written in
Perl/Tk is included in the contrib directory (oinkgui.pl).
See README.gui for more information. Screenshots are available on
o contrib/makesidex.pl has been rewritten to handle multi-line rules and
multiple rules directories. It will now also include the rule's "msg"
string as a comment on each disablesid line it prints. Usage syntax is
o The other contrib scripts have been improved with misc feature updates
and small bug fixes as well. For example, addmsg.pl now handles
multiple rules directories just like the others. All scripts now give
a short description when run without arguments. Full descriptions can
still be found in contrib/README.contrib.
o The new default oinkmaster.conf has been updated with more and better
examples (mostly "modifysid" stuff).
o Slightly improved multi-line rule parsing.
o Perl version is checked on startup and must be >= 5.6.1.
o Permission on all rules files in the output directory that are subject
to become updated by Oinkmaster (i.e. files matching the "update_rules"
regexp and that are not ignore by a "skipfile") are now checked
before starting, so that we don't bail out in a middle of
execution if a copy of an updated file should fail because of
o A manual page is now included which describes all the command
line options in detail.
o Major documentation updates (INSTALL, README, README.win32, FAQ).
o Many other improvements.
Oinkmaster v0.9 - 20031201
o It's much faster now.
o Added ability to use "include " in oinkmaster configuration
files. will be parsed (just like a regular oinkmaster.conf) as
soon as the include statement is seen, and then return and continue
parsing the rest of the original file. If an option is re-defined, it
will override the previous value. You can use as many 'include'
statements as you wish, and also include even more files from included
o Also permit an arbitrary number of "-C" arguments to be specified on
command line to load multiple config files. They will be loaded in the
order of appearance. Thanks to Rickard Cedergren for inspiration with
his 'policy-based sensor setup' doc and patch.
o Permit https://... in url specification. Only useful if your wget is
SSL-enabled and you download from an SSL-enabled site.
o Permit scp://@: in url specification.
The rules archive will be copied from remotehost using scp (only tested
with OpenSSH). You can specify a private key with scp_key = ... in
oinkmaster.conf (or set it in ~/.ssh/config).
o You can now specify "-i" for interactive mode. You will be asked to
approve the changes before Oinkmaster modifies anything.
o Added 'enablesid' option to oinkmaster.conf.
o Slightly improved rules parsing (order of sid and msg does not matter).
o oinkmaster.conf will be searched for in /etc/ and /usr/local/etc/ by default.
o Make contrib/create-sidmap.pl and contrib/addsid.pl take an arbitrary number
of directories as argument.
o Added a FAQ.
o wget is now always run in verbose mode, although the output is not displayed
unless you run Oinkmaster in verbose mode as well, or if an error occurs (i.e.
no more need to re-run in verbose mode just to get decent error messages).
o deleted.rules is now ignored (with a "skipfile delete.rules") in the
o You can now specify a wildcard ('*') to the modifysid keyword, like
modifysid * "foo" | "bar", to apply the substitution expression to all
matching rules. This enables you to do stuff like convert all rules of a
certain classtype to 'drop' rules, or replace all 'flow' keywords with
"flags: A+;", and so on. See oinkmaster.conf for examples.
o Include seconds in filename of backup tarball.
o File::Temp is used for creation of temporary directory. You probably
already have that module unless you run an ancient version of Perl.
o Many other minor improvements.
Oinkmaster v0.8 - 20030902
o Experimental multi-line rule support.
o Make contrib/addsid.pl and contrib/addmsg.pl handle multi-line rules as well.
o Added create-sidmap.pl to contrib section. It's a script that generates
a SID map from a directory with rules files. (Like Snort's Regen-sidmap,
but this one handles multi-line rules).
o The 'modifysid' keyword now regards the arguments as regular expressions.
So if you already use this function, you may have to adjust the arguments.
Based on a patch from firstname.lastname@example.org. Also added a bunch of examples.
o Understand Snort_inline's "drop", "sdrop" and "reject" rules.
o You can now start Perl with tainting checks enabled if you like, if
you have a reasonably recent version of Perl.
o The default temporary directory will be checked for in the environment
variables TMP, TMPDIR and TEMPDIR. "/tmp" will be used if none was set.
You can override this by setting tmpdir in oinkmaster.conf.
o A bunch of Win32/Cygwin fixes, mostly from Ueli Kistler .
o A bunch of fixes that makes it work on native Win32 with ActivePerl.
o Added a README.win32 with information about Oinkmaster on Windows.
o Added command line argument "-T" to test the configuration and then exit.
o Better check for duplicate SIDs. Check is done across all files now, and
duplicate SIDs in downloaded archive are discarded (only first one is
kept) and not copied to the local files. This will avoid some annoying
warning messages about duplicates in the local files that won't go away
until the files gets updated again. Pointed out by email@example.com.
o Slightly modified format when printing results
(hopefully easier to read when there are a large number of changes).
o New options in oinkmaster.conf: min_files and min_rules.
If number of rules files or number of rules are not at least min_files
and min_rules respectively, the rules tarball is regarded as broken and
the update is aborted. Both are set to 1 by default.
o New command line option, -U . If specified, variable definitions that
exist in the distribution snort.conf but not in
will be inserted at the beginning of it. See README for more info.
o Avoid using move() from File::Copy since some versions of it lies about
the error message (e.g. "Cross-device link" instead of "Permission denied").
Thanks to Del Armstrong for investigating this issue!
Oinkmaster v0.7 - 20030217
o oinkmaster.conf will now be searched for in /usr/local/etc/ by
default (instead of in the current directory).
You will have to put it there or use the -C argument.
o Don't print warning when using "-e" in quiet mode.
o "-p" ("preserve comments") is now not just obsolete, but invalid.
o New argument, "-Q" to run in über-quiet mode.
Same as quiet mode except that it doesn't print the "None." stuff
when printing results.
o Support file:// syntax in URL specification.
Rules archive will be copied directly from the local filesystem
(which must have been put there ahead of time).
Suggested by firstname.lastname@example.org.
o sid-msg.map will now be updated by default.
o Warn instead of exit in case of invalid lines in the config file.
o Added possibility to modify SIDs, using the "modifysid" keyword
in the config file (use with care).
o Added makesidex.pl by Jerry Applebaum
to contrib section. Useful to new Oinkmaster users who already
have many rules commented out and don't want to create oinkmaster.conf
manually from scratch. It strips out the SIDs from everything you've
commented out and writes them out in a format that can be appended to
o Added addmsg.pl (by myself) to contrib section.
It's a script that will parse your oinkmaster.conf for "disablesid" lines
and add to them their SID message as a #comment.
o Fixed bug related to deleted rules printout.
o Default URL is now
o In verbose mode, print warning if a file in the downloaded archive is empty.
o Don't require write permission in the output directory when running with -c.
Pointed out by email@example.com.
o Don't care about trailing whitespaces for non-rule lines (to avoid getting
a diff where the same line appears to have been both added and removed when
only a trailing whitespace has been removed etc).
o Allow umask to be specified in oinkmaster.conf.
o Many internal cleanups and minor bug fixes.
Oinkmaster v0.6 - 20020706
o Rules that are disabled by default in the rules distribution
will now NOT be re-enabled by Oinkmaster by default, finally.
I.e. "-p" is obsolete. If you want to enable those rules you now
have to use "-e".
o A couple of minor documentation updates.
Oinkmaster v0.5 - 20020506
o Fixed bug where all filenames would not always be printed.
o Fixed minor whitespace idiocy.
o Print which rules that are being preserved or enabled (for rules that
are commented out by default) when running in verbose mode.
o SID dup warnings will no longer be printed when running in quiet mode.
o Document example where running silently as a cron job, only
sending e-mail when there were updates available.
o Document that using -p is usually a good idea.
Oinkmaster v0.4 - 20020422
o More or less rewritten from scratch.
o The file rules.ignore has been renamed to oinkmaster.conf, which contains
more than just the SIDs to disable (have a look at it).
o Slightly improved error checking.
o Better output format (or at least it has changed).
o Oinkmaster will now also update other files (and print changes in them) than
*.rules and classification.conf. The default is now *.rules, *.conf, *.config,
*.txt and *.map so we also update the MIB and sid-msg.map files for example.
Files to be updated is defined by a regexp in oinkmaster.conf so this can
easily be changed.
o Removed several stupid command line options.
o Print warning message if two (or more) rules share the same SID.
o Added option -p to preserve disabled rules in downloaded archive.
o "file" and "sid" keywords in oinkmaster.conf are now invalid.
They are instead called "skipfile" and "disablesid" (to avoid confusion
when possibly adding new keywords in the future).
o Instead of specifying one "disablesid X" per line, you can now also use
comma-separated lists, e.g. "disablesid 1,2,3,4,42".
Same goes for the skipfile keyword.
o Various minor bug fixes and tweaks.
o Some documentation updates.
Oinkmaster v0.3 - never (was rewritten and became v0.4)
Oinkmaster v0.2 - 20010906
o Added optional "-a " argument (which is passed to wget's "-t" argument)
to configure maximum number of download retries before giving up.
o Warning message will be printed if there is any invalid line in the ignore file.
o Fixed a few stupid bugs.
o Default URL is now http://www.snort.org/downloads/snortrules.tar.gz
PLEASE be aware of the following description of the rules in the above archive:
"This is a CVS snapshot of the snort signatures every 30 minutes.
NOTE: These signatures may only work with snort-current"
Oinkmaster v0.1 - 20010726
o Initial release (based on arachnids_upd v0.4).
arachnids_upd v0.4 - 20010526
o Minor optimization fix, which a few people pointed out.
arachnids_upd v0.3 - 20010508
o Much more easy-to-read output of the rule changes
(the diff command is no longer used).
The changes are split into eight categories:
o Added (new):
- New rule (the IDS number did not exist in the old ruleset).
o Added (enabled):
- The rule (with this IDS number) was commented in the old ruleset, but is
o Added (enabled) and modified:
- The rule (with this IDS number) was commented in the old ruleset, but
is now activated. The actual rule had also been modified.
o Removed (deleted):
- The rule (with this IDS number) does no longer exist in any way.
o Removed (disabled):
- The rule (with this IDS number) still exists but have now been commented.
o Removed (disabled) and modified:
- The rule (with this IDS number) still exists but have now been commented.
The actual rule had also been modified.
o Modified active:
- The rule (with this IDS number) have been modified and is an active rule.
o Modified inactive:
- The rule (with this IDS number) have been modified but is currently an
inactive (commented) rule.
o Added INSTALL file with basic installation instructions.
o Minor enhancements.
o Minor documentation updates.
arachnids_upd v0.2 - 20010422
o The ruleset file in the URL must now be gzipped.
Default URL is now http://www.whitehats.com/ids/vision.rules.gz.
An integrity check (gzip -t) will be run on this file after download.
o You must now use -b instead of just -b.
Backups will be stored in this directory.
o If there were no changes in the new ruleset, no backup will be done and the
current ruleset will remain untouched.
o Added contribution script from Dejan Muhamedagic (see contrib/).
I'm not sure it's quite as useful now in v0.2 though.
o Added -q option to run in quiet mode. No output unless the rules had changed.
o Minor documentation updates.
o Minor bug fixes and other minor enhancements
(see arachnids_upd.pl -h for new options).
arachnids_upd v0.1 - 20010210
o Initial release.