This release fixes another remotely triggerable NULL dereference in ip_fragment.c. An unofficial patch enables tracking of already established TCP connections. Missing reset of some tcp_* variables upon nids_exit has been fixed. This release has correct calculation of the radiotap header, compilation warning fixes with newer gcc, and uses pcap_get_selectable_fd() instead of pcap_fileno().
More externals were added to access libnids'
intrinsics from the outside. nids_unregister_*()
functions were added. UDP checksumming was fixed.
nids_params.tcp_workarounds was added. For
nids_params.multiproc and queue_limit, a patch was
applied which creates a separate thread for packet
capture. In killtcp.c, two more RST packets are
sent (which is required because of the MS05-019
patch). A glibc 2.4 syslog.h disaster workaround
was made.
This release adds wscale option parsing. It adds nids_dispatch() for systems that do not ignore pcap timeout, and the ability to specify hosts/networks for which checksums are not checked.
This version fixed signed/unsigned comparisons that
could cause crashes in TCP option parsing. The PCAP
header of the last received packet is now exported
along with the timeout parameter to pcap_open_live.
DLT_PRISM_HEADER and DLT_PPP_SERIAL are now
supported, and dataless ACKs are now let through.
The raw_init() prototype was fixed, and %edi is used
instead of %ebx in csum_partial to resolve issues
with GCC 3.5. Inline assembly was cleaned up, and a
bug where queued FIN segments were not
processed properly was fixed.
Starting with version 1.18, libnids discards TCP
packets with old timestamps, which is required to
pass "fragroute" tests. Memory corruption which
could be caused by overlarge TCP packets has been
fixed. checksum.c has been adjusted to not use
multiline literals (for gcc 3.3). In configure.in,
compilation is attempted even if libnet files are
found; there is another library with the same
name. A bug has been fixed in "collect" field
handling where if you did collect-- and then
collect++ (which is rare) you would get a single
junk packet.
