= Added Accumulator Feature to ossec-analysisd.

Accumulator allows the collection of data across multiple log entries by
decoding and grouping on an id field.  The cache for the accumulator
lasts:
    Default expire to 2 minutes (on lookup of exact key)
    Default purge count to 200 lookups (on lookup of any key)
    Default purge interval to 5 minutes (on lookup of any key)

== hash_op.(c|h)
* Change to design of the API, OSHash owns the key's memory, caller owns
  the data elements memory.
* OSHash_Add() strdup's the key
* OSHash_Free() now free()'s the key element
* OSHash_Delete() added so hashes can be dynamic

== accumulator.(c|h)
* This allows log lines to accumulate details based on the previous log
  entries which share the same id element.  Lines must contain, therefor
  the decoder must extract, the id element, or the accumulator simply
  returns without performing any action. It is important to note, this
  is not a multi-line reader, each log line is treated as it's own
  event.  As more data is learned about each ID, the events are able
  to use that data.
* Accumulate_Init() sets up the accumulator constants and initilizations
  variables
* Accumulate() performs the accumulation of event data. The default
  expiry for an event ID is 5 minutes of inactivity.
* Accumulate_CleanUp() is called once every 100 lookups or once every 10
  minutes, whichever happens first.

== etc/decoder.xml
* Enabled accumulator plugin for the OpenLDAP Decoder.  This allows for
  rules to be created with <same_source_ip/>, like with SSHD multiple
  login failures.

Bug fixes included:
 * Accumulator working with in-memory structs
 * Testrule.c now is very flagrant about the accumulator usage
 * Fixed bug in Accumulator_CleanUp() which caused crashes
= Added Accumulator Feature to ossec-analysisd.

Accumulator allows the collection of data across multiple log entries by
decoding and grouping on an id field.  The cache for the accumulator
lasts:
    Default expire to 2 minutes (on lookup of exact key)
    Default purge count to 200 lookups (on lookup of any key)
    Default purge interval to 5 minutes (on lookup of any key)

== hash_op.(c|h)
* Change to design of the API, OSHash owns the key's memory, caller owns
  the data elements memory.
* OSHash_Add() strdup's the key
* OSHash_Free() now free()'s the key element
* OSHash_Delete() added so hashes can be dynamic

== accumulator.(c|h)
* This allows log lines to accumulate details based on the previous log
  entries which share the same id element.  Lines must contain, therefor
  the decoder must extract, the id element, or the accumulator simply
  returns without performing any action. It is important to note, this
  is not a multi-line reader, each log line is treated as it's own
  event.  As more data is learned about each ID, the events are able
  to use that data.
* Accumulate_Init() sets up the accumulator constants and initilizations
  variables
* Accumulate() performs the accumulation of event data. The default
  expiry for an event ID is 5 minutes of inactivity.
* Accumulate_CleanUp() is called once every 100 lookups or once every 10
  minutes, whichever happens first.

== etc/decoder.xml
* Enabled accumulator plugin for the OpenLDAP Decoder.  This allows for
  rules to be created with <same_source_ip/>, like with SSHD multiple
  login failures.

Bug fixes included:
 * Accumulator working with in-memory structs
 * Testrule.c now is very flagrant about the accumulator usage
 * Fixed bug in Accumulator_CleanUp() which caused crashes
Merge branch 'feature/accumulator' of github.com:reyjrar/ossec-hids into feature/accumulator

Conflicts:
	etc/decoder.xml
	src/analysisd/Makefile
Add initial support for certificate verification to ossec-authd and agent-auth
Merge remote-tracking branch 'upstream/master' into authd_certificate_verify
Fixed small memory leak in OS_AddNewAgent
Minor changes for consistency
Add more extensive certificate verification to agent-auth
Initial support for verifying IP addresses in subjectAltNames
Stop call to check_ipaddr() if manager was given as hostname
Add much more comprehensive validation of domain names presented in X.509 certificate.
Move certificate verification into check_cert.h and cert_check.c
Minor tidy up
Minor fixes
Ensure ARGV0 is set correctly for agent-auth
More tidy up in check_hostname and better comments
Remove code that checks whether the manager was given as a hostname or IP address
Get agent-auth working on Windows again
add final changes to get agent-auth building for Windows
Merge branch 'master' into feature/accumulator