ossec/ossec-hids — pull request #23 by jrossi (2014-01-29 18:29:44+00:00)
Title: Aquerubin ipv6

This has undergone some limited testing in dual-stack Scientific Linux and Linux Mint agents and servers and in IPv6-only Scientific Linux and FreeBSD agents. As a dual-stack server it will accept connections from older IPv4-only agents. As a dual-stack agent it will connect to older IPv4-only servers.

## Known issues/limitations:

* This has not been built/tested for Windows, however, it does accept connections from IPv4 Windows agents. I do not have a working Windows development environment.
* Several database fields now store IP addresses as character strings instead of integers. This feature has not been tested. To check or convert an existing database, run the following SQL commands:
```
describe agent;
describe alert;
alter table agent modify ip_address varchar(46) not null;
alter table alert modify src_ip varchar(46) not null;
alter table alert modify dst_ip varchar(46) not null;
describe agent;
describe alert;
```

## Change notes:

* Removed/converted IPv4 dependent code to IP version-agnostic code
* Enabled dual-stack single-socket connections - connections from IPv4 hosts are tracked internally as IPv4-mapped addresses (os_net.c)
* Replaced sockaddr_in structures with sockaddr_storage and passed as sockaddr pointers (sec.h, validate_op.h, main-client.c, secure.c, main-server.c, syslog.c)
* Added IPv6 ports check (check_open_ports.c, check_rc_ports.c)
* Fixed up event message parsing to skip beyond the colons in IPv6 agent addresses (cleanevent.c)
* Increased IPSIZE to INET6_ADDRSTRLEN (defs.h)
* IP addresses are now stored in character strings instead of ints and displayed as address/prefixlength instead of address/netmask (validate_op.h, os_net.c, secure.c, agent_control.c, rootcheck_control.c, syscheck_control.c)
* Agents will attempt to connect to all IP addresses of a server until a connection is established (os_net.c, ssl-test.c)
* Used getaddrinfo() instead of regular expressions to validate IP addresses (validate_op.c)
* Replaced in_addr structures with a modified os_ip structure which now carries address family and prefix length info (validate_op.c, validate_op.h)
* New function sacmp() does prefix comparisons using sockaddr structures instead of ints (validate_op.c, validate_op.h)
* Modified database schema to store IP addresses as character strings - not tested (alert.c, mysql.schema, postgresql.schema)
* Added ::1 to localhost list (db_op.c)
* Replaced IPv4-dependent decoder regular expressions (\d+.\d+.\d+.\d+) with a more general (\S+) (decoder.xml)
* Replaced local definitions TCP_PROTO and UDP_PROTO with socket API definitions IPPROTO_TCP and IPPROTO_UDP (remote-config.c, remote-config.h, remoted.c)
* New function satop() converts sockaddr structures to text form (os_net.c, os_net.h)
* Port numbers are now stored as strings instead of numbers to reduce type conversions (start_agent.c, client-config.c, client-config.h, csyslogd-config.c, csyslogd-config.h, remote-config.c, remote-config.h, error_messages.h, defs.h, main-client.c, main-server.c, csyslogd.c, alert.c, sendcustomemail.c, sendmail.c, os_net.c, os_net.h, ssl-test.c)
* Removed getNetmask() and _init_mask() functions which are no longer used (validate_op.c, validate_op.h)
* Some minor spelling corrections (read_nmapg.c, read_snortfull.c)
* Enclosed IPv6 addresses in brackets where required (host-deny.sh)
* Updated dovecot decoder filters to handle a log format change and the protocol fi