Index: trunk/src/sh_prelude.c
===================================================================
--- trunk/src/sh_prelude.c	(revision 582)
+++ trunk/src/sh_prelude.c	(revision 1)
@@ -27,16 +27,11 @@
  *       include libprelude 0.9 code from Yoann Vandoorselaere
  */
-
-
-/*
- * for strptime()
- */
-#define _GNU_SOURCE 1 
-
+ 
 #include "config_xor.h"
+
+#define _XOPEN_SOURCE 500 /* glibc2 needs this */
 
 #include <stdio.h>
 #include <string.h>
-#include <ctype.h>
 #include <sys/types.h>
 
@@ -59,9 +54,7 @@
 #include <syslog.h>
 #include <pwd.h>
-
-int     sh_argc_store;
-char ** sh_argv_store;
-
-#if defined(HAVE_LIBPRELUDE)
+#include <grp.h>
+
+#if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
 
 
@@ -80,11 +73,9 @@
  * includes for samhain-specific functions (sl_strstr, sh_error_handle)
  */
-#include "samhain.h"
+#include "slib.h"
 #include "sh_cat.h"
 #include "sh_error_min.h"
 #include "sh_prelude.h"
-#define SH_NEED_PWD_GRP 1
-#include "sh_static.h"
-char * sh_util_strdup (const char * str) SH_GNUC_MALLOC;
+
 /*
  * When SH_USE_XML is set, value are formated using name="value".
@@ -102,5 +93,7 @@
 #define IDMEF_ANALYZER_CLASS _("Integrity Checker")
 #define IDMEF_ANALYZER_VERSION VERSION
-#define IDMEF_ANALYZER_MANUFACTURER _("http://www.la-samhna.de/samhain/")
+#define IDMEF_ANALYZER_MANUFACTURER _("Samhain by Rainer Wichmann")
+
+#define CLASSIFICATION_URL _("http://www.la-samhna.de/samhain/")
 
 
@@ -137,20 +130,8 @@
 }
 
-static int set_prelude_severity_int (const char * str, int prelude_sev)
-{
-        char * p;
-	char * dup = strdup (str);
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
-	char * saveptr;
-#endif
-
-	if (!dup) 
-	        return -1;
-
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
-	p = strtok_r (dup, ", \t", &saveptr);
-#else
-	p = strtok (dup, ", \t");
-#endif
+static int set_prelude_severity_int (char * str, int prelude_sev)
+{
+        char * p = strtok (str, ", \t");
+
         if (p) {
                 do {
@@ -171,32 +152,25 @@
                         else if (0 == strcmp (p, _("info")))
 	                        clear_and_set (prelude_sev, SH_ERR_INFO);
-                        else {
-			        free (dup);
+                        else
 	                        return -1;
-			}
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
-                        p = strtok_r (NULL, ", \t", &saveptr);
-#else
                         p = strtok (NULL, ", \t");
-#endif
                 } while (p);
         }
-	free(dup);
         return 0;
 }
 
-int sh_prelude_map_info (const char * str)
+int sh_prelude_map_info (char * str)
 {
         return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
 }
-int sh_prelude_map_low (const char * str)
+int sh_prelude_map_low (char * str)
 {
         return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
 }
-int sh_prelude_map_medium (const char * str)
+int sh_prelude_map_medium (char * str)
 {
         return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
 }
-int sh_prelude_map_high (const char * str)
+int sh_prelude_map_high (char * str)
 {
         return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
@@ -220,9 +194,5 @@
 {
         char *ret = NULL;
-#if defined(SH_WITH_SERVER)
-        int    delim_start_count = 0;
-        int    found = 0;
-#endif                
-
+        
         ptr = strchr(ptr, delim_start);
         if ( ! ptr )
@@ -230,19 +200,6 @@
 
         ret = ++ptr;
-#if defined(SH_WITH_SERVER)
-        while ((*ptr != '\0') && (!found)){
-		if (*ptr == delim_end) {
-		        if (delim_start_count == 0)
-			        found = 1;
-			delim_start_count--;
-		}
-		else if (*ptr == delim_start) 
-		        delim_start_count++;
-		ptr++;
-        }
-        ptr = (found) ? ptr-1 : NULL ;
-#else
+
         ptr = strchr(ptr, delim_end);
-#endif
         if ( ! ptr )
                 return NULL;
@@ -340,5 +297,4 @@
 }
 
-/* flawfinder: ignore *//* is part of name, not access() */
 static void get_access_info(idmef_file_access_t *access, char * mode, int pos, int mpos)
 {
@@ -349,6 +305,5 @@
 	do {
 	        if ( mode[pos] == 'r' ) {
-			/* flawfinder: ignore *//* is part of name, not access() */
-	                ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
+	                ret = idmef_file_access_new_permission(access, &str, -1);
 	                if ( ret < 0 )
 	                        return;
@@ -357,6 +312,5 @@
 	        }
 	        else if ( mode[pos] == 'w' ) {
-			/* flawfinder: ignore *//* is part of name, not access() */
-	                ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
+	                ret = idmef_file_access_new_permission(access, &str, -1);
 	                if ( ret < 0 )
 	                        return;
@@ -365,6 +319,5 @@
 	        }
 	        else if ( mode[pos] == 'x' || mode[pos] == 's' || mode[pos] == 't') {
-			/* flawfinder: ignore *//* is part of name, not access() */
-	                ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
+	                ret = idmef_file_access_new_permission(access, &str, -1);
 	                if ( ret < 0 )
 	                        return;
@@ -384,6 +337,5 @@
 
 	if ( got == 0 ) {
-	        /* flawfinder: ignore *//* is part of name, not access() */
-	        ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
+	        ret = idmef_file_access_new_permission(access, &str, -1);
 	        if ( ret < 0 )
 	                return;
@@ -405,10 +357,10 @@
         prelude_string_t *str;
         idmef_checksum_t *checksum;
-        idmef_file_access_t *access; /* flawfinder: ignore */
+        idmef_file_access_t *access;
         idmef_user_id_t *userid;
         const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
 	char *mode = NULL;
                 
-        ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
+        ret = idmef_target_new_file(target, &file, -1);
         if ( ret < 0  )
                 return;
@@ -422,8 +374,6 @@
                  */
                 ret = idmef_file_new_path(file, &str);
-                if ( ret < 0 ) {
-		        free(ptr);
-                        return;
-		}
+                if ( ret < 0 )
+                        return;
                 prelude_string_set_nodup(str, ptr);
 
@@ -431,7 +381,8 @@
                 if ( ptr ) {
                         ret = idmef_file_new_name(file, &str);
-                        if ( ret == 0 ) {
-			        prelude_string_set_dup(str, ptr + 1);
-			}
+                        if ( ret < 0 )
+                                return;
+                        
+                        prelude_string_set_dup(str, ptr + 1);
                 }
         }
@@ -446,7 +397,8 @@
         if ( ptr ) {
                 ret = idmef_time_from_samhain(&time, ptr);
-                if ( ret == 0 ) {
-                        idmef_file_set_modify_time(file, time);
-		}
+                if ( ret < 0 )
+                        return;
+                
+                idmef_file_set_modify_time(file, time);
                 free(ptr);
         }
@@ -455,7 +407,8 @@
         if ( ptr ) {
                 ret = idmef_time_from_samhain(&time, ptr);
-                if ( ret == 0 ) {
-                        idmef_file_set_create_time(file, time);
-		}
+                if ( ret < 0 )
+                        return;
+                
+                idmef_file_set_create_time(file, time);
                 free(ptr);
         }
@@ -464,17 +417,8 @@
         if ( ptr ) {
                 ret = idmef_file_new_inode(file, &inode);
-                if ( ret == 0 ) {
-			char * dev = get_value(msg, _("dev"), suffix);
-			if (dev) {
-			        char * q = strchr(dev, ',');
-				if (*q) {
-				         *q = '\0'; ++q;
-					 idmef_inode_set_major_device(inode, strtoul(dev, NULL, 0));
-					 idmef_inode_set_minor_device(inode, strtoul(  q, NULL, 0));
-				}
-				free(dev);
-			}
-			idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
-		}
+                if ( ret < 0 )
+                        return;
+                
+                idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
                 free(ptr);
         }
@@ -482,148 +426,109 @@
         ptr = get_value(msg, _("chksum"), suffix);
         if ( ptr ) {
-                ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
-                if ( ret < 0 ) {
-			free(ptr);
-			goto get_mode;
-		}
+                ret = idmef_file_new_checksum(file, &checksum, 0);
+                if ( ret < 0 )
+                        return;
 
 		hashtype = sh_tiger_get_hashtype();
 
 		if (hashtype == 0)
-			idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
-
-		else if (hashtype == 1)
-			idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
-		
-		else if (hashtype == 2)
-			idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
-		
-		else
-			idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
-
-
-		ret = idmef_checksum_new_value(checksum, &str);
-		if ( ret < 0 ) {
-			free(ptr);
-			goto get_mode;
-		}
+                        idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
+
+                else if (hashtype == 1)
+                        idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
+
+                else if (hashtype == 2)
+                        idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
+
+                else
+                        idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
+
+
+                ret = idmef_checksum_new_value(checksum, &str);
+                if ( ret < 0 )
+                        return;
 
 		/* will be freed on destroy()
 		 */
-		prelude_string_set_nodup(str, ptr);
-	}
-
- get_mode:
+                prelude_string_set_nodup(str, ptr);
+        }
 
 	mode = get_value(msg, _("mode"), suffix);
         if ( mode ) {
-	        /* flawfinder: ignore *//* is part of name, not access() */
-                ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
-                if ( ret < 0 )
-                        goto get_owner;
-
-	        /* flawfinder: ignore *//* is part of name, not access() */
+                ret = idmef_file_new_file_access(file, &access, -1);
+                if ( ret < 0 )
+                        return;
+
                 ret = idmef_file_access_new_user_id(access, &userid);
                 if ( ret < 0 )
-                        goto get_owner;
+                        return;
                 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
 
-	        /* flawfinder: ignore *//* is part of name, not access() */
 		get_access_info ( access, mode, 7, 9 );
         }
-
- get_owner:
  
         ptr = get_value(msg, _("owner"), suffix);
         if ( ptr ) {
-	        char * uid;
-                
-	        /* flawfinder: ignore *//* is part of name, not access() */
-                ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto get_group;
-		}
-
-	        /* flawfinder: ignore *//* is part of name, not access() */
+                struct passwd *pw;
+                
+                ret = idmef_file_new_file_access(file, &access, 0);
+                if ( ret < 0 )
+                        return;
+
                 ret = idmef_file_access_new_user_id(access, &userid);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto get_group;
-		}
+                if ( ret < 0 )
+                        return;
                 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
                 
                 ret = idmef_user_id_new_name(userid, &str);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto get_group;
-                }
+                if ( ret < 0 )
+                        return;
+                
                 prelude_string_set_nodup(str, ptr);
                 
-                uid = get_value(msg, _("iowner"), suffix);
-                if ( ! uid )
-                        goto get_group;
-                
-                idmef_user_id_set_number(userid, strtoul(uid, NULL, 0));
+                pw = getpwnam(ptr);
+                if ( ! pw )
+                        return;
+                
+                idmef_user_id_set_number(userid, pw->pw_uid);
 
 		if ( mode ) {
-		        /* flawfinder: ignore *//* is part of name, not access() */
 		        get_access_info ( access, mode, 1, 3 );
 		}
-
-		free(uid);
-		/* Don't free(ptr) because of prelude_string_set_nodup(str, ptr) */
-        }
-
- get_group:
+        }
 
         ptr = get_value(msg, _("group"), suffix);
         if ( ptr ) {
-                char *gid;
-                
-	        /* flawfinder: ignore *//* is part of name, not access() */
-                ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto mode_free;
+                struct group *gr;
+                
+                ret = idmef_file_new_file_access(file, &access, -1);
+                if ( ret < 0 )
+                        return;
+
+                ret = idmef_file_access_new_user_id(access, &userid);
+                if ( ret < 0 )
+                        return;
+                idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
+                
+                ret = idmef_user_id_new_name(userid, &str);
+                if ( ret < 0 )
+                        return;
+                
+                prelude_string_set_nodup(str, ptr);
+
+                gr = getgrnam(ptr);
+                if ( ! gr )
+                        return;
+
+                idmef_user_id_set_number(userid, gr->gr_gid);
+
+		if ( mode ) {
+		        get_access_info ( access, mode, 4, 6 );
 		}
-
-                ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore *//* is part of name, not access() */
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto mode_free;
-		}
-
-                idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
-                
-                ret = idmef_user_id_new_name(userid, &str);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        goto mode_free;
-		}
-                
-                prelude_string_set_nodup(str, ptr);
-
-                gid = get_value(msg, _("igroup"), suffix);
-                if ( ! gid )
-                        goto mode_free;
-
-                idmef_user_id_set_number(userid, strtoul(gid, NULL, 0));
-
-		if ( mode ) {
-		        get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
-		}
-
-		free(gid);
-		/* Don't free(ptr) because of prelude_string_set_nodup(str, ptr) */
-        }
-
- mode_free:
+        }
 
 	if ( mode ) {
 	        free ( mode );
 	}
-
-	return;
 }
 
@@ -671,11 +576,4 @@
 #endif
 
-#ifdef SH_USE_PORTCHECK
-		{ MSG_PORT_MISS, N_("Service closed"), IDMEF_IMPACT_TYPE_OTHER },
-		{ MSG_PORT_NEW, N_("Service opened"), IDMEF_IMPACT_TYPE_OTHER },
-		{ MSG_PORT_RESTART, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
-		{ MSG_PORT_NEWPORT, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
-#endif
-
 #ifdef SH_USE_SUIDCHK
                 { MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
@@ -703,13 +601,5 @@
                 return -1;
         }
-
-#if defined(SH_WITH_SERVER)
-        /* when using yule, theres a msg=<... msg=<...> >*/
-	while ( (msg = get_value(ptr, _("msg"), NULL)) ) {
-	        free(ptr);
-		ptr = msg;
-	}
-#endif        
-
+        
         ret = prelude_string_cat(out, ptr);
         free(ptr);
@@ -719,276 +609,4 @@
 
 
-#ifdef SH_USE_PORTCHECK
-static int get_service_info(char *msg, idmef_alert_t *alert)
-{
-        int ret;
-	long port;
-	char *ptr, *new, *tmp, *ip, *srv, *protocol, *end;
-        prelude_string_t *str;
-        idmef_address_t *address;
-        idmef_node_t *node;
-	idmef_user_t *user;
-	idmef_process_t *process;
-        idmef_service_t *service;
-        idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
-        struct passwd *pw;
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-	struct passwd pwd;
-	char * buffer;
-#endif
-
-        new = sh_util_strdup(msg);
- 
-        ptr = strstr(new, _("port: "));
-        if ( ! ptr ) {
-                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
-                                _("malformed Samhain port check message"), _("get_service_info"));
-		SH_FREE( new );
-                return -1;
-        }
-
-        ptr += 6; /* skip 'port: ', position on first byte of interface */
-        tmp = strchr(ptr, ':');
-        if ( ! tmp ) {
-                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
-                                _("malformed Samhain port check message (no port)"), _("get_service_info"));
-		SH_FREE( new );
-                return -1;
-        }
-	*tmp = '\0';
-
-	/* Get interface 
-	 */
-	ip = strdup(ptr);
-        if ( ip ) {
-                if ( ! source ) {
-                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
-                        if ( ret < 0 ) {
-                                free(ip);
-				SH_FREE( new );
-                                return ret;
-                        }
-                }
-
-                ret = idmef_source_new_node(source, &node);
-                if ( ret < 0 ) {
-                        free(ip);
-			SH_FREE( new );
-                        return ret;
-                }
-                
-                ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
-                if ( ret < 0 ) {
-                        free(ip);
-			SH_FREE( new );
-                        return ret;
-                }
-                
-                ret = idmef_address_new_address(address, &str);
-                if ( ret < 0 ) {
-                        free(ip);
-			SH_FREE( new );
-                        return ret;
-                }
-                
-                prelude_string_set_nodup(str, ip);
-        }
-
-	ptr = tmp;
-	++ptr;
-        tmp = strchr(ptr, '/');
-        if ( ! tmp ) {
-                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
-                                _("malformed Samhain port check message (no protocol)"), _("get_service_info"));
-		SH_FREE( new );
-                return -1;
-        }
-	*tmp = '\0';
-
-	/* Get port number
-	 */
-	port = strtol(ptr, &end, 0);
-        if ( *ptr && *end == '\0' && port >= 0 && port < 65536) {
-
-                if ( ! source ) {
-                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
-                        if ( ret < 0 ) {
-				SH_FREE( new );
-                                return ret;
-                        }
-                }
-
-                ret = idmef_source_new_service(source, &service);
-                if ( ret < 0 ) {
-			SH_FREE( new );
-                        return ret;
-                }
-
-		idmef_service_set_port(service, port);
-
-                ret = idmef_service_new_protocol(service, &str);
-                if ( ret < 0 ) {
-			SH_FREE( new );
-                        return ret;
-                }
-                
-		++tmp; 
-		if (*tmp) { 
-		        char * tmpw = tmp;
-			char tmpw_store;
-			while (*tmpw && !isblank((int) *tmpw)) ++tmpw;
-			tmpw_store = *tmpw; *tmpw = '\0';
-		        protocol = strdup(tmp);
-			*tmpw = tmpw_store;
-			prelude_string_set_nodup(str, protocol);
-		}
-
-	}
-
-	ptr = tmp;
-	++ptr;
-        ptr = strchr(ptr, '(');
-        if ( ! ptr ) {
-                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
-                                _("malformed Samhain port check message (no service)"), _("get_service_info"));
-		SH_FREE( new );
-                return -1;
-        }
-	++ptr;
-        tmp = strchr(ptr, ')');
-        if ( ! tmp ) {
-                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
-                                _("malformed Samhain port check message (service not closed)"), _("get_service_info"));
-		SH_FREE( new );
-                return -1;
-        }
-	*tmp = '\0';
-
-	/* Get service
-	 */
-	srv = strdup(ptr);
-        if ( srv ) {
-                if ( ! source ) {
-                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
-                        if ( ret < 0 ) {
-                                free(srv);
-				SH_FREE( new );
-                                return ret;
-                        }
-                }
-
-		if ( ! service ) {
-                        ret = idmef_source_new_service(source, &service);
-			if ( ret < 0 ) {
-                                free(srv);
-				SH_FREE( new );
-				return ret;
-			}
-                }
-
-                ret = idmef_service_new_name(service, &str);
-                if ( ret < 0 ) {
-                        free(srv);
-			SH_FREE( new );
-                        return ret;
-                }
-                
-                prelude_string_set_nodup(str, srv);
-        }
-
-	SH_FREE( new );
-
-        ptr = get_value(msg, _("userid"), NULL);
-
-        if ( ptr ) {
-
-	        idmef_user_id_t * user_id;
-
-	        ret = idmef_source_new_user(source, &user);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        return ret;
-                }
-
-                idmef_user_set_category(user, IDMEF_USER_CATEGORY_APPLICATION);
-                
-                ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
-                if ( ret < 0 ) {
-                        free(ptr);
-                        return ret;
-                }
-                
-                idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_CURRENT_USER);
-
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-		buffer = SH_ALLOC(SH_PWBUF_SIZE);
-		sh_getpwnam_r(ptr, &pwd, buffer, SH_PWBUF_SIZE, &pw);
-#else
-		pw = sh_getpwnam(ptr);
-#endif
-                if ( pw )
-                        idmef_user_id_set_number(user_id, pw->pw_uid);
-
-                ret = idmef_user_id_new_name(user_id, &str);
-                if ( ret < 0 ) {
-                        free(ptr);
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-			SH_FREE(buffer);
-#endif
-                        return ret;
-                }
-                prelude_string_set_nodup(str, ptr);
-
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-		SH_FREE(buffer);
-#endif
-	}
-
-
-        ptr = get_value(msg, _("path"), NULL);
-        tmp = get_value(msg, _("pid"), NULL);
-
-        if ( ptr ) {
-
-                /*
-                 * In term of IDMEF, this is the full path,
-                 * including the name.
-                 */
-                ret = idmef_source_new_process(source, &process);
-                if ( ret < 0 ) {
-		        free(ptr);
-                        return ret;
-		}
-
-		ret = idmef_process_new_path(process, &str);
-                if ( ret < 0 ) {
-		        free(ptr);
-                        return ret;
-		}
-                prelude_string_set_nodup(str, ptr);
-
-                
-                if ( NULL != strrchr(ptr, '/') ) {
-                        ret = idmef_process_new_name(process, &str);
-                        if ( ret == 0 ) {
-			        ptr = strrchr(ptr, '/');
-			        prelude_string_set_dup(str, ptr + 1);
-			}
-                } else {
-		        ret = idmef_process_new_name(process, &str);
-                        if ( ret == 0 ) {
-			        prelude_string_set_dup(str, ptr);
-			}
-		}
-
-		idmef_process_set_pid(process, strtoul(tmp, NULL, 0));
-        }
-
-	if (tmp)
-	  free(tmp);
-
-	return 0;
-}
-#endif
 
 static int get_login_info(char *msg, idmef_alert_t *alert)
@@ -999,8 +617,4 @@
         idmef_node_t *node;
         struct passwd *pw;
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-	struct passwd pwd;
-	char * buffer;
-#endif
         prelude_string_t *str;
         idmef_user_id_t *user_id;
@@ -1012,5 +626,5 @@
         if ( ptr ) {
                 if ( ! source ) {
-                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+                        ret = idmef_alert_new_source(alert, &source, -1);
                         if ( ret < 0 ) {
                                 free(ptr);
@@ -1025,5 +639,5 @@
                 }
                 
-                ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
+                ret = idmef_node_new_address(node, &address, -1);
                 if ( ret < 0 ) {
                         free(ptr);
@@ -1046,5 +660,5 @@
                 else {
                         if ( ! source ) {
-                                ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+                                ret = idmef_alert_new_source(alert, &source, -1);
                                 if ( ret < 0 ) {
                                         free(ptr);
@@ -1079,5 +693,5 @@
                 idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
                 
-                ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
+                ret = idmef_user_new_user_id(user, &user_id, -1);
                 if ( ret < 0 ) {
                         free(ptr);
@@ -1087,10 +701,5 @@
                 idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
                 
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-		buffer = SH_ALLOC(SH_PWBUF_SIZE);
-		sh_getpwnam_r(ptr, &pwd, buffer, SH_PWBUF_SIZE, &pw);
-#else
-		pw = sh_getpwnam(ptr);
-#endif
+                pw = getpwnam(ptr);
                 if ( pw )
                         idmef_user_id_set_number(user_id, pw->pw_uid);
@@ -1099,7 +708,4 @@
                 if ( ret < 0 ) {
                         free(ptr);
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-			SH_FREE(buffer);
-#endif
                         return ret;
                 }
@@ -1111,7 +717,4 @@
                         if ( ret < 0 ) {
                                 free(ptr);
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-				SH_FREE(buffer);
-#endif
                                 return ret;
                         }
@@ -1119,7 +722,4 @@
                         prelude_string_set_nodup(str, ptr);
                 }
-#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
-		SH_FREE(buffer);
-#endif
         }
 
@@ -1140,37 +740,7 @@
 }
 
-#if defined(SH_WITH_SERVER)
-static int node_set_address(idmef_node_t *node, const char *addr)
-{
-        int ret;
-	prelude_string_t *prelude_str;
-	idmef_address_t *idmef_addr;
-
-	ret = prelude_string_new(&prelude_str);
-	if ( ret < 0 ) 
-                goto err;
-      
-	ret = prelude_string_set_ref(prelude_str, addr);
-	if ( ret < 0 ) 
-                goto err;
-
-	ret = idmef_address_new(&idmef_addr);
-	if ( ret < 0 ) 
-                goto err;
-      
-	idmef_address_set_category(idmef_addr, IDMEF_ADDRESS_CATEGORY_IPV4_ADDR);
-	idmef_address_set_address(idmef_addr, prelude_str);
-	idmef_node_set_address(node, idmef_addr, 0);
-
-	return 0;
- err:
-        return -1;
-}
-#endif
-                                          
 
 static int samhain_alert_prelude(int priority, int sh_class, 
-				 char *message, unsigned long msgid, 
-				 char * inet_peer_ip)
+				 char *message, unsigned long msgid)
 {
         int ret;
@@ -1185,11 +755,6 @@
         idmef_confidence_t *confidence;
         prelude_string_t *str;
-#if defined(SH_WITH_SERVER)
-        idmef_node_t *node;
-#else
-	(void) inet_peer_ip;
-#endif
-                
-        if ( !client || sh_class == STAMP)
+                
+        if ( sh_class == STAMP)
                 return 0;
         
@@ -1202,5 +767,5 @@
                 goto err;
 
-        idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
+        idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), 0);
         
         ret = idmef_time_new_from_gettimeofday(&time);
@@ -1218,34 +783,18 @@
                 goto err;
         
-        ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
+        ret = idmef_alert_new_target(alert, &target, -1);
         if ( ret < 0 )
                 goto err;
 
         idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
-
-#if defined(SH_WITH_SERVER)
-        if ( inet_peer_ip != NULL){
-                ret = idmef_target_new_node(target, &node);
-		if ( ret < 0 )
-                          goto err;
-        
-		ret = node_set_address(node, inet_peer_ip); 
-		if ( ret < 0 )
-                          goto err;
-                          
-		idmef_target_set_node(target, idmef_node_ref(node));
-        }
-        else
-#endif        
+        
         if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
                 idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
                 idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
         }
-
+        
         if ( strstr(message, _("path=")) ) {
-#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
                 if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
                         get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
-#endif
                 
                 get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
@@ -1268,12 +817,4 @@
                 goto err;
         
-#ifdef SH_USE_PORTCHECK
-	if (msgid == MSG_PORT_MISS || msgid == MSG_PORT_NEW || msgid == MSG_PORT_RESTART || msgid == MSG_PORT_NEWPORT) {
-	        ret = get_service_info(message, alert);
-		if ( ret < 0 )
-		        goto err;
-        }
-#endif
-   
         map_policy_to_class(message, msgid, impact, str);
 
@@ -1298,5 +839,5 @@
         idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
         
-        ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
+        ret = idmef_alert_new_additional_data(alert, &data, -1);
         if ( ret < 0 )
                 goto err;
@@ -1323,5 +864,5 @@
 
 
-int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid, char *inet_peer_ip)
+int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
 {
         int ret;
@@ -1329,8 +870,8 @@
 	(void) msgflags; /* fix compiler warning */
 
-        if ( initialized < 1 )
+        if ( initialized < 0 )
                 return -1;
         
-        ret = samhain_alert_prelude(priority, sh_class, message, msgid, inet_peer_ip);
+        ret = samhain_alert_prelude(priority, sh_class, message, msgid);
         if ( ret < 0 ) {
                 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
@@ -1344,5 +885,5 @@
 
 
-int sh_prelude_set_profile(const char *arg)
+int sh_prelude_set_profile(char *arg)
 {
         if ( profile ) {
@@ -1360,8 +901,5 @@
 }
 
-/* Allow initialization of prelude; to be called
- * after forking the daemon. Delays heartbeat
- * start after config read until it is safe.
- */
+
 void sh_prelude_reset(void)
 {
@@ -1379,14 +917,5 @@
         if (initialized < 1)
                 return;
-
-	if (sh.flag.isdaemon == S_TRUE)
-	        prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_FAILURE);
-	else
-	        prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
-
-	client = NULL;
-
-	prelude_deinit();
-
+        prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
         initialized = 0;
         return;
@@ -1401,8 +930,4 @@
         idmef_analyzer_t *analyzer;
         prelude_client_flags_t flags;
-#ifdef SH_NOFAILOVER
-	prelude_connection_pool_t *pool;
-	prelude_connection_pool_flags_t conn_flags;
-#endif
 
 	if (ready_for_init == 0)
@@ -1413,5 +938,5 @@
 
 	prelude_thread_init(NULL);
-        prelude_init(&sh_argc_store, sh_argv_store);
+        prelude_init(NULL, NULL);
 
         ret = prelude_client_new(&client, profile ? profile : _("samhain"));
@@ -1440,12 +965,4 @@
         prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
         
-#ifdef SH_NOFAILOVER
-	pool = prelude_client_get_connection_pool(client);
-	conn_flags = prelude_connection_pool_get_flags(pool);
-
-	conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
-	prelude_connection_pool_set_flags(pool, conn_flags);
-#endif
-
         ret = prelude_client_start(client);
         if ( ret < 0 ) {
