Snort 2.9.4.6 Pkg. Version 2.6.1 Update and Dashboard Widget-Snort Pkg Version 0.3.5 Update

Snort 2.9.4.6 pkg v2.6.1
=========================================================================
Change Log
-------------------------------------------------------------------------
Date:  10/08/2013
-------------------------------------------------------------------------

-------------------------------------------------------------------------
Snort Package New Features
-------------------------------------------------------------------------

1. This update adds support for the Emerging Threats Pro ruleset to the Snort package.  The ETPro ruleset is mutually exclusive to the Emerging Threats Open (ETOpen) ruleset.  Because the ETPro ruleset contains all of the ETOpen rules in addition to a number of others, it is not necessary to run both rulesets simultaneously.  When  the ETPro ruleset is selected, the ETOpen ruleset is automatically disabled.  ETPro rules require a paid subscription through the Emerging Threats service.  You must enter your ETPro subscription code as part of the configuration.

2. Tool Tip pop-ups now appear for form field textboxes in the Snort GUI where Aliases are used as the value.  The Tool Tip pop up displays the resolved string value of the Alias when you hover your mouse over the textbox.

3. Automatically enabled Flowbit Rules can now be selected on the RULES tab the same as any other rules category.  You can manually disable auto-flowbit rules if you have good reason for doing so, but the recommended method for dealing with unwanted alerts from auto-flowbit rules is to add a Suppress List entry instead.  Disabling an auto-flowbit rule can result in unintended consequences including a reduction in overall protection.  You need to fully understand the role of auto-flowbit rules in Snort and their impact on the security posture before choosing to disable one!  A link is now provided on the RULES tab page when "Auto-Flowbit Rules" is the selected category for adding a Suppress List entry.

------------------------------------------------------------------------
IMPORTANT -- Snort Package Functionality Change
------------------------------------------------------------------------

1. Snort package update 2.6.0 introduced limited support for using Fully-Qualified-Domain-Name (FQDN) Aliases in some configuration parameters.  This required a pair of package-specific custom functions for resolving FQDN Aliases because the built-in pfSense function does not support resolving FQDN Aliases.  The Core Team package review rejected adding these two custom functions in the Snort package; therefore they have been backed out, and support for FQDN Aliases has currently been removed from the Snort package.  This functionality may return in a later update when a suitable method exists natively in pfSense to allow packages to resolve FQDN Aliases.  You can still use Host, Network and Port Aliases in Snort configurations.  The only limitation is that any Host Aliases must be defined with specific IP addresses and must not be FQDN hosts.

------------------------------------------------------------------------
Snort Package Bug Fixes
------------------------------------------------------------------------

1. Port Aliases containing port ranges (such as 137:139, etc.) in their value were not being expanded into the full list of individual ports prior to being written to certain preprocessor configuration lines in the snort.conf file.

2. The Download buttons on the ALERTS and BLOCKED tabs now function properly to download the alert logs and blocked IP address lists.  The downloaded file is a gzipped UNIX tar archive (*.tar.gz).

-----------------------------------------------------------------------
Dashboard Widget-Snort New Features
-----------------------------------------------------------------------

1. Added custom title string with hyperlink to Snort ALERTS tab to the title bar of the Snort Dashboard Widget.