Snort Package 2.5.8 Update

Snort Package Version 2.5.8 Update
==================================================================

CHANGE LOG
==================================================================
Date:       05/22/2013
Pkg Ver:  2.5.8


This release of the Snort Package fixes a few bugs, corrects some HTML CSS issues so Snort screens more closely match other pfSense screens, and adds several new features.  The most notable new feature is the ability to synchronize the Snort configuration from a Master Host to one or more Secondary (or slave) Hosts.

New Features
==================================================================
1. The Snort package now has the ability to synchronize the configuration to remote hosts using the XMLRPC functionality of pfSense.  This feature is still considered EXPERIMENTAL and is not recommended for production use.  There is a new SYNC tab present in Snort where replication parameters are configured (if desired).  The default is for no replication to occur.  Currently only the basic Snort configuration is synchronized between hosts.  This includes configured Snort interfaces, enabled rules, whitelists, suppress lists, preprocessor options and other parameters typically included in the "snort.conf" configuration file.  Logs, currently blocked hosts and current Alerts are not synchronized between hosts.  A big thank you to pfSense Forum member marcelloc for his contribution of this feature.

2. The HTTP_INSPECT, FRAG3, STREAM5 and SF_PORTSCAN preprocessors now have several new configuration parameters exposed through the Snort GUI.

3. On the IF SETTINGS tab, it is now possible to view in a pop-up window any of the Whitelists or Suppress Lists configured on the system.  The new buttons are located beside the dropdowns on the page where HOME_NET, WHITELISTS and SUPPRESS LISTS are selected.

4. When viewing flowbit-required rules, a new option exists to quickly add the GID:SID for a rule to the SUPPRESS LIST for the interface.

5. On the GUI screens where information is presented in tabular format and the content of a column is truncated and displayed with ellipsis, tooltip text with the entire column content will now appear when you hover over the column.

6. The automatic flowbit-resolution logic now correctly parses and decodes the flowbit logical operators "&" and "|" (logical AND and OR).  For more information on flowbit logical operators, see the README.flowbits file in the Snort.org documentation.

7. On the ALERTS tab, the option for adding the GID:SID of an event to the SUPPRESS LIST has been improved so that now the icon is only enabled when the GID:SID is not already present in the current SUPPRESS LIST for the interface.  If the GID:SID is already present in the list, it displays grayed-out. This prevents multiple entry of the same GID:SID in a list.

8. The menu tab layout in Snort is now more efficient.  When editing Snort interfaces, a new set of menu tabs is added underneath the top-layer tabs.  This makes navigating among functions much easier and faster.  Thanks to pfSense Forum member marcelloc for this improvement!

Changed Features
==================================================================
1. On the SNORT INTERFACES tab, the icons for "Snort Running" or "Snort Stopped" have been changed to align with the icons displayed in the pfSense Services applet.  The green arrow now means "running" and the red X now means "stopped".  This coincides with the styles used for the other pfSense Services.

Bug Fixes
==================================================================
1. Fixed the generation of the default HOME_NET variable so it now correctly includes all locally-attached networks defined on the firewall interfaces.  The entire subnet for locally-attached networks is now included.  The WAN IP address, WAN gateway, WAN DNS Servers, VPNs and/or VIPs (virtual IPs) are also included by default.  Optionally, these latter components may also be ommitted.  Formerly the entire WAN subnet was included in HOME_NET.  This was not optimal and was changed to include just the WAN IP instead of the entire subnet.

2. Similar to the HOME_NET fix above, the default WHITELIST was also fixed to contain the entire subnet of all locally-attached firewall networks.  It may also optionally contains WAN, VPN and VIP information as described for HOME_NET above.

3. Fixed various HTML code issues on several pages that caused problems with word-wrapping and column layout on some browsers (Firefox and Chrome).

4. Fixed minor bug on SNORT INTERFACES tab when attempting to delete an existing interface.