Snort GUI Pkg Update to 2.5.5 - Bug Fixes,  and New Features

CHANGE LOG  04/06/2013

Snort 2.9.4.1 pkg version 2.5.5
==============================================================

New or Changed Features

1. Added stability, reliability and logging to Rule Updates
   performed from the UPDATES tab or scheduled via cron 
   jobs.

2. Enabled VIEW LOG button on UPDATES TAB so that logged 
   information from rule update runs can be viewed.  Log 
   is limited to 1024K in size, and automatically clears 
   when the limit is reached.

3. Added support for the new Snort GPLv2 Community Rules.  
   This rule set is a free download and contains current 
   community-authored detection rules for Snort.  Note 
   that this rule package is a subset of the Snort VRT 
   rule packge available to paid or registered VRT 
   subscribers.  If you have an Oinkcode, then there is 
   no real benefit to installing the GPLv2 Community 
   Rules with the Snort VRT rules.

4. Added a user configurable setting to protect the Snort 
   preprocessor text rules files from being over-written 
   by an automatic or manual rule set update.  This
   setting defaults to OFF, since most users will want 
   the lastest preprocessor rules updates.  This setting 
   would be useful if you maintain customized sensitive-
   data rules, for example.

5. Made the Snort package compliant with the PBI install 
   process when it detects installation on a 2.1-BETA 
   or higher platform.  The detection key is the FreeBSD 
   version on the platform.  Versions equal to or greater 
   than 8.3 perform a PBI-compliant installation with all
   configuration files in /usr/local/snort-{arch}/etc/snort/
   where {arch} is "i386" for 32-bit platforms or "amd64" 
   for 64-bit platforms.

6. Changed a formerly automatic and somewhat hidden feature 
   into a user-configurable setting.  Snort on pfSense has 
   the ability to examine your enabled preprocessors and 
   compare them to your selected and enabled rules.  When 
   it finds an enabled rule with a dependency on a 
   disabled preprocessor, it can disable the rule.  Doing 
   so allows Snort to start without "missing preprocessor" 
   errors.  Formerly this action was automatic and hidden 
   from the user.  It is now user-configurable on a per-
   interface basis on the PREPROCESSORS tab.  If enabled, 
   the actions taken by this feature are logged in the 
   /var/log/snort directory in separate files named for 
   each interface.  The feature now defaults to OFF.  
   Enabling this feature will make your Snort installation 
   less effective, but some users may accept the risk in 
   order to avoid the hassles of selecting preprocessors.  
   Use this feature AT YOUR OWN RISK!  It is HIGHLY
   recommended you leave it at the default OFF setting.

7. Toggled the default state of the HTTP_INSPECT 
   preprocessor to ON from its former default of OFF.  
   This was done because so many of the Snort and Emerging 
   Threats rules require the HTTP_INSPECT preprocessor to 
   be enabled.  Because this preprocessor can generate a 
   considerable number of false positives in many setups, 
   the HTTP_INSPECT_NO_ALERTS option was also defaulted 
   to ON in this version.  This combination allows the 
   HTTP_INSPECT preprocessor to normalize HTTP traffic 
   for the rules that need it, yet suppresses all the  
   alerts from the preprocessor.  If you want to enable  
   the HTTP_INSPECT alerts, toggle this option to OFF on  
   the PREPROCESSORS tab in the HTTP_INSPECT section.

8. Improved the process for installing, removing and 
   reinstalling the Snort packge.  The package should now 
   correctly handle either a package GUI components reinstall, 
   nor a package delete and install operation.


BUG Fixes
==============================================================

1. Fixed GUI crash when deleting the final remaining Snort 
   interface on the SNORT INTERFACES tab.

2. Fixed bug that caused the three preprocessor text rules 
   files:  "decoder.rules", "preprocessor.rules" and  
   "sensitive-data.rules" files to not be correctly copied 
   to the interface's configuration sub-directory.  This bug 
   impacted FreeBSD 8.3 systems using the PBI package.

3. Fixed a few issues with HTML formatting on the GUI pages.

4. Added a missing "stop" command to the Snort rc.d script 
   for starting, stopping and restarting Snort.  The "restart" 
   portion of the script was missing the "stop" command in 
   the normal "stop then start" sequence.