bsdperimeter/pfsense-packages — pull request #351 by bmeeks8 (2013-01-20 05:26:33+00:00)
Title: Several bug fixes and some major enhancements to Snort for pfSense 2.0.x and higher

Snort Package for pfSense 2.x

Package Version: 2.5.3 (proposed)
Snort Binary Version: 2.9.2.3

----------------------------------------------------------------
Change Log: 01/19/2013
----------------------------------------------------------------
New Features:

1. Ability to use Snort VRT pre-defined IPS policies
and the associated rules by selecting a policy.
The pre-defined polices are Connectivity, Balanced
or Security. When selected, the corresponding rules
for the policy are automatically enforced.

2. Automatic flowbit resolution for enabled rules. This
ensures required "flowbit-set" rules are enabled to
satisfy any "flowbit-isset" checks in selected rules.

3. An additional setting for configuring memcap on the
stream5 preprocessor.

4. Added configuration for two new SCADA industrial
controls preprocessors for Modbus and DNP3. This
allows use of SCADA rules from Digital Bond, Snort
VRT and Emerging Threats.

5. Added color-coded flagging of modified SID rules
in the GUI Rules display tab to make it easy to
identify rules whose enabled or disabled state
has been modified by the user.

6. Added capability to reset modified rules to their
default state and remove any enablesid/disablesid
mods. This can be done on a specific category or
to all categories.

6. Added option to disable alerts from the http_inspect
preprocessor without actually disabling its function.

Bug Fixes:

1. Corrected inconsistencies in the behavior of
enablesid/disablesid changes across rule updates.
User customizations of rule enable/disable states
now persist across automated rule updates and
Snort start/stop cycles.

2. Corrected problems related to potentially building
incorrect sid-msg.map, classification.config and
reference.config files during automated rule updates.

3. Fixed bug in handling of zero values for some
http_inspect parameters. Zeroes were evaluting as
empty variables and the desired value was not
getting written to the snort.conf file.

4. Fixed assorted minor HTML layout issues with some
of the Snort GUI tab screens.

5. Added code to the automated rules update routine
so that multiple attempts at rules download are
made before logging an error and giving up. This
helps during times the rule download web sites are
particularly busy.

6. Added additional parameters to the POP3 and SMTP
preprocessor configuration to bring the settings in line
with those in the latest Snort 2.9.2.x and higher snort.conf
files. These prevent errors from the preprocessor for
some e-mail attachments due to the defaults being too
small in some cases.

Change in Rules File Handling Philosophy
======================================================

This update drastically alters the way rules files are handled in
Snort. Instead of copying each individual selected category
rules file into the Snort interface sub-directory, the code now stores
all the chosen rules in a single file called "snort.rules" in the /rules
directory of the Snort interface. This file is built by calling a series
of functions during the generation of the "snort.conf" file and during
automated rules updates. Once this file is built, then any custom
enablesid/disablesid changes are done, and the auto-flowbit
resolution routine is called to be sure any flowbit-setting rules are
enabled to support other enabled rules dependent upon set flowbits.

Using and storing a single rules file for chosen rules makes it
easy to implement the new IPS Policy pre-defined protections
in the Snort VRT rules. A new function exists in the code that
takes a Snort VRT policy as input and returns all the rules marked
with the policy. These are then written to the "snort.rules" file.

After chosen rules, policy rules and any custom rules are in place,
the flowbit auto-resolution routine is called to generate a separate
"flowbit-required.rules" file that is stored alongside the "snort.rules"
file. Together, these two files contain all the enforced rules.