pfsense/pfsense-packages — pull request #421 by bmeeks8 (2013-04-06 23:54:39+00:00)
Title: Snort GUI Pkg Update to 2.5.5 - Bug Fixes,  and New Features

CHANGE LOG 04/06/2013

Snort 2.9.4.1 pkg version 2.5.5
==============================================================

New or Changed Features

1. Added stability, reliability and logging to Rule Updates
performed from the UPDATES tab or scheduled via cron
jobs.

2. Enabled VIEW LOG button on UPDATES TAB so that logged
information from rule update runs can be viewed. Log
is limited to 1024K in size, and automatically clears
when the limit is reached.

3. Added support for the new Snort GPLv2 Community Rules.
This rule set is a free download and contains current
community-authored detection rules for Snort. Note
that this rule package is a subset of the Snort VRT
rule packge available to paid or registered VRT
subscribers. If you have an Oinkcode, then there is
no real benefit to installing the GPLv2 Community
Rules with the Snort VRT rules.

4. Added a user configurable setting to protect the Snort
preprocessor text rules files from being over-written
by an automatic or manual rule set update. This
setting defaults to OFF, since most users will want
the lastest preprocessor rules updates. This setting
would be useful if you maintain customized sensitive-
data rules, for example.

5. Made the Snort package compliant with the PBI install
process when it detects installation on a 2.1-BETA
or higher platform. The detection key is the FreeBSD
version on the platform. Versions equal to or greater
than 8.3 perform a PBI-compliant installation with all
configuration files in /usr/local/snort-{arch}/etc/snort/
where {arch} is "i386" for 32-bit platforms or "amd64"
for 64-bit platforms.

6. Changed a formerly automatic and somewhat hidden feature
into a user-configurable setting. Snort on pfSense has
the ability to examine your enabled preprocessors and
compare them to your selected and enabled rules. When
it finds an enabled rule with a dependency on a
disabled preprocessor, it can disable the rule. Doing
so allows Snort to start without "missing preprocessor"
errors. Formerly this action was automatic and hidden
from the user. It is now user-configurable on a per-
interface basis on the PREPROCESSORS tab. If enabled,
the actions taken by this feature are logged in the
/var/log/snort directory in separate files named for
each interface. The feature now defaults to OFF.
Enabling this feature will make your Snort installation
less effective, but some users may accept the risk in
order to avoid the hassles of selecting preprocessors.
Use this feature AT YOUR OWN RISK! It is HIGHLY
recommended you leave it at the default OFF setting.

7. Toggled the default state of the HTTP_INSPECT
preprocessor to ON from its former default of OFF.
This was done because so many of the Snort and Emerging
Threats rules require the HTTP_INSPECT preprocessor to
be enabled. Because this preprocessor can generate a
considerable number of false positives in many setups,
the HTTP_INSPECT_NO_ALERTS option was also defaulted
to ON in this version. This combination allows the
HTTP_INSPECT preprocessor to normalize HTTP traffic
for the rules that need it, yet suppresses all the
alerts from the preprocessor. If you want to enable
the HTTP_INSPECT alerts, toggle this option to OFF on
the PREPROCESSORS tab in the HTTP_INSPECT section.

8. Improved the process for installing, removing and
reinstalling the Snort packge. The package should now
correctly handle either a package GUI components reinstall,
nor a package delete and install operation.

BUG Fixes
==============================================================

1. Fixed GUI crash when deleting the final remaining Snort
interface on the SNORT INTERFACES tab.

2. Fixed bug that caused the three preprocessor text rules
files: "decoder.rules", "preprocessor.rules" and
"sensitive-data.rules" files to not be correctly copied
to the interface's configuration sub-directory. This bug
impacted FreeBSD 8.3 systems using the PBI package.

3. Fixed a few issues with HTML formatting on the GUI pages.

4. Added a missing "stop" command to the Snort rc.d script
for starting, stopping and restarting Snort. The "restart"
portion of the script was missing the "stop" command in
the normal "stop then start" sequence.