pfsense/pfsense-packages — pull request #423 by bmeeks8 (2013-04-10 01:05:58+00:00)
Title: Update Snort Package to ver 2.5.5 - New features and bug fixes

Change Log -- 04/09/2013
====================================================================

Snort 2.9.4.1 pkg version 2.5.5
====================================================================

New or Changed Features
====================================================================
1. Added stability, reliability and logging to Rule Updates performed from the UPDATES
tab or scheduled via cron jobs.

2. Enabled VIEW LOG button on UPDATES TAB so that logged information from rule
update runs can be viewed. Log is limited to 1024K in size, and automatically clears
when the limit is reached.

3. Added support for the new Snort GPLv2 Community Rules. This rule set is a free
download and contains current community-authored detection rules for Snort. Note
that this rule package is a subset of the Snort VRT rule package available to paid VRT
subscribers. If you have a paid subscriber account, then there is no real benefit to
installing the GPLv2 Community Rules along with the Snort VRT rules.

4. Added a user configurable setting to protect the Snort preprocessor text rules files
from being over-written by an automatic or manual rule set update. This setting
defaults to OFF, since most users will want the latest preprocessor rules updates.
This setting would be useful if you maintain customized sensitive-data rules, for
example.

5. Made the Snort package compliant with the PBI install process when it detects
installation on a 2.1-BETA or higher platform. The detection key is the FreeBSD
version on the platform. Versions equal to or greater than 8.3 perform a PBI-compliant
installation with all configuration files in /usr/local/snort-{arch}/etc/snort/ where {arch}
is "i386" for 32-bit platforms or "amd64" for 64-bit platforms.

6. Changed a formerly automatic and somewhat hidden feature into a user-configurable
setting. Snort on pfSense has the ability to examine your enabled preprocessors and
compare them to your selected and enabled rules. When it finds an enabled rule with
a dependency on a disabled preprocessor, it can disable the rule. Doing so allows
Snort to start without "missing preprocessor" errors. Formerly this action was
automatic and hidden from the user. It is now user-configurable on a per-interface
basis on the PREPROCESSORS tab. If enabled, the actions taken by this feature are
logged in the /var/log/snort directory in separate files named for each interface. The
feature now defaults to OFF.

Enabling this feature will make your Snort installation less effective, but some users
may accept the risk in order to avoid the hassles of selecting preprocessors. Use this
feature AT YOUR OWN RISK! It is recommended you leave it at the default OFF
setting.

7. Toggled the default state of the HTTP_INSPECT preprocessor to ON from its former
default of OFF. This was done because so many of the Snort and Emerging Threats
rules require the HTTP_INSPECT preprocessor to be enabled. Because this
preprocessor can generate a considerable number of false positives in many setups,
the HTTP_INSPECT_NO_ALERTS option was also defaulted to ON in this version.
This combination allows the HTTP_INSPECT preprocessor to normalize HTTP traffic
for the rules that need it, yet suppresses all the alerts from the preprocessor.

If you want to enable the HTTP_INSPECT alerts, toggle the
HTTP_INSPECT_NO_ALERTS option to OFF on the PREPROCESSORS tab in the
HTTP_INSPECT section.

8. Improved the process for installing, removing and reinstalling the Snort package. The
package should now correctly handle either a package GUI components reinstall, or
a package delete and install operation.

Bug Fixes
====================================================================
1. Fixed GUI crash when deleting the final remaining Snort interface on the SNORT
INTERFACES tab.

2. Fixed bug that caused the three preprocessor rules files; "decoder.rules",
"preprocessor.rules" and "sensitive-data.rules"; to not be correctly copied to the
interface's configuration sub-directory. This bug impacted FreeBSD 8.3 systems using
the PBI package.

3. Fixed a few issues with HTML formatting on the GUI pages.