pfsense/pfsense-packages — pull request #429 by bmeeks8 (2013-04-22 00:07:37+00:00)
Title: Improve Snort rc.d script restart reliability and fix HTML error in Global Settings

Snort 2.9.4.1 pkg version 2.5.6
====================================================================
Change Log
====================================================================

1. Change the logic of the auto-generated ../rc.d/snort.sh script to improve the restart sequence for Snort and Barnyard2. The rc_stop() portion of the init script now pulls a copy of the PID for the running Snort and Barnyard2 (if applicable) processes on an interface. It then monitors the process shutdown by sending "kill -0" signals every second until the process no longer responds. In this manner, the process is verified as terminated prior to calling the rc_start() portion of the init script. The shutdown monitor has a 30-second timeout, after which it will proceed as if the shutdown completed. This is to prevent an infinite loop. This change in restart behavior was made to correct a type of race condition where during a restart sequence the terminate command was sent via a call to pkill. This call immediately returned after sending the signal and script execution continued assuming the Snort process was dead. However, it can take Snort several seconds to completely shutdown on an interface, particularly on a low-powered firewall. The script then proceeded to issue the rc_start() command to Snort. This part of the code would erroneously sometimes see the "not yet shutdown Snort process" and try to send it a SIGHUP to soft-restart instead of starting a new Snort process. That "shutting down" Snort process would ignore the soft-restart command, and thus at the end of the sequence some users were left with no running Snort process. This typically happened during the Snort restart done during an automatic rule update. The issue was sporadic. The new script logic now waits for Snort or fully shutdown before continuing. The same logic is applied to Barnyard2 if it is configured on the interface. This should improve the reliability of the Snort restart logic in the init script. Additionally, the "soft restart" function was removed since it is only successful when only limited types of updates have been made to the Snort configuration. Overall it's just better to hard stop and then start Snort rather than attempt the soft-restart.

2. Add additional configuration directives for both the snort.conf and barnyard2.conf files that configure Snort to include the year in all alert timestamps, and instruct Barnyard2 to include the year in all of its logged event timestamps.

3. Fix a pair of missing HTML closure tags for the Global Settings tab in Snort. These missing table element tags were causing the "Snort Log Limit Size" text box value to be incorrectly shown.