pfsense/pfsense-packages — pull request #433 by bmeeks8 (2013-04-26 02:13:30+00:00)
Title: Snort Packge Update to ver 2.5.7 - Bug fixes and new features

Snort 2.9.4.1 - Package Version 2.5.7
====================================================================
CHANGE LOG -- 04/25/2013
====================================================================
This update for the Snort package includes several bug fixes, process and UI enhancements and new features. This updates the package to version 2.5.7. This is a GUI code update only. The underlying Snort binary package is still 2.9.4.1.

Bug Fixes
============
1. Fixed longstanding bug preventing edits to the intervals for the "Rules Update" and "Remove Blocked Offenders" cron jobs. Changes made in the GLOBAL SETTINGS tab altering the initial settings are now saved and actually implemented in /etc/crontab.

2. Made additional enhancements to the ".../etc/rc.d/snort.sh" script to further improve the startup reliability of Snort and Barnyard2. Found it necessary to add back the code in the "rc_start()" function that prevents double-starting of Snort on reboots following firmware updates or reboots. These changes also corrected problems with Snort not auto-starting following 2.1-BETA snapshot updates and the associated package reinstallation.

3. Corrected a perceived bug in how the Snort reinstall process worked when reinstalling using previously saved settings. Now, if previously saved Snort settings are detected, Snort is auto-started at the end of the post-install process. Several users requested this new behavior.

4. Corrected a number of typos in the Automatic Rules Update module where string variables used as arguments within quotes were not properly delimited with braces {}. For example, "$my_variable" instead of "{$my_variable}". This could certainly have caused some random mischief!

5. Found several more HTML formatting errors scattered around in various modules. Fixing these corrected some weird table formatting issues with stuff not lining up correctly. One example was on the ALERTS tab where on Internet Explorer the layout was scrunched up all on the right-hand side when the alerts table was empty.

6. On the ALERTS tab, the CLEAR button was set to "type=button" instead of the required "type=submit". This caused the CLEAR button to be ineffective in Internet Explorer because it was not hooked to the page form object, and consequently alerts could not be cleared when using Internet Explorer 9 or higher.

7. On the SNORT INTERFACES tab, added code to insure the ".../etc/rc.d/snort.sh" shell script was correctly generated each time an interface was added, removed or had the Barnyard2 settings modified. Previously, some actions could result in the required lines not being added to the shell script.

8. Fixed some spelling errors in assorted log messages and in a few code comments. These had no impact on functionality, but they just looked bad.

9. Fixed a bug in the new PBI-aware install code where during certain stages of package reinstalling on 2.1 systems the PBI path was null. Now, when the PBI path for Snort shows as null, a sane default value is used instead. This bug was also partly responsible for Snort reinstall failures on 2.1 systems during snapshot updates.

Enhanced or New Features
============================
1. Added a check on the SNORT INTERFACES tab for an empty set of rules on an interface. If a configured and enabled interface has no selected rules, a warning icon is now printed next to the offending interface. Additionally, a warning message is also printed in the system log when the interface is started. Lack of selected rules will not prevent Snort from starting on the interface, but now the user is notified of the condition.

2. Changed the pop-up window for viewing the Flowbit-Required Rules and the Rule Updates Log to be a more conventional style custom pop-up that is not full-screen and does not contain the menu UI of pfSense. This will hopefully prevent some user confusion caused by the old UI where the pop-up window was full-screen and contained the menu. However, this old pop-up window did not have all the necessary state information from the old window; so some menu functions within Snort would get confused.

3. Added an automatic VIEW button to the PREPROCESSORS tab that appears whenever the automatic disabling of preprocessor-dependent rules is enabled and it has resulted in some rules actually being disabled. The user can now directly view these auto-disabled rules using the VIEW button on the PREPROCESSORS tab. Note that this new button only appears if rules have actually been disabled. If no rules were auto-disabled, then the new VIEW button is hidden.

4. Changed several of the system log messages from Snort to be more descriptive. Also added a few additional messages from the Snort package deletion and reinstallation routines to give a better record of the process in the event something goes wrong.

5. Continuing in the vein of making Snort easier for novices to use right out-of-the-box without inadvertently shooting themselves in the foot, the Snort package now default enables the most commonly-needed preprocessors. These are clearly marked now on the PREPROCESSORS tab. The new default values are used only when the user has never selected a value. If you have an existing Snort installation and saved the values "unchecked", then they will remain that way until you change them.

6. Added a new CLEAR button on the Custom Rules view of the RULES tab. When the Custom Rules are selected in the dropdown, and the text area is available for editing custom rules, you now have a CLEAR button that will delete all custom rules in the text area and erase them from the configuration file. The new button has a confirmation dialog where you must answer OK before it actually clears the custom rules.

7. Improved the security and integrity of the Rules Update process (both manual and automated) by incorporating verification of the MD5 hash of downloaded rules update files before unpacking and installing them. Previously the code simply tested that the downloaded file size was greater than an arbitrary number. If yes, the download was assumed good. In the new scheme, the MD5 hash of the downloaded file is calculated and then compared to the MD5 hash obtained from the rules origin web site. Only if they match does the updating of the rules proceed. If the hashes do not match, appropriate error messages are sent to the system log and the Rules Update Log.