pfsense/pfsense-packages — pull request #461 by bmeeks8 (2013-06-18 23:24:51+00:00)
Title: Snort Package v 2.5.9 Update

Snort Package v 2.5.9 Update
======================================================================================
Change Log June 18, 2013
-------------------------------------
This update introduces one new feature and improves on several existing ones. It also supports the updating of the underlying Snort binary code to version 2.9.4.6.

----------------------------

New Features
-------------------
1. Support has been added for a Host Attribute Table. This feature allows the run-time import of specific network host attributes to provide auto-configuration of various Preprocessor and rule options. Tools such as nmap and hogger can be used in concert to scan your network, fingerprint all the hosts, and generate a Host Attribute Table file suitable for direct input to Snort. Snort will then auto-configure Preprocessor and rule options to tailor them to your specific network hosts.

Improved Features
-------------------------
1. The automatic rule update start time is now configurable. Formerly, only the update interval was selectable. But now both the interval and starting time are configurable in the GUI. This change benefits users with multiple firewalls as it allows their updates to be staggered. The starting time must be entered in 24-hour form with hours and minutes only (as in HH:MM).

2. Two new icon links were added the RULES tab that either Enable All or Disable All rules in the selected category. The table on the RULES tab is also sortable. Clicking the headers will sort the column. The sort will toggle between ascending and descending on each click. A bookmark anchor has been added to each displayed rule row so that when clicking to enable or disable a particular rule, the page will auto-scroll upon return so the last-clicked rule is near the top of the page.

3. New icons have been added to the ALERTS tab in the SRC and DST IP address columns for displayed alerts. The plus (+) icon, when clicked, will auto-add the generator ID and signature ID (gid:sid) to the Suppression List for the interface using the "suppress gen_id, sig_id, track by_src ip ..." or "suppress gen_id, sig_id, track by_src ip ..." form as applicable for source or destination addresses. As with the SID column icon, if the IP address is already in the Suppression List a disabled icon will be displayed instead. If the GID:SID by itself is in the Suppression List, then the event is suppressed globally and source or destination IP has no meaning. In this case, no plus (+) icon will be displayed under the SRC or DST columns.

4. The XMLRPC Sync process has been improved by moving the sync job on the remote target host to a background task. This greatly speeds up the sync process when a master must replicate to multiple secondary hosts. The master no longer waits for the entire synchronization process to complete on each target. Instead, the job is deposited on the target host and then executes in the background. The master is then free to proceed to the next target host.

Bug Fixes
--------------------
1. The Snort GUI code was run through a HTML validator and several HTML syntax errors were corrected on the various pages. These errors were not materially impacting performance nor functionality, but cleaning them up was a good thing nonetheless.

2. A bug introduced in version 2.5.8 involving zero-length spaces was fixed in the SUPPRESS tab. When copying and pasting an IPv6 address from the ALERTS tab to a suppression list entry, the zero-length spaces used to signal word-break opportunities to the browser on the ALERTS tab were being copied into and then saved with the suppression list. This corrupted the list and produced a Snort error on restart. Now, prior to saving the list, the contents are scrubbed of any zero-length spaces.