pfsense/pfsense-packages — pull request #529 by bmeeks8 (2013-10-17 00:29:24+00:00)
Title: Snort 2.9.4.6 Pkg. Version 2.6.1 Update and Dashboard Widget-Snort Pkg Version 0.3.5 Update

Snort 2.9.4.6 pkg v2.6.1
=========================================================================
Change Log
-------------------------------------------------------------------------
Date: 10/08/2013
-------------------------------------------------------------------------

-------------------------------------------------------------------------
Snort Package New Features
-------------------------------------------------------------------------

1. This update adds support for the Emerging Threats Pro ruleset to the Snort package. The ETPro ruleset is mutually exclusive to the Emerging Threats Open (ETOpen) ruleset. Because the ETPro ruleset contains all of the ETOpen rules in addition to a number of others, it is not necessary to run both rulesets simultaneously. When the ETPro ruleset is selected, the ETOpen ruleset is automatically disabled. ETPro rules require a paid subscription through the Emerging Threats service. You must enter your ETPro subscription code as part of the configuration.

2. Tool Tip pop-ups now appear for form field textboxes in the Snort GUI where Aliases are used as the value. The Tool Tip pop up displays the resolved string value of the Alias when you hover your mouse over the textbox.

------------------------------------------------------------------------
IMPORTANT -- Snort Package Functionality Change
------------------------------------------------------------------------

1. Snort package update 2.6.0 introduced limited support for using Fully-Qualified-Domain-Name (FQDN) Aliases in some configuration parameters. This required a pair of package-specific custom functions for resolving FQDN Aliases because the built-in pfSense function does not support resolving FQDN Aliases. The Core Team package review rejected adding these two custom functions in the Snort package; therefore they have been backed out, and support for FQDN Aliases has currently been removed from the Snort package. This functionality may return in a later update when a suitable method exists natively in pfSense to allow packages to resolve FQDN Aliases. You can still use Host, Network and Port Aliases in Snort configurations. The only limitation is that any Host Aliases must be defined with specific IP addresses and must not be FQDN hosts.

------------------------------------------------------------------------
Snort Package Bug Fixes
------------------------------------------------------------------------

1. Aliases containing port ranges (such as 137:139, etc.) were not being expanded into the full list of individual ports prior to being written to certain preprocessor configuration lines in the snort.conf file.

2. The Download buttons on the ALERTS and BLOCKED tabs now function properly to download the alert logs and blocked IP address lists. The downloaded file is a gzipped UNIX tar archive (*.tar.gz).

-----------------------------------------------------------------------
Dashboard Widget-Snort New Features
-----------------------------------------------------------------------

1. Added custom title string with hyperlink to Snort ALERTS tab to the title bar of the Snort Dashboard Widget.