pfsense/pfsense-packages — pull request #552 by bmeeks8 (2013-11-19 00:40:03+00:00)
Title: Snort 2.9.5.5 pkg v3.0.0 update

Change Log for pkg v3.0.0
------------------------------------------------------------------------------------
Date: 11/18/2013
------------------------------------------------------------------------------------

New Features:

1. Several of the preprocessors now support multi-engine configurations in the GUI. This allows customized preprocessor settings based on target hosts or networks. The frag3, http_inspect, stream5, ftp_client and ftp_server preprocessors can now be configured with multiple targets based on specified hosts or networks. The new functionality is accessed via the PREPROCESSORS tab for a Snort interface. Each multi-engine preprocessor provides a global configuration section for setting parameters that impact all instances of the preprocessor. The individual target-based parameters are then configured on a per-engine basis. The engine targets are pre-defined host or network Aliases. Controls are provided on the multi-engine configuration GUI to allow selection and import of existing Aliases into a new target-based instance of the preprocessor.

2. Additional configuration parameters have been added for the frag3, stream5, http_inspect, ftp_client and ftp_server preprocessors along with the sensitive data preprocessor.

3. Instead of becoming grayed-out when not available, certain form controls are now hidden completely to reduce screen clutter. When enabled and required, these form controls will become visible.

4. The underlying Snort binary is updated to the latest 2.9.5.5 version. See snort.org for change log information for the 2.9.5.5 binary.

NOTE: this version requires significant changes in the internal structure of the Snort package configuration section within the pfSense config.xml file. For this reason, once upgraded to the 3.0.0 Snort package, the new config.xml is not backwards compatible with older Snort package versions. Be aware of this if you restore an older version of the config.xml file on pfSense. Doing so will require downgrading Snort to match the older package version. During installation of the 3.0.0 package, existing Snort settings will be automatically migrated to the new format.

Snort Sync Users: if you are currently using the experimental Snort Sync feature, there are some upgrade details to consider. First, disable Snort Sync on the master firewall and upgrade it first. Then upgrade all the slave Snort Sync targets to the same Snort package version as the master. Once all hosts have been upgraded, you can safely re-enable Snort Sync again. During the package upgrade, Snort Sync will automatically be disabled as a precaution on any firewall where it is enabled.