pfsense/pfsense-packages — pull request #635 by bmeeks8 (2014-04-02 20:40:25+00:00)
Title: Snort 2.9.6.0 pkg. v3.0.5 Update

Snort 2.9.6.0 pkg. v3.0.5 Update
-------------------------------------------

Update the Snort package to binary version 2.9.6.0 and GUI version 3.0.5.

Major Changes:
-------------------
1. Note that with this update, due to the inclusion of the IP Reputation preprocessor and its use of whitelist files, the old WHITELISTS tab has been renamed to PASS LISTS. The function is still the same, but the name has been changed to avoid confusion with IP REP whitelists. A PASS LIST file contains IP addresses that Snort will never block, but it will inspect and alert on all traffic to and from IP addresses on a PASS LIST. This is different from the way the whitelists work in the IP Reputation preprocessor. Details on the IP Reputation preprocessor can be found here: http://manual.snort.org/node17.html#SECTION003219000000000000000

2. The Snort Dashboard Widget is now officially part of the Snort package and the separate package installation for the widget is no longer required. During installation of this update, Snort will "absorb" the former Dashboard Widget settings (if it was installed) and then remove the package entry for the separate Snort Dashboard Widget. The last saved state for the Dashboard widget will be restored when Snort is reinstalled if "Keep Settings on Deinstall" is checked on the GLOBAL SETTINGS tab in Snort.

New Features:
-------------------
1. Added support for the IP Reputation preprocessor. This preprocessor supports the use of blacklist and whitelist files of IP addresses that are quickly and efficiently matched to network traffic and a block or pass decision is made solely on the basis of which list (blacklist or whitelist) contains the source or destination IP address.

2. Added support for additional Barnyard2 output plugins to support syslog and Bro receivers along with support of processed file archiving for unified2 log files. A configurable retention period is available for archived unified2 logs along with a configurable limit on the size of an individual unified2 log file.

3. The rules package update tab has been redesigned to match the other Snort package tabs. Additional information about each downloaded rules package is also provided. There is a new FORCE button to force download of new rules packages.

4. The Snort package now produces a version 2 sid-msg.map file format for Barnyard2. The v2 sid-msg.map file format includes a number of additional fields.

Bug Fixes:
--------------
1. On systems with a large number of enabled rules, multiple Barnyard2 processes would sometimes be started for the same Snort interface.

2. If an existing Snort instance was moved to another physical interface using the drop-down selector on the INTERFACE SETTINGS tab, the log directory for the instance would be deleted.