pfsense/pfsense-packages — pull request #696 by bmeeks8 (2014-08-27 02:04:39+00:00)
Title: Update Suricata to version 2.0.3 and GUI package to v2.0

Suricata 2.0.3 pkg v2.0
-------------------------------
This updates the Suricata binary to version 2.0.3 and the GUI package to version 2.0. A number of bug fixes and new features are included with this update.

Bug Fixes
-------------
1. The phrase "sid-msg.map" is misspelled as "sig-msg.map" in some log messages.

2. On the LOGS MGMT tab, when choosing NO LIMIT for max log sizes or KEEP ALL for retention periods, the change is not saved and the setting reverts back to the default values.

3. The cron task for rotating log files reports an error about a missing file when a log file is not actually present because it has not been enabled. The cron task should check first to see if the log file is present before attempting to check for rotation.

4. On the BLOCKED and ALERTS tabs, certain events may trigger an error similar to: "Warning: inet_pton(): Unrecognized address...". This also results in garbled formatting for the tab display.

5. IPv6 Link-Local addresses are not correctly parsed and added to the HOME_NET variable and to the default pass list. The interface is left appended to the end of the address, and this causes Suricata to throw an error and not parse the HOME_NET variable.

6. Pass Lists created on the PASS LIST tab are not available in the drop-down for HOME NET selection on the INTERFACE tab for a Suricata instance.

7. Suricata decoder events are not logged in the ALERTS tab of the GUI.

8. The cron task for clearing blocked hosts sends an error e-mail when there are no hosts currently being blocked. Need to add the "-q" option to the pfctl command line.

9. After recent changes at the snort.org web site, Snort VRT rules no longer download in Suricata because the VRT eliminated the snortrules-snapshot-edge.tar.gz file the Suricata package uses.

10. The interface name in the widget is not always correct. The name is ok on the alert-tab. e.g. WAN2 is displayed as OPT2 even when OPT2 doesn't exist.

11. IPv6 addresses do not have an unblock button on the alerts page, although they are correctly added to the blocked table (snort2c) and the blocked page.

12. IPv6 networks specified with a CIDR mask in a Pass List are not properly parsed and thus subject to being blocked by Suricata.

13. sksort() function causes redefinition error and crash report on Dashboard when Snort and Suricata dashboard widgets are both displayed at the same time.

14. Sorting of some clickable column headers in tables is broken in newer pfSense versions.

New or Enhanced Features
------------------------------------
1. Add option to set specific syslog facility for Suricata logging, and facility and priority for Barnyard2 local syslog output

2. Add sync to CARP members (also includes new SID mgmt conf files as part of sync data)

3. Add definition for variables FTP_SERVERS and SSH_SERVERS to Variables tab

4. Revert rule forced enable/disable icon behavior back to original two-states (forced on or forced off)

5. Add filtering dialog to ALERTS tab

6. Add ability to utilize enablesid.conf, modifysid.conf and disablesid.conf files such as those used by PulledPork or Oinkmaster for automatically managing enabled/disabled rules and rule categories.

7. Add support for new DNS logging feature available in Suricata 2.0.x

8. Add support for new Application-Layer parsers and detection available in Suricata 2.0.x

9. Remove deprecated "stream_max_sessions" parameter from suricata.yaml config

10. Add support for new EVE JSON logging feature available in Suricata 2.0.x

11. Alter reverse DNS lookup icons on ALERTS and BLOCKED tabs to conform to recent changes in pfSense 2.2

12. Add a REFRESH button to the LOGS BROWSER tab to reload the currently displayed file