Snort pkg v3.2.9 Update Release Notes

bmeeks

Snort 2.9.7.6 pkg v3.2.9 Release Notes

This release updates the Snort binary to v2.9.7.6 and the pfSense GUI package to v3.2.9. This update adds support for two new HTTP_INSPECT options and enables logging of IPv6 addresses in Unified2 logs as extra-data. There are four minor bug fixes included with this update.

Note: Other than required bug fixes, I plan on not making changes to GUI functionality within Snort during the period I am porting the package to the new pfSense 2.3 Bootstrap code. There are some additional GUI features I want to add in the areas of custom rules and OpenAppID, but I need to freeze the GUI for a bit while porting to Bootstrap.

New Features

Added support for the decompress_swf and decompress_pdf options for the HTTP_INSPECT preprocessor. These options decompress Shockwave Flash and Adobe PDF files so they can be further inspected. The new settings are available on the HTTP_INSPECT Engines dialog on the PREPROCESSORS tab.
IPv6 addresses are now logged in the extra-data segment when Unified2 log output is enabled with Barnyard2.

Bug Fixes

Tidy up output messages displayed during package installation and during rule updates.
Add two missing OpenAppID folders and a default file to prevent warning messages when starting up with OpenAppID enabled.
When editing HTTP_INSPECT, FRAG3, STREAM5, FTP_SERVER or FTP_CLIENT engines on the PREPROCESSORS tab, there is no prompt to apply the change to the running configuration when returning from the engine dialog page on the PREPROCESSORS tab .
Add code to prevent the /usr/local/etc/rc.d shell script for Snort from processing a RESTART command while a package START command is still in progress

Bill

telserv

Thank you for the Snort upgrade package, but I've noticed a problem. After upgrading to 3.2.9, SNORT has disappeared from the GUI.

The SNORT package shows as installed, but when checking under Services, there is no SNORT menu item. Likewise, under Status > Dashboard > Services Status, SNORT doesn't show.

I have upgraded the SNORT GUI, just in case that was the problem. I have also rebooted the firewall. Are there any suggestions about what to try next, or how to troubleshoot?

Just for the record, I also upgraded Notes and AutoConfigBackup at the same time. They seem to be working.

doktornotor

Yeah. Reinstall the package.

telserv

Reinstall worked. One of the interfaces did not come back up immediately, but I was able to restart it.

<update> On my second site, the upgrade worked perfectly. <end update="">Thank you.</end></update>