pfSense-pkg-suricata v4.0.3_2

[bmeeks8]

pfSense-pkg-suricata-4.0.3_2

This update for the Suricata GUI package contains 2 bug fixes and 7 new features. The underlying binary is unchanged and remains at version 4.0.3.

New Features:

1. The configuration files associated with automatic SID managment via the SID MGMT tab are deprecated in favor of storing the automatic SID management directives directly in the firewall's configuration file, config.xml. During the installation of the new package, the content of all files found in the /var/db/suricata/sidmods directory will be migrated into a list array stored in the firewall configuration file. The new list names are taken from the filenames read from the directory. Storing the automatic SID managment directives content as Base64-encoded data within the firewall configuration ensures that the automatic SID management configuration is backed up and restored along with the rest of the firewall configuration. The ability to upload and download the SID configuration data is retained, but instead of being stored as physical files on the firewall the configuration is written to config.xml.

2. On the CATEGORIES tab, hyperlinks are now provided for opening and viewing the content of all rules categories irregardless of whether the category is enabled or not. Formerly, only "checked" (or enabled) categories could have their contents viewed in a separate window.

3. On the INTERFACE SETTINGS tab a new configurable parameter for snaplen has been added. The default value for the new parameter is 1518 bytes. Increasing the value of this parameter can be helpful if Suricata is failing to alert on VLAN traffic. Note that due to a limitation in the Suricata binary, this value is only applicable to Legacy Mode operation. It has no effect when using Inline IPS Mode.

4. More options are now available to the user for rule action overrides on the RULES and ALERTS tabs. Rules can be forced to ALERT, DROP or REJECT depending on the IPS operational mode of the interface. REJECT is only available when using Inline IPS Mode. Actions are hidden when they are not applicable to the current operational mode. There is also a new option of "Default" for the action. Selecting "Default" removes all user overrides and returns the rule action to the vendor's original value. This is generally "Alert".

5. A series of new choices are availalbe in the Categories drop-down selector on the RULES tab. The new selections are filtered according to the specific operational mode of the interface. The new selections allow the user to select special filtered views as follows: "Active Rules", "User-Forced Enabled Rules", "User-Forced Disabled Rules", "User-Forced Alert Rules", "User-Forced Drop Rules" and "User-Forced Reject Rules". Display of "User-Forced Reject Rules" is only possible when using Inline IPS Mode with blocking enabled. Display of "User-Forced Drop Rules" requires the interface be using Inline IPS Mode or Legacy Mode with Block-on-Drops-Only enabled.

6. A third rule state option of "Default" has been added to the RULES tab when displaying user override options. Choosing "Default" for the rule state will remove all user overrides and return the rule's state (enabled or disabled) to the vendor's original value.

7. Add the ability to customize rule actions on the ALERTS tab. See feature 4 above for details. An additional icon is displayed in the GID:SID column for each alert that allows user overrides of the action. When a rule action has been overridden, a special icon is shown to flag the new action. Pop up tooltips explain the icons.

Bug Fixes:

1. The default pass list generated during Inline IPS Mode operation was too broad. Pass Lists really have very limited usefulness with Inline IPS Mode and so the ability to select a pass list when using Inline IPS Mode has been removed. If you require pass list functionality with Inline IPS Mode, create your own custom PASS rules instead on the RULES tab. Note that pass list functionality is unchanged when using Legacy Mode operation.

2. The new dynamic service status icons on the INTERFACES tab would sometimes not correctly indicate the Suricata service status. There was also an error in a control name for the icons associated with Barnyard2 on the INTERFACES tab.