pfSense-pkg-snort-4.0 -- Add support for Inline IPS mode and fix miscellaneous bugs

[bmeeks8]

pfSense-pkg-snort-4.0

This update to the Snort GUI package introduces a new Inline IPS mode of operation using the DAQ netmap module. With Inline IPS operation, rules with the ALERT action will generate alerts but will not block the associated traffic. Rules with the DROP action will generate alerts and block the associated traffic by dropping the packet and not transmitting it on to the operating system stack. Rules with the REJECT action will generate an alert, drop the packet by not forwarding it to the OS stack, and will send a RST back to the sender for TCP traffic or a "Destination port unreachable" for UDP/ICMP traffic.

This update also includes a five bug fixes.

New Features:

1. Support for Inline IPS mode operation using the DAQ netmap module. This mode is configured on the INTERFACE SETTINGS tab for an interface in the Block Settings area. You must have a supported NIC (network interface card) to use this new feature. Currently FreeBSD 12 supports netmap operation with the following NIC drivers: em, igb, ixgb, ixl, lem, re and cxgbe.
2. Enabled the normalize preprocessor for Inline IPS mode operation. This preprocessor does nothing when Legacy Mode blocking is used.

Bug Fixes:

1. Host Attribute Table XML file fails load. See Redmine issue #9546.
2. Interface IP REP tab shows "invalid foreach parameter" error message if no blacklists or whitelists are assigned to the interface.
3. The snort_prepare_rule_files() function does not process enabled or disabled preprocessor or decoder rules when no other rule categories nor an IPS Policy are selected.
4. Config setting CONFIG FLOWBITS_SIZE now set to maximum value (2048). See this Netgate Forums post for details.
5. Snort sometimes fails to live reload rule updates and logs a spurious "Snort Reload: Changes to dynamic preprocessors require a restart" error message in the system log.