Software Release - fwsnort-1.0.6
30 May, 2009
The 1.0.6 release of fwsnort is ready for download.
This release fixes a bug that caused some Snort rules to not be translated into
iptables rules due to improper handling of escaped semicolons. Now that this
bug has been fixed, an additional 58 rules from the Emerging Threats rule set
are now properly supported. Also made it easier to point fwsnort at a single
file with a Snort rule set to be converted (see the --fwsnort-rfile command line
argument).
Here is the complete ChangeLog:
- (Franck Joncourt) Updated fwsnort to use the "! <option> <arg> syntax instead of the older "<option> ! <arg> for the iptables command line.
- (Franck Joncourt) For the --hex-string and --string matches, if the argument exceeds 128 bytes (iptables 1.4.2) then iptables fails with an error "iptables v1.4.2: STRING too long". Fixes this with a patch that adds a new variable in fwsnort.conf "MAX_STRING_LEN", so that the size of the content can be limited. If the content (null terminated string) is more than MAX_STRING_LEN chars, fwsnort throws the rule away.
- Bug fix to allow fwsnort to properly translate snort rules that have "content" fields with embedded escaped semicolons (e.g. "\;"). This allows fwsnort to translate about 58 additional rules from the Emerging Threats rule set.
- Bug fix to allow case insensitive matches to work properly with the --include-re-caseless and --exclude-re-caseless arguments.
- Bug fix to move the 'rawbytes' keyword to the list of keywords that are ignored since iptables does a raw match anyway as it doesn't run any preprocessors in the Snort sense.
- Added the --snort-rfile argument so that a specific Snort rules file (or list of files separated by commas) is parsed.
- Added a small hack to choose the first port from a port list until the iptables 'multiport' match is supported.
- Updated to consolidate spaces in hex matches in the fwsnort.sh script since the spaces are not part of patterns to be searched anyway.
- Updated to the latest complete rule set from Emerging Threats (see http://www.emergingthreats.net/).
- Added the "fwsnort-nobuildreqs.spec" file for building fwsnort on
systems (such as Debian) that do not install/upgrade software via RPM.
This file omits the "BuildRequires: perl-ExtUtils-MakeMaker" directive,
and this fixes errors like the following on an Ubuntu system when
building fwsnort with rpmbuild:
rpm: To install rpm packages on Debian systems, use alien. See README.Debian.
error: cannot open Packages index using db3 - No such file or directory (2)
error: cannot open Packages database in /var/lib/rpm
