pfSense-pkg-suricata-4.1.6_1 - Support Suricata 4.1.6, fix GeoLite2 DB and others.

[bmeeks8]

pfSense-pkg-suricata-4.1.6_1

This GUI package update provides support for the latest version of the Suricata binary (v4.1.6). It also corrects five bugs and adds four new features.

New Features:

1. Added column sorting to the RULES tab so it behaves the same as the ALERTS tab.
2. Make filters on ALERTS tab sticky across other actions such as suppressing alerts or disabling a SID. Currently any applied filter resets. Redmine Issue #9902.
3. Highlight rules with "noalerts;" option on RULES tab by coloring the text using the Bootstrap class "text-success" and using a different ACTION icon.
4. Added option to set unique logging directory for file-store configuration section in suricata.yaml.

Bug Fixes:

1. When creating HOME_NET and EXTERNAL_NET (and other ipvars), make sure there is a comma followed by a space for each IP entry. Failure to do so with intermixed IPv4 and IPv6 addresses results in failure to start with no ERRCODE given. See Suricata Redmine Issue #3222.
2. Use of explode() function in suricata_interfaces_edit.php generates a warning because the second parameter of the function call is not interpreted as an empty string due to being uninitialized on green-field installs.
3. When SID MGMT changes rules to DROP or REJECT, it is not skipping rules containing a "flowbits:noalert;" tag. This can result in dropped traffic without any logged alert about the drop or reject action.
4. The IP Reputation List enable option on the IPREP tab actually defaults to "ON" when it should default to "OFF".
5. Maxmind GeoLite2 IP DB now requires a license key for GeoIP2 database downloads. Add support for user-supplied license key.