> o Major version bump to celebrate that Oinkmaster has now turned 5
> years old!
> o When using the -U argument to merge new variables, you can now also
> specify -S <file> to specify which files in the downloaded rules
> archive(s) to search for new variables. If -S is not specified, only
> snort.conf is searched, just like before. As usual, no variable
> merge is done unless -U is specified. You may specify multiple
> -S <file> arguments to search for variables in multiple files, e.g.
> "... -S snort.conf -S foo.conf ...".
> o Handle multi-line variable definitions when merging variables.
> o Obfuscate the oinkcode when printing URLs, unless running in verbose
> mode.
> o Added ability to grab rules files from a local directory by
> specifying dir://<directory> as URL.
> o Suppress warnings about using modifysid on non-existent SIDs when
> running in quiet mode.
> o Added some modifysid sanity checks
> o Added Q33 to the FAQ on how to disable all rules by default and
> only activate specific ones, with example how to automatically
> update only a few selected rules from Bleeding Snort.
> o Other documentation updates.
> o Misc improvements to the config file parser.
> o You can now set the HTTP User-Agent header string for Oinkmaster by
> specifying "user_agent = ..." in oinkmaster.conf. The default
> User-Agent string is unchanged, i.e. the string that LWP or wget set
> it to by default. Based on patch from Derek Edwards.
> o Make contrib/addmsg.pl handle some multi-line statements.
> o contrib/create-sidmap.pl:
> - don't ignore rules that are commented out
> - ignore the file deleted.rules by default (you don't use it, do you?!)
- Fix ln => ${LN} in MESSAGE
- From the ChangeLog:
> o Slightly improved modifysid/template documentation and examples.
> For example, added a new template to disable a SID but only if it has
> a specific revision number so you can disable a rule temporarily and
> automatically start using it again if it becomes updated. Thanks to
> Russell Fulton for this suggestion.
> o Suppress warnings about non-matching modifysid expressions when
> running in super quiet mode (-Q).
> o Permit .tgz suffix for rules archive.
> o Permit filename as argument to modifysid (and use_template) to apply
> a substitution expression on all rules in the specified files(s).
> o You can now download multiple rules archives from different URLs at
> the same time, either by specifying several -u <url> on the command
> line or by using several url=<url> directives in the Oinkmaster
> configuration file(s). See the default oinkmaster.conf and the FAQ
> for more information.
> o Many updates to the FAQ, especially regarding how to update rules
> from multiple sources. Also added info about how to use Oinkmaster
> after Sourcefire changed the license of the rules.
> o Because of the license change, no URL is specified in the default
> oinkmaster.conf anymore. You will have to follow the instructions
> in there and activate the requested URL(s).
> o modifysid/use_template statements of all types will now be processed
> in the exact order as specified in the config file. Previously, all
> the wildcards were processed last.
> o Slightly improved error handling when running under Windows.
> o Removed some useless buttons and changed default URL list in the GUI.
> o Misc other minor fixes.
Portelli with minor changes by me.
Oinkmaster is simple Perl script released under the BSD license to help you
update/manage your Snort 2.0+ rules and comment out the unwanted ones after
each update (among other things). It will tell you exactly what had changed
since the last update, hence giving you good control of your rules.
Oinkmaster can be used to manage the official rules from www.snort.org, but
can just as well be used for managing your homemade rules and distribute
them between sensors.
