Merge git+ssh://github.com/pfsense/pfsense-packages

99 files changed, 8392 insertions, 3911 deletions

diff --git a/config/autoconfigbackup/autoconfigbackup.inc b/config/autoconfigbackup/autoconfigbackup.inc
index 0ca3ebe9..2c9d18f9 100644
--- a/config/autoconfigbackup/autoconfigbackup.inc
+++ b/config/autoconfigbackup/autoconfigbackup.inc
@@ -43,8 +43,17 @@ if(file_exists("/usr/local/pkg/parse_config/parse_config_upload.php"))
 function custom_php_validation_command($post, &$input_errors) {
 	global $_POST, $savemsg, $config;
 
+	if(!$post['username'])
+		$input_errors[] = "Username is required.";
+
+	if(!$post['password'] or !$post['passwordagain'])
+		$input_errors[] = "The subscription password is required.";
+
+	if(!$post['crypto_password'] or !$post['crypto_password2'])
+		$input_errors[] = "The encryption password is required.";
+
 	if($post['password'] <> $post['passwordagain']) 
-		$input_errors[] = "Sorry, the entered passwords do not match.";
+		$input_errors[] = "Sorry, the entered portal.pfsense.org passwords do not match.";
 
 	if($post['crypto_password'] <> $post['crypto_password2']) 
 		$input_errors[] = "Sorry, the entered encryption passwords do not match.";
@@ -59,6 +68,21 @@ function custom_php_validation_command($post, &$input_errors) {
 	unset($_POST['testconnection']);
 }
 
+function configure_proxy() {
+	global $config;
+	$ret = array();
+	if (!empty($config['system']['proxyurl'])) {
+		$ret[CURLOPT_PROXY] = $config['system']['proxyurl'];
+		if (!empty($config['system']['proxyport']))
+			$ret[CURLOPT_PROXYPORT] = $config['system']['proxyport'];
+		if (!empty($config['system']['proxyuser']) && !empty($config['system']['proxypass'])) {
+			$ret[CURLOPT_PROXYAUTH] = CURLAUTH_ANY | CURLAUTH_ANYSAFE;
+			$ret[CURLOPT_PROXYUSERPWD] = "{$config['system']['proxyuser']}:{$config['system']['proxypass']}";
+		}
+	}
+	return $ret;
+}
+
 function test_connection($post) {
 	global $savemsg, $config, $g;
 
@@ -93,6 +117,9 @@ function test_connection($post) {
 	curl_setopt($curl_session, CURLOPT_RETURNTRANSFER, 1);
 	curl_setopt($curl_session, CURLOPT_CONNECTTIMEOUT, 55);
 	curl_setopt($curl_session, CURLOPT_TIMEOUT, 30);
+	curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+	// Proxy
+	curl_setopt_array($curl_session, configure_proxy());
 
 	curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=showbackups&hostname={$hostname}");
 	$data = curl_exec($curl_session);
@@ -200,7 +227,10 @@ function upload_config($reasonm = "") {
 				curl_setopt($curl_session, CURLOPT_SSL_VERIFYPEER, 0);
 				curl_setopt($curl_session, CURLOPT_CONNECTTIMEOUT, 55);
 				curl_setopt($curl_session, CURLOPT_TIMEOUT, 30);
-
+				curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+				// Proxy
+				curl_setopt_array($curl_session, configure_proxy());
+				
 				$data = curl_exec($curl_session);
 				if (curl_errno($curl_session)) {
 					$fd = fopen("/tmp/backupdebug.txt", "w");
@@ -239,4 +269,3 @@ function upload_config($reasonm = "") {
 	}	
 }
 
-?>
diff --git a/config/autoconfigbackup/autoconfigbackup.php b/config/autoconfigbackup/autoconfigbackup.php
index 20f5f741..755c47aa 100644
--- a/config/autoconfigbackup/autoconfigbackup.php
+++ b/config/autoconfigbackup/autoconfigbackup.php
@@ -28,6 +28,7 @@
 */
 
 require("guiconfig.inc");
+require("autoconfigbackup.inc");
 
 $pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
 if ($pf_version < 2.0)
@@ -79,7 +80,7 @@ else
 include("head.inc");
 
 function get_hostnames() {
-	global $stats_url, $username, $password, $oper_sep;
+	global $stats_url, $username, $password, $oper_sep, $config, $g;
 	// Populate available backups
 	$curl_session = curl_init();
 	curl_setopt($curl_session, CURLOPT_URL, $stats_url);  
@@ -88,6 +89,10 @@ function get_hostnames() {
 	curl_setopt($curl_session, CURLOPT_POST, 1);
 	curl_setopt($curl_session, CURLOPT_RETURNTRANSFER, 1);
 	curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=showstats");
+	curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+	// Proxy
+	curl_setopt_array($curl_session, configure_proxy());
+	
 	$data = curl_exec($curl_session);
 	if (curl_errno($curl_session)) {
 		$fd = fopen("/tmp/acb_statsdebug.txt", "w");
@@ -165,6 +170,10 @@ function get_hostnames() {
 					curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=delete" . 
 						"&hostname=" . urlencode($hostname) . 
 						"&revision=" . urlencode($_REQUEST['rmver']));
+					curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+					// Proxy
+					curl_setopt_array($curl_session, configure_proxy());
+					
 					$data = curl_exec($curl_session);
 					if (curl_errno($curl_session)) {
 						$fd = fopen("/tmp/acb_deletedebug.txt", "w");
@@ -192,6 +201,9 @@ function get_hostnames() {
 					curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=restore" . 
 						"&hostname=" . urlencode($hostname) . 	
 						"&revision=" . urlencode($_REQUEST['newver']));
+					curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+					// Proxy
+					curl_setopt_array($curl_session, configure_proxy());
 					$data = curl_exec($curl_session);
 					$data_split = split("\+\+\+\+", $data);
 					$sha256 = trim($data_split[0]);	// sha256
@@ -256,6 +268,9 @@ EOF;
 					curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=restore" . 
 						"&hostname=" . urlencode($hostname) . 
 						"&revision=" . urlencode($_REQUEST['download']));
+					curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+					// Proxy
+					curl_setopt_array($curl_session, configure_proxy());
 					$data = curl_exec($curl_session);
 					if (!tagfile_deformat($data, $data1, "config.xml")) 
 						$input_errors[] = "The downloaded file does not appear to contain an encrypted pfSense configuration.";
@@ -306,6 +321,10 @@ EOF;
 				curl_setopt($curl_session, CURLOPT_POST, 1);
 				curl_setopt($curl_session, CURLOPT_RETURNTRANSFER, 1);
 				curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=showbackups&hostname={$hostname}");
+				curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+				// Proxy
+				curl_setopt_array($curl_session, configure_proxy());
+
 				$data = curl_exec($curl_session);
 				if (curl_errno($curl_session)) {
 					$fd = fopen("/tmp/acb_backupdebug.txt", "w");
@@ -401,4 +420,4 @@ EOF;
 </form>
 <?php include("fend.inc"); ?>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/config/autoconfigbackup/autoconfigbackup.xml b/config/autoconfigbackup/autoconfigbackup.xml
index b0514e6a..ee125efc 100644
--- a/config/autoconfigbackup/autoconfigbackup.xml
+++ b/config/autoconfigbackup/autoconfigbackup.xml
@@ -34,7 +34,7 @@
 		*/
         ]]>
 	</copyright>
-    <description>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires Gold or Support Subscription from https://portal.pfsense.org</description>
+    <description>Automatically backs up your pfSense configuration.  All contents are encrypted before being sent to the server.  Requires Gold Subscription from https://portal.pfsense.org</description>
     <requirements>pfSense Portal subscription</requirements>
 	<name>AutoConfigBackup</name>
 	<version>1.25</version>
diff --git a/config/autoconfigbackup/autoconfigbackup_backup.php b/config/autoconfigbackup/autoconfigbackup_backup.php
index 7a6b045f..f14b8aed 100644
--- a/config/autoconfigbackup/autoconfigbackup_backup.php
+++ b/config/autoconfigbackup/autoconfigbackup_backup.php
@@ -29,7 +29,7 @@
 
 require("globals.inc");
 require("guiconfig.inc");
-require("/usr/local/pkg/autoconfigbackup.inc");
+require("autoconfigbackup.inc");
 
 $pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
 if ($pf_version < 2.0)
diff --git a/config/autoconfigbackup/autoconfigbackup_stats.php b/config/autoconfigbackup/autoconfigbackup_stats.php
index b991e3d3..34d96eda 100644
--- a/config/autoconfigbackup/autoconfigbackup_stats.php
+++ b/config/autoconfigbackup/autoconfigbackup_stats.php
@@ -29,7 +29,7 @@
 
 require("globals.inc");
 require("guiconfig.inc");
-require("/usr/local/pkg/autoconfigbackup.inc");
+require("autoconfigbackup.inc");
 
 $pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
 if ($pf_version < 2.0)
@@ -72,6 +72,10 @@ if($_REQUEST['delhostname']) {
 	curl_setopt($curl_session, CURLOPT_SSL_VERIFYPEER, 0);	
 	curl_setopt($curl_session, CURLOPT_RETURNTRANSFER, 1);	
 	curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=deletehostname&delhostname=" . urlencode($_REQUEST['delhostname']));
+	curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+	// Proxy
+	curl_setopt_array($curl_session, configure_proxy());
+	
 	$data = curl_exec($curl_session);
 	if (curl_errno($curl_session)) {
 		$fd = fopen("/tmp/acb_deletedebug.txt", "w");
@@ -144,6 +148,10 @@ include("head.inc");
 	curl_setopt($curl_session, CURLOPT_POST, 1);
 	curl_setopt($curl_session, CURLOPT_RETURNTRANSFER, 1);
 	curl_setopt($curl_session, CURLOPT_POSTFIELDS, "action=showstats");
+	curl_setopt($curl_session, CURLOPT_USERAGENT, $g['product_name'] . '/' . rtrim(file_get_contents("/etc/version")));
+        // Proxy
+        curl_setopt_array($curl_session, configure_proxy());
+
 	$data = curl_exec($curl_session);
 	if (curl_errno($curl_session)) {
 		$fd = fopen("/tmp/acb_statsdebug.txt", "w");
diff --git a/config/autoconfigbackup/crypt_acb.php b/config/autoconfigbackup/crypt_acb.php
index 49a2147a..9f897cb5 100644
--- a/config/autoconfigbackup/crypt_acb.php
+++ b/config/autoconfigbackup/crypt_acb.php
@@ -31,14 +31,17 @@
 
 	function crypt_data($val, $pass, $opt) {
 		$file = tempnam("/tmp", "php-encrypt");
-		$fd = fopen("$file.dec", "w");
-		fwrite($fd, $val);
-		fclose($fd);
-		exec("/usr/bin/openssl enc {$opt} -aes-256-cbc -in $file.dec -out $file.enc -k {$pass}");
-		$result = file_get_contents("$file.enc");
-		exec("rm $file");
-		exec("rm $file.dec");
-		exec("rm $file.enc");
+		file_put_contents("{$file}.dec", $val);
+		exec("/usr/bin/openssl enc {$opt} -aes-256-cbc -in {$file}.dec -out {$file}.enc -k " . escapeshellarg($pass));
+		if (file_exists("{$file}.enc"))
+			$result = file_get_contents("{$file}.enc");
+		else {
+			$result = "";
+			log_error("Failed to encrypt/decrypt data!");
+		}
+		@unlink($file);
+		@unlink("{$file}.dec");
+		@unlink("{$file}.enc");
 		return $result;
 	}
 
@@ -130,4 +133,3 @@
 		return strpos(strtolower($str), strtolower($needle));
 	}
 
-?>
\ No newline at end of file
diff --git a/config/autoconfigbackup/parse_config_upload.inc b/config/autoconfigbackup/parse_config_upload.inc
index ce592966..ba0b48ce 100644
--- a/config/autoconfigbackup/parse_config_upload.inc
+++ b/config/autoconfigbackup/parse_config_upload.inc
@@ -5,4 +5,3 @@ if(file_exists("/usr/local/pkg/autoconfigbackup.inc")) {
 	upload_config();
 }
 
-?>
diff --git a/config/autoconfigbackup/parse_config_upload.php b/config/autoconfigbackup/parse_config_upload.php
index ce592966..ba0b48ce 100644
--- a/config/autoconfigbackup/parse_config_upload.php
+++ b/config/autoconfigbackup/parse_config_upload.php
@@ -5,4 +5,3 @@ if(file_exists("/usr/local/pkg/autoconfigbackup.inc")) {
 	upload_config();
 }
 
-?>
diff --git a/config/autoconfigbackup/upload_config_filter.php b/config/autoconfigbackup/upload_config_filter.php
index ce592966..ba0b48ce 100644
--- a/config/autoconfigbackup/upload_config_filter.php
+++ b/config/autoconfigbackup/upload_config_filter.php
@@ -5,4 +5,3 @@ if(file_exists("/usr/local/pkg/autoconfigbackup.inc")) {
 	upload_config();
 }
 
-?>
diff --git a/config/avahi/avahi.inc b/config/avahi/avahi.inc
index 7b093276..0bc181ec 100644
--- a/config/avahi/avahi.inc
+++ b/config/avahi/avahi.inc
@@ -115,12 +115,12 @@ function avahi_write_config() {
 
 [server]
 host-name={$hostname}
-domain-name={$domain}
-browse-domains="{$browsedomains}"
+domain-name=local
+browse-domains={$browsedomains}
 deny-interfaces={$denyinterfaces}
 use-ipv4={$useipv4}
 use-ipv6={$useipv6}
-enable-dbus=no
+enable-dbus=yes
 #check-response-ttl=no
 #use-iff-running=no
 #disallow-other-stacks=no
diff --git a/config/avahi/avahi.xml b/config/avahi/avahi.xml
index d1e58bdc..f3f98dd4 100644
--- a/config/avahi/avahi.xml
+++ b/config/avahi/avahi.xml
@@ -34,7 +34,7 @@
 	</copyright>
 	<title>Services: Avahi</title>
 	<name>avahi</name>
-	<version>0.6.29 pkg v1.01</version>
+	<version>0.6.31 pkg v1.05</version>
 	<savetext>Save</savetext>
 	<include_file>/usr/local/pkg/avahi.inc</include_file>
 	<menu>
@@ -59,13 +59,13 @@
 		<field>
 			<fielddescr>Browse domains (comma separated)</fielddescr>
 			<fieldname>browsedomains</fieldname>
-			<description>Enter the domains that you would like proxied. (example: .local, pfsense.org, mydomain.com)</description>
+			<description>Enter the domains that you would like proxied. (example: local, pfsense.org, mydomain.com)</description>
 			<type>input</type>
 		</field>
 		<field>
 			<fielddescr>Deny interfaces</fielddescr>
 			<fieldname>denyinterfaces</fieldname>
-			<description>Interfaces that you do NOT want Avahi to listen on.  NOTE: WAN is disabled by default.</description>
+			<description>Interfaces that you do NOT want Avahi to listen on.  NOTE: WAN is always disabled.</description>
 			<type>interfaces_selection</type>
 			<multiple>true</multiple>
 		</field>
diff --git a/config/bandwidthd/bandwidthd.inc b/config/bandwidthd/bandwidthd.inc
index 16ce4ab1..b7ef3bbd 100644
--- a/config/bandwidthd/bandwidthd.inc
+++ b/config/bandwidthd/bandwidthd.inc
@@ -348,7 +348,9 @@ cd -
 EOD;
 		} else {
 			$rc['start'] = <<<EOD
-/usr/local/bandwidthd/bandwidthd
+cd {$bandwidthd_base_dir}
+{$bandwidthd_runtime_library_env} {$bandwidthd_base_dir}/bandwidthd
+cd -
 EOD;
 		}
 	} else {
diff --git a/config/bind/bind.inc b/config/bind/bind.inc
index 9b4a444d..4f6e0d87 100644
--- a/config/bind/bind.inc
+++ b/config/bind/bind.inc
@@ -347,7 +347,7 @@ EOD;
         			switch ($zonetype){
         				case "slave":
         				$bind_conf .= "\t\tmasters { $zoneipslave; };\n";
-        				$bind_conf .= "\t\tallow-transfer {none;};\n";
+        				$bind_conf .= "\t\tallow-transfer { $zoneallowtransfer;};\n";
         				$bind_conf .= "\t\tnotify no;\n";
         				break;
         				case "forward":
diff --git a/config/bind/bind_zones.xml b/config/bind/bind_zones.xml
index 24c3b99e..d771ada6 100644
--- a/config/bind/bind_zones.xml
+++ b/config/bind/bind_zones.xml
@@ -432,7 +432,7 @@
         <custom_php_command_before_form>
         </custom_php_command_before_form>
 	<custom_php_validation_command>
-		if ($_POST['type']=="master")
+		if ($_POST['type']=="master" and $_POST['serial']=="")
 			$_POST['serial']=(date("U")+ 1000000000);
 		bind_zone_validate($_POST, $input_errors);
 	</custom_php_validation_command>
diff --git a/config/ntopng/ntopng.xml b/config/ntopng/ntopng.xml
new file mode 100644
index 00000000..5428d205
--- /dev/null
+++ b/config/ntopng/ntopng.xml
@@ -0,0 +1,240 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+	<copyright>
+	<![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+	ntopng.xml
+	part of pfSense (http://www.pfSense.com)
+	Copyright (C) 2014 ESF, LLC
+	All rights reserved.
+*/
+/* ========================================================================== */
+/*
+	Redistribution and use in source and binary forms, with or without
+	modification, are permitted provided that the following conditions are met:
+
+	 1. Redistributions of source code must retain the above copyright notice,
+		this list of conditions and the following disclaimer.
+
+	 2. Redistributions in binary form must reproduce the above copyright
+		notice, this list of conditions and the following disclaimer in the
+		documentation and/or other materials provided with the distribution.
+
+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+	POSSIBILITY OF SUCH DAMAGE.
+*/
+/* ========================================================================== */
+	]]>
+	</copyright>
+	<name>ntopng</name>
+	<version>1.1 v0.1</version>
+	<title>Diagnostics: ntopng Settings</title>
+	<savetext>Change</savetext>
+	<aftersaveredirect>pkg_edit.php?xml=ntopng.xml</aftersaveredirect>
+	<menu>
+		<name>ntopng Settings</name>
+		<tooltiptext>Set ntopng settings such as password and port.</tooltiptext>
+		<section>Diagnostics</section>
+		<url>/pkg_edit.php?xml=ntopng.xml&amp;id=0</url>
+	</menu>
+	<menu>
+		<name>ntopng</name>
+		<tooltiptext>Access ntopng</tooltiptext>
+		<section>Diagnostics</section>
+		<url>http://$myurl:3000</url>
+		<depends_on_service>ntopng</depends_on_service>
+	</menu>
+	<service>
+		<name>ntopng</name>
+		<rcfile>ntopng.sh</rcfile>
+		<executable>ntopng</executable>
+		<description>ntopng bandwidth monitoring/graphing</description>
+	</service>
+	<tabs>
+		<tab>
+			<text>ntopng Settings</text>
+			<url>/pkg_edit.php?xml=ntopng.xml&amp;id=0</url>
+			<active/>
+		</tab>
+		<tab>
+			<text>Access ntopng</text>
+			<url>http://$myurl:3000</url>
+		</tab>
+	</tabs>
+	<fields>
+		<field>
+			<fielddescr>ntopng Admin Password</fielddescr>
+			<fieldname>password</fieldname>
+			<description>Enter the password for the ntopng GUI.  Minimum 5 characters, defaults to admin.</description>
+			<type>password</type>
+		</field>
+		<field>
+			<fielddescr>Confirm ntopng Admin Password</fielddescr>
+			<fieldname>passwordagain</fieldname>
+			<type>password</type>
+		</field>
+		<field>
+			<fielddescr>Interface</fielddescr>
+			<fieldname>interface_array</fieldname>
+			<type>interfaces_selection</type>
+			<size>3</size>
+			<value>lan</value>
+			<multiple>true</multiple>
+		</field>
+		<field>
+			<fielddescr>DNS Mode</fielddescr>
+			<fieldname>dns_mode</fieldname>
+			<description>Configures how name resolution is handled</description>
+			<type>select</type>
+			<default_value>0</default_value>
+			<options>
+				<option><value>0</value><name>Decode DNS responses and resolve local numeric IPs only (default)</name></option>
+				<option><value>1</value><name>Decode DNS responses and resolve all numeric IPs</name></option>
+				<option><value>2</value><name>Decode DNS responses and don't resolve numeric IPs</name></option>
+				<option><value>3</value><name>Don't decode DNS responses and don't resolve numeric IPs</name></option>
+			</options>
+		</field>
+		<field>
+			<fielddescr>Local Networks</fielddescr>
+			<fieldname>local_networks</fieldname>
+			<description>Configures how Local Networks are defined</description>
+			<type>select</type>
+			<default_value>rfc1918</default_value>
+			<options>
+				<option><value>rfc1918</value><name>Consider all RFC1918 networks local</name></option>
+				<option><value>selected</value><name>Consider selected interface networks local</name></option>
+				<option><value>lanonly</value><name>Consider only LAN interface local</name></option>
+			</options>
+		</field>
+	</fields>
+	<custom_php_global_functions>
+	<![CDATA[
+	function sync_package_ntopng() {
+		conf_mount_rw();
+		config_lock();
+		global $config;
+		global $input_errors;
+		if ($_POST) {
+			$config['installedpackages']['ntopng']['config'] = array();
+			$config['installedpackages']['ntopng']['config'][0] = $_POST;
+		}
+		$ntopng_config =& $config['installedpackages']['ntopng']['config'][0];
+		$if_final = "";
+		$ifaces_final = "";
+		system("/bin/mkdir -p /var/db/ntopng");
+		system("/bin/mkdir -p /var/db/ntopng/rrd");
+		system("/bin/mkdir -p /var/db/ntopng/rrd/graphics");
+		system("/bin/chmod -R 755 /var/db/ntopng");
+		system("/usr/sbin/chown -R nobody:nobody /var/db/ntopng");
+		system("/bin/cp -Rp /usr/local/lib/X11/fonts/webfonts/ /usr/local/lib/X11/fonts/TTF/");
+		$first = 0;
+		foreach($ntopng_config['interface_array'] as $iface) {
+			$if = convert_friendly_interface_to_real_interface_name($iface);
+			if ($if) {
+				$ifaces .= " -i " . escapeshellarg("{$if}");
+			}
+		}
+
+		// DNS Mode
+		if (is_numeric($ntopng_config['dns_mode']) && ($ntopng_config['dns_mode'] >= 0) && ($ntopng_config['dns_mode'] <= 3)) {
+			$dns_mode = "--dns-mode " . escapeshellarg($ntopng_config['dns_mode']);
+		}
+
+		// Local Networks >
+		switch ($ntopng_config['local_networks']) {
+			case "selected":
+				$nets = array();
+				foreach ($ntopng_config['interface_array'] as $iface) {
+					if (is_ipaddr(get_interface_ip($iface))) {
+						$nets[] = gen_subnet(get_interface_ip($iface),get_interface_subnet($iface)) . '/' . get_interface_subnet($iface);
+					}
+				}
+				if (!empty($nets))
+					$local_networks = "--local-networks " . escapeshellarg(implode(",", $nets));
+				break;
+			case "lanonly":
+				if (is_ipaddr(get_interface_ip('lan'))) {
+					$local_networks = "--local-networks " . escapeshellarg(gen_subnet(get_interface_ip('lan'),get_interface_subnet('lan')) . '/' . get_interface_subnet('lan'));
+				}
+				break;
+			case "rfc1918":
+			default:
+				$local_networks = "--local-networks '192.168.0.0/16,172.16.0.0/12,10.0.0.0/8'";
+				break;
+		}
+
+		$pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
+		if ($pf_version >= 2.2) {
+			$redis_path = "/usr/pbi/ntopng-" . php_uname("m") . "/local/bin";
+		} else {
+			$redis_path = "/usr/pbi/ntopng-" . php_uname("m") . "/bin";
+		}
+
+		$start = "ldconfig -m /usr/pbi/ntopng-i386/lib\n";
+		$start .= "\t{$redis_path}/redis-server &\n";
+		// TODO:
+		//  Add support for --data-dir /somewhere, --httpdocs-dir /somewhereelse,
+		//  --dump-timeline (on/off) --http-port, --https-port
+
+		$start .= "\t/usr/local/bin/ntopng -s -e {$ifaces} {$dns_mode} {$aggregations} {$local_networks} &";
+		write_rcfile(array(
+					"file" => "ntopng.sh",
+					"start" => $start,
+					"stop" => "/usr/bin/killall ntopng redis-cli redis-server"
+				)
+		);
+		if (is_service_running("ntopng")) {
+			stop_service("ntopng");
+			// Wait for ntopng to shut down cleanly.
+			sleep(20);
+		}
+		start_service("ntopng");
+		sleep(2);
+
+		if (empty($ntopng_config['password']))
+			$ntopng_config['password'] = "admin";
+		$password = md5($ntopng_config['password']);
+		mwexec_bg("{$redis_path}/redis-cli SET user.admin.password " . escapeshellarg($password));
+		conf_mount_ro();
+		config_unlock();
+	}
+	]]>
+	</custom_php_global_functions>
+	<custom_add_php_command>
+		sync_package_ntopng();
+	</custom_add_php_command>
+	<custom_php_resync_config_command>
+		sync_package_ntopng();
+	</custom_php_resync_config_command>
+	<custom_php_install_command>
+	<![CDATA[
+		mwexec_bg("/usr/pbi/ntopng-" . php_uname("m") . "/bin/geoipupdate.sh");
+		sync_package_ntopng();
+	]]>
+	</custom_php_install_command>
+	<custom_php_deinstall_command>
+		exec("rm /usr/local/etc/rc.d/ntopng*");
+	</custom_php_deinstall_command>
+	<custom_php_validation_command>
+	<![CDATA[
+	if ($_POST) {
+		if (empty($_POST['password']) || empty($_POST['passwordagain']))
+			$input_errors[] = "You must provide (and confirm) ntopng's password.";
+		if ($_POST['password'] != $_POST['passwordagain'])
+			$input_errors[] = "The provided passwords did not match.";
+	}
+	]]>
+	</custom_php_validation_command>
+</packagegui>
\ No newline at end of file
diff --git a/config/openbgpd/openbgpd.inc b/config/openbgpd/openbgpd.inc
index 76aeb54f..907f6b8c 100644
--- a/config/openbgpd/openbgpd.inc
+++ b/config/openbgpd/openbgpd.inc
@@ -129,10 +129,13 @@ function openbgpd_install_conf() {
 									$conffile .= "\t\t{$row['parameters']} {$row['parmvalue']} \n";
 								}
 							}
-							if ($setlocaladdr == true && !empty($openbgpd_conf['listenip']))
-								$conffile .= "\t\tlocal-address {$openbgpd_conf['listenip']}\n";
-							else
-								$conffile .= "\t\tlocal-address 0.0.0.0\n";
+							if ($setlocaladdr == true) {
+								if (!empty($openbgpd_conf['listenip'])) {
+									$conffile .= "\t\tlocal-address {$openbgpd_conf['listenip']}\n";
+								} else {
+									$conffile .= "\t\tlocal-address 0.0.0.0\n";
+								}
+							}
 								
 							$conffile .= "}\n";
 						}
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index 47274e77..e442755a 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -49,30 +49,28 @@ global $rebuild_rules, $pfSense_snort_version;
 // Grab the Snort binary version programmatically, but if that fails use a safe default
 $snortver = array();
 exec("/usr/local/bin/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver);
-$snort_version = $snortver[0];
-if (empty($snort_version))
-	$snort_version = "2.9.6.0";
 
 /* Used to indicate latest version of this include file has been loaded */
-$pfSense_snort_version = "3.0.13";
+$pfSense_snort_version = "3.1.2";
 
 /* get installed package version for display */
 $snort_package_version = "Snort {$config['installedpackages']['package'][get_pkg_id("snort")]['version']}";
 
 // Define SNORTDIR and SNORTLIBDIR constants according to pfSense version
 $pfs_version=substr(trim(file_get_contents("/etc/version")),0,3);
-if ($pfs_version > 2.0) {
-	define("SNORTDIR", "/usr/pbi/snort-" . php_uname("m") . "/etc/snort");
-	define("SNORTLIBDIR", "/usr/pbi/snort-" . php_uname("m") . "/lib/snort");
-}
-else {
+if ($pfs_version < 2.1) {
 	define("SNORTDIR", "/usr/local/etc/snort");
 	define("SNORTLIBDIR", "/usr/local/lib/snort");
 }
+else {
+	define("SNORTDIR", "/usr/pbi/snort-" . php_uname("m") . "/etc/snort");
+	define("SNORTLIBDIR", "/usr/pbi/snort-" . php_uname("m") . "/lib/snort");
+}
 
 /* Define some useful constants for Snort */
 /* Be sure to include trailing slash on the URL defines */
 define("SNORTLOGDIR", "/var/log/snort");
+define("SNORT_BIN_VERSION", "2.9.6.2");
 define("ET_DNLD_FILENAME", "emerging.rules.tar.gz");
 define("ETPRO_DNLD_FILENAME", "etpro.rules.tar.gz");
 define("GPLV2_DNLD_FILENAME", "community-rules.tar.gz");
@@ -335,9 +333,11 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
 			$home_net = explode(" ", trim(filter_expand_alias($list['address'])));
 	}
 
-	/* Always add loopback to HOME_NET and whitelist (ftphelper) */
+	/* Always add loopback addresses to HOME_NET and whitelist */
 	if (!in_array("127.0.0.1", $home_net))
 		$home_net[] = "127.0.0.1";
+	if (!in_array("::1", $home_net))
+		$home_net[] = "::1";
 
 	/********************************************************************/
 	/* Always put the interface running Snort in HOME_NET and whitelist */
@@ -365,27 +365,37 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
 		}
 	}
 
-	/* Handle IPv6 if available (2.1 and higher) */
-	if (function_exists('get_interface_ipv6')) {
-		$snortip = get_interface_ipv6($snortcfg['interface']);
-		if (!$whitelist || $localnet == 'yes' || empty($localnet)) {
-			if (is_ipaddrv6($snortip)) {
-				if ($snortcfg['interface'] <> "wan") {
-					$sn = get_interface_subnetv6($snortcfg['interface']);
-					$ip = gen_subnetv6($snortip, $sn). "/{$sn}";
-					if (!in_array($ip, $home_net))
-						$home_net[] = $ip;
-				}
+	$snortip = get_interface_ipv6($snortcfg['interface']);
+	if (!$whitelist || $localnet == 'yes' || empty($localnet)) {
+		if (is_ipaddrv6($snortip)) {
+			if ($snortcfg['interface'] <> "wan") {
+				$sn = get_interface_subnetv6($snortcfg['interface']);
+				$ip = gen_subnetv6($snortip, $sn). "/{$sn}";
+				if (!in_array($ip, $home_net))
+					$home_net[] = $ip;
 			}
 		}
-		else {
-			if (is_ipaddrv6($snortip)) {
-				if (!in_array($snortip, $home_net))
-					$home_net[] = $snortip;
-			}
+	}
+	else {
+		if (is_ipaddrv6($snortip)) {
+			// Trim off the interface designation (e.g., %em1) if present
+			if (strpos($snortip, "%") !== FALSE)
+				$snortip = substr($snortip, 0, strpos($snortip, "%"));
+			if (!in_array($snortip, $home_net))
+				$home_net[] = $snortip;
 		}
 	}
 
+	// Add link-local address
+	$snortip = get_interface_linklocal($snortcfg['interface']);
+	if (!empty($snortip)) {
+		// Trim off the interface designation (e.g., %em1) if present
+		if (strpos($snortip, "%") !== FALSE)
+			$snortip = substr($snortip, 0, strpos($snortip, "%"));
+		if (!in_array($snortip, $home_net))
+			$home_net[] = $snortip;
+	}
+
 	if (!$whitelist || $localnet == 'yes' || empty($localnet)) {		
 		/*************************************************************************/
 		/*  Iterate through the interface list and write out whitelist items and */
@@ -404,16 +414,23 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
 				if (!in_array($ip, $home_net))
 					$home_net[] = $ip;
 			}
-			if (function_exists("get_interface_ipv6")) {
-				if ($int == "wan")
-					continue;
-				$subnet = get_interface_ipv6($int);
-				if (is_ipaddrv6($subnet)) {
-					$sn = get_interface_subnetv6($int);
-					$ip = gen_subnetv6($subnet, $sn). "/{$sn}";
-					if (!in_array($ip, $home_net))
-						$home_net[] = $ip;
-				}
+
+			$subnet = get_interface_ipv6($int);
+			if (is_ipaddrv6($subnet)) {
+				$sn = get_interface_subnetv6($int);
+				$ip = gen_subnetv6($subnet, $sn). "/{$sn}";
+				if (!in_array($ip, $home_net))
+					$home_net[] = $ip;
+			}
+
+			// Add link-local address
+			$snortip = get_interface_linklocal($int);
+			if (!empty($snortip)) {
+				// Trim off the interface designation (e.g., %em1) if present
+				if (strpos($snortip, "%") !== FALSE)
+					$snortip = substr($snortip, 0, strpos($snortip, "%"));
+				if (!in_array($snortip, $home_net))
+					$home_net[] = $snortip;
 			}
 		}
 	}
@@ -424,12 +441,23 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
 			if (!in_array($ip, $home_net))
 				$home_net[] = $ip;
 		}
-		if (function_exists("get_interface_ipv6")) {
-			$ip = get_interface_ipv6("wan");
-			if (is_ipaddrv6($ip)) {
-				if (!in_array($ip, $home_net))
-					$home_net[] = $ip;
-			}
+		$ip = get_interface_ipv6("wan");
+		if (is_ipaddrv6($ip)) {
+			// Trim off the interface designation (e.g., %em1) if present
+			if (strpos($ip, "%") !== FALSE)
+				$ip = substr($ip, 0, strpos($ip, "%"));
+			if (!in_array($ip, $home_net))
+				$home_net[] = $ip;
+		}
+
+		// Add link-local address
+		$snortip = get_interface_linklocal("wan");
+		if (!empty($snortip)) {
+			// Trim off the interface designation (e.g., %em1) if present
+			if (strpos($snortip, "%") !== FALSE)
+				$snortip = substr($snortip, 0, strpos($snortip, "%"));
+			if (!in_array($snortip, $home_net))
+				$home_net[] = $snortip;
 		}
 	}
 
@@ -443,11 +471,12 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
 		$gw = get_interface_gateway($snortcfg['interface']);
 		if (is_ipaddr($gw) && !in_array($gw, $home_net))
 			$home_net[] = $gw;
-		if (function_exists("get_interface_gateway_v6")) {
-			$gw = get_interface_gateway_v6($snortcfg['interface']);
-			if (is_ipaddrv6($gw) && !in_array($gw, $home_net))
-				$home_net[] = $gw;
-		}
+		$gw = get_interface_gateway_v6($snortcfg['interface']);
+		// Trim off the interface designation (e.g., %em1) if present
+		if (strpos($gw, "%") !== FALSE)
+			$gw = substr($gw, 0, strpos($gw, "%"));
+		if (is_ipaddrv6($gw) && !in_array($gw, $home_net))
+			$home_net[] = $gw;
 	}
 
 	if ($wandns == 'yes') {
@@ -761,7 +790,7 @@ function snort_rm_blocked_install_cron($should_install) {
 	// Now either install the new or updated cron job, 
 	// or return if "rm_blocked" is disabled
 	if ($should_install) {
-		$command = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t $snort_rm_blocked_expire snort2c";
+		$command = "/usr/bin/nice -n20 /sbin/pfctl -q -t snort2c -T expire {$snort_rm_blocked_expire}";
 		install_cron_job($command, $should_install, $snort_rm_blocked_min, $snort_rm_blocked_hr, $snort_rm_blocked_mday, $snort_rm_blocked_month, $snort_rm_blocked_wday, "root");
 	}
 }
@@ -770,6 +799,13 @@ function snort_rm_blocked_install_cron($should_install) {
 function snort_rules_up_install_cron($should_install) {
 	global $config, $g;
 
+	// Remove any existing job first
+	install_cron_job("snort_check_for_rule_updates.php", false);
+
+	// If called with FALSE as argument, then we're done
+	if ($should_install == FALSE)
+		return;
+
 	$snort_rules_up_info_ck = $config['installedpackages']['snortglobal']['autorulesupdate7'];
 
 	/* See if a customized start time has been set for rule file updates */
@@ -833,7 +869,7 @@ function snort_rules_up_install_cron($should_install) {
 		$snort_rules_up_wday = "*";
 	}
 
-	$command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/snort/snort_check_for_rule_updates.php";
+	$command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php";
 	install_cron_job($command, $should_install, $snort_rules_up_min, $snort_rules_up_hr, $snort_rules_up_mday, $snort_rules_up_month, $snort_rules_up_wday, "root");
 }
 
@@ -849,7 +885,7 @@ function sync_snort_package_config() {
 
 	/* do not start config build if rules is empty or there are no Snort settings */
 	if (!is_array($config['installedpackages']['snortglobal']) || !is_array($config['installedpackages']['snortglobal']['rule'])) {
-		@unlink("{$rcdir}/snort.sh");
+		@unlink("{$rcdir}snort.sh");
 		conf_mount_ro();
 		return;
 	}
@@ -1936,11 +1972,8 @@ esac
 EOD;
 
 	/* write out snort.sh */
-	if (!@file_put_contents("{$rcdir}/snort.sh", $snort_sh_text)) {
-		log_error("Could not open {$rcdir}/snort.sh for writing.");
-		return;
-	}
-	@chmod("{$rcdir}/snort.sh", 0755);
+	@file_put_contents("{$rcdir}snort.sh", $snort_sh_text);
+	@chmod("{$rcdir}snort.sh", 0755);
 }
 
 function snort_generate_barnyard2_conf($snortcfg, $if_real) {
@@ -2152,7 +2185,7 @@ function snort_deinstall() {
 		log_error(gettext("[Snort] Package deletion requested... removing all files..."));
 		mwexec("/bin/rm -rf {$snortdir}");
 		mwexec("/bin/rm -rf {$snortlibdir}/dynamicrules");
-		mwexec("/bin/rm -f {$rcdir}/snort.sh");
+		mwexec("/bin/rm -f {$rcdir}snort.sh");
 		mwexec("/bin/rm -rf /usr/local/pkg/snort");
 		mwexec("/bin/rm -rf /usr/local/www/snort");
 		mwexec("/bin/rm -rf /usr/local/etc/snort");
@@ -2515,1283 +2548,44 @@ function snort_filter_preproc_rules($snortcfg, &$active_rules, $persist_log = fa
 
 function snort_generate_conf($snortcfg) {
 
+	/********************************************************/
+	/* This function generates the snort.conf file for the  */
+	/* passed interface using stored values from the Snort  */
+	/* package configuration.                               */
+	/********************************************************/
+
 	global $config, $g, $rebuild_rules;
 
+	// Exit if there are no configured Snort interfaces
+	if (!is_array($config['installedpackages']['snortglobal']['rule']))
+		return;
+
 	$snortdir = SNORTDIR;
 	$snortlibdir = SNORTLIBDIR;
 	$snortlogdir = SNORTLOGDIR;
 	$flowbit_rules_file = FLOWBITS_FILENAME;
 	$snort_enforcing_rules_file = ENFORCING_RULES_FILENAME;
 
-	if (!is_array($config['installedpackages']['snortglobal']['rule']))
-		return;
-
-	conf_mount_rw();
-
-	/* See if we should protect and not modify the preprocessor rules files */
-	if (!empty($snortcfg['protect_preproc_rules'])) 	
-		$protect_preproc_rules = $snortcfg['protect_preproc_rules'];
-	else
-		$protect_preproc_rules = "off";
-
 	$if_real = get_real_interface($snortcfg['interface']);
 	$snort_uuid = $snortcfg['uuid'];
 	$snortcfgdir = "{$snortdir}/snort_{$snort_uuid}_{$if_real}";
 
-	/* custom home nets */
-	$home_net_list = snort_build_list($snortcfg, $snortcfg['homelistname']);
-	$home_net = implode(",", $home_net_list);
-
-	$external_net = '!$HOME_NET';
-	if (!empty($snortcfg['externallistname']) && $snortcfg['externallistname'] != 'default') {
-		$external_net_list = snort_build_list($snortcfg, $snortcfg['externallistname']);
-		$external_net = implode(",", $external_net_list);
-	}
-
-	/* user added arguments */
-	$snort_config_pass_thru = str_replace("\r", "", base64_decode($snortcfg['configpassthru']));
-	// Remove the trailing newline
-	$snort_config_pass_thru = rtrim($snort_config_pass_thru);
-
-	/* create a few directories and ensure the sample files are in place */
-	$snort_dirs = array( $snortdir, $snortcfgdir, "{$snortcfgdir}/rules",
-		"{$snortlogdir}/snort_{$if_real}{$snort_uuid}",
-		"{$snortlogdir}/snort_{$if_real}{$snort_uuid}/barnyard2", 
-		"{$snortcfgdir}/preproc_rules", 
-		"dynamicrules" => "{$snortlibdir}/dynamicrules",
-		"dynamicengine" => "{$snortlibdir}/dynamicengine",
-		"dynamicpreprocessor" => "{$snortcfgdir}/dynamicpreprocessor"
-	    );
-	foreach ($snort_dirs as $dir) {
-		if (!is_dir($dir))
-			safe_mkdir($dir);
-	}
-
-	/********************************************************************/
-	/* For fail-safe on an initial startup following installation, and  */
-	/* before a rules update has occurred, copy the default config      */
-	/* files to the interface directory.  If files already exist in     */
-	/* the interface directory, or they are newer, that means a rule    */
-	/* update has been done and we should leave the customized files    */
-	/* put in place by the rules update process.                        */
-	/********************************************************************/
-	$snort_files = array("gen-msg.map", "classification.config", "reference.config", "attribute_table.dtd", 
-			"sid-msg.map", "unicode.map", "threshold.conf", "preproc_rules/preprocessor.rules",
-			"preproc_rules/decoder.rules", "preproc_rules/sensitive-data.rules"
-		);
-	foreach ($snort_files as $file) {
-		if (file_exists("{$snortdir}/{$file}")) {
-			$ftime = filemtime("{$snortdir}/{$file}");
-			if (!file_exists("{$snortcfgdir}/{$file}") || ($ftime > filemtime("{$snortcfgdir}/{$file}")))
-				@copy("{$snortdir}/{$file}", "{$snortcfgdir}/{$file}");
-		}
-	}
-
-	/* define alertsystemlog */
-	$alertsystemlog_type = "";
-	if ($snortcfg['alertsystemlog'] == "on")
-		$alertsystemlog_type = "output alert_syslog: log_alert";
-
-	/* define snortunifiedlog */
-	$snortunifiedlog_type = "";
-	if ($snortcfg['barnyard_enable'] == "on") {
-		if (isset($snortcfg['unified2_log_limit']))
-			$u2_log_limit = "limit {$snortcfg['unified2_log_limit']}";
-		else
-			$u2_log_limit = "limit 128";
-
-		$snortunifiedlog_type = "output unified2: filename snort_{$snort_uuid}_{$if_real}.u2, {$u2_log_limit}";
-		if ($snortcfg['barnyard_log_vlan_events'] == 'on')
-			$snortunifiedlog_type .= ", vlan_event_types";
-		if ($snortcfg['barnyard_log_mpls_events'] == 'on')
-			$snortunifiedlog_type .= ", mpls_event_types";
-	}
-
-	/* define spoink */
-	$spoink_type = "";
-	if ($snortcfg['blockoffenders7'] == "on") {
-		$pfkill = "";
-		if ($snortcfg['blockoffenderskill'] == "on")
-			$pfkill = "kill";
-		$spoink_wlist = snort_build_list($snortcfg, $snortcfg['whitelistname'], true);
-		/* write Pass List */
-		@file_put_contents("{$snortcfgdir}/{$snortcfg['whitelistname']}", implode("\n", $spoink_wlist));
-		$spoink_type = "output alert_pf: {$snortcfgdir}/{$snortcfg['whitelistname']},snort2c,{$snortcfg['blockoffendersip']},{$pfkill}";
-	}
-
-	/* define selected suppress file */
-	$suppress_file_name = "";
-	$suppress = snort_find_list($snortcfg['suppresslistname'], 'suppress');
-	if (!empty($suppress)) {
-		$suppress_data = str_replace("\r", "", base64_decode($suppress['suppresspassthru']));
-		@file_put_contents("{$snortcfgdir}/supp{$snortcfg['suppresslistname']}", $suppress_data);
-		$suppress_file_name = "include {$snortcfgdir}/supp{$snortcfg['suppresslistname']}";
-	}
-
-	/* set the snort performance model */
-	$snort_performance = "ac-bnfa";
-	if(!empty($snortcfg['performance']))
-		$snort_performance = $snortcfg['performance'];
-
-	/* if user has defined a custom ssh port, use it */
-	if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port']))
-		$ssh_port = $config['system']['ssh']['port'];
-	else
-		$ssh_port = "22";
-
-	/* Define an array of default values for the various preprocessor ports */
-	$snort_ports = array(
-		"dns_ports" => "53", "smtp_ports" => "25", "mail_ports" => "25,465,587,691",
-		"http_ports" => "36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712", 
-		"oracle_ports" => "1024:", "mssql_ports" => "1433", "telnet_ports" => "23", 
-		"snmp_ports" => "161", "ftp_ports" => "21,2100,3535", "ssh_ports" => $ssh_port, 
-		"pop2_ports" => "109", "pop3_ports" => "110", "imap_ports" => "143", 
-		"sip_ports" => "5060,5061,5600", "auth_ports" => "113", "finger_ports" => "79", 
-		"irc_ports" => "6665,6666,6667,6668,6669,7000", "smb_ports" => "139,445",
-		"nntp_ports" => "119", "rlogin_ports" => "513", "rsh_ports" => "514",
-		"ssl_ports" => "443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920",
-		"file_data_ports" => "\$HTTP_PORTS,110,143", "shellcode_ports" => "!80", 
-		"sun_rpc_ports" => "111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779",
-		"DCERPC_NCACN_IP_TCP" => "139,445", "DCERPC_NCADG_IP_UDP" => "138,1024:",
-		"DCERPC_NCACN_IP_LONG" => "135,139,445,593,1024:", "DCERPC_NCACN_UDP_LONG" => "135,1024:",
-		"DCERPC_NCACN_UDP_SHORT" => "135,593,1024:", "DCERPC_NCACN_TCP" => "2103,2105,2107",
-		"DCERPC_BRIGHTSTORE" => "6503,6504", "DNP3_PORTS" => "20000", "MODBUS_PORTS" => "502",
-		"GTP_PORTS" => "2123,2152,3386"
-	);
-
-	/* Check for defined Aliases that may override default port settings as we build the portvars array */
-	$portvardef = "";
-	foreach ($snort_ports as $alias => $avalue) {
-		if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"]))
-			$snort_ports[$alias] = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
-		$snort_ports[$alias] = preg_replace('/\s+/', ',', trim($snort_ports[$alias]));
-		$portvardef .= "portvar " . strtoupper($alias) . " [" . $snort_ports[$alias] . "]\n";
-	}
-
-	/* Define the default ports for the Stream5 preprocessor (formatted for easier reading in the snort.conf file) */
-	$stream5_ports_client = "21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 \\\n";
-	$stream5_ports_client .= "\t             139 143 161 445 513 514 587 593 691 1433 1521 1741 \\\n";
-	$stream5_ports_client .= "\t             2100 3306 6070 6665 6666 6667 6668 6669 7000 8181 \\\n";
-	$stream5_ports_client .= "\t             32770 32771 32772 32773 32774 32775 32776 32777 \\\n";
-	$stream5_ports_client .= "\t             32778 32779";
-        $stream5_ports_both = "80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563 \\\n";
-	$stream5_ports_both .= "\t           591 593 631 636 901 989 992 993 994 995 1220 1414 1533 \\\n";
-	$stream5_ports_both .= "\t           1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 \\\n";
-	$stream5_ports_both .= "\t           5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777 \\\n";
-	$stream5_ports_both .= "\t           7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 \\\n";
-	$stream5_ports_both .= "\t           7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 \\\n";
-	$stream5_ports_both .= "\t           8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 \\\n";
-	$stream5_ports_both .= "\t           8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000 \\\n";
-	$stream5_ports_both .= "\t           9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 \\\n";
-	$stream5_ports_both .= "\t           33300 34412 34443 34444 41080 44440 50000 50002 51423 \\\n";
-	$stream5_ports_both .= "\t           55555 56712";
-
-	/////////////////////////////
-	/* preprocessor code */
-	/* def perform_stat */
-	$perform_stat = <<<EOD
-# Performance Statistics #
-preprocessor perfmonitor: time 300 file {$snortlogdir}/snort_{$if_real}{$snort_uuid}/{$if_real}.stats pktcnt 10000
-	
-EOD;
-
-	/* def ftp_preprocessor */
-	$telnet_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['telnet_ports']));
-	$ftp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ftp_ports']));
-
-	// Configure FTP_Telnet global options
-	$ftp_telnet_globals = "inspection_type ";
-	if ($snortcfg['ftp_telnet_inspection_type'] != "") { $ftp_telnet_globals .= $snortcfg['ftp_telnet_inspection_type']; }else{ $ftp_telnet_globals .= "stateful"; }
-	if ($snortcfg['ftp_telnet_alert_encrypted'] == "on")
-		$ftp_telnet_globals .= " \\\n\tencrypted_traffic yes";
-	else
-		$ftp_telnet_globals .= " \\\n\tencrypted_traffic no";
-	if ($snortcfg['ftp_telnet_check_encrypted'] == "on")
-		$ftp_telnet_globals .= " \\\n\tcheck_encrypted";
-
-	// Configure FTP_Telnet Telnet protocol options
-	$ftp_telnet_protocol = "ports { {$telnet_ports} }";
-	if ($snortcfg['ftp_telnet_normalize'] == "on")
-		$ftp_telnet_protocol .= " \\\n\tnormalize";
-	if ($snortcfg['ftp_telnet_detect_anomalies'] == "on")
-		$ftp_telnet_protocol .= " \\\n\tdetect_anomalies";
-	if ($snortcfg['ftp_telnet_ayt_attack_threshold'] <> '0') {
-		$ftp_telnet_protocol .= " \\\n\tayt_attack_thresh "; 
-		if ($snortcfg['ftp_telnet_ayt_attack_threshold'] != "")
-			$ftp_telnet_protocol .= $snortcfg['ftp_telnet_ayt_attack_threshold'];
-		else
-			$ftp_telnet_protocol .= "20";
-	}
-
-	// Setup the standard FTP commands used for all FTP Server engines
-	$ftp_cmds = <<<EOD
-	ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
-	ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
-	ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
-	ftp_cmds { LPSV MACB MAIL MDTM MFMT MIC MKD MLSD MLST } \
-	ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
-	ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
-	ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
-	ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
-	ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
-	ftp_cmds { XSEN XSHA1 XSHA256 } \
-	alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
-	alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
-	alt_max_param_len 256 { CWD RNTO } \
-	alt_max_param_len 400 { PORT } \
-	alt_max_param_len 512 { MFMT SIZE } \
-	chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
-	chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
-	chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
-	chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
-	chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
-	chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
-	chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ 
-	chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
-	cmd_validity ALLO < int [ char R int ] > \    
-	cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
-	cmd_validity MACB < string > \
-	cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
-	cmd_validity MODE < char ASBCZ > \
-	cmd_validity PORT < host_port > \
-	cmd_validity PROT < char CSEP > \
-	cmd_validity STRU < char FRPO [ string ] > \    
-	cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
-
-EOD;
-
-	// Configure all the FTP_Telnet FTP protocol options
-	// Iterate and configure the FTP Client engines
-	$ftp_default_client_engine = array( "name" => "default", "bind_to" => "all", "max_resp_len" => 256, 
-					    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
-					    "bounce" => "yes", "bounce_to_net" => "", "bounce_to_port" => "" );
-
-	if (!is_array($snortcfg['ftp_client_engine']['item']))
-		$snortcfg['ftp_client_engine']['item'] = array();
-
-	// If no FTP client engine is configured, use the default
-	// to keep from breaking Snort.
-	if (empty($snortcfg['ftp_client_engine']['item']))
-			$snortcfg['ftp_client_engine']['item'][] = $ftp_default_client_engine;
-	$ftp_client_engine = "";
-
-	foreach ($snortcfg['ftp_client_engine']['item'] as $f => $v) {
-		$buffer = "preprocessor ftp_telnet_protocol: ftp client ";
-		if ($v['name'] == "default" && $v['bind_to'] == "all")
-			$buffer .= "default \\\n";
-		elseif (is_alias($v['bind_to'])) {
-			$tmp = trim(filter_expand_alias($v['bind_to']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$buffer .= "{$tmp} \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
-				continue;
-			}
-		}
-		else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
-				continue;
-		}
-
-		if ($v['max_resp_len'] == "")
-			$buffer .= "\tmax_resp_len 256 \\\n";
-		else
-			$buffer .= "\tmax_resp_len {$v['max_resp_len']} \\\n";
-
-		$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
-		$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
-
-		if ($v['bounce'] == "yes") {
-			if (is_alias($v['bounce_to_net']) && is_alias($v['bounce_to_port'])) {
-				$net = trim(filter_expand_alias($v['bounce_to_net']));
-				$port = trim(filter_expand_alias($v['bounce_to_port']));
-				if (!empty($net) && !empty($port) && 
-				     snort_is_single_addr_alias($v['bounce_to_net']) && 
-				    (is_port($port) || is_portrange($port))) {
-					$port = preg_replace('/\s+/', ',', $port);
-					// Change port range delimiter to comma for ftp_telnet client preprocessor
-					if (is_portrange($port))
-						$port = str_replace(":", ",", $port);
-					$buffer .= "\tbounce yes \\\n";
-					$buffer .= "\tbounce_to { {$net},{$port} }\n";
-				}
-				else {
-					// One or both of the BOUNCE_TO alias values is not right,
-					// so figure out which and log an appropriate error.
-					if (empty($net) || !snort_is_single_addr_alias($v['bounce_to_net']))
-						log_error("[snort] ERROR: illegal value for bounce_to Address Alias [{$v['bounce_to_net']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
-					if (empty($port) || !(is_port($port) || is_portrange($port)))
-						log_error("[snort] ERROR: illegal value for bounce_to Port Alias [{$v['bounce_to_port']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
-					$buffer .= "\tbounce yes\n";
-				}
-			}
-			else
-				$buffer .= "\tbounce yes\n";
-		}
-		else
-			$buffer .= "\tbounce no\n";
-
-		// Add this FTP client engine to the master string
-		$ftp_client_engine .= "{$buffer}\n";
-	}
-	// Trim final trailing newline
-	rtrim($ftp_client_engine);	
-
-	// Iterate and configure the FTP Server engines
-	$ftp_default_server_engine = array( "name" => "default", "bind_to" => "all", "ports" => "default", 
-					    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
-					    "ignore_data_chan" => "no", "def_max_param_len" => 100 );
-
-	if (!is_array($snortcfg['ftp_server_engine']['item']))
-		$snortcfg['ftp_server_engine']['item'] = array();
-
-	// If no FTP server engine is configured, use the default
-	// to keep from breaking Snort.
-	if (empty($snortcfg['ftp_server_engine']['item']))
-			$snortcfg['ftp_server_engine']['item'][] = $ftp_default_server_engine;
-	$ftp_server_engine = "";
-
-	foreach ($snortcfg['ftp_server_engine']['item'] as $f => $v) {
-		$buffer = "preprocessor ftp_telnet_protocol: ftp server ";
-		if ($v['name'] == "default" && $v['bind_to'] == "all")
-			$buffer .= "default \\\n";
-		elseif (is_alias($v['bind_to'])) {
-			$tmp = trim(filter_expand_alias($v['bind_to']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$buffer .= "{$tmp} \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
-				continue;
-			}
-		}
-		else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
-				continue;
-		}
-
-		if ($v['def_max_param_len'] == "")
-			$buffer .= "\tdef_max_param_len 100 \\\n";
-		elseif ($v['def_max_param_len'] <> '0')
-			$buffer .= "\tdef_max_param_len {$v['def_max_param_len']} \\\n";
-
-		if ($v['ports'] == "default" || !is_alias($v['ports']) || empty($v['ports']))
-			$buffer .= "\tports { {$ftp_ports} } \\\n";
-		elseif (is_alias($v['ports'])) {
-			$tmp = trim(filter_expand_alias($v['ports']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$tmp = snort_expand_port_range($tmp, ' ');
-				$buffer .= "\tports { {$tmp} } \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve Port Alias '{$v['ports']}' for FTP server '{$v['name']}' ... reverting to defaults.");
-				$buffer .= "\tports { {$ftp_ports} } \\\n";
-			}
-		}
-
-		$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
-		$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
-		if ($v['ignore_data_chan'] == "yes")
-			$buffer .= "\tignore_data_chan yes \\\n";
-		$buffer .= "{$ftp_cmds}\n";
-
-		// Add this FTP server engine to the master string
-		$ftp_server_engine .= $buffer;
-	}
-	// Remove trailing newlines
-	rtrim($ftp_server_engine);
-
-	$ftp_preprocessor = <<<EOD
-# ftp_telnet preprocessor #
-preprocessor ftp_telnet: global \
-	{$ftp_telnet_globals}
-
-preprocessor ftp_telnet_protocol: telnet \
-	{$ftp_telnet_protocol}
-
-{$ftp_server_engine}
-{$ftp_client_engine}
-EOD;
-
-	$pop_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['pop3_ports']));
-	$pop_preproc = <<<EOD
-# POP preprocessor #
-preprocessor pop: \
-	ports { {$pop_ports} } \
-	memcap 1310700 \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0
-
-EOD;
-
-	$imap_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['imap_ports']));
-	$imap_preproc = <<<EOD
-# IMAP preprocessor #
-preprocessor imap: \
-	ports { {$imap_ports} } \
-	memcap 1310700 \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0
-
-EOD;
-
-	$smtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['mail_ports']));
-	/* def smtp_preprocessor */
-	$smtp_preprocessor = <<<EOD
-# SMTP preprocessor #
-preprocessor SMTP: \
-	ports { {$smtp_ports} } \
-	inspection_type stateful \
-	normalize cmds \
-	ignore_tls_data \
-	valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT \
-		     NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX QUEU \
-		     STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE \
-		     XQUEU XSTA XTRN XUSR } \
-	normalize_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY \
-			 IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT \
-			 ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 \
-			 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
-	max_header_line_len 1000 \ 
-	max_response_line_len 512 \
-	alt_max_command_line_len 260 { MAIL } \
-	alt_max_command_line_len 300 { RCPT } \
-	alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
-	alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
-	alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX } \
-	alt_max_command_line_len 246 { QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR } \
-	alt_max_command_line_len 246 { XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
-	xlink2state { enable } \
-	log_mailfrom \
-	log_rcptto \
-	log_email_hdrs \
-	email_hdrs_log_depth 1464 \
-	log_filename \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0 \
-	uu_decode_depth 0
-
-EOD;
-
-	/* def sf_portscan */
-	$sf_pscan_protocol = "all";
-	if (!empty($snortcfg['pscan_protocol']))
-		$sf_pscan_protocol = $snortcfg['pscan_protocol'];
-	$sf_pscan_type = "all";
-	if (!empty($snortcfg['pscan_type']))
-		$sf_pscan_type = $snortcfg['pscan_type'];
-	$sf_pscan_memcap = "10000000";
-	if (!empty($snortcfg['pscan_memcap']))
-		$sf_pscan_memcap = $snortcfg['pscan_memcap'];
-	$sf_pscan_sense_level = "medium";
-	if (!empty($snortcfg['pscan_sense_level']))
-		$sf_pscan_sense_level = $snortcfg['pscan_sense_level'];
-	$sf_pscan_ignore_scanners = "\$HOME_NET";
-	if (!empty($snortcfg['pscan_ignore_scanners']) && is_alias($snortcfg['pscan_ignore_scanners'])) {
-		$sf_pscan_ignore_scanners = trim(filter_expand_alias($snortcfg['pscan_ignore_scanners']));
-		$sf_pscan_ignore_scanners = preg_replace('/\s+/', ',', trim($sf_pscan_ignore_scanners));
-	}
-	
-	$sf_portscan = <<<EOD
-# sf Portscan #
-preprocessor sfportscan: \
-	scan_type { {$sf_pscan_type} } \
-	proto  { {$sf_pscan_protocol} } \
-	memcap { {$sf_pscan_memcap} } \
-	sense_level { {$sf_pscan_sense_level} } \
-	ignore_scanners { {$sf_pscan_ignore_scanners} }
-	
-EOD;
-
-	/* def ssh_preproc */
-	$ssh_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssh_ports']));
-	$ssh_preproc = <<<EOD
-# SSH preprocessor #
-preprocessor ssh: \
-	server_ports { {$ssh_ports} } \
-	autodetect \
-	max_client_bytes 19600 \
-	max_encrypted_packets 20 \
-	max_server_version_len 100 \
-	enable_respoverflow enable_ssh1crc32 \
-	enable_srvoverflow enable_protomismatch
-
-EOD;
-
-	/* def other_preprocs */
-	$sun_rpc_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sun_rpc_ports']));
-	$other_preprocs = <<<EOD
-# Other preprocs #
-preprocessor rpc_decode: \
-	{$sun_rpc_ports} \
-	no_alert_multiple_requests \
-	no_alert_large_fragments \
-	no_alert_incomplete
-
-# Back Orifice preprocessor #
-preprocessor bo
-	
-EOD;
-
-	/* def dce_rpc_2 */
-	$dce_rpc_2 = <<<EOD
-# DCE/RPC 2 #
-preprocessor dcerpc2: \
-	memcap 102400, \
-	events [co]
-
-preprocessor dcerpc2_server: default, \
-	policy WinXP, \
-	detect [smb [{$snort_ports['smb_ports']}], \
-	tcp 135, \
-	udp 135, \
-	rpc-over-http-server 593], \
-	autodetect [tcp 1025:, \
-	udp 1025:, \
-	rpc-over-http-server 1025:], \
-	smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]
-	
-EOD;
-
-	$sip_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sip_ports']));
-	$sip_preproc = <<<EOD
-# SIP preprocessor #
-preprocessor sip: \
-	max_sessions 40000, \
-	ports { {$sip_ports} }, \
-	methods { invite \
-		cancel \
-		ack \
-		bye \
-		register \
-		options \
-		refer \
-		subscribe \
-		update \
-		join \
-		info \
-		message \
-		notify \
-		benotify \
-		do \
-		qauth \
-		sprack \
-		publish \
-		service \
-		unsubscribe \
-		prack }, \
-	max_call_id_len 80, \
-	max_from_len 256, \
-	max_to_len 256, \
-	max_via_len 1024, \
-	max_requestName_len 50, \
-	max_uri_len 512, \
-	ignore_call_channel, \
-	max_content_len 2048, \
-	max_contact_len 512
-
-EOD;
-
-	$dns_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['dns_ports']));
-	/* def dns_preprocessor */
-	$dns_preprocessor = <<<EOD
-# DNS preprocessor #
-preprocessor dns: \
-	ports { {$dns_ports} } \
-	enable_rdata_overflow
-	
-EOD;
-
-	/* def dnp3_preprocessor */
-	$dnp3_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['DNP3_PORTS']));
-	$dnp3_preproc = <<<EOD
-# DNP3 preprocessor #
-preprocessor dnp3: \
-	ports { {$dnp3_ports} } \
-	memcap 262144 \
-	check_crc
-	
-EOD;
-
-	/* def modbus_preprocessor */
-	$modbus_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['MODBUS_PORTS']));
-	$modbus_preproc = <<<EOD
-# Modbus preprocessor #
-preprocessor modbus: \
-	ports { {$modbus_ports} }
-	
-EOD;
+	// Pull in the PHP code that generates required string variables
+	include("/usr/local/pkg/snort/snort_generate_conf.php");
 
-	/* def gtp_preprocessor */
-	$gtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['GTP_PORTS']));
-	$gtp_preproc = <<<EOD
-# GTP preprocessor #
-preprocessor gtp: \
-	ports { {$gtp_ports} }
-	
-EOD;
-
-	/* def ssl_preprocessor */
-	$ssl_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssl_ports']));
-	$ssl_preproc = <<<EOD
-# SSL preprocessor #
-preprocessor ssl: \
-	ports { {$ssl_ports} }, \
-	trustservers, \
-	noinspect_encrypted 
-
-EOD;
-
-	/* def sensitive_data_preprocessor */
-	if ($snortcfg['sdf_mask_output'] == "on")
-		$sdf_mask_output = "\\\n\tmask_output";
-	else
-		$sdf_mask_output = "";
-	if (empty($snortcfg['sdf_alert_threshold']))
-		$snortcfg['sdf_alert_threshold'] = 25;
-	$sensitive_data = <<<EOD
-# SDF preprocessor #
-preprocessor sensitive_data: \
-	alert_threshold {$snortcfg['sdf_alert_threshold']} {$sdf_mask_output}
-
-EOD;
-
-	/* define IP Reputation preprocessor */
-	if (is_array($snortcfg['blist_files']['item'])) {
-		$blist_files = "";
-		$bIsFirst = TRUE;
-		foreach ($snortcfg['blist_files']['item'] as $blist) {
-			if ($bIsFirst) {
-				$blist_files .= "blacklist " . IPREP_PATH . $blist;
-				$bIsFirst = FALSE;
-			}
-			else
-				$blist_files .= ", \\ \n\tblacklist " . IPREP_PATH . $blist;    
-		}
-	}
-	if (is_array($snortcfg['wlist_files']['item'])) {
-		$wlist_files = "";
-		$bIsFirst = TRUE;
-		foreach ($snortcfg['wlist_files']['item'] as $wlist) {
-			if ($bIsFirst) {
-				$wlist_files .= "whitelist " . IPREP_PATH . $wlist;
-				$bIsFirst = FALSE;
-			}
-			else
-				$wlist_files .= ", \\ \n\twhitelist " . IPREP_PATH . $wlist;    
-		}
-	}
-	if (!empty($blist_files))
-		$ip_lists = $blist_files;
-	if (!empty($wlist_files))
-		$ip_lists .= ", \\ \n" . $wlist_files;
-	if ($snortcfg['iprep_scan_local'] == 'on')
-		$ip_lists .= ", \\ \n\tscan_local";	
-
-	$reputation_preproc = <<<EOD
-# IP Reputation preprocessor #
-preprocessor reputation: \
-	memcap {$snortcfg['iprep_memcap']}, \
-	priority {$snortcfg['iprep_priority']}, \
-	nested_ip {$snortcfg['iprep_nested_ip']}, \
-	white {$snortcfg['iprep_white']}, \
-	{$ip_lists}
-
-EOD;
-
-	/* define servers as IP variables */
-	$snort_servers = array (
-		"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
-		"www_servers" => "\$HOME_NET", "sql_servers" => "\$HOME_NET", "telnet_servers" => "\$HOME_NET",
-		"snmp_servers" => "\$HOME_NET", "ftp_servers" => "\$HOME_NET", "ssh_servers" => "\$HOME_NET",
-		"pop_servers" => "\$HOME_NET", "imap_servers" => "\$HOME_NET", "sip_proxy_ip" => "\$HOME_NET",
-		"sip_servers" => "\$HOME_NET", "rpc_servers" => "\$HOME_NET", "dnp3_server" => "\$HOME_NET",
-		"dnp3_client" => "\$HOME_NET", "modbus_server" => "\$HOME_NET", "modbus_client" => "\$HOME_NET",
-		"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET",
-		"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
-	    );
-
-	// Change old name from "var" to new name of "ipvar" for IP variables because 
-	// Snort is deprecating the old "var" name in newer versions.
-	$ipvardef = "";
-	foreach ($snort_servers as $alias => $avalue) {
-		if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"])) {
-			$avalue = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
-			$avalue = preg_replace('/\s+/', ',', trim($avalue));
-		}
-		$ipvardef .= "ipvar " . strtoupper($alias) . " [{$avalue}]\n";
-	}
-
-	$snort_preproc_libs = array(
-		"dce_rpc_2" => "dce2_preproc", "dns_preprocessor" => "dns_preproc", "ftp_preprocessor" => "ftptelnet_preproc", "imap_preproc" => "imap_preproc",
-		"pop_preproc" => "pop_preproc", "reputation_preproc" => "reputation_preproc", "sensitive_data" => "sdf_preproc", 
-		"sip_preproc" => "sip_preproc", "gtp_preproc" => "gtp_preproc", "smtp_preprocessor" => "smtp_preproc", "ssh_preproc" => "ssh_preproc", 
-		"ssl_preproc" => "ssl_preproc", "dnp3_preproc" => "dnp3_preproc", "modbus_preproc" => "modbus_preproc"
-	);
-	$snort_preproc = array (
-		"perform_stat", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor", "ssl_preproc", "sip_preproc", "gtp_preproc", "ssh_preproc", "sf_portscan", 
-		"dce_rpc_2", "dns_preprocessor", "sensitive_data", "pop_preproc", "imap_preproc", "dnp3_preproc", "modbus_preproc", "reputation_preproc"
-	);
-	$default_disabled_preprocs = array(
-		"sf_portscan", "gtp_preproc", "sensitive_data", "dnp3_preproc", "modbus_preproc", "reputation_preproc", "perform_stat" 
-	);
-	$snort_preprocessors = "";
-	foreach ($snort_preproc as $preproc) {
-		if ($snortcfg[$preproc] == 'on' || empty($snortcfg[$preproc]) ) {
+	// Pull in the boilerplate template for the snort.conf
+	// configuration file.  The contents of the template along
+	// with substituted variables is stored in $snort_conf_text
+	// (which is defined in the included file).
+	include("/usr/local/pkg/snort/snort_conf_template.inc");
 
-			/* If preprocessor is not explicitly "on" or "off", then default to "off" if in our default disabled list */
-			if (empty($snortcfg[$preproc]) && in_array($preproc, $default_disabled_preprocs))
-				continue;
-
-			/* NOTE: The $$ is not a bug. It is an advanced feature of php */
-			if (!empty($snort_preproc_libs[$preproc])) {
-				$preproclib = "libsf_" . $snort_preproc_libs[$preproc];
-				if (!file_exists($snort_dirs['dynamicpreprocessor'] . "{$preproclib}.so")) {
-					if (file_exists("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so")) {
-						@copy("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so", "{$snort_dirs['dynamicpreprocessor']}/{$preproclib}.so");
-						$snort_preprocessors .= $$preproc;
-						$snort_preprocessors .= "\n";
-					} else
-						log_error("Could not find the {$preproclib} file. Snort might error out!");
-				} else {
-					$snort_preprocessors .= $$preproc;
-					$snort_preprocessors .= "\n";
-				}
-			} else {
-				$snort_preprocessors .= $$preproc;
-				$snort_preprocessors .= "\n";
-			}
-		}
-	}
-	// Remove final trailing newline
-	$snort_preprocessors = rtrim($snort_preprocessors);
-
-	$snort_misc_include_rules = "";
-	if (file_exists("{$snortcfgdir}/reference.config"))
-		$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
-	if (file_exists("{$snortcfgdir}/classification.config"))
-		$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
-	if (!file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") || !file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules")) {
-		$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-		log_error("[Snort] Seems preprocessor and/or decoder rules are missing, enabling autogeneration of them in conf file.");
-	}
-
-	/* generate rule sections to load */
-	/* The files are always configured so the update process is easier */
-	$selected_rules_sections = "include \$RULE_PATH/{$snort_enforcing_rules_file}\n";
-	$selected_rules_sections .= "include \$RULE_PATH/{$flowbit_rules_file}\n";
-	$selected_rules_sections  .= "include \$RULE_PATH/custom.rules\n";
-
-	// Remove trailing newlines
-	$snort_misc_include_rules = rtrim($snort_misc_include_rules);
-	$selected_rules_sections = rtrim($selected_rules_sections);
+	// Write out snort.conf file using contents of $snort_conf_text
+	@file_put_contents("{$snortcfgdir}/snort.conf", $snort_conf_text);
 
-	/* Create the actual rules files and save in the interface directory */
+	// Create the actual rules files and save them in the interface directory
 	snort_prepare_rule_files($snortcfg, $snortcfgdir);
 
-	$cksumcheck = "all";
-	if ($snortcfg['cksumcheck'] == 'on')
-		$cksumcheck = "none";
-
-	/* Pull in user-configurable detection config options */
-	$cfg_detect_settings = "search-method {$snort_performance} max-pattern-len 20 max_queue_events 5";
-	if ($snortcfg['fpm_split_any_any'] == "on")
-		$cfg_detect_settings .= " split-any-any";
-	if ($snortcfg['fpm_search_optimize'] == "on")
-		$cfg_detect_settings .= " search-optimize";
-	if ($snortcfg['fpm_no_stream_inserts'] == "on")
-		$cfg_detect_settings .= " no_stream_inserts";
-
-	/* Pull in user-configurable options for Frag3 preprocessor settings */
-	/* Get global Frag3 options first and put into a string */
-	$frag3_global = "preprocessor frag3_global: ";
-	if (!empty($snortcfg['frag3_memcap']) || $snortcfg['frag3_memcap'] == "0")
-		$frag3_global .= "memcap {$snortcfg['frag3_memcap']}, ";
-	else
-		$frag3_global .= "memcap 4194304, ";
-	if (!empty($snortcfg['frag3_max_frags']))
-		$frag3_global .= "max_frags {$snortcfg['frag3_max_frags']}";
-	else
-		$frag3_global .= "max_frags 8192";
-	if ($snortcfg['frag3_detection'] == "off")
-		$frag3_global .= ", disabled";
-
-	$frag3_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", 
-					   "timeout" => 60, "min_ttl" => 1, "detect_anomalies" => "on", 
-					   "overlap_limit" => 0, "min_frag_len" => 0 );
-	$frag3_engine = "";
-
-	// Now iterate configured Frag3 engines and write them to a string if enabled
-	if ($snortcfg['frag3_detection'] == "on") {
-		if (!is_array($snortcfg['frag3_engine']['item']))
-			$snortcfg['frag3_engine']['item'] = array();
-
-		// If no frag3 tcp engine is configured, use the default
-		if (empty($snortcfg['frag3_engine']['item']))
-			$snortcfg['frag3_engine']['item'][] = $frag3_default_tcp_engine;
-
-		foreach ($snortcfg['frag3_engine']['item'] as $f => $v) {
-			$frag3_engine .= "preprocessor frag3_engine: ";
-			$frag3_engine .= "policy {$v['policy']}";
-			if ($v['bind_to'] <> "all") {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ',', $tmp);
-					if (strpos($tmp, ",") !== false)
-						$frag3_engine .= " \\\n\tbind_to [{$tmp}]";
-					else
-						$frag3_engine .= " \\\n\tbind_to {$tmp}";
-				}
-				else
-					log_error("[snort] WARNING: unable to resolve IP List Alias '{$v['bind_to']}' for Frag3 engine '{$v['name']}' ... using 0.0.0.0 failsafe.");
-			}
-			$frag3_engine .= " \\\n\ttimeout {$v['timeout']}";
-			$frag3_engine .= " \\\n\tmin_ttl {$v['min_ttl']}";
-			if ($v['detect_anomalies'] == "on") {
-				$frag3_engine .= " \\\n\tdetect_anomalies";
-				$frag3_engine .= " \\\n\toverlap_limit {$v['overlap_limit']}";
-				$frag3_engine .= " \\\n\tmin_fragment_length {$v['min_frag_len']}";
-			}
-			// Add newlines to terminate this engine
-			$frag3_engine .= "\n\n";
-		}
-		// Remove trailing newline
-		$frag3_engine = rtrim($frag3_engine);
-	}
-
-	// Grab any user-customized value for Protocol Aware Flushing (PAF) max PDUs
-	$paf_max_pdu_config = "config paf_max: ";
-	if (empty($snortcfg['max_paf']) || $snortcfg['max_paf'] == '0')
-		$paf_max_pdu_config .= "0";
-	else
-		$paf_max_pdu_config .= $snortcfg['max_paf'];
-
-	// Pull in user-configurable options for Stream5 preprocessor settings
-	// Get global options first and put into a string
-	$stream5_global = "preprocessor stream5_global: \\\n";
-	if ($snortcfg['stream5_reassembly'] == "off")
-		$stream5_global .= "\tdisabled, \\\n";
-	if ($snortcfg['stream5_track_tcp'] == "off")
-		$stream5_global .= "\ttrack_tcp no,";
-	else {
-		$stream5_global .= "\ttrack_tcp yes,";
-		if (!empty($snortcfg['stream5_max_tcp']))
-			$stream5_global .= " \\\n\tmax_tcp {$snortcfg['stream5_max_tcp']},";
-		else
-			$stream5_global .= " \\\n\tmax_tcp 262144,";
-	}
-	if ($snortcfg['stream5_track_udp'] == "off")
-		$stream5_global .= " \\\n\ttrack_udp no,";
-	else {
-		$stream5_global .= " \\\n\ttrack_udp yes,";
-		if (!empty($snortcfg['stream5_max_udp']))
-			$stream5_global .= " \\\n\tmax_udp {$snortcfg['stream5_max_udp']},";
-		else
-			$stream5_global .= " \\\n\tmax_udp 131072,";
-	}
-	if ($snortcfg['stream5_track_icmp'] == "on") {
-		$stream5_global .= " \\\n\ttrack_icmp yes,";
-		if (!empty($snortcfg['stream5_max_icmp']))
-			$stream5_global .= " \\\n\tmax_icmp {$snortcfg['stream5_max_icmp']},";
-		else
-			$stream5_global .= " \\\n\tmax_icmp 65536,";
-	}
-	else
-		$stream5_global .= " \\\n\ttrack_icmp no,";
-	if (!empty($snortcfg['stream5_mem_cap']))
-		$stream5_global .= " \\\n\tmemcap {$snortcfg['stream5_mem_cap']},";
-	else
-		$stream5_global .= " \\\n\tmemcap 8388608,";
-
-	if (!empty($snortcfg['stream5_prune_log_max']) || $snortcfg['stream5_prune_log_max'] == '0')
-		$stream5_global .= " \\\n\tprune_log_max {$snortcfg['stream5_prune_log_max']}";
-	else
-		$stream5_global .= " \\\n\tprune_log_max 1048576";
-	if ($snortcfg['stream5_flush_on_alert'] == "on")
-		$stream5_global .= ", \\\n\tflush_on_alert";
-
-	$stream5_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", "timeout" => 30, 
-					     "max_queued_bytes" => 1048576, "detect_anomalies" => "off", "overlap_limit" => 0, 
-					     "max_queued_segs" => 2621, "require_3whs" => "off", "startup_3whs_timeout" => 0, 
-					     "no_reassemble_async" => "off", "dont_store_lg_pkts" => "off", "max_window" => 0, 
-					     "use_static_footprint_sizes" => "off", "check_session_hijacking" => "off", "ports_client" => "default", 
-					     "ports_both" => "default", "ports_server" => "none" );
-	$stream5_tcp_engine = "";
-
-	// Now iterate configured Stream5 TCP engines and write them to a string if enabled
-	if ($snortcfg['stream5_reassembly'] == "on") {
-		if (!is_array($snortcfg['stream5_tcp_engine']['item']))
-			$snortcfg['stream5_tcp_engine']['item'] = array();
-
-		// If no stream5 tcp engine is configured, use the default
-		if (empty($snortcfg['stream5_tcp_engine']['item']))
-			$snortcfg['stream5_tcp_engine']['item'][] = $stream5_default_tcp_engine;
-
-		foreach ($snortcfg['stream5_tcp_engine']['item'] as $f => $v) {
-			$buffer = "preprocessor stream5_tcp: ";
-			$buffer .= "policy {$v['policy']},";
-			if ($v['bind_to'] <> "all") {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ',', $tmp);
-					if (strpos($tmp, ",") !== false)
-						$buffer .= " \\\n\tbind_to [{$tmp}],";
-					else
-						$buffer .= " \\\n\tbind_to {$tmp},";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for Stream5 TCP engine '{$v['name']}' ... skipping this engine.");
-					continue;
-				}
-			}
-			$stream5_tcp_engine .= $buffer;
-			$stream5_tcp_engine .= " \\\n\ttimeout {$v['timeout']},";
-			$stream5_tcp_engine .= " \\\n\toverlap_limit {$v['overlap_limit']},";
-			$stream5_tcp_engine .= " \\\n\tmax_window {$v['max_window']},";
-			$stream5_tcp_engine .= " \\\n\tmax_queued_bytes {$v['max_queued_bytes']},";
-			$stream5_tcp_engine .= " \\\n\tmax_queued_segs {$v['max_queued_segs']}";
-			if ($v['use_static_footprint_sizes'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tuse_static_footprint_sizes";
-			if ($v['check_session_hijacking'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tcheck_session_hijacking";
-			if ($v['dont_store_lg_pkts'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdont_store_large_packets";
-			if ($v['no_reassemble_async'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdont_reassemble_async";
-			if ($v['detect_anomalies'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdetect_anomalies";
-			if ($v['require_3whs'] == "on")
-				$stream5_tcp_engine .= ", \\\n\trequire_3whs {$v['startup_3whs_timeout']}";
-			if (!empty($v['ports_client'])) {
-				$stream5_tcp_engine .= ", \\\n\tports client";
-				if ($v['ports_client'] == " all")
-					$stream5_tcp_engine .= " all";
-				elseif ($v['ports_client'] == "default")
-					$stream5_tcp_engine .= " {$stream5_ports_client}";
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_client']));
-					if (!empty($tmp))
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					else {
-						$stream5_tcp_engine .= " {$stream5_ports_client}";
-						log_error("[snort] WARNING: unable to resolve Ports Client Alias [{$v['ports_client']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
-					}
-				}
-			}
-			if (!empty($v['ports_both'])) {
-				$stream5_tcp_engine .= ", \\\n\tports both";
-				if ($v['ports_both'] == " all")
-					$stream5_tcp_engine .= " all";
-				elseif ($v['ports_both'] == "default")
-					$stream5_tcp_engine .= " {$stream5_ports_both}";
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_both']));
-					if (!empty($tmp))
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					else {
-						$stream5_tcp_engine .= " {$stream5_ports_both}";
-						log_error("[snort] WARNING: unable to resolve Ports Both Alias [{$v['ports_both']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
-					}
-				}
-			}
-			if (!empty($v['ports_server']) && $v['ports_server'] <> "none" && $v['ports_server'] <> "default") {
-				if ($v['ports_server'] == " all") {
-					$stream5_tcp_engine .= ", \\\n\tports server";
-					$stream5_tcp_engine .= " all";
-				}
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_server']));
-					if (!empty($tmp)) {
-						$stream5_tcp_engine .= ", \\\n\tports server";
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					}
-					else
-						log_error("[snort] WARNING: unable to resolve Ports Server Alias [{$v['ports_server']}] for Stream5 TCP engine '{$v['name']}' ... defaulting to none.");
-				}
-			}
-
-			// Make sure the "ports" parameter is set, or else default to a safe value
-			if (strpos($stream5_tcp_engine, "ports ") === false)
-				$stream5_tcp_engine .= ", \\\n\tports both all";
-
-			// Add a pair of newlines to terminate this engine
-			$stream5_tcp_engine .= "\n\n";
-		}
-		// Trim off the final trailing newline
-		$stream5_tcp_engine = rtrim($stream5_tcp_engine);
-	}
-
-	// Configure the Stream5 UDP engine if it and Stream5 reassembly are enabled
-	if ($snortcfg['stream5_track_udp'] == "off" || $snortcfg['stream5_reassembly'] == "off")
-		$stream5_udp_engine = "";
-	else {
-		$stream5_udp_engine = "preprocessor stream5_udp: ";
-		if (!empty($snortcfg['stream5_udp_timeout'])) 
-			$stream5_udp_engine .= "timeout {$snortcfg['stream5_udp_timeout']}";
-		else
-			$stream5_udp_engine .= "timeout 30";
-	}
-
-	// Configure the Stream5 ICMP engine if it and Stream5 reassembly are enabled
-	if ($snortcfg['stream5_track_icmp'] == "on" && $snortcfg['stream5_reassembly'] == "on") {
-		$stream5_icmp_engine = "preprocessor stream5_icmp: ";
-		if (!empty($snortcfg['stream5_icmp_timeout'])) 
-			$stream5_icmp_engine .= "timeout {$snortcfg['stream5_icmp_timeout']}";
-		else
-			$stream5_icmp_engine .= "timeout 30";
-	}
-	else
-		$stream5_icmp_engine = "";
-
-	// Check for and configure Host Attribute Table if enabled
-	$host_attrib_config = "";
-	if ($snortcfg['host_attribute_table'] == "on" && !empty($snortcfg['host_attribute_data'])) {
-		@file_put_contents("{$snortcfgdir}/host_attributes", base64_decode($snortcfg['host_attribute_data']));
-		$host_attrib_config = "# Host Attribute Table #\n";
-		$host_attrib_config .= "attribute_table filename {$snortcfgdir}/host_attributes\n";
-		if (!empty($snortcfg['max_attribute_hosts']))
-			$host_attrib_config .= "config max_attribute_hosts: {$snortcfg['max_attribute_hosts']}\n";
-		if (!empty($snortcfg['max_attribute_services_per_host']))
-			$host_attrib_config .= "config max_attribute_services_per_host: {$snortcfg['max_attribute_services_per_host']}";
-	}
-
-	// Configure the HTTP_INSPECT preprocessor
-	// Get global options first and put into a string
-	$http_inspect_global = "preprocessor http_inspect: global ";
-	if ($snortcfg['http_inspect'] == "off")
-		$http_inspect_global .= "disabled ";
-	$http_inspect_global .= "\\\n\tiis_unicode_map unicode.map 1252 \\\n";
-	$http_inspect_global .= "\tcompress_depth 65535 \\\n";
-	$http_inspect_global .= "\tdecompress_depth 65535 \\\n";
-	if (!empty($snortcfg['http_inspect_memcap']))
-		$http_inspect_global .= "\tmemcap {$snortcfg['http_inspect_memcap']} \\\n";
-	else
-		$http_inspect_global .= "\tmemcap 150994944 \\\n";
-	if (!empty($snortcfg['http_inspect_max_gzip_mem']))
-		$http_inspect_global .= "\tmax_gzip_mem {$snortcfg['http_inspect_max_gzip_mem']}";
-	else
-		$http_inspect_global .= "\tmax_gzip_mem 838860";
-	if ($snortcfg['http_inspect_proxy_alert'] == "on")
-		$http_inspect_global .= " \\\n\tproxy_alert";
-
-	$http_inspect_default_engine = array( "name" => "default", "bind_to" => "all", "server_profile" => "all", "enable_xff" => "off", 
-					      "log_uri" => "off", "log_hostname" => "off", "server_flow_depth" => 65535, "enable_cookie" => "on", 
-					      "client_flow_depth" => 1460, "extended_response_inspection" => "on", "no_alerts" => "off", 
-					      "unlimited_decompress" => "on", "inspect_gzip" => "on", "normalize_cookies" =>"on", "normalize_headers" => "on", 
-					      "normalize_utf" => "on", "normalize_javascript" => "on", "allow_proxy_use" => "off", "inspect_uri_only" => "off", 
-					      "max_javascript_whitespaces" => 200, "post_depth" => -1, "max_headers" => 0, "max_spaces" => 0, 
-					      "max_header_length" => 0, "ports" => "default" );
-	$http_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['http_ports']));
-	$http_inspect_servers = "";
-
-	// Iterate configured HTTP_INSPECT servers and write them to string if HTTP_INSPECT enabled
-	if ($snortcfg['http_inspect'] <> "off") {
-		if (!is_array($snortcfg['http_inspect_engine']['item']))
-			$snortcfg['http_inspect_engine']['item'] = array();
-
-		// If no http_inspect_engine is configured, use the default
-		if (empty($snortcfg['http_inspect_engine']['item']))
-			$snortcfg['http_inspect_engine']['item'][] = $http_inspect_default_engine;
-
-		foreach ($snortcfg['http_inspect_engine']['item'] as $f => $v) {
-			$buffer = "preprocessor http_inspect_server: \\\n";
-			if ($v['name'] == "default")
-				$buffer .= "\tserver default \\\n";
-			elseif (is_alias($v['bind_to'])) {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ' ', $tmp);
-						$buffer .= "\tserver { {$tmp} } \\\n";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
-					continue;
-				}
-			}
-			else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
-					continue;
-			}
-			$http_inspect_servers .= $buffer;
-			$http_inspect_servers .= "\tprofile {$v['server_profile']} \\\n";
-
-			if ($v['no_alerts'] == "on")
-				$http_inspect_servers .= "\tno_alerts \\\n";
-
-			if ($v['ports'] == "default" || empty($v['ports']))
-				$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-			elseif (is_alias($v['ports'])) {
-				$tmp = trim(filter_expand_alias($v['ports']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ' ', $tmp);
-					$tmp = snort_expand_port_range($tmp, ' ');
-					$http_inspect_servers .= "\tports { {$tmp} } \\\n";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
-					$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-				}
-			}
-			else {
-					log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
-					$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-			}
-
-			$http_inspect_servers .= "\tserver_flow_depth {$v['server_flow_depth']} \\\n";
-			$http_inspect_servers .= "\tclient_flow_depth {$v['client_flow_depth']} \\\n";
-			$http_inspect_servers .= "\thttp_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \\\n";
-			$http_inspect_servers .= "\tpost_depth {$v['post_depth']} \\\n";
-			$http_inspect_servers .= "\tmax_headers {$v['max_headers']} \\\n";
-			$http_inspect_servers .= "\tmax_header_length {$v['max_header_length']} \\\n";
-			$http_inspect_servers .= "\tmax_spaces {$v['max_spaces']}";
-			if ($v['enable_xff'] == "on")
-				$http_inspect_servers .= " \\\n\tenable_xff";
-			if ($v['enable_cookie'] == "on")
-				$http_inspect_servers .= " \\\n\tenable_cookie";
-			if ($v['normalize_cookies'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_cookies";
-			if ($v['normalize_headers'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_headers";
-			if ($v['normalize_utf'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_utf";
-			if ($v['allow_proxy_use'] == "on")
-				$http_inspect_servers .= " \\\n\tallow_proxy_use";
-			if ($v['inspect_uri_only'] == "on")
-				$http_inspect_servers .= " \\\n\tinspect_uri_only";
-			if ($v['extended_response_inspection'] == "on") {
-				$http_inspect_servers .= " \\\n\textended_response_inspection";
-				if ($v['inspect_gzip'] == "on") {
-					$http_inspect_servers .= " \\\n\tinspect_gzip";
-					if ($v['unlimited_decompress'] == "on")
-						$http_inspect_servers .= " \\\n\tunlimited_decompress";
-				}
-				if ($v['normalize_javascript'] == "on") {
-					$http_inspect_servers .= " \\\n\tnormalize_javascript";
-					$http_inspect_servers .= " \\\n\tmax_javascript_whitespaces {$v['max_javascript_whitespaces']}";
-				}
-			}
-			if ($v['log_uri'] == "on")
-				$http_inspect_servers .= " \\\n\tlog_uri";
-			if ($v['log_hostname'] == "on")
-				$http_inspect_servers .= " \\\n\tlog_hostname";
-
-			// Add a pair of trailing newlines to terminate this server config
-			$http_inspect_servers .= "\n\n";
-		}
-		/* Trim off the final trailing newline */
-		$http_inspect_server = rtrim($http_inspect_server);
-	}
-
-	// Finally, build the Snort configuration file
-	$snort_conf_text = <<<EOD
-# snort configuration file
-# generated automatically by the pfSense subsystems do not modify manually
-
-# Define Local Network #
-ipvar HOME_NET [{$home_net}]
-ipvar EXTERNAL_NET [{$external_net}]
-
-# Define Rule Path #
-var RULE_PATH {$snortcfgdir}/rules
-
-# Define Servers #
-{$ipvardef}
-
-# Define Server Ports #
-{$portvardef}
-
-# Configure quiet startup mode #
-config quiet
-
-# Configure the snort decoder #
-config checksum_mode: {$cksumcheck}
-config disable_decode_alerts
-config disable_tcpopt_experimental_alerts
-config disable_tcpopt_obsolete_alerts
-config disable_ttcp_alerts
-config disable_tcpopt_alerts
-config disable_ipopt_alerts
-config disable_decode_drops
-
-# Enable the GTP decoder #
-config enable_gtp
-
-# Configure PCRE match limitations
-config pcre_match_limit: 3500
-config pcre_match_limit_recursion: 1500
-
-# Configure the detection engine #
-config detection: {$cfg_detect_settings}
-config event_queue: max_queue 8 log 5 order_events content_length
-
-# Configure to show year in timestamps
-config show_year
-
-# Configure protocol aware flushing #
-# For more information see README.stream5 #
-{$paf_max_pdu_config}
-
-# Configure dynamically loaded libraries
-dynamicpreprocessor directory {$snort_dirs['dynamicpreprocessor']}
-dynamicengine directory {$snort_dirs['dynamicengine']}
-dynamicdetection directory {$snort_dirs['dynamicrules']}
-
-# Inline packet normalization. For more information, see README.normalize
-# Disabled since we do not use "inline" mode with pfSense
-# preprocessor normalize_ip4
-# preprocessor normalize_tcp: ips ecn stream
-# preprocessor normalize_icmp4
-# preprocessor normalize_ip6
-# preprocessor normalize_icmp6
-
-# Flow and stream #
-{$frag3_global}
-
-{$frag3_engine}
-
-{$stream5_global}
-
-{$stream5_tcp_engine}
-
-{$stream5_udp_engine}
-
-{$stream5_icmp_engine}
-
-# HTTP Inspect #
-{$http_inspect_global}
-
-{$http_inspect_servers}
-{$snort_preprocessors}
-{$host_attrib_config}
-
-# Snort Output Logs #
-output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
-{$alertsystemlog_type}
-{$snortunifiedlog_type}
-{$spoink_type}
-						
-# Misc Includes #
-{$snort_misc_include_rules}
-
-{$suppress_file_name}
-
-# Snort user pass through configuration
-{$snort_config_pass_thru}
-
-# Rules Selection #
-{$selected_rules_sections}
-EOD;
-
-	// Write out snort.conf file
-	@file_put_contents("{$snortcfgdir}/snort.conf", $snort_conf_text);
-	conf_mount_ro();
+	// Clean up variables we no longer need and free memory
 	unset($snort_conf_text, $selected_rules_sections, $suppress_file_name, $snort_misc_include_rules, $spoink_type, $snortunifiedlog_type, $alertsystemlog_type);
 	unset($home_net, $external_net, $ipvardef, $portvardef);
 }
diff --git a/config/snort/snort.priv.inc b/config/snort/snort.priv.inc
index 8db5408d..9fac78e0 100644
--- a/config/snort/snort.priv.inc
+++ b/config/snort/snort.priv.inc
@@ -39,11 +39,13 @@ $priv_list['page-services-snort']['match'][] = "snort/snort_stream5_engine.php*"
 $priv_list['page-services-snort']['match'][] = "snort/snort_ip_list_mgmt.php*";
 $priv_list['page-services-snort']['match'][] = "snort/snort_ip_reputation.php*";
 $priv_list['page-services-snort']['match'][] = "snort/snort_iprep_list_browser.php*";
+$priv_list['page-services-snort']['match'][] = "snort/snort_generate_conf.php*";
 $priv_list['page-services-snort']['match'][] = "widgets/javascript/snort_alerts.js*";
 $priv_list['page-services-snort']['match'][] = "widgets/include/widget-snort.inc*";
 $priv_list['page-services-snort']['match'][] = "widgets/widgets/snort_alerts.widget.php*";
 $priv_list['page-services-snort']['match'][] = "pkg_edit.php?xml=snort_sync.xml*";
 $priv_list['page-services-snort']['match'][] = "pkg_edit.php?xml=snort/snort.xml*";
 $priv_list['page-services-snort']['match'][] = "snort/snort_check_cron_misc.inc*";
+$priv_list['page-services-snort']['match'][] = "snort/snort_conf_template.inc*";
 $priv_list['page-services-snort']['match'][] = "snort/snort.inc*";
 ?>
\ No newline at end of file
diff --git a/config/snort/snort.xml b/config/snort/snort.xml
index 977db98a..663ce4eb 100755
--- a/config/snort/snort.xml
+++ b/config/snort/snort.xml
@@ -46,8 +46,8 @@
 	<requirements>None</requirements>
 	<faq>Currently there are no FAQ items provided.</faq>
 	<name>Snort</name>
-	<version>2.9.6.0</version>
-	<title>Services:2.9.6.0 pkg v3.0.13</title>
+	<version>2.9.6.2</version>
+	<title>Services:2.9.6.2 pkg v3.1.2</title>
 	<include_file>/usr/local/pkg/snort/snort.inc</include_file>
 	<menu>
 		<name>Snort</name>
@@ -74,12 +74,17 @@
 		<item>https://packages.pfsense.org/packages/config/snort/snort_check_cron_misc.inc</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/snort/</prefix>
+		<prefix>/usr/local/pkg/snort/</prefix>
+		<chmod>077</chmod>
+		<item>https://packages.pfsense.org/packages/config/snort/snort_conf_template.inc</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/snort/</prefix>
 		<chmod>077</chmod>
 		<item>https://packages.pfsense.org/packages/config/snort/snort_migrate_config.php</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/snort/</prefix>
+		<prefix>/usr/local/pkg/snort/</prefix>
 		<chmod>077</chmod>
 		<item>https://packages.pfsense.org/packages/config/snort/snort_post_install.php</item>
 	</additional_files_needed>
@@ -119,7 +124,7 @@
 		<item>https://packages.pfsense.org/packages/config/snort/snort_download_updates.php</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/snort/</prefix>
+		<prefix>/usr/local/pkg/snort/</prefix>
 		<chmod>077</chmod>
 		<item>https://packages.pfsense.org/packages/config/snort/snort_check_for_rule_updates.php</item>
 	</additional_files_needed>
@@ -249,6 +254,11 @@
 		<item>https://packages.pfsense.org/packages/config/snort/snort_iprep_list_browser.php</item>
 	</additional_files_needed>
 	<additional_files_needed>
+		<prefix>/usr/local/pkg/snort/</prefix>
+		<chmod>077</chmod>
+		<item>https://packages.pfsense.org/packages/config/snort/snort_generate_conf.php</item>
+	</additional_files_needed>
+	<additional_files_needed>
 		<prefix>/usr/local/www/widgets/javascript/</prefix>
 		<chmod>0644</chmod>
 		<item>https://packages.pfsense.org/packages/config/snort/snort_alerts.js</item>
@@ -269,13 +279,13 @@
 	</custom_add_php_command>
 	<custom_php_resync_config_command>
 		<![CDATA[
-		if ($GLOBALS['pfSense_snort_version'] == "3.0.13")
+		if ($GLOBALS['pfSense_snort_version'] == "3.1.2")
 		sync_snort_package_config();
 		]]>
 	</custom_php_resync_config_command>
 	<custom_php_install_command>
 		<![CDATA[
-		include_once("/usr/local/www/snort/snort_post_install.php");
+		include_once("/usr/local/pkg/snort/snort_post_install.php");
 		]]>
 	</custom_php_install_command>
 	<custom_php_deinstall_command>
diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php
index 45443ec2..c04f4e31 100755
--- a/config/snort/snort_alerts.php
+++ b/config/snort/snort_alerts.php
@@ -7,6 +7,7 @@
  * Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
  * Copyright (C) 2006 Scott Ullrich
  * Copyright (C) 2012 Ermal Luci
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * Copyright (C) 2013,2014 Bill Meeks
  * All rights reserved.
  *
@@ -164,6 +165,21 @@ if (empty($pconfig['arefresh']))
 	$pconfig['arefresh'] = 'off';
 $anentries = $pconfig['alertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
 if ($_POST['save']) {
 	if (!is_array($config['installedpackages']['snortglobal']['alertsblocks']))
 		$config['installedpackages']['snortglobal']['alertsblocks'] = array();
@@ -283,7 +299,9 @@ if ($_POST['togglesid'] && is_numeric($_POST['sidid']) && is_numeric($_POST['gen
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	snort_generate_conf($a_instance[$instanceid]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Soft-restart Snort to live-load the new rules */
@@ -342,7 +360,6 @@ include_once("head.inc");
 ?>
 
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
 <?php
 include_once("fbegin.inc");
 
@@ -442,7 +459,7 @@ if ($savemsg) {
 			<col axis="string">
 		</colgroup>
 		<thead>
-		   <tr>
+		   <tr class="sortableHeaderRowIdentifier">
 			<th class="listhdrr" axis="date"><?php echo gettext("Date"); ?></th>
 			<th class="listhdrr" axis="number"><?php echo gettext("Pri"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
@@ -486,16 +503,12 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 			$alert_ip_src = $fields[6];
 			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
 			$alert_ip_src = str_replace(":", ":&#8203;", $alert_ip_src);
+
 			/* Add Reverse DNS lookup icons (two different links if pfSense version supports them) */
 			$alert_ip_src .= "<br/>";
-			if ($pfs_version > 2.0) {
-				$alert_ip_src .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[6]}&dialog_output=true', outputrule);\">";
-				$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-				$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			}
-			$alert_ip_src .= "<a href='/diag_dns.php?host={$fields[6]}&instance={$instanceid}'>";
-			$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
+			$alert_ip_src .= "<img onclick=\"javascript:resolve_with_ajax('{$fields[6]}');\" title=\"";
+			$alert_ip_src .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+			$alert_ip_src .= " style=\"cursor: pointer;\"/>";
 
 			/* Add icons for auto-adding to Suppress List if appropriate */
 			if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && 
@@ -519,16 +532,13 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 			$alert_ip_dst = $fields[8];
 			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
 			$alert_ip_dst = str_replace(":", ":&#8203;", $alert_ip_dst);
+
 			/* Add Reverse DNS lookup icons (two different links if pfSense version supports them) */
 			$alert_ip_dst .= "<br/>";
-			if ($pfs_version > 2.0) {
-				$alert_ip_dst .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[8]}&dialog_output=true', outputrule);\">";
-				$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-				$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			}
-			$alert_ip_dst .= "<a href='/diag_dns.php?host={$fields[8]}&instance={$instanceid}'>";
-			$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";	
+			$alert_ip_dst .= "<img onclick=\"javascript:resolve_with_ajax('{$fields[8]}');\" title=\"";
+			$alert_ip_dst .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+			$alert_ip_dst .= " style=\"cursor: pointer;\"/>";
+
 			/* Add icons for auto-adding to Suppress List if appropriate */
 			if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && 
 			    !isset($supplist[$fields[1]][$fields[2]]['by_dst'][$fields[8]])) {
@@ -578,11 +588,11 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 				<td class='listr' align='center'>{$alert_priority}</td>
 				<td class='listr' align='center'>{$alert_proto}</td>
 				<td class='listr' style=\"word-wrap:break-word;\">{$alert_class}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[6]}'>{$alert_ip_src}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[6]};\" sorttable_customkey=\"{$fields[6]}\">{$alert_ip_src}</td>
 				<td class='listr' align='center'>{$alert_src_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[8]}'>{$alert_ip_dst}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[8]};\" sorttable_customkey=\"{$fields[8]}\">{$alert_ip_dst}</td>
 				<td class='listr' align='center'>{$alert_dst_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[2]}'>{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[2]};\" sorttable_customkey=\"{$fields[2]}\">{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
 				<td class='listbg' style=\"word-wrap:break-word;\">{$alert_descr}</td>
 				</tr>\n";
 			$counter++;
@@ -620,5 +630,38 @@ function encRuleSig(rulegid,rulesid,srcip,ruledescr) {
 	document.getElementById("descr").value = ruledescr;
 }
 </script>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/snort/snort_alerts.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
+</script>
+
 </body>
 </html>
diff --git a/config/snort/snort_blocked.php b/config/snort/snort_blocked.php
index 76d5a9df..087724e3 100644
--- a/config/snort/snort_blocked.php
+++ b/config/snort/snort_blocked.php
@@ -7,6 +7,7 @@
  *
  * Modified for the Pfsense snort package v. 1.8+
  * Copyright (C) 2009 Robert Zelaya Sr. Developer
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * Copyright (C) 2014 Bill Meeks
  *
  * Redistribution and use in source and binary forms, with or without
@@ -50,6 +51,21 @@ if (empty($pconfig['blertnumber']))
 else
 	$bnentries = $pconfig['blertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
 if ($_POST['todelete']) {
 	$ip = "";
 	if ($_POST['ip'])
@@ -133,7 +149,6 @@ include_once("head.inc");
 ?>
 
 <body link="#000000" vlink="#000000" alink="#000000">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
 
 <?php
 
@@ -185,7 +200,7 @@ if ($savemsg) {
 				<input name="download" type="submit" class="formbtns" value="Download" title="<?=gettext("Download list of blocked hosts as a gzip archive");?>"/>
 				&nbsp;<?php echo gettext("All blocked hosts will be saved."); ?>&nbsp;&nbsp;
 				<input name="remove" type="submit" class="formbtns" value="Clear" title="<?=gettext("Remove blocks for all listed hosts");?>" 
-				onClick="return confirm('<?=gettext("Are you sure you want to remove all blocked hosts?  Click OK to continue or CANCLE to quit.");?>');"/>&nbsp;
+				onClick="return confirm('<?=gettext("Are you sure you want to remove all blocked hosts?  Click OK to continue or CANCEL to quit.");?>');"/>&nbsp;
 				<span class="red"><strong><?php echo gettext("Warning:"); ?></strong></span>&nbsp;<?php echo gettext("all hosts will be removed."); ?>
 				</td>
 			</tr>
@@ -214,11 +229,11 @@ if ($savemsg) {
 						<col width="10%" align="center">
 					</colgroup>
 					<thead>
-					   <tr>
+					   <tr class="sortableHeaderRowIdentifier">
 						<th class="listhdrr" axis="number">#</th>
 						<th class="listhdrr" axis="string"><?php echo gettext("IP"); ?></th>
 						<th class="listhdrr" axis="string"><?php echo gettext("Alert Description"); ?></th>
-						<th class="listhdrr"><?php echo gettext("Remove"); ?></th>
+						<th class="listhdrr sorttable_nosort"><?php echo gettext("Remove"); ?></th>
 					   </tr>
 					</thead>
 				<tbody>
@@ -278,20 +293,16 @@ if ($savemsg) {
 				$tmp_ip = str_replace(":", ":&#8203;", $blocked_ip);
 				/* Add reverse DNS lookup icons (two different links if pfSense version supports them) */
 				$rdns_link = "";
-				if ($pfs_version > 2.0) {
-					$rdns_link .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$blocked_ip}&dialog_output=true', outputrule);\">";
-					$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-					$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-				}
-				$rdns_link .= "<a href='/diag_dns.php?host={$blocked_ip}'>";
-				$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-				$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
+				$rdns_link .= "<img onclick=\"javascript:resolve_with_ajax('{$blocked_ip}');\" title=\"";
+				$rdns_link .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+				$rdns_link.= " style=\"cursor: pointer;\"/>";
+
 				/* use one echo to do the magic*/
 					echo "<tr>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$counter}</td>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$tmp_ip}<br/>{$rdns_link}</td>
 						<td valign=\"middle\" class=\"listr\">{$blocked_desc}</td>
-						<td align=\"center\" valign=\"middle\" class=\"listr\" sorttable_customkey=\"\">
+						<td align=\"center\" valign=\"middle\" class=\"listr\">
 						<input type=\"image\" name=\"todelete[]\" onClick=\"document.getElementById('ip').value='{$blocked_ip}';\" 
 						src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\" title=\"" . gettext("Delete host from Blocked Table") . "\" border=\"0\" /></td>
 					</tr>\n";
@@ -325,5 +336,38 @@ if ($savemsg) {
 <?php
 include("fend.inc");
 ?>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/snort/snort_blocked.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
+</script>
+
 </body>
 </html>
diff --git a/config/snort/snort_check_cron_misc.inc b/config/snort/snort_check_cron_misc.inc
index a5b9e65e..9a1c7833 100644
--- a/config/snort/snort_check_cron_misc.inc
+++ b/config/snort/snort_check_cron_misc.inc
@@ -116,7 +116,7 @@ foreach ($config['installedpackages']['snortglobal']['rule'] as $value) {
 		}
 		unset($files);
 		if ($prune_count > 0)
-			log_error(gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s)..."));
+			log_error(gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/barnyard2/archive/..."));
 	}
 }
 
diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php
index 667f4044..9d8d15d5 100755
--- a/config/snort/snort_check_for_rule_updates.php
+++ b/config/snort/snort_check_for_rule_updates.php
@@ -37,7 +37,9 @@ require_once "/usr/local/pkg/snort/snort.inc";
 global $g, $config, $pkg_interface, $snort_gui_include, $rebuild_rules;
 
 if (!defined("VRT_DNLD_URL"))
-	define("VRT_DNLD_URL", "https://www.snort.org/reg-rules/");
+	define("VRT_DNLD_URL", "https://www.snort.org/rules/");
+if (!defined("SNORT_BIN_VERSION"))
+	define("SNORT_BIN_VERSION", "2.9.6.2");
 if (!defined("ET_VERSION"))
 	define("ET_VERSION", "2.9.0");
 if (!defined("ET_BASE_DNLD_URL"))
@@ -98,7 +100,7 @@ exec("/usr/local/bin/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26
 // Save the version with decimal delimiters for use in extracting the rules
 $snort_version = $snortver[0];
 if (empty($snort_version))
-	$snort_version = "2.9.6.0";
+	$snort_version = SNORT_BIN_VERSION;
 
 // Create a collapsed version string for use in the tarball filename
 $snortver[0] = str_replace(".", "", $snortver[0]);
@@ -431,10 +433,10 @@ $update_errors = false;
 
 /*  Check for and download any new Snort VRT sigs */
 if ($snortdownload == 'on') {
-	if (snort_check_rule_md5("{$snort_rule_url}{$snort_filename_md5}/{$oinkid}/", "{$tmpfname}/{$snort_filename_md5}", "Snort VRT rules")) {
+	if (snort_check_rule_md5("{$snort_rule_url}{$snort_filename_md5}?oinkcode={$oinkid}", "{$tmpfname}/{$snort_filename_md5}", "Snort VRT rules")) {
 		/* download snortrules file */
 		$file_md5 = trim(file_get_contents("{$tmpfname}/{$snort_filename_md5}"));
-		if (!snort_fetch_new_rules("{$snort_rule_url}{$snort_filename}/{$oinkid}/", "{$tmpfname}/{$snort_filename}", $file_md5, "Snort VRT rules"))
+		if (!snort_fetch_new_rules("{$snort_rule_url}{$snort_filename}?oinkcode={$oinkid}", "{$tmpfname}/{$snort_filename}", $file_md5, "Snort VRT rules"))
 			$snortdownload = 'off';
 	}
 	else
diff --git a/config/snort/snort_conf_template.inc b/config/snort/snort_conf_template.inc
new file mode 100644
index 00000000..be4791af
--- /dev/null
+++ b/config/snort/snort_conf_template.inc
@@ -0,0 +1,112 @@
+<?php
+
+// This is the template used to generate the snort.conf
+// configuration file for the interface.  The contents of
+// this file are written to the snort.conf file for
+// the interface.  Key parameters are provided by the
+// included string variables which are populated by the
+// snort_generate_conf.php file.
+
+$snort_conf_text = <<<EOD
+# snort configuration file
+# generated automatically by the pfSense subsystems do not modify manually
+
+# Define Local Network #
+ipvar HOME_NET [{$home_net}]
+ipvar EXTERNAL_NET [{$external_net}]
+
+# Define Rule Path #
+var RULE_PATH {$snortcfgdir}/rules
+
+# Define Servers #
+{$ipvardef}
+
+# Define Server Ports #
+{$portvardef}
+
+# Configure quiet startup mode #
+config quiet
+
+# Configure the snort decoder #
+config checksum_mode: {$cksumcheck}
+config disable_decode_alerts
+config disable_tcpopt_experimental_alerts
+config disable_tcpopt_obsolete_alerts
+config disable_ttcp_alerts
+config disable_tcpopt_alerts
+config disable_ipopt_alerts
+config disable_decode_drops
+
+# Enable the GTP decoder #
+config enable_gtp
+
+# Configure PCRE match limitations
+config pcre_match_limit: 3500
+config pcre_match_limit_recursion: 1500
+
+# Configure the detection engine #
+config detection: {$cfg_detect_settings}
+config event_queue: max_queue 8 log 5 order_events content_length
+
+# Configure to show year in timestamps
+config show_year
+
+# Configure protocol aware flushing #
+# For more information see README.stream5 #
+{$paf_max_pdu_config}
+
+# Configure dynamically loaded libraries
+dynamicpreprocessor directory {$snort_dirs['dynamicpreprocessor']}
+dynamicengine directory {$snort_dirs['dynamicengine']}
+dynamicdetection directory {$snort_dirs['dynamicrules']}
+
+# Inline packet normalization. For more information, see README.normalize
+# Disabled since we do not use "inline" mode with pfSense
+# preprocessor normalize_ip4
+# preprocessor normalize_tcp: ips ecn stream
+# preprocessor normalize_icmp4
+# preprocessor normalize_ip6
+# preprocessor normalize_icmp6
+
+# Flow and stream #
+{$frag3_global}
+
+{$frag3_engine}
+
+{$stream5_global}
+
+{$stream5_tcp_engine}
+
+{$stream5_udp_engine}
+
+{$stream5_icmp_engine}
+
+# HTTP Inspect #
+{$http_inspect_global}
+
+{$http_inspect_servers}
+{$snort_preprocessors}
+{$host_attrib_config}
+
+# Snort Output Logs #
+output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
+{$alertsystemlog_type}
+{$snortunifiedlog_type}
+{$spoink_type}
+						
+# Misc Includes #
+{$snort_misc_include_rules}
+
+{$suppress_file_name}
+
+# Snort user pass through configuration
+{$snort_config_pass_thru}
+
+# Rules Selection #
+{$selected_rules_sections}
+EOD;
+
+// End of snort.conf template code
+
+?>
+
diff --git a/config/snort/snort_define_servers.php b/config/snort/snort_define_servers.php
index 4d1b3c2e..98a98fd9 100755
--- a/config/snort/snort_define_servers.php
+++ b/config/snort/snort_define_servers.php
@@ -138,7 +138,9 @@ if ($_POST['save']) {
 
 		/* Update the snort conf file for this interface. */
 		$rebuild_rules = false;
+		conf_mount_rw();
 		snort_generate_conf($a_nat[$id]);
+		conf_mount_ro();
 
 		/* Soft-restart Snort to live-load new variables. */
 		snort_reload_config($a_nat[$id]);
diff --git a/config/snort/snort_download_rules.php b/config/snort/snort_download_rules.php
index f35341f1..0fa20e08 100755
--- a/config/snort/snort_download_rules.php
+++ b/config/snort/snort_download_rules.php
@@ -43,7 +43,6 @@ include("head.inc");
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
 
 <?php include("fbegin.inc"); ?>
-<?if($pfsense_stable == 'yes'){echo '<p class="pgtitle">' . $pgtitle . '</p>';}?>
 
 <form action="/snort/snort_download_updates.php" method="GET">
 
@@ -91,7 +90,7 @@ include("head.inc");
 <?php
 
 $snort_gui_include = true;
-include("/usr/local/www/snort/snort_check_for_rule_updates.php");
+include("/usr/local/pkg/snort/snort_check_for_rule_updates.php");
 
 /* hide progress bar and lets end this party */
 echo "\n<script type=\"text/javascript\">document.progressbar.style.visibility='hidden';\n</script>";
diff --git a/config/snort/snort_download_updates.php b/config/snort/snort_download_updates.php
index ecc1e5b5..ff05bdfd 100755
--- a/config/snort/snort_download_updates.php
+++ b/config/snort/snort_download_updates.php
@@ -47,7 +47,7 @@ $snort_rules_upd_log = RULES_UPD_LOGFILE;
 $snortver = array();
 exec("/usr/local/bin/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver);
 if (empty($snortver[0]))
-	$snortver[0] = "2.9.5.5";
+	$snortver[0] = SNORT_BIN_VERSION;
 $snortver[0] = str_replace(".", "", $snortver[0]);
 
 $snort_rules_file = "snortrules-snapshot-{$snortver[0]}.tar.gz";
@@ -251,7 +251,7 @@ include_once("head.inc");
 						<p style="text-align:center;" class="vexpl">
 						<font class="red"><b><?php echo gettext("WARNING:");?></b></font>&nbsp;
 						<?php echo gettext('No rule types have been selected for download. ') . 
-						gettext('Visit the ') . '<a href="/snort/snort_global.php">Global Settings Tab</a>' . gettext(' to select rule types.'); ?>
+						gettext('Visit the ') . '<a href="/snort/snort_interfaces_global.php">Global Settings Tab</a>' . gettext(' to select rule types.'); ?>
 						<br/></p>
 					<?php else: ?>
 						<br/>
diff --git a/config/snort/snort_edit_hat_data.php b/config/snort/snort_edit_hat_data.php
index a5ec0aad..04be18e7 100644
--- a/config/snort/snort_edit_hat_data.php
+++ b/config/snort/snort_edit_hat_data.php
@@ -68,7 +68,9 @@ if ($_POST['clear']) {
 	$a_nat[$id]['host_attribute_table'] = 'off';
 	write_config("Snort pkg: cleared Host Attribute Table data for {$a_nat[$id]['interface']}.");
 	$rebuild_rules = false;
+	conf_mount_rw();
 	snort_generate_conf($a_nat[$id]);
+	conf_mount_ro();
 	$pconfig['host_attribute_data'] = "";
 }
 
@@ -80,7 +82,9 @@ if ($_POST['save']) {
 		$a_nat[$id]['host_attribute_table'] = 'off';
 	write_config("Snort pkg: modified Host Attribute Table data for {$a_nat[$id]['interface']}.");
 	$rebuild_rules = false;
+	conf_mount_rw();
 	snort_generate_conf($a_nat[$id]);
+	conf_mount_ro();
 	$pconfig['host_attribute_data'] = $_POST['host_attribute_data'];
 }
 
diff --git a/config/snort/snort_generate_conf.php b/config/snort/snort_generate_conf.php
new file mode 100644
index 00000000..c67ab3d6
--- /dev/null
+++ b/config/snort/snort_generate_conf.php
@@ -0,0 +1,1351 @@
+<?php
+/*
+ * snort_generate_conf.php
+ *
+ * Copyright (C) 2006 Scott Ullrich
+ * Copyright (C) 2009-2010 Robert Zelaya
+ * Copyright (C) 2011-2012 Ermal Luci
+ * Copyright (C) 2013,2014 Bill Meeks
+ * part of pfSense
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**************************************************************************/
+/* This code reads the stored Snort configuration and constructs a series */
+/* of string variables that are used as values for placeholders in the    */
+/* snort_conf_template.inc file.  These strings along with text in the    */
+/* template are used to create the snort.conf file for the interface.     */
+/**************************************************************************/
+
+/* Custom home nets */
+$home_net_list = snort_build_list($snortcfg, $snortcfg['homelistname']);
+$home_net = implode(",", $home_net_list);
+
+$external_net = '!$HOME_NET';
+if (!empty($snortcfg['externallistname']) && $snortcfg['externallistname'] != 'default') {
+	$external_net_list = snort_build_list($snortcfg, $snortcfg['externallistname']);
+	$external_net = implode(",", $external_net_list);
+}
+
+/* User added custom configuration arguments */
+$snort_config_pass_thru = str_replace("\r", "", base64_decode($snortcfg['configpassthru']));
+// Remove the trailing newline
+$snort_config_pass_thru = rtrim($snort_config_pass_thru);
+
+/* create a few directories and ensure the sample files are in place */
+$snort_dirs = array( $snortdir, $snortcfgdir, "{$snortcfgdir}/rules",
+	"{$snortlogdir}/snort_{$if_real}{$snort_uuid}",
+	"{$snortlogdir}/snort_{$if_real}{$snort_uuid}/barnyard2", 
+	"{$snortcfgdir}/preproc_rules", 
+	"dynamicrules" => "{$snortlibdir}/dynamicrules",
+	"dynamicengine" => "{$snortlibdir}/dynamicengine",
+	"dynamicpreprocessor" => "{$snortcfgdir}/dynamicpreprocessor"
+);
+foreach ($snort_dirs as $dir) {
+	if (!is_dir($dir))
+		safe_mkdir($dir);
+}
+
+/********************************************************************/
+/* For fail-safe on an initial startup following installation, and  */
+/* before a rules update has occurred, copy the default config      */
+/* files to the interface directory.  If files already exist in     */
+/* the interface directory, or they are newer, that means a rule    */
+/* update has been done and we should leave the customized files    */
+/* put in place by the rules update process.                        */
+/********************************************************************/
+$snort_files = array("gen-msg.map", "classification.config", "reference.config", "attribute_table.dtd", 
+		"sid-msg.map", "unicode.map", "threshold.conf", "preproc_rules/preprocessor.rules",
+		"preproc_rules/decoder.rules", "preproc_rules/sensitive-data.rules"
+	);
+foreach ($snort_files as $file) {
+	if (file_exists("{$snortdir}/{$file}")) {
+		$ftime = filemtime("{$snortdir}/{$file}");
+		if (!file_exists("{$snortcfgdir}/{$file}") || ($ftime > filemtime("{$snortcfgdir}/{$file}")))
+			@copy("{$snortdir}/{$file}", "{$snortcfgdir}/{$file}");
+	}
+}
+
+/* define alertsystemlog */
+$alertsystemlog_type = "";
+if ($snortcfg['alertsystemlog'] == "on")
+	$alertsystemlog_type = "output alert_syslog: log_alert";
+
+/* define snortunifiedlog */
+$snortunifiedlog_type = "";
+if ($snortcfg['barnyard_enable'] == "on") {
+	if (isset($snortcfg['unified2_log_limit']))
+		$u2_log_limit = "limit {$snortcfg['unified2_log_limit']}";
+	else
+		$u2_log_limit = "limit 128";
+
+	$snortunifiedlog_type = "output unified2: filename snort_{$snort_uuid}_{$if_real}.u2, {$u2_log_limit}";
+	if ($snortcfg['barnyard_log_vlan_events'] == 'on')
+		$snortunifiedlog_type .= ", vlan_event_types";
+	if ($snortcfg['barnyard_log_mpls_events'] == 'on')
+		$snortunifiedlog_type .= ", mpls_event_types";
+}
+
+/* define spoink */
+$spoink_type = "";
+if ($snortcfg['blockoffenders7'] == "on") {
+	$pfkill = "";
+	if ($snortcfg['blockoffenderskill'] == "on")
+		$pfkill = "kill";
+	$spoink_wlist = snort_build_list($snortcfg, $snortcfg['whitelistname'], true);
+	/* write Pass List */
+	@file_put_contents("{$snortcfgdir}/{$snortcfg['whitelistname']}", implode("\n", $spoink_wlist));
+	$spoink_type = "output alert_pf: {$snortcfgdir}/{$snortcfg['whitelistname']},snort2c,{$snortcfg['blockoffendersip']},{$pfkill}";
+}
+
+/* define selected suppress file */
+$suppress_file_name = "";
+$suppress = snort_find_list($snortcfg['suppresslistname'], 'suppress');
+if (!empty($suppress)) {
+	$suppress_data = str_replace("\r", "", base64_decode($suppress['suppresspassthru']));
+	@file_put_contents("{$snortcfgdir}/supp{$snortcfg['suppresslistname']}", $suppress_data);
+	$suppress_file_name = "include {$snortcfgdir}/supp{$snortcfg['suppresslistname']}";
+}
+
+/* set the snort performance model */
+$snort_performance = "ac-bnfa";
+if(!empty($snortcfg['performance']))
+	$snort_performance = $snortcfg['performance'];
+
+/* if user has defined a custom ssh port, use it */
+if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port']))
+	$ssh_port = $config['system']['ssh']['port'];
+else
+	$ssh_port = "22";
+
+/* Define an array of default values for the various preprocessor ports */
+$snort_ports = array(
+	"dns_ports" => "53", "smtp_ports" => "25", "mail_ports" => "25,465,587,691",
+	"http_ports" => "36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712", 
+	"oracle_ports" => "1024:", "mssql_ports" => "1433", "telnet_ports" => "23", 
+	"snmp_ports" => "161", "ftp_ports" => "21,2100,3535", "ssh_ports" => $ssh_port, 
+	"pop2_ports" => "109", "pop3_ports" => "110", "imap_ports" => "143", 
+	"sip_ports" => "5060,5061,5600", "auth_ports" => "113", "finger_ports" => "79", 
+	"irc_ports" => "6665,6666,6667,6668,6669,7000", "smb_ports" => "139,445",
+	"nntp_ports" => "119", "rlogin_ports" => "513", "rsh_ports" => "514",
+	"ssl_ports" => "443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920",
+	"file_data_ports" => "\$HTTP_PORTS,110,143", "shellcode_ports" => "!80", 
+	"sun_rpc_ports" => "111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779",
+	"DCERPC_NCACN_IP_TCP" => "139,445", "DCERPC_NCADG_IP_UDP" => "138,1024:",
+	"DCERPC_NCACN_IP_LONG" => "135,139,445,593,1024:", "DCERPC_NCACN_UDP_LONG" => "135,1024:",
+	"DCERPC_NCACN_UDP_SHORT" => "135,593,1024:", "DCERPC_NCACN_TCP" => "2103,2105,2107",
+	"DCERPC_BRIGHTSTORE" => "6503,6504", "DNP3_PORTS" => "20000", "MODBUS_PORTS" => "502",
+	"GTP_PORTS" => "2123,2152,3386"
+);
+
+/* Check for defined Aliases that may override default port settings as we build the portvars array */
+$portvardef = "";
+foreach ($snort_ports as $alias => $avalue) {
+	if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"]))
+		$snort_ports[$alias] = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
+	$snort_ports[$alias] = preg_replace('/\s+/', ',', trim($snort_ports[$alias]));
+	$portvardef .= "portvar " . strtoupper($alias) . " [" . $snort_ports[$alias] . "]\n";
+}
+
+/* Define the default ports for the Stream5 preprocessor (formatted for easier reading in the snort.conf file) */
+$stream5_ports_client = "21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 \\\n";
+$stream5_ports_client .= "\t             139 143 161 445 513 514 587 593 691 1433 1521 1741 \\\n";
+$stream5_ports_client .= "\t             2100 3306 6070 6665 6666 6667 6668 6669 7000 8181 \\\n";
+$stream5_ports_client .= "\t             32770 32771 32772 32773 32774 32775 32776 32777 \\\n";
+$stream5_ports_client .= "\t             32778 32779";
+$stream5_ports_both = "80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563 \\\n";
+$stream5_ports_both .= "\t           591 593 631 636 901 989 992 993 994 995 1220 1414 1533 \\\n";
+$stream5_ports_both .= "\t           1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 \\\n";
+$stream5_ports_both .= "\t           5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777 \\\n";
+$stream5_ports_both .= "\t           7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 \\\n";
+$stream5_ports_both .= "\t           7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 \\\n";
+$stream5_ports_both .= "\t           8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 \\\n";
+$stream5_ports_both .= "\t           8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000 \\\n";
+$stream5_ports_both .= "\t           9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 \\\n";
+$stream5_ports_both .= "\t           33300 34412 34443 34444 41080 44440 50000 50002 51423 \\\n";
+$stream5_ports_both .= "\t           55555 56712";
+
+/*********************/
+/* preprocessor code */
+/*********************/
+
+/* def perform_stat */
+
+$perform_stat = <<<EOD
+# Performance Statistics #
+preprocessor perfmonitor: time 300 file {$snortlogdir}/snort_{$if_real}{$snort_uuid}/{$if_real}.stats pktcnt 10000
+	
+EOD;
+
+/* def ftp_preprocessor */
+
+$telnet_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['telnet_ports']));
+$ftp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ftp_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($telnet_ports) || empty($telnet_ports))
+	$telnet_ports = "23";
+if (!isset($ftp_ports) || empty($ftp_ports))
+	$ftp_ports = "21 2100 3535";
+
+// Configure FTP_Telnet global options
+$ftp_telnet_globals = "inspection_type ";
+if ($snortcfg['ftp_telnet_inspection_type'] != "") { $ftp_telnet_globals .= $snortcfg['ftp_telnet_inspection_type']; }else{ $ftp_telnet_globals .= "stateful"; }
+if ($snortcfg['ftp_telnet_alert_encrypted'] == "on")
+	$ftp_telnet_globals .= " \\\n\tencrypted_traffic yes";
+else
+	$ftp_telnet_globals .= " \\\n\tencrypted_traffic no";
+if ($snortcfg['ftp_telnet_check_encrypted'] == "on")
+	$ftp_telnet_globals .= " \\\n\tcheck_encrypted";
+
+// Configure FTP_Telnet Telnet protocol options
+$ftp_telnet_protocol = "ports { {$telnet_ports} }";
+if ($snortcfg['ftp_telnet_normalize'] == "on")
+	$ftp_telnet_protocol .= " \\\n\tnormalize";
+if ($snortcfg['ftp_telnet_detect_anomalies'] == "on")
+	$ftp_telnet_protocol .= " \\\n\tdetect_anomalies";
+if ($snortcfg['ftp_telnet_ayt_attack_threshold'] <> '0') {
+	$ftp_telnet_protocol .= " \\\n\tayt_attack_thresh "; 
+	if ($snortcfg['ftp_telnet_ayt_attack_threshold'] != "")
+		$ftp_telnet_protocol .= $snortcfg['ftp_telnet_ayt_attack_threshold'];
+	else
+		$ftp_telnet_protocol .= "20";
+}
+
+// Setup the standard FTP commands used for all FTP Server engines
+$ftp_cmds = <<<EOD
+	ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
+	ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
+	ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
+	ftp_cmds { LPSV MACB MAIL MDTM MFMT MIC MKD MLSD MLST } \
+	ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
+	ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
+	ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
+	ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
+	ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
+	ftp_cmds { XSEN XSHA1 XSHA256 } \
+	alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
+	alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
+	alt_max_param_len 256 { CWD RNTO } \
+	alt_max_param_len 400 { PORT } \
+	alt_max_param_len 512 { MFMT SIZE } \
+	chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
+	chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
+	chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
+	chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
+	chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
+	chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
+	chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ 
+	chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
+	cmd_validity ALLO < int [ char R int ] > \    
+	cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
+	cmd_validity MACB < string > \
+	cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
+	cmd_validity MODE < char ASBCZ > \
+	cmd_validity PORT < host_port > \
+	cmd_validity PROT < char CSEP > \
+	cmd_validity STRU < char FRPO [ string ] > \    
+	cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
+
+EOD;
+
+// Configure all the FTP_Telnet FTP protocol options
+// Iterate and configure the FTP Client engines
+$ftp_default_client_engine = array( "name" => "default", "bind_to" => "all", "max_resp_len" => 256, 
+				    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
+				    "bounce" => "yes", "bounce_to_net" => "", "bounce_to_port" => "" );
+
+if (!is_array($snortcfg['ftp_client_engine']['item']))
+	$snortcfg['ftp_client_engine']['item'] = array();
+
+// If no FTP client engine is configured, use the default
+// to keep from breaking Snort.
+if (empty($snortcfg['ftp_client_engine']['item']))
+		$snortcfg['ftp_client_engine']['item'][] = $ftp_default_client_engine;
+$ftp_client_engine = "";
+
+foreach ($snortcfg['ftp_client_engine']['item'] as $f => $v) {
+	$buffer = "preprocessor ftp_telnet_protocol: ftp client ";
+	if ($v['name'] == "default" && $v['bind_to'] == "all")
+		$buffer .= "default \\\n";
+	elseif (is_alias($v['bind_to'])) {
+		$tmp = trim(filter_expand_alias($v['bind_to']));
+		if (!empty($tmp)) {
+			$tmp = preg_replace('/\s+/', ' ', $tmp);
+			$buffer .= "{$tmp} \\\n";
+		}
+		else {
+			log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
+			continue;
+		}
+	}
+	else {
+			log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
+			continue;
+	}
+
+	if ($v['max_resp_len'] == "")
+		$buffer .= "\tmax_resp_len 256 \\\n";
+	else
+		$buffer .= "\tmax_resp_len {$v['max_resp_len']} \\\n";
+
+	$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
+	$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
+
+	if ($v['bounce'] == "yes") {
+		if (is_alias($v['bounce_to_net']) && is_alias($v['bounce_to_port'])) {
+			$net = trim(filter_expand_alias($v['bounce_to_net']));
+			$port = trim(filter_expand_alias($v['bounce_to_port']));
+			if (!empty($net) && !empty($port) && 
+			     snort_is_single_addr_alias($v['bounce_to_net']) && 
+			    (is_port($port) || is_portrange($port))) {
+				$port = preg_replace('/\s+/', ',', $port);
+				// Change port range delimiter to comma for ftp_telnet client preprocessor
+				if (is_portrange($port))
+					$port = str_replace(":", ",", $port);
+				$buffer .= "\tbounce yes \\\n";
+				$buffer .= "\tbounce_to { {$net},{$port} }\n";
+			}
+			else {
+				// One or both of the BOUNCE_TO alias values is not right,
+				// so figure out which and log an appropriate error.
+				if (empty($net) || !snort_is_single_addr_alias($v['bounce_to_net']))
+					log_error("[snort] ERROR: illegal value for bounce_to Address Alias [{$v['bounce_to_net']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
+				if (empty($port) || !(is_port($port) || is_portrange($port)))
+					log_error("[snort] ERROR: illegal value for bounce_to Port Alias [{$v['bounce_to_port']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
+				$buffer .= "\tbounce yes\n";
+			}
+		}
+		else
+			$buffer .= "\tbounce yes\n";
+	}
+	else
+		$buffer .= "\tbounce no\n";
+
+	// Add this FTP client engine to the master string
+	$ftp_client_engine .= "{$buffer}\n";
+}
+// Trim final trailing newline
+rtrim($ftp_client_engine);	
+
+// Iterate and configure the FTP Server engines
+$ftp_default_server_engine = array( "name" => "default", "bind_to" => "all", "ports" => "default", 
+				    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
+				    "ignore_data_chan" => "no", "def_max_param_len" => 100 );
+
+if (!is_array($snortcfg['ftp_server_engine']['item']))
+	$snortcfg['ftp_server_engine']['item'] = array();
+
+// If no FTP server engine is configured, use the default
+// to keep from breaking Snort.
+if (empty($snortcfg['ftp_server_engine']['item']))
+		$snortcfg['ftp_server_engine']['item'][] = $ftp_default_server_engine;
+$ftp_server_engine = "";
+
+foreach ($snortcfg['ftp_server_engine']['item'] as $f => $v) {
+	$buffer = "preprocessor ftp_telnet_protocol: ftp server ";
+	if ($v['name'] == "default" && $v['bind_to'] == "all")
+		$buffer .= "default \\\n";
+	elseif (is_alias($v['bind_to'])) {
+		$tmp = trim(filter_expand_alias($v['bind_to']));
+		if (!empty($tmp)) {
+			$tmp = preg_replace('/\s+/', ' ', $tmp);
+			$buffer .= "{$tmp} \\\n";
+		}
+		else {
+			log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
+			continue;
+		}
+	}
+	else {
+			log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
+			continue;
+	}
+
+	if ($v['def_max_param_len'] == "")
+		$buffer .= "\tdef_max_param_len 100 \\\n";
+	elseif ($v['def_max_param_len'] <> '0')
+		$buffer .= "\tdef_max_param_len {$v['def_max_param_len']} \\\n";
+
+	if ($v['ports'] == "default" || !is_alias($v['ports']) || empty($v['ports']))
+		$buffer .= "\tports { {$ftp_ports} } \\\n";
+	elseif (is_alias($v['ports'])) {
+		$tmp = trim(filter_expand_alias($v['ports']));
+		if (!empty($tmp)) {
+			$tmp = preg_replace('/\s+/', ' ', $tmp);
+			$tmp = snort_expand_port_range($tmp, ' ');
+			$buffer .= "\tports { {$tmp} } \\\n";
+		}
+		else {
+			log_error("[snort] ERROR: unable to resolve Port Alias '{$v['ports']}' for FTP server '{$v['name']}' ... reverting to defaults.");
+			$buffer .= "\tports { {$ftp_ports} } \\\n";
+		}
+	}
+
+	$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
+	$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
+	if ($v['ignore_data_chan'] == "yes")
+		$buffer .= "\tignore_data_chan yes \\\n";
+	$buffer .= "{$ftp_cmds}\n";
+
+	// Add this FTP server engine to the master string
+	$ftp_server_engine .= $buffer;
+}
+// Remove trailing newlines
+rtrim($ftp_server_engine);
+
+	$ftp_preprocessor = <<<EOD
+# ftp_telnet preprocessor #
+preprocessor ftp_telnet: global \
+	{$ftp_telnet_globals}
+
+preprocessor ftp_telnet_protocol: telnet \
+	{$ftp_telnet_protocol}
+
+{$ftp_server_engine}
+{$ftp_client_engine}
+EOD;
+
+/* def pop_preprocessor */
+
+$pop_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['pop3_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($pop_ports) || empty($pop_ports))
+	$pop_ports = "110";
+
+if (isset($snortcfg['pop_memcap']))
+	$pop_memcap = $snortcfg['pop_memcap'];
+else
+	$pop_memcap = "838860";
+if (isset($snortcfg['pop_qp_decode_depth']))
+	$pop_qp_decode_depth = $snortcfg['pop_qp_decode_depth'];
+else
+	$pop_qp_decode_depth = "0";
+if (isset($snortcfg['pop_b64_decode_depth']))
+	$pop_b64_decode_depth = $snortcfg['pop_b64_decode_depth'];
+else
+	$pop_b64_decode_depth = "0";
+if (isset($snortcfg['pop_bitenc_decode_depth']))
+	$pop_bitenc_decode_depth = $snortcfg['pop_bitenc_decode_depth'];
+else
+	$pop_bitenc_decode_depth = "0";
+if (isset($snortcfg['pop_uu_decode_depth']))
+	$pop_uu_decode_depth = $snortcfg['pop_uu_decode_depth'];
+else
+	$pop_uu_decode_depth = "0";
+$pop_preproc = <<<EOD
+# POP preprocessor #
+preprocessor pop: \
+	ports { {$pop_ports} } \
+	memcap {$pop_memcap} \
+	qp_decode_depth {$pop_qp_decode_depth} \
+	b64_decode_depth {$pop_b64_decode_depth} \
+	bitenc_decode_depth {$pop_bitenc_decode_depth} \
+	uu_decode_depth {$pop_uu_decode_depth}
+
+EOD;
+
+/* def imap_preprocessor */
+
+$imap_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['imap_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($imap_ports) || empty($imap_ports))
+	$imap_ports = "143";
+
+if (isset($snortcfg['imap_memcap']))
+	$imap_memcap = $snortcfg['imap_memcap'];
+else
+	$imap_memcap = "838860";
+if (isset($snortcfg['imap_qp_decode_depth']))
+	$imap_qp_decode_depth = $snortcfg['imap_qp_decode_depth'];
+else
+	$imap_qp_decode_depth = "0";
+if (isset($snortcfg['imap_b64_decode_depth']))
+	$imap_b64_decode_depth = $snortcfg['imap_b64_decode_depth'];
+else
+	$imap_b64_decode_depth = "0";
+if (isset($snortcfg['imap_bitenc_decode_depth']))
+	$imap_bitenc_decode_depth = $snortcfg['imap_bitenc_decode_depth'];
+else
+	$imap_bitenc_decode_depth = "0";
+if (isset($snortcfg['imap_uu_decode_depth']))
+	$imap_uu_decode_depth = $snortcfg['imap_uu_decode_depth'];
+else
+	$imap_uu_decode_depth = "0";
+$imap_preproc = <<<EOD
+# IMAP preprocessor #
+preprocessor imap: \
+	ports { {$imap_ports} } \
+	memcap {$imap_memcap} \
+	qp_decode_depth {$imap_qp_decode_depth} \
+	b64_decode_depth {$imap_b64_decode_depth} \
+	bitenc_decode_depth {$imap_bitenc_decode_depth} \
+	uu_decode_depth {$imap_uu_decode_depth}
+
+EOD;
+
+/* def smtp_preprocessor */
+
+$smtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['mail_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($smtp_ports) || empty($smtp_ports))
+	$smtp_ports = "25 465 587 691";
+
+if (isset($snortcfg['smtp_memcap']))
+	$smtp_memcap = $snortcfg['smtp_memcap'];
+else
+	$smtp_memcap = "838860";
+if (isset($snortcfg['smtp_max_mime_mem']))
+	$smtp_max_mime_mem = $snortcfg['smtp_max_mime_mem'];
+else
+	$smtp_max_mime_mem = "838860";
+if (isset($snortcfg['smtp_qp_decode_depth']))
+	$smtp_qp_decode_depth = $snortcfg['smtp_qp_decode_depth'];
+else
+	$smtp_qp_decode_depth = "0";
+if (isset($snortcfg['smtp_b64_decode_depth']))
+	$smtp_b64_decode_depth = $snortcfg['smtp_b64_decode_depth'];
+else
+	$smtp_b64_decode_depth = "0";
+if (isset($snortcfg['smtp_bitenc_decode_depth']))
+	$smtp_bitenc_decode_depth = $snortcfg['smtp_bitenc_decode_depth'];
+else
+	$smtp_bitenc_decode_depth = "0";
+if (isset($snortcfg['smtp_uu_decode_depth']))
+	$smtp_uu_decode_depth = $snortcfg['smtp_uu_decode_depth'];
+else
+	$smtp_uu_decode_depth = "0";
+if (isset($snortcfg['smtp_email_hdrs_log_depth']) && $snortcfg['smtp_email_hdrs_log_depth'] != '0')
+	$smtp_email_hdrs_log_depth = $snortcfg['smtp_email_hdrs_log_depth'];
+else
+	$smtp_email_hdrs_log_depth = "0";
+$smtp_boolean_params = "";
+if ($snortcfg['smtp_ignore_data'] == 'on')
+	$smtp_boolean_params .= "\tignore_data \\\n";
+if ($snortcfg['smtp_ignore_tls_data'] == 'on')
+	$smtp_boolean_params .= "\tignore_tls_data \\\n";
+if ($snortcfg['smtp_log_mail_from'] == 'on')
+	$smtp_boolean_params .= "\tlog_mailfrom \\\n";
+if ($snortcfg['smtp_log_rcpt_to'] == 'on')
+	$smtp_boolean_params .= "\tlog_rcptto \\\n";
+if ($snortcfg['smtp_log_filename'] == 'on')
+	$smtp_boolean_params .= "\tlog_filename \\\n";
+if ($snortcfg['smtp_log_email_hdrs'] == 'on')
+	$smtp_boolean_params .= "\tlog_email_hdrs\\\n";
+$smtp_boolean_params = trim($smtp_boolean_params, "\t\n\\");
+$smtp_preprocessor = <<<EOD
+# SMTP preprocessor #
+preprocessor SMTP: \
+	ports { {$smtp_ports} } \
+	inspection_type stateful \
+	normalize cmds \
+	memcap {$smtp_memcap} \
+	max_mime_mem {$smtp_max_mime_mem} \
+	valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT \
+		     NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX QUEU \
+		     STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE \
+		     XQUEU XSTA XTRN XUSR } \
+	normalize_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY \
+			 IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT \
+			 ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 \
+			 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
+	max_header_line_len 1000 \ 
+	max_response_line_len 512 \
+	alt_max_command_line_len 260 { MAIL } \
+	alt_max_command_line_len 300 { RCPT } \
+	alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
+	alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
+	alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX } \
+	alt_max_command_line_len 246 { QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR } \
+	alt_max_command_line_len 246 { XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
+	xlink2state { enable } \
+	{$smtp_boolean_params} \
+	email_hdrs_log_depth {$smtp_email_hdrs_log_depth} \
+	qp_decode_depth {$smtp_qp_decode_depth} \
+	b64_decode_depth {$smtp_b64_decode_depth} \
+	bitenc_decode_depth {$smtp_bitenc_decode_depth} \
+	uu_decode_depth {$smtp_uu_decode_depth}
+
+EOD;
+
+/* def sf_portscan */
+
+$sf_pscan_protocol = "all";
+if (!empty($snortcfg['pscan_protocol']))
+	$sf_pscan_protocol = $snortcfg['pscan_protocol'];
+$sf_pscan_type = "all";
+if (!empty($snortcfg['pscan_type']))
+	$sf_pscan_type = $snortcfg['pscan_type'];
+$sf_pscan_memcap = "10000000";
+if (!empty($snortcfg['pscan_memcap']))
+	$sf_pscan_memcap = $snortcfg['pscan_memcap'];
+$sf_pscan_sense_level = "medium";
+if (!empty($snortcfg['pscan_sense_level']))
+	$sf_pscan_sense_level = $snortcfg['pscan_sense_level'];
+$sf_pscan_ignore_scanners = "\$HOME_NET";
+if (!empty($snortcfg['pscan_ignore_scanners']) && is_alias($snortcfg['pscan_ignore_scanners'])) {
+	$sf_pscan_ignore_scanners = trim(filter_expand_alias($snortcfg['pscan_ignore_scanners']));
+	$sf_pscan_ignore_scanners = preg_replace('/\s+/', ',', trim($sf_pscan_ignore_scanners));
+}
+	
+$sf_portscan = <<<EOD
+# sf Portscan #
+preprocessor sfportscan: \
+	scan_type { {$sf_pscan_type} } \
+	proto  { {$sf_pscan_protocol} } \
+	memcap { {$sf_pscan_memcap} } \
+	sense_level { {$sf_pscan_sense_level} } \
+	ignore_scanners { {$sf_pscan_ignore_scanners} }
+	
+EOD;
+
+/* def ssh_preproc */
+
+$ssh_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssh_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($ssh_ports) || empty($ssh_ports))
+	$ssh_ports = "22";
+$ssh_preproc = <<<EOD
+# SSH preprocessor #
+preprocessor ssh: \
+	server_ports { {$ssh_ports} } \
+	autodetect \
+	max_client_bytes 19600 \
+	max_encrypted_packets 20 \
+	max_server_version_len 100 \
+	enable_respoverflow enable_ssh1crc32 \
+	enable_srvoverflow enable_protomismatch
+
+EOD;
+
+/* def other_preprocs */
+
+$sun_rpc_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sun_rpc_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($sun_rpc_ports) || empty($sun_rpc_ports))
+	$sun_rpc_ports = "111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779";
+$other_preprocs = <<<EOD
+# Other preprocs #
+preprocessor rpc_decode: \
+	{$sun_rpc_ports} \
+	no_alert_multiple_requests \
+	no_alert_large_fragments \
+	no_alert_incomplete
+
+# Back Orifice preprocessor #
+preprocessor bo
+	
+EOD;
+
+/* def dce_rpc_2 */
+
+$dce_rpc_2 = <<<EOD
+# DCE/RPC 2 #
+preprocessor dcerpc2: \
+	memcap 102400, \
+	events [co]
+
+preprocessor dcerpc2_server: default, \
+	policy WinXP, \
+	detect [smb [{$snort_ports['smb_ports']}], \
+	tcp 135, \
+	udp 135, \
+	rpc-over-http-server 593], \
+	autodetect [tcp 1025:, \
+	udp 1025:, \
+	rpc-over-http-server 1025:], \
+	smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]
+	
+EOD;
+
+
+/* def sip_preprocessor */
+
+$sip_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sip_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($sip_ports) || empty($sip_ports))
+	$sip_ports = "5060 5061 5600";
+$sip_preproc = <<<EOD
+# SIP preprocessor #
+preprocessor sip: \
+	max_sessions 40000, \
+	ports { {$sip_ports} }, \
+	methods { invite \
+		  cancel \
+		  ack \
+		  bye \
+		  register \
+		  options \
+		  refer \
+		  subscribe \
+		  update \
+		  join \
+		  info \
+		  message \
+		  notify \
+		  benotify \
+		  do \
+		  qauth \
+		  sprack \
+		  publish \
+		  service \
+		  unsubscribe \
+		  prack }, \
+	max_call_id_len 80, \
+	max_from_len 256, \
+	max_to_len 256, \
+	max_via_len 1024, \
+	max_requestName_len 50, \
+	max_uri_len 512, \
+	ignore_call_channel, \
+	max_content_len 2048, \
+	max_contact_len 512
+
+EOD;
+
+/* def dns_preprocessor */
+
+$dns_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['dns_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($dns_ports) || empty($dns_ports))
+	$dns_ports = "53";
+$dns_preprocessor = <<<EOD
+# DNS preprocessor #
+preprocessor dns: \
+	ports { {$dns_ports} } \
+	enable_rdata_overflow
+	
+EOD;
+
+/* def dnp3_preprocessor */
+
+$dnp3_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['DNP3_PORTS']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($dnp3_ports) || empty($dnp3_ports))
+	$dnp3_ports = "20000";
+$dnp3_preproc = <<<EOD
+# DNP3 preprocessor #
+preprocessor dnp3: \
+	ports { {$dnp3_ports} } \
+	memcap 262144 \
+	check_crc
+	
+EOD;
+
+/* def modbus_preprocessor */
+
+$modbus_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['MODBUS_PORTS']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($modbus_ports) || empty($modbus_ports))
+	$modbus_ports = "502";
+$modbus_preproc = <<<EOD
+# Modbus preprocessor #
+preprocessor modbus: \
+	ports { {$modbus_ports} }
+	
+EOD;
+
+/* def gtp_preprocessor */
+
+$gtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['GTP_PORTS']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($gtp_ports) || empty($gtp_ports))
+	$gtp_ports = "2123 3386 2152";
+$gtp_preproc = <<<EOD
+# GTP preprocessor #
+preprocessor gtp: \
+	ports { {$gtp_ports} }
+	
+EOD;
+
+/* def ssl_preprocessor */
+
+$ssl_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssl_ports']));
+
+// Make sure we have port numbers or else use defaults
+if (!isset($ssl_ports) || empty($ssl_ports))
+	$ssl_ports = "443 465 563 636 989 992 993 994 995 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920";
+$ssl_preproc = <<<EOD
+# SSL preprocessor #
+preprocessor ssl: \
+	ports { {$ssl_ports} }, \
+	trustservers, \
+	noinspect_encrypted 
+
+EOD;
+
+/* def sensitive_data_preprocessor */
+
+if ($snortcfg['sdf_mask_output'] == "on")
+	$sdf_mask_output = "\\\n\tmask_output";
+else
+	$sdf_mask_output = "";
+if (empty($snortcfg['sdf_alert_threshold']))
+	$snortcfg['sdf_alert_threshold'] = 25;
+$sensitive_data = <<<EOD
+# SDF preprocessor #
+preprocessor sensitive_data: \
+	alert_threshold {$snortcfg['sdf_alert_threshold']} {$sdf_mask_output}
+
+EOD;
+
+/* define IP Reputation preprocessor */
+
+if (is_array($snortcfg['blist_files']['item'])) {
+	$blist_files = "";
+	$bIsFirst = TRUE;
+	foreach ($snortcfg['blist_files']['item'] as $blist) {
+		if ($bIsFirst) {
+			$blist_files .= "blacklist " . IPREP_PATH . $blist;
+			$bIsFirst = FALSE;
+		}
+		else
+			$blist_files .= ", \\ \n\tblacklist " . IPREP_PATH . $blist;    
+	}
+}
+if (is_array($snortcfg['wlist_files']['item'])) {
+	$wlist_files = "";
+	$bIsFirst = TRUE;
+	foreach ($snortcfg['wlist_files']['item'] as $wlist) {
+		if ($bIsFirst) {
+			$wlist_files .= "whitelist " . IPREP_PATH . $wlist;
+			$bIsFirst = FALSE;
+		}
+		else
+			$wlist_files .= ", \\ \n\twhitelist " . IPREP_PATH . $wlist;    
+	}
+}
+if (!empty($blist_files))
+	$ip_lists = $blist_files;
+if (!empty($wlist_files))
+	$ip_lists .= ", \\ \n" . $wlist_files;
+if ($snortcfg['iprep_scan_local'] == 'on')
+	$ip_lists .= ", \\ \n\tscan_local";	
+
+$reputation_preproc = <<<EOD
+# IP Reputation preprocessor #
+preprocessor reputation: \
+	memcap {$snortcfg['iprep_memcap']}, \
+	priority {$snortcfg['iprep_priority']}, \
+	nested_ip {$snortcfg['iprep_nested_ip']}, \
+	white {$snortcfg['iprep_white']}, \
+	{$ip_lists}
+
+EOD;
+
+/***************************************/
+/* end of preprocessor string var code */
+/***************************************/
+
+/* define servers as IP variables */
+$snort_servers = array (
+	"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
+	"www_servers" => "\$HOME_NET", "sql_servers" => "\$HOME_NET", "telnet_servers" => "\$HOME_NET",
+	"snmp_servers" => "\$HOME_NET", "ftp_servers" => "\$HOME_NET", "ssh_servers" => "\$HOME_NET",
+	"pop_servers" => "\$HOME_NET", "imap_servers" => "\$HOME_NET", "sip_proxy_ip" => "\$HOME_NET",
+	"sip_servers" => "\$HOME_NET", "rpc_servers" => "\$HOME_NET", "dnp3_server" => "\$HOME_NET",
+	"dnp3_client" => "\$HOME_NET", "modbus_server" => "\$HOME_NET", "modbus_client" => "\$HOME_NET",
+	"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET",
+	"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
+    );
+
+// Change old name from "var" to new name of "ipvar" for IP variables because 
+// Snort is deprecating the old "var" name in newer versions.
+$ipvardef = "";
+foreach ($snort_servers as $alias => $avalue) {
+	if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"])) {
+		$avalue = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
+		$avalue = preg_replace('/\s+/', ',', trim($avalue));
+	}
+	$ipvardef .= "ipvar " . strtoupper($alias) . " [{$avalue}]\n";
+}
+
+$snort_preproc_libs = array(
+	"dce_rpc_2" => "dce2_preproc", "dns_preprocessor" => "dns_preproc", "ftp_preprocessor" => "ftptelnet_preproc", "imap_preproc" => "imap_preproc",
+	"pop_preproc" => "pop_preproc", "reputation_preproc" => "reputation_preproc", "sensitive_data" => "sdf_preproc", 
+	"sip_preproc" => "sip_preproc", "gtp_preproc" => "gtp_preproc", "smtp_preprocessor" => "smtp_preproc", "ssh_preproc" => "ssh_preproc", 
+	"ssl_preproc" => "ssl_preproc", "dnp3_preproc" => "dnp3_preproc", "modbus_preproc" => "modbus_preproc"
+);
+$snort_preproc = array (
+	"perform_stat", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor", "ssl_preproc", "sip_preproc", "gtp_preproc", "ssh_preproc", "sf_portscan", 
+	"dce_rpc_2", "dns_preprocessor", "sensitive_data", "pop_preproc", "imap_preproc", "dnp3_preproc", "modbus_preproc", "reputation_preproc"
+);
+$default_disabled_preprocs = array(
+	"sf_portscan", "gtp_preproc", "sensitive_data", "dnp3_preproc", "modbus_preproc", "reputation_preproc", "perform_stat" 
+);
+$snort_preprocessors = "";
+foreach ($snort_preproc as $preproc) {
+	if ($snortcfg[$preproc] == 'on' || empty($snortcfg[$preproc]) ) {
+
+		/* If preprocessor is not explicitly "on" or "off", then default to "off" if in our default disabled list */
+		if (empty($snortcfg[$preproc]) && in_array($preproc, $default_disabled_preprocs))
+			continue;
+
+		/* NOTE: The $$ is not a bug. It is an advanced feature of php */
+		if (!empty($snort_preproc_libs[$preproc])) {
+			$preproclib = "libsf_" . $snort_preproc_libs[$preproc];
+			if (!file_exists($snort_dirs['dynamicpreprocessor'] . "{$preproclib}.so")) {
+				if (file_exists("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so")) {
+					@copy("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so", "{$snort_dirs['dynamicpreprocessor']}/{$preproclib}.so");
+					$snort_preprocessors .= $$preproc;
+					$snort_preprocessors .= "\n";
+				} else
+					log_error("Could not find the {$preproclib} file. Snort might error out!");
+			} else {
+				$snort_preprocessors .= $$preproc;
+				$snort_preprocessors .= "\n";
+			}
+		} else {
+			$snort_preprocessors .= $$preproc;
+			$snort_preprocessors .= "\n";
+		}
+	}
+}
+// Remove final trailing newline
+$snort_preprocessors = rtrim($snort_preprocessors);
+
+$snort_misc_include_rules = "";
+if (file_exists("{$snortcfgdir}/reference.config"))
+	$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
+if (file_exists("{$snortcfgdir}/classification.config"))
+	$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
+if (!file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") || !file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules")) {
+	$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
+	log_error("[Snort] Seems preprocessor and/or decoder rules are missing, enabling autogeneration of them in conf file.");
+}
+
+/* generate rule sections to load */
+/* The files are always configured so the update process is easier */
+$selected_rules_sections = "include \$RULE_PATH/{$snort_enforcing_rules_file}\n";
+$selected_rules_sections .= "include \$RULE_PATH/{$flowbit_rules_file}\n";
+$selected_rules_sections  .= "include \$RULE_PATH/custom.rules\n";
+
+// Remove trailing newlines
+$snort_misc_include_rules = rtrim($snort_misc_include_rules);
+$selected_rules_sections = rtrim($selected_rules_sections);
+
+$cksumcheck = "all";
+if ($snortcfg['cksumcheck'] == 'on')
+	$cksumcheck = "none";
+
+/* Pull in user-configurable detection config options */
+$cfg_detect_settings = "search-method {$snort_performance} max-pattern-len 20 max_queue_events 5";
+if ($snortcfg['fpm_split_any_any'] == "on")
+	$cfg_detect_settings .= " split-any-any";
+if ($snortcfg['fpm_search_optimize'] == "on")
+	$cfg_detect_settings .= " search-optimize";
+if ($snortcfg['fpm_no_stream_inserts'] == "on")
+	$cfg_detect_settings .= " no_stream_inserts";
+
+/* Pull in user-configurable options for Frag3 preprocessor settings */
+/* Get global Frag3 options first and put into a string */
+$frag3_global = "preprocessor frag3_global: ";
+if (!empty($snortcfg['frag3_memcap']) || $snortcfg['frag3_memcap'] == "0")
+	$frag3_global .= "memcap {$snortcfg['frag3_memcap']}, ";
+else
+	$frag3_global .= "memcap 4194304, ";
+if (!empty($snortcfg['frag3_max_frags']))
+	$frag3_global .= "max_frags {$snortcfg['frag3_max_frags']}";
+else
+	$frag3_global .= "max_frags 8192";
+if ($snortcfg['frag3_detection'] == "off")
+	$frag3_global .= ", disabled";
+
+$frag3_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", 
+				   "timeout" => 60, "min_ttl" => 1, "detect_anomalies" => "on", 
+				   "overlap_limit" => 0, "min_frag_len" => 0 );
+$frag3_engine = "";
+
+// Now iterate configured Frag3 engines and write them to a string if enabled
+if ($snortcfg['frag3_detection'] == "on") {
+	if (!is_array($snortcfg['frag3_engine']['item']))
+		$snortcfg['frag3_engine']['item'] = array();
+
+	// If no frag3 tcp engine is configured, use the default
+	if (empty($snortcfg['frag3_engine']['item']))
+		$snortcfg['frag3_engine']['item'][] = $frag3_default_tcp_engine;
+
+	foreach ($snortcfg['frag3_engine']['item'] as $f => $v) {
+		$frag3_engine .= "preprocessor frag3_engine: ";
+		$frag3_engine .= "policy {$v['policy']}";
+		if ($v['bind_to'] <> "all") {
+			$tmp = trim(filter_expand_alias($v['bind_to']));
+			if (!empty($tmp)) {
+				$tmp = preg_replace('/\s+/', ',', $tmp);
+				if (strpos($tmp, ",") !== false)
+					$frag3_engine .= " \\\n\tbind_to [{$tmp}]";
+				else
+					$frag3_engine .= " \\\n\tbind_to {$tmp}";
+			}
+			else
+				log_error("[snort] WARNING: unable to resolve IP List Alias '{$v['bind_to']}' for Frag3 engine '{$v['name']}' ... using 0.0.0.0 failsafe.");
+		}
+		$frag3_engine .= " \\\n\ttimeout {$v['timeout']}";
+		$frag3_engine .= " \\\n\tmin_ttl {$v['min_ttl']}";
+		if ($v['detect_anomalies'] == "on") {
+			$frag3_engine .= " \\\n\tdetect_anomalies";
+			$frag3_engine .= " \\\n\toverlap_limit {$v['overlap_limit']}";
+			$frag3_engine .= " \\\n\tmin_fragment_length {$v['min_frag_len']}";
+		}
+		// Add newlines to terminate this engine
+		$frag3_engine .= "\n\n";
+	}
+	// Remove trailing newline
+	$frag3_engine = rtrim($frag3_engine);
+}
+
+// Grab any user-customized value for Protocol Aware Flushing (PAF) max PDUs
+$paf_max_pdu_config = "config paf_max: ";
+if (empty($snortcfg['max_paf']) || $snortcfg['max_paf'] == '0')
+	$paf_max_pdu_config .= "0";
+else
+	$paf_max_pdu_config .= $snortcfg['max_paf'];
+
+// Pull in user-configurable options for Stream5 preprocessor settings
+// Get global options first and put into a string
+$stream5_global = "preprocessor stream5_global: \\\n";
+if ($snortcfg['stream5_reassembly'] == "off")
+	$stream5_global .= "\tdisabled, \\\n";
+if ($snortcfg['stream5_track_tcp'] == "off")
+	$stream5_global .= "\ttrack_tcp no,";
+else {
+	$stream5_global .= "\ttrack_tcp yes,";
+	if (!empty($snortcfg['stream5_max_tcp']))
+		$stream5_global .= " \\\n\tmax_tcp {$snortcfg['stream5_max_tcp']},";
+	else
+		$stream5_global .= " \\\n\tmax_tcp 262144,";
+}
+if ($snortcfg['stream5_track_udp'] == "off")
+	$stream5_global .= " \\\n\ttrack_udp no,";
+else {
+	$stream5_global .= " \\\n\ttrack_udp yes,";
+	if (!empty($snortcfg['stream5_max_udp']))
+		$stream5_global .= " \\\n\tmax_udp {$snortcfg['stream5_max_udp']},";
+	else
+		$stream5_global .= " \\\n\tmax_udp 131072,";
+}
+if ($snortcfg['stream5_track_icmp'] == "on") {
+	$stream5_global .= " \\\n\ttrack_icmp yes,";
+	if (!empty($snortcfg['stream5_max_icmp']))
+		$stream5_global .= " \\\n\tmax_icmp {$snortcfg['stream5_max_icmp']},";
+	else
+		$stream5_global .= " \\\n\tmax_icmp 65536,";
+}
+else
+	$stream5_global .= " \\\n\ttrack_icmp no,";
+if (!empty($snortcfg['stream5_mem_cap']))
+	$stream5_global .= " \\\n\tmemcap {$snortcfg['stream5_mem_cap']},";
+else
+	$stream5_global .= " \\\n\tmemcap 8388608,";
+
+if (!empty($snortcfg['stream5_prune_log_max']) || $snortcfg['stream5_prune_log_max'] == '0')
+	$stream5_global .= " \\\n\tprune_log_max {$snortcfg['stream5_prune_log_max']}";
+else
+	$stream5_global .= " \\\n\tprune_log_max 1048576";
+if ($snortcfg['stream5_flush_on_alert'] == "on")
+	$stream5_global .= ", \\\n\tflush_on_alert";
+
+$stream5_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", "timeout" => 30, 
+				     "max_queued_bytes" => 1048576, "detect_anomalies" => "off", "overlap_limit" => 0, 
+				     "max_queued_segs" => 2621, "require_3whs" => "off", "startup_3whs_timeout" => 0, 
+				     "no_reassemble_async" => "off", "dont_store_lg_pkts" => "off", "max_window" => 0, 
+				     "use_static_footprint_sizes" => "off", "check_session_hijacking" => "off", "ports_client" => "default", 
+				     "ports_both" => "default", "ports_server" => "none" );
+$stream5_tcp_engine = "";
+
+// Now iterate configured Stream5 TCP engines and write them to a string if enabled
+if ($snortcfg['stream5_reassembly'] == "on") {
+	if (!is_array($snortcfg['stream5_tcp_engine']['item']))
+		$snortcfg['stream5_tcp_engine']['item'] = array();
+
+	// If no stream5 tcp engine is configured, use the default
+	if (empty($snortcfg['stream5_tcp_engine']['item']))
+		$snortcfg['stream5_tcp_engine']['item'][] = $stream5_default_tcp_engine;
+
+	foreach ($snortcfg['stream5_tcp_engine']['item'] as $f => $v) {
+		$buffer = "preprocessor stream5_tcp: ";
+		$buffer .= "policy {$v['policy']},";
+		if ($v['bind_to'] <> "all") {
+			$tmp = trim(filter_expand_alias($v['bind_to']));
+			if (!empty($tmp)) {
+				$tmp = preg_replace('/\s+/', ',', $tmp);
+				if (strpos($tmp, ",") !== false)
+					$buffer .= " \\\n\tbind_to [{$tmp}],";
+				else
+					$buffer .= " \\\n\tbind_to {$tmp},";
+			}
+			else {
+				log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for Stream5 TCP engine '{$v['name']}' ... skipping this engine.");
+				continue;
+			}
+		}
+		$stream5_tcp_engine .= $buffer;
+		$stream5_tcp_engine .= " \\\n\ttimeout {$v['timeout']},";
+		$stream5_tcp_engine .= " \\\n\toverlap_limit {$v['overlap_limit']},";
+		$stream5_tcp_engine .= " \\\n\tmax_window {$v['max_window']},";
+		$stream5_tcp_engine .= " \\\n\tmax_queued_bytes {$v['max_queued_bytes']},";
+		$stream5_tcp_engine .= " \\\n\tmax_queued_segs {$v['max_queued_segs']}";
+		if ($v['use_static_footprint_sizes'] == "on")
+			$stream5_tcp_engine .= ", \\\n\tuse_static_footprint_sizes";
+		if ($v['check_session_hijacking'] == "on")
+			$stream5_tcp_engine .= ", \\\n\tcheck_session_hijacking";
+		if ($v['dont_store_lg_pkts'] == "on")
+			$stream5_tcp_engine .= ", \\\n\tdont_store_large_packets";
+		if ($v['no_reassemble_async'] == "on")
+			$stream5_tcp_engine .= ", \\\n\tdont_reassemble_async";
+		if ($v['detect_anomalies'] == "on")
+			$stream5_tcp_engine .= ", \\\n\tdetect_anomalies";
+		if ($v['require_3whs'] == "on")
+			$stream5_tcp_engine .= ", \\\n\trequire_3whs {$v['startup_3whs_timeout']}";
+		if (!empty($v['ports_client'])) {
+			$stream5_tcp_engine .= ", \\\n\tports client";
+			if ($v['ports_client'] == " all")
+				$stream5_tcp_engine .= " all";
+			elseif ($v['ports_client'] == "default")
+				$stream5_tcp_engine .= " {$stream5_ports_client}";
+			else {
+				$tmp = trim(filter_expand_alias($v['ports_client']));
+				if (!empty($tmp))
+					$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
+				else {
+					$stream5_tcp_engine .= " {$stream5_ports_client}";
+					log_error("[snort] WARNING: unable to resolve Ports Client Alias [{$v['ports_client']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
+				}
+			}
+		}
+		if (!empty($v['ports_both'])) {
+			$stream5_tcp_engine .= ", \\\n\tports both";
+			if ($v['ports_both'] == " all")
+				$stream5_tcp_engine .= " all";
+			elseif ($v['ports_both'] == "default")
+				$stream5_tcp_engine .= " {$stream5_ports_both}";
+			else {
+				$tmp = trim(filter_expand_alias($v['ports_both']));
+				if (!empty($tmp))
+					$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
+				else {
+					$stream5_tcp_engine .= " {$stream5_ports_both}";
+					log_error("[snort] WARNING: unable to resolve Ports Both Alias [{$v['ports_both']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
+				}
+			}
+		}
+		if (!empty($v['ports_server']) && $v['ports_server'] <> "none" && $v['ports_server'] <> "default") {
+			if ($v['ports_server'] == " all") {
+				$stream5_tcp_engine .= ", \\\n\tports server";
+				$stream5_tcp_engine .= " all";
+			}
+			else {
+				$tmp = trim(filter_expand_alias($v['ports_server']));
+				if (!empty($tmp)) {
+					$stream5_tcp_engine .= ", \\\n\tports server";
+					$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
+				}
+				else
+					log_error("[snort] WARNING: unable to resolve Ports Server Alias [{$v['ports_server']}] for Stream5 TCP engine '{$v['name']}' ... defaulting to none.");
+			}
+		}
+
+		// Make sure the "ports" parameter is set, or else default to a safe value
+		if (strpos($stream5_tcp_engine, "ports ") === false)
+			$stream5_tcp_engine .= ", \\\n\tports both all";
+
+		// Add a pair of newlines to terminate this engine
+		$stream5_tcp_engine .= "\n\n";
+	}
+	// Trim off the final trailing newline
+	$stream5_tcp_engine = rtrim($stream5_tcp_engine);
+}
+
+// Configure the Stream5 UDP engine if it and Stream5 reassembly are enabled
+if ($snortcfg['stream5_track_udp'] == "off" || $snortcfg['stream5_reassembly'] == "off")
+	$stream5_udp_engine = "";
+else {
+	$stream5_udp_engine = "preprocessor stream5_udp: ";
+	if (!empty($snortcfg['stream5_udp_timeout'])) 
+		$stream5_udp_engine .= "timeout {$snortcfg['stream5_udp_timeout']}";
+	else
+		$stream5_udp_engine .= "timeout 30";
+}
+
+// Configure the Stream5 ICMP engine if it and Stream5 reassembly are enabled
+if ($snortcfg['stream5_track_icmp'] == "on" && $snortcfg['stream5_reassembly'] == "on") {
+	$stream5_icmp_engine = "preprocessor stream5_icmp: ";
+	if (!empty($snortcfg['stream5_icmp_timeout'])) 
+		$stream5_icmp_engine .= "timeout {$snortcfg['stream5_icmp_timeout']}";
+	else
+		$stream5_icmp_engine .= "timeout 30";
+}
+else
+	$stream5_icmp_engine = "";
+
+// Check for and configure Host Attribute Table if enabled
+$host_attrib_config = "";
+if ($snortcfg['host_attribute_table'] == "on" && !empty($snortcfg['host_attribute_data'])) {
+	@file_put_contents("{$snortcfgdir}/host_attributes", base64_decode($snortcfg['host_attribute_data']));
+	$host_attrib_config = "# Host Attribute Table #\n";
+	$host_attrib_config .= "attribute_table filename {$snortcfgdir}/host_attributes\n";
+	if (!empty($snortcfg['max_attribute_hosts']))
+		$host_attrib_config .= "config max_attribute_hosts: {$snortcfg['max_attribute_hosts']}\n";
+	if (!empty($snortcfg['max_attribute_services_per_host']))
+		$host_attrib_config .= "config max_attribute_services_per_host: {$snortcfg['max_attribute_services_per_host']}";
+}
+
+// Configure the HTTP_INSPECT preprocessor
+// Get global options first and put into a string
+$http_inspect_global = "preprocessor http_inspect: global ";
+if ($snortcfg['http_inspect'] == "off")
+	$http_inspect_global .= "disabled ";
+$http_inspect_global .= "\\\n\tiis_unicode_map unicode.map 1252 \\\n";
+$http_inspect_global .= "\tcompress_depth 65535 \\\n";
+$http_inspect_global .= "\tdecompress_depth 65535 \\\n";
+if (!empty($snortcfg['http_inspect_memcap']))
+	$http_inspect_global .= "\tmemcap {$snortcfg['http_inspect_memcap']} \\\n";
+else
+	$http_inspect_global .= "\tmemcap 150994944 \\\n";
+if (!empty($snortcfg['http_inspect_max_gzip_mem']))
+	$http_inspect_global .= "\tmax_gzip_mem {$snortcfg['http_inspect_max_gzip_mem']}";
+else
+	$http_inspect_global .= "\tmax_gzip_mem 838860";
+if ($snortcfg['http_inspect_proxy_alert'] == "on")
+	$http_inspect_global .= " \\\n\tproxy_alert";
+
+$http_inspect_default_engine = array( "name" => "default", "bind_to" => "all", "server_profile" => "all", "enable_xff" => "off", 
+				      "log_uri" => "off", "log_hostname" => "off", "server_flow_depth" => 65535, "enable_cookie" => "on", 
+				      "client_flow_depth" => 1460, "extended_response_inspection" => "on", "no_alerts" => "off", 
+				      "unlimited_decompress" => "on", "inspect_gzip" => "on", "normalize_cookies" =>"on", "normalize_headers" => "on", 
+				      "normalize_utf" => "on", "normalize_javascript" => "on", "allow_proxy_use" => "off", "inspect_uri_only" => "off", 
+				      "max_javascript_whitespaces" => 200, "post_depth" => -1, "max_headers" => 0, "max_spaces" => 0, 
+				      "max_header_length" => 0, "ports" => "default" );
+$http_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['http_ports']));
+$http_inspect_servers = "";
+
+// Iterate configured HTTP_INSPECT servers and write them to string if HTTP_INSPECT enabled
+if ($snortcfg['http_inspect'] <> "off") {
+	if (!is_array($snortcfg['http_inspect_engine']['item']))
+		$snortcfg['http_inspect_engine']['item'] = array();
+
+	// If no http_inspect_engine is configured, use the default
+	if (empty($snortcfg['http_inspect_engine']['item']))
+		$snortcfg['http_inspect_engine']['item'][] = $http_inspect_default_engine;
+
+	foreach ($snortcfg['http_inspect_engine']['item'] as $f => $v) {
+		$buffer = "preprocessor http_inspect_server: \\\n";
+		if ($v['name'] == "default")
+			$buffer .= "\tserver default \\\n";
+		elseif (is_alias($v['bind_to'])) {
+			$tmp = trim(filter_expand_alias($v['bind_to']));
+			if (!empty($tmp)) {
+				$tmp = preg_replace('/\s+/', ' ', $tmp);
+					$buffer .= "\tserver { {$tmp} } \\\n";
+			}
+			else {
+				log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
+				continue;
+			}
+		}
+		else {
+				log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
+				continue;
+		}
+		$http_inspect_servers .= $buffer;
+		$http_inspect_servers .= "\tprofile {$v['server_profile']} \\\n";
+
+		if ($v['no_alerts'] == "on")
+			$http_inspect_servers .= "\tno_alerts \\\n";
+
+		if ($v['ports'] == "default" || empty($v['ports']))
+			$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
+		elseif (is_alias($v['ports'])) {
+			$tmp = trim(filter_expand_alias($v['ports']));
+			if (!empty($tmp)) {
+				$tmp = preg_replace('/\s+/', ' ', $tmp);
+				$tmp = snort_expand_port_range($tmp, ' ');
+				$http_inspect_servers .= "\tports { {$tmp} } \\\n";
+			}
+			else {
+				log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
+				$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
+			}
+		}
+		else {
+				log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
+				$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
+		}
+
+		$http_inspect_servers .= "\tserver_flow_depth {$v['server_flow_depth']} \\\n";
+		$http_inspect_servers .= "\tclient_flow_depth {$v['client_flow_depth']} \\\n";
+		$http_inspect_servers .= "\thttp_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \\\n";
+		$http_inspect_servers .= "\tpost_depth {$v['post_depth']} \\\n";
+		$http_inspect_servers .= "\tmax_headers {$v['max_headers']} \\\n";
+		$http_inspect_servers .= "\tmax_header_length {$v['max_header_length']} \\\n";
+		$http_inspect_servers .= "\tmax_spaces {$v['max_spaces']}";
+		if ($v['enable_xff'] == "on")
+			$http_inspect_servers .= " \\\n\tenable_xff";
+		if ($v['enable_cookie'] == "on")
+			$http_inspect_servers .= " \\\n\tenable_cookie";
+		if ($v['normalize_cookies'] == "on")
+			$http_inspect_servers .= " \\\n\tnormalize_cookies";
+		if ($v['normalize_headers'] == "on")
+			$http_inspect_servers .= " \\\n\tnormalize_headers";
+		if ($v['normalize_utf'] == "on")
+			$http_inspect_servers .= " \\\n\tnormalize_utf";
+		if ($v['allow_proxy_use'] == "on")
+			$http_inspect_servers .= " \\\n\tallow_proxy_use";
+		if ($v['inspect_uri_only'] == "on")
+			$http_inspect_servers .= " \\\n\tinspect_uri_only";
+		if ($v['extended_response_inspection'] == "on") {
+			$http_inspect_servers .= " \\\n\textended_response_inspection";
+			if ($v['inspect_gzip'] == "on") {
+				$http_inspect_servers .= " \\\n\tinspect_gzip";
+				if ($v['unlimited_decompress'] == "on")
+					$http_inspect_servers .= " \\\n\tunlimited_decompress";
+			}
+			if ($v['normalize_javascript'] == "on") {
+				$http_inspect_servers .= " \\\n\tnormalize_javascript";
+				$http_inspect_servers .= " \\\n\tmax_javascript_whitespaces {$v['max_javascript_whitespaces']}";
+			}
+		}
+		if ($v['log_uri'] == "on")
+			$http_inspect_servers .= " \\\n\tlog_uri";
+		if ($v['log_hostname'] == "on")
+			$http_inspect_servers .= " \\\n\tlog_hostname";
+
+		// Add a pair of trailing newlines to terminate this server config
+		$http_inspect_servers .= "\n\n";
+	}
+	/* Trim off the final trailing newline */
+	$http_inspect_server = rtrim($http_inspect_server);
+}
+
+?>
diff --git a/config/snort/snort_interfaces.php b/config/snort/snort_interfaces.php
index c82ec57e..8b2ca2bb 100755
--- a/config/snort/snort_interfaces.php
+++ b/config/snort/snort_interfaces.php
@@ -45,6 +45,9 @@ $a_nat = &$config['installedpackages']['snortglobal']['rule'];
 // Calculate the index of the next added Snort interface
 $id_gen = count($config['installedpackages']['snortglobal']['rule']);
 
+// Get list of configured firewall interfaces
+$ifaces = get_configured_interface_list();
+
 if (isset($_POST['del_x'])) {
 	/* Delete selected Snort interfaces */
 	if (is_array($_POST['rule'])) {
@@ -73,7 +76,7 @@ if (isset($_POST['del_x'])) {
 			snort_create_rc();
 		else {
 			conf_mount_rw();
-			@unlink("{$rcdir}/snort.sh");
+			@unlink("{$rcdir}snort.sh");
 			conf_mount_ro();
 		}
 	  
@@ -173,18 +176,33 @@ include_once("fbegin.inc");
 		<tr id="frheader">
 			<td width="3%" class="list">&nbsp;</td>
 			<td width="10%" class="listhdrr"><?php echo gettext("Interface"); ?></td>
-			<td width="13%" class="listhdrr"><?php echo gettext("Snort"); ?></td>
+			<td width="14%" class="listhdrr"><?php echo gettext("Snort"); ?></td>
 			<td width="10%" class="listhdrr"><?php echo gettext("Performance"); ?></td>
 			<td width="10%" class="listhdrr"><?php echo gettext("Block"); ?></td>
 			<td width="12%" class="listhdrr"><?php echo gettext("Barnyard2"); ?></td>
-			<td width="30%" class="listhdr"><?php echo gettext("Description"); ?></td>
-			<td width="3%" class="list">
+			<td width="32%" class="listhdr"><?php echo gettext("Description"); ?></td>
+			<td class="list">
 			<table border="0" cellspacing="0" cellpadding="0">
 				<tr>
-					<td></td>
-					<td align="center" valign="middle"><a href="snort_interfaces_edit.php?id=<?php echo $id_gen;?>"><img
-					src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif"
-					width="17" height="17" border="0" title="<?php echo gettext('Add Snort interface mapping');?>"></a></td>
+					<td class="list" valign="middle">
+						<?php if ($id_gen < count($ifaces)): ?>
+							<a href="snort_interfaces_edit.php?id=<?php echo $id_gen;?>">
+							<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif"
+							width="17" height="17" border="0" title="<?php echo gettext('Add Snort interface mapping');?>"></a>
+						<?php else: ?>
+							<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus_d.gif" width="17" height="17" border="0" 
+							title="<?php echo gettext('No available interfaces for a new Snort mapping');?>">
+						<?php endif; ?>
+					</td>
+					<td class="list" valign="middle">
+						<?php if ($id_gen == 0): ?>
+							<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_x_d.gif" width="17" height="17" " border="0">
+						<?php else: ?>
+							<input name="del" type="image" src="../themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" 
+							width="17" height="17" title="<?php echo gettext("Delete selected Snort interface mapping(s)"); ?>"
+							onclick="return intf_del()">
+						<?php endif; ?>
+					</td>
 				</tr>
 			</table>
 			</td>
@@ -317,10 +335,20 @@ include_once("fbegin.inc");
 			<td valign="middle" class="list" nowrap>
 			<table border="0" cellspacing="0" cellpadding="0">
 				<tr>
-					<td><a href="snort_interfaces_edit.php?id=<?=$i;?>"><img
+					<td class="list" valign="middle"><a href="snort_interfaces_edit.php?id=<?=$i;?>"><img
 						src="/themes/<?= $g['theme']; ?>/images/icons/icon_e.gif"
 						width="17" height="17" border="0" title="<?php echo gettext('Edit Snort interface mapping'); ?>"></a>
 					</td>
+					<td class="list" valign="middle">
+						<?php if ($id_gen < count($ifaces)): ?>
+							<a href="snort_interfaces_edit.php?id=<?=$i;?>&action=dup">
+							<img src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif"
+							width="17" height="17" border="0" title="<?php echo gettext('Add new interface mapping based on this one'); ?>"></a>
+						<?php else: ?>
+							<img src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus_d.gif" width="17" height="17" border="0" 
+							title="<?php echo gettext('No available interfaces for a new Snort mapping');?>">
+						<?php endif; ?>
+					</td>
 				</tr>
 			</table>
 			</td>	
@@ -337,14 +365,25 @@ include_once("fbegin.inc");
 			<td class="list" valign="middle" nowrap>
 				<table border="0" cellspacing="0" cellpadding="0">
 					<tr>
-						<td><?php if ($nnats == 0): ?><img
-						src="../themes/<?= $g['theme']; ?>/images/icons/icon_x_d.gif"
-						width="17" height="17" " border="0">
-						<?php else: ?>
-						<input name="del" type="image" src="../themes/<?= $g['theme']; ?>/images/icons/icon_x.gif"
-						width="17" height="17" title="<?php echo gettext("Delete selected Snort interface mapping(s)"); ?>"
-						onclick="return intf_del()">
-						<?php endif; ?></td>
+						<td class="list">
+							<?php if ($id_gen < count($ifaces)): ?>
+								<a href="snort_interfaces_edit.php?id=<?php echo $id_gen;?>">
+								<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif"
+								width="17" height="17" border="0" title="<?php echo gettext('Add Snort interface mapping');?>"></a>
+							<?php else: ?>
+								<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus_d.gif" width="17" height="17" border="0" 
+								title="<?php echo gettext('No available interfaces for a new Snort mapping');?>">
+							<?php endif; ?>
+						</td>
+						<td class="list">
+							<?php if ($id_gen == 0): ?>
+								<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_x_d.gif" width="17" height="17" " border="0">
+							<?php else: ?>
+								<input name="del" type="image" src="../themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" 
+								width="17" height="17" title="<?php echo gettext("Delete selected Snort interface mapping(s)"); ?>"
+								onclick="return intf_del()">
+							<?php endif; ?>
+						</td>
 					</tr>
 				</table>
 			</td>
diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php
index 4c868844..fb573a73 100755
--- a/config/snort/snort_interfaces_edit.php
+++ b/config/snort/snort_interfaces_edit.php
@@ -55,6 +55,13 @@ if (is_null($id)) {
         exit;
 }
 
+if (isset($_POST['action']))
+	$action = htmlspecialchars($_POST['action'], ENT_QUOTES | ENT_HTML401);
+elseif (isset($_GET['action']))
+	$action = htmlspecialchars($_GET['action'], ENT_QUOTES | ENT_HTML401);
+else
+	$action = "";
+
 $pconfig = array();
 if (empty($snortglob['rule'][$id]['uuid'])) {
 	/* Adding new interface, so flag rules to build. */
@@ -107,7 +114,36 @@ if (empty($pconfig['blockoffendersip']))
 if (empty($pconfig['performance']))
 	$pconfig['performance'] = "ac-bnfa";
 
-if ($_POST["save"]) {
+// See if creating a new interface by duplicating an existing one
+if (strcasecmp($action, 'dup') == 0) {
+
+	// Try to pick the next available physical interface to use
+	$ifaces = get_configured_interface_list();
+	$ifrules = array();
+	foreach($a_rule as $r)
+		$ifrules[] = $r['interface'];
+	foreach ($ifaces as $i) {
+		if (!in_array($i, $ifrules)) {
+			$pconfig['interface'] = $i;
+			$pconfig['enable'] = 'on';
+			$pconfig['descr'] = strtoupper($i);
+			break;
+		}
+	}
+	if (count($ifrules) == count($ifaces)) {
+		$input_errors[] = gettext("No more available interfaces to configure for Snort!");
+		$interfaces = array();
+		$pconfig = array();
+	}
+
+	// Set Home Net, External Net, Suppress List and Pass List to defaults
+	unset($pconfig['suppresslistname']);
+	unset($pconfig['whitelistname']);
+	unset($pconfig['homelistname']);
+	unset($pconfig['externallistname']);
+}
+
+if ($_POST["save"] && !$input_errors) {
 	if (!isset($_POST['interface']))
 		$input_errors[] = "Interface is mandatory";
 
@@ -121,8 +157,28 @@ if ($_POST["save"]) {
 		}
 	}
 
+	// If Snort is disabled on this interface, stop any running instance,
+	// save the change, and exit.
+	if ($_POST['enable'] != 'on') {
+		$a_rule[$id]['enable'] = $_POST['enable'] ? 'on' : 'off';
+		snort_stop($a_rule[$id], get_real_interface($a_rule[$id]['interface']));
+		write_config("Snort pkg: modified interface configuration for {$a_rule[$id]['interface']}.");
+		$rebuild_rules = false;
+		sync_snort_package_config();
+		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
+		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
+		header( 'Cache-Control: no-store, no-cache, must-revalidate' );
+		header( 'Cache-Control: post-check=0, pre-check=0', false );
+		header( 'Pragma: no-cache' );
+		header("Location: /snort/snort_interfaces.php");
+		exit;
+	}
+
 	/* if no errors write to conf */
 	if (!$input_errors) {
+		/* Most changes don't require a rules rebuild, so default to "off" */
+		$rebuild_rules = false;
+
 		$natent = $a_rule[$id];
 		$natent['interface'] = $_POST['interface'];
 		$natent['enable'] = $_POST['enable'] ? 'on' : 'off';
@@ -157,7 +213,7 @@ if ($_POST["save"]) {
 		if ($_POST['fpm_no_stream_inserts'] == "on") { $natent['fpm_no_stream_inserts'] = 'on'; }else{ $natent['fpm_no_stream_inserts'] = 'off'; }
 
 		$if_real = get_real_interface($natent['interface']);
-		if (isset($id) && $a_rule[$id]) {
+		if (isset($id) && $a_rule[$id] && $action == '') {
 			// See if moving an existing Snort instance to another physical interface
 			if ($natent['interface'] != $a_rule[$id]['interface']) {
 				$oif_real = get_real_interface($a_rule[$id]['interface']);
@@ -173,7 +229,15 @@ if ($_POST["save"]) {
 				conf_mount_ro();
 			}
 			$a_rule[$id] = $natent;
-		} else {
+		}
+		elseif (strcasecmp($action, 'dup') == 0) {
+			// Duplicating a new interface, so set flag to build new rules
+			$rebuild_rules = true;
+
+			// Add the new duplicated interface configuration to the [rule] array in config
+			$a_rule[] = $natent;
+		}
+		else {
 			// Adding new interface, so set required interface configuration defaults
 			$frag3_eng = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", 
 					    "timeout" => 60, "min_ttl" => 1, "detect_anomalies" => "on", 
@@ -221,11 +285,35 @@ if ($_POST["save"]) {
 			$natent['ftp_server_engine']['item'][] = $ftp_server_eng;
 
 			$natent['smtp_preprocessor'] = 'on';
+			$natent['smtp_memcap'] = "838860";
+			$natent['smtp_max_mime_mem'] = "838860";
+			$natent['smtp_b64_decode_depth'] = "0";
+			$natent['smtp_qp_decode_depth'] = "0";
+			$natent['smtp_bitenc_decode_depth'] = "0";
+			$natent['smtp_uu_decode_depth'] = "0";
+			$natent['smtp_email_hdrs_log_depth'] = "1464";
+			$natent['smtp_ignore_data'] = 'off';
+			$natent['smtp_ignore_tls_data'] = 'on';
+			$natent['smtp_log_mail_from'] = 'on';
+			$natent['smtp_log_rcpt_to'] = 'on';
+			$natent['smtp_log_filename'] = 'on';
+			$natent['smtp_log_email_hdrs'] = 'on';
+
 			$natent['dce_rpc_2'] = 'on';
 			$natent['dns_preprocessor'] = 'on';
 			$natent['ssl_preproc'] = 'on';
 			$natent['pop_preproc'] = 'on';
+			$natent['pop_memcap'] = "838860";
+			$natent['pop_b64_decode_depth'] = "0";
+			$natent['pop_qp_decode_depth'] = "0";
+			$natent['pop_bitenc_decode_depth'] = "0";
+			$natent['pop_uu_decode_depth'] = "0";
 			$natent['imap_preproc'] = 'on';
+			$natent['imap_memcap'] = "838860";
+			$natent['imap_b64_decode_depth'] = "0";
+			$natent['imap_qp_decode_depth'] = "0";
+			$natent['imap_bitenc_decode_depth'] = "0";
+			$natent['imap_uu_decode_depth'] = "0";
 			$natent['sip_preproc'] = 'on';
 			$natent['other_preprocs'] = 'on';
 
@@ -275,9 +363,6 @@ if ($_POST["save"]) {
 		/* Save configuration changes */
 		write_config("Snort pkg: modified interface configuration for {$natent['interface']}.");
 
-		/* Most changes don't require a rules rebuild, so default to "off" */
-		$rebuild_rules = false;
-
 		/* Update snort.conf and snort.sh files for this interface */
 		sync_snort_package_config();
 
@@ -326,6 +411,7 @@ include_once("head.inc");
 
 <form action="snort_interfaces_edit.php" method="post" name="iform" id="iform">
 <input name="id" type="hidden" value="<?=$id;?>"/>
+<input name="action" type="hidden" value="<?=$action;?>"/>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr><td>
 <?php
diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php
index 69a182bd..195e1a5e 100644
--- a/config/snort/snort_interfaces_global.php
+++ b/config/snort/snort_interfaces_global.php
@@ -63,6 +63,8 @@ if (empty($pconfig['snortloglimit']))
 	$pconfig['snortloglimit'] = 'on';
 if (!isset($pconfig['rule_update_starttime']))
 	$pconfig['rule_update_starttime'] = '00:05';
+if (!isset($config['installedpackages']['snortglobal']['forcekeepsettings']))
+	$pconfig['forcekeepsettings'] = 'on';
 
 if ($_POST['rule_update_starttime']) {
 	if (!preg_match('/^([01]?[0-9]|2[0-3]):?([0-5][0-9])$/', $_POST['rule_update_starttime']))
@@ -217,8 +219,8 @@ if ($input_errors)
 			<td><span class="vexpl"><?php echo gettext("Snort VRT free Registered User or paid Subscriber rules"); ?></span></td>
 		<tr>
 			<td>&nbsp;</td>
-			<td><a href="https://www.snort.org/signup" target="_blank"><?php echo gettext("Sign Up for a free Registered User Rule Account"); ?> </a><br/>
-			<a href="http://www.snort.org/vrt/buy-a-subscription" target="_blank">
+			<td><a href="https://www.snort.org/users/sign_up" target="_blank"><?php echo gettext("Sign Up for a free Registered User Rule Account"); ?> </a><br/>
+			<a href="https://www.snort.org/products" target="_blank">
 			<?php echo gettext("Sign Up for paid Sourcefire VRT Certified Subscriber Rules"); ?></a></td>
 		</tr>
 		</table>
@@ -390,7 +392,7 @@ if ($input_errors)
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Keep Snort Settings After Deinstall"); ?></td>
 	<td width="78%" class="vtable"><input name="forcekeepsettings"
 		id="forcekeepsettings" type="checkbox" value="yes"
-		<?php if ($config['installedpackages']['snortglobal']['forcekeepsettings']=="on") echo "checked"; ?>
+		<?php if ($pconfig['forcekeepsettings']=="on") echo "checked"; ?>
 		>&nbsp;&nbsp;<?php echo gettext("Settings will not be removed during package deinstallation."); ?></td>
 </tr>
 <tr>
diff --git a/config/snort/snort_ip_reputation.php b/config/snort/snort_ip_reputation.php
index 3de8c661..c3536e89 100644
--- a/config/snort/snort_ip_reputation.php
+++ b/config/snort/snort_ip_reputation.php
@@ -162,7 +162,9 @@ if ($_POST['save'] || $_POST['apply']) {
 
 		// Update the snort conf file for this interface
 		$rebuild_rules = false;
+		conf_mount_rw();
 		snort_generate_conf($a_nat[$id]);
+		conf_mount_ro();
 
 		// Soft-restart Snort to live-load new variables
 		snort_reload_config($a_nat[$id]);
diff --git a/config/snort/snort_migrate_config.php b/config/snort/snort_migrate_config.php
index d524e9f3..af02261f 100644
--- a/config/snort/snort_migrate_config.php
+++ b/config/snort/snort_migrate_config.php
@@ -357,6 +357,100 @@ foreach ($rule as &$r) {
 		$updated_cfg = true;
 	}
 
+	// Migrate new POP3 preprocessor parameter settings
+	if (empty($pconfig['pop_memcap'])) {
+		$pconfig['pop_memcap'] = "838860";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['pop_b64_decode_depth']) && $pconfig['pop_b64_decode_depth'] != '0') {
+		$pconfig['pop_b64_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['pop_qp_decode_depth']) && $pconfig['pop_qp_decode_depth'] != '0') {
+		$pconfig['pop_qp_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['pop_bitenc_decode_depth']) && $pconfig['pop_bitenc_decode_depth'] != '0') {
+		$pconfig['pop_bitenc_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['pop_uu_decode_depth']) && $pconfig['pop_uu_decode_depth'] != '0') {
+		$pconfig['pop_uu_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+
+	// Migrate new IMAP preprocessor parameter settings
+	if (empty($pconfig['imap_memcap'])) {
+		$pconfig['imap_memcap'] = "838860";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['imap_b64_decode_depth']) && $pconfig['imap_b64_decode_depth'] != '0') {
+		$pconfig['imap_b64_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['imap_qp_decode_depth']) && $pconfig['imap_qp_decode_depth'] != '0') {
+		$pconfig['imap_qp_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['imap_bitenc_decode_depth']) && $pconfig['imap_bitenc_decode_depth'] != '0') {
+		$pconfig['imap_bitenc_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['imap_uu_decode_depth']) && $pconfig['imap_uu_decode_depth'] != '0') {
+		$pconfig['imap_uu_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+
+	// Migrate new SMTP preprocessor parameter settings
+	if (empty($pconfig['smtp_memcap'])) {
+		$pconfig['smtp_memcap'] = "838860";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_max_mime_mem'])) {
+		$pconfig['smtp_max_mime_mem'] = "838860";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_b64_decode_depth'])) {
+		$pconfig['smtp_b64_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_qp_decode_depth'])) {
+		$pconfig['smtp_qp_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_bitenc_decode_depth'])) {
+		$pconfig['smtp_bitenc_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_uu_decode_depth'])) {
+		$pconfig['smtp_uu_decode_depth'] = "0";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_email_hdrs_log_depth']) && $pconfig['smtp_email_hdrs_log_depth'] != '0') {
+		$pconfig['smtp_email_hdrs_log_depth'] = "1464";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_ignore_tls_data'])) {
+		$pconfig['smtp_ignore_tls_data'] = 'on';
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_log_mail_from'])) {
+		$pconfig['smtp_log_mail_from'] = 'on';
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_log_rcpt_to'])) {
+		$pconfig['smtp_log_rcpt_to'] = 'on';
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_log_filename'])) {
+		$pconfig['smtp_log_filename'] = 'on';
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_log_email_hdrs'])) {
+		$pconfig['smtp_log_email_hdrs'] = 'on';
+		$updated_cfg = true;
+	}
+
 	// Save the new configuration data into the $config array pointer
 	$r = $pconfig;
 }
@@ -365,7 +459,7 @@ unset($r);
 
 // Write out the new configuration to disk if we changed anything
 if ($updated_cfg) {
-	$config['installedpackages']['snortglobal']['snort_config_ver'] = "3.0.13";
+	$config['installedpackages']['snortglobal']['snort_config_ver'] = "3.1.2";
 	log_error("[Snort] Saving configuration settings in new format...");
 	write_config("Snort pkg: migrate existing settings to new format as part of package upgrade.");
 	log_error("[Snort] Settings successfully migrated to new configuration format...");
diff --git a/config/snort/snort_passlist_edit.php b/config/snort/snort_passlist_edit.php
index f501e0fc..d5b89877 100644
--- a/config/snort/snort_passlist_edit.php
+++ b/config/snort/snort_passlist_edit.php
@@ -39,6 +39,8 @@
 require_once("guiconfig.inc");
 require_once("/usr/local/pkg/snort/snort.inc");
 
+$pconfig = array();
+
 if ($_POST['cancel']) {
 	header("Location: /snort/snort_passlist.php");
 	exit;
@@ -52,24 +54,63 @@ $a_passlist = &$config['installedpackages']['snortglobal']['whitelist']['item'];
 
 if (isset($_POST['id']) && is_numericint($_POST['id']))
 	$id = $_POST['id'];
-elseif (isset($_GET['id']) && is_numericint($_GET['id']))
+elseif (isset($_GET['id']) && is_numericint($_GET['id'])) {
 	$id = htmlspecialchars($_GET['id']);
+}
 
 /* Should never be called without identifying list index, so bail */
 if (is_null($id)) {
-	header("Location: /snort/snort_interfaces_whitelist.php");
+	header("Location: /snort/snort_passlist.php");
 	exit;
 }
 
+if (isset($id) && isset($a_passlist[$id])) {
+	/* Retrieve saved settings */
+	$pconfig['name'] = $a_passlist[$id]['name'];
+	$pconfig['uuid'] = $a_passlist[$id]['uuid'];
+	$pconfig['address'] = $a_passlist[$id]['address'];
+	$pconfig['descr'] = html_entity_decode($a_passlist[$id]['descr']);
+	$pconfig['localnets'] = $a_passlist[$id]['localnets'];
+	$pconfig['wanips'] = $a_passlist[$id]['wanips'];
+	$pconfig['wangateips'] = $a_passlist[$id]['wangateips'];
+	$pconfig['wandnsips'] = $a_passlist[$id]['wandnsips'];
+	$pconfig['vips'] = $a_passlist[$id]['vips'];
+	$pconfig['vpnips'] = $a_passlist[$id]['vpnips'];
+}
+
+// Check for returned "selected alias" if action is import
+if ($_GET['act'] == "import") {
+
+	// Retrieve previously typed values we passed to SELECT ALIAS page
+	$pconfig['name'] = htmlspecialchars($_GET['name']);
+	$pconfig['uuid'] = htmlspecialchars($_GET['uuid']);
+	$pconfig['address'] = htmlspecialchars($_GET['address']);
+	$pconfig['descr'] = htmlspecialchars($_GET['descr']);
+	$pconfig['localnets'] = htmlspecialchars($_GET['localnets'])? 'yes' : 'no';
+	$pconfig['wanips'] = htmlspecialchars($_GET['wanips'])? 'yes' : 'no';
+	$pconfig['wangateips'] = htmlspecialchars($_GET['wangateips'])? 'yes' : 'no';
+	$pconfig['wandnsips'] = htmlspecialchars($_GET['wandnsips'])? 'yes' : 'no';
+	$pconfig['vips'] = htmlspecialchars($_GET['vips'])? 'yes' : 'no';
+	$pconfig['vpnips'] = htmlspecialchars($_GET['vpnips'])? 'yes' : 'no';
+
+	// Now retrieve the "selected alias" returned from SELECT ALIAS page
+	if ($_GET['varname'] == "address" && isset($_GET['varvalue']))
+		$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
+}
+
 /* If no entry for this passlist, then create a UUID and treat it like a new list */
-if (!isset($a_passlist[$id]['uuid'])) {
+if (!isset($a_passlist[$id]['uuid']) && empty($pconfig['uuid'])) {
 	$passlist_uuid = 0;
 	while ($passlist_uuid > 65535 || $passlist_uuid == 0) {
 		$passlist_uuid = mt_rand(1, 65535);
 		$pconfig['uuid'] = $passlist_uuid;
 		$pconfig['name'] = "passlist_{$passlist_uuid}";
 	}
-} else
+}
+elseif (!empty($pconfig['uuid'])) {
+	$passlist_uuid = $pconfig['uuid'];	
+}
+else
 	$passlist_uuid = $a_passlist[$id]['uuid'];
 
 /* returns true if $name is a valid name for a pass list file name or ip */
@@ -83,28 +124,6 @@ function is_validpasslistname($name) {
 	return false;
 }
 
-if (isset($id) && $a_passlist[$id]) {
-	/* old settings */
-	$pconfig = array();
-	$pconfig['name'] = $a_passlist[$id]['name'];
-	$pconfig['uuid'] = $a_passlist[$id]['uuid'];
-	$pconfig['detail'] = $a_passlist[$id]['detail'];
-	$pconfig['address'] = $a_passlist[$id]['address'];
-	$pconfig['descr'] = html_entity_decode($a_passlist[$id]['descr']);
-	$pconfig['localnets'] = $a_passlist[$id]['localnets'];
-	$pconfig['wanips'] = $a_passlist[$id]['wanips'];
-	$pconfig['wangateips'] = $a_passlist[$id]['wangateips'];
-	$pconfig['wandnsips'] = $a_passlist[$id]['wandnsips'];
-	$pconfig['vips'] = $a_passlist[$id]['vips'];
-	$pconfig['vpnips'] = $a_passlist[$id]['vpnips'];
-}
-
-// Check for returned "selected alias" if action is import
-if ($_GET['act'] == "import") {
-	if ($_GET['varname'] == "address" && isset($_GET['varvalue']))
-		$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
-}
-
 if ($_POST['save']) {
 	unset($input_errors);
 	$pconfig = $_POST;
@@ -126,11 +145,11 @@ if ($_POST['save']) {
 		$input_errors[] = gettext("Pass List file name may only consist of the characters \"a-z, A-Z, 0-9 and _\". Note: No Spaces or dashes. Press Cancel to reset.");
 
 	/* check for name conflicts */
-	foreach ($a_passlist as $w_list) {
-		if (isset($id) && ($a_passlist[$id]) && ($a_passlist[$id] === $w_list))
+	foreach ($a_passlist as $p_list) {
+		if (isset($id) && ($a_passlist[$id]) && ($a_passlist[$id] === $p_list))
 			continue;
 
-		if ($w_list['name'] == $_POST['name']) {
+		if ($p_list['name'] == $_POST['name']) {
 			$input_errors[] = gettext("A Pass List file name with this name already exists.");
 			break;
 		}
@@ -141,27 +160,25 @@ if ($_POST['save']) {
 			$input_errors[] = gettext("A valid alias must be provided");
 
 	if (!$input_errors) {
-		$w_list = array();
+		$p_list = array();
 		/* post user input */
-		$w_list['name'] = $_POST['name'];
-		$w_list['uuid'] = $passlist_uuid;
-		$w_list['localnets'] = $_POST['localnets']? 'yes' : 'no';
-		$w_list['wanips'] = $_POST['wanips']? 'yes' : 'no';
-		$w_list['wangateips'] = $_POST['wangateips']? 'yes' : 'no';
-		$w_list['wandnsips'] = $_POST['wandnsips']? 'yes' : 'no';
-		$w_list['vips'] = $_POST['vips']? 'yes' : 'no';
-		$w_list['vpnips'] = $_POST['vpnips']? 'yes' : 'no';
-
-		$w_list['address'] = $_POST['address'];
-		$w_list['descr']  =  mb_convert_encoding($_POST['descr'],"HTML-ENTITIES","auto");
-		$w_list['detail'] = $final_address_details;
+		$p_list['name'] = $_POST['name'];
+		$p_list['uuid'] = $passlist_uuid;
+		$p_list['localnets'] = $_POST['localnets']? 'yes' : 'no';
+		$p_list['wanips'] = $_POST['wanips']? 'yes' : 'no';
+		$p_list['wangateips'] = $_POST['wangateips']? 'yes' : 'no';
+		$p_list['wandnsips'] = $_POST['wandnsips']? 'yes' : 'no';
+		$p_list['vips'] = $_POST['vips']? 'yes' : 'no';
+		$p_list['vpnips'] = $_POST['vpnips']? 'yes' : 'no';
+		$p_list['address'] = $_POST['address'];
+		$p_list['descr']  =  mb_convert_encoding($_POST['descr'],"HTML-ENTITIES","auto");
 
 		if (isset($id) && $a_passlist[$id])
-			$a_passlist[$id] = $w_list;
+			$a_passlist[$id] = $p_list;
 		else
-			$a_passlist[] = $w_list;
+			$a_passlist[] = $p_list;
 
-		write_config("Snort pkg: modified PASS LIST {$w_list['name']}.");
+		write_config("Snort pkg: modified PASS LIST {$p_list['name']}.");
 
 		/* create pass list and homenet file, then sync files */
 		sync_snort_package_config();
@@ -284,8 +301,8 @@ if ($savemsg)
 		</td>
 		<td width="78%" class="vtable">
 		<input autocomplete="off" name="address" type="text" class="formfldalias" id="address" size="30" value="<?=htmlspecialchars($pconfig['address']);?>"
-		title="<?=trim(filter_expand_alias($pconfig['address']));?>"/>
-		&nbsp;&nbsp;&nbsp;&nbsp;<input type="button" class="formbtns" value="Aliases" onclick="parent.location='snort_select_alias.php?id=0&type=host|network&varname=address&act=import&multi_ip=yes&returl=<?=urlencode($_SERVER['PHP_SELF']);?>'" 
+		title="<?=trim(filter_expand_alias($pconfig['address']));?>"/>&nbsp;&nbsp;&nbsp;&nbsp;
+		<input type="button" class="formbtns" value="Aliases" onclick="selectAlias();" 
 		title="<?php echo gettext("Select an existing IP alias");?>"/>
 		</td>
 	</tr>
@@ -326,6 +343,29 @@ function createAutoSuggest() {
 
 setTimeout("createAutoSuggest();", 500);
 
+function selectAlias() {
+
+	var loc;
+	var fields = [ "name", "descr", "localnets", "wanips", "wangateips", "wandnsips", "vips", "vpnips", "address" ];
+
+	// Scrape current form field values and add to
+	// the select alias URL as a query string.
+	var loc = 'snort_select_alias.php?id=<?=$id;?>&act=import&type=host|network';
+	loc = loc + '&varname=address&multi_ip=yes';
+	loc = loc + '&returl=<?=urlencode($_SERVER['PHP_SELF']);?>';
+	loc = loc + '&uuid=<?=$passlist_uuid;?>';
+
+	// Iterate over just the specific form fields we want to pass to
+	// the select alias URL.
+	fields.forEach(function(entry) {
+		var tmp = $(entry).serialize();
+		if (tmp.length > 0)
+			loc = loc + '&' + tmp;
+	});
+	
+	window.parent.location = loc; 
+}
+
 </script>
 <?php include("fend.inc"); ?>
 </body>
diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php
index 6b645df5..c1be72cc 100644
--- a/config/snort/snort_post_install.php
+++ b/config/snort/snort_post_install.php
@@ -48,1328 +48,6 @@ $snortdir = SNORTDIR;
 $snortlibdir = SNORTLIBDIR;
 $rcdir = RCFILEPREFIX;
 
-// This is a hack to workaround the caching of the old "snort.inc" by the
-// Package Manager installation code.  We need this new function which is
-// in the new snort.inc file during post-installation.
-if (!function_exists('snort_expand_port_range')) {
-	function snort_expand_port_range($ports, $delim = ',') {
-		// Split the incoming string on the specified delimiter
-		$tmp = explode($delim, $ports);
-
-		// Look for any included port range and expand it
-		foreach ($tmp as $val) {
-			if (is_portrange($val)) {
-				$start = strtok($val, ":");
-				$end = strtok(":");
-				if ($end !== false) {
-					$val = $start . $delim;
-					for ($i = intval($start) + 1; $i < intval($end); $i++)
-						$val .= strval($i) . $delim;
-					$val .= $end;
-				}
-			}
-			$value .= $val . $delim;
-		}
-
-		// Remove any trailing delimiter in return value
-		return trim($value, $delim);
-		}
-}
-
-// This function mirrors the "snort_generate_conf()" function in the
-// "snort.inc" file.  It is here with a modified name as a workaround 
-// so that functionality built into the new package version can be 
-// implemented during installation.  During a package reinstall, the  
-// Package Manager will cache the old version of "snort.inc" and thus 
-// new features are not available from the new "snort.inc" file in the 
-// new package.
-function snort_build_new_conf($snortcfg) {
-
-	global $config, $g, $rebuild_rules;
-
-	$snortdir = SNORTDIR;
-	$snortlibdir = SNORTLIBDIR;
-	$snortlogdir = SNORTLOGDIR;
-	$flowbit_rules_file = FLOWBITS_FILENAME;
-	$snort_enforcing_rules_file = ENFORCING_RULES_FILENAME;
-
-	if (!is_array($config['installedpackages']['snortglobal']['rule']))
-		return;
-
-	conf_mount_rw();
-
-	/* See if we should protect and not modify the preprocessor rules files */
-	if (!empty($snortcfg['protect_preproc_rules'])) 	
-		$protect_preproc_rules = $snortcfg['protect_preproc_rules'];
-	else
-		$protect_preproc_rules = "off";
-
-	$if_real = get_real_interface($snortcfg['interface']);
-	$snort_uuid = $snortcfg['uuid'];
-	$snortcfgdir = "{$snortdir}/snort_{$snort_uuid}_{$if_real}";
-
-	/* custom home nets */
-	$home_net_list = snort_build_list($snortcfg, $snortcfg['homelistname']);
-	$home_net = implode(",", $home_net_list);
-
-	$external_net = '!$HOME_NET';
-	if (!empty($snortcfg['externallistname']) && $snortcfg['externallistname'] != 'default') {
-		$external_net_list = snort_build_list($snortcfg, $snortcfg['externallistname']);
-		$external_net = implode(",", $external_net_list);
-	}
-
-	/* user added arguments */
-	$snort_config_pass_thru = str_replace("\r", "", base64_decode($snortcfg['configpassthru']));
-	// Remove the trailing newline
-	$snort_config_pass_thru = rtrim($snort_config_pass_thru);
-
-	/* create a few directories and ensure the sample files are in place */
-	$snort_dirs = array( $snortdir, $snortcfgdir, "{$snortcfgdir}/rules",
-		"{$snortlogdir}/snort_{$if_real}{$snort_uuid}",
-		"{$snortlogdir}/snort_{$if_real}{$snort_uuid}/barnyard2", 
-		"{$snortcfgdir}/preproc_rules", 
-		"dynamicrules" => "{$snortlibdir}/dynamicrules",
-		"dynamicengine" => "{$snortlibdir}/dynamicengine",
-		"dynamicpreprocessor" => "{$snortcfgdir}/dynamicpreprocessor"
-	    );
-	foreach ($snort_dirs as $dir) {
-		if (!is_dir($dir))
-			safe_mkdir($dir);
-	}
-
-	/********************************************************************/
-	/* For fail-safe on an initial startup following installation, and  */
-	/* before a rules update has occurred, copy the default config      */
-	/* files to the interface directory.  If files already exist in     */
-	/* the interface directory, or they are newer, that means a rule    */
-	/* update has been done and we should leave the customized files    */
-	/* put in place by the rules update process.                        */
-	/********************************************************************/
-	$snort_files = array("gen-msg.map", "classification.config", "reference.config", "attribute_table.dtd", 
-			"sid-msg.map", "unicode.map", "threshold.conf", "preproc_rules/preprocessor.rules",
-			"preproc_rules/decoder.rules", "preproc_rules/sensitive-data.rules"
-		);
-	foreach ($snort_files as $file) {
-		if (file_exists("{$snortdir}/{$file}")) {
-			$ftime = filemtime("{$snortdir}/{$file}");
-			if (!file_exists("{$snortcfgdir}/{$file}") || ($ftime > filemtime("{$snortcfgdir}/{$file}")))
-				@copy("{$snortdir}/{$file}", "{$snortcfgdir}/{$file}");
-		}
-	}
-
-	/* define alertsystemlog */
-	$alertsystemlog_type = "";
-	if ($snortcfg['alertsystemlog'] == "on")
-		$alertsystemlog_type = "output alert_syslog: log_alert";
-
-	/* define snortunifiedlog */
-	$snortunifiedlog_type = "";
-	if ($snortcfg['barnyard_enable'] == "on") {
-		if (isset($snortcfg['unified2_log_limit']))
-			$u2_log_limit = "limit {$snortcfg['unified2_log_limit']}";
-		else
-			$u2_log_limit = "limit 128";
-
-		$snortunifiedlog_type = "output unified2: filename snort_{$snort_uuid}_{$if_real}.u2, {$u2_log_limit}";
-		if ($snortcfg['barnyard_log_vlan_events'] == 'on')
-			$snortunifiedlog_type .= ", vlan_event_types";
-		if ($snortcfg['barnyard_log_mpls_events'] == 'on')
-			$snortunifiedlog_type .= ", mpls_event_types";
-	}
-
-	/* define spoink */
-	$spoink_type = "";
-	if ($snortcfg['blockoffenders7'] == "on") {
-		$pfkill = "";
-		if ($snortcfg['blockoffenderskill'] == "on")
-			$pfkill = "kill";
-		$spoink_wlist = snort_build_list($snortcfg, $snortcfg['whitelistname'], true);
-		/* write whitelist */
-		@file_put_contents("{$snortcfgdir}/{$snortcfg['whitelistname']}", implode("\n", $spoink_wlist));
-		$spoink_type = "output alert_pf: {$snortcfgdir}/{$snortcfg['whitelistname']},snort2c,{$snortcfg['blockoffendersip']},{$pfkill}";
-	}
-
-	/* define selected suppress file */
-	$suppress_file_name = "";
-	$suppress = snort_find_list($snortcfg['suppresslistname'], 'suppress');
-	if (!empty($suppress)) {
-		$suppress_data = str_replace("\r", "", base64_decode($suppress['suppresspassthru']));
-		@file_put_contents("{$snortcfgdir}/supp{$snortcfg['suppresslistname']}", $suppress_data);
-		$suppress_file_name = "include {$snortcfgdir}/supp{$snortcfg['suppresslistname']}";
-	}
-
-	/* set the snort performance model */
-	$snort_performance = "ac-bnfa";
-	if(!empty($snortcfg['performance']))
-		$snort_performance = $snortcfg['performance'];
-
-	/* if user has defined a custom ssh port, use it */
-	if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port']))
-		$ssh_port = $config['system']['ssh']['port'];
-	else
-		$ssh_port = "22";
-
-	/* Define an array of default values for the various preprocessor ports */
-	$snort_ports = array(
-		"dns_ports" => "53", "smtp_ports" => "25", "mail_ports" => "25,465,587,691",
-		"http_ports" => "36,80,81,82,83,84,85,86,87,88,89,90,311,383,591,593,631,901,1220,1414,1533,1741,1830,2301,2381,2809,3037,3057,3128,3443,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,10000,11371,15489,29991,33300,34412,34443,34444,41080,44440,50000,50002,51423,55555,56712", 
-		"oracle_ports" => "1024:", "mssql_ports" => "1433", "telnet_ports" => "23", 
-		"snmp_ports" => "161", "ftp_ports" => "21,2100,3535", "ssh_ports" => $ssh_port, 
-		"pop2_ports" => "109", "pop3_ports" => "110", "imap_ports" => "143", 
-		"sip_ports" => "5060,5061,5600", "auth_ports" => "113", "finger_ports" => "79", 
-		"irc_ports" => "6665,6666,6667,6668,6669,7000", "smb_ports" => "139,445",
-		"nntp_ports" => "119", "rlogin_ports" => "513", "rsh_ports" => "514",
-		"ssl_ports" => "443,465,563,636,989,992,993,994,995,7801,7802,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920",
-		"file_data_ports" => "\$HTTP_PORTS,110,143", "shellcode_ports" => "!80", 
-		"sun_rpc_ports" => "111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779",
-		"DCERPC_NCACN_IP_TCP" => "139,445", "DCERPC_NCADG_IP_UDP" => "138,1024:",
-		"DCERPC_NCACN_IP_LONG" => "135,139,445,593,1024:", "DCERPC_NCACN_UDP_LONG" => "135,1024:",
-		"DCERPC_NCACN_UDP_SHORT" => "135,593,1024:", "DCERPC_NCACN_TCP" => "2103,2105,2107",
-		"DCERPC_BRIGHTSTORE" => "6503,6504", "DNP3_PORTS" => "20000", "MODBUS_PORTS" => "502",
-		"GTP_PORTS" => "2123,2152,3386"
-	);
-
-	/* Check for defined Aliases that may override default port settings as we build the portvars array */
-	$portvardef = "";
-	foreach ($snort_ports as $alias => $avalue) {
-		if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"]))
-			$snort_ports[$alias] = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
-		$snort_ports[$alias] = preg_replace('/\s+/', ',', trim($snort_ports[$alias]));
-		$portvardef .= "portvar " . strtoupper($alias) . " [" . $snort_ports[$alias] . "]\n";
-	}
-
-	/* Define the default ports for the Stream5 preprocessor (formatted for easier reading in the snort.conf file) */
-	$stream5_ports_client = "21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 \\\n";
-	$stream5_ports_client .= "\t             139 143 161 445 513 514 587 593 691 1433 1521 1741 \\\n";
-	$stream5_ports_client .= "\t             2100 3306 6070 6665 6666 6667 6668 6669 7000 8181 \\\n";
-	$stream5_ports_client .= "\t             32770 32771 32772 32773 32774 32775 32776 32777 \\\n";
-	$stream5_ports_client .= "\t             32778 32779";
-        $stream5_ports_both = "80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563 \\\n";
-	$stream5_ports_both .= "\t           591 593 631 636 901 989 992 993 994 995 1220 1414 1533 \\\n";
-	$stream5_ports_both .= "\t           1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848 \\\n";
-	$stream5_ports_both .= "\t           5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777 \\\n";
-	$stream5_ports_both .= "\t           7779 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 \\\n";
-	$stream5_ports_both .= "\t           7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 \\\n";
-	$stream5_ports_both .= "\t           8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 \\\n";
-	$stream5_ports_both .= "\t           8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000 \\\n";
-	$stream5_ports_both .= "\t           9060 9080 9090 9091 9443 9999 10000 11371 15489 29991 \\\n";
-	$stream5_ports_both .= "\t           33300 34412 34443 34444 41080 44440 50000 50002 51423 \\\n";
-	$stream5_ports_both .= "\t           55555 56712";
-
-	/////////////////////////////
-	/* preprocessor code */
-	/* def perform_stat */
-	$perform_stat = <<<EOD
-# Performance Statistics #
-preprocessor perfmonitor: time 300 file {$snortlogdir}/snort_{$if_real}{$snort_uuid}/{$if_real}.stats pktcnt 10000
-	
-EOD;
-
-	/* def ftp_preprocessor */
-	$telnet_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['telnet_ports']));
-	$ftp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ftp_ports']));
-
-	// Configure FTP_Telnet global options
-	$ftp_telnet_globals = "inspection_type ";
-	if ($snortcfg['ftp_telnet_inspection_type'] != "") { $ftp_telnet_globals .= $snortcfg['ftp_telnet_inspection_type']; }else{ $ftp_telnet_globals .= "stateful"; }
-	if ($snortcfg['ftp_telnet_alert_encrypted'] == "on")
-		$ftp_telnet_globals .= " \\\n\tencrypted_traffic yes";
-	else
-		$ftp_telnet_globals .= " \\\n\tencrypted_traffic no";
-	if ($snortcfg['ftp_telnet_check_encrypted'] == "on")
-		$ftp_telnet_globals .= " \\\n\tcheck_encrypted";
-
-	// Configure FTP_Telnet Telnet protocol options
-	$ftp_telnet_protocol = "ports { {$telnet_ports} }";
-	if ($snortcfg['ftp_telnet_normalize'] == "on")
-		$ftp_telnet_protocol .= " \\\n\tnormalize";
-	if ($snortcfg['ftp_telnet_detect_anomalies'] == "on")
-		$ftp_telnet_protocol .= " \\\n\tdetect_anomalies";
-	if ($snortcfg['ftp_telnet_ayt_attack_threshold'] <> '0') {
-		$ftp_telnet_protocol .= " \\\n\tayt_attack_thresh "; 
-		if ($snortcfg['ftp_telnet_ayt_attack_threshold'] != "")
-			$ftp_telnet_protocol .= $snortcfg['ftp_telnet_ayt_attack_threshold'];
-		else
-			$ftp_telnet_protocol .= "20";
-	}
-
-	// Setup the standard FTP commands used for all FTP Server engines
-	$ftp_cmds = <<<EOD
-	ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
-	ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
-	ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
-	ftp_cmds { LPSV MACB MAIL MDTM MFMT MIC MKD MLSD MLST } \
-	ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
-	ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
-	ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
-	ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
-	ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
-	ftp_cmds { XSEN XSHA1 XSHA256 } \
-	alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
-	alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
-	alt_max_param_len 256 { CWD RNTO } \
-	alt_max_param_len 400 { PORT } \
-	alt_max_param_len 512 { MFMT SIZE } \
-	chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
-	chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
-	chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
-	chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
-	chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
-	chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
-	chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ 
-	chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
-	cmd_validity ALLO < int [ char R int ] > \    
-	cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
-	cmd_validity MACB < string > \
-	cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
-	cmd_validity MODE < char ASBCZ > \
-	cmd_validity PORT < host_port > \
-	cmd_validity PROT < char CSEP > \
-	cmd_validity STRU < char FRPO [ string ] > \    
-	cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
-
-EOD;
-
-	// Configure all the FTP_Telnet FTP protocol options
-	// Iterate and configure the FTP Client engines
-	$ftp_default_client_engine = array( "name" => "default", "bind_to" => "all", "max_resp_len" => 256, 
-					    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
-					    "bounce" => "yes", "bounce_to_net" => "", "bounce_to_port" => "" );
-
-	if (!is_array($snortcfg['ftp_client_engine']['item']))
-		$snortcfg['ftp_client_engine']['item'] = array();
-
-	// If no FTP client engine is configured, use the default
-	// to keep from breaking Snort.
-	if (empty($snortcfg['ftp_client_engine']['item']))
-			$snortcfg['ftp_client_engine']['item'][] = $ftp_default_client_engine;
-	$ftp_client_engine = "";
-
-	foreach ($snortcfg['ftp_client_engine']['item'] as $f => $v) {
-		$buffer = "preprocessor ftp_telnet_protocol: ftp client ";
-		if ($v['name'] == "default" && $v['bind_to'] == "all")
-			$buffer .= "default \\\n";
-		elseif (is_alias($v['bind_to'])) {
-			$tmp = trim(filter_expand_alias($v['bind_to']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$buffer .= "{$tmp} \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
-				continue;
-			}
-		}
-		else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP client '{$v['name']}' ... skipping entry.");
-				continue;
-		}
-
-		if ($v['max_resp_len'] == "")
-			$buffer .= "\tmax_resp_len 256 \\\n";
-		else
-			$buffer .= "\tmax_resp_len {$v['max_resp_len']} \\\n";
-
-		$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
-		$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
-
-		if ($v['bounce'] == "yes") {
-			if (is_alias($v['bounce_to_net']) && is_alias($v['bounce_to_port'])) {
-				$net = trim(filter_expand_alias($v['bounce_to_net']));
-				$port = trim(filter_expand_alias($v['bounce_to_port']));
-				if (!empty($net) && !empty($port) && 
-				     snort_is_single_addr_alias($v['bounce_to_net']) && 
-				    (is_port($port) || is_portrange($port))) {
-					$port = preg_replace('/\s+/', ',', $port);
-					// Change port range delimiter to comma for ftp_telnet client preprocessor
-					if (is_portrange($port))
-						$port = str_replace(":", ",", $port);
-					$buffer .= "\tbounce yes \\\n";
-					$buffer .= "\tbounce_to { {$net},{$port} }\n";
-				}
-				else {
-					// One or both of the BOUNCE_TO alias values is not right,
-					// so figure out which and log an appropriate error.
-					if (empty($net) || !snort_is_single_addr_alias($v['bounce_to_net']))
-						log_error("[snort] ERROR: illegal value for bounce_to Address Alias [{$v['bounce_to_net']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
-					if (empty($port) || !(is_port($port) || is_portrange($port)))
-						log_error("[snort] ERROR: illegal value for bounce_to Port Alias [{$v['bounce_to_port']}] for FTP client engine [{$v['name']}] ... omitting 'bounce_to' option for this client engine.");
-					$buffer .= "\tbounce yes\n";
-				}
-			}
-			else
-				$buffer .= "\tbounce yes\n";
-		}
-		else
-			$buffer .= "\tbounce no\n";
-
-		// Add this FTP client engine to the master string
-		$ftp_client_engine .= "{$buffer}\n";
-	}
-	// Trim final trailing newline
-	rtrim($ftp_client_engine);	
-
-	// Iterate and configure the FTP Server engines
-	$ftp_default_server_engine = array( "name" => "default", "bind_to" => "all", "ports" => "default", 
-					    "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", 
-					    "ignore_data_chan" => "no", "def_max_param_len" => 100 );
-
-	if (!is_array($snortcfg['ftp_server_engine']['item']))
-		$snortcfg['ftp_server_engine']['item'] = array();
-
-	// If no FTP server engine is configured, use the default
-	// to keep from breaking Snort.
-	if (empty($snortcfg['ftp_server_engine']['item']))
-			$snortcfg['ftp_server_engine']['item'][] = $ftp_default_server_engine;
-	$ftp_server_engine = "";
-
-	foreach ($snortcfg['ftp_server_engine']['item'] as $f => $v) {
-		$buffer = "preprocessor ftp_telnet_protocol: ftp server ";
-		if ($v['name'] == "default" && $v['bind_to'] == "all")
-			$buffer .= "default \\\n";
-		elseif (is_alias($v['bind_to'])) {
-			$tmp = trim(filter_expand_alias($v['bind_to']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$buffer .= "{$tmp} \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
-				continue;
-			}
-		}
-		else {
-				log_error("[snort] ERROR: unable to resolve IP Address Alias '{$v['bind_to']}' for FTP server '{$v['name']}' ... skipping entry.");
-				continue;
-		}
-
-		if ($v['def_max_param_len'] == "")
-			$buffer .= "\tdef_max_param_len 100 \\\n";
-		elseif ($v['def_max_param_len'] <> '0')
-			$buffer .= "\tdef_max_param_len {$v['def_max_param_len']} \\\n";
-
-		if ($v['ports'] == "default" || !is_alias($v['ports']) || empty($v['ports']))
-			$buffer .= "\tports { {$ftp_ports} } \\\n";
-		elseif (is_alias($v['ports'])) {
-			$tmp = trim(filter_expand_alias($v['ports']));
-			if (!empty($tmp)) {
-				$tmp = preg_replace('/\s+/', ' ', $tmp);
-				$tmp = snort_expand_port_range($tmp, ' ');
-				$buffer .= "\tports { {$tmp} } \\\n";
-			}
-			else {
-				log_error("[snort] ERROR: unable to resolve Port Alias '{$v['ports']}' for FTP server '{$v['name']}' ... reverting to defaults.");
-				$buffer .= "\tports { {$ftp_ports} } \\\n";
-			}
-		}
-
-		$buffer .= "\ttelnet_cmds {$v['telnet_cmds']} \\\n";
-		$buffer .= "\tignore_telnet_erase_cmds {$v['ignore_telnet_erase_cmds']} \\\n";
-		if ($v['ignore_data_chan'] == "yes")
-			$buffer .= "\tignore_data_chan yes \\\n";
-		$buffer .= "{$ftp_cmds}\n";
-
-		// Add this FTP server engine to the master string
-		$ftp_server_engine .= $buffer;
-	}
-	// Remove trailing newlines
-	rtrim($ftp_server_engine);
-
-	$ftp_preprocessor = <<<EOD
-# ftp_telnet preprocessor #
-preprocessor ftp_telnet: global \
-	{$ftp_telnet_globals}
-
-preprocessor ftp_telnet_protocol: telnet \
-	{$ftp_telnet_protocol}
-
-{$ftp_server_engine}
-{$ftp_client_engine}
-EOD;
-
-	$pop_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['pop3_ports']));
-	$pop_preproc = <<<EOD
-# POP preprocessor #
-preprocessor pop: \
-	ports { {$pop_ports} } \
-	memcap 1310700 \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0
-
-EOD;
-
-	$imap_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['imap_ports']));
-	$imap_preproc = <<<EOD
-# IMAP preprocessor #
-preprocessor imap: \
-	ports { {$imap_ports} } \
-	memcap 1310700 \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0
-
-EOD;
-
-	$smtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['mail_ports']));
-	/* def smtp_preprocessor */
-	$smtp_preprocessor = <<<EOD
-# SMTP preprocessor #
-preprocessor SMTP: \
-	ports { {$smtp_ports} } \
-	inspection_type stateful \
-	normalize cmds \
-	ignore_tls_data \
-	valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT \
-		     NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX QUEU \
-		     STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE \
-		     XQUEU XSTA XTRN XUSR } \
-	normalize_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY \
-			 IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT \
-			 ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 \
-			 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
-	max_header_line_len 1000 \ 
-	max_response_line_len 512 \
-	alt_max_command_line_len 260 { MAIL } \
-	alt_max_command_line_len 300 { RCPT } \
-	alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
-	alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
-	alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX } \
-	alt_max_command_line_len 246 { QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR } \
-	alt_max_command_line_len 246 { XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
-	xlink2state { enable } \
-	log_mailfrom \
-	log_rcptto \
-	log_email_hdrs \
-	email_hdrs_log_depth 1464 \
-	log_filename \
-	qp_decode_depth 0 \
-	b64_decode_depth 0 \
-	bitenc_decode_depth 0 \
-	uu_decode_depth 0
-
-EOD;
-
-	/* def sf_portscan */
-	$sf_pscan_protocol = "all";
-	if (!empty($snortcfg['pscan_protocol']))
-		$sf_pscan_protocol = $snortcfg['pscan_protocol'];
-	$sf_pscan_type = "all";
-	if (!empty($snortcfg['pscan_type']))
-		$sf_pscan_type = $snortcfg['pscan_type'];
-	$sf_pscan_memcap = "10000000";
-	if (!empty($snortcfg['pscan_memcap']))
-		$sf_pscan_memcap = $snortcfg['pscan_memcap'];
-	$sf_pscan_sense_level = "medium";
-	if (!empty($snortcfg['pscan_sense_level']))
-		$sf_pscan_sense_level = $snortcfg['pscan_sense_level'];
-	$sf_pscan_ignore_scanners = "\$HOME_NET";
-	if (!empty($snortcfg['pscan_ignore_scanners']) && is_alias($snortcfg['pscan_ignore_scanners'])) {
-		$sf_pscan_ignore_scanners = trim(filter_expand_alias($snortcfg['pscan_ignore_scanners']));
-		$sf_pscan_ignore_scanners = preg_replace('/\s+/', ',', trim($sf_pscan_ignore_scanners));
-	}
-	
-	$sf_portscan = <<<EOD
-# sf Portscan #
-preprocessor sfportscan: \
-	scan_type { {$sf_pscan_type} } \
-	proto  { {$sf_pscan_protocol} } \
-	memcap { {$sf_pscan_memcap} } \
-	sense_level { {$sf_pscan_sense_level} } \
-	ignore_scanners { {$sf_pscan_ignore_scanners} }
-	
-EOD;
-
-	/* def ssh_preproc */
-	$ssh_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssh_ports']));
-	$ssh_preproc = <<<EOD
-# SSH preprocessor #
-preprocessor ssh: \
-	server_ports { {$ssh_ports} } \
-	autodetect \
-	max_client_bytes 19600 \
-	max_encrypted_packets 20 \
-	max_server_version_len 100 \
-	enable_respoverflow enable_ssh1crc32 \
-	enable_srvoverflow enable_protomismatch
-
-EOD;
-
-	/* def other_preprocs */
-	$sun_rpc_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sun_rpc_ports']));
-	$other_preprocs = <<<EOD
-# Other preprocs #
-preprocessor rpc_decode: \
-	{$sun_rpc_ports} \
-	no_alert_multiple_requests \
-	no_alert_large_fragments \
-	no_alert_incomplete
-
-# Back Orifice preprocessor #
-preprocessor bo
-	
-EOD;
-
-	/* def dce_rpc_2 */
-	$dce_rpc_2 = <<<EOD
-# DCE/RPC 2 #
-preprocessor dcerpc2: \
-	memcap 102400, \
-	events [co]
-
-preprocessor dcerpc2_server: default, \
-	policy WinXP, \
-	detect [smb [{$snort_ports['smb_ports']}], \
-	tcp 135, \
-	udp 135, \
-	rpc-over-http-server 593], \
-	autodetect [tcp 1025:, \
-	udp 1025:, \
-	rpc-over-http-server 1025:], \
-	smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]
-	
-EOD;
-
-	$sip_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['sip_ports']));
-	$sip_preproc = <<<EOD
-# SIP preprocessor #
-preprocessor sip: \
-	max_sessions 40000, \
-	ports { {$sip_ports} }, \
-	methods { invite \
-		cancel \
-		ack \
-		bye \
-		register \
-		options \
-		refer \
-		subscribe \
-		update \
-		join \
-		info \
-		message \
-		notify \
-		benotify \
-		do \
-		qauth \
-		sprack \
-		publish \
-		service \
-		unsubscribe \
-		prack }, \
-	max_call_id_len 80, \
-	max_from_len 256, \
-	max_to_len 256, \
-	max_via_len 1024, \
-	max_requestName_len 50, \
-	max_uri_len 512, \
-	ignore_call_channel, \
-	max_content_len 2048, \
-	max_contact_len 512
-
-EOD;
-
-	$dns_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['dns_ports']));
-	/* def dns_preprocessor */
-	$dns_preprocessor = <<<EOD
-# DNS preprocessor #
-preprocessor dns: \
-	ports { {$dns_ports} } \
-	enable_rdata_overflow
-	
-EOD;
-
-	/* def dnp3_preprocessor */
-	$dnp3_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['DNP3_PORTS']));
-	$dnp3_preproc = <<<EOD
-# DNP3 preprocessor #
-preprocessor dnp3: \
-	ports { {$dnp3_ports} } \
-	memcap 262144 \
-	check_crc
-	
-EOD;
-
-	/* def modbus_preprocessor */
-	$modbus_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['MODBUS_PORTS']));
-	$modbus_preproc = <<<EOD
-# Modbus preprocessor #
-preprocessor modbus: \
-	ports { {$modbus_ports} }
-	
-EOD;
-
-	/* def gtp_preprocessor */
-	$gtp_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['GTP_PORTS']));
-	$gtp_preproc = <<<EOD
-# GTP preprocessor #
-preprocessor gtp: \
-	ports { {$gtp_ports} }
-	
-EOD;
-
-	/* def ssl_preprocessor */
-	$ssl_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['ssl_ports']));
-	$ssl_preproc = <<<EOD
-# SSL preprocessor #
-preprocessor ssl: \
-	ports { {$ssl_ports} }, \
-	trustservers, \
-	noinspect_encrypted 
-
-EOD;
-
-	/* def sensitive_data_preprocessor */
-	if ($snortcfg['sdf_mask_output'] == "on")
-		$sdf_mask_output = "\\\n\tmask_output";
-	else
-		$sdf_mask_output = "";
-	if (empty($snortcfg['sdf_alert_threshold']))
-		$snortcfg['sdf_alert_threshold'] = 25;
-	$sensitive_data = <<<EOD
-# SDF preprocessor #
-preprocessor sensitive_data: \
-	alert_threshold {$snortcfg['sdf_alert_threshold']} {$sdf_mask_output}
-
-EOD;
-
-	/* define IP Reputation preprocessor */
-	if (is_array($snortcfg['blist_files']['item'])) {
-		$blist_files = "";
-		$bIsFirst = TRUE;
-		foreach ($snortcfg['blist_files']['item'] as $blist) {
-			if ($bIsFirst) {
-				$blist_files .= "blacklist " . IPREP_PATH . $blist;
-				$bIsFirst = FALSE;
-			}
-			else
-				$blist_files .= ", \\ \n\tblacklist " . IPREP_PATH . $blist;    
-		}
-	}
-	if (is_array($snortcfg['wlist_files']['item'])) {
-		$wlist_files = "";
-		$bIsFirst = TRUE;
-		foreach ($snortcfg['wlist_files']['item'] as $wlist) {
-			if ($bIsFirst) {
-				$wlist_files .= "whitelist " . IPREP_PATH . $wlist;
-				$bIsFirst = FALSE;
-			}
-			else
-				$wlist_files .= ", \\ \n\twhitelist " . IPREP_PATH . $wlist;    
-		}
-	}
-	if (!empty($blist_files))
-		$ip_lists = $blist_files;
-	if (!empty($wlist_files))
-		$ip_lists .= ", \\ \n" . $wlist_files;
-	if ($snortcfg['iprep_scan_local'] == 'on')
-		$ip_lists .= ", \\ \n\tscan_local";	
-
-	$reputation_preproc = <<<EOD
-# IP Reputation preprocessor #
-preprocessor reputation: \
-	memcap {$snortcfg['iprep_memcap']}, \
-	priority {$snortcfg['iprep_priority']}, \
-	nested_ip {$snortcfg['iprep_nested_ip']}, \
-	white {$snortcfg['iprep_white']}, \
-	{$ip_lists}
-
-EOD;
-
-	/* define servers as IP variables */
-	$snort_servers = array (
-		"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
-		"www_servers" => "\$HOME_NET", "sql_servers" => "\$HOME_NET", "telnet_servers" => "\$HOME_NET",
-		"snmp_servers" => "\$HOME_NET", "ftp_servers" => "\$HOME_NET", "ssh_servers" => "\$HOME_NET",
-		"pop_servers" => "\$HOME_NET", "imap_servers" => "\$HOME_NET", "sip_proxy_ip" => "\$HOME_NET",
-		"sip_servers" => "\$HOME_NET", "rpc_servers" => "\$HOME_NET", "dnp3_server" => "\$HOME_NET",
-		"dnp3_client" => "\$HOME_NET", "modbus_server" => "\$HOME_NET", "modbus_client" => "\$HOME_NET",
-		"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET",
-		"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
-	    );
-
-	// Change old name from "var" to new name of "ipvar" for IP variables because 
-	// Snort is deprecating the old "var" name in newer versions.
-	$ipvardef = "";
-	foreach ($snort_servers as $alias => $avalue) {
-		if (!empty($snortcfg["def_{$alias}"]) && is_alias($snortcfg["def_{$alias}"])) {
-			$avalue = trim(filter_expand_alias($snortcfg["def_{$alias}"]));
-			$avalue = preg_replace('/\s+/', ',', trim($avalue));
-		}
-		$ipvardef .= "ipvar " . strtoupper($alias) . " [{$avalue}]\n";
-	}
-
-	$snort_preproc_libs = array(
-		"dce_rpc_2" => "dce2_preproc", "dns_preprocessor" => "dns_preproc", "ftp_preprocessor" => "ftptelnet_preproc", "imap_preproc" => "imap_preproc",
-		"pop_preproc" => "pop_preproc", "reputation_preproc" => "reputation_preproc", "sensitive_data" => "sdf_preproc", 
-		"sip_preproc" => "sip_preproc", "gtp_preproc" => "gtp_preproc", "smtp_preprocessor" => "smtp_preproc", "ssh_preproc" => "ssh_preproc", 
-		"ssl_preproc" => "ssl_preproc", "dnp3_preproc" => "dnp3_preproc", "modbus_preproc" => "modbus_preproc"
-	);
-	$snort_preproc = array (
-		"perform_stat", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor", "ssl_preproc", "sip_preproc", "gtp_preproc", "ssh_preproc", "sf_portscan", 
-		"dce_rpc_2", "dns_preprocessor", "sensitive_data", "pop_preproc", "imap_preproc", "dnp3_preproc", "modbus_preproc", "reputation_preproc"
-	);
-	$default_disabled_preprocs = array(
-		"sf_portscan", "gtp_preproc", "sensitive_data", "dnp3_preproc", "modbus_preproc", "reputation_preproc", "perform_stat" 
-	);
-	$snort_preprocessors = "";
-	foreach ($snort_preproc as $preproc) {
-		if ($snortcfg[$preproc] == 'on' || empty($snortcfg[$preproc]) ) {
-
-			/* If preprocessor is not explicitly "on" or "off", then default to "off" if in our default disabled list */
-			if (empty($snortcfg[$preproc]) && in_array($preproc, $default_disabled_preprocs))
-				continue;
-
-			/* NOTE: The $$ is not a bug. It is an advanced feature of php */
-			if (!empty($snort_preproc_libs[$preproc])) {
-				$preproclib = "libsf_" . $snort_preproc_libs[$preproc];
-				if (!file_exists($snort_dirs['dynamicpreprocessor'] . "{$preproclib}.so")) {
-					if (file_exists("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so")) {
-						@copy("{$snortlibdir}/dynamicpreprocessor/{$preproclib}.so", "{$snort_dirs['dynamicpreprocessor']}/{$preproclib}.so");
-						$snort_preprocessors .= $$preproc;
-						$snort_preprocessors .= "\n";
-					} else
-						log_error("Could not find the {$preproclib} file. Snort might error out!");
-				} else {
-					$snort_preprocessors .= $$preproc;
-					$snort_preprocessors .= "\n";
-				}
-			} else {
-				$snort_preprocessors .= $$preproc;
-				$snort_preprocessors .= "\n";
-			}
-		}
-	}
-	// Remove final trailing newline
-	$snort_preprocessors = rtrim($snort_preprocessors);
-
-	$snort_misc_include_rules = "";
-	if (file_exists("{$snortcfgdir}/reference.config"))
-		$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
-	if (file_exists("{$snortcfgdir}/classification.config"))
-		$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
-	if (!file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") || !file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules")) {
-		$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-		log_error("[Snort] Seems preprocessor and/or decoder rules are missing, enabling autogeneration of them in conf file.");
-	}
-
-	/* generate rule sections to load */
-	/* The files are always configured so the update process is easier */
-	$selected_rules_sections = "include \$RULE_PATH/{$snort_enforcing_rules_file}\n";
-	$selected_rules_sections .= "include \$RULE_PATH/{$flowbit_rules_file}\n";
-	$selected_rules_sections  .= "include \$RULE_PATH/custom.rules\n";
-
-	// Remove trailing newlines
-	$snort_misc_include_rules = rtrim($snort_misc_include_rules);
-	$selected_rules_sections = rtrim($selected_rules_sections);
-
-	/* Create the actual rules files and save in the interface directory */
-	snort_prepare_rule_files($snortcfg, $snortcfgdir);
-
-	$cksumcheck = "all";
-	if ($snortcfg['cksumcheck'] == 'on')
-		$cksumcheck = "none";
-
-	/* Pull in user-configurable detection config options */
-	$cfg_detect_settings = "search-method {$snort_performance} max-pattern-len 20 max_queue_events 5";
-	if ($snortcfg['fpm_split_any_any'] == "on")
-		$cfg_detect_settings .= " split-any-any";
-	if ($snortcfg['fpm_search_optimize'] == "on")
-		$cfg_detect_settings .= " search-optimize";
-	if ($snortcfg['fpm_no_stream_inserts'] == "on")
-		$cfg_detect_settings .= " no_stream_inserts";
-
-	/* Pull in user-configurable options for Frag3 preprocessor settings */
-	/* Get global Frag3 options first and put into a string */
-	$frag3_global = "preprocessor frag3_global: ";
-	if (!empty($snortcfg['frag3_memcap']) || $snortcfg['frag3_memcap'] == "0")
-		$frag3_global .= "memcap {$snortcfg['frag3_memcap']}, ";
-	else
-		$frag3_global .= "memcap 4194304, ";
-	if (!empty($snortcfg['frag3_max_frags']))
-		$frag3_global .= "max_frags {$snortcfg['frag3_max_frags']}";
-	else
-		$frag3_global .= "max_frags 8192";
-	if ($snortcfg['frag3_detection'] == "off")
-		$frag3_global .= ", disabled";
-
-	$frag3_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", 
-					   "timeout" => 60, "min_ttl" => 1, "detect_anomalies" => "on", 
-					   "overlap_limit" => 0, "min_frag_len" => 0 );
-	$frag3_engine = "";
-
-	// Now iterate configured Frag3 engines and write them to a string if enabled
-	if ($snortcfg['frag3_detection'] == "on") {
-		if (!is_array($snortcfg['frag3_engine']['item']))
-			$snortcfg['frag3_engine']['item'] = array();
-
-		// If no frag3 tcp engine is configured, use the default
-		if (empty($snortcfg['frag3_engine']['item']))
-			$snortcfg['frag3_engine']['item'][] = $frag3_default_tcp_engine;
-
-		foreach ($snortcfg['frag3_engine']['item'] as $f => $v) {
-			$frag3_engine .= "preprocessor frag3_engine: ";
-			$frag3_engine .= "policy {$v['policy']}";
-			if ($v['bind_to'] <> "all") {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ',', $tmp);
-					if (strpos($tmp, ",") !== false)
-						$frag3_engine .= " \\\n\tbind_to [{$tmp}]";
-					else
-						$frag3_engine .= " \\\n\tbind_to {$tmp}";
-				}
-				else
-					log_error("[snort] WARNING: unable to resolve IP List Alias '{$v['bind_to']}' for Frag3 engine '{$v['name']}' ... using 0.0.0.0 failsafe.");
-			}
-			$frag3_engine .= " \\\n\ttimeout {$v['timeout']}";
-			$frag3_engine .= " \\\n\tmin_ttl {$v['min_ttl']}";
-			if ($v['detect_anomalies'] == "on") {
-				$frag3_engine .= " \\\n\tdetect_anomalies";
-				$frag3_engine .= " \\\n\toverlap_limit {$v['overlap_limit']}";
-				$frag3_engine .= " \\\n\tmin_fragment_length {$v['min_frag_len']}";
-			}
-			// Add newlines to terminate this engine
-			$frag3_engine .= "\n\n";
-		}
-		// Remove trailing newline
-		$frag3_engine = rtrim($frag3_engine);
-	}
-
-	// Grab any user-customized value for Protocol Aware Flushing (PAF) max PDUs
-	$paf_max_pdu_config = "config paf_max: ";
-	if (empty($snortcfg['max_paf']) || $snortcfg['max_paf'] == '0')
-		$paf_max_pdu_config .= "0";
-	else
-		$paf_max_pdu_config .= $snortcfg['max_paf'];
-
-	// Pull in user-configurable options for Stream5 preprocessor settings
-	// Get global options first and put into a string
-	$stream5_global = "preprocessor stream5_global: \\\n";
-	if ($snortcfg['stream5_reassembly'] == "off")
-		$stream5_global .= "\tdisabled, \\\n";
-	if ($snortcfg['stream5_track_tcp'] == "off")
-		$stream5_global .= "\ttrack_tcp no,";
-	else {
-		$stream5_global .= "\ttrack_tcp yes,";
-		if (!empty($snortcfg['stream5_max_tcp']))
-			$stream5_global .= " \\\n\tmax_tcp {$snortcfg['stream5_max_tcp']},";
-		else
-			$stream5_global .= " \\\n\tmax_tcp 262144,";
-	}
-	if ($snortcfg['stream5_track_udp'] == "off")
-		$stream5_global .= " \\\n\ttrack_udp no,";
-	else {
-		$stream5_global .= " \\\n\ttrack_udp yes,";
-		if (!empty($snortcfg['stream5_max_udp']))
-			$stream5_global .= " \\\n\tmax_udp {$snortcfg['stream5_max_udp']},";
-		else
-			$stream5_global .= " \\\n\tmax_udp 131072,";
-	}
-	if ($snortcfg['stream5_track_icmp'] == "on") {
-		$stream5_global .= " \\\n\ttrack_icmp yes,";
-		if (!empty($snortcfg['stream5_max_icmp']))
-			$stream5_global .= " \\\n\tmax_icmp {$snortcfg['stream5_max_icmp']},";
-		else
-			$stream5_global .= " \\\n\tmax_icmp 65536,";
-	}
-	else
-		$stream5_global .= " \\\n\ttrack_icmp no,";
-	if (!empty($snortcfg['stream5_mem_cap']))
-		$stream5_global .= " \\\n\tmemcap {$snortcfg['stream5_mem_cap']},";
-	else
-		$stream5_global .= " \\\n\tmemcap 8388608,";
-
-	if (!empty($snortcfg['stream5_prune_log_max']) || $snortcfg['stream5_prune_log_max'] == '0')
-		$stream5_global .= " \\\n\tprune_log_max {$snortcfg['stream5_prune_log_max']}";
-	else
-		$stream5_global .= " \\\n\tprune_log_max 1048576";
-	if ($snortcfg['stream5_flush_on_alert'] == "on")
-		$stream5_global .= ", \\\n\tflush_on_alert";
-
-	$stream5_default_tcp_engine = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", "timeout" => 30, 
-					     "max_queued_bytes" => 1048576, "detect_anomalies" => "off", "overlap_limit" => 0, 
-					     "max_queued_segs" => 2621, "require_3whs" => "off", "startup_3whs_timeout" => 0, 
-					     "no_reassemble_async" => "off", "dont_store_lg_pkts" => "off", "max_window" => 0, 
-					     "use_static_footprint_sizes" => "off", "check_session_hijacking" => "off", "ports_client" => "default", 
-					     "ports_both" => "default", "ports_server" => "none" );
-	$stream5_tcp_engine = "";
-
-	// Now iterate configured Stream5 TCP engines and write them to a string if enabled
-	if ($snortcfg['stream5_reassembly'] == "on") {
-		if (!is_array($snortcfg['stream5_tcp_engine']['item']))
-			$snortcfg['stream5_tcp_engine']['item'] = array();
-
-		// If no stream5 tcp engine is configured, use the default
-		if (empty($snortcfg['stream5_tcp_engine']['item']))
-			$snortcfg['stream5_tcp_engine']['item'][] = $stream5_default_tcp_engine;
-
-		foreach ($snortcfg['stream5_tcp_engine']['item'] as $f => $v) {
-			$buffer = "preprocessor stream5_tcp: ";
-			$buffer .= "policy {$v['policy']},";
-			if ($v['bind_to'] <> "all") {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ',', $tmp);
-					if (strpos($tmp, ",") !== false)
-						$buffer .= " \\\n\tbind_to [{$tmp}],";
-					else
-						$buffer .= " \\\n\tbind_to {$tmp},";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for Stream5 TCP engine '{$v['name']}' ... skipping this engine.");
-					continue;
-				}
-			}
-			$stream5_tcp_engine .= $buffer;
-			$stream5_tcp_engine .= " \\\n\ttimeout {$v['timeout']},";
-			$stream5_tcp_engine .= " \\\n\toverlap_limit {$v['overlap_limit']},";
-			$stream5_tcp_engine .= " \\\n\tmax_window {$v['max_window']},";
-			$stream5_tcp_engine .= " \\\n\tmax_queued_bytes {$v['max_queued_bytes']},";
-			$stream5_tcp_engine .= " \\\n\tmax_queued_segs {$v['max_queued_segs']}";
-			if ($v['use_static_footprint_sizes'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tuse_static_footprint_sizes";
-			if ($v['check_session_hijacking'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tcheck_session_hijacking";
-			if ($v['dont_store_lg_pkts'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdont_store_large_packets";
-			if ($v['no_reassemble_async'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdont_reassemble_async";
-			if ($v['detect_anomalies'] == "on")
-				$stream5_tcp_engine .= ", \\\n\tdetect_anomalies";
-			if ($v['require_3whs'] == "on")
-				$stream5_tcp_engine .= ", \\\n\trequire_3whs {$v['startup_3whs_timeout']}";
-			if (!empty($v['ports_client'])) {
-				$stream5_tcp_engine .= ", \\\n\tports client";
-				if ($v['ports_client'] == " all")
-					$stream5_tcp_engine .= " all";
-				elseif ($v['ports_client'] == "default")
-					$stream5_tcp_engine .= " {$stream5_ports_client}";
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_client']));
-					if (!empty($tmp))
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					else {
-						$stream5_tcp_engine .= " {$stream5_ports_client}";
-						log_error("[snort] WARNING: unable to resolve Ports Client Alias [{$v['ports_client']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
-					}
-				}
-			}
-			if (!empty($v['ports_both'])) {
-				$stream5_tcp_engine .= ", \\\n\tports both";
-				if ($v['ports_both'] == " all")
-					$stream5_tcp_engine .= " all";
-				elseif ($v['ports_both'] == "default")
-					$stream5_tcp_engine .= " {$stream5_ports_both}";
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_both']));
-					if (!empty($tmp))
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					else {
-						$stream5_tcp_engine .= " {$stream5_ports_both}";
-						log_error("[snort] WARNING: unable to resolve Ports Both Alias [{$v['ports_both']}] for Stream5 TCP engine '{$v['name']}' ... using default value.");
-					}
-				}
-			}
-			if (!empty($v['ports_server']) && $v['ports_server'] <> "none" && $v['ports_server'] <> "default") {
-				if ($v['ports_server'] == " all") {
-					$stream5_tcp_engine .= ", \\\n\tports server";
-					$stream5_tcp_engine .= " all";
-				}
-				else {
-					$tmp = trim(filter_expand_alias($v['ports_server']));
-					if (!empty($tmp)) {
-						$stream5_tcp_engine .= ", \\\n\tports server";
-						$stream5_tcp_engine .= " " . trim(preg_replace('/\s+/', ' ', $tmp));
-					}
-					else
-						log_error("[snort] WARNING: unable to resolve Ports Server Alias [{$v['ports_server']}] for Stream5 TCP engine '{$v['name']}' ... defaulting to none.");
-				}
-			}
-
-			// Make sure the "ports" parameter is set, or else default to a safe value
-			if (strpos($stream5_tcp_engine, "ports ") === false)
-				$stream5_tcp_engine .= ", \\\n\tports both all";
-
-			// Add a pair of newlines to terminate this engine
-			$stream5_tcp_engine .= "\n\n";
-		}
-		// Trim off the final trailing newline
-		$stream5_tcp_engine = rtrim($stream5_tcp_engine);
-	}
-
-	// Configure the Stream5 UDP engine if it and Stream5 reassembly are enabled
-	if ($snortcfg['stream5_track_udp'] == "off" || $snortcfg['stream5_reassembly'] == "off")
-		$stream5_udp_engine = "";
-	else {
-		$stream5_udp_engine = "preprocessor stream5_udp: ";
-		if (!empty($snortcfg['stream5_udp_timeout'])) 
-			$stream5_udp_engine .= "timeout {$snortcfg['stream5_udp_timeout']}";
-		else
-			$stream5_udp_engine .= "timeout 30";
-	}
-
-	// Configure the Stream5 ICMP engine if it and Stream5 reassembly are enabled
-	if ($snortcfg['stream5_track_icmp'] == "on" && $snortcfg['stream5_reassembly'] == "on") {
-		$stream5_icmp_engine = "preprocessor stream5_icmp: ";
-		if (!empty($snortcfg['stream5_icmp_timeout'])) 
-			$stream5_icmp_engine .= "timeout {$snortcfg['stream5_icmp_timeout']}";
-		else
-			$stream5_icmp_engine .= "timeout 30";
-	}
-	else
-		$stream5_icmp_engine = "";
-
-	// Check for and configure Host Attribute Table if enabled
-	$host_attrib_config = "";
-	if ($snortcfg['host_attribute_table'] == "on" && !empty($snortcfg['host_attribute_data'])) {
-		file_put_contents("{$snortcfgdir}/host_attributes", base64_decode($snortcfg['host_attribute_data']));
-		$host_attrib_config = "# Host Attribute Table #\n";
-		$host_attrib_config .= "attribute_table filename {$snortcfgdir}/host_attributes\n";
-		if (!empty($snortcfg['max_attribute_hosts']))
-			$host_attrib_config .= "config max_attribute_hosts: {$snortcfg['max_attribute_hosts']}\n";
-		if (!empty($snortcfg['max_attribute_services_per_host']))
-			$host_attrib_config .= "config max_attribute_services_per_host: {$snortcfg['max_attribute_services_per_host']}";
-	}
-
-	// Configure the HTTP_INSPECT preprocessor
-	// Get global options first and put into a string
-	$http_inspect_global = "preprocessor http_inspect: global ";
-	if ($snortcfg['http_inspect'] == "off")
-		$http_inspect_global .= "disabled ";
-	$http_inspect_global .= "\\\n\tiis_unicode_map unicode.map 1252 \\\n";
-	$http_inspect_global .= "\tcompress_depth 65535 \\\n";
-	$http_inspect_global .= "\tdecompress_depth 65535 \\\n";
-	if (!empty($snortcfg['http_inspect_memcap']))
-		$http_inspect_global .= "\tmemcap {$snortcfg['http_inspect_memcap']} \\\n";
-	else
-		$http_inspect_global .= "\tmemcap 150994944 \\\n";
-	if (!empty($snortcfg['http_inspect_max_gzip_mem']))
-		$http_inspect_global .= "\tmax_gzip_mem {$snortcfg['http_inspect_max_gzip_mem']}";
-	else
-		$http_inspect_global .= "\tmax_gzip_mem 838860";
-	if ($snortcfg['http_inspect_proxy_alert'] == "on")
-		$http_inspect_global .= " \\\n\tproxy_alert";
-
-	$http_inspect_default_engine = array( "name" => "default", "bind_to" => "all", "server_profile" => "all", "enable_xff" => "off", 
-					      "log_uri" => "off", "log_hostname" => "off", "server_flow_depth" => 65535, "enable_cookie" => "on", 
-					      "client_flow_depth" => 1460, "extended_response_inspection" => "on", "no_alerts" => "off", 
-					      "unlimited_decompress" => "on", "inspect_gzip" => "on", "normalize_cookies" =>"on", "normalize_headers" => "on", 
-					      "normalize_utf" => "on", "normalize_javascript" => "on", "allow_proxy_use" => "off", "inspect_uri_only" => "off", 
-					      "max_javascript_whitespaces" => 200, "post_depth" => -1, "max_headers" => 0, "max_spaces" => 0, 
-					      "max_header_length" => 0, "ports" => "default" );
-	$http_ports = str_replace(",", " ", snort_expand_port_range($snort_ports['http_ports']));
-	$http_inspect_servers = "";
-
-	// Iterate configured HTTP_INSPECT servers and write them to string if HTTP_INSPECT enabled
-	if ($snortcfg['http_inspect'] <> "off") {
-		if (!is_array($snortcfg['http_inspect_engine']['item']))
-			$snortcfg['http_inspect_engine']['item'] = array();
-
-		// If no http_inspect_engine is configured, use the default
-		if (empty($snortcfg['http_inspect_engine']['item']))
-			$snortcfg['http_inspect_engine']['item'][] = $http_inspect_default_engine;
-
-		foreach ($snortcfg['http_inspect_engine']['item'] as $f => $v) {
-			$buffer = "preprocessor http_inspect_server: \\\n";
-			if ($v['name'] == "default")
-				$buffer .= "\tserver default \\\n";
-			elseif (is_alias($v['bind_to'])) {
-				$tmp = trim(filter_expand_alias($v['bind_to']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ' ', $tmp);
-						$buffer .= "\tserver { {$tmp} } \\\n";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
-					continue;
-				}
-			}
-			else {
-					log_error("[snort] WARNING: unable to resolve IP Address Alias [{$v['bind_to']}] for HTTP_INSPECT server '{$v['name']}' ... skipping this server engine.");
-					continue;
-			}
-			$http_inspect_servers .= $buffer;
-			$http_inspect_servers .= "\tprofile {$v['server_profile']} \\\n";
-
-			if ($v['no_alerts'] == "on")
-				$http_inspect_servers .= "\tno_alerts \\\n";
-
-			if ($v['ports'] == "default" || empty($v['ports']))
-				$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-			elseif (is_alias($v['ports'])) {
-				$tmp = trim(filter_expand_alias($v['ports']));
-				if (!empty($tmp)) {
-					$tmp = preg_replace('/\s+/', ' ', $tmp);
-					$tmp = snort_expand_port_range($tmp, ' ');
-					$http_inspect_servers .= "\tports { {$tmp} } \\\n";
-				}
-				else {
-					log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
-					$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-				}
-			}
-			else {
-					log_error("[snort] WARNING: unable to resolve Ports Alias [{$v['ports']}] for HTTP_INSPECT server '{$v['name']}' ... using safe default instead.");
-					$http_inspect_servers .= "\tports { {$http_ports} } \\\n";
-			}
-
-			$http_inspect_servers .= "\tserver_flow_depth {$v['server_flow_depth']} \\\n";
-			$http_inspect_servers .= "\tclient_flow_depth {$v['client_flow_depth']} \\\n";
-			$http_inspect_servers .= "\thttp_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \\\n";
-			$http_inspect_servers .= "\tpost_depth {$v['post_depth']} \\\n";
-			$http_inspect_servers .= "\tmax_headers {$v['max_headers']} \\\n";
-			$http_inspect_servers .= "\tmax_header_length {$v['max_header_length']} \\\n";
-			$http_inspect_servers .= "\tmax_spaces {$v['max_spaces']}";
-			if ($v['enable_xff'] == "on")
-				$http_inspect_servers .= " \\\n\tenable_xff";
-			if ($v['enable_cookie'] == "on")
-				$http_inspect_servers .= " \\\n\tenable_cookie";
-			if ($v['normalize_cookies'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_cookies";
-			if ($v['normalize_headers'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_headers";
-			if ($v['normalize_utf'] == "on")
-				$http_inspect_servers .= " \\\n\tnormalize_utf";
-			if ($v['allow_proxy_use'] == "on")
-				$http_inspect_servers .= " \\\n\tallow_proxy_use";
-			if ($v['inspect_uri_only'] == "on")
-				$http_inspect_servers .= " \\\n\tinspect_uri_only";
-			if ($v['extended_response_inspection'] == "on") {
-				$http_inspect_servers .= " \\\n\textended_response_inspection";
-				if ($v['inspect_gzip'] == "on") {
-					$http_inspect_servers .= " \\\n\tinspect_gzip";
-					if ($v['unlimited_decompress'] == "on")
-						$http_inspect_servers .= " \\\n\tunlimited_decompress";
-				}
-				if ($v['normalize_javascript'] == "on") {
-					$http_inspect_servers .= " \\\n\tnormalize_javascript";
-					$http_inspect_servers .= " \\\n\tmax_javascript_whitespaces {$v['max_javascript_whitespaces']}";
-				}
-			}
-			if ($v['log_uri'] == "on")
-				$http_inspect_servers .= " \\\n\tlog_uri";
-			if ($v['log_hostname'] == "on")
-				$http_inspect_servers .= " \\\n\tlog_hostname";
-
-			// Add a pair of trailing newlines to terminate this server config
-			$http_inspect_servers .= "\n\n";
-		}
-		/* Trim off the final trailing newline */
-		$http_inspect_server = rtrim($http_inspect_server);
-	}
-
-	// Finally, build the Snort configuration file
-	$snort_conf_text = <<<EOD
-# snort configuration file
-# generated automatically by the pfSense subsystems do not modify manually
-
-# Define Local Network #
-ipvar HOME_NET [{$home_net}]
-ipvar EXTERNAL_NET [{$external_net}]
-
-# Define Rule Path #
-var RULE_PATH {$snortcfgdir}/rules
-
-# Define Servers #
-{$ipvardef}
-
-# Define Server Ports #
-{$portvardef}
-
-# Configure quiet startup mode #
-config quiet
-
-# Configure the snort decoder #
-config checksum_mode: {$cksumcheck}
-config disable_decode_alerts
-config disable_tcpopt_experimental_alerts
-config disable_tcpopt_obsolete_alerts
-config disable_ttcp_alerts
-config disable_tcpopt_alerts
-config disable_ipopt_alerts
-config disable_decode_drops
-
-# Enable the GTP decoder #
-config enable_gtp
-
-# Configure PCRE match limitations
-config pcre_match_limit: 3500
-config pcre_match_limit_recursion: 1500
-
-# Configure the detection engine #
-config detection: {$cfg_detect_settings}
-config event_queue: max_queue 8 log 5 order_events content_length
-
-# Configure to show year in timestamps
-config show_year
-
-# Configure protocol aware flushing #
-# For more information see README.stream5 #
-{$paf_max_pdu_config}
-
-# Configure dynamically loaded libraries
-dynamicpreprocessor directory {$snort_dirs['dynamicpreprocessor']}
-dynamicengine directory {$snort_dirs['dynamicengine']}
-dynamicdetection directory {$snort_dirs['dynamicrules']}
-
-# Inline packet normalization. For more information, see README.normalize
-# Disabled since we do not use "inline" mode with pfSense
-# preprocessor normalize_ip4
-# preprocessor normalize_tcp: ips ecn stream
-# preprocessor normalize_icmp4
-# preprocessor normalize_ip6
-# preprocessor normalize_icmp6
-
-# Flow and stream #
-{$frag3_global}
-
-{$frag3_engine}
-
-{$stream5_global}
-
-{$stream5_tcp_engine}
-
-{$stream5_udp_engine}
-
-{$stream5_icmp_engine}
-
-# HTTP Inspect #
-{$http_inspect_global}
-
-{$http_inspect_servers}
-{$snort_preprocessors}
-{$host_attrib_config}
-
-# Snort Output Logs #
-output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority
-{$alertsystemlog_type}
-{$snortunifiedlog_type}
-{$spoink_type}
-						
-# Misc Includes #
-{$snort_misc_include_rules}
-
-{$suppress_file_name}
-
-# Snort user pass through configuration
-{$snort_config_pass_thru}
-
-# Rules Selection #
-{$selected_rules_sections}
-EOD;
-
-	// Write out snort.conf file
-	file_put_contents("{$snortcfgdir}/snort.conf", $snort_conf_text);
-	conf_mount_ro();
-	unset($snort_conf_text, $selected_rules_sections, $suppress_file_name, $snort_misc_include_rules, $spoink_type, $snortunifiedlog_type, $alertsystemlog_type);
-	unset($home_net, $external_net, $ipvardef, $portvardef);
-}
-
-/*****************************************************************************/
-/* This starts the actual post-install code                                  */
-/*****************************************************************************/
-
 /* Hard kill any running Snort processes that may have been started by any   */
 /* of the pfSense scripts such as check_reload_status() or rc.start_packages */
 if(is_process_running("snort")) {
@@ -1389,6 +67,9 @@ if(is_process_running("barnyard")) {
 /* Set flag for post-install in progress */
 $g['snort_postinstall'] = true;
 
+/* Set Snort conf partition to read-write so we can make changes there */
+conf_mount_rw();
+
 /* cleanup default files */
 @rename("{$snortdir}/snort.conf-sample", "{$snortdir}/snort.conf");
 @rename("{$snortdir}/threshold.conf-sample", "{$snortdir}/threshold.conf");
@@ -1398,7 +79,7 @@ $g['snort_postinstall'] = true;
 @rename("{$snortdir}/generators-sample", "{$snortdir}/generators");
 @rename("{$snortdir}/reference.config-sample", "{$snortdir}/reference.config");
 @rename("{$snortdir}/gen-msg.map-sample", "{$snortdir}/gen-msg.map");
-@rename("{$snortdir}/attribute_table.dtd-sample", "{$snortdir}/attribute_table.dtd");
+//@rename("{$snortdir}/attribute_table.dtd-sample", "{$snortdir}/attribute_table.dtd");
 
 /* fix up the preprocessor rules filenames from a PBI package install */
 $preproc_rules = array("decoder.rules", "preprocessor.rules", "sensitive-data.rules");
@@ -1409,8 +90,8 @@ foreach ($preproc_rules as $file) {
 
 /* Remove any previously installed scripts since we rebuild them */
 @unlink("{$snortdir}/sid");
-@unlink("{$rcdir}/snort.sh");
-@unlink("{$rcdir}/barnyard2");
+@unlink("{$rcdir}snort.sh");
+@unlink("{$rcdir}barnyard2");
 
 /* Create required log and db directories in /var */
 safe_mkdir(SNORTLOGDIR);
@@ -1435,13 +116,13 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') {
 	update_status(gettext("Saved settings detected..."));
 	/* Do one-time settings migration for new multi-engine configurations */
 	update_output_window(gettext("Please wait... migrating settings to new configuration..."));
-	include('/usr/local/www/snort/snort_migrate_config.php');
+	include('/usr/local/pkg/snort/snort_migrate_config.php');
 	update_output_window(gettext("Please wait... rebuilding installation with saved settings..."));
 	log_error(gettext("[Snort] Downloading and updating configured rule types..."));
 	update_output_window(gettext("Please wait... downloading and updating configured rule types..."));
 	if ($pkg_interface <> "console")
 		$snort_gui_include = true;
-	include('/usr/local/www/snort/snort_check_for_rule_updates.php');
+	include('/usr/local/pkg/snort/snort_check_for_rule_updates.php');
 	update_status(gettext("Generating snort.conf configuration file from saved settings..."));
 	$rebuild_rules = true;
 
@@ -1451,7 +132,7 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') {
 		$if_real = get_real_interface($value['interface']);
 
 		/* create a snort.conf file for interface */
-		snort_build_new_conf($value);
+		snort_generate_conf($value);
 
 		/* create barnyard2.conf file for interface */
 		if ($value['barnyard_enable'] == 'on')
@@ -1479,22 +160,25 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') {
 	log_error(gettext("[Snort] Finished rebuilding installation from saved settings..."));
 
 	/* Only try to start Snort if not in reboot */
-	if (!$g['booting']) {
+	if (!($g['booting'])) {
 		update_status(gettext("Starting Snort using rebuilt configuration..."));
 		update_output_window(gettext("Please wait... while Snort is started..."));
 		log_error(gettext("[Snort] Starting Snort using rebuilt configuration..."));
-		start_service("snort");
-		update_output_window(gettext("Snort has been started using the rebuilt configuration..."));
+		mwexec_bg("{$rcdir}snort.sh start");
+		update_output_window(gettext("Snort is starting using the rebuilt configuration..."));
 	}
 }
 
+/* We're finished with conf partition mods, return to read-only */
+conf_mount_ro();
+
 /* If an existing Snort Dashboard Widget container is not found, */
 /* then insert our default Widget Dashboard container.           */
 if (stristr($config['widgets']['sequence'], "snort_alerts-container") === FALSE)
 	$config['widgets']['sequence'] .= ",{$snort_widget_container}";
 
 /* Update Snort package version in configuration */
-$config['installedpackages']['snortglobal']['snort_config_ver'] = "3.0.13";
+$config['installedpackages']['snortglobal']['snort_config_ver'] = "3.1.2";
 write_config("Snort pkg: post-install configuration saved.");
 
 /* Done with post-install, so clear flag */
diff --git a/config/snort/snort_preprocessors.php b/config/snort/snort_preprocessors.php
index 5cee95df..133c0513 100755
--- a/config/snort/snort_preprocessors.php
+++ b/config/snort/snort_preprocessors.php
@@ -117,16 +117,64 @@ if (isset($id) && isset($a_nat[$id])) {
 
 	if (empty($pconfig['smtp_preprocessor']))
 		$pconfig['smtp_preprocessor'] = 'on';
+	if (empty($pconfig['smtp_memcap']))
+		$pconfig['smtp_memcap'] = "838860";
+	if (empty($pconfig['smtp_max_mime_mem']))
+		$pconfig['smtp_max_mime_mem'] = "838860";
+	if (empty($pconfig['smtp_b64_decode_depth']))
+		$pconfig['smtp_b64_decode_depth'] = "0";
+	if (empty($pconfig['smtp_qp_decode_depth']))
+		$pconfig['smtp_qp_decode_depth'] = "0";
+	if (empty($pconfig['smtp_bitenc_decode_depth']))
+		$pconfig['smtp_bitenc_decode_depth'] = "0";
+	if (empty($pconfig['smtp_uu_decode_depth']))
+		$pconfig['smtp_uu_decode_depth'] = "0";
+	if (empty($pconfig['smtp_email_hdrs_log_depth']) && $pconfig['smtp_email_hdrs_log_depth'] != '0')
+		$pconfig['smtp_email_hdrs_log_depth'] = "1464";
+	if (empty($pconfig['smtp_ignore_tls_data']))
+		$pconfig['smtp_ignore_tls_data'] = 'on';
+	if (empty($pconfig['smtp_log_mail_from']))
+		$pconfig['smtp_log_mail_from'] = 'on';
+	if (empty($pconfig['smtp_log_rcpt_to']))
+		$pconfig['smtp_log_rcpt_to'] = 'on';
+	if (empty($pconfig['smtp_log_filename']))
+		$pconfig['smtp_log_filename'] = 'on';
+	if (empty($pconfig['smtp_log_email_hdrs']))
+		$pconfig['smtp_log_email_hdrs'] = 'on';
+
 	if (empty($pconfig['dce_rpc_2']))
 		$pconfig['dce_rpc_2'] = 'on';
 	if (empty($pconfig['dns_preprocessor']))
 		$pconfig['dns_preprocessor'] = 'on';
 	if (empty($pconfig['ssl_preproc']))
 		$pconfig['ssl_preproc'] = 'on';
+
 	if (empty($pconfig['pop_preproc']))
 		$pconfig['pop_preproc'] = 'on';
+	if (empty($pconfig['pop_memcap']))
+		$pconfig['pop_memcap'] = "838860";
+	if (empty($pconfig['pop_b64_decode_depth']))
+		$pconfig['pop_b64_decode_depth'] = "0";
+	if (empty($pconfig['pop_qp_decode_depth']))
+		$pconfig['pop_qp_decode_depth'] = "0";
+	if (empty($pconfig['pop_bitenc_decode_depth']))
+		$pconfig['pop_bitenc_decode_depth'] = "0";
+	if (empty($pconfig['pop_uu_decode_depth']))
+		$pconfig['pop_uu_decode_depth'] = "0";
+
 	if (empty($pconfig['imap_preproc']))
 		$pconfig['imap_preproc'] = 'on';
+	if (empty($pconfig['imap_memcap']))
+		$pconfig['imap_memcap'] = "838860";
+	if (empty($pconfig['imap_b64_decode_depth']))
+		$pconfig['imap_b64_decode_depth'] = "0";
+	if (empty($pconfig['imap_qp_decode_depth']))
+		$pconfig['imap_qp_decode_depth'] = "0";
+	if (empty($pconfig['imap_bitenc_decode_depth']))
+		$pconfig['imap_bitenc_decode_depth'] = "0";
+	if (empty($pconfig['imap_uu_decode_depth']))
+		$pconfig['imap_uu_decode_depth'] = "0";
+
 	if (empty($pconfig['sip_preproc']))
 		$pconfig['sip_preproc'] = 'on';
 	if (empty($pconfig['other_preprocs']))
@@ -192,7 +240,17 @@ $disabled_rules_log = "{$if_friendly}_disabled_preproc_rules.log";
 
 // Check for returned "selected alias" if action is import
 if ($_GET['act'] == "import" && isset($_GET['varname']) && !empty($_GET['varvalue'])) {
-		$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
+
+	// Retrieve previously typed values we passed to SELECT ALIAS page
+	$pconfig['sf_portscan'] = htmlspecialchars($_GET['sf_portscan'])? 'on' : 'off';
+	$pconfig['pscan_ignore_scanners'] = htmlspecialchars($_GET['pscan_ignore_scanners']);
+	$pconfig['pscan_protocol'] = htmlspecialchars($_GET['pscan_protocol']);
+	$pconfig['pscan_type'] = htmlspecialchars($_GET['pscan_type']);
+	$pconfig['pscan_memcap'] = htmlspecialchars($_GET['pscan_memcap']);
+	$pconfig['pscan_sense_level'] = htmlspecialchars($_GET['pscan_sense_level']);
+
+	// Now retrieve the "selected alias" returned from SELECT ALIAS page
+	$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
 }
 
 // Handle deleting of any of the multiple configuration engines
@@ -270,6 +328,19 @@ if ($_POST['ResetAll']) {
 	$pconfig['ftp_telnet_detect_anomalies'] = "on";
 	$pconfig['ftp_telnet_ayt_attack_threshold'] = "20";
 	$pconfig['smtp_preprocessor'] = "on";
+	$pconfig['smtp_memcap'] = "838860";
+	$pconfig['smtp_max_mime_mem'] = "838860";
+	$pconfig['smtp_b64_decode_depth'] = "0";
+	$pconfig['smtp_qp_decode_depth'] = "0";
+	$pconfig['smtp_bitenc_decode_depth'] = "0";
+	$pconfig['smtp_uu_decode_depth'] = "0";
+	$pconfig['smtp_email_hdrs_log_depth'] = "1464";
+	$pconfig['smtp_ignore_data'] = 'off';
+	$pconfig['smtp_ignore_tls_data'] = 'on';
+	$pconfig['smtp_log_mail_from'] = 'on';
+	$pconfig['smtp_log_rcpt_to'] = 'on';
+	$pconfig['smtp_log_filename'] = 'on';
+	$pconfig['smtp_log_email_hdrs'] = 'on';
 	$pconfig['sf_portscan'] = "off";
 	$pconfig['pscan_protocol'] = "all";
 	$pconfig['pscan_type'] = "all";
@@ -284,7 +355,17 @@ if ($_POST['ResetAll']) {
 	$pconfig['sdf_mask_output'] = "off";
 	$pconfig['ssl_preproc'] = "on";
 	$pconfig['pop_preproc'] = "on";
+	$pconfig['pop_memcap'] = "838860";
+	$pconfig['pop_b64_decode_depth'] = "0";
+	$pconfig['pop_qp_decode_depth'] = "0";
+	$pconfig['pop_bitenc_decode_depth'] = "0";
+	$pconfig['pop_uu_decode_depth'] = "0";
 	$pconfig['imap_preproc'] = "on";
+	$pconfig['imap_memcap'] = "838860";
+	$pconfig['imap_b64_decode_depth'] = "0";
+	$pconfig['imap_qp_decode_depth'] = "0";
+	$pconfig['imap_bitenc_decode_depth'] = "0";
+	$pconfig['imap_uu_decode_depth'] = "0";
 	$pconfig['sip_preproc'] = "on";
 	$pconfig['dnp3_preproc'] = "off";
 	$pconfig['modbus_preproc'] = "off";
@@ -312,6 +393,52 @@ if ($_POST['save']) {
 			$input_errors[] = gettext("You must select at least one sensitive data type to inspect for when Sensitive Data detection is enabled.");
 	}
 
+	// Validate POP3 parameter values if POP3 Decoder is enabled
+	if ($_POST['pop_preproc'] == 'on') {
+		if ($_POST['pop_memcap'] < 3276 || $_POST['pop_memcap'] > 104857600)
+			$input_errors[] = gettext("The value for POP3 Decoder Memory Cap must be between 3,276 and 104,857,600.");
+		if ($_POST['pop_b64_decode_depth'] < -1 || $_POST['pop_b64_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for POP3 Decoder Base64 Decode Depth must be between -1 and 65,535.");
+		if ($_POST['pop_qp_decode_depth'] < -1 || $_POST['pop_qp_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for POP3 Decoder Quoted-Printable (QP) Decode Depth must be between -1 and 65,535.");
+		if ($_POST['pop_bitenc_decode_depth'] < -1 || $_POST['pop_bitenc_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for POP3 Decoder Non-Encoded MIME Extraction Depth must be between -1 and 65,535.");
+		if ($_POST['pop_uu_decode_depth'] < -1 || $_POST['pop_uu_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for POP3 Decoder Unix-to-Unix (UU) Decode Depth must be between -1 and 65,535.");
+	}
+
+	// Validate IMAP parameter values if IMAP Decoder is enabled
+	if ($_POST['imap_preproc'] == 'on') {
+		if ($_POST['imap_memcap'] < 3276 || $_POST['imap_memcap'] > 104857600)
+			$input_errors[] = gettext("The value for IMAP Decoder Memory Cap must be between 3,276 and 104,857,600.");
+		if ($_POST['imap_b64_decode_depth'] < -1 || $_POST['imap_b64_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for IMAP Decoder Base64 Decode Depth must be between -1 and 65,535.");
+		if ($_POST['imap_qp_decode_depth'] < -1 || $_POST['imap_qp_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for IMAP Decoder Quoted-Printable (QP) Decode Depth must be between -1 and 65,535.");
+		if ($_POST['imap_bitenc_decode_depth'] < -1 || $_POST['imap_bitenc_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for IMAP Decoder Non-Encoded MIME Extraction Depth must be between -1 and 65,535.");
+		if ($_POST['imap_uu_decode_depth'] < -1 || $_POST['imap_uu_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for IMAP Decoder Unix-to-Unix (UU) Decode Depth must be between -1 and 65,535.");
+	}
+
+	// Validate SMTP parameter values if SMTP Decoder is enabled
+	if ($_POST['smtp_preprocessor'] == 'on') {
+		if ($_POST['smtp_memcap'] < 3276 || $_POST['smtp_memcap'] > 104857600)
+			$input_errors[] = gettext("The value for SMTP Decoder Memory Cap must be between 3,276 and 104,857,600.");
+		if ($_POST['smtp_max_mime_mem'] < 3276 || $_POST['smtp_max_mime_mem'] > 104857600)
+			$input_errors[] = gettext("The value for SMTP Decoder Maximum MIME Memory must be between 3,276 and 104,857,600.");
+		if ($_POST['smtp_b64_decode_depth'] < -1 || $_POST['smtp_b64_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for SMTP Decoder Base64 Decode Depth must be between -1 and 65,535.");
+		if ($_POST['smtp_qp_decode_depth'] < -1 || $_POST['smtp_qp_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for SMTP Decoder Quoted-Printable (QP) Decode Depth must be between -1 and 65,535.");
+		if ($_POST['smtp_bitenc_decode_depth'] < -1 || $_POST['smtp_bitenc_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for SMTP Decoder Non-Encoded MIME Extraction Depth must be between -1 and 65,535.");
+		if ($_POST['smtp_uu_decode_depth'] < -1 || $_POST['smtp_uu_decode_depth'] > 65535)
+			$input_errors[] = gettext("The value for SMTP Decoder Unix-to-Unix (UU) Decode Depth must be between -1 and 65,535.");
+		if ($_POST['smtp_email_hdrs_log_depth'] < 0 || $_POST['smtp_email_hdrs_log_depth'] > 20480)
+			$input_errors[] = gettext("The value for SMTP Decoder E-Mail Headers Log Depth must be between 0 and 20,480.");
+	}
+
 	/* if no errors write to conf */
 	if (!$input_errors) {
 		/* post new options */
@@ -337,6 +464,23 @@ if ($_POST['save']) {
 		if ($_POST['ftp_telnet_inspection_type'] != "") { $natent['ftp_telnet_inspection_type'] = $_POST['ftp_telnet_inspection_type']; }else{ $natent['ftp_telnet_inspection_type'] = "stateful"; }
 		if ($_POST['ftp_telnet_ayt_attack_threshold'] != "") { $natent['ftp_telnet_ayt_attack_threshold'] = $_POST['ftp_telnet_ayt_attack_threshold']; }else{ $natent['ftp_telnet_ayt_attack_threshold'] = "20"; }
 		if ($_POST['sdf_alert_threshold'] != "") { $natent['sdf_alert_threshold'] = $_POST['sdf_alert_threshold']; }else{ $natent['sdf_alert_threshold'] = "25"; }
+		if ($_POST['pop_memcap'] != "") { $natent['pop_memcap'] = $_POST['pop_memcap']; }else{ $natent['pop_memcap'] = "838860"; }
+		if ($_POST['pop_b64_decode_depth'] != "") { $natent['pop_b64_decode_depth'] = $_POST['pop_b64_decode_depth']; }else{ $natent['pop_b64_decode_depth'] = "0"; }
+		if ($_POST['pop_qp_decode_depth'] != "") { $natent['pop_qp_decode_depth'] = $_POST['pop_qp_decode_depth']; }else{ $natent['pop_qp_decode_depth'] = "0"; }
+		if ($_POST['pop_bitenc_decode_depth'] != "") { $natent['pop_bitenc_decode_depth'] = $_POST['pop_bitenc_decode_depth']; }else{ $natent['pop_bitenc_decode_depth'] = "0"; }
+		if ($_POST['pop_uu_decode_depth'] != "") { $natent['pop_uu_decode_depth'] = $_POST['pop_uu_decode_depth']; }else{ $natent['pop_uu_decode_depth'] = "0"; }
+		if ($_POST['imap_memcap'] != "") { $natent['imap_memcap'] = $_POST['imap_memcap']; }else{ $natent['imap_memcap'] = "838860"; }
+		if ($_POST['imap_b64_decode_depth'] != "") { $natent['imap_b64_decode_depth'] = $_POST['imap_b64_decode_depth']; }else{ $natent['imap_b64_decode_depth'] = "0"; }
+		if ($_POST['imap_qp_decode_depth'] != "") { $natent['imap_qp_decode_depth'] = $_POST['imap_qp_decode_depth']; }else{ $natent['imap_qp_decode_depth'] = "0"; }
+		if ($_POST['imap_bitenc_decode_depth'] != "") { $natent['imap_bitenc_decode_depth'] = $_POST['imap_bitenc_decode_depth']; }else{ $natent['imap_bitenc_decode_depth'] = "0"; }
+		if ($_POST['imap_uu_decode_depth'] != "") { $natent['imap_uu_decode_depth'] = $_POST['imap_uu_decode_depth']; }else{ $natent['imap_uu_decode_depth'] = "0"; }
+		if ($_POST['smtp_memcap'] != "") { $natent['smtp_memcap'] = $_POST['smtp_memcap']; }else{ $natent['smtp_memcap'] = "838860"; }
+		if ($_POST['smtp_max_mime_mem'] != "") { $natent['smtp_max_mime_mem'] = $_POST['smtp_max_mime_mem']; }else{ $natent['smtp_max_mime_mem'] = "838860"; }
+		if ($_POST['smtp_b64_decode_depth'] != "") { $natent['smtp_b64_decode_depth'] = $_POST['smtp_b64_decode_depth']; }else{ $natent['smtp_b64_decode_depth'] = "0"; }
+		if ($_POST['smtp_qp_decode_depth'] != "") { $natent['smtp_qp_decode_depth'] = $_POST['smtp_qp_decode_depth']; }else{ $natent['smtp_qp_decode_depth'] = "0"; }
+		if ($_POST['smtp_bitenc_decode_depth'] != "") { $natent['smtp_bitenc_decode_depth'] = $_POST['smtp_bitenc_decode_depth']; }else{ $natent['smtp_bitenc_decode_depth'] = "0"; }
+		if ($_POST['smtp_uu_decode_depth'] != "") { $natent['smtp_uu_decode_depth'] = $_POST['smtp_uu_decode_depth']; }else{ $natent['smtp_uu_decode_depth'] = "0"; }
+		if ($_POST['smtp_email_hdrs_log_depth'] != "") { $natent['smtp_email_hdrs_log_depth'] = $_POST['smtp_email_hdrs_log_depth']; }else{ $natent['smtp_email_hdrs_log_depth'] = "1464"; }
 
 		// Set SDF inspection types
 		$natent['sdf_alert_data_type'] = implode(",",$_POST['sdf_alert_data_type']);
@@ -352,6 +496,13 @@ if ($_POST['save']) {
 		$natent['ftp_telnet_normalize'] = $_POST['ftp_telnet_normalize'] ? 'on' : 'off';
 		$natent['ftp_telnet_detect_anomalies'] = $_POST['ftp_telnet_detect_anomalies'] ? 'on' : 'off';
 		$natent['smtp_preprocessor'] = $_POST['smtp_preprocessor'] ? 'on' : 'off';
+		$natent['smtp_ignore_data'] = $_POST['smtp_ignore_data'] ? 'on' : 'off';
+		$natent['smtp_ignore_tls_data'] = $_POST['smtp_ignore_tls_data'] ? 'on' : 'off';
+		$natent['smtp_log_mail_from'] = $_POST['smtp_log_mail_from'] ? 'on' : 'off';
+		$natent['smtp_log_rcpt_to'] = $_POST['smtp_log_rcpt_to'] ? 'on' : 'off';
+		$natent['smtp_log_filename'] = $_POST['smtp_log_filename'] ? 'on' : 'off';
+		$natent['smtp_log_email_hdrs'] = $_POST['smtp_log_email_hdrs'] ? 'on' : 'off';
+
 		$natent['sf_portscan'] = $_POST['sf_portscan'] ? 'on' : 'off';
 		$natent['dce_rpc_2'] = $_POST['dce_rpc_2'] ? 'on' : 'off';
 		$natent['dns_preprocessor'] = $_POST['dns_preprocessor'] ? 'on' : 'off';
@@ -385,7 +536,9 @@ if ($_POST['save']) {
 		/* rules for this interface.                     */
 		/*************************************************/
 		$rebuild_rules = true;
+		conf_mount_rw();
 		snort_generate_conf($natent);
+		conf_mount_ro();
 		$rebuild_rules = false;
 
 		/* If 'preproc_auto_rule_disable' is off, then clear log file */
@@ -1094,7 +1247,7 @@ if ($savemsg) {
 					value="<?=$pconfig['pscan_ignore_scanners'];?>" title="<?=trim(filter_expand_alias($pconfig['pscan_ignore_scanners']));?>">&nbsp;&nbsp;<?php echo gettext("Leave blank for default.  ") . 
 					gettext("Default value is ") . "<strong>" . gettext("\$HOME_NET") . "</strong>"; ?>.</td>
 					<td class="vexpl" align="right">
-						<input type="button" class="formbtns" value="Aliases" onclick="parent.location='snort_select_alias.php?id=<?=$id;?>&type=host|network&varname=pscan_ignore_scanners&act=import&multi_ip=yes&returl=<?=urlencode($_SERVER['PHP_SELF']);?>'"  
+						<input type="button" class="formbtns" value="Aliases" onclick="selectAlias();"  
 						title="<?php echo gettext("Select an existing IP alias");?>"/></td>
 				</tr>
 				<tr>
@@ -1308,34 +1461,300 @@ if ($savemsg) {
 		</td>
 	</tr>
 	<tr>
-		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("General Preprocessors"); ?></td>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("POP3 Decoder Settings"); ?></td>
 	</tr>
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable RPC Decode and Back Orifice detector"); ?></td>
-		<td width="78%" class="vtable"><input name="other_preprocs" type="checkbox" value="on" 
-			<?php if ($pconfig['other_preprocs']=="on") echo "checked"; ?>>
-		<?php echo gettext("Normalize/Decode RPC traffic and detects Back Orifice traffic on the network.  Default is ") . 
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable POP3 Decoder"); ?></td>
+		<td width="78%" class="vtable"><input name="pop_preproc" type="checkbox" value="on" 
+			<?php if ($pconfig['pop_preproc']=="on") echo "checked"; ?> onclick="pop_enable_change();"/>
+		<?php echo gettext("Normalize/Decode POP3 protocol for enforcement and buffer overflows.  Default is ") . 
 		"<strong>" . gettext("Checked") . "</strong>"; ?>.</td>
 	</tr>
+	<tbody id="pop_setting_rows">
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable POP Normalizer"); ?></td>
-		<td width="78%" class="vtable"><input name="pop_preproc" type="checkbox" value="on" 
-			<?php if ($pconfig['pop_preproc']=="on") echo "checked"; ?>>
-		<?php echo gettext("Normalize/Decode POP protocol for enforcement and buffer overflows.  Default is ") . 
-		"<strong>" . gettext("Checked") . "</strong>"; ?>.</td>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Memory Cap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="pop_memcap" type="text" class="formfld unknown" id="pop_memcap" size="9" 
+			value="<?=htmlspecialchars($pconfig['pop_memcap']);?>">
+			<?php echo gettext("Maximum memory in bytes to use for decoding attachments.  ") . 
+			gettext("Default is ") . "<strong>" . gettext("838860") . "</strong>" . 
+			gettext(" bytes."); ?><br/><br/>
+			<?php echo gettext("The minimum value is ") . "<strong>" . gettext("3276") . "</strong>" . gettext(" bytes and the maximum is ") . 
+			"<strong>" . gettext("100 MB") . "</strong>" . gettext(" (104857600). An IMAP preprocessor alert with sid 3 is ") . 
+			gettext("generated (when enabled) if this limit is exceeded."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Base64 Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="pop_b64_decode_depth" type="text" class="formfld unknown" id="pop_b64_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['pop_b64_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode base64 encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the base64 decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of base64 encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of base64 MIME attachments, and applies per attachment. A POP preprocessor alert with sid 4 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Quoted Printable Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="pop_qp_decode_depth" type="text" class="formfld unknown" id="pop_qp_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['pop_qp_decode_depth']);?>">
+			<?php echo gettext("Byte depth to decode Quoted Printable (QP) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the QP decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of QP encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of QP MIME attachments, and applies per attachment. A POP preprocessor alert with sid 5 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Non-Encoded MIME Extraction Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="pop_bitenc_decode_depth" type="text" class="formfld unknown" id="pop_bitenc_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['pop_bitenc_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to extract non-encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the extraction of non-encoded MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the extraction of non-encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the extraction of non-encoded MIME attachments, and applies per attachment.");?>
+		</td>
 	</tr>
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable IMAP Normalizer"); ?></td>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Unix-to-Unix Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="pop_uu_decode_depth" type="text" class="formfld unknown" id="pop_uu_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['pop_uu_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode Unix-to-Unix (UU) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the UU decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of UU encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of UU MIME attachments, and applies per attachment. A POP preprocessor alert with sid 7 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	</tbody>
+	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("IMAP Decoder Settings"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable IMAP Decoder"); ?></td>
 		<td width="78%" class="vtable"><input name="imap_preproc" type="checkbox" value="on" 
-			<?php if ($pconfig['imap_preproc']=="on") echo "checked"; ?>>
-		<?php echo gettext("Normalize/Decode IMAP protocol for enforcement and buffer overflows.  Default is ") . 
-		"<strong>" . gettext("Checked") . "</strong>"; ?>.</td>
+			<?php if ($pconfig['imap_preproc']=="on") echo "checked"; ?> onclick="imap_enable_change();"/>
+			<?php echo gettext("Normalize/Decode IMAP protocol for enforcement and buffer overflows.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?>
+		</td>
+	</tr>
+	<tbody id="imap_setting_rows">
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Memory Cap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="imap_memcap" type="text" class="formfld unknown" id="imap_memcap" size="9" 
+			value="<?=htmlspecialchars($pconfig['imap_memcap']);?>">
+			<?php echo gettext("Maximum memory in bytes to use for decoding attachments.  ") . 
+			gettext("Default is ") . "<strong>" . gettext("838860") . "</strong>" . 
+			gettext(" bytes."); ?><br/><br/>
+			<?php echo gettext("The minimum value is ") . "<strong>" . gettext("3276") . "</strong>" . gettext(" bytes and the maximum is ") . 
+			"<strong>" . gettext("100 MB") . "</strong>" . gettext(" (104857600). An IMAP preprocessor alert with sid 3 is ") . 
+			gettext("generated (when enabled) if this limit is exceeded."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Base64 Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="imap_b64_decode_depth" type="text" class="formfld unknown" id="imap_b64_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['imap_b64_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode base64 encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the base64 decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of base64 encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of base64 MIME attachments, and applies per attachment. An IMAP preprocessor alert with sid 4 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
 	</tr>
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable SMTP Normalizer"); ?></td>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Quoted Printable Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="imap_qp_decode_depth" type="text" class="formfld unknown" id="imap_qp_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['imap_qp_decode_depth']);?>">
+			<?php echo gettext("Byte depth to decode Quoted Printable (QP) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the QP decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of QP encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of QP MIME attachments, and applies per attachment. An IMAP preprocessor alert with sid 5 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Non-Encoded MIME Extraction Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="imap_bitenc_decode_depth" type="text" class="formfld unknown" id="imap_bitenc_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['imap_bitenc_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to extract non-encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the extraction of non-encoded MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the extraction of non-encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the extraction of non-encoded MIME attachments, and applies per attachment.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Unix-to-Unix Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="imap_uu_decode_depth" type="text" class="formfld unknown" id="imap_uu_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['imap_uu_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode Unix-to-Unix (UU) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the UU decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of UU encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of UU MIME attachments, and applies per attachment. An IMAP preprocessor alert with sid 7 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	</tbody>
+
+	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("SMTP Decoder Settings"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable SMTP Decoder"); ?></td>
 		<td width="78%" class="vtable"><input name="smtp_preprocessor" type="checkbox" value="on" 
-			<?php if ($pconfig['smtp_preprocessor']=="on") echo "checked"; ?>>
-		<?php echo gettext("Normalize/Decode SMTP protocol for enforcement and buffer overflows.  Default is ") . 
+			<?php if ($pconfig['smtp_preprocessor']=="on") echo "checked"; ?> onclick="smtp_enable_change();"/>
+			<?php echo gettext("Normalize/Decode SMTP protocol for enforcement and buffer overflows.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?>
+		</td>
+	</tr>
+	<tbody id="smtp_setting_rows">
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Memory Cap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="smtp_memcap" type="text" class="formfld unknown" id="smtp_memcap" size="9" 
+			value="<?=htmlspecialchars($pconfig['smtp_memcap']);?>"/>
+			<?php echo gettext("Max memory in bytes used to log filename, addresses and headers.  ") . 
+			gettext("Default is ") . "<strong>" . gettext("838860") . "</strong>" . gettext(" bytes."); ?><br/><br/>
+			<?php echo gettext("The minimum value is ") . "<strong>" . gettext("3276") . "</strong>" . gettext(" bytes and the maximum is ") . 
+			"<strong>" . gettext("100 MB") . "</strong>" . gettext(" (104857600).  When this memcap is reached, ") . 
+			gettext("SMTP will stop logging the filename, MAIL FROM address, RCPT TO addresses and email headers until memory becomes available."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Ignore Data"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_ignore_data" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_ignore_data']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Ignore data section of mail (except for mail headers) when processing rules.  Default is ") . 
+			"<strong>" . gettext("Not Checked") . "</strong>."; ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Ignore TLS Data"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_ignore_tls_data" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_ignore_tls_data']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Ignore TLS-encrypted data when processing rules.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Mail From"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_log_mail_from" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_log_mail_from']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Log sender email address extracted from MAIL FROM command.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?><br/>
+			<span class="red"><strong><?php echo gettext("Note: "); ?></strong></span>
+			<?php echo gettext("this is logged only with the unified2 (Barnyard2) output enabled."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Receipt To"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_log_rcpt_to" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_log_rcpt_to']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Log recipient email addresses extracted from RCPT TO command.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?><br/>
+			<span class="red"><strong><?php echo gettext("Note: "); ?></strong></span>
+			<?php echo gettext("this is logged only with the unified2 (Barnyard2) output enabled."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Filename"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_log_filename" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_log_filename']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Log MIME attachment filenames extracted from Content-Disposition header.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?><br/>
+			<span class="red"><strong><?php echo gettext("Note: "); ?></strong></span>
+			<?php echo gettext("this is logged only with the unified2 (Barnyard2) output enabled."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Log E-Mail Headers"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_log_email_hdrs" type="checkbox" value="on" 
+			<?php if ($pconfig['smtp_log_email_hdrs']=="on") echo "checked"; ?>/>
+			<?php echo gettext("Log SMTP email headers extracted from SMTP data.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?><br/>
+			<span class="red"><strong><?php echo gettext("Note: "); ?></strong></span>
+			<?php echo gettext("this is logged only with the unified2 (Barnyard2) output enabled."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("E-Mail Headers Log Depth"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="smtp_email_hdrs_log_depth" type="text" class="formfld unknown" id="smtp_email_hdrs_log_depth" size="9" 
+			value="<?=htmlspecialchars($pconfig['smtp_email_hdrs_log_depth']);?>"/>
+			<?php echo gettext("Memory in bytes to use for logging e-mail headers.  ") . 
+			gettext("Default is ") . "<strong>" . gettext("1464") . "</strong>" . gettext(" bytes."); ?><br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("0") . "</strong>" . gettext(" to ") . 
+			"<strong>" . gettext("20480") . "</strong>" . gettext(".  A value of ") . "<strong>" . gettext("0") . "</strong>" . 
+			gettext(" will disable e-mail headers logging."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Maximum MIME Memory"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="smtp_max_mime_mem" type="text" class="formfld unknown" id="smtp_max_mime_mem" size="9" 
+			value="<?=htmlspecialchars($pconfig['smtp_max_mime_mem']);?>"/>
+			<?php echo gettext("Maximum memory in bytes to use for decoding attachments.  ") . 
+			gettext("Default is ") . "<strong>" . gettext("838860") . "</strong>" . gettext(" bytes."); ?><br/><br/>
+			<?php echo gettext("The minimum value is ") . "<strong>" . gettext("3276") . "</strong>" . gettext(" bytes and the maximum is ") . 
+			"<strong>" . gettext("100 MB") . "</strong>" . gettext(" (104857600)."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Base64 Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_b64_decode_depth" type="text" class="formfld unknown" id="smtp_b64_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['smtp_b64_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode base64 encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the base64 decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of base64 encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of base64 MIME attachments, and applies per attachment. An SMTP preprocessor alert with sid 10 ") . 
+			gettext("is generated when the decoding fails.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Quoted Printable Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_qp_decode_depth" type="text" class="formfld unknown" id="smtp_qp_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['smtp_qp_decode_depth']);?>">
+			<?php echo gettext("Byte depth to decode Quoted Printable (QP) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the QP decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of QP encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of QP MIME attachments, and applies per attachment. An SMTP preprocessor alert with sid 11 ") . 
+			gettext("is generated when the decoding fails.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Non-Encoded MIME Extraction Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_bitenc_decode_depth" type="text" class="formfld unknown" id="smtp_bitenc_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['smtp_bitenc_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to extract non-encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the extraction of non-encoded MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the extraction of non-encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the extraction of non-encoded MIME attachments, and applies per attachment.");?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Unix-to-Unix Decoding Depth"); ?></td>
+		<td width="78%" class="vtable"><input name="smtp_uu_decode_depth" type="text" class="formfld unknown" id="smtp_uu_decode_depth" size="9" value="<?=htmlspecialchars($pconfig['smtp_uu_decode_depth']);?>">
+			<?php echo gettext("Depth in bytes to decode Unix-to-Unix (UU) encoded MIME attachments.  Default is ") . "<strong>" . gettext("0") . "</strong>" . gettext(" (unlimited)");?>.<br/><br/>
+			<?php echo gettext("Allowable values range from ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" to ") . "<strong>" . gettext("65535") . "</strong>" . 
+			gettext(". A value of ") . "<strong>" . gettext("-1") . "</strong>" . gettext(" turns off the UU decoding of MIME attachments. ") . 
+			gettext("A value of ") . "<strong>" . gettext("0") . "</strong>" . gettext(" sets the decoding of UU encoded MIME attachments to unlimited. ") . 
+			gettext("A value other than 0 or -1 restricts the decoding of UU MIME attachments, and applies per attachment. An SMTP preprocessor alert with sid 13 ") . 
+			gettext("is generated (if enabled) when the decoding fails.");?>
+		</td>
+	</tr>
+	</tbody>
+
+
+	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("General Preprocessors"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable RPC Decode and Back Orifice detector"); ?></td>
+		<td width="78%" class="vtable"><input name="other_preprocs" type="checkbox" value="on" 
+			<?php if ($pconfig['other_preprocs']=="on") echo "checked"; ?>>
+		<?php echo gettext("Normalize/Decode RPC traffic and detects Back Orifice traffic on the network.  Default is ") . 
 		"<strong>" . gettext("Checked") . "</strong>"; ?>.</td>
 	</tr>
 	<tr>
@@ -1692,6 +2111,36 @@ function sensitive_data_enable_change() {
 	}
 }
 
+function pop_enable_change() {
+	var endis = !(document.iform.pop_preproc.checked);
+
+	// Hide POP3 configuration rows if POP preprocessor disabled
+	if (endis)
+		document.getElementById("pop_setting_rows").style.display = "none";
+	else
+		document.getElementById("pop_setting_rows").style.display = "";
+}
+
+function imap_enable_change() {
+	var endis = !(document.iform.imap_preproc.checked);
+
+	// Hide IMAP configuration rows if IMAP preprocessor disabled
+	if (endis)
+		document.getElementById("imap_setting_rows").style.display = "none";
+	else
+		document.getElementById("imap_setting_rows").style.display = "";
+}
+
+function smtp_enable_change() {
+	var endis = !(document.iform.smtp_preprocessor.checked);
+
+	// Hide SMTP configuration rows if SMTP preprocessor disabled
+	if (endis)
+		document.getElementById("smtp_setting_rows").style.display = "none";
+	else
+		document.getElementById("smtp_setting_rows").style.display = "";
+}
+
 function enable_change_all() {
 	http_inspect_enable_change();
 	sf_portscan_enable_change();
@@ -1746,6 +2195,9 @@ function enable_change_all() {
 	stream5_track_icmp_enable_change();
 	ftp_telnet_enable_change();
 	sensitive_data_enable_change();
+	pop_enable_change();
+	imap_enable_change();
+	smtp_enable_change();
 }
 
 function wopen(url, name, w, h)
@@ -1763,6 +2215,29 @@ function wopen(url, name, w, h)
     win.focus();
 }
 
+function selectAlias() {
+
+	var loc;
+	var fields = [ "sf_portscan", "pscan_protocol", "pscan_type", "pscan_sense_level", "pscan_memcap", "pscan_ignore_scanners" ];
+
+	// Scrape current form field values and add to
+	// the select alias URL as a query string.
+	var loc = 'snort_select_alias.php?id=<?=$id;?>&act=import&type=host|network';
+	loc = loc + '&varname=pscan_ignore_scanners&multi_ip=yes';
+	loc = loc + '&returl=<?=urlencode($_SERVER['PHP_SELF']);?>';
+	loc = loc + '&uuid=<?=$passlist_uuid;?>';
+
+	// Iterate over just the specific form fields we want to pass to
+	// the select alias URL.
+	fields.forEach(function(entry) {
+		var tmp = $(entry).serialize();
+		if (tmp.length > 0)
+			loc = loc + '&' + tmp;
+	});
+	
+	window.parent.location = loc; 
+}
+
 // Set initial state of form controls
 enable_change_all();
 
diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php
index e69152c3..8d9aa6ba 100755
--- a/config/snort/snort_rules.php
+++ b/config/snort/snort_rules.php
@@ -157,12 +157,16 @@ if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) &
 	$sid = $_POST['sid'];
 
 	// See if the target SID is in our list of modified SIDs,
-	// and toggle it back to default if present; otherwise,
-	// add it to the appropriate modified SID list.
-	if (isset($enablesid[$gid][$sid]))
+	// and toggle if present; otherwise, add it to the
+	// appropriate modified SID list.
+	if (isset($enablesid[$gid][$sid])) {
 		unset($enablesid[$gid][$sid]);
-	elseif (isset($disablesid[$gid][$sid]))
+		$disablesid[$gid][$sid] = "disablesid";
+	}
+	elseif (isset($disablesid[$gid][$sid])) {
 		unset($disablesid[$gid][$sid]);
+		$enablesid[$gid][$sid] = "enablesid";
+	}
 	else {
 		if ($rules_map[$gid][$sid]['disabled'] == 1)
 			$enablesid[$gid][$sid] = "enablesid";
@@ -198,6 +202,10 @@ if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) &
 	/* Update the config.xml file. */
 	write_config("Snort pkg: modified state for rule {$gid}:{$sid} on {$a_rule[$id]['interface']}.");
 
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('snort_rules');
+
+	// Set a scroll-to anchor location
 	$anchor = "rule_{$gid}_{$sid}";
 }
 elseif ($_POST['disable_all'] && !empty($rules_map)) {
@@ -237,6 +245,9 @@ elseif ($_POST['disable_all'] && !empty($rules_map)) {
 		unset($a_rule[$id]['rule_sid_off']);
 
 	write_config("Snort pkg: disabled all rules in category {$currentruleset} for {$a_rule[$id]['interface']}.");
+
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('snort_rules');
 }
 elseif ($_POST['enable_all'] && !empty($rules_map)) {
 
@@ -274,6 +285,9 @@ elseif ($_POST['enable_all'] && !empty($rules_map)) {
 		unset($a_rule[$id]['rule_sid_off']);
 
 	write_config("Snort pkg: enable all rules in category {$currentruleset} for {$a_rule[$id]['interface']}.");
+
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('snort_rules');
 }
 elseif ($_POST['resetcategory'] && !empty($rules_map)) {
 
@@ -313,6 +327,9 @@ elseif ($_POST['resetcategory'] && !empty($rules_map)) {
 		unset($a_rule[$id]['rule_sid_off']);
 
 	write_config("Snort pkg: remove enablesid/disablesid changes for category {$currentruleset} on {$a_rule[$id]['interface']}.");
+
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('snort_rules');
 }
 elseif ($_POST['resetall'] && !empty($rules_map)) {
 
@@ -322,15 +339,21 @@ elseif ($_POST['resetall'] && !empty($rules_map)) {
 
 	/* Update the config.xml file. */
 	write_config("Snort pkg: remove all enablesid/disablesid changes for {$a_rule[$id]['interface']}.");
+
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('snort_rules');
 }
 else if ($_POST['cancel']) {
 	$pconfig['customrules'] = base64_decode($a_rule[$id]['customrules']);
+	clear_subsystem_dirty('snort_rules');
 }
 elseif ($_POST['clear']) {
 	unset($a_rule[$id]['customrules']);
 	write_config("Snort pkg: clear all custom rules for {$a_rule[$id]['interface']}.");
 	$rebuild_rules = true;
+	conf_mount_rw();
 	snort_generate_conf($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 	$pconfig['customrules'] = '';
 }
@@ -342,7 +365,9 @@ elseif ($_POST['save']) {
 		unset($a_rule[$id]['customrules']);
 	write_config("Snort pkg: save modified custom rules for {$a_rule[$id]['interface']}.");
 	$rebuild_rules = true;
+	conf_mount_rw();
 	snort_generate_conf($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 	$output = "";
 	$retcode = "";
@@ -361,6 +386,8 @@ elseif ($_POST['save']) {
 		$savemsg = gettext("Custom rules validated successfully and have been saved to the Snort configuration files. ");
 		$savemsg .= gettext("Any active Snort process on this interface has been signalled to live-load the new rules.");
 	}
+
+	clear_subsystem_dirty('snort_rules');
 }
 else if ($_POST['apply']) {
 	/* Save new configuration */
@@ -371,14 +398,18 @@ else if ($_POST['apply']) {
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	snort_generate_conf($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Soft-restart Snort to live-load new rules */
 	snort_reload_config($a_rule[$id]);
+
+	// We have saved changes and done a soft restart, so clear "dirty" flag
+	clear_subsystem_dirty('snort_rules');
 }
 
-require_once("guiconfig.inc");
 include_once("head.inc");
 
 $if_friendly = convert_friendly_interface_to_friendly_descr($a_rule[$id]['interface']);
@@ -405,6 +436,11 @@ if ($savemsg) {
 <input type='hidden' name='openruleset' id='openruleset' value='<?=$currentruleset;?>'/>
 <input type='hidden' name='sid' id='sid' value=''/>
 <input type='hidden' name='gid' id='gid' value=''/>
+
+<?php if (is_subsystem_dirty('snort_rules')): ?><p>
+<?php print_info_box_np(gettext("A change has been made to a rule state.") . "<br/>" . gettext("Click APPLY when finished to send the changes to the running configuration."));?>
+<?php endif; ?>
+
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 	<tr><td>
 	<?php
@@ -564,8 +600,8 @@ if ($savemsg) {
 							<col axis="string">
 						</colgroup>
 						<thead>
-						   <tr>
-							<th class="list">&nbsp;</th>
+						   <tr class="sortableHeaderRowIdentifier">
+							<th class="list sorttable_nosort">&nbsp;</th>
 							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Proto"); ?></th>
@@ -589,7 +625,7 @@ if ($savemsg) {
 									$textse = "</span>";
 									$iconb = "icon_reject_d.gif";
 									$disable_cnt++;
-									$title = gettext("Disabled by user. Click to toggle to default state");
+									$title = gettext("Disabled by user. Click to toggle to enabled state");
 								}
 								elseif (($v['disabled'] == 1) && (!isset($enablesid[$gid][$sid]))) {
 									$textss = "<span class=\"gray\">";
@@ -602,7 +638,7 @@ if ($savemsg) {
 									$textss = $textse = "";
 									$iconb = "icon_reject.gif";
 									$enable_cnt++;
-									$title = gettext("Enabled by user. Click to toggle to default state");
+									$title = gettext("Enabled by user. Click to toggle to disabled state");
 								}
 								else {
 									$textss = $textse = "";
@@ -632,7 +668,7 @@ if ($savemsg) {
 								$message = snort_get_msg($v['rule']); // description field
 								$sid_tooltip = gettext("View the raw text for this rule");
 
-								echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\" sorttable_customkey=\"\">{$textss}
+								echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\">{$textss}
 								<a id=\"rule_{$gid}_{$sid}\" href=''><input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
 								document.getElementById('gid').value='{$gid}';\" 
 								src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
@@ -687,8 +723,8 @@ if ($savemsg) {
 							<col align="left" axis="string">
 						</colgroup>
 						<thead>
-						   <tr>
-							<th class="list">&nbsp;</th>
+						   <tr class="sortableHeaderRowIdentifier">
+							<th class="list" sorttable_nosort>&nbsp;</th>
 							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Classification"); ?></th>
@@ -708,7 +744,7 @@ if ($savemsg) {
 											$textse = "</span>";
 											$iconb = "icon_reject_d.gif";
 											$disable_cnt++;
-											$title = gettext("Disabled by user. Click to toggle to default state");
+											$title = gettext("Disabled by user. Click to toggle to enabled state");
 										}
 										elseif (($v['disabled'] == 1) && (!isset($enablesid[$gid][$sid]))) {
 											$textss = "<span class=\"gray\">";
@@ -721,7 +757,7 @@ if ($savemsg) {
 											$textss = $textse = "";
 											$iconb = "icon_reject.gif";
 											$enable_cnt++;
-											$title = gettext("Enabled by user. Click to toggle to default state");
+											$title = gettext("Enabled by user. Click to toggle to disabled state");
 										}
 										else {
 											$textss = $textse = "";
@@ -741,7 +777,7 @@ if ($savemsg) {
 										else
 											$policy = "none";
 
-										echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\" sorttable_customkey=\"\">{$textss}
+										echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\">{$textss}
 										<input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
 										document.getElementById('gid').value='{$gid}';\" 
 										src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
diff --git a/config/snort/snort_rules_flowbits.php b/config/snort/snort_rules_flowbits.php
index d7c18a9d..cbb7b631 100644
--- a/config/snort/snort_rules_flowbits.php
+++ b/config/snort/snort_rules_flowbits.php
@@ -216,7 +216,7 @@ if ($savemsg)
 				<col axis="string">
 			</colgroup>
 			<thead>
-			   <tr>
+			   <tr class="sortableHeaderRowIdentifier">
 				<th class="listhdrr" axis="number"><?php echo gettext("SID"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Source"); ?></th>
@@ -263,7 +263,7 @@ if ($savemsg)
 
 							// Use "echo" to write the table HTML row-by-row.
 							echo "<tr>" . 
-								"<td class=\"listr\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
+								"<td class=\"listr\" style=\"sorttable_customkey:{$sid};\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
 								"<td class=\"listr\" style=\"text-align:center;\">{$protocol}</td>" . 
 								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[2]}\">{$source}</span></td>" . 
 								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[5]}\">{$destination}</span></td>" . 
diff --git a/config/snort/snort_rulesets.php b/config/snort/snort_rulesets.php
index 79365f5f..59fe6eef 100755
--- a/config/snort/snort_rulesets.php
+++ b/config/snort/snort_rulesets.php
@@ -160,7 +160,9 @@ if ($_POST["save"]) {
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	snort_generate_conf($a_nat[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Soft-restart Snort to live-load new rules */
diff --git a/config/squid3/31/squid_reverse.inc b/config/squid3/31/squid_reverse.inc
index d2611c79..badaeebe 100644
--- a/config/squid3/31/squid_reverse.inc
+++ b/config/squid3/31/squid_reverse.inc
@@ -78,7 +78,7 @@ function squid_resync_reverse() {
 		$real_ifaces[] = squid_get_real_interface_address($iface);
 		if($real_ifaces[$i][0]) {
 		      //HTTP
-		      if (!empty($settings['reverse_http']))
+		      if (!empty($settings['reverse_http']) OR ($settings['reverse_owa_autodiscover'] == 'on'))
 		      		$conf .= "http_port {$real_ifaces[$i][0]}:{$http_port} accel defaultsite={$http_defsite} vhost\n";
 		      //HTTPS
 		      if (!empty($settings['reverse_https']))
@@ -90,7 +90,7 @@ function squid_resync_reverse() {
 		$reverse_ip = explode(";", ($settings['reverse_ip']));
 		foreach ($reverse_ip as $reip) {
 		      //HTTP
-		      if (!empty($settings['reverse_http']))
+		      if (!empty($settings['reverse_http']) OR ($settings['reverse_owa_autodiscover'] == 'on'))
 		      		$conf .= "http_port {$reip}:{$http_port} accel defaultsite={$http_defsite} vhost\n";
 		      //HTTPS
 		      if (!empty($settings['reverse_https']))
@@ -106,8 +106,8 @@ function squid_resync_reverse() {
 			$casnr = 0;
 			foreach ($reverse_owa_ip as $reowaip) {
 				$casnr++;
-				$conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASS ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_443_{$casnr}_pfs\n";
-				$conf .= "cache_peer {$reowaip} parent 80 0 proxy-only no-query originserver login=PASS name=OWA_HOST_80_{$casnr}_pfs\n";
+				$conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query no-digest originserver login=PASS ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_443_{$casnr}_pfs\n";
+				$conf .= "cache_peer {$reowaip} parent 80 0 proxy-only no-query no-digest originserver login=PASS name=OWA_HOST_80_{$casnr}_pfs\n";
 			}
 		}
 		
diff --git a/config/squid3/31/squid_reverse.xml b/config/squid3/31/squid_reverse.xml
index b3a4c6cb..40fb0ec1 100644
--- a/config/squid3/31/squid_reverse.xml
+++ b/config/squid3/31/squid_reverse.xml
@@ -252,7 +252,8 @@
 		<field>
 			<fielddescr>Enable AutoDiscover</fielddescr>
 			<fieldname>reverse_owa_autodiscover</fieldname>
-			<description>If this field is checked, AutoDiscover will be enabled.</description>
+			<description><![CDATA[If this field is checked, AutoDiscover will be enabled.<br>
+								<strong>You also should set up the autodiscover DNS-record to point to you WAN-IP.</strong>]]></description>
 			<type>checkbox</type>
 		</field>
 		<field>
diff --git a/config/squid3/31/squid_reverse_general.xml b/config/squid3/31/squid_reverse_general.xml
index 47426c8e..1795edf5 100644
--- a/config/squid3/31/squid_reverse_general.xml
+++ b/config/squid3/31/squid_reverse_general.xml
@@ -240,7 +240,8 @@
 		<field>
 			<fielddescr>Enable AutoDiscover</fielddescr>
 			<fieldname>reverse_owa_autodiscover</fieldname>
-			<description>If this field is checked, AutoDiscover will be enabled.</description>
+			<description><![CDATA[If this field is checked, AutoDiscover will be enabled.<br>
+								<strong>You also should set up the autodiscover DNS-record to point to you WAN-IP.</strong>]]></description>
 			<type>checkbox</type>
 		</field>
 	</fields>
diff --git a/config/squid3/33/squid_reverse.inc b/config/squid3/33/squid_reverse.inc
index a6b81c0b..1332f220 100755
--- a/config/squid3/33/squid_reverse.inc
+++ b/config/squid3/33/squid_reverse.inc
@@ -78,7 +78,7 @@ function squid_resync_reverse() {
 		$real_ifaces[] = squid_get_real_interface_address($iface);
 		if($real_ifaces[$i][0]) {
 		      //HTTP
-		      if (!empty($settings['reverse_http']))
+		      if (!empty($settings['reverse_http']) OR ($settings['reverse_owa_autodiscover'] == 'on'))
 		      		$conf .= "http_port {$real_ifaces[$i][0]}:{$http_port} accel defaultsite={$http_defsite} vhost\n";
 		      //HTTPS
 		      if (!empty($settings['reverse_https']))
@@ -90,7 +90,7 @@ function squid_resync_reverse() {
 		$reverse_ip = explode(";", ($settings['reverse_ip']));
 		foreach ($reverse_ip as $reip) {
 		      //HTTP
-		      if (!empty($settings['reverse_http']))
+		      if (!empty($settings['reverse_http']) OR ($settings['reverse_owa_autodiscover'] == 'on'))
 		      		$conf .= "http_port {$reip}:{$http_port} accel defaultsite={$http_defsite} vhost\n";
 		      //HTTPS
 		      if (!empty($settings['reverse_https']))
@@ -106,8 +106,8 @@ function squid_resync_reverse() {
 			$casnr = 0;
 			foreach ($reverse_owa_ip as $reowaip) {
 				$casnr++;
-				$conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_443_{$casnr}_pfs\n";
-				$conf .= "cache_peer {$reowaip} parent 80 0 proxy-only no-query originserver login=PASSTHRU connection-auth=on name=OWA_HOST_80_{$casnr}_pfs\n";
+				$conf .= "cache_peer {$reowaip} parent 443 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on ssl sslflags=DONT_VERIFY_PEER front-end-https=on name=OWA_HOST_443_{$casnr}_pfs\n";
+				$conf .= "cache_peer {$reowaip} parent 80 0 proxy-only no-query no-digest originserver login=PASSTHRU connection-auth=on name=OWA_HOST_80_{$casnr}_pfs\n";
 			}
 		}
 		
diff --git a/config/squid3/33/squid_reverse.xml b/config/squid3/33/squid_reverse.xml
index b3a4c6cb..40fb0ec1 100755
--- a/config/squid3/33/squid_reverse.xml
+++ b/config/squid3/33/squid_reverse.xml
@@ -252,7 +252,8 @@
 		<field>
 			<fielddescr>Enable AutoDiscover</fielddescr>
 			<fieldname>reverse_owa_autodiscover</fieldname>
-			<description>If this field is checked, AutoDiscover will be enabled.</description>
+			<description><![CDATA[If this field is checked, AutoDiscover will be enabled.<br>
+								<strong>You also should set up the autodiscover DNS-record to point to you WAN-IP.</strong>]]></description>
 			<type>checkbox</type>
 		</field>
 		<field>
diff --git a/config/squid3/33/squid_reverse_general.xml b/config/squid3/33/squid_reverse_general.xml
index 47426c8e..1795edf5 100755
--- a/config/squid3/33/squid_reverse_general.xml
+++ b/config/squid3/33/squid_reverse_general.xml
@@ -240,7 +240,8 @@
 		<field>
 			<fielddescr>Enable AutoDiscover</fielddescr>
 			<fieldname>reverse_owa_autodiscover</fieldname>
-			<description>If this field is checked, AutoDiscover will be enabled.</description>
+			<description><![CDATA[If this field is checked, AutoDiscover will be enabled.<br>
+								<strong>You also should set up the autodiscover DNS-record to point to you WAN-IP.</strong>]]></description>
 			<type>checkbox</type>
 		</field>
 	</fields>
diff --git a/config/suricata/disablesid-sample.conf b/config/suricata/disablesid-sample.conf
new file mode 100644
index 00000000..026f4d94
--- /dev/null
+++ b/config/suricata/disablesid-sample.conf
@@ -0,0 +1,43 @@
+# example disablesid.conf
+
+# Example of modifying state for individual rules
+# 1:1034,1:9837,1:1270,1:3390,1:710,1:1249,3:13010
+
+# Example of modifying state for rule ranges
+# 1:220-1:3264,3:13010-3:13013
+
+# Comments are allowed in this file, and can also be on the same line
+# As the modify state syntax, as long as it is a trailing comment
+# 1:1011 # I Disabled this rule because I could!
+
+# Example of modifying state for MS and cve rules, note the use of the : 
+# in cve. This will modify MS09-008, cve 2009-0233, bugtraq 21301,
+# and all MS00 and all cve 2000 related sids!  These support regular expression
+# matching only after you have specified what you are looking for, i.e. 
+# MS00-<regex> or cve:<regex>, the first section CANNOT contain a regular
+# expression (MS\d{2}-\d+) will NOT work, use the pcre: keyword (below)
+# for this.
+# MS09-008,cve:2009-0233,bugtraq:21301,MS00-\d+,cve:2000-\d+
+
+# Example of using the pcre: keyword to modify rulestate.  the pcre keyword 
+# allows for full use of regular expression syntax, you do not need to designate
+# with / and all pcre searches are treated as case insensitive. For more information 
+# about regular expression syntax: http://www.regular-expressions.info/
+# The following example modifies state for all MS07 through MS10 
+# pcre:MS(0[7-9]|10)-\d+
+# pcre:"Joomla"
+
+# Example of modifying state for specific categories entirely.
+# "snort_" limits to Snort VRT rules, "emerging-" limits to 
+# Emerging Threats Open rules, "etpro-" limits to ET-PRO rules.
+# "shellcode" with no prefix would match in any vendor set.
+# snort_web-iis,emerging-shellcode,etpro-imap,shellcode
+
+# Any of the above values can be on a single line or multiple lines, when 
+# on a single line they simply need to be separated by a ,
+# 1:9837,1:220-1:3264,3:13010-3:13013,pcre:MS(0[0-7])-\d+,MS09-008,cve:2009-0233
+
+# The modifications in this file are for sample/example purposes only and
+# should not actively be used, you need to modify this file to fit your 
+# environment.
+
diff --git a/config/suricata/enablesid-sample.conf b/config/suricata/enablesid-sample.conf
new file mode 100644
index 00000000..4cccc5dd
--- /dev/null
+++ b/config/suricata/enablesid-sample.conf
@@ -0,0 +1,39 @@
+# example enablesid.conf
+
+# Example of modifying state for individual rules
+# 1:1034,1:9837,1:1270,1:3390,1:710,1:1249,3:13010
+
+# Example of modifying state for rule ranges
+# 1:220-1:3264,3:13010-3:13013
+
+# Comments are allowed in this file, and can also be on the same line
+# As the modify state syntax, as long as it is a trailing comment
+# 1:1011 # I Disabled this rule because I could!
+
+# Example of modifying state for MS and cve rules, note the use of the : 
+# in cve. This will modify MS09-008, cve 2009-0233, bugtraq 21301,
+# and all MS00 and all cve 2000 related sids!  These support regular expression
+# matching only after you have specified what you are looking for, i.e. 
+# MS00-<regex> or cve:<regex>, the first section CANNOT contain a regular
+# expression (MS\d{2}-\d+) will NOT work, use the pcre: keyword (below)
+# for this.
+# MS09-008,cve:2009-0233,bugtraq:21301,MS00-\d+,cve:2000-\d+
+
+# Example of using the pcre: keyword to modify rulestate.  the pcre keyword 
+# allows for full use of regular expression syntax, you do not need to designate
+# with / and all pcre searches are treated as case insensitive. For more information 
+# about regular expression syntax: http://www.regular-expressions.info/
+# The following example modifies state for all MS07 through MS10 
+# pcre:MS(0[7-9]|10)-\d+
+# pcre:"Joomla"
+
+# Example of modifying state for specific categories entirely.
+# "snort_" limits to Snort VRT rules, "emerging-" limits to 
+# Emerging Threats Open rules, "etpro-" limits to ET-PRO rules.
+# "shellcode" with no prefix would match in any vendor set.
+# snort_web-iis,emerging-shellcode,etpro-imap,shellcode
+
+# Any of the above values can be on a single line or multiple lines, when 
+# on a single line they simply need to be separated by a ,
+# 1:9837,1:220-1:3264,3:13010-3:13013,pcre:MS(0[0-7])-\d+,MS09-008,cve:2009-0233
+
diff --git a/config/suricata/modifysid-sample.conf b/config/suricata/modifysid-sample.conf
new file mode 100644
index 00000000..d59f84ba
--- /dev/null
+++ b/config/suricata/modifysid-sample.conf
@@ -0,0 +1,23 @@
+# example modifysid.conf
+#
+# formatting is simple
+# <sid or sid list> "what I'm replacing" "what I'm replacing it with"
+#
+# Note that this will only work with GID:1 rules, simply because modifying
+# GID:3 SO stub rules would not actually affect the rule.
+#
+# If you are attempting to change rulestate (enable,disable) from here
+# then you are doing it wrong. Do this from within the respective 
+# rulestate modification configuration files.
+
+# the following applies to sid 10010 only and represents what would normally
+# be s/to_client/from_server/
+# 10010 "to_client" "from_server"
+
+# the following would replace HTTP_PORTS with HTTPS_PORTS for ALL GID:1
+# rules
+# "HTTP_PORTS" "HTTPS_PORTS"
+
+# multiple sids can be specified as noted below:
+# 302,429,1821 "\$EXTERNAL_NET" "\$HOME_NET"
+
diff --git a/config/suricata/suricata.inc b/config/suricata/suricata.inc
index 89bb572f..af0b0da2 100644
--- a/config/suricata/suricata.inc
+++ b/config/suricata/suricata.inc
@@ -47,6 +47,9 @@ require_once("filter.inc");
 
 global $g, $config;
 
+// Suricata GUI needs some extra PHP memory space to manipulate large rules arrays
+ini_set("memory_limit", "256M");
+
 if (!is_array($config['installedpackages']['suricata']))
 	$config['installedpackages']['suricata'] = array();
 
@@ -70,11 +73,12 @@ define('SURICATALOGDIR', '/var/log/suricata/');
 define('RULES_UPD_LOGFILE', SURICATALOGDIR . 'suricata_rules_update.log');
 define('ENFORCING_RULES_FILENAME', 'suricata.rules');
 define('FLOWBITS_FILENAME', 'flowbit-required.rules');
+define('SID_MODS_PATH', '/var/db/suricata/sidmods/');
+define('IPREP_PATH', '/var/db/suricata/iprep/');
 
 // Rule set download filenames and prefixes
 define('ET_DNLD_FILENAME', 'emerging.rules.tar.gz');
 define('ETPRO_DNLD_FILENAME', 'etpro.rules.tar.gz');
-define('VRT_DNLD_FILENAME', 'snortrules-snapshot-edge.tar.gz');
 define('GPLV2_DNLD_FILENAME', 'community-rules.tar.gz');
 define('VRT_FILE_PREFIX', 'snort_');
 define('GPL_FILE_PREFIX', 'GPLv2_');
@@ -183,7 +187,6 @@ function suricata_reload_config($suricatacfg, $signal="USR2") {
 	/******************************************************/
 	if (isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid")) {
 		log_error("[Suricata] Suricata LIVE RULE RELOAD initiated for {$suricatacfg['descr']} ({$if_real})...");
-//		sigkillbypid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid", $signal);
 		mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid");
 	}
 }
@@ -212,7 +215,6 @@ function suricata_barnyard_reload_config($suricatacfg, $signal="HUP") {
 	/******************************************************/
 	if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid")) {
 		log_error("[Suricata] Barnyard2 CONFIG RELOAD initiated for {$suricatacfg['descr']} ({$if_real})...");
-//		sigkillbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid", $signal);
 		mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid");
 	}
 }
@@ -255,7 +257,7 @@ function suricata_find_list($find_name, $type = 'passlist') {
 	return array();
 }
 
-function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
+function suricata_build_list($suricatacfg, $listname = "", $passlist = false, $externallist = false) {
 
 	/***********************************************************/
 	/* The default is to build a HOME_NET variable unless      */
@@ -265,9 +267,10 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 	global $config, $g, $aliastable, $filterdns;
 	$home_net = array();
 
-	if ($listname == 'default' || empty($listname)) {
+	if (!$externallist && ($listname == 'default' || empty($listname))) {
 		$localnet = 'yes'; $wanip = 'yes'; $wangw = 'yes'; $wandns = 'yes'; $vips = 'yes'; $vpns = 'yes';
-	} else {
+	}
+	else {
                 $list = suricata_find_list($listname);
                 if (empty($list))
                         return $list;
@@ -281,21 +284,25 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 			$home_net = explode(" ", trim(filter_expand_alias($list['address'])));
 	}
 
-	// Always add loopback to HOME_NET and passlist (ftphelper)
-	if (!in_array("127.0.0.1", $home_net))
-		$home_net[] = "127.0.0.1";
+	// Always add loopback to HOME_NET and passlist
+	if (!$externallist) {
+		if (!in_array("127.0.0.1/32", $home_net))
+			$home_net[] = "127.0.0.1/32";
+		if (!in_array("::1/128", $home_net))
+			$home_net[] = "::1/128";
+	}
 
 	/********************************************************************/
 	/* Always put the interface running Suricata in HOME_NET and        */
-	/* whitelist unless it's the WAN.  WAN options are handled further  */
+	/* pass list unless it's the WAN.  WAN options are handled further  */
 	/* down.  If the user specifically chose not to include LOCAL_NETS  */
 	/* in the PASS LIST, then do not include the Suricata interface     */
 	/* subnet in the PASS LIST. We do include the actual LAN interface  */
 	/* IP for Suricata, though, to prevent locking out the firewall.    */
 	/********************************************************************/
 	$suricataip = get_interface_ip($suricatacfg['interface']);
-	if (!$whitelist || $localnet == 'yes' || empty($localnet)) {
-		if (is_ipaddr($suricataip)) {
+	if (($externallist && $localnet == 'yes') || (!$externallist && (!$passlist || $localnet == 'yes' || empty($localnet)))) {
+		if (is_ipaddrv4($suricataip)) {
 			if ($suricatacfg['interface'] <> "wan") {
 				$sn = get_interface_subnet($suricatacfg['interface']);
 				$ip = gen_subnet($suricataip, $sn) . "/{$sn}";
@@ -304,15 +311,19 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 			}
 		}
 	}
-	else {
-		if (is_ipaddr($suricataip)) {
-			if (!in_array($suricataip, $home_net))
-				$home_net[] = $suricataip;
+	elseif (!$externallist && $localnet != 'yes') {
+		if (is_ipaddrv4($suricataip)) {
+			if (!in_array($suricataip . "/32", $home_net))
+				$home_net[] = $suricataip . "/32";
 		}
 	}
 
+	// Grab the IPv6 address if we have one assigned
 	$suricataip = get_interface_ipv6($suricatacfg['interface']);
-	if (!$whitelist || $localnet == 'yes' || empty($localnet)) {
+	// Trim off the interface designation (e.g., %em1) if present
+	if (strpos($suricataip, "%") !== FALSE)
+		$suricataip = substr($suricataip, 0, strpos($suricataip, "%"));
+	if (($externallist && $localnet == 'yes') || (!$externallist && (!$passlist || $localnet == 'yes' || empty($localnet)))) {
 		if (is_ipaddrv6($suricataip)) {
 			if ($suricatacfg['interface'] <> "wan") {
 				$sn = get_interface_subnetv6($suricatacfg['interface']);
@@ -322,14 +333,24 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 			}
 		}
 	}
-	else {
+	elseif (!$externallist && $localnet != 'yes') {
 		if (is_ipaddrv6($suricataip)) {
-			if (!in_array($suricataip, $home_net))
-				$home_net[] = $suricataip;
+			if (!in_array($suricataip . "/128", $home_net))
+				$home_net[] = $suricataip . "/128";
 		}
 	}
 
-	if (!$whitelist || $localnet == 'yes' || empty($localnet)) {		
+	// Add link-local address if user included locally-attached networks
+	$suricataip = get_interface_linklocal($suricatacfg['interface']);
+	if (!empty($suricataip) && $localnet == 'yes') {
+		// Trim off the interface designation (e.g., %em1) if present
+		if (strpos($suricataip, "%") !== FALSE)
+			$suricataip = substr($suricataip, 0, strpos($suricataip, "%"));
+		if (!in_array($suricataip . "/128", $home_net))
+			$home_net[] = $suricataip . "/128";
+	}
+
+	if (($$externallist && $localnet == 'yes') || (!$externallist && (!$passlist || $localnet == 'yes' || empty($localnet)))) {		
 		/*************************************************************************/
 		/*  Iterate through the interface list and write out pass list items and */
 		/*  also compile a HOME_NET list of all local interfaces for suricata.   */
@@ -341,58 +362,89 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 			if ($int == "wan")
 				continue;
 			$subnet = get_interface_ip($int);
-			if (is_ipaddr($subnet)) {
+			if (is_ipaddrv4($subnet)) {
 				$sn = get_interface_subnet($int);
 				$ip = gen_subnet($subnet, $sn) . "/{$sn}";
 				if (!in_array($ip, $home_net))
 					$home_net[] = $ip;
 			}
-			if ($int == "wan")
-				continue;
+
 			$subnet = get_interface_ipv6($int);
+			// Trim off the interface designation (e.g., %em1) if present
+			if (strpos($subnet, "%") !== FALSE)
+				$subnet = substr($subnet, 0, strpos($subnet, "%"));
 			if (is_ipaddrv6($subnet)) {
 				$sn = get_interface_subnetv6($int);
 				$ip = gen_subnetv6($subnet, $sn). "/{$sn}";
 				if (!in_array($ip, $home_net))
 					$home_net[] = $ip;
 			}
+
+			// Add link-local address
+			$suricataip = get_interface_linklocal($int);
+			if (!empty($suricataip)) {
+				// Trim off the interface designation (e.g., %em1) if present
+				if (strpos($suricataip, "%") !== FALSE)
+					$suricataip = substr($suricataip, 0, strpos($suricataip, "%"));
+				if (!in_array($suricataip . "/128", $home_net))
+					$home_net[] = $suricataip . "/128";
+			}
 		}
 	}
 
 	if ($wanip == 'yes') {
 		$ip = get_interface_ip("wan");
-		if (is_ipaddr($ip)) {
-			if (!in_array($ip, $home_net))
-				$home_net[] = $ip;
+		if (is_ipaddrv4($ip)) {
+			if (!in_array($ip . "/32", $home_net))
+				$home_net[] = $ip . "/32";
 		}
 		$ip = get_interface_ipv6("wan");
+		// Trim off the interface designation (e.g., %em1) if present
+		if (strpos($ip, "%") !== FALSE)
+			$ip = substr($ip, 0, strpos($ip, "%"));
 		if (is_ipaddrv6($ip)) {
-			if (!in_array($ip, $home_net))
-				$home_net[] = $ip;
+			if (!in_array($ip . "/128", $home_net))
+				$home_net[] = $ip . "/128";
+		}
+		// Explicitly grab the WAN Link-Local address
+		$ip = get_interface_linklocal("wan");
+		if (!empty($ip)) {
+			// Trim off the interface designation (e.g., %em1) if present
+			if (strpos($ip, "%") !== FALSE)
+				$ip = substr($ip, 0, strpos($ip, "%"));
+			if (!in_array($ip . "/128", $home_net))
+				$home_net[] = $ip . "/128";
 		}
 	}
 
 	if ($wangw == 'yes') {
 		// Grab the default gateway if set
 		$default_gw = exec("/sbin/route -n get default |grep 'gateway:' | /usr/bin/awk '{ print $2 }'");
-		if (is_ipaddr($default_gw) && !in_array($default_gw, $home_net))
-			$home_net[] = $default_gw;
-		if (is_ipaddrv6($default_gw) && !in_array($default_gw, $home_net))
-			$home_net[] = $default_gw;
+		if (is_ipaddrv4($default_gw) && !in_array($default_gw . "/32", $home_net))
+			$home_net[] = $default_gw . "/32";
+		if (is_ipaddrv6($default_gw) && !in_array($default_gw . "/128", $home_net))
+			$home_net[] = $default_gw . "/128";
 
 		// Get any other interface gateway and put in $HOME_NET if not there already
 		$gw = get_interface_gateway($suricatacfg['interface']);
-		if (is_ipaddr($gw) && !in_array($gw, $home_net))
-			$home_net[] = $gw;
+		if (is_ipaddrv4($gw) && !in_array($gw . "/32", $home_net))
+			$home_net[] = $gw . "/32";
 		$gw = get_interface_gateway_v6($suricatacfg['interface']);
-		if (is_ipaddrv6($gw) && !in_array($gw, $home_net))
-			$home_net[] = $gw;
+		// Trim off the interface designation (e.g., %em1) if present
+		if (strpos($gw, "%") !== FALSE)
+			$gw = substr($gw, 0, strpos($gw, "%"));
+		if (is_ipaddrv6($gw) && !in_array($gw . "/128", $home_net))
+			$home_net[] = $gw . "/128";
 	}
 
 	if ($wandns == 'yes') {
-		// Add DNS server for WAN interface to whitelist
+		// Add DNS server for WAN interface to Pass List
 		$dns_servers = get_dns_servers();
 		foreach ($dns_servers as $dns) {
+			if (is_ipaddrv4($dns))
+				$dns .= "/32";
+			elseif (is_ipaddrv6($dns))
+				$dns .= "/128";
 			if ($dns && !in_array($dns, $home_net))
 				$home_net[] = $dns;
 		}
@@ -410,7 +462,7 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 		}
 	}
 
-	// grab a list of vpns and whitelist if user desires
+	// Grab a list of vpns enabled - these come back as CIDR mask networks
 	if ($vpns == 'yes') {
 		$vpns_list = filter_get_vpns_list();
 		if (!empty($vpns_list)) {
@@ -443,7 +495,14 @@ function suricata_build_list($suricatacfg, $listname = "", $passlist = false) {
 function suricata_rules_up_install_cron($should_install=true) {
 	global $config, $g;
 
-	$command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/suricata/suricata_check_for_rule_updates.php";
+	// Remove any existing job first
+	install_cron_job("suricata_check_for_rule_updates.php", false);
+
+	// If called with FALSE as argument, then we're done
+	if ($should_install == FALSE)
+		return;
+
+	$command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_check_for_rule_updates.php";
 
 	// Get auto-rule update parameter from configuration
 	$suricata_rules_up_info_ck = $config['installedpackages']['suricata']['config'][0]['autoruleupdate'];
@@ -606,12 +665,12 @@ function suricata_rm_blocked_install_cron($should_install) {
 	}
 
 	// First, remove any existing cron task for "rm_blocked" hosts
-	install_cron_job("pfctl -t {$suri_pf_table} -T expire" , false);
+	install_cron_job("{$suri_pf_table}", false);
 
 	// Now add or update the cron task for "rm_blocked" hosts
 	// if enabled.
 	if ($should_install) {
-		$command = "/usr/bin/nice -n20 /sbin/pfctl -t {$suri_pf_table} -T expire {$suricata_rm_blocked_expire}";
+		$command = "/usr/bin/nice -n20 /sbin/pfctl -q -t {$suri_pf_table} -T expire {$suricata_rm_blocked_expire}";
 		install_cron_job($command, $should_install, $suricata_rm_blocked_min, $suricata_rm_blocked_hr, $suricata_rm_blocked_mday, $suricata_rm_blocked_month, $suricata_rm_blocked_wday, "root");
 	}
 }
@@ -626,7 +685,7 @@ function sync_suricata_package_config() {
 
 	// Do not start config build if there are no Suricata-configured interfaces
 	if (!is_array($config['installedpackages']['suricata']) || !is_array($config['installedpackages']['suricata']['rule'])) {
-		@unlink("{$rcdir}/suricata.sh");
+		@unlink("{$rcdir}suricata.sh");
 		conf_mount_ro();
 		return;
 	}
@@ -646,7 +705,6 @@ function sync_suricata_package_config() {
 	// create suricata bootup file suricata.sh
 	suricata_create_rc();
 
-	$suricataglob = $config['installedpackages']['suricata']['config'][0];
 	// setup the log directory size check job if enabled
 	suricata_loglimit_install_cron(true);
 	// setup the suricata rules update job if enabled
@@ -654,12 +712,11 @@ function sync_suricata_package_config() {
 	// set the suricata blocked hosts time
 	suricata_rm_blocked_install_cron($config['installedpackages']['suricata']['config'][0]['rm_blocked'] != "never_b" ? true : false);
 
-	write_config();
 	configure_cron();
 	
 	// Do not attempt package sync if reinstalling package or booting
-//	if (!$g['suricata_postinstall'] && !$g['booting'])
-//		suricata_sync_on_changes();
+	if (!isset($g['suricata_postinstall']) && !$g['booting'])
+		suricata_sync_on_changes();
 	
 	conf_mount_ro();
 }
@@ -1052,11 +1109,11 @@ function suricata_load_rules_map($rules_path) {
 	if (empty($rules_path))
 		return $map_ref;
 
-	/***************************************************************
+	/************************************************************************************
 	 * Read all the rules into the map array.
 	 * The structure of the map array is:
 	 *
-	 *  map[gid][sid]['rule']['category']['disabled']['flowbits']
+	 *  map[gid][sid]['rule']['category']['action']['disabled']['managed']['flowbits']
 	 *
 	 *  where:
 	 *   gid      = Generator ID from rule, or 1 if general text 
@@ -1067,9 +1124,11 @@ function suricata_load_rules_map($rules_path) {
 	 *   action   = alert, drop, reject or pass
 	 *   disabled = 1 if rule is disabled (commented out), 0 if 
 	 *              rule is enabled
+	 *    managed = 1 if rule is auto-managed by SID MGMT process,
+	 *              0 if not auto-managed 
 	 *   flowbits = Array of applicable flowbits if rule contains 
 	 *              flowbits options
-	 ***************************************************************/
+	 ************************************************************************************/
 
 	// First check if we were passed a directory, a single file
 	// or an array of filenames to read. Set our $rule_files
@@ -1542,6 +1601,854 @@ function suricata_load_vrt_policy($policy, $all_rules=null) {
 	return $vrt_policy_rules;
 }
 
+function suricata_parse_sidconf_file($sidconf_file) {
+
+	/**********************************************/
+	/* This function loads and processes the file */
+	/* specified by '$sidconf_file'.  The file is */
+	/* assumed to contain valid instructions for  */
+	/* matching rule SIDs as supported by the     */
+	/* Oinkmaster and PulledPork utilities.       */
+	/*                                            */
+	/*  $sidconf_file ==> full path and name of   */
+	/*                    file to process         */
+	/*                                            */
+	/*        Returns ==> an array containing     */
+	/*                    SID modifier tokens     */
+	/**********************************************/
+
+	$buf = "";
+	$sid_mods = array();
+
+	$fd = fopen("{$sidconf_file}", "r");
+	if ($fd == FALSE) {
+		log_error("[Suricata] Failed to open SID MGMT file '{$sidconf_file}' for processing.");
+		return $sid_mods;
+	}
+
+	// Read and parse the conf file line-by-line
+	while (($buf = fgets($fd)) !== FALSE) {
+		$line = array();
+
+		// Skip any lines that may be just spaces.
+		if (trim($buf, " \r\n") == "")
+			continue;
+
+		// Skip line with leading "#" since it's a comment
+		if (preg_match('/^\s*#/', $buf))
+			continue;
+
+		// Trim off any trailing comment
+		$line = explode("#", $buf);
+
+		// Trim leading and trailing spaces plus newline and any carriage returns
+		$buf = trim($line[0], ' \r\n');
+
+		// Now split the SID mod arguments at the commas, if more than one
+		// per line, and add to our $sid_mods array.
+		$line = explode(",", $buf);
+		foreach ($line as $ent)
+			$sid_mods[] = trim($ent);
+	}
+
+	// Close the file, release unneeded memory and return
+	// the array of SID mod tokens parsed from the file.
+	fclose($fd);
+	unset($line, $buf);
+	return $sid_mods;
+}
+
+function suricata_sid_mgmt_auto_categories($suricatacfg, $log_results = FALSE) {
+
+	/****************************************************/
+	/* This function parses any auto-SID conf files     */
+	/* configured for the interface and returns an      */
+	/* array of rule categories adjusted from the       */
+	/* ['enabled_rulesets'] element in the config for   */
+	/* the interface in accordance with the contents    */
+	/* of the SID Mgmt conf files.                      */
+	/*                                                  */
+	/* The returned array shows which files should be   */
+	/* removed and which should be added to the list    */
+	/* used when building the enforcing ruleset.        */
+	/*                                                  */
+	/*  $suricatacfg ==> pointer to interface           */
+	/*                   configuration info             */
+	/*  $log_results ==> [optional] log results to      */
+	/*                   'sid_changes.log' in the       */
+	/*                   interface directory in         */
+	/*                   /var/log/suricata when TRUE    */
+	/*                                                  */
+	/*       Returns ==> array of category file names   */
+	/*                   for the interface.  The keys   */
+	/*                   are category file names and    */
+	/*                   the corresponding values show  */
+	/*                   if the file should be added    */
+	/*                   or removed from the enabled    */
+	/*                   rulesets list.                 */
+	/*                                                  */
+	/*                    Example -                     */
+	/*                      $changes[file] = 'enabled'  */
+	/*                                                  */
+	/****************************************************/
+
+	global $config;
+	$suricata_sidmods_dir = SID_MODS_PATH;
+	$sid_mods = array();
+	$enables = array();
+	$disables = array();
+
+	// Check if auto-mgmt of SIDs is enabled, exit if not
+	if ($config['installedpackages']['suricata']['config'][0]['auto_manage_sids'] != 'on')
+		return array();
+	if (empty($suricatacfg['disable_sid_file']) && empty($suricatacfg['enable_sid_file']))
+		return array();
+
+	// Configure the interface's logging subdirectory if log results is enabled
+	if ($log_results == TRUE)
+		$log_file = SURICATALOGDIR . $suricatalogdir . "suricata_" . get_real_interface($suricatacfg['interface']) . "{$suricatacfg['uuid']}/sid_changes.log";
+	else
+		$log_file = NULL;
+
+	// Get the list of currently enabled categories for the interface
+	if (!empty($suricatacfg['rulesets']))
+		$enabled_cats = explode("||", $suricatacfg['rulesets']);
+
+	if ($log_results == TRUE) {
+		error_log(gettext("********************************************************\n"), 3, $log_file);
+		error_log(gettext("Starting auto RULE CATEGORY management for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) ."\n"), 3, $log_file);
+		error_log(gettext("Start Time: " . date("Y-m-d H:i:s") . "\n"), 3, $log_file);
+	}
+
+	switch ($suricatacfg['sid_state_order']) {
+		case "disable_enable":
+			if (!empty($suricatacfg['disable_sid_file'])) {
+				if ($log_results == TRUE)
+					error_log(gettext("Processing disable_sid file: {$suricatacfg['disable_sid_file']}\n"), 3, $log_file);
+
+				// Attempt to open the 'disable_sid_file' for the interface
+				if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}")) {
+					log_error(gettext("[Suricata] Error - unable to open 'disable_sid_file' \"{$suricatacfg['disable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+					if ($log_results == TRUE)
+						error_log(gettext("Unable to open disable_sid file \"{$suricatacfg['disable_sid_file']}\".\n"), 3, $log_file);
+				}
+				else
+					$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}");
+
+				if (!empty($sid_mods))
+					$disables = suricata_get_auto_category_mods($enabled_cats, $sid_mods, "disable", $log_results, $log_file);
+				elseif ($log_results == TRUE && !empty($log_file)) {
+					error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['disable_sid_file']}\".\n"), 3, $log_file);
+				}
+			}
+			if (!empty($suricatacfg['enable_sid_file'])) {
+				if ($log_results == TRUE)
+					error_log(gettext("Processing enable_sid file: {$suricatacfg['enable_sid_file']}\n"), 3, $log_file);
+
+				// Attempt to open the 'enable_sid_file' for the interface
+				if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}")) {
+					log_error(gettext("[Suricata] Error - unable to open 'enable_sid_file' \"{$suricatacfg['enable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+					if ($log_results == TRUE)
+						error_log(gettext("Unable to open enable_sid file \"{$suricatacfg['enable_sid_file']}\".\n"), 3, $log_file);
+				}
+				else
+					$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}");
+
+				if (!empty($sid_mods))
+					$enables = suricata_get_auto_category_mods($enabled_cats, $sid_mods, "enable", $log_results, $log_file);
+				elseif ($log_results == TRUE && !empty($log_file)) {
+					error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['enable_sid_file']}\".\n"), 3, $log_file);
+				}
+			}
+			break;
+
+		case "enable_disable":
+			if (!empty($suricatacfg['enable_sid_file'])) {
+				if ($log_results == TRUE)
+					error_log(gettext("Processing enable_sid file: {$suricatacfg['enable_sid_file']}\n"), 3, $log_file);
+
+				// Attempt to open the 'enable_sid_file' for the interface
+				if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}")) {
+					log_error(gettext("[Suricata] Error - unable to open 'enable_sid_file' \"{$suricatacfg['enable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+					if ($log_results == TRUE)
+						error_log(gettext("Unable to open enable_sid file \"{$suricatacfg['enable_sid_file']}\".\n"), 3, $log_file);
+				}
+				else
+					$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}");
+
+				if (!empty($sid_mods))
+					$enables = suricata_get_auto_category_mods($enabled_cats, $sid_mods, "enable", $log_results, $log_file);
+				elseif ($log_results == TRUE && !empty($log_file)) {
+					error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['enable_sid_file']}\".\n"), 3, $log_file);
+				}
+			}
+			if (!empty($suricatacfg['disable_sid_file'])) {
+				if ($log_results == TRUE)
+					error_log(gettext("Processing disable_sid file: {$suricatacfg['disable_sid_file']}\n"), 3, $log_file);
+
+				// Attempt to open the 'disable_sid_file' for the interface
+				if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}")) {
+					log_error(gettext("[Suricata] Error - unable to open 'disable_sid_file' \"{$suricatacfg['disable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+					if ($log_results == TRUE)
+						error_log(gettext("Unable to open disable_sid file \"{$suricatacfg['disable_sid_file']}\".\n"), 3, $log_file);
+				}
+				else
+					$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}");
+
+				if (!empty($sid_mods))
+					$disables = suricata_get_auto_category_mods($enabled_cats, $sid_mods, "disable", $log_results, $log_file);
+				elseif ($log_results == TRUE && !empty($log_file)) {
+					error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['disable_sid_file']}\".\n"), 3, $log_file);
+				}
+			}
+			break;
+
+		default:
+			log_error(gettext("[Suricata] Unrecognized 'sid_state_order' value.  Skipping auto CATEGORY mgmt step for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+			if ($log_results == TRUE) {
+				error_log(gettext("ERROR: unrecognized 'sid_state_order' value.  Skipping auto CATEGORY mgmt step for ") . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']). ".\n", 3, $log_file);
+			}
+	}
+
+	if ($log_results == TRUE) {
+		error_log(gettext("End Time: " . date("Y-m-d H:i:s") . "\n"), 3, $log_file);
+		error_log(gettext("********************************************************\n\n"), 3, $log_file);
+	}
+
+	// Return the required rule category modifications as an array;
+	return array_merge($enables, $disables);
+}
+
+function suricata_get_auto_category_mods($categories, $sid_mods, $action, $log_results = FALSE, $log_file = NULL) {
+
+	/****************************************************/
+	/* This function parses the provided SID mod tokens */
+	/* in $sid_mods and returns an array of category    */
+	/* files that must be added ('enabled') or removed  */
+	/* ('disabled') from the provided $categories list  */
+	/* of enabled rule categories as determined by the  */
+	/* content of the SID Mgmt tokens in $sid_mods.     */
+	/*                                                  */
+	/* The returned array shows which files should be   */
+	/* removed and which should be added to the list    */
+	/* used when building the enforcing ruleset.        */
+	/*                                                  */
+	/*   $categories ==> array of currently enabled     */
+	/*                   ruleset categories             */
+	/*     $sid_mods ==> array of SID modification      */
+	/*                   tokens                         */
+	/*       $action ==> modification action for        */
+	/*                   matching category targets:     */
+	/*                   'enable' or 'disable'          */
+	/*  $log_results ==> [optional] 'yes' to log        */
+	/*                   results to $log_file           */
+	/*     $log_file ==> full path and filename of log  */
+	/*                   file to write to               */
+	/*                                                  */
+	/*       Returns ==> array of category file names   */
+	/*                   for the interface.  The keys   */
+	/*                   are category file names and    */
+	/*                   the corresponding values show  */
+	/*                   if the file should be added    */
+	/*                   or removed from the enabled    */
+	/*                   rulesets list.                 */
+	/*                                                  */
+	/*                    Example -                     */
+	/*                      $changes[file] = 'enabled'  */
+	/*                                                  */
+	/****************************************************/
+
+	$suricatadir = SURICATADIR;
+	$all_cats = array();
+	$changes = array();
+	$counter = 0;
+	$matchcount = 0;
+
+	// Get a list of all possible categories by loading all rules files
+	foreach (array( VRT_FILE_PREFIX, ET_OPEN_FILE_PREFIX, ET_PRO_FILE_PREFIX, GPL_FILE_PREFIX ) as $prefix) {
+		$files = glob("{$suricatadir}rules/{$prefix}*.rules");
+		foreach ($files as $file)
+			$all_cats[] = basename($file);
+	}
+
+	// Walk the SID mod tokens and decode looking for rule
+	// category enable/disable changes.
+	foreach ($sid_mods as $tok) {
+		$matches = array();
+		// Test the SID token for a GID:SID range and skip if true
+		if (preg_match('/^(\d+):(\d+)-\1:(\d+)/', $tok))
+			continue;
+		// Test the token for a single GID:SID and skip if true
+		elseif (preg_match('/^(\d+):(\d+)$/', $tok))
+			continue;
+		// Test the token for the PCRE: keyword and skip if true
+		elseif (preg_match('/(^pcre\:)(.+)/i', $tok))
+			continue;
+		// Test the token for the MS reference keyword and skip if true
+		elseif (preg_match('/^MS\d+-.+/i', $tok))
+			continue;
+		// Test the token for other keywords delimited with a colon and skip if true
+		elseif (preg_match('/^[a-xA-X]+\:.+/', $tok))
+			continue;
+		// Test the SID token for a rule category name.  Anything that
+		// failed to match above is considered a potential category name.
+		elseif (preg_match('/[a-xA-X]+(-|\w).*/', $tok, $matches)) {
+			$counter++;
+			$regex = "/" . preg_quote(trim($matches[0]), '/') . "/i";
+			// Search through the $all_cats array for any matches to the regex
+			$matches = preg_grep($regex, $all_cats);
+
+			// See if any matches are in the $categories array
+			foreach ($matches as $cat) {
+				switch ($action) {
+					case 'enable':
+						if (!isset($changes[$cat])) {
+							$changes[$cat] = 'enabled';
+							if ($log_results == TRUE && !empty($log_file))
+								error_log(gettext("    Enabled rule category: {$cat}\n"), 3, $log_file);
+							$matchcount++;
+						}
+						break;
+
+					case 'disable':
+						if (!isset($changes[$cat])) {
+							$changes[$cat] = 'disabled';
+							if ($log_results == TRUE && !empty($log_file))
+								error_log(gettext("    Disabled rule category: {$cat}\n"), 3, $log_file);
+							$matchcount++;
+						}
+						break;
+
+					default:
+						break;
+				}
+			}
+		}
+		else {
+			if ($log_results == TRUE && !empty($log_file))
+				error_log(gettext("WARNING: unrecognized token '{$tok}' encountered while processing an automatic SID MGMT file.\n"), 3, $log_file);
+		}
+	}
+
+	if ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("    Parsed {$counter} potential Rule Categories to match from the list of tokens.\n"), 3, $log_file);
+		error_log(gettext("    " . ucfirst($action) . "d {$matchcount} matching Rule Categories.\n"), 3, $log_file);
+	}
+
+	// Release memory no longer needed
+	unset($all_cats, $matches);
+
+	// Return array of rule category file changes
+	return $changes;
+}
+
+function suricata_modify_sid_state(&$rule_map, $sid_mods, $action, $log_results = FALSE, $log_file = NULL) {
+
+	/**********************************************/
+	/* This function walks the provided array of  */
+	/* SID modification tokens and locates the    */
+	/* target SID or SIDs in the $rule_map array. */
+	/* It then performs the change specified by   */
+	/* $action on the target SID or SIDs.         */
+	/*                                            */
+	/*    $rule_map ==> reference to array of     */
+	/*                  current rules             */
+	/*    $sid_mods ==> array of SID modification */
+	/*                  tokens                    */
+	/*      $action ==> modification action for   */
+	/*                  matching SID targets:     */
+	/*                  'enable' or 'disable'     */
+	/* $log_results ==> [optional] 'yes' to log   */
+	/*                   results to $log_file     */
+	/*    $log_file ==> full path and filename    */
+	/*                  of log file to write to   */
+	/*                                            */
+	/*    On Return ==> $rule_map array modified  */
+	/*                  by changing state for     */
+	/*                  matching SIDs.            */
+	/*                                            */
+	/*                  Returns a two-dimension   */
+	/*                  array of matching GID:SID */
+	/*                  pairs.                    */
+	/**********************************************/
+
+	$sids = array();
+
+	// If no rules in $rule_map or mods in $sid_mods,
+	// then nothing to do.
+	if (empty($rule_map) || empty($sid_mods))
+		return $sids;
+
+	// Validate the action keyword as we only accept
+	// 'enable' and 'disable' as valid.
+	switch ($action) {
+
+		case "enable":
+			break;
+
+		case "disable":
+			break;
+
+		default:
+			log_error(gettext("[Suricata] Error - unknown action '{$action}' supplied to suricata_modify_sid_state() function...no SIDs modified."));
+			return $sids;
+	}
+
+	// Walk the SID mod tokens and decode each one
+	foreach ($sid_mods as $tok) {
+		$matches = array();
+		// Test the SID token for a GID:SID range
+		if (preg_match('/^(\d+):(\d+)-\1:(\d+)/', $tok, $matches)) {
+			// It was a range, so find all the intervening SIDs
+			$gid = trim($matches[1]);
+			$lsid = trim($matches[2]);
+			$usid = trim($matches[3]);
+			$sids[$gid][$lsid] = $action;
+			while ($lsid < $usid) {
+				$lsid++;
+				$sids[$gid][$lsid] = $action;
+			}
+		}
+		// Test the SID token for a single GID:SID
+		elseif (preg_match('/^(\d+):(\d+)$/', $tok, $matches)) {
+			// It's a single GID:SID, so grab it
+			$sids[$matches[1]][$matches[2]] = $action;
+		}
+		// Test the SID token for the PCRE: keyword
+		elseif (preg_match('/(^pcre\:)(.+)/i', $tok, $matches)) {
+			$regex = '/' . preg_quote($matches[2], '/') . '/i';
+
+			// Now search through the $rule_map in the 'rule'
+			// element for any matches to the regex and get
+			// the GID:SID.
+			foreach ($rule_map as $k1 => $rulem) {
+				foreach ($rulem as $k2 => $v) {
+					if (preg_match($regex, $v['rule'])) {
+						$sids[$k1][$k2] = $action;
+					}
+				}
+			}
+		}
+		// Test the SID token for the MS reference keyword
+		elseif (preg_match('/^MS\d+-.+/i', $tok, $matches)) {
+			$regex = "/" . preg_quote($matches[0], '/') . "/i";
+
+			// Now search through the $rule_map in the 'rule'
+			// element for any matches to the regex and get
+			// the GID:SID.
+			foreach ($rule_map as $k1 => $rulem) {
+				foreach ($rulem as $k2 => $v) {
+					if (preg_match($regex, $v['rule'])) {
+						$sids[$k1][$k2] = $action;
+					}
+				}
+			}
+		}
+		// Test the SID token for other keywords delimited with a colon
+		elseif (preg_match('/^[a-xA-X]+\:.+/', $tok, $matches)) {
+			$regex = "/" . str_replace(':', ",", preg_quote($matches[0], '/')) . "/i";
+
+			// Now search through the $rule_map in the 'rule'
+			// element for any matches to the regex and get
+			// the GID:SID.
+			foreach ($rule_map as $k1 => $rulem) {
+				foreach ($rulem as $k2 => $v) {
+					if (preg_match($regex, $v['rule'])) {
+						$sids[$k1][$k2] = $action;
+					}
+				}
+			}
+		}
+		// Test the SID token for a rule category name.  Anything that
+		// failed to match above is considered a potential category name.
+		elseif (preg_match('/[a-xA-X]+(-|\w).*/', $tok, $matches)) {
+			$regex = "/" . preg_quote(trim($matches[0]), '/') . "/i";
+			// Now search through the $rule_map in the 'category'
+			// element for any matches to the regex and get
+			// the GID:SID.
+			foreach ($rule_map as $k1 => $rulem) {
+				foreach ($rulem as $k2 => $v) {
+					if (preg_match($regex, $v['category'] . ".rules")) {
+						$sids[$k1][$k2] = $action;
+					}
+				}
+			}
+		}
+		else {
+			if ($log_results == TRUE && !empty($log_file))
+				error_log(gettext("WARNING: unrecognized token '{$tok}' encountered while processing an automatic SID MGMT file.\n"), 3, $log_file);
+		}
+	}
+
+	// Change state of all the matching GID:SID pairs we found
+	// above in the $rule_map array passed to us.
+	$modcount = $changecount = 0;
+	$counter = count($sids, COUNT_RECURSIVE) - count($sids);
+
+	if ($log_results == TRUE && !empty($log_file))
+		error_log(gettext("    Parsed {$counter} potential SIDs to match from the provided list of tokens.\n"), 3, $log_file);
+
+	foreach (array_keys($sids) as $k1) {
+		foreach (array_keys($sids[$k1]) as $k2) {
+			if (isset($rule_map[$k1][$k2])) {
+				if ($action == 'enable' && $rule_map[$k1][$k2]['disabled'] == 1) {
+					$rule_map[$k1][$k2]['rule'] = ltrim($rule_map[$k1][$k2]['rule'], " \t#");
+					$rule_map[$k1][$k2]['disabled'] = 0;
+					$rule_map[$k1][$k2]['managed'] = 1;
+					$changecount++;
+					$modcount++;
+				}
+				elseif ($action == 'disable' && $rule_map[$k1][$k2]['disabled'] == 0) {
+					$rule_map[$k1][$k2]['rule'] = "# " . $rule_map[$k1][$k2]['rule'];
+					$rule_map[$k1][$k2]['disabled'] = 1;
+					$rule_map[$k1][$k2]['managed'] = 1;
+					$changecount++;
+					$modcount++;
+				}
+			}
+		}
+	}
+
+	if ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("    Found {$modcount} matching SIDs in the active rules.\n"), 3, $log_file);
+		error_log(gettext("    Changed state for {$changecount} SIDs to '{$action}d'.\n"), 3, $log_file);
+	}
+
+	// Return the array of matching SIDs
+	return $sids;
+}
+
+function suricata_modify_sid_content(&$rule_map, $sid_mods, $log_results = FALSE, $log_file = NULL) {
+
+	/************************************************/
+	/* This function walks the provided array of    */
+	/* SID modification tokens and locates the      */
+	/* target SID or SIDs in the $rule_map array.   */
+	/* It then modifies the content of the target   */
+	/* SID or SIDs. Modifications are only valid    */
+	/* for normal GID=1 text rules.                 */
+	/*                                              */
+	/*     $rule_map ==> reference to array of      */
+	/*                   current rules              */
+	/*     $sid_mods ==> array of SID modification  */
+	/*                   tokens                     */
+	/*  $log_results ==> [optional] 'yes' to log    */
+	/*                   results to $log_file       */
+	/*     $log_file ==> full path and filename     */
+	/*                   of log file to write to    */
+	/*                                              */
+	/*     On Return ==> $rule_map array modified   */
+	/*                   by changing content for    */
+	/*                   matching SIDs.             */
+	/*                                              */
+	/*                   Returns a two-dimension    */
+	/*                   array of matching          */
+	/*                   GID:SID pairs.             */
+	/************************************************/
+
+	$sids = array();
+	$tokencounter = $modcount = $modifiedcount = 0;
+
+	// If no rules in $rule_map or mods in $sid_mods,
+	// then nothing to do.
+	if (empty($rule_map) || empty($sid_mods))
+		return $sids;
+
+	// Walk the SID mod tokens and decode each one
+	foreach ($sid_mods as $tok) {
+		$matches = array();
+		if (preg_match('/([\d+|,|\*]*)\s+"(.+)"\s+"(.*)"/', $tok, $matches)) {
+			$tokencounter++;
+			$sidlist = explode(",", $matches[1]);
+			$from = '/' . preg_quote($matches[2], '/') . '/';
+			$to = $matches[3];
+			$count = 0;
+
+			// Now walk the provided rule map and make the modifications
+			if ($matches[1] == "*") {
+				// If wildcard '*' provided for SID, then check them all
+				foreach ($rule_map[1] as $rulem) {
+					foreach ($rulem as $k2 => $v) {
+						$modcount++;
+						$rule_map[1][$k2]['rule'] = preg_replace($from, $to, $v['rule'], -1, $count);
+						if ($count > 0) {
+							$rule_map[1][$k2]['managed'] = 1;
+							$sids[1][$k2] = 'modify';
+							$modifiedcount++;
+						}
+					}
+				}
+			}
+			else {
+				// Otherwise just check the provided SIDs
+				foreach ($sidlist as $sid) {
+					if (isset($rule_map[1][$sid])) {
+						$modcount++;
+						$rule_map[1][$sid]['rule'] = preg_replace($from, $to, $rule_map[1][$sid]['rule'], -1, $count);
+						if ($count > 0) {
+							$rule_map[1][$sid]['managed'] = 1;
+							$sids[1][$sid] = 'modify';
+							$modifiedcount++;
+						}
+					}
+				}
+			}
+		}
+		else {
+			if ($log_results == TRUE && !empty($log_file))
+				error_log(gettext("WARNING: unrecognized token '{$tok}' encountered while processing an automatic SID MGMT file.\n"), 3, $log_file);
+		}
+	}
+
+	if ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("    Parsed {$tokencounter} potential SIDs to match from the provided list of tokens.\n"), 3, $log_file);
+		error_log(gettext("    Found {$modcount} matching SIDs in the active rules.\n"), 3, $log_file);
+		error_log(gettext("    Modified rule text for {$modifiedcount} SIDs.\n"), 3, $log_file);
+	}
+
+	// Return the array of matching SIDs
+	return $sids;
+}
+
+function suricata_process_enablesid(&$rule_map, $suricatacfg, $log_results = FALSE, $log_file = NULL) {
+
+	/**********************************************/
+	/* This function loads and processes the file */
+	/* specified by 'enable_sid_file' for the     */
+	/* interface.  The file is assumed to be a    */
+	/* valid enablesid.conf file containing       */
+	/* instructions for enabling matching rule    */
+	/* SIDs.                                      */
+	/*                                            */
+	/*     $rule_map ==> reference to array of    */
+	/*                   current rules            */
+	/*  $suricatacfg ==> interface config params  */
+	/*  $log_results ==> [optional] 'yes' to log  */
+	/*                   results to $log_file     */
+	/*     $log_file ==> full path and filename   */
+	/*                   of log file to write to  */
+	/*                                            */
+	/*     On Return ==> suitably modified        */
+	/*                   $rule_map array          */
+	/**********************************************/
+
+	$suricata_sidmods_dir = SID_MODS_PATH;
+	$suricatalogdir = SURICATALOGDIR;
+	$sid_mods = array();
+
+	// If no rules in $rule_map, then nothing to do
+	if (empty($rule_map))
+		return;
+
+	// Attempt to open the 'enable_sid_file' for the interface
+	if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}")) {
+		log_error(gettext("[Suricata] Error - unable to open 'enable_sid_file' \"{$suricatacfg['enable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+		return;
+	}
+	else
+		$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['enable_sid_file']}");
+
+	if (!empty($sid_mods))
+		suricata_modify_sid_state($rule_map, $sid_mods, "enable", $log_results, $log_file);
+	elseif ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['enable_sid_file']}\".\n"), 3, $log_file);
+	}
+
+	unset($sid_mods);
+}
+
+function suricata_process_disablesid(&$rule_map, $suricatacfg, $log_results = FALSE, $log_file = NULL) {
+
+	/**********************************************/
+	/* This function loads and processes the file */
+	/* specified by 'disable_sid_file' for the    */
+	/* interface.  The file is assumed to be a    */
+	/* valid disablesid.conf file containing      */
+	/* instructions for disabling matching rule   */
+	/* SIDs.                                      */
+	/*                                            */
+	/*     $rule_map ==> reference to array of    */
+	/*                   current rules            */
+	/*  $suricatacfg ==> interface config params  */
+	/*  $log_results ==> [optional] 'yes' to log  */
+	/*                   results to $log_file     */
+	/*     $log_file ==> full path and filename   */
+	/*                   of log file to write to  */
+	/*                                            */
+	/*     On Return ==> suitably modified        */
+	/*                   $rule_map array          */
+	/**********************************************/
+
+	$suricata_sidmods_dir = SID_MODS_PATH;
+	$suricatalogdir = SURICATALOGDIR;
+	$sid_mods = array();
+
+	// If no rules in $rule_map, then nothing to do
+	if (empty($rule_map))
+		return;
+
+	// Attempt to open the 'disable_sid_file' for the interface
+	if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}")) {
+		log_error(gettext("[Suricata] Error - unable to open 'disable_sid_file' \"{$suricatacfg['disable_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+		return;
+	}
+	else
+		$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['disable_sid_file']}");
+
+	if (!empty($sid_mods))
+		suricata_modify_sid_state($rule_map, $sid_mods, "disable", $log_results, $log_file);
+	elseif ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['disable_sid_file']}\".\n"), 3, $log_file);
+	}
+
+	unset($sid_mods);
+}
+
+function suricata_process_modifysid(&$rule_map, $suricatacfg, $log_results = FALSE, $log_file = NULL) {
+
+	/**********************************************/
+	/* This function loads and processes the file */
+	/* specified by 'modify_sid_file' for the     */
+	/* interface.  The file is assumed to be a    */
+	/* valid modifysid.conf file containing       */
+	/* instructions for modifying matching rule   */
+	/* SIDs.                                      */
+	/*                                            */
+	/*     $rule_map ==> reference to array of    */
+	/*                   current rules            */
+	/*  $suricatacfg ==> interface config params  */
+	/*  $log_results ==> [optional] 'yes' to log  */
+	/*                   results to $log_file     */
+	/*     $log_file ==> full path and filename   */
+	/*                   of log file to write to  */
+	/*                                            */
+	/*     On Return ==> suitably modified        */
+	/*                   $rule_map array          */
+	/**********************************************/
+
+	$suricata_sidmods_dir = SID_MODS_PATH;
+	$suricatalogdir = SURICATALOGDIR;
+	$sid_mods = array();
+
+	// If no rules in $rule_map, then nothing to do
+	if (empty($rule_map))
+		return;
+
+	// Attempt to open the 'modify_sid_file' for the interface
+	if (!file_exists("{$suricata_sidmods_dir}{$suricatacfg['modify_sid_file']}")) {
+		log_error(gettext("[Suricata] Error - unable to open 'modify_sid_file' \"{$suricatacfg['modify_sid_file']}\" specified for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+		return;
+	}
+	else
+		$sid_mods = suricata_parse_sidconf_file("{$suricata_sidmods_dir}{$suricatacfg['modify_sid_file']}");
+
+	if (!empty($sid_mods))
+		suricata_modify_sid_content($rule_map, $sid_mods, $log_results, $log_file);
+	elseif ($log_results == TRUE && !empty($log_file)) {
+		error_log(gettext("WARNING: no valid SID match tokens found in file \"{$suricatacfg['modify_sid_file']}\".\n"), 3, $log_file);
+	}
+
+	unset($sid_mods);
+}
+
+function suricata_auto_sid_mgmt(&$rule_map, $suricatacfg, $log_results = FALSE) {
+
+	/**************************************************/
+	/* This function modifies the rules in the        */
+	/* passed rule_map array based on values in the   */
+	/* files 'enable_sid_file', 'disable_sid_file'    */
+	/* and 'modify_sid_file' for the interface.       */
+	/*                                                */
+	/* If auto-mgmt of SIDs is enabled via the        */
+	/* settings on the UPDATE RULES tab, then the     */
+	/* rules are processed against these settings.    */
+	/*                                                */
+	/*     $rule_map ==> array of current rules       */
+	/*  $suricatacfg ==> interface config settings    */
+	/*  $log_results ==> [optional] log results to    */
+	/*                   'sid_changes.log' in the     */
+	/*                   interface directory in       */
+	/*                   /var/log/suricata when TRUE  */
+	/*                                                */
+	/*       Returns ==> TRUE if rules were changed;  */
+	/*                   otherwise FALSE              */
+	/**************************************************/
+
+	global $config;
+	$result = FALSE;
+
+	// Configure the interface's logging subdirectory if log results is enabled
+	if ($log_results == TRUE)
+		$log_file = SURICATALOGDIR . $suricatalogdir . "suricata_" . get_real_interface($suricatacfg['interface']) . "{$suricatacfg['uuid']}/sid_changes.log";
+	else
+		$log_file = NULL;
+
+	// Check if auto-mgmt of SIDs is enabled and files are specified
+	// for the interface.
+	if ($config['installedpackages']['suricata']['config'][0]['auto_manage_sids'] == 'on' &&
+	    (!empty($suricatacfg['disable_sid_file']) || !empty($suricatacfg['enable_sid_file']) || 
+	    !empty($suricatacfg['modify_sid_file']))) {
+		if ($log_results == TRUE) {
+			error_log(gettext("********************************************************\n"), 3, $log_file);
+			error_log(gettext("Starting auto SID management for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) ."\n"), 3, $log_file);
+			error_log(gettext("Start Time: " . date("Y-m-d H:i:s") . "\n"), 3, $log_file);
+		}
+
+		switch ($suricatacfg['sid_state_order']) {
+			case "disable_enable":
+				if (!empty($suricatacfg['disable_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing disable_sid file: {$suricatacfg['disable_sid_file']}\n"), 3, $log_file);
+					suricata_process_disablesid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				if (!empty($suricatacfg['enable_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing enable_sid file: {$suricatacfg['enable_sid_file']}\n"), 3, $log_file);
+					suricata_process_enablesid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				if (!empty($suricatacfg['modify_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing modify_sid file: {$suricatacfg['modify_sid_file']}\n"), 3, $log_file);
+					suricata_process_modifysid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				$result = TRUE;
+				break;
+
+			case "enable_disable":
+				if (!empty($suricatacfg['enable_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing enable_sid file: {$suricatacfg['enable_sid_file']}\n"), 3, $log_file);
+					suricata_process_enablesid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				if (!empty($suricatacfg['disable_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing disable_sid file: {$suricatacfg['disable_sid_file']}\n"), 3, $log_file);
+					suricata_process_disablesid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				if (!empty($suricatacfg['modify_sid_file'])) {
+					if ($log_results == TRUE)
+						error_log(gettext("Processing modify_sid file: {$suricatacfg['modify_sid_file']}\n"), 3, $log_file);
+					suricata_process_modifysid($rule_map, $suricatacfg, $log_results, $log_file);
+				}
+				$result = TRUE;
+				break;
+
+			default:
+				log_error(gettext("[Suricata] Unrecognized 'sid_state_order' value.  Skipping auto SID mgmt step for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface'])));
+				if ($log_results == TRUE) {
+					error_log(gettext("ERROR: unrecognized 'sid_state_order' value.  Skipping auto SID mgmt step for ") . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']). ".\n", 3, $log_file);
+				}
+				$result = FALSE;
+		}
+
+		if ($log_results == TRUE) {
+			error_log(gettext("End Time: " . date("Y-m-d H:i:s") . "\n"), 3, $log_file);
+			error_log(gettext("********************************************************\n\n"), 3, $log_file);
+		}
+	}
+	return $result;
+}
+
 function suricata_load_sid_mods($sids) {
 
 	/*****************************************/
@@ -1577,15 +2484,15 @@ function suricata_load_sid_mods($sids) {
 
 function suricata_modify_sids(&$rule_map, $suricatacfg) {
 
-	/*****************************************/
-	/* This function modifies the rules in   */
-	/* the passed rules_map array based on   */
-	/* values in the enablesid/disablesid    */
-	/* configuration parameters.             */
-	/*                                       */
-	/*  $rule_map = array of current rules   */
-	/*  $suricatacfg = config settings       */
-	/*****************************************/
+	/***********************************************/
+	/* This function modifies the rules in the     */
+	/* passed rules_map array based on values in   */
+	/* the enablesid/disablesid configuration      */
+	/* parameters for the interface.               */
+	/*                                             */
+	/*  $rule_map = array of current rules         */
+	/*  $suricatacfg = interface config settings   */
+	/***********************************************/
 
 	if (!isset($suricatacfg['rule_sid_on']) && 
 	    !isset($suricatacfg['rule_sid_off']))
@@ -1639,11 +2546,15 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 	/*                  to be written.                         */
 	/***********************************************************/
 
-	global $rebuild_rules;
+	global $config, $rebuild_rules;
 
 	$suricatadir = SURICATADIR;
 	$flowbit_rules_file = FLOWBITS_FILENAME;
 	$suricata_enforcing_rules_file = ENFORCING_RULES_FILENAME;
+	$enabled_rules = array();
+	$enabled_files = array();
+	$all_rules = array();
+	$cat_mods = array();
 	$no_rules_defined = true;
 
 	// If there is no reason to rebuild the rules, exit to save time.
@@ -1653,11 +2564,12 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 	// Log a message for rules rebuild in progress
 	log_error(gettext("[Suricata] Updating rules configuration for: " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) . " ..."));
 
+	// Get any automatic rule category enable/disable modifications
+	// if auto-SID Mgmt is enabled and conf files exist for the interface.
+	$cat_mods = suricata_sid_mgmt_auto_categories($suricatacfg, TRUE);
+
 	// Only rebuild rules if some are selected or an IPS Policy is enabled
-	if (!empty($suricatacfg['rulesets']) || $suricatacfg['ips_policy_enable'] == 'on') {
-		$enabled_rules = array();
-		$enabled_files = array();
-		$all_rules = array();
+	if (!empty($suricatacfg['rulesets']) || $suricatacfg['ips_policy_enable'] == 'on' || !empty($cat_mods)) {
 		$no_rules_defined = false;
 
 		// Load up all the rules into a Rules Map array.
@@ -1665,12 +2577,37 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 
 		// Create an array with the filenames of the enabled
 		// rule category files if we have any.
-		if (!empty($suricatacfg['rulesets'])) {
-			foreach (explode("||", $suricatacfg['rulesets']) as $file){
-					$category = basename($file, ".rules");
-					if (!is_array($enabled_files[$category]))
-						$enabled_files[$category] = array();
-					$enabled_files[$category] = $file;
+		if (!empty($suricatacfg['rulesets']) || !empty($cat_mods)) {
+			// First get all the user-enabled category files
+			if (!empty($suricatacfg['rulesets'])) {
+				foreach (explode("||", $suricatacfg['rulesets']) as $file){
+						$category = basename($file, ".rules");
+						if (!is_array($enabled_files[$category]))
+							$enabled_files[$category] = array();
+						$enabled_files[$category] = $file;
+				}
+			}
+
+			// Now adjust the list using any required changes as
+			// determined by auto-SID Mgmt policy files.
+			if (!empty($cat_mods)) {
+				foreach ($cat_mods as $k => $action) {
+					$key = basename($k, ".rules");
+					switch ($action) {
+						case 'enabled':
+							if (!isset($enabled_files[$key]))
+								$enabled_files[$key] = $k;
+							break;
+
+						case 'disabled':
+							if (isset($enabled_files[$key]))
+								unset($enabled_files[$key]);
+							break;
+
+						default:
+							break;
+					}
+				}
 			}
 
 			/****************************************************/
@@ -1694,7 +2631,7 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 			}
 
 			// Release memory we no longer need.
-			unset($enabled_files, $rulem, $v);
+			unset($enabled_files, $cat_mods, $rulem, $v);
 		}
 
 		// Check if a pre-defined Snort VRT policy is selected. If so,
@@ -1717,6 +2654,8 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 		}
 
 		// Process any enablesid or disablesid modifications for the selected rules.
+		// Do the auto-SID managment first, if enabled, then do any manual SID state changes.
+		suricata_auto_sid_mgmt($enabled_rules, $suricatacfg, TRUE);
 		suricata_modify_sids($enabled_rules, $suricatacfg);
 
 		// Write the enforcing rules file to the Suricata interface's "rules" directory.
@@ -1735,7 +2674,45 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 		} else
 			// Just put an empty file to always have the file present
 			suricata_write_flowbit_rules_file(array(), "{$suricatacfgdir}/rules/{$flowbit_rules_file}");
-	} else {
+		unset($all_rules);
+	}
+	// If no rule categories were enabled, then use auto-SID management if enabled, since it may enable some rules
+	elseif ($config['installedpackages']['suricata']['config'][0]['auto_manage_sids'] == 'on' &&
+		(!empty($suricatacfg['disable_sid_file']) || !empty($suricatacfg['enable_sid_file']) || 
+		!empty($suricatacfg['modify_sid_file']))) {
+
+		suricata_auto_sid_mgmt($enabled_rules, $suricatacfg, TRUE);
+		if (!empty($enabled_rules)) {
+			// Auto-SID management generated some rules, so use them
+			$no_rules_defined = false;
+			suricata_modify_sids($enabled_rules, $suricatacfg);
+
+			// Write the enforcing rules file to the Suricata interface's "rules" directory.
+			suricata_write_enforcing_rules_file($enabled_rules, "{$suricatacfgdir}/rules/{$suricata_enforcing_rules_file}");
+
+			// If auto-flowbit resolution is enabled, generate the dependent flowbits rules file.
+			if ($suricatacfg['autoflowbitrules'] == 'on') {
+				log_error('[Suricata] Enabling any flowbit-required rules for: ' . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) . '...');
+
+				// Load up all rules into a Rules Map array for flowbits assessment
+				$all_rules = suricata_load_rules_map("{$suricatadir}rules/");
+				$fbits = suricata_resolve_flowbits($all_rules, $enabled_rules);
+
+				// Check for and disable any flowbit-required rules the
+				// user has manually forced to a disabled state.
+				suricata_modify_sids($fbits, $suricatacfg);
+				suricata_write_flowbit_rules_file($fbits, "{$suricatacfgdir}/rules/{$flowbit_rules_file}");
+				unset($all_rules, $fbits);
+			} else
+				// Just put an empty file to always have the file present
+			suricata_write_flowbit_rules_file(array(), "{$suricatacfgdir}/rules/{$flowbit_rules_file}");
+		}
+		else {
+			suricata_write_enforcing_rules_file(array(), "{$suricatacfgdir}/rules/{$suricata_enforcing_rules_file}");
+			suricata_write_flowbit_rules_file(array(), "{$suricatacfgdir}/rules/{$flowbit_rules_file}");
+		}
+	}
+	 else {
 		suricata_write_enforcing_rules_file(array(), "{$suricatacfgdir}/rules/{$suricata_enforcing_rules_file}");
 		suricata_write_flowbit_rules_file(array(), "{$suricatacfgdir}/rules/{$flowbit_rules_file}");
 	}
@@ -1753,7 +2730,7 @@ function suricata_prepare_rule_files($suricatacfg, $suricatacfgdir) {
 
 	// Build a new sid-msg.map file from the enabled
 	// rules and copy it to the interface directory.
-	log_error(gettext("[Suricata] Building new sig-msg.map file for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) . "..."));
+	log_error(gettext("[Suricata] Building new sid-msg.map file for " . convert_friendly_interface_to_friendly_descr($suricatacfg['interface']) . "..."));
 	suricata_build_sid_msg_map("{$suricatacfgdir}/rules/", "{$suricatacfgdir}/sid-msg.map");
 }
 
@@ -1994,8 +2971,8 @@ esac
 EOD;
 
 	// Write out the suricata.sh script file
-	@file_put_contents("{$rcdir}/suricata.sh", $suricata_sh_text);
-	@chmod("{$rcdir}/suricata.sh", 0755);
+	@file_put_contents("{$rcdir}suricata.sh", $suricata_sh_text);
+	@chmod("{$rcdir}suricata.sh", 0755);
 	unset($suricata_sh_text);
 }
 
@@ -2056,7 +3033,7 @@ function suricata_generate_barnyard2_conf($suricatacfg, $if_real) {
 		$suricatabarnyardlog_output_plugins .= "# syslog_full: log to a syslog receiver\n";
 		$suricatabarnyardlog_output_plugins .= "output alert_syslog_full: sensor_name {$suricatabarnyardlog_hostname_info_chk}, ";
 		if ($suricatacfg['barnyard_syslog_local'] == 'on')
-			$suricatabarnyardlog_output_plugins .= "local, log_facility LOG_AUTH, log_priority LOG_INFO\n\n";
+			$suricatabarnyardlog_output_plugins .= "local, log_facility {$suricatacfg['barnyard_syslog_facility']}, log_priority {$suricatacfg['barnyard_syslog_priority']}\n\n";
 		else {
 			$suricatabarnyardlog_output_plugins .= "server {$suricatacfg['barnyard_syslog_rhost']}, protocol {$suricatacfg['barnyard_syslog_proto']}, ";
 			$suricatabarnyardlog_output_plugins .= "port {$suricatacfg['barnyard_syslog_dport']}, operation_mode {$suricatacfg['barnyard_syslog_opmode']}, ";
@@ -2136,25 +3113,289 @@ function suricata_generate_yaml($suricatacfg) {
 	$suricata_uuid = $suricatacfg['uuid'];
 	$suricatacfgdir = "{$suricatadir}suricata_{$suricata_uuid}_{$if_real}";
 
-	conf_mount_rw();
-
 	if (!is_array($config['installedpackages']['suricata']['rule']))
 		return;
 
 	// Pull in the PHP code that generates the suricata.yaml file
 	// variables that will be substitued further down below.
-	include("/usr/local/www/suricata/suricata_generate_yaml.php");
+	include("/usr/local/pkg/suricata/suricata_generate_yaml.php");
 
 	// Pull in the boilerplate template for the suricata.yaml
 	// configuration file.  The contents of the template along
-	// with substituted variables is stored in $suricata_conf_text
+	// with substituted variables are stored in $suricata_conf_text
 	// (which is defined in the included file).
 	include("/usr/local/pkg/suricata/suricata_yaml_template.inc");
 
 	// Now write out the conf file using $suricata_conf_text contents
 	@file_put_contents("{$suricatacfgdir}/suricata.yaml", $suricata_conf_text); 
 	unset($suricata_conf_text);
-	conf_mount_ro();
+}
+
+/* Uses XMLRPC to synchronize the changes to a remote node */
+function suricata_sync_on_changes() {
+	global $config, $g;
+
+	/* Do not attempt a package sync while booting up or installing package */
+	if ($g['booting'] || $g['suricata_postinstall'] == TRUE) {
+		log_error("[suricata] No xmlrpc sync to CARP targets when booting up or during package reinstallation.");
+		return;
+	}
+
+	if (is_array($config['installedpackages']['suricatasync']['config'])){
+		$suricata_sync=$config['installedpackages']['suricatasync']['config'][0];
+		$synconchanges = $suricata_sync['varsynconchanges'];
+		$synctimeout = $suricata_sync['varsynctimeout'];
+		$syncdownloadrules = $suricata_sync['vardownloadrules'];
+		switch ($synconchanges){
+			case "manual":
+				if (is_array($suricata_sync[row])){
+					$rs=$suricata_sync[row];
+				}
+				else{
+					log_error("[suricata] xmlrpc CARP sync is enabled but there are no hosts configured as replication targets.");
+					return;
+				}
+				break;
+			case "auto":
+					if (is_array($config['installedpackages']['carpsettings']) && is_array($config['installedpackages']['carpsettings']['config'])){
+						$system_carp=$config['installedpackages']['carpsettings']['config'][0];
+						$rs[0]['varsyncipaddress']=$system_carp['synchronizetoip'];
+						$rs[0]['varsyncusername']=$system_carp['username'];
+						$rs[0]['varsyncpassword']=$system_carp['password'];
+						$rs[0]['varsyncsuricatastart']="no";
+						if ($system_carp['synchronizetoip'] ==""){
+							log_error("[suricata] xmlrpc CARP sync is enabled but there are no system backup hosts configured as replication targets.");
+							return;
+						}
+					}
+					else{
+						log_error("[suricata] xmlrpc CARP sync is enabled but there are no system backup hosts configured as replication targets.");
+						return;
+					}
+				break;			
+			default:
+				return;
+			break;
+		}
+		if (is_array($rs)){
+			log_error("[suricata] Suricata pkg xmlrpc CARP sync is starting.");
+			foreach($rs as $sh){
+				if ($sh['varsyncsuricatastart'])
+					$syncstartsuricata = $sh['varsyncsuricatastart'];
+				else
+					$syncstartsuricata = "OFF";
+				$sync_to_ip = $sh['varsyncipaddress'];
+				$port = $sh['varsyncport'];
+				$password = $sh['varsyncpassword'];
+				if($sh['varsyncusername'])
+					$username = $sh['varsyncusername'];
+				else
+					$username = 'admin';
+				if($password && $sync_to_ip)
+					suricata_do_xmlrpc_sync($syncdownloadrules, $sync_to_ip, $port, $username, $password, $synctimeout, $syncstartsuricata);
+			}
+			log_error("[suricata] Suricata pkg xmlrpc CARP sync completed.");
+		}
+ 	}
+}
+
+/* Do the actual XMLRPC sync */
+function suricata_do_xmlrpc_sync($syncdownloadrules, $sync_to_ip, $port, $username, $password, $synctimeout = 150, $syncstartsuricata) {
+	global $config, $g;
+
+	/* Do not attempt a package sync while booting up or installing package */
+	if ($g['booting'] || isset($g['suricata_postinstall'])) {
+		log_error("[suricata] No xmlrpc sync to CARP targets when booting up or during package reinstallation.");
+		return;
+	}
+
+	if($username == "" || $password == "" || $sync_to_ip == "") {
+		log_error("[suricata] A required XMLRPC CARP sync parameter (user, host IP or password) is empty ... aborting pkg sync");
+		return;
+	}
+
+	/* Test key variables and set defaults if empty */
+	if(!$synctimeout)
+		$synctimeout=150;
+
+	$xmlrpc_sync_neighbor = $sync_to_ip;
+	if($config['system']['webgui']['protocol'] != "") {
+		$synchronizetoip = $config['system']['webgui']['protocol'];
+		$synchronizetoip .= "://";
+	}
+	$port = $config['system']['webgui']['port'];
+	/* if port is empty lets rely on the protocol selection */
+	if($port == "") {
+		if($config['system']['webgui']['protocol'] == "http") 
+			$port = "80";
+		else 
+			$port = "443";
+	}
+	$synchronizetoip .= $sync_to_ip;
+	$url = $synchronizetoip;
+
+	/*************************************************/
+	/* Send over any auto-SID management files       */
+	/*************************************************/
+	$sid_files = glob(SID_MODS_PATH . '*');
+	foreach ($sid_files as $file) {
+		$content = base64_encode(file_get_contents($file));
+		$payload = "@file_put_contents('{$file}', base64_decode('{$content}'));";
+
+		/* assemble xmlrpc payload */
+		$method = 'pfsense.exec_php';
+		$params = array( XML_RPC_encode($password), XML_RPC_encode($payload) );
+	
+		log_error("[suricata] Suricata XMLRPC CARP sync sending auto-SID conf files to {$url}:{$port}.");
+		$msg = new XML_RPC_Message($method, $params);
+		$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+		$cli->setCredentials($username, $password);
+		$resp = $cli->send($msg, $synctimeout);
+		$error = "";
+		if(!$resp) {
+			$error = "A communications error occurred while attempting Suricata XMLRPC CARP sync with {$url}:{$port}.  Failed to transfer file: " . basename($file);
+			log_error($error);
+			file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+		} elseif($resp->faultCode()) {
+			$error = "An error code was received while attempting Suricata XMLRPC CARP sync with {$url}:{$port}. Failed to transfer file: " . basename($file) . " - Code " . $resp->faultCode() . ": " . $resp->faultString();
+			log_error($error);
+			file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+		}
+	}
+
+	if (!empty($sid_files) && $error == "")
+		log_error("[suricata] Suricata pkg XMLRPC CARP sync auto-SID conf files success with {$url}:{$port} (pfsense.exec_php).");
+
+	/**************************************************/
+	/* Send over the <suricata> portion of config.xml */
+	/* $xml will hold the section to sync.            */
+	/**************************************************/
+	$xml = array();
+	$xml['suricata'] = $config['installedpackages']['suricata'];
+	/* assemble xmlrpc payload */
+	$params = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($xml)
+	);
+
+	log_error("[suricata] Beginning Suricata pkg configuration XMLRPC sync to {$url}:{$port}.");
+	$method = 'pfsense.merge_installedpackages_section_xmlrpc';
+	$msg = new XML_RPC_Message($method, $params);
+	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+	$cli->setCredentials($username, $password);
+
+	/* send our XMLRPC message and timeout after defined sync timeout value*/
+	$resp = $cli->send($msg, $synctimeout);
+	if(!$resp) {
+		$error = "A communications error occurred while attempting Suricata XMLRPC CARP sync with {$url}:{$port}.";
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} elseif($resp->faultCode()) {
+		$error = "An error code was received while attempting Suricata XMLRPC CARP sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} else {
+		log_error("[suricata] Suricata pkg configuration XMLRPC CARP sync successfully completed with {$url}:{$port}.");
+	}
+
+	$downloadrulescmd = "";
+	if ($syncdownloadrules == "yes") {
+		$downloadrulescmd = "log_error(gettext(\"[suricata] XMLRPC pkg CARP sync: Update of downloaded rule sets requested...\"));\n";
+		$downloadrulescmd .= "\tinclude_once(\"/usr/local/pkg/suricata/suricata_check_for_rule_updates.php\");\n";
+	}
+	$suricatastart = "";
+	if ($syncstartsuricata == "ON") {
+		$suricatastart = "log_error(gettext(\"[suricata] XMLRPC pkg CARP sync: Checking Suricata status...\"));\n";
+		$suricatastart .= "\tif (!is_process_running(\"suricata\")) {\n";
+		$suricatastart .= "\t\tlog_error(gettext(\"[suricata] XMLRPC pkg CARP sync: Suricata not running. Sending a start command...\"));\n";
+		$suricatastart .= "\t\t\$sh_script = RCFILEPREFIX . \"suricata.sh\";\n";
+		$suricatastart .= "\t\tmwexec_bg(\"{\$sh_script} start\");\n\t}\n";
+		$suricatastart .= "\telse {\n\t\tlog_error(gettext(\"[suricata] XMLRPC pkg CARP sync: Suricata is running...\"));\n\t}\n";
+	}
+
+	/*************************************************/
+	/* Build a series of commands as a PHP file for  */
+	/* the secondary host to execute to load the new */
+	/* settings.                                     */
+	/*************************************************/
+	$suricata_sync_cmd = <<<EOD
+	<?php
+	require_once("/usr/local/pkg/suricata/suricata.inc");
+	require_once("service-utils.inc");
+	global \$g, \$rebuild_rules, \$suricata_gui_include, \$pkg_interface;
+	\$orig_pkg_interface = \$pkg_interface;
+	\$g["suricata_postinstall"] = true;
+	\$g["suricata_sync_in_progress"] = true;
+	\$suricata_gui_include = false;
+	\$pkg_interface = "console";
+	{$downloadrulescmd}
+	unset(\$g["suricata_postinstall"]);
+	log_error(gettext("[suricata] XMLRPC pkg CARP sync: Generating suricata.yaml file using Master Host settings..."));
+	\$rebuild_rules = true;
+	sync_suricata_package_config();
+	\$rebuild_rules = false;
+	{$suricatastart}
+	log_error(gettext("[suricata] XMLRPC pkg CARP sync process on this host is complete..."));
+	\$pkg_interface = \$orig_pkg_interface;
+	unset(\$g["suricata_sync_in_progress"]);
+	return true;
+	?>
+
+EOD;
+
+	/*************************************************/
+	/* First, have target host write the commands    */ 
+	/* to a PHP file in the /tmp directory.          */
+	/*************************************************/
+	$execcmd = "file_put_contents('/tmp/suricata_sync_cmds.php', '{$suricata_sync_cmd}');";
+
+	/* assemble xmlrpc payload */
+	$method = 'pfsense.exec_php';
+	$params = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($execcmd)
+	);
+	
+	log_error("[suricata] Suricata XMLRPC CARP sync sending reload configuration cmd set as a file to {$url}:{$port}.");
+	$msg = new XML_RPC_Message($method, $params);
+	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+	$cli->setCredentials($username, $password);
+	$resp = $cli->send($msg, $synctimeout);
+	if(!$resp) {
+		$error = "A communications error occurred while attempting Suricata XMLRPC CARP sync with {$url}:{$port} (pfsense.exec_php).";
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} elseif($resp->faultCode()) {
+		$error = "An error code was received while attempting Suricata XMLRPC CARP sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} else {
+		log_error("[suricata] Suricata pkg XMLRPC CARP sync reload configuration success with {$url}:{$port} (pfsense.exec_php).");
+	}
+
+	/*************************************************/
+	/* Now assemble a command to execute the         */
+	/* previously sent PHP file in the background.   */
+	/*************************************************/
+	$execcmd = "exec(\"/usr/local/bin/php -f '/tmp/suricata_sync_cmds.php' > /dev/null 2>&1 &\");";
+	$params2 = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($execcmd)
+	);
+	log_error("[suricata] Suricata XMLRPC CARP sync sending {$url}:{$port} cmd to execute configuration reload.");
+	$msg2 = new XML_RPC_Message($method, $params2);
+	$resp = $cli->send($msg2, $synctimeout);
+	if(!$resp) {
+		$error = "A communications error occurred while attempting Suricata XMLRPC CARP sync with {$url}:{$port} (pfsense.exec_php).";
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} elseif($resp->faultCode()) {
+		$error = "An error code was received while attempting Suricata XMLRPC CARP sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("sync_settings", $error, "Suricata Settings Sync", "");
+	} else {
+		log_error("[suricata] Suricata pkg XMLRPC CARP sync reload configuration success with {$url}:{$port} (pfsense.exec_php).");
+	}
 }
 
 ?>
diff --git a/config/suricata/suricata.priv.inc b/config/suricata/suricata.priv.inc
index 3bbee55a..efa71366 100644
--- a/config/suricata/suricata.priv.inc
+++ b/config/suricata/suricata.priv.inc
@@ -25,6 +25,7 @@ $priv_list['page-services-suricata']['match'][] = "suricata/suricata_select_alia
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_list_view.php*";
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_logs_browser.php*";
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_logs_mgmt.php*";
+$priv_list['page-services-suricata']['match'][] = "suricata/suricata_sid_mgmt.php*";
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_passlist.php*";
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_passlist_edit.php*";
 $priv_list['page-services-suricata']['match'][] = "suricata/suricata_post_install.php*";
diff --git a/config/suricata/suricata.xml b/config/suricata/suricata.xml
index 6aae2d93..43ad68fa 100644
--- a/config/suricata/suricata.xml
+++ b/config/suricata/suricata.xml
@@ -9,49 +9,40 @@
 /*
     suricata.xml
     part of the Suricata package for pfSense
+    Copyright (C) 2014 Bill meeks
 
-   Significant portions are based on original work done for the Snort
-   package for pfSense from the following contributors:
-   
-   Copyright (C) 2005 Bill Marquette <bill.marquette@gmail.com>.
-   Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
-   Copyright (C) 2006 Scott Ullrich
-   Copyright (C) 2009 Robert Zelaya Sr. Developer
-   Copyright (C) 2012 Ermal Luci
-   All rights reserved.
-  
-   Adapted for Suricata by:
-   Copyright (C) 2014 Bill Meeks
-   All rights reserved.
-  
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions are met:
-
-   1. Redistributions of source code must retain the above copyright notice,
-   this list of conditions and the following disclaimer.
-  
-   2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-  
-   THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
-   INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
-   AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-   AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-   OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-   CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-   ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-   POSSIBILITY OF SUCH DAMAGE.
+    All rights reserved.            
 			                                                      */
 /* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code MUST retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
 	]]>
 	</copyright>
 	<description>Suricata IDS/IPS Package</description>
 	<requirements>None</requirements>
 	<name>suricata</name>
-	<version>1.4.6 pkg v1.0.6</version>
+	<version>2.0.3 pkg v2.0.1</version>
 	<title>Services: Suricata IDS</title>
 	<include_file>/usr/local/pkg/suricata/suricata.inc</include_file>
 	<menu>
@@ -77,18 +68,43 @@
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_sync.xml</item>
+		<prefix>/usr/local/pkg/suricata/</prefix>
+		<chmod>0755</chmod>
+	</additional_files_needed>
+	<additional_files_needed>
 		<item>https://packages.pfsense.org/packages/config/suricata/suricata_check_cron_misc.inc</item>
 		<prefix>/usr/local/pkg/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_check_for_rule_updates.php</item>
+		<prefix>/usr/local/pkg/suricata/</prefix>
+		<chmod>0755</chmod>
+	</additional_files_needed>
+	<additional_files_needed>
 		<item>https://packages.pfsense.org/packages/config/suricata/suricata_yaml_template.inc</item>
 		<prefix>/usr/local/pkg/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
 		<item>https://packages.pfsense.org/packages/config/suricata/suricata_generate_yaml.php</item>
-		<prefix>/usr/local/www/suricata/</prefix>
+		<prefix>/usr/local/pkg/suricata/</prefix>
+		<chmod>0755</chmod>
+	</additional_files_needed>
+	<additional_files_needed>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_migrate_config.php</item>
+		<prefix>/usr/local/pkg/suricata/</prefix>
+		<chmod>0755</chmod>
+	</additional_files_needed>
+	<additional_files_needed>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_post_install.php</item>
+		<prefix>/usr/local/pkg/suricata/</prefix>
+		<chmod>0755</chmod>
+	</additional_files_needed>
+	<additional_files_needed>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_uninstall.php</item>
+		<prefix>/usr/local/pkg/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
@@ -122,11 +138,6 @@
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_check_for_rule_updates.php</item>
-		<prefix>/usr/local/www/suricata/</prefix>
-		<chmod>0755</chmod>
-	</additional_files_needed>
-	<additional_files_needed>
 		<item>https://packages.pfsense.org/packages/config/suricata/suricata_rules.php</item>
 		<prefix>/usr/local/www/suricata/</prefix>
 		<chmod>0755</chmod>
@@ -182,22 +193,22 @@
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_list_view.php</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_sid_mgmt.php</item>
 		<prefix>/usr/local/www/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_app_parsers.php</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_list_view.php</item>
 		<prefix>/usr/local/www/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_libhtp_policy_engine.php</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_app_parsers.php</item>
 		<prefix>/usr/local/www/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_uninstall.php</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_libhtp_policy_engine.php</item>
 		<prefix>/usr/local/www/suricata/</prefix>
 		<chmod>0755</chmod>
 	</additional_files_needed>
@@ -212,9 +223,19 @@
 		<chmod>0755</chmod>
 	</additional_files_needed>
 	<additional_files_needed>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_post_install.php</item>
-		<prefix>/usr/local/www/suricata/</prefix>
-		<chmod>0755</chmod>
+		<prefix>/usr/local/www/widgets/javascript/</prefix>
+		<chmod>0644</chmod>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_alerts.js</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/www/widgets/widgets/</prefix>
+		<chmod>0644</chmod>
+		<item>https://packages.pfsense.org/packages/config/suricata/suricata_alerts.widget.php</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/www/widgets/include/</prefix>
+		<chmod>0644</chmod>
+		<item>https://packages.pfsense.org/packages/config/suricata/widget-suricata.inc</item>
 	</additional_files_needed>
 	<additional_files_needed>
 		<prefix>/usr/local/www/suricata/</prefix>
@@ -237,19 +258,19 @@
 		<item>https://packages.pfsense.org/packages/config/suricata/suricata_select_alias.php</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/widgets/javascript/</prefix>
+		<prefix>/var/db/suricata/sidmods/</prefix>
 		<chmod>0644</chmod>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_alerts.js</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/disablesid-sample.conf</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/widgets/widgets/</prefix>
+		<prefix>/var/db/suricata/sidmods/</prefix>
 		<chmod>0644</chmod>
-		<item>https://packages.pfsense.org/packages/config/suricata/suricata_alerts.widget.php</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/enablesid-sample.conf</item>
 	</additional_files_needed>
 	<additional_files_needed>
-		<prefix>/usr/local/www/widgets/include/</prefix>
+		<prefix>/var/db/suricata/sidmods/</prefix>
 		<chmod>0644</chmod>
-		<item>https://packages.pfsense.org/packages/config/suricata/widget-suricata.inc</item>
+		<item>https://packages.pfsense.org/packages/config/suricata/modifysid-sample.conf</item>
 	</additional_files_needed>
 	<!-- configpath gets expanded out automatically and config items will be stored in that location -->
 	<configpath>['installedpackages']['suricata']</configpath>
@@ -259,12 +280,12 @@
 	</fields>
 	<custom_php_install_command>
 		<![CDATA[
-		include_once("/usr/local/www/suricata/suricata_post_install.php");
+		include_once("/usr/local/pkg/suricata/suricata_post_install.php");
 		]]>
 	</custom_php_install_command>
 	<custom_php_deinstall_command>
 		<![CDATA[
-		include_once("/usr/local/www/suricata/suricata_uninstall.php");
+		include_once("/usr/local/pkg/suricata/suricata_uninstall.php");
 		]]>
 	</custom_php_deinstall_command>
 	<custom_php_resync_config_command>
diff --git a/config/suricata/suricata_alerts.php b/config/suricata/suricata_alerts.php
index 2f0f114f..eab2a1d5 100644
--- a/config/suricata/suricata_alerts.php
+++ b/config/suricata/suricata_alerts.php
@@ -11,6 +11,7 @@
  * Copyright (C) 2006 Scott Ullrich
  * Copyright (C) 2009 Robert Zelaya Sr. Developer
  * Copyright (C) 2012 Ermal Luci
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * All rights reserved.
  *
  * Adapted for Suricata by:
@@ -44,6 +45,7 @@ require_once("/usr/local/pkg/suricata/suricata.inc");
 
 $supplist = array();
 $suri_pf_table = SURICATA_PF_TABLE;
+$filterlogentries = FALSE;
 
 function suricata_is_alert_globally_suppressed($list, $gid, $sid) {
 
@@ -132,6 +134,31 @@ function suricata_add_supplist_entry($suppress) {
 		return false;
 }
 
+function suricata_escape_filter_regex($filtertext) {
+	/* If the caller (user) has not already put a backslash before a slash, to escape it in the regex, */
+	/* then this will do it. Take out any "\/" already there, then turn all ordinary "/" into "\/".  */
+	return str_replace('/', '\/', str_replace('\/', '/', $filtertext));
+}
+
+function suricata_match_filter_field($flent, $fields) {
+	foreach ($fields as $key => $field) {
+		if ($field == null)
+			continue;
+		if ((strpos($field, '!') === 0)) {
+			$field = substr($field, 1);
+			$field_regex = suricata_escape_filter_regex($field);
+			if (@preg_match("/{$field_regex}/i", $flent[$key]))
+				return false;
+		}
+		else {
+			$field_regex = suricata_escape_filter_regex($field);
+			if (!@preg_match("/{$field_regex}/i", $flent[$key]))
+				return false;
+		}
+	}
+	return true;
+}
+
 if (isset($_POST['instance']) && is_numericint($_POST['instance']))
 	$instanceid = $_POST['instance'];
 // This is for the auto-refresh so we can  stay on the same interface
@@ -164,6 +191,49 @@ if (empty($pconfig['arefresh']))
 	$pconfig['arefresh'] = 'off';
 $anentries = $pconfig['alertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
+if ($_POST['filterlogentries_submit']) {
+	// Set flag for filtering alert entries
+	$filterlogentries = TRUE;
+
+	// -- IMPORTANT --
+	// Note the order of these fields must match the order decoded from the alerts log
+	$filterfieldsarray = array();
+	$filterfieldsarray['time'] = $_POST['filterlogentries_time'] ? $_POST['filterlogentries_time'] : null;
+	$filterfieldsarray['action'] = null;
+	$filterfieldsarray['gid'] = $_POST['filterlogentries_gid'] ? $_POST['filterlogentries_gid'] : null;
+	$filterfieldsarray['sid'] = $_POST['filterlogentries_sid'] ? $_POST['filterlogentries_sid'] : null;
+	$filterfieldsarray['rev'] = null;
+	$filterfieldsarray['msg'] = $_POST['filterlogentries_description'] ? $_POST['filterlogentries_description'] : null;
+	$filterfieldsarray['class'] = $_POST['filterlogentries_classification'] ? $_POST['filterlogentries_classification'] : null;
+	$filterfieldsarray['priority'] = $_POST['filterlogentries_priority'] ? $_POST['filterlogentries_priority'] : null;
+	$filterfieldsarray['proto'] = $_POST['filterlogentries_protocol'] ? $_POST['filterlogentries_protocol'] : null;
+	// Remove any zero-length spaces added to the IP address that could creep in from a copy-paste operation
+	$filterfieldsarray['src'] = $_POST['filterlogentries_sourceipaddress'] ? str_replace("\xE2\x80\x8B", "", $_POST['filterlogentries_sourceipaddress']) : null;
+	$filterfieldsarray['sport'] = $_POST['filterlogentries_sourceport'] ? $_POST['filterlogentries_sourceport'] : null;
+	// Remove any zero-length spaces added to the IP address that could creep in from a copy-paste operation
+	$filterfieldsarray['dst'] = $_POST['filterlogentries_destinationipaddress'] ? str_replace("\xE2\x80\x8B", "", $_POST['filterlogentries_destinationipaddress']) : null;
+	$filterfieldsarray['dport'] = $_POST['filterlogentries_destinationport'] ? $_POST['filterlogentries_destinationport'] : null;
+}
+
+if ($_POST['filterlogentries_clear']) {
+	$filterfieldsarray = array();
+}
+
 if ($_POST['save']) {
 	if (!is_array($config['installedpackages']['suricata']['alertsblocks']))
 		$config['installedpackages']['suricata']['alertsblocks'] = array();
@@ -277,7 +347,9 @@ if ($_POST['togglesid'] && is_numeric($_POST['sidid']) && is_numeric($_POST['gen
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	suricata_generate_yaml($a_instance[$instanceid]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Signal Suricata to live-load the new rules */
@@ -334,7 +406,6 @@ include_once("head.inc");
 ?>
 
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
 <?php
 include_once("fbegin.inc");
 
@@ -359,24 +430,28 @@ if ($savemsg) {
 <input type="hidden" name="descr" id="descr" value=""/>
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), true, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 ?>
 </td></tr>
 <tr>
 	<td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="6">
+			<tbody>
 			<tr>
 				<td colspan="2" class="listtopic"><?php echo gettext("Alert Log View Settings"); ?></td>
 			</tr>
@@ -417,9 +492,97 @@ if ($savemsg) {
 				</td>
 			</tr>
 			<tr>
+				<td colspan="2" class="listtopic"><?php echo gettext("Alert Log View Filter"); ?></td>
+			</tr>
+			<tr id="filter_enable_row" style="display:<?php if (!$filterlogentries) {echo "table-row;";} else {echo "none;";} ?>">
+				<td width="22%" class="vncell"><?php echo gettext('Alert Log Filter Options'); ?></td>
+				<td width="78%" class="vtable">
+					<input name="show_filter" id="show_filter" type="button" class="formbtns" value="<?=gettext("Show Filter");?>" onclick="enable_showFilter();" />
+					&nbsp;&nbsp;<?=gettext("Click to display advanced filtering options dialog");?>
+				</td>
+			</tr>
+			<tr id="filter_options_row" style="display:<?php if (!$filterlogentries) {echo "none;";} else {echo "table-row;";} ?>">
+				<td colspan="2">
+					<table width="100%" border="0" cellpadding="0" cellspacing="1" summary="action">
+						<tr>
+							<td valign="top">
+								<div align="center"><?=gettext("Date");?></div>
+								<div align="center"><input id="filterlogentries_time" name="filterlogentries_time" class="formfld search" type="text" size="10" value="<?= $filterfieldsarray['time'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Source IP Address");?></div>
+								<div align="center"><input id="filterlogentries_sourceipaddress" name="filterlogentries_sourceipaddress" class="formfld search" type="text" size="28" value="<?= $filterfieldsarray['src'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Source Port");?></div>
+								<div align="center"><input id="filterlogentries_sourceport" name="filterlogentries_sourceport" class="formfld search" type="text" size="5" value="<?= $filterfieldsarray['sport'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Description");?></div>
+								<div align="center"><input id="filterlogentries_description" name="filterlogentries_description" class="formfld search" type="text" size="28" value="<?= $filterfieldsarray['msg'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("GID");?></div>
+								<div align="center"><input id="filterlogentries_gid" name="filterlogentries_gid" class="formfld search" type="text" size="6" value="<?= $filterfieldsarray['gid'] ?>" /></div>
+							</td>
+						</tr>
+						<tr>
+							<td valign="top">
+								<div align="center"><?=gettext("Priority");?></div>
+								<div align="center"><input id="filterlogentries_priority" name="filterlogentries_priority" class="formfld search" type="text" size="10" value="<?= $filterfieldsarray['priority'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Destination IP Address");?></div>
+								<div align="center"><input id="filterlogentries_destinationipaddress" name="filterlogentries_destinationipaddress" class="formfld search" type="text" size="28" value="<?= $filterfieldsarray['dst'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Destination Port");?></div>
+								<div align="center"><input id="filterlogentries_destinationport" name="filterlogentries_destinationport" class="formfld search" type="text" size="5" value="<?= $filterfieldsarray['dport'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("Classification");?></div>
+								<div align="center"><input id="filterlogentries_classification" name="filterlogentries_classification" class="formfld search" type="text" size="28" value="<?= $filterfieldsarray['class'] ?>" /></div>
+							</td>
+							<td valign="top">
+								<div align="center"><?=gettext("SID");?></div>
+								<div align="center"><input id="filterlogentries_sid" name="filterlogentries_sid" class="formfld search" type="text" size="6" value="<?= $filterfieldsarray['sid'] ?>" /></div>
+							</td>
+						</tr>
+						<tr>
+							<td valign="top">
+								<div align="center"><?=gettext("Protocol");?></div>
+								<div align="center"><input id="filterlogentries_protocol" name="filterlogentries_protocol" class="formfld search" type="text" size="10" value="<?= $filterfieldsarray['proto'] ?>" /></div>
+							</td>
+							<td valign="top">
+							</td>
+							<td valign="top">
+							</td>
+							<td colspan="2" style="vertical-align:bottom">
+								<div align="right"><input id="filterlogentries_submit" name="filterlogentries_submit" type="submit" class="formbtns" value="<?=gettext("Filter");?>" title="<?=gettext("Apply filter"); ?>" />
+								&nbsp;&nbsp;&nbsp;<input id="filterlogentries_clear" name="filterlogentries_clear" type="submit" class="formbtns" value="<?=gettext("Clear");?>" title="<?=gettext("Remove filter");?>" />
+								&nbsp;&nbsp;&nbsp;<input id="filterlogentries_hide" name="filterlogentries_hide" type="button" class="formbtns" value="<?=gettext("Hide");?>" onclick="enable_hideFilter();" title="<?=gettext("Hide filter options");?>" /></div>
+							</td>
+						</tr>
+						<tr>
+							<td colspan="5" style="vertical-align:bottom">
+								&nbsp;<?printf(gettext('Matches %1$s regular expression%2$s.'), '<a target="_blank" href="http://www.php.net/manual/en/book.pcre.php">', '</a>');?>&nbsp;&nbsp;
+								<?=gettext("Precede with exclamation (!) as first character to exclude match.");?>&nbsp;&nbsp;
+							</td>
+						</tr>
+					</table>
+				</td>
+			</tr>
+		<?php if ($filterlogentries) : ?>
+			<tr>
+				<td colspan="2" class="listtopic"><?php printf(gettext("Last %s Alert Entries"), $anentries); ?>&nbsp;&nbsp;
+				<?php echo gettext("(Most recent listed first)  ** FILTERED VIEW **  clear filter to see all entries"); ?></td>
+			</tr>
+		<?php else: ?>
+			<tr>
 				<td colspan="2" class="listtopic"><?php printf(gettext("Last %s Alert Entries"), $anentries); ?>&nbsp;&nbsp;
 				<?php echo gettext("(Most recent entries are listed first)"); ?></td>
 			</tr>
+		<?php endif; ?>
 	<tr>
 	<td width="100%" colspan="2">
 	<table id="myTable" style="table-layout: fixed;" width="100%" class="sortable" border="0" cellpadding="0" cellspacing="0">
@@ -436,7 +599,7 @@ if ($savemsg) {
 			<col axis="string">
 		</colgroup>
 		<thead>
-		   <tr>
+		   <tr class="sortableHeaderRowIdentifier">
 			<th class="listhdrr" axis="date"><?php echo gettext("Date"); ?></th>
 			<th class="listhdrr" axis="number"><?php echo gettext("Pri"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
@@ -445,7 +608,7 @@ if ($savemsg) {
 			<th class="listhdrr" axis="string"><?php echo gettext("SPort"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("Dst"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("DPort"); ?></th>
-			<th class="listhdrr" axis="number"><?php echo gettext("SID"); ?></th>
+			<th class="listhdrr" axis="number"><?php echo gettext("GID:SID"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("Description"); ?></th>
 		   </tr>
 		</thead>
@@ -458,95 +621,175 @@ if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.lo
 	if (file_exists("/tmp/alerts_suricata{$suricata_uuid}")) {
 		$tmpblocked = array_flip(suricata_get_blocked_ips());
 		$counter = 0;
-		/*             0         1      2             3      4       5   6              7        8     9   10      11  12      */
-		/* File format timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */
+
+		/*************** FORMAT without CSV patch -- ALERT -- ***********************************************************************************/
+		/* Line format: timestamp  action[**] [gid:sid:rev] msg [**] [Classification: class] [Priority: pri] {proto} src:srcport -> dst:dstport */
+		/*             0          1           2   3   4    5                         6                 7     8      9   10         11  12       */
+		/****************************************************************************************************************************************/
+
+		/**************** FORMAT without CSV patch -- DECODER EVENT -- **************************************************************************/
+		/* Line format: timestamp  action[**] [gid:sid:rev] msg [**] [Classification: class] [Priority: pri] [**] [Raw pkt: ...]                */
+		/*              0          1           2   3   4    5                         6                 7                                       */
+		/************** *************************************************************************************************************************/
+
 		$fd = fopen("/tmp/alerts_suricata{$suricata_uuid}", "r");
-		while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) {
-			if(count($fields) < 13)
-				continue;
+		$buf = "";
+		while (($buf = fgets($fd)) !== FALSE) {
+			$fields = array();
+			$tmp = array();
+			$decoder_event = FALSE;
+
+			/**************************************************************/
+			/* Parse alert log entry to find the parts we want to display */
+			/**************************************************************/
+
+			// Field 0 is the event timestamp
+			$fields['time'] = substr($buf, 0, strpos($buf, '  '));
+
+			// Field 1 is currently not used, so set to NULL
+			$fields['action'] = null;
+
+			// The regular expression match below returns an array as follows:
+			// [2] => GID, [3] => SID, [4] => REV, [5] => MSG, [6] => CLASSIFICATION, [7] = PRIORITY
+			preg_match('/\[\*{2}\]\s\[((\d+):(\d+):(\d+))\]\s(.*)\[\*{2}\]\s\[Classification:\s(.*)\]\s\[Priority:\s(\d+)\]\s/', $buf, $tmp);
+			$fields['gid'] = trim($tmp[2]);
+			$fields['sid'] = trim($tmp[3]);
+			$fields['rev'] = trim($tmp[4]);
+			$fields['msg'] = trim($tmp[5]);
+			$fields['class'] = trim($tmp[6]);
+			$fields['priority'] = trim($tmp[7]);
+
+			// The regular expression match below looks for the PROTO, SRC and DST fields
+			// and returns an array as follows:
+			// [1] = PROTO, [2] => SRC:SPORT [3] => DST:DPORT
+			if (preg_match('/\{(.*)\}\s(.*)\s->\s(.*)/', $buf, $tmp)) {
+				// Get PROTO
+				$fields['proto'] = trim($tmp[1]);
+
+				// Get SRC
+				$fields['src'] = trim(substr($tmp[2], 0, strrpos($tmp[2], ':')));
+				if (is_ipaddrv6($fields['src']))
+					$fields['src'] = inet_ntop(inet_pton($fields['src']));
+
+				// Get SPORT
+				$fields['sport'] = trim(substr($tmp[2], strrpos($tmp[2], ':') + 1));
+
+				// Get DST
+				$fields['dst'] = trim(substr($tmp[3], 0, strrpos($tmp[3], ':')));
+				if (is_ipaddrv6($fields['dst']))
+					$fields['dst'] = inet_ntop(inet_pton($fields['dst']));
+
+				// Get DPORT
+				$fields['dport'] = trim(substr($tmp[3], strrpos($tmp[3], ':') + 1));
+			}
+			else {
+				// If no PROTO nor IP ADDR, then this is a DECODER EVENT
+				$decoder_event = TRUE;
+				$fields['proto'] = gettext("n/a");
+				$fields['sport'] = gettext("n/a");
+				$fields['dport'] = gettext("n/a");
+			}
 
 			// Create a DateTime object from the event timestamp that
 			// we can use to easily manipulate output formats.
-			$event_tm = date_create_from_format("m/d/Y-H:i:s.u", $fields[0]);
+			$event_tm = date_create_from_format("m/d/Y-H:i:s.u", $fields['time']);
 
 			// Check the 'CATEGORY' field for the text "(null)" and
 			// substitute "Not Assigned".
-			if ($fields[6] == "(null)")
-				$fields[6] = "Not Assigned";
+			if ($fields['class'] == "(null)")
+				$fields['class'] = gettext("Not Assigned");
+
+			$fields['time'] = date_format($event_tm, "m/d/Y") . " " . date_format($event_tm, "H:i:s");
+			if ($filterlogentries && !suricata_match_filter_field($fields, $filterfieldsarray)) {
+				continue;
+			}
 
 			/* Time */
 			$alert_time = date_format($event_tm, "H:i:s");
 			/* Date */
 			$alert_date = date_format($event_tm, "m/d/Y");
 			/* Description */
-			$alert_descr = $fields[5];
-			$alert_descr_url = urlencode($fields[5]);
+			$alert_descr = $fields['msg'];
+			$alert_descr_url = urlencode($fields['msg']);
 			/* Priority */
-			$alert_priority = $fields[7];
+			$alert_priority = $fields['priority'];
 			/* Protocol */
-			$alert_proto = $fields[8];
+			$alert_proto = $fields['proto'];
+
 			/* IP SRC */
-			$alert_ip_src = $fields[9];
-			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
-			$alert_ip_src = str_replace(":", ":&#8203;", $alert_ip_src);
-			/* Add Reverse DNS lookup icons */
-			$alert_ip_src .= "<br/><a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[9]}&dialog_output=true', outputrule);\">";
-			$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-			$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			$alert_ip_src .= "<a href='/diag_dns.php?host={$fields[9]}&instance={$instanceid}'>";
-			$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
-			/* Add icons for auto-adding to Suppress List if appropriate */
-			if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3]) && 
-			    !isset($supplist[$fields[2]][$fields[3]]['by_src'][$fields[9]])) {
-				$alert_ip_src .= "&nbsp;&nbsp;<input type='image' name='addsuppress_srcip[]' onClick=\"encRuleSig('{$fields[2]}','{$fields[3]}','{$fields[9]}','{$alert_descr}');\" ";
-				$alert_ip_src .= "src='../themes/{$g['theme']}/images/icons/icon_plus.gif' width='12' height='12' border='0' ";
-				$alert_ip_src .= "title='" . gettext("Add this alert to the Suppress List and track by_src IP") . "'/>";	
-			}
-			elseif (isset($supplist[$fields[2]][$fields[3]]['by_src'][$fields[9]])) {
-				$alert_ip_src .= "&nbsp;&nbsp;<img src='../themes/{$g['theme']}/images/icons/icon_plus_d.gif' width='12' height='12' border='0' ";
-				$alert_ip_src .= "title='" . gettext("This alert track by_src IP is already in the Suppress List") . "'/>";	
+			if ($decoder_event == FALSE) {
+				$alert_ip_src = $fields['src'];
+				/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
+				$alert_ip_src = str_replace(":", ":&#8203;", $alert_ip_src);
+				/* Add Reverse DNS lookup icon */
+				$alert_ip_src .= "<br/><img onclick=\"javascript:resolve_with_ajax('{$fields['src']}');\" title=\"";
+				$alert_ip_src .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+				$alert_ip_src .= " style=\"cursor: pointer;\"/>";
+				/* Add icons for auto-adding to Suppress List if appropriate */
+				if (!suricata_is_alert_globally_suppressed($supplist, $fields['gid'], $fields['sid']) && 
+				    !isset($supplist[$fields['gid']][$fields['sid']]['by_src'][$fields['src']])) {
+					$alert_ip_src .= "&nbsp;&nbsp;<input type='image' name='addsuppress_srcip[]' onClick=\"encRuleSig('{$fields['gid']}','{$fields['sid']}','{$fields['src']}','{$alert_descr}');\" ";
+					$alert_ip_src .= "src='../themes/{$g['theme']}/images/icons/icon_plus.gif' width='12' height='12' border='0' ";
+					$alert_ip_src .= "title='" . gettext("Add this alert to the Suppress List and track by_src IP") . "'/>";	
+				}
+				elseif (isset($supplist[$fields['gid']][$fields['sid']]['by_src'][$fields['src']])) {
+					$alert_ip_src .= "&nbsp;&nbsp;<img src='../themes/{$g['theme']}/images/icons/icon_plus_d.gif' width='12' height='12' border='0' ";
+					$alert_ip_src .= "title='" . gettext("This alert track by_src IP is already in the Suppress List") . "'/>";	
+				}
+				/* Add icon for auto-removing from Blocked Table if required */
+				if (isset($tmpblocked[$fields['src']])) {
+					$alert_ip_src .= "&nbsp;<input type='image' name='unblock[]' onClick=\"document.getElementById('ip').value='{$fields['src']}';\" ";
+					$alert_ip_src .= "title='" . gettext("Remove host from Blocked Table") . "' border='0' width='12' height='12' src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\"/>"; 
+				}
 			}
-			/* Add icon for auto-removing from Blocked Table if required */
-			if (isset($tmpblocked[$fields[9]])) {
-				$alert_ip_src .= "&nbsp;<input type='image' name='unblock[]' onClick=\"document.getElementById('ip').value='{$fields[9]}';\" ";
-				$alert_ip_src .= "title='" . gettext("Remove host from Blocked Table") . "' border='0' width='12' height='12' src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\"/>"; 
+			else {
+				if (preg_match('/\s\[Raw pkt:(.*)\]/', $buf, $tmp))
+					$alert_ip_src = "<div title='[Raw pkt: {$tmp[1]}]'>" . gettext("Decoder Event") . "</div>";
+				else
+					$alert_ip_src = gettext("Decoder Event");
 			}
+
 			/* IP SRC Port */
-			$alert_src_p = $fields[10];
-			/* IP Destination */
-			$alert_ip_dst = $fields[11];
-			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
-			$alert_ip_dst = str_replace(":", ":&#8203;", $alert_ip_dst);
-			/* Add Reverse DNS lookup icons */
-			$alert_ip_dst .= "<br/><a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[11]}&dialog_output=true', outputrule);\">";
-			$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-			$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			$alert_ip_dst .= "<a href='/diag_dns.php?host={$fields[11]}&instance={$instanceid}'>";
-			$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";	
-			/* Add icons for auto-adding to Suppress List if appropriate */
-			if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3]) && 
-			    !isset($supplist[$fields[2]][$fields[3]]['by_dst'][$fields[11]])) {
-				$alert_ip_dst .= "&nbsp;&nbsp;<input type='image' name='addsuppress_dstip[]' onClick=\"encRuleSig('{$fields[2]}','{$fields[3]}','{$fields[11]}','{$alert_descr}');\" ";
-				$alert_ip_dst .= "src='../themes/{$g['theme']}/images/icons/icon_plus.gif' width='12' height='12' border='0' ";
-				$alert_ip_dst .= "title='" . gettext("Add this alert to the Suppress List and track by_dst IP") . "'/>";	
-			}
-			elseif (isset($supplist[$fields[2]][$fields[3]]['by_dst'][$fields[11]])) {
-				$alert_ip_dst .= "&nbsp;&nbsp;<img src='../themes/{$g['theme']}/images/icons/icon_plus_d.gif' width='12' height='12' border='0' ";
-				$alert_ip_dst .= "title='" . gettext("This alert track by_dst IP is already in the Suppress List") . "'/>";	
+			$alert_src_p = $fields['sport'];
+
+			/* IP DST */
+			if ($decoder_event == FALSE) {
+				$alert_ip_dst = $fields['dst'];
+				/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
+				$alert_ip_dst = str_replace(":", ":&#8203;", $alert_ip_dst);
+				/* Add Reverse DNS lookup icons */
+				$alert_ip_dst .= "<br/><img onclick=\"javascript:resolve_with_ajax('{$fields['dst']}');\" title=\"";
+				$alert_ip_dst .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+				$alert_ip_dst .= " style=\"cursor: pointer;\"/>";
+				/* Add icons for auto-adding to Suppress List if appropriate */
+				if (!suricata_is_alert_globally_suppressed($supplist, $fields['gid'], $fields['sid']) && 
+				    !isset($supplist[$fields['gid']][$fields['sid']]['by_dst'][$fields['dst']])) {
+					$alert_ip_dst .= "&nbsp;&nbsp;<input type='image' name='addsuppress_dstip[]' onClick=\"encRuleSig('{$fields['gid']}','{$fields['sid']}','{$fields['dst']}','{$alert_descr}');\" ";
+					$alert_ip_dst .= "src='../themes/{$g['theme']}/images/icons/icon_plus.gif' width='12' height='12' border='0' ";
+					$alert_ip_dst .= "title='" . gettext("Add this alert to the Suppress List and track by_dst IP") . "'/>";	
+				}
+				elseif (isset($supplist[$fields['gid']][$fields['sid']]['by_dst'][$fields['dst']])) {
+					$alert_ip_dst .= "&nbsp;&nbsp;<img src='../themes/{$g['theme']}/images/icons/icon_plus_d.gif' width='12' height='12' border='0' ";
+					$alert_ip_dst .= "title='" . gettext("This alert track by_dst IP is already in the Suppress List") . "'/>";	
+				}
+
+				/* Add icon for auto-removing from Blocked Table if required */
+				if (isset($tmpblocked[$fields['dst']])) {
+					$alert_ip_dst .= "&nbsp;<input type='image' name='unblock[]' onClick=\"document.getElementById('ip').value='{$fields['dst']}';\" ";
+					$alert_ip_dst .= "title='" . gettext("Remove host from Blocked Table") . "' border='0' width='12' height='12' src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\"/>"; 
+				}
 			}
-			/* Add icon for auto-removing from Blocked Table if required */
-			if (isset($tmpblocked[$fields[11]])) {
-				$alert_ip_dst .= "&nbsp;<input type='image' name='unblock[]' onClick=\"document.getElementById('ip').value='{$fields[11]}';\" ";
-				$alert_ip_dst .= "title='" . gettext("Remove host from Blocked Table") . "' border='0' width='12' height='12' src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\"/>"; 
+			else {
+				$alert_ip_dst = gettext("n/a");
 			}
+
 			/* IP DST Port */
-			$alert_dst_p = $fields[12];
+			$alert_dst_p = $fields['dport'];
+
 			/* SID */
-			$alert_sid_str = "{$fields[2]}:{$fields[3]}";
-			if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3])) {
-				$sidsupplink = "<input type='image' name='addsuppress[]' onClick=\"encRuleSig('{$fields[2]}','{$fields[3]}','','{$alert_descr}');\" ";
+			$alert_sid_str = "{$fields['gid']}:{$fields['sid']}";
+			if (!suricata_is_alert_globally_suppressed($supplist, $fields['gid'], $fields['sid'])) {
+				$sidsupplink = "<input type='image' name='addsuppress[]' onClick=\"encRuleSig('{$fields['gid']}','{$fields['sid']}','','{$alert_descr}');\" ";
 				$sidsupplink .= "src='../themes/{$g['theme']}/images/icons/icon_plus.gif' width='12' height='12' border='0' ";
 				$sidsupplink .= "title='" . gettext("Add this alert to the Suppress List") . "'/>";	
 			}
@@ -555,34 +798,35 @@ if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.lo
 				$sidsupplink .= "title='" . gettext("This alert is already in the Suppress List") . "'/>";	
 			}
 			/* Add icon for toggling rule state */
-			if (isset($disablesid[$fields[2]][$fields[3]])) {
-				$sid_dsbl_link = "<input type='image' name='togglesid[]' onClick=\"encRuleSig('{$fields[2]}','{$fields[3]}','','');\" ";
+			if (isset($disablesid[$fields['gid']][$fields['sid']])) {
+				$sid_dsbl_link = "<input type='image' name='togglesid[]' onClick=\"encRuleSig('{$fields['gid']}','{$fields['sid']}','','');\" ";
 				$sid_dsbl_link .= "src='../themes/{$g['theme']}/images/icons/icon_reject.gif' width='11' height='11' border='0' ";
 				$sid_dsbl_link .= "title='" . gettext("Rule is forced to a disabled state. Click to remove the force-disable action from this rule.") . "'/>";
 			}
 			else {
-				$sid_dsbl_link = "<input type='image' name='togglesid[]' onClick=\"encRuleSig('{$fields[2]}','{$fields[3]}','','');\" ";
+				$sid_dsbl_link = "<input type='image' name='togglesid[]' onClick=\"encRuleSig('{$fields['gid']}','{$fields['sid']}','','');\" ";
 				$sid_dsbl_link .= "src='../themes/{$g['theme']}/images/icons/icon_block.gif' width='11' height='11' border='0' ";
 				$sid_dsbl_link .= "title='" . gettext("Force-disable this rule and remove it from current rules set.") . "'/>";
 			}
 			/* DESCRIPTION */
-			$alert_class = $fields[6];
+			$alert_class = $fields['class'];
 
 			echo "<tr>
 				<td class='listr' align='center'>{$alert_date}<br/>{$alert_time}</td>
 				<td class='listr' align='center'>{$alert_priority}</td>
 				<td class='listr' align='center'>{$alert_proto}</td>
 				<td class='listr' style=\"word-wrap:break-word;\">{$alert_class}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[9]}'>{$alert_ip_src}</td>
+				<td class='listr' style=\"sorttable_customkey:{$fields['src']};\" sorttable_customkey=\"{$fields['src']}\" align='center'>{$alert_ip_src}</td>
 				<td class='listr' align='center'>{$alert_src_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[11]}'>{$alert_ip_dst}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields['dst']};\" sorttable_customkey=\"{$fields['dst']}\">{$alert_ip_dst}</td>
 				<td class='listr' align='center'>{$alert_dst_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[3]}'>{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields['sid']};\" sorttable_customkey=\"{$fields['sid']}\">{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
 				<td class='listbg' style=\"word-wrap:break-word;\">{$alert_descr}</td>
 				</tr>\n";
 
 			$counter++;
 		}
+		unset($fields, $buf, $tmp);
 		fclose($fd);
 		@unlink("/tmp/alerts_suricata{$suricata_uuid}");
 	}
@@ -591,10 +835,10 @@ if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.lo
 		</tbody>
 	</table>
 	</td>
-</tr>
+</tr></tbody>
 </table>
 </div>
-</td></tr>
+</td></tr></tbody>
 </table>
 </form>
 <?php
@@ -615,6 +859,50 @@ function encRuleSig(rulegid,rulesid,srcip,ruledescr) {
 	document.getElementById("ip").value = srcip;
 	document.getElementById("descr").value = ruledescr;
 }
+
+function enable_showFilter() {
+	document.getElementById("filter_enable_row").style.display="none";
+	document.getElementById("filter_options_row").style.display="table-row";
+}
+
+function enable_hideFilter() {
+	document.getElementById("filter_enable_row").style.display="table-row";
+	document.getElementById("filter_options_row").style.display="none";
+}
+
+</script>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/suricata/suricata_alerts.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
 </script>
+
 </body>
 </html>
diff --git a/config/suricata/suricata_alerts.widget.php b/config/suricata/suricata_alerts.widget.php
index 21fad03d..bc7a0e2a 100644
--- a/config/suricata/suricata_alerts.widget.php
+++ b/config/suricata/suricata_alerts.widget.php
@@ -42,8 +42,8 @@ if (!is_array($config['installedpackages']['suricata']['rule']))
 $a_instance = &$config['installedpackages']['suricata']['rule'];
 
 /* array sorting */
-function sksort(&$array, $subkey="id", $sort_ascending=false) {
-        /* an empty array causes sksort to fail - this test alleviates the error */
+function suricata_sksort(&$array, $subkey="id", $sort_ascending=false) {
+        /* an empty array causes suricata_sksort to fail - this test alleviates the error */
 	if(empty($array))
 	        return false;
 	if (count($array)){
@@ -114,12 +114,58 @@ function suricata_widget_get_alerts() {
 			exec("tail -{$suri_nentries} -r /var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log > /tmp/surialerts_{$suricata_uuid}");
 			if (file_exists("/tmp/surialerts_{$suricata_uuid}")) {
 
-				/*              0         1      2             3      4       5   6              7        8     9   10      11  12      */
-				/* File format: timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */
+				/*************** FORMAT without CSV patch -- ALERT -- ***********************************************************************************/
+				/* Line format: timestamp  action[**] [gid:sid:rev] msg [**] [Classification: class] [Priority: pri] {proto} src:srcport -> dst:dstport */
+				/*             0          1           2   3   4    5                         6                 7     8      9   10         11  12       */
+				/****************************************************************************************************************************************/
+
+				/**************** FORMAT without CSV patch -- DECODER EVENT -- **************************************************************************/
+				/* Line format: timestamp  action[**] [gid:sid:rev] msg [**] [Classification: class] [Priority: pri] [**] [Raw pkt: ...]                */
+				/*              0          1           2   3   4    5                         6                 7                                       */
+				/************** *************************************************************************************************************************/
+
 				$fd = fopen("/tmp/surialerts_{$suricata_uuid}", "r");
-				while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) {
-					if(count($fields) < 13)
-						continue;
+				$buf = "";
+				while (($buf = fgets($fd)) !== FALSE) {
+					$fields = array();
+					$tmp = array();
+
+					// Parse alert log entry to find the parts we want to display
+					$fields[0] = substr($buf, 0, strpos($buf, '  '));
+
+					// The regular expression match below returns an array as follows:
+					// [1] => CLASSIFICATION, [2] = PRIORITY
+					preg_match('/\s\[Classification:\s(.*)\]\s\[Priority:\s(\d+)\]\s/', $buf, $tmp);
+					$fields[6] = trim($tmp[1]);
+					$fields[7] = trim($tmp[2]);
+
+					// The regular expression match below looks for the PROTO, SRC and DST fields
+					// and returns an array as follows:
+					// [1] = PROTO, [2] => SRC:SPORT [3] => DST:DPORT
+					if (preg_match('/\{(.*)\}\s(.*)\s->\s(.*)/', $buf, $tmp)) {
+						// Get SRC
+						$fields[9] = trim(substr($tmp[2], 0, strrpos($tmp[2], ':')));
+						if (is_ipaddrv6($fields[9]))
+							$fields[9] = inet_ntop(inet_pton($fields[9]));
+
+						// Get SPORT
+						$fields[10] = trim(substr($tmp[2], strrpos($tmp[2], ':') + 1));
+
+						// Get DST
+						$fields[11] = trim(substr($tmp[3], 0, strrpos($tmp[3], ':')));
+						if (is_ipaddrv6($fields[11]))
+							$fields[11] = inet_ntop(inet_pton($fields[11]));
+
+						// Get DPORT
+						$fields[12] = trim(substr($tmp[3], strrpos($tmp[3], ':') + 1));
+					}
+					else {
+						// If no PROTO and IP ADDR, then this is a DECODER EVENT
+						$fields[9] = gettext("Decoder Event");
+						$fields[10] = "";
+						$fields[11] = "";
+						$fields[12] = "";
+					}
 
 					// Create a DateTime object from the event timestamp that
 					// we can use to easily manipulate output formats.
@@ -130,7 +176,7 @@ function suricata_widget_get_alerts() {
 					if ($fields[6] == "(null)")
 						$fields[6] = "No classtype assigned";
 
-					$suricata_alerts[$counter]['instanceid'] = strtoupper($a_instance[$instanceid]['interface']);
+					$suricata_alerts[$counter]['instanceid'] = strtoupper(convert_friendly_interface_to_friendly_descr($a_instance[$instanceid]['interface']));
 					$suricata_alerts[$counter]['timestamp'] = strval(date_timestamp_get($event_tm));
 					$suricata_alerts[$counter]['timeonly'] = date_format($event_tm, "H:i:s");
 					$suricata_alerts[$counter]['dateonly'] = date_format($event_tm, "M d");
@@ -140,15 +186,15 @@ function suricata_widget_get_alerts() {
 					else
 						$suricata_alerts[$counter]['src'] = $fields[9];
 					// Add the SRC PORT if not null
-					if (!empty($fields[10]))					
+					if (!empty($fields[10]) || $fields[10] == '0')					
 						$suricata_alerts[$counter]['src'] .= ":" . $fields[10];
 					// Add square brackets around any IPv6 address
 					if (is_ipaddrv6($fields[11]))
 						$suricata_alerts[$counter]['dst'] = "[" . $fields[11] . "]";
 					else
 						$suricata_alerts[$counter]['dst'] = $fields[11];
-					// Add the SRC PORT if not null
-					if (!empty($fields[12]))
+					// Add the DST PORT if not null
+					if (!empty($fields[12]) || $fields[12] == '0')
 						$suricata_alerts[$counter]['dst'] .= ":" . $fields[12];
 					$suricata_alerts[$counter]['priority'] = $fields[7];
 					$suricata_alerts[$counter]['category'] = $fields[6];
@@ -162,9 +208,9 @@ function suricata_widget_get_alerts() {
 
 	// Sort the alerts array
 	if (isset($config['syslog']['reverse'])) {
-		sksort($suricata_alerts, 'timestamp', false);
+		suricata_sksort($suricata_alerts, 'timestamp', false);
 	} else {
-		sksort($suricata_alerts, 'timestamp', true);
+		suricata_sksort($suricata_alerts, 'timestamp', true);
 	}
 
 	return $suricata_alerts;
@@ -192,7 +238,7 @@ function suricata_widget_get_alerts() {
 		<tr>
 			<th class="listhdrr"><?=gettext("IF/Date");?></th>
 			<th class="listhdrr"><?=gettext("Src/Dst Address");?></th>
-			<th class="listhdrr"><?=gettext("Classification");?></th>
+			<th class="listhdrr"><?=gettext("Priority/Class");?></th>
 		</tr>
 	</thead>
 	<tbody id="suricata-alert-entries">
diff --git a/config/suricata/suricata_app_parsers.php b/config/suricata/suricata_app_parsers.php
index c28b99d1..16927092 100644
--- a/config/suricata/suricata_app_parsers.php
+++ b/config/suricata/suricata_app_parsers.php
@@ -86,13 +86,14 @@ if (isset($id) && $a_nat[$id]) {
 	if (empty($pconfig['libhtp_policy']['item'])) {
 		$default = array( "name" => "default", "bind_to" => "all", "personality" => "IDS", 
 				  "request-body-limit" => 4096, "response-body-limit" => 4096, 
-				  "double-decode-path" => "no", "double-decode-query" => "no" );
+				  "double-decode-path" => "no", "double-decode-query" => "no", 
+				  "uri-include-all" => "no" );
 		$pconfig['libhtp_policy']['item'] = array();
 		$pconfig['libhtp_policy']['item'][] = $default;
 		if (!is_array($a_nat[$id]['libhtp_policy']['item']))
 			$a_nat[$id]['libhtp_policy']['item'] = array();
 		$a_nat[$id]['libhtp_policy']['item'][] = $default;
-		write_config();
+		write_config("Suricata pkg: created a new default HTTP server configuration for " . convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']));
 		$libhtp_engine_next_id++;
 	}
 	else
@@ -121,6 +122,7 @@ elseif ($_POST['select_alias']) {
 	$eng_resp_body_limit = $_POST['resp_body_limit'];
 	$eng_enable_double_decode_path = $_POST['enable_double_decode_path'];
 	$eng_enable_double_decode_query = $_POST['enable_double_decode_query'];
+	$eng_enable_uri_include_all = $_POST['enable_uri_include_all'];
 	$mode = "add_edit_libhtp_policy";
 }
 if ($_POST['save_libhtp_policy']) {
@@ -161,6 +163,7 @@ if ($_POST['save_libhtp_policy']) {
 
 		if ($_POST['enable_double_decode_path']) { $engine['double-decode-path'] = 'yes'; }else{ $engine['double-decode-path'] = 'no'; }
 		if ($_POST['enable_double_decode_query']) { $engine['double-decode-query'] = 'yes'; }else{ $engine['double-decode-query'] = 'no'; }
+		if ($_POST['enable_uri_include_all']) { $engine['uri-include-all'] = 'yes'; }else{ $engine['uri-include-all'] = 'no'; }
 
 		// Can only have one "all" Bind_To address
 		if ($engine['bind_to'] == "all" && $engine['name'] <> "default")
@@ -196,7 +199,7 @@ if ($_POST['save_libhtp_policy']) {
 			}
 
 			// Now write the new engine array to conf
-			write_config();
+			write_config("Suricata pkg: saved updated HTTP server configuration for " . convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']));
 			$pconfig['libhtp_policy']['item'] = $a_nat[$id]['libhtp_policy']['item'];
 		}
 		else {
@@ -209,7 +212,7 @@ elseif ($_POST['add_libhtp_policy']) {
 	$add_edit_libhtp_policy = true;
 	$pengcfg = array( "name" => "engine_{$libhtp_engine_next_id}", "bind_to" => "", "personality" => "IDS", 
 			  "request-body-limit" => "4096", "response-body-limit" => "4096", 
-			  "double-decode-path" => "no", "double-decode-query" => "no" );
+			  "double-decode-path" => "no", "double-decode-query" => "no", "uri-include-all" => "no" );
 	$eng_id = $libhtp_engine_next_id;
 }
 elseif ($_POST['edit_libhtp_policy']) {
@@ -229,7 +232,7 @@ elseif ($_POST['del_libhtp_policy']) {
 	}
 	if (isset($id) && $a_nat[$id]) {
 		$a_nat[$id] = $natent;
-		write_config();
+		write_config("Suricata pkg: deleted a HTTP server configuration for " . convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']));
 	}
 }
 elseif ($_POST['cancel_libhtp_policy']) {
@@ -239,9 +242,24 @@ elseif ($_POST['ResetAll']) {
 
 	/* Reset all the settings to defaults */
 	$pconfig['asn1_max_frames'] = "256";
+	$pconfig['dns_global_memcap'] = "16777216";
+	$pconfig['dns_state_memcap'] = "524288";
+	$pconfig['dns_request_flood_limit'] = "500";
+	$pconfig['http_parser_memcap'] = "67108864";
+	$pconfig['dns_parser_udp'] = "yes";
+	$pconfig['dns_parser_tcp'] = "yes";
+	$pconfig['http_parser'] = "yes";
+	$pconfig['tls_parser'] = "yes";
+	$pconfig['smtp_parser'] = "yes";
+	$pconfig['imap_parser'] = "detection-only";
+	$pconfig['ssh_parser'] = "yes";
+	$pconfig['ftp_parser'] = "yes";
+	$pconfig['dcerpc_parser'] = "yes";
+	$pconfig['smb_parser'] = "yes";
+	$pconfig['msn_parser'] = "detection-only";
 
 	/* Log a message at the top of the page to inform the user */
-	$savemsg = gettext("All flow and stream settings have been reset to their defaults.");
+	$savemsg = gettext("All flow and stream settings on this page have been reset to their defaults.  Click APPLY if you wish to keep these new settings.");
 }
 elseif ($_POST['save_import_alias']) {
 	// If saving out of "select alias" mode,
@@ -257,6 +275,7 @@ elseif ($_POST['save_import_alias']) {
 		$pengcfg['response-body-limit'] = $_POST['eng_resp_body_limit'];
 		$pengcfg['double-decode-path'] = $_POST['eng_enable_double_decode_path'];
 		$pengcfg['double-decode-query'] = $_POST['eng_enable_double_decode_query'];
+		$pengcfg['uri-include-all'] = $_POST['eng_enable_uri_include_all'];
 		$add_edit_libhtp_policy = true;
 		$mode = "add_edit_libhtp_policy";
 
@@ -277,12 +296,13 @@ elseif ($_POST['save_import_alias']) {
 			$eng_resp_body_limit = $_POST['eng_resp_body_limit'];
 			$eng_enable_double_decode_path = $_POST['eng_enable_double_decode_path'];
 			$eng_enable_double_decode_query = $_POST['eng_enable_double_decode_query'];
+			$eng_enable_uri_include_all = $_POST['eng_enable_uri_include_all'];
 		}
 	}
 	else {
 		$engine = array( "name" => "", "bind_to" => "", "personality" => "IDS", 
 				 "request-body-limit" => "4096", "response-body-limit" => "4096", 
-				 "double-decode-path" => "no", "double-decode-query" => "no" );
+				 "double-decode-path" => "no", "double-decode-query" => "no", "uri-include-all" => "no" );
 
 		// See if anything was checked to import
 		if (is_array($_POST['aliastoimport']) && count($_POST['aliastoimport']) > 0) {
@@ -322,7 +342,7 @@ elseif ($_POST['save_import_alias']) {
 			}
 
 			// Write the new engine array to config file
-			write_config();
+			write_config("Suricata pkg: saved an updated HTTP server configuration for " . convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']));
 			$importalias = false;
 		}
 	}
@@ -344,10 +364,11 @@ elseif ($_POST['cancel_import_alias']) {
 		$pengcfg['response-body-limit'] = $_POST['eng_resp_body_limit'];
 		$pengcfg['double-decode-path'] = $_POST['eng_enable_double_decode_path'];
 		$pengcfg['double-decode-query'] = $_POST['eng_enable_double_decode_query'];
+		$pengcfg['uri-include-all'] = $_POST['eng_enable_uri_include_all'];
 		$add_edit_libhtp_policy = true;
 	}
 }
-elseif ($_POST['save']) {
+elseif ($_POST['save'] || $_POST['apply']) {
 	$natent = array();
 	$natent = $pconfig;
 
@@ -355,9 +376,37 @@ elseif ($_POST['save']) {
 	if (!is_numeric($_POST['asn1_max_frames'] ) || $_POST['asn1_max_frames'] < 1)
 		$input_errors[] = gettext("The value for 'ASN1 Max Frames' must be all numbers and greater than 0.");
 
+	if (!is_numeric($_POST['dns_global_memcap'] ) || $_POST['dns_global_memcap'] < 1)
+		$input_errors[] = gettext("The value for 'DNS Global Memcap' must be all numbers and greater than 0.");
+
+	if (!is_numeric($_POST['dns_state_memcap'] ) || $_POST['dns_state_memcap'] < 1)
+		$input_errors[] = gettext("The value for 'DNS Flow/State Memcap' must be all numbers and greater than 0.");
+
+	if (!is_numeric($_POST['dns_request_flood_limit'] ) || $_POST['dns_request_flood_limit'] < 1)
+		$input_errors[] = gettext("The value for 'DNS Request Flood Limit' must be all numbers and greater than 0.");
+
+	if (!is_numeric($_POST['http_parser_memcap'] ) || $_POST['http_parser_memcap'] < 1)
+		$input_errors[] = gettext("The value for 'HTTP Memcap' must be all numbers and greater than 0.");
+
 	/* if no errors write to conf */
 	if (!$input_errors) {
 		if ($_POST['asn1_max_frames'] != "") { $natent['asn1_max_frames'] = $_POST['asn1_max_frames']; }else{ $natent['asn1_max_frames'] = "256"; }
+		if ($_POST['dns_global_memcap'] != ""){ $natent['dns_global_memcap'] = $_POST['dns_global_memcap']; }else{ $natent['dns_global_memcap'] = "16777216"; }
+		if ($_POST['dns_state_memcap'] != ""){ $natent['dns_state_memcap'] = $_POST['dns_state_memcap']; }else{ $natent['dns_state_memcap'] = "524288"; }
+		if ($_POST['dns_request_flood_limit'] != ""){ $natent['dns_request_flood_limit'] = $_POST['dns_request_flood_limit']; }else{ $natent['dns_request_flood_limit'] = "500"; }
+		if ($_POST['http_parser_memcap'] != ""){ $natent['http_parser_memcap'] = $_POST['http_parser_memcap']; }else{ $natent['http_parser_memcap'] = "67108864"; }
+
+		$natent['dns_parser_udp'] = $_POST['dns_parser_udp'];
+		$natent['dns_parser_tcp'] = $_POST['dns_parser_tcp'];
+		$natent['http_parser'] = $_POST['http_parser'];
+		$natent['tls_parser'] = $_POST['tls_parser'];
+		$natent['smtp_parser'] = $_POST['smtp_parser'];
+		$natent['imap_parser'] = $_POST['imap_parser'];
+		$natent['ssh_parser'] = $_POST['ssh_parser'];
+		$natent['ftp_parser'] = $_POST['ftp_parser'];
+		$natent['dcerpc_parser'] = $_POST['dcerpc_parser'];
+		$natent['smb_parser'] = $_POST['smb_parser'];
+		$natent['msn_parser'] = $_POST['msn_parser'];
 
 		/**************************************************/
 		/* If we have a valid rule ID, save configuration */
@@ -366,9 +415,11 @@ elseif ($_POST['save']) {
 		/**************************************************/
 		if (isset($id) && $a_nat[$id]) {
 			$a_nat[$id] = $natent;
-			write_config();
+			write_config("Suricata pkg: saved updated app-layer parser configuration for " . convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']));
 			$rebuild_rules = false;
+			conf_mount_rw();
 			suricata_generate_yaml($natent);
+			conf_mount_ro();
 		}
 
 		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
@@ -382,37 +433,45 @@ elseif ($_POST['save']) {
 }
 
 $if_friendly = convert_friendly_interface_to_friendly_descr($pconfig['interface']);
-$pgtitle = gettext("Suricata: Interface {$if_friendly} - Layer 7 Application Parsers");
+$pgtitle = gettext("Suricata: Interface {$if_friendly} - Application Layer Parsers");
 include_once("head.inc");
 ?>
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
 
 <?php include("fbegin.inc");
-	/* Display error or save message */
+	/* Display error message */
 	if ($input_errors) {
 		print_input_errors($input_errors);
 	}
-	if ($savemsg) {
-		print_info_box($savemsg);
-	}
 ?>
 
 <form action="suricata_app_parsers.php" method="post" name="iform" id="iform">
 <input name="id" type="hidden" value="<?=$id;?>"/>
 <input type="hidden" name="eng_id" id="eng_id" value="<?=$eng_id;?>"/>
+
+<?php
+if ($savemsg) {
+	/* Display save message */
+	print_info_box($savemsg);
+}
+?>
+
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td>';
@@ -440,6 +499,7 @@ include_once("head.inc");
 			echo '<input type="hidden" name="eng_resp_body_limit" value="' . $eng_resp_body_limit . '"/>';
 			echo '<input type="hidden" name="eng_enable_double_decode_path" value="' . $eng_enable_double_decode_path . '"/>';
 			echo '<input type="hidden" name="eng_enable_double_decode_query" value="' . $eng_enable_double_decode_query . '"/>';
+			echo '<input type="hidden" name="eng_enable_uri_include_all" value="' . $eng_enable_uri_include_all . '"/>';
 		}
 	?>
 
@@ -449,6 +509,7 @@ include_once("head.inc");
 <?php else: ?>
 
 <table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 
 		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Abstract Syntax One Settings"); ?></td>
@@ -465,11 +526,103 @@ include_once("head.inc");
 			gettext("H.323 (VoIP), and SNMP, use ASN.1 to describe the protocol data units (PDUs) they exchange."); ?>
 		</td>
 	</tr>
+
+	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("DNS App-Layer Parser Settings"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Global Memcap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="dns_global_memcap" type="text" class="formfld unknown" id="dns_global_memcap" size="9"
+			value="<?=htmlspecialchars($pconfig['dns_global_memcap']);?>">&nbsp;
+			<?php echo gettext("Sets the global memcap limit for the DNS parser.  Default is ") . 
+			"<strong>" . gettext("16777216") . "</strong>" . gettext(" bytes (16MB)."); ?>
+		</td>
+	</tr>
 	<tr>
-		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Host-Specific HTTP Server Settings"); ?></td>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Flow/State Memcap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="dns_state_memcap" type="text" class="formfld unknown" id="dns_state_memcap" size="9"
+			value="<?=htmlspecialchars($pconfig['dns_state_memcap']);?>">&nbsp;
+			<?php echo gettext("Sets per flow/state memcap limit for the DNS parser.  Default is ") . 
+			"<strong>" . gettext("524288") . "</strong>" . gettext(" bytes (512KB)."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Request Flood Limit"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="dns_request_flood_limit" type="text" class="formfld unknown" id="dns_request_flood_limit" size="9"
+			value="<?=htmlspecialchars($pconfig['dns_request_flood_limit']);?>">&nbsp;
+			<?php echo gettext("How many unreplied DNS requests are considered a flood.  Default is ") . 
+			"<strong>" . gettext("500") . "</strong>" . gettext(" requests."); ?><br/>
+			<?php echo gettext("If this limit is reached, 'app-layer-event:dns.flooded' will match and alert.  "); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("UDP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="dns_parser_udp" id="dns_parser_udp" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['dns_parser_udp'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for UDP.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("TCP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="dns_parser_tcp" id="dns_parser_tcp" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['dns_parser_tcp'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for TCP.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("HTTP App-Layer Parser Settings"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Memcap"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="http_parser_memcap" type="text" class="formfld unknown" id="http_parser_memcap" size="9"
+			value="<?=htmlspecialchars($pconfig['http_parser_memcap']);?>">&nbsp;
+			<?php echo gettext("Sets the memcap limit for the HTTP parser.  Default is ") . 
+			"<strong>" . gettext("67108864") . "</strong>" . gettext(" bytes (64MB)."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("HTTP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="http_parser" id="http_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['http_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for HTTP.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
 	</tr>
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Server Configuration"); ?></td>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Server Configurations"); ?></td>
 		<td width="78%" class="vtable">
 			<table width="95%" align="left" id="libhtpEnginesTable" style="table-layout: fixed;" border="0" cellspacing="0" cellpadding="0">
 				<colgroup>
@@ -487,6 +640,7 @@ include_once("head.inc");
 					height="17" border="0" title="<?php echo gettext("Add a new server configuration");?>"></th>
 				</tr>
 			   </thead>
+				<tbody>
 			<?php foreach ($pconfig['libhtp_policy']['item'] as $f => $v): ?>
 				<tr>
 					<td class="listlr" align="left"><?=gettext($v['name']);?></td>
@@ -505,19 +659,159 @@ include_once("head.inc");
 					</td>
 				</tr>
 			<?php endforeach; ?>
+				</tbody>
 			</table>
 		</td>
 	</tr>
 	<tr>
+		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Other App-Layer Parser Settings"); ?></td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("TLS Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="tls_parser" id="tls_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['tls_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for TLS.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("SMTP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="smtp_parser" id="smtp_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['smtp_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for SMTP.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("IMAP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="imap_parser" id="imap_parser" class="formselect">
+			<?php
+				$opt = array( "detection-only", "yes", "no" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['imap_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for IMAP.  Default is ") . "<strong>" . gettext("detection-only") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("SSH Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="ssh_parser" id="ssh_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['ssh_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for SSH.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("FTP Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="ftp_parser" id="ftp_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['ftp_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for FTP.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("DCERPC Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="dcerpc_parser" id="dcerpc_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['dcerpc_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for DCERPC.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("SMB Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="smb_parser" id="smb_parser" class="formselect">
+			<?php
+				$opt = array(  "yes", "no", "detection-only" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['smb_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for SMB.  Default is ") . "<strong>" . gettext("yes") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("MSN Parser"); ?></td>
+		<td width="78%" class="vtable">
+			<select name="msn_parser" id="msn_parser" class="formselect">
+			<?php
+				$opt = array( "detection-only", "yes", "no" );
+				foreach ($opt as $val) {
+					$selected = "";
+					if ($val == $pconfig['msn_parser'])
+						$selected = " selected";
+					echo "<option value='{$val}'{$selected}>" . $val . "</option>\n";
+				}
+			?></select>&nbsp;&nbsp;
+			<?php echo gettext("Choose the parser/detection setting for MSN.  Default is ") . "<strong>" . gettext("detection-only") . "</strong>" . gettext("."); ?><br/>
+			<?php echo gettext("Selecting \"yes\" enables detection and parser, \"no\" disables both and \"detection-only\" disables parser."); ?>
+		</td>
+	</tr>
+	<tr>
 		<td width="22%" valign="top">&nbsp;</td>
 		<td width="78%">
 			<input name="save" type="submit" class="formbtn" value="Save" title="<?php echo 
-			gettext("Save flow and stream settings"); ?>">
+			gettext("Save flow and stream settings"); ?>"/>
 			&nbsp;&nbsp;&nbsp;&nbsp;
 			<input name="ResetAll" type="submit" class="formbtn" value="Reset" title="<?php echo 
 			gettext("Reset all settings to defaults") . "\" onclick=\"return confirm('" . 
 			gettext("WARNING:  This will reset ALL App Parsers settings to their defaults.  Click OK to continue or CANCEL to quit.") . 
-			"');\""; ?>></td>
+			"');\""; ?>/></td>
 	</tr>
 	<tr>
 		<td width="22%" valign="top">&nbsp;</td>
@@ -525,12 +819,13 @@ include_once("head.inc");
 			<?php echo gettext("Please save your settings before you exit.  Changes will rebuild the rules file.  This "); ?>
 			<?php echo gettext("may take several seconds.  Suricata must also be restarted to activate any changes made on this screen."); ?></td>
 	</tr>
+	</tbody>
 </table>
 
 <?php endif; ?>
 
 </div>
-</td></tr></table>
+</td></tr></tbody></table>
 </form>
 <?php include("fend.inc"); ?>
 </body>
diff --git a/config/suricata/suricata_barnyard.php b/config/suricata/suricata_barnyard.php
index c7488fe4..cd233b5e 100644
--- a/config/suricata/suricata_barnyard.php
+++ b/config/suricata/suricata_barnyard.php
@@ -79,7 +79,7 @@ if (isset($id) && $a_nat[$id]) {
 	if (empty($a_nat[$id]['barnyard_syslog_opmode']))
 		$pconfig['barnyard_syslog_opmode'] = "default";
 	if (empty($a_nat[$id]['barnyard_syslog_facility']))
-		$pconfig['barnyard_syslog_facility'] = "LOG_USER";
+		$pconfig['barnyard_syslog_facility'] = "LOG_LOCAL1";
 	if (empty($a_nat[$id]['barnyard_syslog_priority']))
 		$pconfig['barnyard_syslog_priority'] = "LOG_INFO";
 	if (empty($a_nat[$id]['barnyard_bro_ids_dport']))
@@ -94,6 +94,12 @@ if ($_POST['save']) {
 	    $_POST['barnyard_bro_ids_enable'] != 'on' && $_POST['barnyard_enable'] == "on")
 		$input_errors[] = gettext("You must enable at least one output option when using Barnyard2.");
 
+	// Validate Sensor Name contains no spaces
+	if ($_POST['barnyard_enable'] == 'on') {
+		if (!empty(trim($_POST['barnyard_sensor_name'])) && strpos(trim($_POST['barnyard_sensor_name']), " ") !== FALSE)
+			$input_errors[] = gettext("The value for 'Sensor Name' cannot contain spaces.");
+	}
+
 	// Validate Sensor ID is a valid integer
 	if ($_POST['barnyard_enable'] == 'on') {
 		if (!is_numericint($_POST['barnyard_sensor_id']) || $_POST['barnyard_sensor_id'] < 0)
@@ -147,7 +153,7 @@ if ($_POST['save']) {
 		$natent['barnyard_syslog_proto'] = $_POST['barnyard_syslog_proto'];
 
 		if ($_POST['barnyard_sensor_id']) $natent['barnyard_sensor_id'] = $_POST['barnyard_sensor_id']; else $natent['barnyard_sensor_id'] = '0';
-		if ($_POST['barnyard_sensor_name']) $natent['barnyard_sensor_name'] = $_POST['barnyard_sensor_name']; else unset($natent['barnyard_sensor_name']);
+		if ($_POST['barnyard_sensor_name']) $natent['barnyard_sensor_name'] = trim($_POST['barnyard_sensor_name']); else unset($natent['barnyard_sensor_name']);
 		if ($_POST['barnyard_dbhost']) $natent['barnyard_dbhost'] = $_POST['barnyard_dbhost']; else unset($natent['barnyard_dbhost']);
 		if ($_POST['barnyard_dbname']) $natent['barnyard_dbname'] = $_POST['barnyard_dbname']; else unset($natent['barnyard_dbname']);
 		if ($_POST['barnyard_dbuser']) $natent['barnyard_dbuser'] = $_POST['barnyard_dbuser']; else unset($natent['barnyard_dbuser']);
@@ -158,7 +164,7 @@ if ($_POST['save']) {
 		if ($_POST['barnyard_syslog_priority']) $natent['barnyard_syslog_priority'] = $_POST['barnyard_syslog_priority']; else $natent['barnyard_syslog_priority'] = 'LOG_INFO';
 		if ($_POST['barnyard_bro_ids_rhost']) $natent['barnyard_bro_ids_rhost'] = $_POST['barnyard_bro_ids_rhost']; else unset($natent['barnyard_bro_ids_rhost']);
 		if ($_POST['barnyard_bro_ids_dport']) $natent['barnyard_bro_ids_dport'] = $_POST['barnyard_bro_ids_dport']; else $natent['barnyard_bro_ids_dport'] = '47760';
-		if ($_POST['barnconfigpassthru']) $natent['barnconfigpassthru'] = base64_encode($_POST['barnconfigpassthru']); else unset($natent['barnconfigpassthru']);
+		if ($_POST['barnconfigpassthru']) $natent['barnconfigpassthru'] = base64_encode(str_replace("\r\n", "\n", $_POST['barnconfigpassthru'])); else unset($natent['barnconfigpassthru']);
 
 		$a_nat[$id] = $natent;
 		write_config();
@@ -213,18 +219,21 @@ include_once("head.inc");
 
 <form action="suricata_barnyard.php" method="post" name="iform" id="iform">
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
     $tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td class="tabnavtbl">';
@@ -243,6 +252,7 @@ include_once("head.inc");
 	<tr>
 		<td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+			<tbody>
 			<tr>
 				<td colspan="2" valign="top" class="listtopic"><?php echo gettext("General Barnyard2 " .
 				"Settings"); ?></td>
@@ -380,7 +390,7 @@ include_once("head.inc");
 					<input name="barnyard_syslog_local" type="checkbox" value="on" <?php if ($pconfig['barnyard_syslog_local'] == "on") echo "checked"; ?> 
 					onClick="toggle_local_syslog()"/>
 					<?php echo gettext("Enable logging of alerts to the local system only"); ?><br/>
-					<?php echo gettext("This will send alert data to the local system only and overrides the host, port, protocol, facility and priority values below."); ?></td>
+					<?php echo gettext("This will send alert data to the local system only and overrides the host, port and protocol values below."); ?></td>
 			</tr>
 			<tr>
 				<td width="22%" valign="top" class="vncell"><?php echo gettext("Remote Host"); ?></td>
@@ -414,8 +424,8 @@ include_once("head.inc");
 				<td width="78%" class="vtable">
 					<select name="barnyard_syslog_facility" id="barnyard_syslog_facility" class="formselect">
 					<?php
-						$log_facility = array(  "LOG_AUTH", "LOG_AUTHPRIV", "LOG_DAEMON", "LOG_KERN", "LOG_SYSLOG", "LOG_USER", "LOG_LOCAL1",
-									"LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" );
+						$log_facility = array(  "LOG_AUTH", "LOG_AUTHPRIV", "LOG_DAEMON", "LOG_KERN", "LOG_SYSLOG", "LOG_USER", "LOG_LOCAL0",
+									"LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" );
 						foreach ($log_facility as $facility) {
 							$selected = "";
 							if ($facility == $pconfig['barnyard_syslog_facility'])
@@ -423,7 +433,7 @@ include_once("head.inc");
 							echo "<option value='{$facility}'{$selected}>" . $facility . "</option>\n";
 						}
 					?></select>&nbsp;&nbsp;
-					<?php echo gettext("Select Syslog Facility to use for remote reporting.  Default is ") . "<strong>" . gettext("LOG_USER") . "</strong>."; ?>
+					<?php echo gettext("Select Syslog Facility to use for remote reporting.  Default is ") . "<strong>" . gettext("LOG_LOCAL1") . "</strong>."; ?>
 				</td>
 			</tr>
 			<tr>
@@ -431,7 +441,7 @@ include_once("head.inc");
 				<td width="78%" class="vtable">
 					<select name="barnyard_syslog_priority" id="barnyard_syslog_priority" class="formselect">
 					<?php
-						$log_priority = array( "LOG_EMERG", "LOG_ALERT", "LOG_CRIT", "LOG_ERR", "LOG_WARNING", "LOG_NOTICE", "LOG_INFO" );
+						$log_priority = array( "LOG_EMERG", "LOG_CRIT", "LOG_ALERT", "LOG_ERR", "LOG_WARNING", "LOG_NOTICE", "LOG_INFO" );
 						foreach ($log_priority as $priority) {
 							$selected = "";
 							if ($priority == $pconfig['barnyard_syslog_priority'])
@@ -496,10 +506,12 @@ include_once("head.inc");
 				<br/>
 				<?php echo gettext("Please save your settings before you click start."); ?> </td>
 			</tr>
+			</tbody>
 		</table>
 		</div>
 		</td>
 	</tr>
+	</tbody>
 </table>
 </form>
 
@@ -547,8 +559,6 @@ function toggle_local_syslog() {
 		document.iform.barnyard_syslog_dport.disabled = endis;
 		document.iform.barnyard_syslog_proto_udp.disabled = endis;
 		document.iform.barnyard_syslog_proto_tcp.disabled = endis;
-		document.iform.barnyard_syslog_facility.disabled = endis;
-		document.iform.barnyard_syslog_priority.disabled = endis;
 	}
 }
 
diff --git a/config/suricata/suricata_blocked.php b/config/suricata/suricata_blocked.php
index 96171c1e..c29d5745 100644
--- a/config/suricata/suricata_blocked.php
+++ b/config/suricata/suricata_blocked.php
@@ -10,6 +10,7 @@
  * Copyright (C) 2006 Scott Ullrich
  * Copyright (C) 2009 Robert Zelaya Sr. Developer
  * Copyright (C) 2012 Ermal Luci
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * All rights reserved.
  *
  * Adapted for Suricata by:
@@ -55,6 +56,21 @@ if (empty($pconfig['blertnumber']))
 else
 	$bnentries = $pconfig['blertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
 if ($_POST['todelete']) {
 	$ip = "";
 	if ($_POST['ip'])
@@ -138,8 +154,6 @@ include_once("head.inc");
 ?>
 
 <body link="#000000" vlink="#000000" alink="#000000">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
-
 <?php
 
 include_once("fbegin.inc");
@@ -161,19 +175,22 @@ if ($savemsg) {
 <input type="hidden" name="ip" id="ip" value=""/>
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr>
 	<td>
 	<?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), true, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), true, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	?>
 	</td>
@@ -181,6 +198,7 @@ if ($savemsg) {
 <tr>
 	<td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+			<tbody>
 			<tr>
 				<td colspan="2" class="listtopic"><?php echo gettext("Blocked Hosts Log View Settings"); ?></td>
 			</tr>
@@ -219,11 +237,11 @@ if ($savemsg) {
 						<col width="10%" align="center">
 					</colgroup>
 					<thead>
-					   <tr>
+					   <tr class="sortableHeaderRowIdentifier">
 						<th class="listhdrr" axis="number">#</th>
 						<th class="listhdrr" axis="string"><?php echo gettext("IP"); ?></th>
 						<th class="listhdrr" axis="string"><?php echo gettext("Alert Description"); ?></th>
-						<th class="listhdrr"><?php echo gettext("Remove"); ?></th>
+						<th class="listhdrr sorttable_nosort"><?php echo gettext("Remove"); ?></th>
 					   </tr>
 					</thead>
 				<tbody>
@@ -274,18 +292,15 @@ if ($savemsg) {
 				$tmp_ip = str_replace(":", ":&#8203;", $block_ip_str);
 				/* Add reverse DNS lookup icons */
 				$rdns_link = "";
-				$rdns_link .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$block_ip_str}&dialog_output=true', outputrule);\">";
-				$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-				$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-				$rdns_link .= "<a href='/diag_dns.php?host={$block_ip_str}'>";
-				$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-				$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
+				$rdns_link .= "<img onclick=\"javascript:resolve_with_ajax('{$block_ip_str}');\" title=\"";
+				$rdns_link .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+				$rdns_link.= " style=\"cursor: pointer;\"/>";
 				/* use one echo to do the magic*/
 					echo "<tr>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$counter}</td>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$tmp_ip}<br/>{$rdns_link}</td>
 						<td valign=\"middle\" class=\"listr\">{$blocked_desc}</td>
-						<td align=\"center\" valign=\"middle\" class=\"listr\" sorttable_customkey=\"\">
+						<td align=\"center\" valign=\"middle\" class=\"listr\">
 						<input type=\"image\" name=\"todelete[]\" onClick=\"document.getElementById('ip').value='{$block_ip_str}';\" 
 						src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\" title=\"" . gettext("Delete host from Blocked Table") . "\" border=\"0\" /></td>
 					</tr>\n";
@@ -310,14 +325,49 @@ if ($savemsg) {
 			?>
 			</td>
 		</tr>
+		</tbody>
 	</table>
 	</div>
 	</td>
 </tr>
+</tbody>
 </table>
 </form>
 <?php
 include("fend.inc");
 ?>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/suricata/suricata_blocked.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
+</script>
+
 </body>
 </html>
diff --git a/config/suricata/suricata_check_cron_misc.inc b/config/suricata/suricata_check_cron_misc.inc
index f750c530..70394a23 100644
--- a/config/suricata/suricata_check_cron_misc.inc
+++ b/config/suricata/suricata_check_cron_misc.inc
@@ -72,7 +72,7 @@ function suricata_check_dir_size_limit($suricataloglimitsize) {
 		}
 
 		// Initialize an array of the log files we want to prune
-		$logs = array ( "alerts.log", "http.log", "files-json.log", "tls.log", "stats.log" );
+		$logs = array ( "alerts.log", "block.log", "dns.log", "eve.json", "http.log", "files-json.log", "sid_changes.log", "stats.log", "tls.log" );
 
 		// Clean-up the logs for each configured Suricata instance
 		foreach ($config['installedpackages']['suricata']['rule'] as $value) {
@@ -126,8 +126,10 @@ function suricata_check_rotate_log($log_file, $log_limit, $retention) {
 	// Check the current log to see if it needs rotating.
 	// If it does, rotate it and put the current time
 	// on the end of the filename as UNIX timestamp.
+	if (!file_exists($log_file))
+		return;
 	if (($log_limit > 0) && (filesize($log_file) >= $log_limit)) {
-		$newfile = $log_file . "." . strval(time());
+		$newfile = $log_file . "." . date('Y_md_Hi');
 		try {
 			copy($log_file, $newfile);
 			file_put_contents($log_file, "");
@@ -168,10 +170,18 @@ $logs = array ();
 // Build an arry of files to check and limits to check them against from our saved configuration
 $logs['alerts.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['alert_log_limit_size'];
 $logs['alerts.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['alert_log_retention'];
+$logs['block.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['block_log_limit_size'];
+$logs['block.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['block_log_retention'];
+$logs['dns.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['dns_log_limit_size'];
+$logs['dns.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['dns_log_retention'];
+$logs['eve.json']['limit'] = $config['installedpackages']['suricata']['config'][0]['eve_log_limit_size'];
+$logs['eve.json']['retention'] = $config['installedpackages']['suricata']['config'][0]['eve_log_retention'];
 $logs['files-json.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_limit_size'];
 $logs['files-json.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['files_json_log_retention'];
 $logs['http.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['http_log_limit_size'];
 $logs['http.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['http_log_retention'];
+$logs['sid_changes.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'];
+$logs['sid_changes.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'];
 $logs['stats.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['stats_log_limit_size'];
 $logs['stats.log']['retention'] = $config['installedpackages']['suricata']['config'][0]['stats_log_retention'];
 $logs['tls.log']['limit'] = $config['installedpackages']['suricata']['config'][0]['tls_log_limit_size'];
@@ -190,12 +200,17 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
 		    $config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] > 0) {
 			$now = time();
 			$files = glob("{$suricata_log_dir}/barnyard2/archive/unified2.alert.*");
+			$prune_count = 0;
 			foreach ($files as $f) {
-				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600))
+				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] * 3600)) {
+					$prune_count++;
 					unlink_if_exists($f);
+				}
 			}
+			if ($prune_count > 0)
+				log_error(gettext("[Suricata] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/barnyard2/archive/..."));
+			unset($files);
 		}
-		unset($files);
 
 		// Prune aged-out File Store files if any exist
 		if (is_dir("{$suricata_log_dir}/files") &&
@@ -203,11 +218,15 @@ if ($config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] ==
 			$now = time();
 			$files = glob("{$suricata_log_dir}/files/file.*");
 			foreach ($files as $f) {
-				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600))
+				if (($now - filemtime($f)) > ($config['installedpackages']['suricata']['config'][0]['file_store_retention'] * 3600)) {
+					$prune_count++;
 					unlink_if_exists($f);
+				}
 			}
+			if ($prune_count > 0)
+				log_error(gettext("[Suricata] File Store cleanup job removed {$prune_count} file(s) from {$suricata_log_dir}/files/..."));
+			unset($files);
 		}
-		unset($files);
 	}
 }
 
diff --git a/config/suricata/suricata_check_for_rule_updates.php b/config/suricata/suricata_check_for_rule_updates.php
index bb29078f..eeb7be6c 100644
--- a/config/suricata/suricata_check_for_rule_updates.php
+++ b/config/suricata/suricata_check_for_rule_updates.php
@@ -45,7 +45,7 @@ require_once("/usr/local/pkg/suricata/suricata.inc");
 global $g, $pkg_interface, $suricata_gui_include, $rebuild_rules;
 
 if (!defined("VRT_DNLD_URL"))
-	define("VRT_DNLD_URL", "https://www.snort.org/reg-rules/");
+	define("VRT_DNLD_URL", "https://www.snort.org/rules/");
 if (!defined("ET_VERSION"))
 	define("ET_VERSION", "2.9.0");
 if (!defined("ET_BASE_DNLD_URL"))
@@ -56,8 +56,6 @@ if (!defined("ET_DNLD_FILENAME"))
 	define("ET_DNLD_FILENAME", "emerging.rules.tar.gz");
 if (!defined("ETPRO_DNLD_FILENAME"))
 	define("ETPRO_DNLD_FILENAME", "etpro.rules.tar.gz");
-if (!defined("VRT_DNLD_FILENAME"))
-	define("VRT_DNLD_FILENAME", "snortrules-snapshot-edge.tar.gz");
 if (!defined("GPLV2_DNLD_FILENAME"))
 	define("GPLV2_DNLD_FILENAME", "community-rules.tar.gz");
 if (!defined("GPLV2_DNLD_URL"))
@@ -86,6 +84,7 @@ else
 
 /* define checks */
 $oinkid = $config['installedpackages']['suricata']['config'][0]['oinkcode'];
+$snort_filename = $config['installedpackages']['suricata']['config'][0]['snort_rules_file'];
 $etproid = $config['installedpackages']['suricata']['config'][0]['etprocode'];
 $snortdownload = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'] == 'on' ? 'on' : 'off';
 $etpro = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'] == 'on' ? 'on' : 'off';
@@ -96,8 +95,7 @@ $snortcommunityrules = $config['installedpackages']['suricata']['config'][0]['sn
 /* Working directory for downloaded rules tarballs */
 $tmpfname = "/tmp/suricata_rules_up";
 
-/* Snort Edge VRT Rules filenames and URL */
-$snort_filename = VRT_DNLD_FILENAME;
+/* Snort VRT Rules filenames and URL */
 $snort_filename_md5 = "{$snort_filename}.md5";
 $snort_rule_url = VRT_DNLD_URL;
 
@@ -439,10 +437,15 @@ if ($emergingthreats == 'on') {
 
 /*  Check for and download any new Snort VRT sigs */
 if ($snortdownload == 'on') {
-	if (suricata_check_rule_md5("{$snort_rule_url}{$snort_filename_md5}/{$oinkid}/", "{$tmpfname}/{$snort_filename_md5}", "Snort VRT rules")) {
+	if (empty($snort_filename)) {
+		log_error(gettext("No snortrules-snapshot filename has been set on Snort pkg GLOBAL SETTINGS tab.  Snort VRT rules cannot be updated."));
+		error_log(gettext("\tWARNING-- No snortrules-snapshot filename set on GLOBAL SETTINGS tab. Snort VRT rules cannot be updated!\n"), 3, $suricata_rules_upd_log);
+		$snortdownload = 'off';
+	}
+	elseif (suricata_check_rule_md5("{$snort_rule_url}{$snort_filename_md5}?oinkcode={$oinkid}", "{$tmpfname}/{$snort_filename_md5}", "Snort VRT rules")) {
 		/* download snortrules file */
 		$file_md5 = trim(file_get_contents("{$tmpfname}/{$snort_filename_md5}"));
-		if (!suricata_fetch_new_rules("{$snort_rule_url}{$snort_filename}/{$oinkid}/", "{$tmpfname}/{$snort_filename}", $file_md5, "Snort VRT rules"))
+		if (!suricata_fetch_new_rules("{$snort_rule_url}{$snort_filename}?oinkcode={$oinkid}", "{$tmpfname}/{$snort_filename}", $file_md5, "Snort VRT rules"))
 			$snortdownload = 'off';
 	}
 	else
@@ -483,7 +486,7 @@ if ($emergingthreats == 'on') {
 		// The code below renames ET files with a prefix, so we
 		// skip renaming the Suricata default events rule files
 		// that are also bundled in the ET rules.
-		$default_rules = array( "decoder-events.rules", "files.rules", "http-events.rules", "smtp-events.rules", "stream-events.rules", "tls-events.rules" );
+		$default_rules = array( "decoder-events.rules", "dns-events.rules", "files.rules", "http-events.rules", "smtp-events.rules", "stream-events.rules", "tls-events.rules" );
 		$files = glob("{$tmpfname}/emerging/rules/*.rules");
 		// Determine the correct prefix to use based on which
 		// Emerging Threats rules package is enabled.
@@ -759,7 +762,11 @@ if ($pkg_interface <> "console") {
 }
 log_error(gettext("[Suricata] The Rules update has finished."));
 error_log(gettext("The Rules update has finished.  Time: " . date("Y-m-d H:i:s"). "\n\n"), 3, $suricata_rules_upd_log);
-conf_mount_ro();
+
+// Remount filesystem read-only unless we are in package post-install.
+// The post-install code will remount read-only when it completes.
+if (!$g['suricata_postinstall'])
+	conf_mount_ro();
 
 // Restore the state of $pkg_interface
 $pkg_interface = $pkg_interface_orig;
@@ -770,6 +777,6 @@ if ($update_errors)
 else
 	$config['installedpackages']['suricata']['config'][0]['last_rule_upd_status'] = gettext("success");
 $config['installedpackages']['suricata']['config'][0]['last_rule_upd_time'] = time();
-write_config();
+write_config("Suricata pkg: updated status for updated rules package(s) check.");
 
 ?>
diff --git a/config/suricata/suricata_define_vars.php b/config/suricata/suricata_define_vars.php
index d072ff42..3fe5de0d 100644
--- a/config/suricata/suricata_define_vars.php
+++ b/config/suricata/suricata_define_vars.php
@@ -64,7 +64,7 @@ $suricata_servers = array (
 	"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
 	"sql_servers" => "\$HOME_NET", "telnet_servers" => "\$HOME_NET", "dnp3_server" => "\$HOME_NET",
 	"dnp3_client" => "\$HOME_NET", "modbus_server" => "\$HOME_NET", "modbus_client" => "\$HOME_NET",
-	"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET",
+	"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET", "ftp_servers" => "\$HOME_NET", "ssh_servers" => "\$HOME_NET", 
 	"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
 );
 
@@ -74,6 +74,7 @@ if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port'])
 else
         $ssh_port = "22";
 $suricata_ports = array(
+	"ftp_ports" => "21", 
 	"http_ports" => "80", 
 	"oracle_ports" => "1521", 
 	"ssh_ports" => $ssh_port, 
@@ -127,7 +128,9 @@ if ($_POST) {
 
 		/* Update the suricata.yaml file for this interface. */
 		$rebuild_rules = false;
+		conf_mount_rw();
 		suricata_generate_yaml($a_nat[$id]);
+		conf_mount_ro();
 
 		/* Soft-restart Suricaa to live-load new variables. */
 		suricata_reload_config($a_nat[$id]);
@@ -166,18 +169,21 @@ if ($savemsg)
 </script>
 <form action="suricata_define_vars.php" method="post" name="iform" id="iform">
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td class="tabnavtbl">';
@@ -196,6 +202,7 @@ if ($savemsg)
 <tr>
 		<td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+		<tbody>
 		<tr>
 			<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Define Servers (IP variables)"); ?></td>
 		</tr>
@@ -254,9 +261,10 @@ if ($savemsg)
 				<input name="id" type="hidden" value="<?=$id;?>">
 			</td>
 		</tr>
+		</tbody>
 	</table>
 </div>
-</td></tr>
+</td></tr></tbody>
 </table>
 </form>
 <script type="text/javascript">
diff --git a/config/suricata/suricata_download_rules.php b/config/suricata/suricata_download_rules.php
index 2de286ba..f0fbffeb 100644
--- a/config/suricata/suricata_download_rules.php
+++ b/config/suricata/suricata_download_rules.php
@@ -101,7 +101,7 @@ include("head.inc");
 <?php
 
 $suricata_gui_include = true;
-include("/usr/local/www/suricata/suricata_check_for_rule_updates.php");
+include("/usr/local/pkg/suricata/suricata_check_for_rule_updates.php");
 
 /* hide progress bar and lets end this party */
 echo "\n<script type=\"text/javascript\">document.progressbar.style.visibility='hidden';\n</script>";
diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php
index b5377351..89e959c9 100644
--- a/config/suricata/suricata_download_updates.php
+++ b/config/suricata/suricata_download_updates.php
@@ -50,6 +50,7 @@ $snortdownload = $config['installedpackages']['suricata']['config'][0]['enable_v
 $emergingthreats = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'];
 $etpro = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'];
 $snortcommunityrules = $config['installedpackages']['suricata']['config'][0]['snortcommunityrules'];
+$snort_rules_file = $config['installedpackages']['suricata']['config'][0]['snort_rules_file'];
 
 /* Get last update information if available */
 if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_time']))
@@ -61,7 +62,6 @@ if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_
 else
 	$last_rule_upd_status = gettext("Unknown");
 
-$snort_rules_file = VRT_DNLD_FILENAME;
 $snort_community_rules_filename = GPLV2_DNLD_FILENAME;
 
 if ($etpro == "on") {
@@ -82,7 +82,7 @@ else {
 	$snort_org_sig_chk_local = 'Not Enabled';
 	$snort_org_sig_date = 'Not Enabled';
 }
-if (file_exists("{$suricatadir}{$snort_rules_file}.md5")){
+if ($snortdownload == 'on' && file_exists("{$suricatadir}{$snort_rules_file}.md5")){
 	$snort_org_sig_chk_local = file_get_contents("{$suricatadir}{$snort_rules_file}.md5");
 	$snort_org_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$snort_rules_file}.md5"));
 }
@@ -95,7 +95,7 @@ else {
 	$emergingt_net_sig_chk_local = 'Not Enabled';
 	$emergingt_net_sig_date = 'Not Enabled';
 }
-if (file_exists("{$suricatadir}{$emergingthreats_filename}.md5")) {
+if (($etpro == "on" || $emergingthreats == "on") && file_exists("{$suricatadir}{$emergingthreats_filename}.md5")) {
 	$emergingt_net_sig_chk_local = file_get_contents("{$suricatadir}{$emergingthreats_filename}.md5");
 	$emergingt_net_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$emergingthreats_filename}.md5"));
 }
@@ -108,7 +108,7 @@ else {
 	$snort_community_sig_chk_local = 'Not Enabled';
 	$snort_community_sig_sig_date = 'Not Enabled';
 }
-if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) {
+if ($snortcommunityrules == 'on' && file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) {
 	$snort_community_sig_chk_local = file_get_contents("{$suricatadir}{$snort_community_rules_filename}.md5");
 	$snort_community_sig_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$snort_community_rules_filename}.md5"));
 }
@@ -119,7 +119,7 @@ if ($_POST['clear']) {
 		mwexec("/bin/rm -f {$suricata_rules_upd_log}");
 }
 
-if ($_POST['check']) {
+if ($_POST['update']) {
 	// Go see if new updates for rule sets are available
 	header("Location: /suricata/suricata_download_rules.php");
 	exit;
@@ -177,21 +177,24 @@ include_once("head.inc");
 		print_info_box($savemsg);
 	}
 ?>
-<form action="suricata_download_updates.php" method="post" name="iform" id="iform">
+<form action="suricata_download_updates.php" enctype="multipart/form-data" method="post" name="iform" id="iform">
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
         $tab_array = array();
-        $tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+        $tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
         $tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-        $tab_array[] = array(gettext("Update Rules"), true, "/suricata/suricata_download_updates.php");
+        $tab_array[] = array(gettext("Updates"), true, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
         display_top_tabs($tab_array, true);
 ?>
 </td></tr>
@@ -199,6 +202,7 @@ include_once("head.inc");
 	<td>
 		<div id="mainarea">
 		<table id="maintable4" class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
+			<tbody>
 			<tr>
 				<td valign="top" class="listtopic" align="center"><?php echo gettext("INSTALLED RULE SET MD5 SIGNATURE");?></td>
 			</tr>
@@ -212,6 +216,7 @@ include_once("head.inc");
 							<th class="listhdrr"><?=gettext("MD5 Signature Date");?></th>
 						</tr>
 					</thead>
+					<tbody>
 					<tr>
 						<td align="center" class="vncell vexpl"><b><?=$et_name;?></b></td>
 						<td align="center" class="vncell vexpl"><? echo trim($emergingt_net_sig_chk_local);?></td>
@@ -227,6 +232,7 @@ include_once("head.inc");
 						<td align="center" class="vncell vexpl"><? echo trim($snort_community_sig_chk_local);?></td>
 						<td align="center" class="vncell vexpl"><?php echo gettext($snort_community_sig_sig_date);?></td>
 					</tr>
+					</tbody>
 				</table><br/>
 				</td>
 			</tr>
@@ -262,8 +268,8 @@ include_once("head.inc");
 						<br/></p>
 					<?php else: ?>
 						<br/>
-						<input type="submit" value="<?=gettext("Check");?>" name="check" id="check" class="formbtn" 
-						title="<?php echo gettext("Check for new updates to enabled rule sets"); ?>"/>&nbsp;&nbsp;&nbsp;&nbsp;
+						<input type="submit" value="<?=gettext("Update");?>" name="update" id="update" class="formbtn" 
+						title="<?php echo gettext("Check for and apply new update to enabled rule sets"); ?>"/>&nbsp;&nbsp;&nbsp;&nbsp;
 						<input type="submit" value="<?=gettext("Force");?>" name="force" id="force" class="formbtn" 
 						title="<?=gettext("Force an update of all enabled rule sets");?>" 
 						onclick="return confirm('<?=gettext("This will zero-out the MD5 hashes to force a fresh download of all enabled rule sets.  Click OK to continue or CANCEL to quit");?>');"/>
@@ -271,7 +277,6 @@ include_once("head.inc");
 					<?php endif; ?>
 				</td>
 			</tr>
-
 			<tr>
 				<td valign="top" class="listtopic" align="center"><?php echo gettext("MANAGE RULE SET LOG");?></td>
 			</tr>
@@ -318,10 +323,12 @@ include_once("head.inc");
 					gettext(" will go down from time to time. Please be patient."); ?></span><br/>
 				</td>
 			</tr>
+			</tbody>
 		</table>
 		</div>
 	</td>
 </tr>
+</tbody>
 </table>
 <!-- end of final table -->
 </form>
diff --git a/config/suricata/suricata_flow_stream.php b/config/suricata/suricata_flow_stream.php
index ba594d55..fa9edc16 100644
--- a/config/suricata/suricata_flow_stream.php
+++ b/config/suricata/suricata_flow_stream.php
@@ -251,7 +251,6 @@ elseif ($_POST['ResetAll']) {
 	$pconfig['flow_icmp_emerg_established_timeout'] = '100';
 
 	$pconfig['stream_memcap'] = '33554432';
-	$pconfig['stream_max_sessions'] = '262144';
 	$pconfig['stream_prealloc_sessions'] = '32768';
 	$pconfig['reassembly_memcap'] = '67108864';
 	$pconfig['reassembly_depth'] = '1048576';
@@ -261,9 +260,9 @@ elseif ($_POST['ResetAll']) {
 	$pconfig['enable_async_sessions'] = 'off';
 
 	/* Log a message at the top of the page to inform the user */
-	$savemsg = gettext("All flow and stream settings have been reset to their defaults.");
+	$savemsg = gettext("All flow and stream settings have been reset to their defaults.  Click APPLY to save the changes.");
 }
-elseif ($_POST['save']) {
+elseif ($_POST['save'] || $_POST['apply']) {
 	$natent = array();
 	$natent = $pconfig;
 
@@ -300,7 +299,6 @@ elseif ($_POST['save']) {
 		if ($_POST['flow_icmp_emerg_established_timeout'] != "") { $natent['flow_icmp_emerg_established_timeout'] = $_POST['flow_icmp_emerg_established_timeout']; }else{ $natent['flow_icmp_emerg_established_timeout'] = "100"; }
 
 		if ($_POST['stream_memcap'] != "") { $natent['stream_memcap'] = $_POST['stream_memcap']; }else{ $natent['stream_memcap'] = "33554432"; }
-		if ($_POST['stream_max_sessions'] != "") { $natent['stream_max_sessions'] = $_POST['stream_max_sessions']; }else{ $natent['stream_max_sessions'] = "262144"; }
 		if ($_POST['stream_prealloc_sessions'] != "") { $natent['stream_prealloc_sessions'] = $_POST['stream_prealloc_sessions']; }else{ $natent['stream_prealloc_sessions'] = "32768"; }
 		if ($_POST['enable_midstream_sessions'] == "on") { $natent['enable_midstream_sessions'] = 'on'; }else{ $natent['enable_midstream_sessions'] = 'off'; }
 		if ($_POST['enable_async_sessions'] == "on") { $natent['enable_async_sessions'] = 'on'; }else{ $natent['enable_async_sessions'] = 'off'; }
@@ -318,7 +316,9 @@ elseif ($_POST['save']) {
 			$a_nat[$id] = $natent;
 			write_config();
 			$rebuild_rules = false;
+			conf_mount_rw();
 			suricata_generate_yaml($natent);
+			conf_mount_ro();
 		}
 
 		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
@@ -431,32 +431,39 @@ include_once("head.inc");
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
 
 <?php include("fbegin.inc");
-
-	/* Display error or save message */
-	if ($input_errors) {
-		print_input_errors($input_errors); // TODO: add checks
-	}
-	if ($savemsg) {
-		print_info_box($savemsg);
-	}
+/* Display error message */
+if ($input_errors) {
+	print_input_errors($input_errors); // TODO: add checks
+}
 ?>
 
 <form action="suricata_flow_stream.php" method="post" name="iform" id="iform">
 <input type="hidden" name="eng_id" id="eng_id" value="<?=$eng_id;?>"/>
 <input type="hidden" name="id" id="id" value="<?=$id;?>"/>
 
+<?php
+if ($savemsg) {
+	/* Display save message */
+	print_info_box($savemsg);
+}
+?>
+
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td>';
@@ -489,6 +496,7 @@ include_once("head.inc");
 <?php else: ?>
 
 <table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Host-Specific Defrag and Stream Settings"); ?></td>
 	</tr>
@@ -511,6 +519,7 @@ include_once("head.inc");
 					height="17" border="0" title="<?php echo gettext("Add a new policy configuration");?>"/></th>
 				</tr>
 			   </thead>
+				<tbody>
 			<?php foreach ($pconfig['host_os_policy']['item'] as $f => $v): ?>
 				<tr>
 					<td class="listlr" align="left"><?=gettext($v['name']);?></td>
@@ -529,6 +538,7 @@ include_once("head.inc");
 					</td>
 				</tr>
 			<?php endforeach; ?>
+				</tbody>
 			</table>
 		</td>
 	</tr>
@@ -633,6 +643,7 @@ include_once("head.inc");
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("TCP Connections"); ?></td>
 		<td width="78%" class="vtable">
 			<table width="100%" cellspacing="4" cellpadding="0" border="0">
+				<tbody>
 				<tr>
 					<td class="vexpl"><input name="flow_tcp_new_timeout" type="text" class="formfld unknown" id="flow_tcp_new_timeout" 
 					size="9" value="<?=htmlspecialchars($pconfig['flow_tcp_new_timeout']);?>">&nbsp;
@@ -669,6 +680,7 @@ include_once("head.inc");
 					<?php echo gettext("Emergency Closed TCP connection timeout in seconds.  Default is ") . "<strong>" . gettext("20") . "</strong>."; ?>
 					</td>
 				</tr>
+				</tbody>
 			</table>
 		</td>
 	</tr>
@@ -676,6 +688,7 @@ include_once("head.inc");
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("UDP Connections"); ?></td>
 		<td width="78%" class="vtable">
 			<table width="100%" cellspacing="4" cellpadding="0" border="0">
+				<tbody>
 				<tr>
 					<td class="vexpl"><input name="flow_udp_new_timeout" type="text" class="formfld unknown" id="flow_udp_new_timeout" 
 					size="9" value="<?=htmlspecialchars($pconfig['flow_udp_new_timeout']);?>">&nbsp;
@@ -700,6 +713,7 @@ include_once("head.inc");
 					<?php echo gettext("Emergency Established UDP connection timeout in seconds.  Default is ") . "<strong>" . gettext("100") . "</strong>."; ?>
 					</td>
 				</tr>
+				</tbody>
 			</table>
 		</td>
 	</tr>
@@ -707,6 +721,7 @@ include_once("head.inc");
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("ICMP Connections"); ?></td>
 		<td width="78%" class="vtable">
 			<table width="100%" cellspacing="4" cellpadding="0" border="0">
+				<tbody>
 				<tr>
 					<td class="vexpl"><input name="flow_icmp_new_timeout" type="text" class="formfld unknown" id="flow_icmp_new_timeout" 
 					size="9" value="<?=htmlspecialchars($pconfig['flow_icmp_new_timeout']);?>">&nbsp;
@@ -731,6 +746,7 @@ include_once("head.inc");
 					<?php echo gettext("Emergency Established ICMP connection timeout in seconds.  Default is ") . "<strong>" . gettext("100") . "</strong>."; ?>
 					</td>
 				</tr>
+				</tbody>
 			</table>
 		</td>
 	</tr>
@@ -748,16 +764,6 @@ include_once("head.inc");
 		</td>
 	</tr>
 	<tr>
-		<td width="22%" valign="top" class="vncell"><?php echo gettext("Max Sessions"); ?></td>
-		<td width="78%" class="vtable">
-			<input name="stream_max_sessions" type="text" class="formfld unknown" id="stream_max_sessions" size="9"
-			value="<?=htmlspecialchars($pconfig['stream_max_sessions']);?>">&nbsp;
-			<?php echo gettext("Max concurrent stream engine sessions.  Default is ") . 
-			"<strong>" . gettext("262,144") . "</strong>" . gettext(" sessions."); ?><br/><br/>
-			<?php echo gettext("Sets the maximum number of concurrent sessions to be used by the stream engine."); ?>
-		</td>
-	</tr>
-	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Preallocated Sessions"); ?></td>
 		<td width="78%" class="vtable">
 			<input name="stream_prealloc_sessions" type="text" class="formfld unknown" id="stream_prealloc_sessions" size="9"
@@ -835,12 +841,13 @@ include_once("head.inc");
 			<?php echo gettext("Please save your settings before you exit.  Changes will rebuild the rules file.  This "); ?>
 			<?php echo gettext("may take several seconds.  Suricata must also be restarted to activate any changes made on this screen."); ?></td>
 	</tr>
+	</tbody>
 </table>
 
 <?php endif; ?>
 
 </div>
-</td></tr></table>
+</td></tr></tbody></table>
 </form>
 <?php include("fend.inc"); ?>
 </body>
diff --git a/config/suricata/suricata_generate_yaml.php b/config/suricata/suricata_generate_yaml.php
index bd3ce368..8e3e538c 100644
--- a/config/suricata/suricata_generate_yaml.php
+++ b/config/suricata/suricata_generate_yaml.php
@@ -68,11 +68,17 @@ foreach ($suricata_files as $file) {
 $home_net_list = suricata_build_list($suricatacfg, $suricatacfg['homelistname']);
 $home_net = implode(",", $home_net_list);
 $home_net = trim($home_net);
-$external_net = '!$HOME_NET';
+$external_net = "";
 if (!empty($suricatacfg['externallistname']) && $suricatacfg['externallistname'] != 'default') {
-	$external_net_list = suricata_build_list($suricatacfg, $suricatacfg['externallistname']);
+	$external_net_list = suricata_build_list($suricatacfg, $suricatacfg['externallistname'], false, true);
 	$external_net = implode(",", $external_net_list);
-	$external_net = trim($external_net);
+	$external_net = "[" . trim($external_net) . "]";
+}
+else {
+	$external_net = "[";
+	foreach ($home_net_list as $ip)
+		$external_net .= "!{$ip},";
+	$external_net = trim($external_net, ', ') . "]";
 }
 
 // Set the PASS LIST and write its contents to disk
@@ -85,7 +91,7 @@ $suricata_servers = array (
 	"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
 	"sql_servers" => "\$HOME_NET", "telnet_servers" => "\$HOME_NET", "dnp3_server" => "\$HOME_NET",
 	"dnp3_client" => "\$HOME_NET", "modbus_server" => "\$HOME_NET", "modbus_client" => "\$HOME_NET",
-	"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET",
+	"enip_server" => "\$HOME_NET", "enip_client" => "\$HOME_NET", "ftp_servers" => "\$HOME_NET", "ssh_servers" => "\$HOME_NET", 
 	"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
 );
 $addr_vars = "";
@@ -102,6 +108,7 @@ if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port'])
 else
         $ssh_port = "22";
 $suricata_ports = array(
+	"ftp_ports" => "21", 
 	"http_ports" => "80", 
 	"oracle_ports" => "1521", 
 	"ssh_ports" => $ssh_port, 
@@ -158,6 +165,11 @@ if ($suricatacfg['delayed_detect'] == 'on')
 else
 	$delayed_detect = "no";
 
+if ($suricatacfg['intf_promisc_mode'] == 'on')
+	$intf_promisc_mode = "yes";
+else
+	$intf_promisc_mode = "no";
+
 // Add interface-specific blocking settings
 if ($suricatacfg['blockoffenders'] == 'on')
 	$suri_blockoffenders = "yes";
@@ -184,6 +196,26 @@ if ($suricatacfg['alertsystemlog'] == 'on')
 else
 	$alert_syslog = "no";
 
+if (!empty($suricatacfg['alertsystemlog_facility']))
+	$alert_syslog_facility = $suricatacfg['alertsystemlog_facility'];
+else
+	$alert_syslog_facility = "local5";
+
+if (!empty($suricatacfg['alertsystemlog_priority']))
+	$alert_syslog_priority = $suricatacfg['alertsystemlog_priority'];
+else
+	$alert_syslog_priority = "Info";
+
+if ($suricatacfg['enable_dns_log'] == 'on')
+	$dns_log_enabled = "yes";
+else
+	$dns_log_enabled = "no";
+
+if ($suricatacfg['append_dns_log'] == 'on')
+	$dns_log_append = "yes";
+else
+	$dns_log_append = "no";
+
 if ($suricatacfg['enable_stats_log'] == 'on')
 	$stats_log_enabled = "yes";
 else
@@ -209,6 +241,11 @@ if ($suricatacfg['append_http_log'] == 'on')
 else
 	$http_log_append = "no";
 
+if ($suricatacfg['http_log_extended'] == 'on')
+	$http_log_extended = "yes";
+else
+	$http_log_extended = "no";
+
 if ($suricatacfg['enable_tls_log'] == 'on')
 	$tls_log_enabled = "yes";
 else
@@ -277,6 +314,66 @@ if (isset($suricatacfg['barnyard_sensor_id']))
 else
 	$unified2_sensor_id = "0";
 
+// EVE JSON log output settings
+if ($suricatacfg['enable_eve_log'] == 'on')
+	$enable_eve_log = "yes";
+else
+	$enable_eve_log = "no";
+
+if ($suricatacfg['eve_output_type'] == 'syslog')
+	$eve_output_type = "syslog";
+else
+	$eve_output_type = "file";
+
+if (!empty($suricatacfg['eve_systemlog_facility']))
+	$eve_systemlog_facility = $suricatacfg['eve_systemlog_facility'];
+else
+	$eve_systemlog_facility = "local1";
+
+if (!empty($suricatacfg['eve_systemlog_priority']))
+	$eve_systemlog_priority = $suricatacfg['eve_systemlog_priority'];
+else
+	$eve_systemlog_priority = "info";
+
+// EVE log output included information
+$eve_out_types = "";
+if ($suricatacfg['eve_log_alerts'] == 'on')
+	$eve_out_types .= "\n        - alert";
+
+if ($suricatacfg['eve_log_http'] == 'on') {
+	$eve_out_types .= "\n        - http:";
+	if ($suricatacfg['http_log_extended'] == 'on')
+		$eve_out_types .= "\n            extended: yes";
+	else
+		$eve_out_types .= "\n            extended: no";
+}
+
+if ($suricatacfg['eve_log_dns'] == 'on')
+	$eve_out_types .= "\n        - dns";
+
+if ($suricatacfg['eve_log_tls'] == 'on') {
+	$eve_out_types .= "\n        - tls:";
+	if ($suricatacfg['tls_log_extended'] == 'on')
+		$eve_out_types .= "\n            extended: yes";
+	else
+		$eve_out_types .= "\n            extended: no";
+}
+
+if ($suricatacfg['eve_log_files'] == 'on') {
+	$eve_out_types .= "\n        - files:";
+	if ($suricatacfg['enable_tracked_files_magic'] == 'on')
+		$eve_out_types .= "\n            force-magic: yes";
+	else
+		$eve_out_types .= "\n            force-magic: no";
+	if ($suricatacfg['enable_tracked_files_md5'] == 'on')
+		$eve_out_types .= "\n            force-md5: yes";
+	else
+		$eve_out_types .= "\n            force-md5: no";
+}
+
+if ($suricatacfg['eve_log_ssh'] == 'on')
+	$eve_out_types .= "\n        - ssh";
+
 // Add interface-specific IP defrag settings
 if (!empty($suricatacfg['frag_memcap']))
 	$frag_memcap = $suricatacfg['frag_memcap'];
@@ -406,11 +503,6 @@ if (!empty($suricatacfg['stream_memcap']))
 else
 	$stream_memcap = "33554432";
 
-if (!empty($suricatacfg['stream_max_sessions']))
-	$stream_max_sessions = $suricatacfg['stream_max_sessions'];
-else
-	$stream_max_sessions = "262144";
-
 if (!empty($suricatacfg['stream_prealloc_sessions']))
 	$stream_prealloc_sessions = $suricatacfg['stream_prealloc_sessions'];
 else
@@ -492,7 +584,7 @@ if (!is_array($suricatacfg['libhtp_policy']['item']))
 	$suricatacfg['libhtp_policy']['item'] = array();
 if (empty($suricatacfg['libhtp_policy']['item'])) {
 	$http_hosts_default_policy = "default-config:\n     personality: IDS\n     request-body-limit: 4096\n     response-body-limit: 4096\n";
-	$http_hosts_default_policy .= "     double-decode-path: no\n     double-decode-query: no\n";
+	$http_hosts_default_policy .= "     double-decode-path: no\n     double-decode-query: no\n     uri-include-all: no\n";
 }
 else {
 	foreach ($suricatacfg['libhtp_policy']['item'] as $k => $v) {
@@ -519,6 +611,7 @@ else {
 				$engine .= "         response-body-limit: {$v['response-body-limit']}\n";
 				$engine .= "         double-decode-path: {$v['double-decode-path']}\n";
 				$engine .= "         double-decode-query: {$v['double-decode-query']}\n";
+				$engine .= "         uri-include-all: {$v['uri-include-all']}\n";
 				$http_hosts_policy .= "   {$engine}\n";
 			}
 			else {
@@ -531,6 +624,7 @@ else {
 			$http_hosts_default_policy .= "     response-body-limit: {$v['response-body-limit']}\n";
 			$http_hosts_default_policy .= "     double-decode-path: {$v['double-decode-path']}\n";
 			$http_hosts_default_policy .= "     double-decode-query: {$v['double-decode-query']}\n";
+			$http_hosts_default_policy .= "     uri-include-all: {$v['uri-include-all']}\n";
 		}
 	}
 	// Remove trailing newline
@@ -544,6 +638,75 @@ if (!empty($suricatacfg['asn1_max_frames']))
 else
 	$asn1_max_frames = "256";
 
+// Configure App-Layer Parsers/Detection
+if (!empty($suricatacfg['tls_parser']))
+	$tls_parser = $suricatacfg['tls_parser'];
+else
+	$tls_parser = "yes";
+if (!empty($suricatacfg['dcerpc_parser']))
+	$dcerpc_parser = $suricatacfg['dcerpc_parser'];
+else
+	$dcerpc_parser = "yes";
+if (!empty($suricatacfg['ftp_parser']))
+	$ftp_parser = $suricatacfg['ftp_parser'];
+else
+	$ftp_parser = "yes";
+if (!empty($suricatacfg['ssh_parser']))
+	$ssh_parser = $suricatacfg['ssh_parser'];
+else
+	$ssh_parser = "yes";
+if (!empty($suricatacfg['smtp_parser']))
+	$smtp_parser = $suricatacfg['smtp_parser'];
+else
+	$smtp_parser = "yes";
+if (!empty($suricatacfg['imap_parser']))
+	$imap_parser = $suricatacfg['imap_parser'];
+else
+	$imap_parser = "detection-only";
+if (!empty($suricatacfg['msn_parser']))
+	$msn_parser = $suricatacfg['msn_parser'];
+else
+	$msn_parser = "detection-only";
+if (!empty($suricatacfg['smb_parser']))
+	$smb_parser = $suricatacfg['smb_parser'];
+else
+	$smb_parser = "yes";
+
+/* DNS Parser */
+if (!empty($suricatacfg['dns_parser_tcp']))
+	$dns_parser_tcp = $suricatacfg['dns_parser_tcp'];
+else
+	$dns_parser_tcp = "yes";
+if (!empty($suricatacfg['dns_parser_udp']))
+	$dns_parser_udp = $suricatacfg['dns_parser_udp'];
+else
+	$dns_parser_udp = "yes";
+if (!empty($suricatacfg['dns_global_memcap']))
+	$dns_global_memcap = $suricatacfg['dns_global_memcap'];
+else
+	$dns_global_memcap = "16777216";
+if (!empty($suricatacfg['dns_state_memcap']))
+	$dns_state_memcap = $suricatacfg['dns_state_memcap'];
+else
+	$dns_state_memcap = "524288";
+if (!empty($suricatacfg['dns_request_flood_limit']))
+	$dns_request_flood_limit = $suricatacfg['dns_request_flood_limit'];
+else
+	$dns_request_flood_limit = "500";
+
+/* HTTP Parser */
+if (!empty($suricatacfg['http_parser']))
+	$http_parser = $suricatacfg['http_parser'];
+else
+	$http_parser = "yes";
+if (!empty($suricatacfg['http_parser_memcap']))
+	$http_parser_memcap = $suricatacfg['http_parser_memcap'];
+else
+	$http_parser_memcap = "67108864";
+
+/* Configure the IP REP section */
+$iprep_path = rtrim(IPREP_PATH, '/');
+
 // Create the rules files and save in the interface directory
 suricata_prepare_rule_files($suricatacfg, $suricatacfgdir);
 
@@ -563,4 +726,9 @@ if ($config['installedpackages']['suricata']['config'][0]['log_to_systemlog'] ==
 else
 	$suricata_use_syslog = "no";
 
+if (!empty($config['installedpackages']['suricata']['config'][0]['log_to_systemlog']))
+	$suricata_use_syslog_facility = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog'];
+else
+	$suricata_use_syslog_facility = "local1";
+
 ?>
diff --git a/config/suricata/suricata_global.php b/config/suricata/suricata_global.php
index 9c932222..5f01a660 100644
--- a/config/suricata/suricata_global.php
+++ b/config/suricata/suricata_global.php
@@ -45,29 +45,45 @@ require_once("/usr/local/pkg/suricata/suricata.inc");
 global $g;
 
 $suricatadir = SURICATADIR;
+$pconfig = array();
 
-$pconfig['enable_vrt_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'];
-$pconfig['oinkcode'] = $config['installedpackages']['suricata']['config'][0]['oinkcode'];
-$pconfig['etprocode'] = $config['installedpackages']['suricata']['config'][0]['etprocode'];
-$pconfig['enable_etopen_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'];
-$pconfig['enable_etpro_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'];
-$pconfig['rm_blocked'] = $config['installedpackages']['suricata']['config'][0]['rm_blocked'];
-$pconfig['autoruleupdate'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdate'];
-$pconfig['autoruleupdatetime'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdatetime'];
-$pconfig['live_swap_updates'] = $config['installedpackages']['suricata']['config'][0]['live_swap_updates'];
-$pconfig['log_to_systemlog'] = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog'];
-$pconfig['forcekeepsettings'] = $config['installedpackages']['suricata']['config'][0]['forcekeepsettings'];
-$pconfig['snortcommunityrules'] = $config['installedpackages']['suricata']['config'][0]['snortcommunityrules'];
+// If doing a postback, used typed values, else load from stored config
+if (!empty($_POST)) {
+	$pconfig = $_POST;
+}
+else {
+	$pconfig['enable_vrt_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'];
+	$pconfig['oinkcode'] = $config['installedpackages']['suricata']['config'][0]['oinkcode'];
+	$pconfig['etprocode'] = $config['installedpackages']['suricata']['config'][0]['etprocode'];
+	$pconfig['enable_etopen_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'];
+	$pconfig['enable_etpro_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'];
+	$pconfig['rm_blocked'] = $config['installedpackages']['suricata']['config'][0]['rm_blocked'];
+	$pconfig['autoruleupdate'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdate'];
+	$pconfig['autoruleupdatetime'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdatetime'];
+	$pconfig['live_swap_updates'] = $config['installedpackages']['suricata']['config'][0]['live_swap_updates'];
+	$pconfig['log_to_systemlog'] = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog'];
+	$pconfig['log_to_systemlog_facility'] = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog_facility'];
+	$pconfig['forcekeepsettings'] = $config['installedpackages']['suricata']['config'][0]['forcekeepsettings'];
+	$pconfig['snortcommunityrules'] = $config['installedpackages']['suricata']['config'][0]['snortcommunityrules'];
+	$pconfig['snort_rules_file'] = $config['installedpackages']['suricata']['config'][0]['snort_rules_file'];
+}
 
+// Do input validation on parameters
 if (empty($pconfig['autoruleupdatetime']))
 	$pconfig['autoruleupdatetime'] = '00:30';
 
+if (empty($pconfig['log_to_systemlog_facility']))
+	$pconfig['log_to_systemlog_facility'] = "local1";
+
 if ($_POST['autoruleupdatetime']) {
 	if (!preg_match('/^([01]?[0-9]|2[0-3]):?([0-5][0-9])$/', $_POST['autoruleupdatetime']))
 		$input_errors[] = "Invalid Rule Update Start Time!  Please supply a value in 24-hour format as 'HH:MM'.";
 }
 
-if ($_POST['suricatadownload'] == "on" && empty($_POST['oinkcode']))
+if ($_POST['enable_vrt_rules'] == "on" && empty($_POST['snort_rules_file']))
+		$input_errors[] = "You must supply a snort rules tarball filename in the box provided in order to enable Snort VRT rules!";
+
+if ($_POST['enable_vrt_rules'] == "on" && empty($_POST['oinkcode']))
 		$input_errors[] = "You must supply an Oinkmaster code in the box provided in order to enable Snort VRT rules!";
 
 if ($_POST['enable_etpro_rules'] == "on" && empty($_POST['etprocode']))
@@ -117,6 +133,7 @@ if (!$input_errors) {
 			}
 		}
 
+		$config['installedpackages']['suricata']['config'][0]['snort_rules_file'] = $_POST['snort_rules_file'];
 		$config['installedpackages']['suricata']['config'][0]['oinkcode'] = $_POST['oinkcode'];
 		$config['installedpackages']['suricata']['config'][0]['etprocode'] = $_POST['etprocode'];
 		$config['installedpackages']['suricata']['config'][0]['rm_blocked'] = $_POST['rm_blocked'];
@@ -130,6 +147,7 @@ if (!$input_errors) {
 		}
 		$config['installedpackages']['suricata']['config'][0]['autoruleupdatetime'] = str_pad($_POST['autoruleupdatetime'], 4, "0", STR_PAD_LEFT);
 		$config['installedpackages']['suricata']['config'][0]['log_to_systemlog'] = $_POST['log_to_systemlog'] ? 'on' : 'off';
+		$config['installedpackages']['suricata']['config'][0]['log_to_systemlog_facility'] = $_POST['log_to_systemlog_facility'];
 		$config['installedpackages']['suricata']['config'][0]['live_swap_updates'] = $_POST['live_swap_updates'] ? 'on' : 'off';
 		$config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] = $_POST['forcekeepsettings'] ? 'on' : 'off';
 
@@ -138,7 +156,7 @@ if (!$input_errors) {
 		/* create passlist and homenet file, then sync files */
 		sync_suricata_package_config();
 
-		write_config();
+		write_config("Suricata pkg: modified global settings.");
 
 		/* forces page to reload new settings */
 		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
@@ -161,9 +179,6 @@ include_once("head.inc");
 <?php
 include_once("fbegin.inc");
 
-if($pfsense_stable == 'yes')
-	echo '<p class="pgtitle">' . $pgtitle . '</p>';
-
 /* Display Alert message, under form tag or no refresh */
 if ($input_errors)
 	print_input_errors($input_errors);
@@ -172,25 +187,29 @@ if ($input_errors)
 
 <form action="suricata_global.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
-        $tab_array = array();
-        $tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
-        $tab_array[] = array(gettext("Global Settings"), true, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array = array();
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Global Settings"), true, "/suricata/suricata_global.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
-        display_top_tabs($tab_array, true);
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
+	display_top_tabs($tab_array, true);
 ?>
 </td></tr>
 <tr>
 	<td>
 	<div id="mainarea">
 	<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+<tbody>
 <tr>
 	<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Please Choose The Type Of Rules You Wish To Download");?></td>
 </tr>
@@ -198,6 +217,7 @@ if ($input_errors)
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Install ") . "<strong>" . gettext("Emerging Threats") . "</strong>" . gettext(" rules");?></td>
 	<td width="78%" class="vtable">
 		<table width="100%" border="0" cellpadding="2" cellspacing="0">
+			<tbody>
 			<tr>
 				<td valign="top" width="8%"><input name="enable_etopen_rules" type="checkbox" value="on" onclick="enable_et_rules();" 
 				<?php if ($config['installedpackages']['suricata']['config'][0]['enable_etopen_rules']=="on") echo "checked"; ?>/></td>
@@ -218,8 +238,10 @@ if ($input_errors)
 			<td class="vexpl"><?php echo "<span class='red'><strong>" . gettext("Note:") . "</strong></span>" . "&nbsp;" . 
 			gettext("The ETPro rules contain all of the ETOpen rules, so the ETOpen rules are not required and are disabled when the ETPro rules are selected."); ?></td>
 		</tr>
+		</tbody>
 		</table>
 		<table id="etpro_code_tbl" width="100%" border="0" cellpadding="2" cellspacing="0">
+		<tbody>
 		<tr>
 			<td colspan="2">&nbsp;</td>
 		</tr>
@@ -232,6 +254,7 @@ if ($input_errors)
 			value="<?=htmlspecialchars($pconfig['etprocode']);?>"/><br/>
 			<?php echo gettext("Obtain an ETPro subscription code and paste it here."); ?></td>
 		</tr>
+		</tbody>
 		</table>
 	</td>
 </tr>
@@ -239,36 +262,45 @@ if ($input_errors)
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Install ") . "<strong>" . gettext("Snort VRT") . "</strong>" . gettext(" rules");?></td>
 	<td width="78%" class="vtable">
 		<table width="100%" border="0" cellpadding="2" cellspacing="0">
+		<tbody>
 		<tr>
 			<td><input name="enable_vrt_rules" type="checkbox" id="enable_vrt_rules" value="on" onclick="enable_snort_vrt();" 
 			<?php if($pconfig['enable_vrt_rules']=='on') echo 'checked'; ?>/></td>
 			<td><span class="vexpl"><?php echo gettext("Snort VRT free Registered User or paid Subscriber rules"); ?></span></td>
 		<tr>
 			<td>&nbsp;</td>
-			<td><a href="https://www.snort.org/signup" target="_blank"><?php echo gettext("Sign Up for a free Registered User Rule Account"); ?> </a><br/>
-			<a href="http://www.snort.org/vrt/buy-a-subscription" target="_blank">
+			<td><a href="https://www.snort.org/users/sign_up" target="_blank"><?php echo gettext("Sign Up for a free Registered User Rule Account"); ?> </a><br/>
+			<a href="https://www.snort.org/products" target="_blank">
 			<?php echo gettext("Sign Up for paid Sourcefire VRT Certified Subscriber Rules"); ?></a></td>
 		</tr>
+		</tbody>
 		</table>
 		<table id="snort_oink_code_tbl" width="100%" border="0" cellpadding="2" cellspacing="0">
+		<tbody>
 		<tr>
-			<td colspan="2">&nbsp;</td>
+			<td colspan="2" valign="top"><b><span class="vexpl"><?php echo gettext("Snort VRT Configuration"); ?></span></b></td>
 		</tr>
 		<tr>
-			<td colspan="2" valign="top"><b><span class="vexpl"><?php echo gettext("Snort VRT Oinkmaster Configuration"); ?></span></b></td>
+			<td valign="top" align="right"><span class="vexpl"><strong><?php echo gettext("Rules Filename:"); ?></strong></span>&nbsp;</td>
+			<td><input name="snort_rules_file" type="text" class="formfld unknown" id="snort_rules_file" size="52" 
+			value="<?=htmlspecialchars($pconfig['snort_rules_file']);?>"/><br/>
+			<?php echo gettext("Enter the rules tarball filename (filename only, do not include the URL.)"); ?>
+			<br/><span class="red"><strong><?php echo gettext("Example: ") . "</strong></span>" . gettext("snortrules-snapshot-2962.tar.gz");?><br/><br/></td>
 		</tr>
 		<tr>
-			<td valign="top"><span class="vexpl"><strong><?php echo gettext("Code:"); ?></strong></span></td>
+			<td valign="top" align="right"><span class="vexpl"><strong><?php echo gettext("Oinkmaster Code:"); ?></strong></span>&nbsp;</td>
 			<td><input name="oinkcode" type="text" class="formfld unknown" id="oinkcode" size="52" 
 			value="<?=htmlspecialchars($pconfig['oinkcode']);?>"/><br/>
 			<?php echo gettext("Obtain a snort.org Oinkmaster code and paste it here."); ?></td>
 		</tr>
+		</tbody>
 		</table>
 </tr>
 <tr>
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Install ") . "<strong>" . gettext("Snort Community") . "</strong>" . gettext(" rules");?></td>
 	<td width="78%" class="vtable">
 		<table width="100%" border="0" cellpadding="2" cellspacing="0">
+			<tbody>
 			<tr>
 				<td valign="top" width="8%"><input name="snortcommunityrules" type="checkbox" value="on"
 				<?php if ($config['installedpackages']['suricata']['config'][0]['snortcommunityrules']=="on") echo " checked";?>/></td>
@@ -278,6 +310,7 @@ if ($input_errors)
 				gettext("If you are a Snort VRT Paid Subscriber, the community ruleset is already built into your download of the ") . 
 				gettext("Snort VRT rules, and there is no benefit in adding this rule set.");?><br/></td>
 			</tr>
+			</tbody>
 		</table></td>
 </tr>
 <tr>
@@ -334,10 +367,29 @@ if ($input_errors)
 </tr>
 <tr>
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Log to System Log"); ?></td>
-	<td width="78%" class="vtable"><input name="log_to_systemlog" id="log_to_systemlog" type="checkbox" value="yes"
+	<td width="78%" class="vtable"><input name="log_to_systemlog" id="log_to_systemlog" type="checkbox" value="yes" onclick="toggle_log_to_systemlog();" 
 	<?php if ($config['installedpackages']['suricata']['config'][0]['log_to_systemlog']=="on") echo " checked"; ?>/>&nbsp;
 	<?php echo gettext("Copy Suricata messages to the firewall system log."); ?></td>
 </tr>
+	<tbody id="log_to_systemlog_rows">
+		<tr>
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Facility"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="log_to_systemlog_facility" id="log_to_systemlog_facility" class="formselect">
+				<?php
+					$log_facility = array(  "auth", "authpriv", "daemon", "kern", "security", "syslog", "user", "local0",
+								"local1", "local2", "local3", "local4", "local5", "local6", "local7" );
+					foreach ($log_facility as $facility) {
+						$selected = "";
+						if ($facility == $pconfig['log_to_systemlog_facility'])
+							$selected = " selected";
+						echo "<option value='{$facility}'{$selected}>" . $facility . "</option>\n";
+					}
+				?></select>&nbsp;&nbsp;
+				<?php echo gettext("Select system log facility to use for reporting.  Default is ") . "<strong>" . gettext("local1") . "</strong>."; ?>
+			</td>
+		</tr>
+	</tbody>
 <tr>
 	<td width="22%" valign="top" class="vncell"><?php echo gettext("Keep Suricata Settings After Deinstall"); ?></td>
 	<td width="78%" class="vtable"><input name="forcekeepsettings" id="forcekeepsettings" type="checkbox" value="yes"
@@ -351,9 +403,10 @@ if ($input_errors)
 	<td colspan="2" class="vexpl" align="center"><span class="red"><strong><?php echo gettext("Note:");?></strong>&nbsp;
 	</span><?php echo gettext("Changing any settings on this page will affect all Suricata-configured interfaces.");?></td>
 </tr>
+</tbody>
 	</table>
 </div><br/>
-</td></tr>
+</td></tr></tbody>
 </table>
 </form>
 <?php include("fend.inc"); ?>
@@ -396,11 +449,20 @@ function enable_change_rules_upd() {
 		document.iform.autoruleupdatetime.disabled="";		
 }
 
+function toggle_log_to_systemlog() {
+	var endis = !document.iform.log_to_systemlog.checked;
+	if (endis)
+		document.getElementById("log_to_systemlog_rows").style.display="none";
+	else
+		document.getElementById("log_to_systemlog_rows").style.display="";
+}
+
 // Initialize the form controls state based on saved settings
 enable_snort_vrt();
 enable_et_rules();
 enable_pro_rules();
 enable_change_rules_upd();
+toggle_log_to_systemlog();
 
 //-->
 </script>
diff --git a/config/suricata/suricata_import_aliases.php b/config/suricata/suricata_import_aliases.php
index ccaaf29d..e2fa4f40 100644
--- a/config/suricata/suricata_import_aliases.php
+++ b/config/suricata/suricata_import_aliases.php
@@ -79,8 +79,8 @@
 				<col width="35%" align="left" axis="string">
 			</colgroup>
 			<thead>
-			   <tr>
-				<th class="listhdrr"></th>
+			   <tr class="sortableHeaderRowIdentifier">
+				<th class="listhdrr sorttable_nosort"></th>
 				<th class="listhdrr" axis="string"><?=gettext("Alias Name"); ?></th>
 				<th class="listhdrr" axis="string"><?=gettext("Values"); ?></th>
 				<th class="listhdrr" axis="string"><?=gettext("Description"); ?></th>
diff --git a/config/suricata/suricata_interfaces.php b/config/suricata/suricata_interfaces.php
index 205a872b..3d093d45 100644
--- a/config/suricata/suricata_interfaces.php
+++ b/config/suricata/suricata_interfaces.php
@@ -60,7 +60,6 @@ $id_gen = count($config['installedpackages']['suricata']['rule']);
 // Get list of configured firewall interfaces
 $ifaces = get_configured_interface_list();
 
-
 if ($_POST['del_x']) {
 	/* delete selected interfaces */
 	if (is_array($_POST['rule'])) {
@@ -79,7 +78,7 @@ if ($_POST['del_x']) {
 		if (empty($a_nat))
 			unset($a_nat);
 
-		write_config();
+		write_config("Suricata pkg: deleted one or more Suricata interfaces.");
 		sleep(2);
 	  
 		/* if there are no ifaces remaining do not create suricata.sh */
@@ -87,7 +86,7 @@ if ($_POST['del_x']) {
 			suricata_create_rc();
 		else {
 			conf_mount_rw();
-			@unlink("{$rcdir}/suricata.sh");
+			@unlink("{$rcdir}suricata.sh");
 			conf_mount_ro();
 		}
 	  
@@ -170,19 +169,22 @@ include_once("head.inc");
 ?>
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr>
 	<td>
 	<?php
 		$tab_array = array();
-		$tab_array[] = array(gettext("Suricata Interfaces"), true, "/suricata/suricata_interfaces.php");
+		$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 		$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-		$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+		$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 		$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-		$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+		$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 		$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 		$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-		$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+		$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 		$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+		$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+		$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 		display_top_tabs($tab_array, true);
 	?>
 	</td>
@@ -191,7 +193,6 @@ include_once("head.inc");
 	<td>
 	<div id="mainarea">
 	<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
-
 		<colgroup>
 			<col width="3%" align="center">
 			<col width="12%">
@@ -230,6 +231,7 @@ include_once("head.inc");
 			</th>
 		</tr>
 		</thead>
+		<tbody>
 		<?php $nnats = $i = 0;
 
 		// Turn on buffering to speed up rendering
@@ -404,6 +406,7 @@ include_once("head.inc");
 			<td>&nbsp;</td>
 			<td colspan="6">
 			<table class="tabcont" width="100%" border="0" cellpadding="1" cellspacing="0">
+				<tbody>
 				<tr>
 					<td colspan="3" class="vexpl"><span class="red"><strong><?php echo gettext("Note:"); ?></strong></span> <br>
 						<?php echo gettext("This is the ") . "<strong>" . gettext("Suricata Menu ") . 
@@ -456,14 +459,17 @@ include_once("head.inc");
 						delete an interface and settings.
 					</td>
 				</tr>
+				</tbody>
 			</table>
 			</td>
 			<td>&nbsp;</td>
 		</tr>
+		</tbody>
 	</table>
 	</div>
 	</td>
 </tr>
+</tbody>
 </table>
 </form>
 
diff --git a/config/suricata/suricata_interfaces_edit.php b/config/suricata/suricata_interfaces_edit.php
index dcf6fe3f..c4a1775a 100644
--- a/config/suricata/suricata_interfaces_edit.php
+++ b/config/suricata/suricata_interfaces_edit.php
@@ -59,8 +59,10 @@ if (isset($_POST['id']) && is_numericint($_POST['id']))
 elseif (isset($_GET['id']) && is_numericint($_GET['id']));
 	$id = htmlspecialchars($_GET['id'], ENT_QUOTES | ENT_HTML401);
 
-if (is_null($id))
-	$id = 0;
+if (is_null($id)) {
+        header("Location: /suricata/suricata_interfaces.php");
+        exit;
+}
 
 if (isset($_POST['action']))
 	$action = htmlspecialchars($_POST['action'], ENT_QUOTES | ENT_HTML401);
@@ -71,7 +73,7 @@ else
 
 $pconfig = array();
 if (empty($suricataglob['rule'][$id]['uuid'])) {
-	/* Adding new interface, so flag rules to build. */
+	/* Adding new interface, so generate a new UUID and flag rules to build. */
 	$pconfig['uuid'] = suricata_generate_id();
 	$rebuild_rules = true;
 }
@@ -87,14 +89,15 @@ $interfaces = get_configured_interface_with_descr();
 
 // See if interface is already configured, and use its values
 if (isset($id) && $a_rule[$id]) {
+	/* old options */
 	$pconfig = $a_rule[$id];
 	if (!empty($pconfig['configpassthru']))
 		$pconfig['configpassthru'] = base64_decode($pconfig['configpassthru']);
 	if (empty($pconfig['uuid']))
 		$pconfig['uuid'] = $suricata_uuid;
 }
+// Must be a new interface, so try to pick next available physical interface to use
 elseif (isset($id) && !isset($a_rule[$id])) {
-	// Must be a new interface, so try to pick next available physical interface to use
 	$ifaces = get_configured_interface_list();
 	$ifrules = array();
 	foreach($a_rule as $r)
@@ -130,24 +133,44 @@ if (empty($pconfig['enable_http_log']))
 	$pconfig['enable_http_log'] = "on";
 if (empty($pconfig['append_http_log']))
 	$pconfig['append_http_log'] = "on";
-if (empty($pconfig['enable_tls_log']))
-	$pconfig['enable_tls_log'] = "off";
+if (empty($pconfig['http_log_extended']))
+	$pconfig['http_log_extended'] = "on";
 if (empty($pconfig['tls_log_extended']))
 	$pconfig['tls_log_extended'] = "on";
-if (empty($pconfig['enable_stats_log']))
-	$pconfig['enable_stats_log'] = "off";
 if (empty($pconfig['stats_upd_interval']))
 	$pconfig['stats_upd_interval'] = "10";
-if (empty($pconfig['append_stats_log']))
-	$pconfig['append_stats_log'] = "off";
+if (empty($pconfig['append_dns_log']))
+	$pconfig['append_dns_log'] = "on";
 if (empty($pconfig['append_json_file_log']))
 	$pconfig['append_json_file_log'] = "on";
-if (empty($pconfig['enable_pcap_log']))
-	$pconfig['enable_pcap_log'] = "off";
 if (empty($pconfig['max_pcap_log_size']))
 	$pconfig['max_pcap_log_size'] = "32";
 if (empty($pconfig['max_pcap_log_files']))
 	$pconfig['max_pcap_log_files'] = "1000";
+if (empty($pconfig['alertsystemlog_facility']))
+	$pconfig['alertsystemlog_facility'] = "local1";
+if (empty($pconfig['alertsystemlog_priority']))
+	$pconfig['alertsystemlog_priority'] = "notice";
+if (empty($pconfig['eve_output_type']))
+	$pconfig['eve_output_type'] = "file";
+if (empty($pconfig['eve_systemlog_facility']))
+	$pconfig['eve_systemlog_facility'] = "local1";
+if (empty($pconfig['eve_systemlog_priority']))
+	$pconfig['eve_systemlog_priority'] = "notice";
+if (empty($pconfig['eve_log_alerts']))
+	$pconfig['eve_log_alerts'] = "on";
+if (empty($pconfig['eve_log_http']))
+	$pconfig['eve_log_http'] = "on";
+if (empty($pconfig['eve_log_dns']))
+	$pconfig['eve_log_dns'] = "on";
+if (empty($pconfig['eve_log_tls']))
+	$pconfig['eve_log_tls'] = "on";
+if (empty($pconfig['eve_log_files']))
+	$pconfig['eve_log_files'] = "on";
+if (empty($pconfig['eve_log_ssh']))
+	$pconfig['eve_log_ssh'] = "on";
+if (empty($pconfig['intf_promisc_mode']))
+	$pconfig['intf_promisc_mode'] = "on";
 
 // See if creating a new interface by duplicating an existing one
 if (strcasecmp($action, 'dup') == 0) {
@@ -180,35 +203,37 @@ if (strcasecmp($action, 'dup') == 0) {
 }
 
 if ($_POST["save"] && !$input_errors) {
-	// If the interface is not enabled, stop any running Suricata
-	// instance on it, save the new state and exit.
-	if (!isset($_POST['enable'])) {
-		if (isset($id) && $a_rule[$id]) {
-			$a_rule[$id]['enable'] = 'off';
-			$a_rule[$id]['interface'] = htmlspecialchars($_POST['interface']);
-			$a_rule[$id]['descr'] = htmlspecialchars($_POST['descr']);
-			suricata_stop($a_rule[$id], get_real_interface($a_rule[$id]['interface']));
-
-			// Save configuration changes
-			write_config();
-
-			// Update suricata.conf and suricata.sh files for this interface
-			sync_suricata_package_config();
-
-			header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
-			header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
-			header( 'Cache-Control: no-store, no-cache, must-revalidate' );
-			header( 'Cache-Control: post-check=0, pre-check=0', false );
-			header( 'Pragma: no-cache' );
-			header("Location: /suricata/suricata_interfaces.php");
-			exit;
+	if (!isset($_POST['interface']))
+		$input_errors[] = gettext("Choosing an Interface is mandatory!");
+
+	/* See if assigned interface is already in use */
+	if (isset($_POST['interface'])) {
+		foreach ($a_rule as $k => $v) {
+			if (($v['interface'] == $_POST['interface']) && ($id <> $k)) {
+				$input_errors[] = gettext("The '{$_POST['interface']}' interface is already assigned to another Suricata instance.");
+				break;
+			}
 		}
 	}
 
-	// Validate inputs
-	if (!isset($_POST['interface']))
-		$input_errors[] = gettext("Choosing an Interface is mandatory!");
+	// If Suricata is disabled on this interface, stop any running instance,
+	// save the change and exit.
+	if ($_POST['enable'] != 'on') {
+		$a_rule[$id]['enable'] = $_POST['enable'] ? 'on' : 'off';
+		suricata_stop($a_rule[$id], get_real_interface($a_rule[$id]['interface']));
+		write_config("Suricata pkg: disabled Suricata on " . convert_friendly_interface_to_friendly_descr($a_rule[$id]['interface']));
+		$rebuild_rules = false;
+		sync_suricata_package_config();
+		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
+		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
+		header( 'Cache-Control: no-store, no-cache, must-revalidate' );
+		header( 'Cache-Control: post-check=0, pre-check=0', false );
+		header( 'Pragma: no-cache' );
+		header("Location: /suricata/suricata_interfaces.php");
+		exit;
+	}
 
+	// Validate inputs
 	if (isset($_POST['stats_upd_interval']) && !is_numericint($_POST['stats_upd_interval']))
 		$input_errors[] = gettext("The value for Stats Update Interval must contain only digits and evaluate to an integer.");
 
@@ -224,16 +249,6 @@ if ($_POST["save"] && !$input_errors) {
 	if (!empty($_POST['inspect_recursion_limit']) && !is_numeric($_POST['inspect_recursion_limit']))
 		$input_errors[] = gettext("The value for Inspect Recursion Limit can either be blank or contain only digits evaluating to an integer greater than or equal to 0.");
 
-	/* See if assigned interface is already in use */
-	if (isset($_POST['interface'])) {
-		foreach ($a_rule as $k => $v) {
-			if (($v['interface'] == $_POST['interface']) && ($id <> $k)) {
-				$input_errors[] = gettext("The '{$_POST['interface']}' interface is already assigned to another Suricata instance.");
-				break;
-			}
-		}
-	}
-
 	// if no errors write to suricata.yaml
 	if (!$input_errors) {
 		$natent = $a_rule[$id];
@@ -250,6 +265,7 @@ if ($_POST["save"] && !$input_errors) {
 		if ($_POST['enable_http_log'] == "on") { $natent['enable_http_log'] = 'on'; }else{ $natent['enable_http_log'] = 'off'; }
 		if ($_POST['append_http_log'] == "on") { $natent['append_http_log'] = 'on'; }else{ $natent['append_http_log'] = 'off'; }
 		if ($_POST['enable_tls_log'] == "on") { $natent['enable_tls_log'] = 'on'; }else{ $natent['enable_tls_log'] = 'off'; }
+		if ($_POST['http_log_extended'] == "on") { $natent['http_log_extended'] = 'on'; }else{ $natent['http_log_extended'] = 'off'; }
 		if ($_POST['tls_log_extended'] == "on") { $natent['tls_log_extended'] = 'on'; }else{ $natent['tls_log_extended'] = 'off'; }
 		if ($_POST['enable_pcap_log'] == "on") { $natent['enable_pcap_log'] = 'on'; }else{ $natent['enable_pcap_log'] = 'off'; }
 		if ($_POST['enable_json_file_log'] == "on") { $natent['enable_json_file_log'] = 'on'; }else{ $natent['enable_json_file_log'] = 'off'; }
@@ -257,6 +273,7 @@ if ($_POST["save"] && !$input_errors) {
 		if ($_POST['enable_tracked_files_magic'] == "on") { $natent['enable_tracked_files_magic'] = 'on'; }else{ $natent['enable_tracked_files_magic'] = 'off'; }
 		if ($_POST['enable_tracked_files_md5'] == "on") { $natent['enable_tracked_files_md5'] = 'on'; }else{ $natent['enable_tracked_files_md5'] = 'off'; }
 		if ($_POST['enable_file_store'] == "on") { $natent['enable_file_store'] = 'on'; }else{ $natent['enable_file_store'] = 'off'; }
+		if ($_POST['enable_eve_log'] == "on") { $natent['enable_eve_log'] = 'on'; }else{ $natent['enable_eve_log'] = 'off'; }
 		if ($_POST['max_pending_packets']) $natent['max_pending_packets'] = $_POST['max_pending_packets']; else unset($natent['max_pending_packets']);
 		if ($_POST['inspect_recursion_limit'] >= '0') $natent['inspect_recursion_limit'] = $_POST['inspect_recursion_limit']; else unset($natent['inspect_recursion_limit']);
 		if ($_POST['detect_eng_profile']) $natent['detect_eng_profile'] = $_POST['detect_eng_profile']; else unset($natent['detect_eng_profile']);
@@ -270,8 +287,23 @@ if ($_POST["save"] && !$input_errors) {
 		if ($_POST['externallistname']) $natent['externallistname'] =  $_POST['externallistname']; else unset($natent['externallistname']);
 		if ($_POST['suppresslistname']) $natent['suppresslistname'] =  $_POST['suppresslistname']; else unset($natent['suppresslistname']);
 		if ($_POST['alertsystemlog'] == "on") { $natent['alertsystemlog'] = 'on'; }else{ $natent['alertsystemlog'] = 'off'; }
+		if ($_POST['alertsystemlog_facility']) $natent['alertsystemlog_facility'] = $_POST['alertsystemlog_facility'];
+		if ($_POST['alertsystemlog_priority']) $natent['alertsystemlog_priority'] = $_POST['alertsystemlog_priority'];
+		if ($_POST['enable_dns_log'] == "on") { $natent['enable_dns_log'] = 'on'; }else{ $natent['enable_dns_log'] = 'off'; }
+		if ($_POST['append_dns_log'] == "on") { $natent['append_dns_log'] = 'on'; }else{ $natent['append_dns_log'] = 'off'; }
+		if ($_POST['enable_eve_log'] == "on") { $natent['enable_eve_log'] = 'on'; }else{ $natent['enable_eve_log'] = 'off'; }
+		if ($_POST['eve_output_type']) $natent['eve_output_type'] = $_POST['eve_output_type'];
+		if ($_POST['eve_systemlog_facility']) $natent['eve_systemlog_facility'] = $_POST['eve_systemlog_facility'];
+		if ($_POST['eve_systemlog_priority']) $natent['eve_systemlog_priority'] = $_POST['eve_systemlog_priority'];
+		if ($_POST['eve_log_alerts'] == "on") { $natent['eve_log_alerts'] = 'on'; }else{ $natent['eve_log_alerts'] = 'off'; }
+		if ($_POST['eve_log_http'] == "on") { $natent['eve_log_http'] = 'on'; }else{ $natent['eve_log_http'] = 'off'; }
+		if ($_POST['eve_log_dns'] == "on") { $natent['eve_log_dns'] = 'on'; }else{ $natent['eve_log_dns'] = 'off'; }
+		if ($_POST['eve_log_tls'] == "on") { $natent['eve_log_tls'] = 'on'; }else{ $natent['eve_log_tls'] = 'off'; }
+		if ($_POST['eve_log_files'] == "on") { $natent['eve_log_files'] = 'on'; }else{ $natent['eve_log_files'] = 'off'; }
+		if ($_POST['eve_log_ssh'] == "on") { $natent['eve_log_ssh'] = 'on'; }else{ $natent['eve_log_ssh'] = 'off'; }
 		if ($_POST['delayed_detect'] == "on") { $natent['delayed_detect'] = 'on'; }else{ $natent['delayed_detect'] = 'off'; }
-		if ($_POST['configpassthru']) $natent['configpassthru'] = base64_encode($_POST['configpassthru']); else unset($natent['configpassthru']);
+		if ($_POST['intf_promisc_mode'] == "on") { $natent['intf_promisc_mode'] = 'on'; }else{ $natent['intf_promisc_mode'] = 'off'; }
+		if ($_POST['configpassthru']) $natent['configpassthru'] = base64_encode(str_replace("\r\n", "\n", $_POST['configpassthru'])); else unset($natent['configpassthru']);
 
 		$if_real = get_real_interface($natent['interface']);
 		if (isset($id) && $a_rule[$id] && $action == '') {
@@ -292,9 +324,12 @@ if ($_POST["save"] && !$input_errors) {
 			$a_rule[$id] = $natent;
 		}
 		elseif (strcasecmp($action, 'dup') == 0) {
-			// Duplicating a new interface, so set flag to build new rules
+			// Duplicating an existing interface to a new interface, so set flag to build new rules
 			$rebuild_rules = true;
 
+			// Duplicating an interface, so need to generate a new UUID for the cloned interface
+			$natent['uuid'] = suricata_generate_id();
+
 			// Add the new duplicated interface configuration to the [rule] array in config
 			$a_rule[] = $natent;
 		}
@@ -330,7 +365,6 @@ if ($_POST["save"] && !$input_errors) {
 			$natent['flow_icmp_emerg_established_timeout'] = '100';
 
 			$natent['stream_memcap'] = '33554432';
-			$natent['stream_max_sessions'] = '262144';
 			$natent['stream_prealloc_sessions'] = '32768';
 			$natent['reassembly_memcap'] = '67108864';
 			$natent['reassembly_depth'] = '1048576';
@@ -339,8 +373,24 @@ if ($_POST["save"] && !$input_errors) {
 			$natent['enable_midstream_sessions'] = 'off';
 			$natent['enable_async_sessions'] = 'off';
 			$natent['delayed_detect'] = 'off';
+			$natent['intf_promisc_mode'] = 'on';
 
 			$natent['asn1_max_frames'] = '256';
+			$natent['dns_global_memcap'] = "16777216";
+			$natent['dns_state_memcap'] = "524288";
+			$natent['dns_request_flood_limit'] = "500";
+			$natent['http_parser_memcap'] = "67108864";
+			$natent['dns_parser_udp'] = "yes";
+			$natent['dns_parser_tcp'] = "yes";
+			$natent['http_parser'] = "yes";
+			$natent['tls_parser'] = "yes";
+			$natent['smtp_parser'] = "yes";
+			$natent['imap_parser'] = "detection-only";
+			$natent['ssh_parser'] = "yes";
+			$natent['ftp_parser'] = "yes";
+			$natent['dcerpc_parser'] = "yes";
+			$natent['smb_parser'] = "yes";
+			$natent['msn_parser'] = "detection-only";
 
 			$default = array( "name" => "default", "bind_to" => "all", "policy" => "bsd" );
 			if (!is_array($natent['host_os_policy']['item']))
@@ -349,13 +399,14 @@ if ($_POST["save"] && !$input_errors) {
 
 			$default = array( "name" => "default", "bind_to" => "all", "personality" => "IDS", 
 					  "request-body-limit" => 4096, "response-body-limit" => 4096, 
-					  "double-decode-path" => "no", "double-decode-query" => "no" );
+					  "double-decode-path" => "no", "double-decode-query" => "no", 
+					  "uri-include-all" => "no" );
 			if (!is_array($natent['libhtp_policy']['item']))
 				$natent['libhtp_policy']['item'] = array();
 			$natent['libhtp_policy']['item'][] = $default;
 
 			// Enable the basic default rules for the interface
-			$natent['rulesets'] = "decoder-events.rules||files.rules||http-events.rules||smtp-events.rules||stream-events.rules||tls-events.rules";
+			$natent['rulesets'] = "decoder-events.rules||dns-events.rules||files.rules||http-events.rules||smtp-events.rules||stream-events.rules||tls-events.rules";
 
 			// Adding a new interface, so set flag to build new rules
 			$rebuild_rules = true;
@@ -369,7 +420,7 @@ if ($_POST["save"] && !$input_errors) {
 			suricata_stop($natent, $if_real);
 
 		// Save configuration changes
-		write_config();
+		write_config("Suricata pkg: modified interface configuration for " . convert_friendly_interface_to_friendly_descr($natent['interface']));
 
 		// Update suricata.conf and suricata.sh files for this interface
 		sync_suricata_package_config();
@@ -407,18 +458,21 @@ if ($savemsg) {
 <input name="action" type="hidden" value="<?=$action;?>"/>
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
     $tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td class="tabnavtbl">';
@@ -436,6 +490,7 @@ if ($savemsg) {
 </td></tr>
 <tr><td><div id="mainarea">
 <table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 		<td colspan="2" class="listtopic"><?php echo gettext("General Settings"); ?></td>
 	</tr>
@@ -471,9 +526,57 @@ if ($savemsg) {
 </tr>
 	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Send Alerts to System Log"); ?></td>
-		<td width="78%" class="vtable"><input name="alertsystemlog" type="checkbox" value="on" <?php if ($pconfig['alertsystemlog'] == "on") echo "checked"; ?>/>
-			<?php echo gettext("Suricata will send Alerts to the firewall's system log."); ?></td>
+		<td width="78%" class="vtable"><input name="alertsystemlog" type="checkbox" value="on" onclick="toggle_system_log();" <?php if ($pconfig['alertsystemlog'] == "on") echo "checked"; ?>/>
+			<?php echo gettext("Suricata will send Alerts from this interface to the firewall's system log."); ?></td>
+	</tr>
+	<tbody id="alertsystemlog_rows">
+		<tr>
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Facility"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="alertsystemlog_facility" id="alertsystemlog_facility" class="formselect">
+				<?php
+					$log_facility = array(  "auth", "authpriv", "daemon", "kern", "security", "syslog", "user", "local0",
+								"local1", "local2", "local3", "local4", "local5", "local6", "local7" );
+					foreach ($log_facility as $facility) {
+						$selected = "";
+						if ($facility == $pconfig['alertsystemlog_facility'])
+							$selected = " selected";
+						echo "<option value='{$facility}'{$selected}>" . $facility . "</option>\n";
+					}
+				?></select>&nbsp;&nbsp;
+				<?php echo gettext("Select system log Facility to use for reporting.  Default is ") . "<strong>" . gettext("local1") . "</strong>."; ?>
+			</td>
+		</tr>
+		<tr>
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Priority"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="alertsystemlog_priority" id="alertsystemlog_priority" class="formselect">
+				<?php
+					$log_priority = array( "emerg", "crit", "alert", "err", "warning", "notice", "info" );
+					foreach ($log_priority as $priority) {
+						$selected = "";
+						if ($priority == $pconfig['alertsystemlog_priority'])
+							$selected = " selected";
+						echo "<option value='{$priority}'{$selected}>" . $priority . "</option>\n";
+					}
+				?></select>&nbsp;&nbsp;
+				<?php echo gettext("Select system log Priority (Level) to use for reporting.  Default is ") . "<strong>" . gettext("notice") . "</strong>."; ?>
+			</td>
+		</tr>
+	</tbody>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable DNS Log"); ?></td>
+		<td width="78%" class="vtable"><input name="enable_dns_log" type="checkbox" value="on" <?php if ($pconfig['enable_dns_log'] == "on") echo "checked"; ?> 
+			onClick="toggle_dns_log();" id="enable_dns_log"/>
+			<?php echo gettext("Suricata will log DNS requests and replies for the interface.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>."; ?>
+		</td>
+	</tr>
+	<tr id="dns_log_append_row">
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Append DNS Log"); ?></td>
+		<td width="78%" class="vtable"><input name="append_dns_log" type="checkbox" value="on" <?php if ($pconfig['append_dns_log'] == "on") echo "checked"; ?>/>
+			<?php echo gettext("Suricata will append-to instead of clearing DNS log file when restarting.  Default is ") . "<strong>" . gettext("Checked") . "</strong>."; ?></td>
 	</tr>
+
 	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable Stats Log"); ?></td>
 		<td width="78%" class="vtable"><input name="enable_stats_log" type="checkbox" value="on" <?php if ($pconfig['enable_stats_log'] == "on") echo "checked"; ?> 
@@ -505,6 +608,11 @@ if ($savemsg) {
 		<td width="78%" class="vtable"><input name="append_http_log" type="checkbox" value="on" <?php if ($pconfig['append_http_log'] == "on") echo "checked"; ?>/>
 			<?php echo gettext("Suricata will append-to instead of clearing HTTP log file when restarting.  Default is ") . "<strong>" . gettext("Checked") . "</strong>."; ?></td>
 	</tr>
+	<tr id="http_log_extended_row">
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Log Extended HTTP Info"); ?></td>
+		<td width="78%" class="vtable"><input name="http_log_extended" type="checkbox" value="on" <?php if ($pconfig['http_log_extended'] == "on") echo "checked"; ?>/>
+			<?php echo gettext("Suricata will log extended HTTP information.  Default is ") . "<strong>" . gettext("Checked") . "</strong>."; ?></td>
+	</tr>
 	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable TLS Log"); ?></td>
 		<td width="78%" class="vtable"><input name="enable_tls_log" type="checkbox" value="on" <?php if ($pconfig['enable_tls_log'] == "on") echo "checked"; ?> 
@@ -572,6 +680,99 @@ if ($savemsg) {
 			<?php echo gettext("Enter maximum number of packet log files to maintain.  Default is ") . "<strong>" . 
 			gettext("1000") . "</strong>."; ?><br/><br/><?php echo gettext("When the number of packet log files reaches the set limit, the oldest file will be overwritten.") ?></td>
 	</tr>
+	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("EVE JSON Log"); ?></td>
+		<td width="78%" class="vtable"><input name="enable_eve_log" id="enable_eve_log" type="checkbox" value="on" <?php if ($pconfig['enable_eve_log'] == "on") echo "checked"; ?> 
+			onClick="toggle_eve_log()"/>
+			<?php echo gettext("Suricata will output selected info in JSON format to a single file or to syslog.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>."; ?>
+			<div id="file_eve_warning" style="display: none;"><br/><span class="red"><strong><?php echo gettext("Warning: ") . "</strong></span>" . 
+			gettext("This can consume a significant amount of disk space when enabled!"); ?></div>
+		</td>
+	</tr>
+	<tbody id="eve_log_option_rows">
+		<tr>
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("EVE Output Type"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="eve_output_type" class="formselect" id="eve_output_type"  onChange="eveOutSelect();" >
+				<?php
+					foreach (array("file", "syslog") as $btype) {
+						if ($btype == $pconfig['eve_output_type'])
+							echo "<option value='{$btype}' selected>";
+						else
+							echo "<option value='{$btype}'>";
+						echo htmlspecialchars($btype) . '</option>';
+					}
+				?> 
+				</select>&nbsp;&nbsp;
+				<?php echo gettext("Select EVE log output destination."); ?><br/>
+				<span class="red"><?php echo gettext("Hint:") . "</span>&nbsp;" . gettext("Choosing FILE is suggested, and it is the default value."); ?><br/>
+			</td>
+		</tr>
+		<tr id="eve_systemlog_facility_row">
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("EVE Syslog Facility"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="eve_systemlog_facility" id="eve_systemlog_facility" class="formselect">
+				<?php
+					$log_facility = array(  "auth", "authpriv", "daemon", "kern", "security", "syslog", "user", "local0",
+								"local1", "local2", "local3", "local4", "local5", "local6", "local7" );
+					foreach ($log_facility as $facility) {
+						$selected = "";
+						if ($facility == $pconfig['eve_systemlog_facility'])
+							$selected = " selected";
+						echo "<option value='{$facility}'{$selected}>" . $facility . "</option>\n";
+					}
+				?></select>&nbsp;&nbsp;
+				<?php echo gettext("Select system log Facility to use for reporting by EVE.  Default is ") . "<strong>" . gettext("local1") . "</strong>."; ?>
+			</td>
+		</tr>
+		<tr id="eve_systemlog_priority_row">
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("EVE Syslog Priority"); ?></td>
+			<td width="78%" class="vtable">
+				<select name="eve_systemlog_priority" id="eve_systemlog_priority" class="formselect">
+				<?php
+					$log_priority = array( "emerg", "crit", "alert", "err", "warning", "notice", "info" );
+					foreach ($log_priority as $priority) {
+						$selected = "";
+						if ($priority == $pconfig['eve_systemlog_priority'])
+							$selected = " selected";
+						echo "<option value='{$priority}'{$selected}>" . $priority . "</option>\n";
+					}
+				?></select>&nbsp;&nbsp;
+				<?php echo gettext("Select system log Priority (Level) to use for reporting by EVE.  Default is ") . "<strong>" . gettext("notice") . "</strong>."; ?>
+			</td>
+		</tr>
+		<tr>
+			<td width="22%" valign="top" class="vncell"><?php echo gettext("EVE Logged Info"); ?></td>
+			<td width="78%" class="vtable"><?php echo gettext("Choose the information to log via EVE JSON output.  Default is ") . "<strong>" . gettext("All Checked") . "</strong>."; ?><br/>
+				<table width="100%" cellpadding="0" cellspacing="0" border="0">
+					<tbody>
+					<tr>
+						<td class="vexpl"><input name="eve_log_alerts" id="eve_log_alerts" type="checkbox" value="on" 
+							<?php if ($pconfig['eve_log_alerts'] == "on") echo "checked"; ?>/>Alerts
+						</td>
+						<td class="vexpl"><input name="eve_log_http" id="eve_log_http" type="checkbox" value="on" 
+							<?php if ($pconfig['eve_log_http'] == "on") echo "checked"; ?>/>HTTP Traffic
+						</td>
+						<td class="vexpl"><input name="eve_log_dns" id="eve_log_dns" type="checkbox" value="on" 
+							<?php if ($pconfig['eve_log_dns'] == "on") echo "checked"; ?>/>DNS Requests/Replies
+						</td>
+					</tr>
+					<tr>
+						<td class="vexpl"><input name="eve_log_tls" id="eve_log_tls" type="checkbox" value="on" onClick="toggle_eve_tls();" 
+							<?php if ($pconfig['eve_log_tls'] == "on") echo "checked"; ?>/>TLS Handshakes
+						</td>
+						<td class="vexpl"><input name="eve_log_files" id="eve_log_files" type="checkbox" value="on" 
+							<?php if ($pconfig['eve_log_files'] == "on") echo "checked"; ?>/>Tracked Files
+						</td>
+						<td class="vexpl"><input name="eve_log_ssh" id="eve_log_ssh" type="checkbox" value="on" 
+							<?php if ($pconfig['eve_log_ssh'] == "on") echo "checked"; ?>/>SSH Handshakes
+						</td>
+					</tr>
+					</tbody>
+				</table>
+			</td>
+		</tr>
+	</tbody>
 <tr>
 	<td colspan="2" class="listtopic"><?php echo gettext("Alert Settings"); ?></td>
 </tr>
@@ -604,7 +805,7 @@ if ($savemsg) {
 			?>
 			</select>&nbsp;&nbsp;
 			<?php echo gettext("Select which IP extracted from the packet you wish to block."); ?><br/>
-			<span class="red"><?php echo gettext("Hint:") . "</span>&nbsp;" . gettext("Choosing BOTH is suggested, and it is the default value."); ?></span><br/></td>
+			<span class="red"><?php echo gettext("Hint:") . "</span>&nbsp;" . gettext("Choosing BOTH is suggested, and it is the default value."); ?><br/>
 		</td>
 	</tr>
 <tr>
@@ -643,8 +844,8 @@ if ($savemsg) {
 		<td width="78%" class="vtable">
 			<select name="mpm_algo" class="formselect" id="mpm_algo">
 				<?php
-					$interfaces2 = array('ac' => 'AC', 'ac-gfbs' => 'AC-GFBS', 'ac-bs' => 'AC-BS',
-							     'b2g' => 'B2G', 'b3g' => 'B3G', 'wumanber' => 'WUMANBER');
+					$interfaces2 = array('ac' => 'AC', 'ac-gfbs' => 'AC-GFBS', 'b2g' => 'B2G',
+							     'b2gc' => 'B2GC', 'b2gm' => 'B2GM', 'b3g' => 'B3G', 'wumanber' => 'WUMANBER');
 					foreach ($interfaces2 as $iface2 => $ifacename2): ?>
 					<option value="<?=$iface2;?>"
 					<?php if ($iface2 == $pconfig['mpm_algo']) echo "selected"; ?>>
@@ -691,6 +892,14 @@ if ($savemsg) {
 			"<strong>" . gettext("Not Checked") . "</strong>."; ?></td>
 	</tr>
 	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("Promiscuous Mode"); ?></td>
+		<td width="78%" class="vtable">
+			<input name="intf_promisc_mode" id="intf_promisc_mode" type="checkbox" value="on"
+			<?php if ($pconfig['intf_promisc_mode'] == "on") echo " checked"; ?>/>
+			<?php echo gettext("Suricata will place the monitored interface in promiscuous mode when checked.  Default is ") . 
+			"<strong>" . gettext("Checked") . "</strong>."; ?></td>
+	</tr>
+	<tr>
 		<td colspan="2" class="listtopic"><?php echo gettext("Networks " . "Suricata Should Inspect and Protect"); ?></td>
 	</tr>
 	<tr>
@@ -699,9 +908,9 @@ if ($savemsg) {
 			<select name="homelistname" class="formselect" id="homelistname">
 				<?php
 					echo "<option value='default' >default</option>";
-					/* find whitelist names and filter by type */
-					if (is_array($suricataglob['whitelist']['item'])) {
-						foreach ($suricataglob['whitelist']['item'] as $value) {
+					/* find Pass List names and filter by type */
+					if (is_array($suricataglob['passlist']['item'])) {
+						foreach ($suricataglob['passlist']['item'] as $value) {
 							$ilistname = $value['name'];
 							if ($ilistname == $pconfig['homelistname'])
 								echo "<option value='$ilistname' selected>";
@@ -716,12 +925,13 @@ if ($savemsg) {
 			onclick="viewList('<?=$id;?>','homelistname','homenet')" id="btnHomeNet" 
 			title="<?php echo gettext("Click to view currently selected Home Net contents"); ?>"/>
 			<br/>
-			<span class="vexpl"><?php echo gettext("Choose the Home Net you want this interface to use."); ?></span>
+			<span class="vexpl"><?php echo gettext("Choose the Home Net you want this interface to use.  Most users should choose 'default'."); ?></span>
 		 	<br/><br/>
 			<span class="red"><?php echo gettext("Note:"); ?></span>&nbsp;<?php echo gettext("Default Home " .
 			"Net adds only local networks, WAN IPs, Gateways, VPNs and VIPs."); ?><br/>
 			<span class="red"><?php echo gettext("Hint:"); ?></span>&nbsp;<?php echo gettext("Create an Alias to hold a list of " .
-			"friendly IPs that the firewall cannot see or to customize the default Home Net."); ?><br/>
+			"friendly IPs that the firewall cannot see or to customize the default Home Net.  Assign the Alias to a Pass List, and " . 
+			"then assign that Pass List to Home Net."); ?><br/>
 		</td>
 	</tr>
 	<tr>
@@ -730,9 +940,9 @@ if ($savemsg) {
 			<select name="externallistname" class="formselect" id="externallistname">
 				<?php
 					echo "<option value='default' >default</option>";
-					/* find whitelist names and filter by type */
-					if (is_array($suricataglob['whitelist']['item'])) {
-						foreach ($suricataglob['whitelist']['item'] as $value) {
+					/* find Pass List names and filter by type */
+					if (is_array($suricataglob['passlist']['item'])) {
+						foreach ($suricataglob['passlist']['item'] as $value) {
 							$ilistname = $value['name'];
 							if ($ilistname == $pconfig['externallistname'])
 								echo "<option value='$ilistname' selected>";
@@ -742,7 +952,11 @@ if ($savemsg) {
 						}
 					}
 				?>
-			</select>&nbsp;&nbsp;
+			</select>
+			&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="button" class="formbtns" value="View List"  
+			onclick="viewList('<?=$id;?>','externallistname','externalnet')" id="btnExternalNet" 
+			title="<?php echo gettext("Click to view currently selected External Net contents"); ?>"/>
+			<br/>
 			<?php echo gettext("Choose the External Net you want this interface " .
 			"to use."); ?>&nbsp;<br/><br/>
 			<span class="red"><?php echo gettext("Note:"); ?></span>&nbsp;<?php echo gettext("Default " .
@@ -772,7 +986,7 @@ if ($savemsg) {
 			&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="button" class="formbtns" value="View List" onclick="viewList('<?=$id;?>','passlistname','passlist')" 
 			id="btnPasslist" title="<?php echo gettext("Click to view currently selected Pass List contents"); ?>"/>
 			<br/>
-			<?php echo gettext("Choose the Pass List you want this interface to use."); ?> <br/><br/>
+			<?php echo gettext("Choose the Pass List you want this interface to use.  Addresses in a Pass List are never blocked."); ?> <br/><br/>
 			<span class="red"><?php echo gettext("Note:"); ?></span>&nbsp;<?php echo gettext("This option will only be used when block offenders is on."); ?><br/>
 			<span class="red"><?php echo gettext("Hint:"); ?></span>&nbsp;<?php echo gettext("Default " .
 			"Pass List adds local networks, WAN IPs, Gateways, VPNs and VIPs.  Create an Alias to customize."); ?>
@@ -828,14 +1042,32 @@ if ($savemsg) {
 		gettext("Please save your settings before you attempt to start Suricata."); ?>	
 	</td>
 </tr>
+</tbody>
 </table>
 </div>
 </td></tr>
+</tbody>
 </table>
 </form>
 
 <script language="JavaScript">
 
+function toggle_system_log() {
+	var endis = !(document.iform.alertsystemlog.checked);
+	if (endis)
+		document.getElementById("alertsystemlog_rows").style.display="none";
+	else
+		document.getElementById("alertsystemlog_rows").style.display="";
+}
+
+function toggle_dns_log() {
+	var endis = !(document.iform.enable_dns_log.checked);
+	if (endis)
+		document.getElementById("dns_log_append_row").style.display="none";
+	else
+		document.getElementById("dns_log_append_row").style.display="table-row";
+}
+
 function enable_blockoffenders() {
 	var endis = !(document.iform.blockoffenders.checked);
 	document.iform.blockoffenderskill.disabled=endis;
@@ -860,18 +1092,27 @@ function toggle_stats_log() {
 
 function toggle_http_log() {
 	var endis = !(document.iform.enable_http_log.checked);
-	if (endis)
+	if (endis) {
 		document.getElementById("http_log_append_row").style.display="none";
-	else
+		document.getElementById("http_log_extended_row").style.display="none";
+	}
+	else {
 		document.getElementById("http_log_append_row").style.display="table-row";
+		document.getElementById("http_log_extended_row").style.display="table-row";
+	}
 }
 
 function toggle_tls_log() {
 	var endis = !(document.iform.enable_tls_log.checked);
 	if (endis)
 		document.getElementById("tls_log_extended_row").style.display="none";
-	else
+	else {
 		document.getElementById("tls_log_extended_row").style.display="table-row";
+		if (document.iform.enable_eve_log.checked && document.iform.eve_log_tls.checked) {
+			alert('Only one TLS log instance permitted...removing TLS log from EVE JSON output in order to enable standalone TLS logging.');
+			document.iform.eve_log_tls.checked = false;
+		}
+	}
 }
 
 function toggle_json_file_log() {
@@ -912,6 +1153,25 @@ function toggle_pcap_log() {
 	}
 }
 
+function toggle_eve_log() {
+	var endis = !(document.iform.enable_eve_log.checked);
+	if (endis) {
+		document.getElementById("eve_log_option_rows").style.display = "none";
+	}
+	else {
+		document.getElementById("eve_log_option_rows").style.display = "";
+		if (document.iform.enable_tls_log.checked)
+			document.iform.eve_log_tls.checked = false;
+	}
+}
+
+function toggle_eve_tls() {
+	if (document.iform.enable_tls_log.checked) {
+		alert('Only one TLS log instance permitted...removing standalone TLS output in order to add EVE JSON TLS output.');
+		document.iform.enable_tls_log.checked = false;
+	}
+}
+
 function enable_change(enable_change) {
 	endis = !(document.iform.enable.checked || enable_change);
 	// make sure a default answer is called if this is invoked.
@@ -921,6 +1181,7 @@ function enable_change(enable_change) {
 	document.iform.append_stats_log.disabled = endis;
 	document.iform.enable_http_log.disabled = endis;
 	document.iform.append_http_log.disabled = endis;
+	document.iform.http_log_extended.disabled = endis;
 	document.iform.enable_tls_log.disabled = endis;
 	document.iform.tls_log_extended.disabled = endis;
 	document.iform.enable_json_file_log.disabled = endis;
@@ -931,6 +1192,14 @@ function enable_change(enable_change) {
 	document.iform.enable_pcap_log.disabled = endis;
 	document.iform.max_pcap_log_size.disabled = endis;
 	document.iform.max_pcap_log_files.disabled = endis;
+	document.iform.eve_output_type.disabled = endis;
+	document.iform.enable_eve_log.disabled = endis;
+	document.iform.eve_log_alerts.disabled = endis;
+	document.iform.eve_log_http.disabled = endis;
+	document.iform.eve_log_dns.disabled = endis;
+	document.iform.eve_log_tls.disabled = endis;
+	document.iform.eve_log_files.disabled = endis;
+	document.iform.eve_log_ssh.disabled = endis;
 	document.iform.max_pending_packets.disabled = endis;
 	document.iform.detect_eng_profile.disabled = endis;
 	document.iform.mpm_algo.disabled = endis;
@@ -948,8 +1217,9 @@ function enable_change(enable_change) {
 	document.iform.btnHomeNet.disabled=endis;
 	document.iform.btnPasslist.disabled=endis;
 	document.iform.btnSuppressList.disabled=endis;
-}	document.iform.delayed_detect.disabled=endis;
-
+	document.iform.delayed_detect.disabled=endis;
+	document.iform.intf_promisc_mode.disabled=endis;
+}
 
 function wopen(url, name, w, h) {
 	// Fudge factors for window decoration space.
@@ -970,6 +1240,18 @@ function getSelectedValue(elemID) {
 	return ctrl.options[ctrl.selectedIndex].value;
 }
 
+function eveOutSelect() {
+	var ctrl = document.getElementById("eve_output_type");
+	if (ctrl.options[ctrl.selectedIndex].value == 'syslog') {
+		document.getElementById("eve_systemlog_facility_row").style.display = "table-row";
+		document.getElementById("eve_systemlog_priority_row").style.display = "table-row";
+	}
+	else {
+		document.getElementById("eve_systemlog_facility_row").style.display = "none";
+		document.getElementById("eve_systemlog_priority_row").style.display = "none";
+	}
+}
+
 function viewList(id, elemID, elemType) {
 	if (typeof elemType == "undefined") {
 		elemType = "passlist";
@@ -982,12 +1264,16 @@ function viewList(id, elemID, elemType) {
 
 enable_change(false);
 //enable_blockoffenders();
+toggle_system_log();
+toggle_dns_log();
 toggle_stats_log();
 toggle_http_log();
 toggle_tls_log();
 toggle_json_file_log();
 toggle_file_store();
 toggle_pcap_log();
+toggle_eve_log();
+eveOutSelect();
 
 </script>
 <?php include("fend.inc"); ?>
diff --git a/config/suricata/suricata_libhtp_policy_engine.php b/config/suricata/suricata_libhtp_policy_engine.php
index 7e6ffd6d..248f4c74 100644
--- a/config/suricata/suricata_libhtp_policy_engine.php
+++ b/config/suricata/suricata_libhtp_policy_engine.php
@@ -60,12 +60,14 @@
 	resp_body_limit --> Response Body Limit size
 	enable_double_decode_path --> double-decode path part of URI
 	enable_double_decode_query --> double-decode query string part of URI
+	enable_uri_include_all --> inspect all of URI
 	save_libhtp_policy --> Submit button for save operation and exit
 	cancel_libhtp_policy --> Submit button to cancel operation and exit
  **************************************************************************************/
 ?>
 
 <table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 		<td colspan="2" valign="middle" class="listtopic"><?php echo gettext("Suricata Target-Based HTTP Server Policy Configuration"); ?></td>
 	</tr>
@@ -73,7 +75,7 @@
 		<td valign="top" class="vncell"><?php echo gettext("Engine Name"); ?></td>
 		<td class="vtable">
 			<input name="policy_name" type="text" class="formfld unknown" id="policy_name" size="25" maxlength="25" 
-			value="<?=htmlspecialchars($pengcfg['name']);?>"<?php if (htmlspecialchars($pengcfg['name']) == "default") echo "readonly";?>>&nbsp;
+			value="<?=htmlspecialchars($pengcfg['name']);?>"<?php if (htmlspecialchars($pengcfg['name']) == " default") echo " readonly";?>>&nbsp;
 			<?php if (htmlspecialchars($pengcfg['name']) <> "default") 
 					echo gettext("Name or description for this engine.  (Max 25 characters)");
 				else
@@ -87,6 +89,7 @@
 		<td class="vtable">
 		<?php if ($pengcfg['name'] <> "default") : ?>
 			<table width="95%" border="0" cellpadding="2" cellspacing="0">
+				<tbody>
 				<tr>
 					<td class="vexpl"><input name="policy_bind_to" type="text" class="formfldalias" id="policy_bind_to" size="32" 
 					value="<?=htmlspecialchars($pengcfg['bind_to']);?>" title="<?=trim(filter_expand_alias($pengcfg['bind_to']));?>" autocomplete="off">&nbsp;
@@ -97,6 +100,7 @@
 				<tr>
 					<td class="vexpl" colspan="2"><?php echo gettext("This policy will apply for packets with destination addresses contained within this IP List.");?></td>
 				</tr>
+				</tbody>
 			</table>
 			<br/><span class="red"><strong><?php echo gettext("Note: ") . "</strong></span>" . gettext("Supplied value must be a pre-configured Alias or the keyword 'all'.");?>
 		<?php else : ?>
@@ -112,7 +116,7 @@
 		<td width="78%" class="vtable">
 			<select name="personality" class="formselect" id="personality">
 			<?php
-			$profile = array( 'Apache', 'Apache_2_2', 'Generic', 'IDS', 'IIS_4_0', 'IIS_5_0', 'IIS_5_1', 'IIS_6_0', 'IIS_7_0', 'IIS_7_5', 'Minimal' );
+			$profile = array( 'Apache_2', 'Generic', 'IDS', 'IIS_4_0', 'IIS_5_0', 'IIS_5_1', 'IIS_6_0', 'IIS_7_0', 'IIS_7_5', 'Minimal' );
 			foreach ($profile as $val): ?>
 			<option value="<?=$val;?>" 
 			<?php if ($val == $pengcfg['personality']) echo "selected"; ?>>
@@ -120,7 +124,7 @@
 				<?php endforeach; ?>
 			</select>&nbsp;&nbsp;<?php echo gettext("Choose the web server personality appropriate for the protected hosts.  The default is ") . 
 			"<strong>" . gettext("IDS") . "</strong>"; ?>.<br/><br/>
-			<?php echo gettext("Available web server personality targets are:  Apache, Apache 2.2, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0, IIS_7_0, IIS_7_5 and Minimal."); ?><br/>
+			<?php echo gettext("Available web server personality targets are:  Apache 2, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0, IIS_7_0, IIS_7_5 and Minimal."); ?><br/>
 		</td>
 	</tr>
 	<tr>
@@ -155,15 +159,22 @@
 	</tr>
 	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Double-Decode Path"); ?></td>
-		<td width="78%" class="vtable"><input name="enable_double_decode_path" type="checkbox" value="yes" <?php if ($pengcfg['double-decode-path'] == "yes") echo "checked"; ?>>
+		<td width="78%" class="vtable"><input name="enable_double_decode_path" type="checkbox" value="yes" <?php if ($pengcfg['double-decode-path'] == "yes") echo " checked"; ?>>
 			<?php echo gettext("Suricata will double-decode path section of the URI.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>."; ?></td>
 	</tr>
 	<tr>
 		<td width="22%" valign="top" class="vncell"><?php echo gettext("Double-Decode Query"); ?></td>
-		<td width="78%" class="vtable"><input name="enable_double_decode_query" type="checkbox" value="yes" <?php if ($pengcfg['double-decode-query'] == "yes") echo "checked"; ?>>
+		<td width="78%" class="vtable"><input name="enable_double_decode_query" type="checkbox" value="yes" <?php if ($pengcfg['double-decode-query'] == "yes") echo " checked"; ?>>
 			<?php echo gettext("Suricata will double-decode query string section of the URI.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>."; ?></td>
 	</tr>
 	<tr>
+		<td width="22%" valign="top" class="vncell"><?php echo gettext("URI Include-All"); ?></td>
+		<td width="78%" class="vtable"><input name="enable_uri_include_all" type="checkbox" value="yes" <?php if ($pengcfg['uri-include-all'] == "yes") echo " checked"; ?>>
+			<?php echo gettext("Include all parts of the URI.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>."; ?><br/><br/>
+			<?php echo gettext("By default the 'scheme', username/password, hostname and port are excluded from inspection.  Enabling this option " . 
+			"adds all of them to the normalized uri.  This was the default in Suricata versions prior to 2.0."); ?></td>
+	</tr>
+	<tr>
 		<td width="22%" valign="bottom">&nbsp;</td>
 		<td width="78%" valign="bottom">
 			<input name="save_libhtp_policy" id="save_libhtp_policy" type="submit" class="formbtn" value=" Save " title="<?php echo 
@@ -172,6 +183,7 @@
 			<input name="cancel_libhtp_policy" id="cancel_libhtp_policy" type="submit" class="formbtn" value="Cancel" title="<?php echo 
 			gettext("Cancel changes and return to App Parsers tab"); ?>"></td>
 	</tr>
+	</tbody>
 </table>
 
 <script type="text/javascript" src="/javascript/autosuggest.js">
diff --git a/config/suricata/suricata_list_view.php b/config/suricata/suricata_list_view.php
index 722bf47a..ec335abd 100644
--- a/config/suricata/suricata_list_view.php
+++ b/config/suricata/suricata_list_view.php
@@ -42,7 +42,7 @@ $type = htmlspecialchars($_GET['type']);
 $title = "List";
 
 if (isset($id) && isset($wlist)) {
-	$a_rule = $config['installedpackages']['suricataglobal']['rule'][$id];
+	$a_rule = $config['installedpackages']['suricata']['rule'][$id];
 	if ($type == "homenet") {
 		$list = suricata_build_list($a_rule, $wlist);
 		$contents = implode("\n", $list);
@@ -58,6 +58,20 @@ if (isset($id) && isset($wlist)) {
 		$contents = str_replace("\r", "", base64_decode($list['suppresspassthru']));
 		$title = "Suppress List";
 	}
+	elseif ($type == "externalnet") {
+		if ($wlist == "default") {
+			$list = suricata_build_list($a_rule, $a_rule['homelistname']);
+			$contents = "";
+			foreach ($list as $ip)
+				$contents .= "!{$ip}\n";
+			$contents = trim($contents, "\n");
+		}
+		else {
+			$list = suricata_build_list($a_rule, $wlist, false, true);
+			$contents = implode("\n", $list);
+		}
+		$title = "EXTERNAL_NET";
+	}
 	else
 		$contents = gettext("\n\nERROR -- Requested List Type entity is not valid!");
 }
diff --git a/config/suricata/suricata_logs_browser.php b/config/suricata/suricata_logs_browser.php
index cbe5ee7b..d4475625 100644
--- a/config/suricata/suricata_logs_browser.php
+++ b/config/suricata/suricata_logs_browser.php
@@ -85,7 +85,6 @@ include_once("head.inc");
 
 <?php
 include_once("fbegin.inc");
-if($pfsense_stable == 'yes'){echo '<p class="pgtitle">' . $pgtitle . '</p>';}
 if ($input_errors) {
 	print_input_errors($input_errors);
 }
@@ -95,8 +94,8 @@ if ($input_errors) {
 <script type="text/javascript">	
 	function loadFile() {
 		jQuery("#fileStatus").html("<?=gettext("Loading file"); ?> ...");
-		jQuery("#fileStatusBox").show(500);
-		jQuery("#filePathBox").show(500);
+		jQuery("#fileStatusBox").show(250);
+		jQuery("#filePathBox").show(250);
 		jQuery("#fbTarget").html("");
 
 		jQuery.ajax(
@@ -109,7 +108,7 @@ if ($input_errors) {
 	}
 
 	function loadComplete(req) {
-		jQuery("#fileContent").show(1000);
+		jQuery("#fileContent").show(250);
 		var values = req.responseText.split("|");
 		values.shift(); values.pop();
 
@@ -118,14 +117,17 @@ if ($input_errors) {
 			var fileContent = Base64.decode(values.join("|"));
 			jQuery("#fileStatus").html("<?=gettext("File successfully loaded"); ?>.");
 			jQuery("#fbTarget").html(file);
+			jQuery("#fileRefreshBtn").show();
+			jQuery("#fileContent").prop("disabled", false);
 			jQuery("#fileContent").val(fileContent);
 		}
 		else {
 			jQuery("#fileStatus").html(values[0]);
 			jQuery("#fbTarget").html("");
+			jQuery("#fileRefreshBtn").hide();
 			jQuery("#fileContent").val("");
+			jQuery("#fileContent").prop("disabled", true);
 		}
-		jQuery("#fileContent").show(1000);
 	}
 
 </script>
@@ -134,18 +136,21 @@ if ($input_errors) {
 <input type="hidden" id="instance" value="<?=$instanceid;?>"/>
 <?php if ($savemsg) print_info_box($savemsg); ?>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tbody>
 	<tr><td>
 	<?php
         	$tab_array = array();
-		$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+		$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 		$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-		$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+		$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 		$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$instanceid}");
-		$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+		$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 		$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 		$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-		$tab_array[] = array(gettext("Logs Browser"), true, "/suricata/suricata_logs_browser.php");
+		$tab_array[] = array(gettext("Logs View"), true, "/suricata/suricata_logs_browser.php");
 		$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+		$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+		$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 		display_top_tabs($tab_array, true);
 	?>
 	</td>
@@ -153,6 +158,7 @@ if ($input_errors) {
 	<tr>
 	<td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="6">
+			<tbody>
 			<tr>
 				<td colspan="2" class="listtopic"><?php echo gettext("Logs Browser Selections"); ?></td>
 			</tr>
@@ -176,7 +182,7 @@ if ($input_errors) {
 				<td width="78%" class="vtable">
 					<select name="logFile" id="logFile" class="formselect" onChange="loadFile();">
 			<?php
-				$logs = array( "alerts.log", "block.log", "files-json.log", "http.log", "stats.log", "suricata.log", "tls.log" );
+				$logs = array( "alerts.log", "block.log", "dns.log", "eve.json", "files-json.log", "http.log", "sid_changes.log", "stats.log", "suricata.log", "tls.log" );
 				foreach ($logs as $log) {
 					$selected = "";
 					if ($log == basename($logfile))
@@ -192,34 +198,51 @@ if ($input_errors) {
 			</tr>
 			<tr>
 				<td colspan="2">
-					<div style="display:none; " id="fileStatusBox">
-						<div class="list" style="padding-left:15px;">
-							<strong id="fileStatus"></strong>
-						</div>
-					</div>
-					<div style="padding-left:15px; display:none;" id="filePathBox">
-						<strong><?=gettext("Log File Path"); ?>:</strong>
-						<div class="list" style="display:inline;" id="fbTarget"></div>
-					</div>
+					<table width="100%">
+						<tbody>
+						<tr>
+							<td width="75%">
+								<div style="display:none; " id="fileStatusBox">
+									<div class="list" style="padding-left:15px;">
+									<strong id="fileStatus"></strong>
+									</div>
+								</div>
+								<div style="padding-left:15px; display:none;" id="filePathBox">
+									<strong><?=gettext("Log File Path"); ?>:</strong>
+									<div class="list" style="display:inline;" id="fbTarget"></div>
+								</div>
+							</td>
+							<td align="right">
+								<div style="padding-right:15px; display:none;" id="fileRefreshBtn">
+									<input type="button" name="refresh" id="refresh" value="Refresh" class="formbtn" onclick="loadFile();" title="<?=gettext("Refresh current display");?>" />
+								</div>
+							</td>
+						</tr>
+						</tbody>
+					</table>
 				</td>
 			</tr>
 			<tr>
 				<td colspan="2">
 					<table width="100%">
+						<tbody>
 						<tr>
 							<td valign="top" class="label">
 							<div style="background:#eeeeee;" id="fileOutput">
-							<textarea id="fileContent" name="fileContent" style="width:100%;" rows="30" wrap="off"></textarea>
+							<textarea id="fileContent" name="fileContent" style="width:100%;" rows="30" wrap="off" disabled></textarea>
 							</div>
 							</td>
 						</tr>
+						</tbody>
 					</table>
 				</td>
 			</tr>
+			</tbody>
 		</table>
 	</div>
 	</td>
 	</tr>
+	</tbody>
 </table>
 </form>
 
diff --git a/config/suricata/suricata_logs_mgmt.php b/config/suricata/suricata_logs_mgmt.php
index 16376c5b..fec2d149 100644
--- a/config/suricata/suricata_logs_mgmt.php
+++ b/config/suricata/suricata_logs_mgmt.php
@@ -67,6 +67,12 @@ $pconfig['tls_log_retention'] = $config['installedpackages']['suricata']['config
 $pconfig['unified2_log_limit'] = $config['installedpackages']['suricata']['config'][0]['unified2_log_limit'];
 $pconfig['u2_archive_log_retention'] = $config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'];
 $pconfig['file_store_retention'] = $config['installedpackages']['suricata']['config'][0]['file_store_retention'];
+$pconfig['dns_log_limit_size'] = $config['installedpackages']['suricata']['config'][0]['dns_log_limit_size'];
+$pconfig['dns_log_retention'] = $config['installedpackages']['suricata']['config'][0]['dns_log_retention'];
+$pconfig['eve_log_limit_size'] = $config['installedpackages']['suricata']['config'][0]['eve_log_limit_size'];
+$pconfig['eve_log_retention'] = $config['installedpackages']['suricata']['config'][0]['eve_log_retention'];
+$pconfig['sid_changes_log_limit_size'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'];
+$pconfig['sid_changes_log_retention'] = $config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'];
 
 // Load up some arrays with selection values (we use these later).
 // The keys in the $retentions array are the retention period
@@ -88,40 +94,97 @@ if (empty($pconfig['suricataloglimitsize'])) {
 }
 
 // Set default retention periods for rotated logs
-if (empty($pconfig['alert_log_retention']))
+if (!isset($pconfig['alert_log_retention']))
 	$pconfig['alert_log_retention'] = "336";
-if (empty($pconfig['block_log_retention']))
+if (!isset($pconfig['block_log_retention']))
 	$pconfig['block_log_retention'] = "336";
-if (empty($pconfig['files_json_log_retention']))
+if (!isset($pconfig['files_json_log_retention']))
 	$pconfig['files_json_log_retention'] = "168";
-if (empty($pconfig['http_log_retention']))
+if (!isset($pconfig['http_log_retention']))
 	$pconfig['http_log_retention'] = "168";
-if (empty($pconfig['stats_log_retention']))
+if (!isset($pconfig['dns_log_retention']))
+	$pconfig['dns_log_retention'] = "168";
+if (!isset($pconfig['stats_log_retention']))
 	$pconfig['stats_log_retention'] = "168";
-if (empty($pconfig['tls_log_retention']))
+if (!isset($pconfig['tls_log_retention']))
 	$pconfig['tls_log_retention'] = "336";
-if (empty($pconfig['u2_archive_log_retention']))
+if (!isset($pconfig['u2_archive_log_retention']))
 	$pconfig['u2_archive_log_retention'] = "168";
-if (empty($pconfig['file_store_retention']))
+if (!isset($pconfig['file_store_retention']))
 	$pconfig['file_store_retention'] = "168";
+if (!isset($pconfig['eve_log_retention']))
+	$pconfig['eve_log_retention'] = "168";
+if (!isset($pconfig['sid_changes_log_retention']))
+	$pconfig['sid_changes_log_retention'] = "336";
 
 // Set default log file size limits
-if (empty($pconfig['alert_log_limit_size']))
+if (!isset($pconfig['alert_log_limit_size']))
 	$pconfig['alert_log_limit_size'] = "500";
-if (empty($pconfig['block_log_limit_size']))
+if (!isset($pconfig['block_log_limit_size']))
 	$pconfig['block_log_limit_size'] = "500";
-if (empty($pconfig['files_json_log_limit_size']))
+if (!isset($pconfig['files_json_log_limit_size']))
 	$pconfig['files_json_log_limit_size'] = "1000";
-if (empty($pconfig['http_log_limit_size']))
+if (!isset($pconfig['http_log_limit_size']))
 	$pconfig['http_log_limit_size'] = "1000";
-if (empty($pconfig['stats_log_limit_size']))
+if (!isset($pconfig['dns_log_limit_size']))
+	$pconfig['dns_log_limit_size'] = "750";
+if (!isset($pconfig['stats_log_limit_size']))
 	$pconfig['stats_log_limit_size'] = "500";
-if (empty($pconfig['tls_log_limit_size']))
+if (!isset($pconfig['tls_log_limit_size']))
 	$pconfig['tls_log_limit_size'] = "500";
-if (empty($pconfig['unified2_log_limit']))
+if (!isset($pconfig['unified2_log_limit']))
 	$pconfig['unified2_log_limit'] = "32";
+if (!isset($pconfig['eve_log_limit_size']))
+	$pconfig['eve_log_limit_size'] = "5000";
+if (!isset($pconfig['sid_changes_log_limit_size']))
+	$pconfig['sid_changes_log_limit_size'] = "250";
+
+if ($_POST['ResetAll']) {
+
+	// Reset all settings to their defaults
+	$pconfig['alert_log_retention'] = "336";
+	$pconfig['block_log_retention'] = "336";
+	$pconfig['files_json_log_retention'] = "168";
+	$pconfig['http_log_retention'] = "168";
+	$pconfig['dns_log_retention'] = "168";
+	$pconfig['stats_log_retention'] = "168";
+	$pconfig['tls_log_retention'] = "336";
+	$pconfig['u2_archive_log_retention'] = "168";
+	$pconfig['file_store_retention'] = "168";
+	$pconfig['eve_log_retention'] = "168";
+	$pconfig['sid_changes_log_retention'] = "336";
+
+	$pconfig['alert_log_limit_size'] = "500";
+	$pconfig['block_log_limit_size'] = "500";
+	$pconfig['files_json_log_limit_size'] = "1000";
+	$pconfig['http_log_limit_size'] = "1000";
+	$pconfig['dns_log_limit_size'] = "750";
+	$pconfig['stats_log_limit_size'] = "500";
+	$pconfig['tls_log_limit_size'] = "500";
+	$pconfig['unified2_log_limit'] = "32";
+	$pconfig['eve_log_limit_size'] = "5000";
+	$pconfig['sid_changes_log_limit_size'] = "250";
+
+	/* Log a message at the top of the page to inform the user */
+	$savemsg = gettext("All log management settings on this page have been reset to their defaults.  Click APPLY if you wish to keep these new settings.");
+}
+
+if ($_POST["save"] || $_POST['apply']) {
+	if ($_POST['enable_log_mgmt'] != 'on') {
+		$config['installedpackages']['suricata']['config'][0]['enable_log_mgmt'] = $_POST['enable_log_mgmt'] ? 'on' :'off';
+		write_config("Suricata pkg: saved updated configuration for LOGS MGMT.");
+		sync_suricata_package_config();
+
+		/* forces page to reload new settings */
+		header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
+		header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' );
+		header( 'Cache-Control: no-store, no-cache, must-revalidate' );
+		header( 'Cache-Control: post-check=0, pre-check=0', false );
+		header( 'Pragma: no-cache' );
+		header("Location: /suricata/suricata_logs_mgmt.php");
+		exit;
+	} 
 
-if ($_POST["save"]) {
 	if ($_POST['suricataloglimit'] == 'on') {
 		if (!is_numericint($_POST['suricataloglimitsize']) || $_POST['suricataloglimitsize'] < 1)
 			$input_errors[] = gettext("The 'Log Directory Size Limit' must be an integer value greater than zero.");
@@ -151,8 +214,14 @@ if ($_POST["save"]) {
 		$config['installedpackages']['suricata']['config'][0]['unified2_log_limit'] = $_POST['unified2_log_limit'];
 		$config['installedpackages']['suricata']['config'][0]['u2_archive_log_retention'] = $_POST['u2_archive_log_retention'];
 		$config['installedpackages']['suricata']['config'][0]['file_store_retention'] = $_POST['file_store_retention'];
+		$config['installedpackages']['suricata']['config'][0]['dns_log_limit_size'] = $_POST['dns_log_limit_size'];
+		$config['installedpackages']['suricata']['config'][0]['dns_log_retention'] = $_POST['dns_log_retention'];
+		$config['installedpackages']['suricata']['config'][0]['eve_log_limit_size'] = $_POST['eve_log_limit_size'];
+		$config['installedpackages']['suricata']['config'][0]['eve_log_retention'] = $_POST['eve_log_retention'];
+		$config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'] = $_POST['sid_changes_log_limit_size'];
+		$config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'] = $_POST['sid_changes_log_retention'];
 
-		write_config();
+		write_config("Suricata pkg: saved updated configuration for LOGS MGMT.");
 		sync_suricata_package_config();
 
 		/* forces page to reload new settings */
@@ -179,23 +248,32 @@ include_once("fbegin.inc");
 /* Display Alert message, under form tag or no refresh */
 if ($input_errors)
 	print_input_errors($input_errors);
-
 ?>
 
 <form action="suricata_logs_mgmt.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
+
+<?php
+if ($savemsg) {
+	/* Display save message */
+	print_info_box($savemsg);
+}
+?>
+
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr><td>
 <?php
         $tab_array = array();
-        $tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+        $tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
         $tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 	$tab_array[] = array(gettext("Logs Mgmt"), true, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
         display_top_tabs($tab_array, true);
 ?>
 </td></tr>
@@ -267,7 +345,7 @@ if ($input_errors)
 			<colgroup>
 				<col style="width: 15%;">
 				<col style="width: 18%;">
-				<col style="width: 20%;">
+				<col style="width: 18%;">
 				<col>
 			</colgroup>
 			<thead>
@@ -320,6 +398,46 @@ if ($input_errors)
 					<td class="listbg"><?=gettext("Suricata blocked IPs and event details");?></td>
 				</tr>
 				<tr>
+					<td class="listbg">dns</td>
+					<td class="listr" align="center"><select name="dns_log_limit_size" class="formselect" id="dns_log_limit_size">
+						<?php foreach ($log_sizes as $k => $l): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['dns_log_limit_size']) echo "selected"; ?>>
+								<?=htmlspecialchars($l);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listr" align="center"><select name="dns_log_retention" class="formselect" id="dns_log_retention">
+						<?php foreach ($retentions as $k => $p): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['dns_log_retention']) echo "selected"; ?>>
+								<?=htmlspecialchars($p);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listbg"><?=gettext("DNS request/reply details");?></td>
+				</tr>
+				<tr>
+					<td class="listbg">eve-json</td>
+					<td class="listr" align="center"><select name="eve_log_limit_size" class="formselect" id="eve_log_limit_size">
+						<?php foreach ($log_sizes as $k => $l): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['eve_log_limit_size']) echo "selected"; ?>>
+								<?=htmlspecialchars($l);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listr" align="center"><select name="eve_log_retention" class="formselect" id="eve_log_retention">
+						<?php foreach ($retentions as $k => $p): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['eve_log_retention']) echo "selected"; ?>>
+								<?=htmlspecialchars($p);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listbg"><?=gettext("Eve-JSON (JavaScript Object Notation) data");?></td>
+				</tr>
+				<tr>
 					<td class="listbg">files-json</td>
 					<td class="listr" align="center"><select name="files_json_log_limit_size" class="formselect" id="files_json_log_limit_size">
 						<?php foreach ($log_sizes as $k => $l): ?>
@@ -359,6 +477,28 @@ if ($input_errors)
 					</td>
 					<td class="listbg"><?=gettext("Captured HTTP events and session info");?></td>
 				</tr>
+
+				<tr>
+					<td class="listbg">sid_changes</td>
+					<td class="listr" align="center"><select name="sid_changes_log_limit_size" class="formselect" id="sid_changes_log_limit_size">
+						<?php foreach ($log_sizes as $k => $l): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['sid_changes_log_limit_size']) echo "selected"; ?>>
+								<?=htmlspecialchars($l);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listr" align="center"><select name="sid_changes_log_retention" class="formselect" id="sid_changes_log_retention">
+						<?php foreach ($retentions as $k => $p): ?>
+							<option value="<?=$k;?>"
+							<?php if ($k == $pconfig['sid_changes_log_retention']) echo "selected"; ?>>
+								<?=htmlspecialchars($p);?></option>
+						<?php endforeach; ?>
+						</select>
+					</td>
+					<td class="listbg"><?=gettext("Log of SID changes made by SID Mgmt conf files");?></td>
+				</tr>
+
 				<tr>
 					<td class="listbg">stats</td>
 					<td class="listr" align="center"><select name="stats_log_limit_size" class="formselect" id="stats_log_limit_size">
@@ -444,7 +584,11 @@ if ($input_errors)
 </tr>
 <tr>
 	<td width="22%"></td>
-	<td width="78%" class="vexpl"><input name="save" type="submit" class="formbtn" value="Save"/><br/>
+	<td width="78%" class="vexpl"><input name="save" type="submit" class="formbtn" value="Save"/>
+		&nbsp;&nbsp;&nbsp;&nbsp;<input name="ResetAll" type="submit" class="formbtn" value="Reset" title="<?php echo 
+		gettext("Reset all settings to defaults") . "\" onclick=\"return confirm('" . 
+		gettext("WARNING:  This will reset ALL Log Management settings to their defaults.  Click OK to continue or CANCEL to quit.") . 
+		"');\""; ?>/><br/>
 	<br/><span class="red"><strong><?php echo gettext("Note:");?></strong>&nbsp;
 	</span><?php echo gettext("Changing any settings on this page will affect all Suricata-configured interfaces.");?></td>
 </tr>
@@ -472,6 +616,12 @@ function enable_change() {
 	document.iform.unified2_log_limit.disabled = endis;
 	document.iform.u2_archive_log_retention.disabled = endis;
 	document.iform.file_store_retention.disabled = endis;
+	document.iform.dns_log_retention.disabled = endis;
+	document.iform.dns_log_limit_size.disabled = endis;
+	document.iform.eve_log_retention.disabled = endis;
+	document.iform.eve_log_limit_size.disabled = endis;
+	document.iform.sid_changes_log_retention.disabled = endis;
+	document.iform.sid_changes_log_limit_size.disabled = endis;
 }
 
 function enable_change_dirSize() {
diff --git a/config/suricata/suricata_migrate_config.php b/config/suricata/suricata_migrate_config.php
new file mode 100644
index 00000000..ba13155b
--- /dev/null
+++ b/config/suricata/suricata_migrate_config.php
@@ -0,0 +1,355 @@
+<?php
+/*
+ * suricata_migrate_config.php
+ *
+ * Copyright (C) 2014 Bill Meeks
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once("config.inc");
+require_once("functions.inc");
+
+/****************************************************************************/
+/* The code in this module is called once during the post-install process   */
+/* via an "include" line.  It is used to perform a one-time migration of    */
+/* Suricata configuration parameters to any new format required by the      */
+/* latest package version.                                                  */
+/****************************************************************************/
+
+global $config;
+
+if (!is_array($config['installedpackages']['suricata']))
+	$config['installedpackages']['suricata'] = array();
+if (!is_array($config['installedpackages']['suricata']['rule']))
+	$config['installedpackages']['suricata']['rule'] = array();
+
+// Just exit if this is a clean install with no saved settings
+if (empty($config['installedpackages']['suricata']['rule']))
+	return;
+
+$rule = &$config['installedpackages']['suricata']['rule'];
+
+/****************************************************************************/
+/* Loop through all the <rule> elements in the Suricata configuration and   */
+/* migrate relevant parameters to the new format.                           */
+/****************************************************************************/
+
+$updated_cfg = false;
+log_error("[Suricata] Checking configuration settings version...");
+
+// Check the configuration version to see if XMLRPC Sync should
+// auto-disabled as part of the upgrade due to config format changes.
+if ($config['installedpackages']['suricata']['config'][0]['suricata_config_ver'] < 2 && 
+    ($config['installedpackages']['suricatasync']['config'][0]['varsynconchanges'] == 'auto' ||
+     $config['installedpackages']['suricatasync']['config'][0]['varsynconchanges'] == 'manual')) {
+	$config['installedpackages']['suricatasync']['config'][0]['varsynconchanges'] = "disabled";
+	log_error("[Suricata] Turning off Suricata Sync on this host due to configuration format changes in this update.  Upgrade all Suricata Sync targets to this same Suricata package version before re-enabling Suricata Sync.");
+	$updated_cfg = true;
+}
+
+/**********************************************************/
+/* Create new Auto SID Mgmt settings if not set           */
+/**********************************************************/
+	if (empty($config['installedpackages']['suricata']['config'][0]['auto_manage_sids'])) {
+		$config['installedpackages']['suricata']['config'][0]['auto_manage_sids'] = "off";
+		$config['installedpackages']['suricata']['config'][0]['sid_changes_log_limit_size'] = "250";
+		$config['installedpackages']['suricata']['config'][0]['sid_changes_log_retention'] = "336";
+		$updated_cfg = true;
+	}
+
+// Now process the interface-specific settings
+foreach ($rule as &$r) {
+
+	// Initialize arrays for supported preprocessors if necessary
+	if (!is_array($r['libhtp_policy']['item']))
+		$r['libhtp_policy']['item'] = array();
+
+	$pconfig = array();
+	$pconfig = $r;
+
+	/***********************************************************/
+	/* This setting is deprecated in Suricata 2.0 and higher,  */
+	/* so remove it from the configuration.                    */
+	/***********************************************************/
+	if (isset($pconfig['stream_max_sessions'])) {
+		unset($pconfig['stream_max_sessions']);
+		$updated_cfg = true;
+	}
+
+	/***********************************************************/
+	/* HTTP server personalities for "Apache" and "Apache_2_2" */
+	/* are deprecated and replaced with "Apache_2" in Suricata */
+	/* versions greater than 2.0.                              */
+	/***********************************************************/
+	$http_serv = &$pconfig['libhtp_policy']['item'];
+	foreach ($http_serv as &$policy) {
+		if ($policy['personality'] == "Apache" || $policy['personality'] == "Apache_2_2") {
+			$policy['personality'] = "Apache_2";
+			$updated_cfg = true;
+		}
+		// Set new URI inspect option for Suricata 2.0 and higher
+		if (!isset($policy['uri-include-all'])) {
+			$policy['uri-include-all'] = "no";
+			$updated_cfg = true;
+		}
+	}
+
+	/***********************************************************/
+	/* Add the new 'dns-events.rules' file to the rulesets.    */
+	/***********************************************************/
+	if (strpos("dns-events.rules", $pconfig['rulesets']) === FALSE) {
+		$pconfig['rulesets'] = rtrim($pconfig['rulesets'], "||") . "||dns-events.rules";	
+		$updated_cfg = true;
+	}
+
+	/***********************************************************/
+	/* Add new interface promisc mode value and default 'on'.  */
+	/***********************************************************/
+	if (empty($pconfig['intf_promisc_mode'])) {
+		$pconfig['intf_promisc_mode'] = "on";
+		$updated_cfg = true;
+	}
+
+	/***********************************************************/
+	/* Add new HTTP Log Extended Info setting if not present   */
+	/***********************************************************/
+	if (!isset($pconfig['http_log_extended'])) {
+		$pconfig['http_log_extended'] = "on";
+		$updated_cfg = true;
+	}
+
+	/***********************************************************/
+	/* Add new EVE logging settings if not present             */
+	/***********************************************************/
+	if (!isset($pconfig['eve_output_type'])) {
+		$pconfig['eve_output_type'] = "file";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['eve_systemlog_facility'])) {
+		$pconfig['eve_systemlog_facility'] = "local1";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['eve_systemlog_priority'])) {
+		$pconfig['eve_systemlog_priority'] = "info";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_alerts'])) {
+		$pconfig['eve_log_alerts'] = "on";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_http'])) {
+		$pconfig['eve_log_http'] = "on";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_dns'])) {
+		$pconfig['eve_log_dns'] = "on";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_tls'])) {
+		$pconfig['eve_log_tls'] = "on";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_files'])) {
+		$pconfig['eve_log_files'] = "on";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_ssh'])) {
+		$pconfig['eve_log_ssh'] = "on";
+		$updated_cfg = true;
+	}
+
+	/******************************************************************/
+	/* Create default log size and retention limits if not set        */
+	/******************************************************************/
+	if (!isset($pconfig['alert_log_retention']) && $pconfig['alert_log_retention'] != '0') {
+		$pconfig['alert_log_retention'] = "336";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['alert_log_limit_size']) && $pconfig['alert_log_limit_size'] != '0') {
+		$pconfig['alert_log_limit_size'] = "500";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['block_log_retention']) && $pconfig['block_log_retention'] != '0') {
+		$pconfig['block_log_retention'] = "336";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['block_log_limit_size']) && $pconfig['block_log_limit_size'] != '0') {
+		$pconfig['block_log_limit_size'] = "500";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['dns_log_retention']) && $pconfig['dns_log_retention'] != '0') {
+		$pconfig['dns_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['dns_log_limit_size']) && $pconfig['dns_log_limit_size'] != '0') {
+		$pconfig['dns_log_limit_size'] = "750";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['eve_log_retention']) && $pconfig['eve_log_retention'] != '0') {
+		$pconfig['eve_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['eve_log_limit_size']) && $pconfig['eve_log_limit_size'] != '0') {
+		$pconfig['eve_log_limit_size'] = "5000";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['files_json_log_retention']) && $pconfig['files_json_log_retention'] != '0') {
+		$pconfig['files_json_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['files_json_log_limit_size']) && $pconfig['files_json_log_limit_size'] != '0') {
+		$pconfig['files_json_log_limit_size'] = "1000";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['http_log_retention']) && $pconfig['http_log_retention'] != '0') {
+		$pconfig['http_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['http_log_limit_size']) && $pconfig['http_log_limit_size'] != '0') {
+		$pconfig['http_log_limit_size'] = "1000";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['stats_log_retention']) && $pconfig['stats_log_retention'] != '0') {
+		$pconfig['stats_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['stats_log_limit_size']) && $pconfig['stats_log_limit_size'] != '0') {
+		$pconfig['stats_log_limit_size'] = "500";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['tls_log_retention']) && $pconfig['tls_log_retention'] != '0') {
+		$pconfig['tls_log_retention'] = "336";
+		$updated_cfg = true;
+	}
+	if (!isset($pconfig['tls_log_limit_size']) && $pconfig['tls_log_limit_size'] != '0') {
+		$pconfig['tls_log_limit_size'] = "500";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['file_store_retention']) && $pconfig['file_store_retention'] != '0') {
+		$pconfig['file_store_retention'] = "168";
+		$updated_cfg = true;
+	}
+
+	if (!isset($pconfig['u2_archive_log_retention']) && $pconfig['u2_archive_log_retention'] != '0') {
+		$pconfig['u2_archive_log_retention'] = "168";
+		$updated_cfg = true;
+	}
+
+	/************************************************************/
+	/* Create new DNS App-Layer parser settings if not set      */
+	/************************************************************/
+	if (empty($pconfig['dns_global_memcap'])) {
+		$pconfig['dns_global_memcap'] = "16777216";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['dns_state_memcap'])) {
+		$pconfig['dns_state_memcap'] = "524288";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['dns_request_flood_limit'])) {
+		$pconfig['dns_request_flood_limit'] = "500";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['dns_parser_udp'])) {
+		$pconfig['dns_parser_udp'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['dns_parser_tcp'])) {
+		$pconfig['dns_parser_tcp'] = "yes";
+		$updated_cfg = true;
+	}
+
+	/***********************************************************/
+	/* Create new HTTP App-Layer parser settings if not set    */
+	/***********************************************************/
+	if (empty($pconfig['http_parser'])) {
+		$pconfig['http_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['http_parser_memcap'])) {
+		$pconfig['http_parser_memcap'] = "67108864";
+		$updated_cfg = true;
+	}
+
+	/**********************************************************/
+	/* Create other App-Layer parser settings if not set      */
+	/**********************************************************/
+	if (empty($pconfig['tls_parser'])) {
+		$pconfig['tls_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smtp_parser'])) {
+		$pconfig['smtp_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['imap_parser'])) {
+		$pconfig['imap_parser'] = "detection-only";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['ssh_parser'])) {
+		$pconfig['ssh_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['ftp_parser'])) {
+		$pconfig['ftp_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['dcerpc_parser'])) {
+		$pconfig['dcerpc_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['smb_parser'])) {
+		$pconfig['smb_parser'] = "yes";
+		$updated_cfg = true;
+	}
+	if (empty($pconfig['msn_parser'])) {
+		$pconfig['msn_parser'] = "detection-only";
+		$updated_cfg = true;
+	}
+
+	// Save the new configuration data into the $config array pointer
+	$r = $pconfig;
+}
+// Release reference to final array element
+unset($r);
+
+// Write out the new configuration to disk if we changed anything
+if ($updated_cfg) {
+	$config['installedpackages']['suricata']['config'][0]['suricata_config_ver'] = "2.0";
+	log_error("[Suricata] Saving configuration settings in new format...");
+	write_config("Suricata pkg: migrate existing settings to new format during package upgrade.");
+	log_error("[Suricata] Settings successfully migrated to new configuration format...");
+}
+else
+	log_error("[Suricata] Configuration version is current...");
+
+?>
diff --git a/config/suricata/suricata_os_policy_engine.php b/config/suricata/suricata_os_policy_engine.php
index 869d940c..9a881f3d 100644
--- a/config/suricata/suricata_os_policy_engine.php
+++ b/config/suricata/suricata_os_policy_engine.php
@@ -62,6 +62,7 @@
 ?>
 
 <table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 		<td colspan="2" align="center" class="listtopic"><?php echo gettext("Suricata Target-Based Host OS Policy Engine Configuration"); ?></td>
 	</tr>
@@ -69,7 +70,7 @@
 		<td valign="top" class="vncell"><?php echo gettext("Policy Name"); ?></td>
 		<td class="vtable">
 			<input name="policy_name" type="text" class="formfld unknown" id="policy_name" size="25" maxlength="25" 
-			value="<?=htmlspecialchars($pengcfg['name']);?>"<?php if (htmlspecialchars($pengcfg['name']) == "default") echo "readonly";?>/>&nbsp;
+			value="<?=htmlspecialchars($pengcfg['name']);?>"<?php if (htmlspecialchars($pengcfg['name']) == " default") echo " readonly";?>/>&nbsp;
 			<?php if (htmlspecialchars($pengcfg['name']) <> "default") 
 					echo gettext("Name or description for this engine.  (Max 25 characters)");
 				else
@@ -83,6 +84,7 @@
 		<td class="vtable">
 		<?php if ($pengcfg['name'] <> "default") : ?>
 			<table width="95%" border="0" cellpadding="2" cellspacing="0">
+				<tbody>
 				<tr>
 					<td class="vexpl"><input name="policy_bind_to" type="text" class="formfldalias" id="policy_bind_to" size="32" 
 					value="<?=htmlspecialchars($pengcfg['bind_to']);?>" title="<?=trim(filter_expand_alias($pengcfg['bind_to']));?>" autocomplete="off"/>&nbsp;
@@ -93,6 +95,7 @@
 				<tr>
 					<td class="vexpl" colspan="2"><?php echo gettext("This policy will apply for packets with destination addresses contained within this IP List.");?></td>
 				</tr>
+				</tbody>
 			</table>
 			<span class="red"><strong><?php echo gettext("Note: ") . "</strong></span>" . gettext("Supplied value must be a pre-configured Alias or the keyword 'all'.");?>
 			&nbsp;&nbsp;&nbsp;&nbsp;
@@ -129,6 +132,7 @@
 			<input name="cancel_os_policy" id="cancel_os_policy" type="submit" class="formbtn" value="Cancel" title="<?php echo 
 			gettext("Cancel changes and return to Flow/Stream tab"); ?>"></td>
 	</tr>
+	</tbody>
 </table>
 <script type="text/javascript" src="/javascript/autosuggest.js">
 </script>
diff --git a/config/suricata/suricata_passlist.php b/config/suricata/suricata_passlist.php
index fc7c60e2..02aa4a3d 100644
--- a/config/suricata/suricata_passlist.php
+++ b/config/suricata/suricata_passlist.php
@@ -115,18 +115,21 @@ if ($savemsg) {
 <form action="/suricata/suricata_passlist.php" method="post">
 <input type="hidden" name="list_id" id="list_id" value=""/>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 	<?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), true, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	?>
 	</td>
@@ -134,6 +137,7 @@ if ($savemsg) {
 <tr>
 	<td><div id="mainarea">
 	<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+		<tbody>
 		<tr>
 			<td width="25%" class="listhdrr">List Name</td>
 			<td width="30%" class="listhdrr">Assigned Alias</td>
@@ -142,19 +146,19 @@ if ($savemsg) {
 		</tr>
 		<?php foreach ($a_passlist as $i => $list): ?>
 		<tr>
-			<td class="listlr"
+			<td class="listlr" 
 				ondblclick="document.location='suricata_passlist_edit.php?id=<?=$i;?>';">
 				<?=htmlspecialchars($list['name']);?></td>
-			<td class="listr"
+			<td class="listr" 
 				ondblclick="document.location='suricata_passlist_edit.php?id=<?=$i;?>';" 
 				title="<?=filter_expand_alias($list['address']);?>">
 				<?php echo gettext($list['address']);?></td>
-			<td class="listbg"
+			<td class="listbg" 
 				ondblclick="document.location='suricata_passlist_edit.php?id=<?=$i;?>';">
-			<font color="#FFFFFF"> <?=htmlspecialchars($list['descr']);?>&nbsp;
-			</td>
+			<font color="#FFFFFF"><?=htmlspecialchars($list['descr']);?></font></td>
 			<td valign="middle" nowrap class="list">
 			<table border="0" cellspacing="0" cellpadding="1">
+				<tbody>
 				<tr>
 					<td valign="middle"><a href="suricata_passlist_edit.php?id=<?=$i;?>">
 					<img src="/themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" width="17" height="17" border="0" title="<?php echo gettext("Edit pass list"); ?>"></a>
@@ -163,6 +167,7 @@ if ($savemsg) {
 					src="/themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0" title="<?php echo gettext("Delete pass list"); ?>"/>
 					</td>
 				</tr>
+				</tbody>
 			</table>
 			</td>
 		</tr>
@@ -171,6 +176,7 @@ if ($savemsg) {
 			<td class="list" colspan="3"></td>
 			<td class="list">
 			<table border="0" cellspacing="0" cellpadding="1">
+				<tbody>
 				<tr>
 					<td valign="middle" width="17">&nbsp;</td>
 					<td valign="middle"><a href="suricata_passlist_edit.php?id=<?php echo $id_gen;?> ">
@@ -178,27 +184,31 @@ if ($savemsg) {
 					width="17" height="17" border="0" title="<?php echo gettext("add a new pass list"); ?>"/></a>
 					</td>
 				</tr>
+				</tbody>
 			</table>
 				</td>
 			</tr>
+			</tbody>
 		</table>
 		</div>
 		</td>
 	</tr>
+	</tbody>
 </table>
 <br>
-<table width="100%" border="0" cellpadding="1"
-	cellspacing="1">
+<table width="100%" border="0" cellpadding="1" cellspacing="1">
+	<tbody>
 	<tr>
-	<td width="100%"><span class="vexpl"><span class="red"><strong><?php echo gettext("Notes:"); ?></strong></span>
-	<p><?php echo gettext("1. Here you can create Pass List files for your Suricata package rules.  Hosts on a Pass List are never blocked by Suricata."); ?><br/>
-	<?php echo gettext("2. Add all the IP addresses or networks (in CIDR notation) you want to protect against Suricata block decisions."); ?><br/>
-	<?php echo gettext("3. The default Pass List includes the WAN IP and gateway, defined DNS servers, VPNs and locally-attached networks."); ?><br/>
-	<?php echo gettext("4. Be careful, it is very easy to get locked out of your system by altering the default settings."); ?></p></span></td>
+		<td width="100%"><span class="vexpl"><span class="red"><strong><?php echo gettext("Notes:"); ?></strong></span>
+		<p><?php echo gettext("1. Here you can create Pass List files for your Suricata package rules.  Hosts on a Pass List are never blocked by Suricata."); ?><br/>
+		<?php echo gettext("2. Add all the IP addresses or networks (in CIDR notation) you want to protect against Suricata block decisions."); ?><br/>
+		<?php echo gettext("3. The default Pass List includes the WAN IP and gateway, defined DNS servers, VPNs and locally-attached networks."); ?><br/>
+		<?php echo gettext("4. Be careful, it is very easy to get locked out of your system by altering the default settings."); ?></p></span></td>
 	</tr>
 	<tr>
-	<td width="100%"><span class="vexpl"><?php echo gettext("Remember you must restart Suricata on the interface for changes to take effect!"); ?></span></td>
+		<td width="100%"><span class="vexpl"><?php echo gettext("Remember you must restart Suricata on the interface for changes to take effect!"); ?></span></td>
 	</tr>
+	</tbody>
 </table>
 </form>
 <?php include("fend.inc"); ?>
diff --git a/config/suricata/suricata_passlist_edit.php b/config/suricata/suricata_passlist_edit.php
index 437ae9a8..3e1502f3 100644
--- a/config/suricata/suricata_passlist_edit.php
+++ b/config/suricata/suricata_passlist_edit.php
@@ -63,15 +63,53 @@ if (is_null($id)) {
 	exit;
 }
 
+if (isset($id) && isset($a_passlist[$id])) {
+	/* Retrieve saved settings */
+	$pconfig['name'] = $a_passlist[$id]['name'];
+	$pconfig['uuid'] = $a_passlist[$id]['uuid'];
+	$pconfig['address'] = $a_passlist[$id]['address'];
+	$pconfig['descr'] = html_entity_decode($a_passlist[$id]['descr']);
+	$pconfig['localnets'] = $a_passlist[$id]['localnets'];
+	$pconfig['wanips'] = $a_passlist[$id]['wanips'];
+	$pconfig['wangateips'] = $a_passlist[$id]['wangateips'];
+	$pconfig['wandnsips'] = $a_passlist[$id]['wandnsips'];
+	$pconfig['vips'] = $a_passlist[$id]['vips'];
+	$pconfig['vpnips'] = $a_passlist[$id]['vpnips'];
+}
+
+// Check for returned "selected alias" if action is import
+if ($_GET['act'] == "import") {
+
+	// Retrieve previously typed values we passed to SELECT ALIAS page
+	$pconfig['name'] = htmlspecialchars($_GET['name']);
+	$pconfig['uuid'] = htmlspecialchars($_GET['uuid']);
+	$pconfig['address'] = htmlspecialchars($_GET['address']);
+	$pconfig['descr'] = htmlspecialchars($_GET['descr']);
+	$pconfig['localnets'] = htmlspecialchars($_GET['localnets'])? 'yes' : 'no';
+	$pconfig['wanips'] = htmlspecialchars($_GET['wanips'])? 'yes' : 'no';
+	$pconfig['wangateips'] = htmlspecialchars($_GET['wangateips'])? 'yes' : 'no';
+	$pconfig['wandnsips'] = htmlspecialchars($_GET['wandnsips'])? 'yes' : 'no';
+	$pconfig['vips'] = htmlspecialchars($_GET['vips'])? 'yes' : 'no';
+	$pconfig['vpnips'] = htmlspecialchars($_GET['vpnips'])? 'yes' : 'no';
+
+	// Now retrieve the "selected alias" returned from SELECT ALIAS page
+	if ($_GET['varname'] == "address" && isset($_GET['varvalue']))
+		$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
+}
+
 /* If no entry for this passlist, then create a UUID and treat it like a new list */
-if (!isset($a_passlist[$id]['uuid'])) {
+if (!isset($a_passlist[$id]['uuid']) && empty($pconfig['uuid'])) {
 	$passlist_uuid = 0;
 	while ($passlist_uuid > 65535 || $passlist_uuid == 0) {
 		$passlist_uuid = mt_rand(1, 65535);
 		$pconfig['uuid'] = $passlist_uuid;
 		$pconfig['name'] = "passlist_{$passlist_uuid}";
 	}
-} else
+}
+elseif (!empty($pconfig['uuid'])) {
+	$passlist_uuid = $pconfig['uuid'];	
+}
+else
 	$passlist_uuid = $a_passlist[$id]['uuid'];
 
 /* returns true if $name is a valid name for a pass list file name or ip */
@@ -85,28 +123,6 @@ function is_validpasslistname($name) {
 	return false;
 }
 
-if (isset($id) && $a_passlist[$id]) {
-	/* old settings */
-	$pconfig = array();
-	$pconfig['name'] = $a_passlist[$id]['name'];
-	$pconfig['uuid'] = $a_passlist[$id]['uuid'];
-	$pconfig['detail'] = $a_passlist[$id]['detail'];
-	$pconfig['address'] = $a_passlist[$id]['address'];
-	$pconfig['descr'] = html_entity_decode($a_passlist[$id]['descr']);
-	$pconfig['localnets'] = $a_passlist[$id]['localnets'];
-	$pconfig['wanips'] = $a_passlist[$id]['wanips'];
-	$pconfig['wangateips'] = $a_passlist[$id]['wangateips'];
-	$pconfig['wandnsips'] = $a_passlist[$id]['wandnsips'];
-	$pconfig['vips'] = $a_passlist[$id]['vips'];
-	$pconfig['vpnips'] = $a_passlist[$id]['vpnips'];
-}
-
-// Check for returned "selected alias" if action is import
-if ($_GET['act'] == "import") {
-	if ($_GET['varname'] == "address" && isset($_GET['varvalue']))
-		$pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']);
-}
-
 if ($_POST['save']) {
 	unset($input_errors);
 	$pconfig = $_POST;
@@ -128,11 +144,11 @@ if ($_POST['save']) {
 		$input_errors[] = gettext("Pass List file name may only consist of the characters \"a-z, A-Z, 0-9 and _\". Note: No Spaces or dashes. Press Cancel to reset.");
 
 	/* check for name conflicts */
-	foreach ($a_passlist as $w_list) {
-		if (isset($id) && ($a_passlist[$id]) && ($a_passlist[$id] === $w_list))
+	foreach ($a_passlist as $p_list) {
+		if (isset($id) && ($a_passlist[$id]) && ($a_passlist[$id] === $p_list))
 			continue;
 
-		if ($w_list['name'] == $_POST['name']) {
+		if ($p_list['name'] == $_POST['name']) {
 			$input_errors[] = gettext("A Pass List file name with this name already exists.");
 			break;
 		}
@@ -143,27 +159,27 @@ if ($_POST['save']) {
 			$input_errors[] = gettext("A valid alias must be provided");
 
 	if (!$input_errors) {
-		$w_list = array();
+		$p_list = array();
 		/* post user input */
-		$w_list['name'] = $_POST['name'];
-		$w_list['uuid'] = $passlist_uuid;
-		$w_list['localnets'] = $_POST['localnets']? 'yes' : 'no';
-		$w_list['wanips'] = $_POST['wanips']? 'yes' : 'no';
-		$w_list['wangateips'] = $_POST['wangateips']? 'yes' : 'no';
-		$w_list['wandnsips'] = $_POST['wandnsips']? 'yes' : 'no';
-		$w_list['vips'] = $_POST['vips']? 'yes' : 'no';
-		$w_list['vpnips'] = $_POST['vpnips']? 'yes' : 'no';
-
-		$w_list['address'] = $_POST['address'];
-		$w_list['descr']  =  mb_convert_encoding($_POST['descr'],"HTML-ENTITIES","auto");
-		$w_list['detail'] = $final_address_details;
+		$p_list['name'] = $_POST['name'];
+		$p_list['uuid'] = $passlist_uuid;
+		$p_list['localnets'] = $_POST['localnets']? 'yes' : 'no';
+		$p_list['wanips'] = $_POST['wanips']? 'yes' : 'no';
+		$p_list['wangateips'] = $_POST['wangateips']? 'yes' : 'no';
+		$p_list['wandnsips'] = $_POST['wandnsips']? 'yes' : 'no';
+		$p_list['vips'] = $_POST['vips']? 'yes' : 'no';
+		$p_list['vpnips'] = $_POST['vpnips']? 'yes' : 'no';
+
+		$p_list['address'] = $_POST['address'];
+		$p_list['descr']  =  mb_convert_encoding(str_replace("\r\n", "\n", $_POST['descr']),"HTML-ENTITIES","auto");
+		$p_list['detail'] = $final_address_details;
 
 		if (isset($id) && $a_passlist[$id])
-			$a_passlist[$id] = $w_list;
+			$a_passlist[$id] = $p_list;
 		else
-			$a_passlist[] = $w_list;
+			$a_passlist[] = $p_list;
 
-		write_config("Snort pkg: modified PASS LIST {$w_list['name']}.");
+		write_config("Suricata pkg: modified PASS LIST {$p_list['name']}.");
 
 		/* create pass list and homenet file, then sync files */
 		sync_suricata_package_config();
@@ -193,24 +209,28 @@ if ($savemsg)
 <form action="suricata_passlist_edit.php" method="post" name="iform" id="iform">
 <input name="id" type="hidden" value="<?=$id;?>" />
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), true, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$instanceid}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 ?>
 	</td>
 </tr>
 <tr><td><div id="mainarea">
 <table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+	<tbody>
 	<tr>
 		<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Add the name and " .
 		"description of the file."); ?></td>
@@ -286,8 +306,8 @@ if ($savemsg)
 		</td>
 		<td width="78%" class="vtable">
 		<input autocomplete="off" name="address" type="text" class="formfldalias" id="address" size="30" value="<?=htmlspecialchars($pconfig['address']);?>"
-		title="<?=trim(filter_expand_alias($pconfig['address']));?>"/>
-		&nbsp;&nbsp;&nbsp;&nbsp;<input type="button" class="formbtns" value="Aliases" onclick="parent.location='suricata_select_alias.php?id=0&type=host|network&varname=address&act=import&multi_ip=yes&returl=<?=urlencode($_SERVER['PHP_SELF']);?>'" 
+		title="<?=trim(filter_expand_alias($pconfig['address']));?>"/>&nbsp;&nbsp;&nbsp;&nbsp;
+		<input type="button" class="formbtns" value="Aliases" onclick="selectAlias();" 
 		title="<?php echo gettext("Select an existing IP alias");?>"/>
 		</td>
 	</tr>
@@ -298,9 +318,10 @@ if ($savemsg)
 			<input id="cancel" name="cancel" type="submit" class="formbtn" value="Cancel" />
 		</td>
 	</tr>
+	</tbody>
 </table>
 </div>
-</td></tr>
+</td></tr></tbody>
 </table>
 </form>
 <script type="text/javascript">
@@ -326,6 +347,29 @@ function createAutoSuggest() {
 ?>
 }
 
+function selectAlias() {
+
+	var loc;
+	var fields = [ "name", "descr", "localnets", "wanips", "wangateips", "wandnsips", "vips", "vpnips", "address" ];
+
+	// Scrape current form field values and add to
+	// the select alias URL as a query string.
+	var loc = '/suricata/suricata_select_alias.php?id=<?=$id;?>&act=import&type=host|network';
+	loc = loc + '&varname=address&multi_ip=yes';
+	loc = loc + '&returl=<?=urlencode($_SERVER['PHP_SELF']);?>';
+	loc = loc + '&uuid=<?=$passlist_uuid;?>';
+
+	// Iterate over just the specific form fields we want to pass to
+	// the select alias URL.
+	fields.forEach(function(entry) {
+		var tmp = $(entry).serialize();
+		if (tmp.length > 0)
+			loc = loc + '&' + tmp;
+	});
+	
+	window.parent.location = loc; 
+}
+
 setTimeout("createAutoSuggest();", 500);
 
 </script>
diff --git a/config/suricata/suricata_post_install.php b/config/suricata/suricata_post_install.php
index eb193d58..7c8d03a5 100644
--- a/config/suricata/suricata_post_install.php
+++ b/config/suricata/suricata_post_install.php
@@ -51,7 +51,33 @@ require_once("/usr/local/pkg/suricata/suricata.inc");
 
 global $config, $g, $rebuild_rules, $pkg_interface, $suricata_gui_include;
 
+/****************************************
+ * Define any new constants here that   *
+ * may not be yet defined in the old    *
+ * "suricata.inc" include file that     *
+ * might be cached and used by the      *
+ * package manager installation code.   *
+ *                                      *
+ * This is a hack to work around the    *
+ * fact the old version of suricata.inc *
+ * is cached and used instead of the    *
+ * updated version icluded with the     *
+ * updated GUI package.                 *
+ ****************************************/
+if (!defined('SID_MODS_PATH'))
+	define('SID_MODS_PATH', '/var/db/suricata/sidmods/');
+if (!defined('IPREP_PATH'))
+	define('IPREP_PATH', '/var/db/suricata/iprep/');
+
+/****************************************
+ * End of PHP cachine workaround        *
+ ****************************************/
+
+// Initialize some common values from defined constants
 $suricatadir = SURICATADIR;
+$suricatalogdir = SURICATALOGDIR;
+$flowbit_rules_file = FLOWBITS_FILENAME;
+$suricata_enforcing_rules_file = ENFORCING_RULES_FILENAME;
 $rcdir = RCFILEPREFIX;
 
 // Hard kill any running Suricata process that may have been started by any
@@ -73,47 +99,59 @@ if(is_process_running("barnyard")) {
 // Set flag for post-install in progress
 $g['suricata_postinstall'] = true;
 
+// Mount file system read/write so we can modify some files
+conf_mount_rw();
+
 // Remove any previously installed script since we rebuild it
-@unlink("{$rcdir}/suricata.sh");
+@unlink("{$rcdir}suricata.sh");
 
 // Create the top-tier log directory
 safe_mkdir(SURICATALOGDIR);
 
-// remake saved settings
+// Create the IP Rep and SID Mods lists directory
+safe_mkdir(SID_MODS_PATH);
+safe_mkdir(IPREP_PATH);
+
+// remake saved settings if previously flagged
 if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] == 'on') {
 	log_error(gettext("[Suricata] Saved settings detected... rebuilding installation with saved settings..."));
 	update_status(gettext("Saved settings detected..."));
+	/* Do one-time settings migration for new version configuration */
+	update_output_window(gettext("Please wait... migrating settings to new configuration..."));
+	include('/usr/local/pkg/suricata/suricata_migrate_config.php');
 	update_output_window(gettext("Please wait... rebuilding installation with saved settings..."));
 	log_error(gettext("[Suricata] Downloading and updating configured rule types..."));
 	update_output_window(gettext("Please wait... downloading and updating configured rule types..."));
 	if ($pkg_interface <> "console")
 		$suricata_gui_include = true;
-	include('/usr/local/www/suricata/suricata_check_for_rule_updates.php');
+	include('/usr/local/pkg/suricata/suricata_check_for_rule_updates.php');
 	update_status(gettext("Generating suricata.yaml configuration file from saved settings..."));
 	$rebuild_rules = true;
 
 	// Create the suricata.yaml files for each enabled interface
 	$suriconf = $config['installedpackages']['suricata']['rule'];
-	foreach ($suriconf as $value) {
-		$if_real = get_real_interface($value['interface']);
-
-		// ## BETA pkg bug fix-up -- be sure default rules enabled ##
-		$rules = explode("||", $value['rulesets']);
-		foreach (array( "decoder-events.rules", "files.rules", "http-events.rules", "smtp-events.rules", "stream-events.rules", "tls-events.rules" ) as $r){
-			if (!in_array($r, $rules))
-				$rules[] = $r;
-		}
-		natcasesort($rules);
-		$value['rulesets'] = implode("||", $rules);
-		write_config();
-		// ## end of BETA pkg bug fix-up ##
-
-		// create a suricata.yaml file for interface
-		suricata_generate_yaml($value);
+	foreach ($suriconf as $suricatacfg) {
+		$if_real = get_real_interface($suricatacfg['interface']);
+		$suricata_uuid = $suricatacfg['uuid'];
+		$suricatacfgdir = "{$suricatadir}suricata_{$suricata_uuid}_{$if_real}";
+
+		// Pull in the PHP code that generates the suricata.yaml file
+		// variables that will be substituted further down below.
+		include("/usr/local/pkg/suricata/suricata_generate_yaml.php");
+
+		// Pull in the boilerplate template for the suricata.yaml
+		// configuration file.  The contents of the template along
+		// with substituted variables are stored in $suricata_conf_text
+		// (which is defined in the included file).
+		include("/usr/local/pkg/suricata/suricata_yaml_template.inc");
+
+		// Now write out the conf file using $suricata_conf_text contents
+		@file_put_contents("{$suricatacfgdir}/suricata.yaml", $suricata_conf_text); 
+		unset($suricata_conf_text);
 
 		// create barnyard2.conf file for interface
-		if ($value['barnyard_enable'] == 'on')
-			suricata_generate_barnyard2_conf($value, $if_real);
+		if ($suricatacfg['barnyard_enable'] == 'on')
+			suricata_generate_barnyard2_conf($suricatacfg, $if_real);
 	}
 
 	// create Suricata bootup file suricata.sh
@@ -128,10 +166,14 @@ if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] =
 	configure_cron();
 
 	// Restore the Dashboard Widget if it was previously enabled and saved
-	if (!empty($config['installedpackages']['suricata']['config'][0]['dashboard_widget']) && !empty($config['widgets']['sequence']))
-		$config['widgets']['sequence'] .= "," . $config['installedpackages']['suricata']['config'][0]['dashboard_widget'];
-	if (!empty($config['installedpackages']['suricata']['config'][0]['dashboard_widget_rows']) && !empty($config['widgets']))
-		$config['widgets']['widget_suricata_display_lines'] = $config['installedpackages']['suricata']['config'][0]['dashboard_widget_rows'];
+	if (!empty($config['installedpackages']['suricata']['config'][0]['dashboard_widget']) && !empty($config['widgets']['sequence'])) {
+		if (strpos($config['widgets']['sequence'], "suricata_alerts-container") === FALSE)
+			$config['widgets']['sequence'] .= "," . $config['installedpackages']['suricata']['config'][0]['dashboard_widget'];
+	}
+	if (!empty($config['installedpackages']['suricata']['config'][0]['dashboard_widget_rows']) && !empty($config['widgets'])) {
+		if (empty($config['widgets']['widget_suricata_display_lines']))
+			$config['widgets']['widget_suricata_display_lines'] = $config['installedpackages']['suricata']['config'][0]['dashboard_widget_rows'];
+	}
 
 	$rebuild_rules = false;
 	update_output_window(gettext("Finished rebuilding Suricata configuration files..."));
@@ -142,14 +184,22 @@ if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] =
 		update_status(gettext("Starting Suricata using rebuilt configuration..."));
 		update_output_window(gettext("Please wait... while Suricata is started..."));
 		log_error(gettext("[Suricata] Starting Suricata using rebuilt configuration..."));
-		start_service("suricata");
+		mwexec_bg("{$rcdir}suricata.sh start");
 		update_output_window(gettext("Suricata has been started using the rebuilt configuration..."));
 	}
 }
 
+// If this is first install and "forcekeepsettings" is empty,
+// then default it to 'on'.
+if (empty($config['installedpackages']['suricata']['config'][0]['forcekeepsettings']))
+	$config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] = 'on';
+
+// Finished with file system mods, so remount it read-only
+conf_mount_ro();
+
 // Update Suricata package version in configuration
-$config['installedpackages']['suricata']['config'][0]['suricata_config_ver'] = "v1.0.2";
-write_config();
+$config['installedpackages']['suricata']['config'][0]['suricata_config_ver'] = "2.0";
+write_config("Suricata pkg: updated GUI package version number.");
 
 // Done with post-install, so clear flag
 unset($g['suricata_postinstall']);
diff --git a/config/suricata/suricata_rules.php b/config/suricata/suricata_rules.php
index 82bb33eb..aa420371 100644
--- a/config/suricata/suricata_rules.php
+++ b/config/suricata/suricata_rules.php
@@ -41,7 +41,7 @@
 require_once("guiconfig.inc");
 require_once("/usr/local/pkg/suricata/suricata.inc");
 
-global $g, $rebuild_rules;
+global $g, $config, $rebuild_rules;
 
 $suricatadir = SURICATADIR;
 $rules_map = array();
@@ -107,9 +107,27 @@ $emergingdownload = $config['installedpackages']['suricata']['config'][0]['enabl
 $etpro = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'];
 $categories = explode("||", $pconfig['rulesets']);
 
-// Add any previously saved rules files to the categories array
-if (!empty($pconfig['rulesets']))
-	$categories = explode("||", $pconfig['rulesets']);
+// Get any automatic rule category enable/disable modifications
+// if auto-SID Mgmt is enabled, and adjust the available rulesets
+// in the CATEGORY drop-down box as necessary.
+$cat_mods = suricata_sid_mgmt_auto_categories($a_rule[$id], FALSE);
+foreach ($cat_mods as $k => $v) {
+	switch ($v) {
+		case 'disabled':
+			if (($key = array_search($k, $categories)) !== FALSE)
+				unset($categories[$key]);
+			break;
+
+		case 'enabled':
+			if (!in_array($k, $categories))
+				$categories[] = $k;
+			break;
+
+		default:
+			break;
+	}
+}
+
 
 if ($_GET['openruleset'])
 	$currentruleset = htmlspecialchars($_GET['openruleset'], ENT_QUOTES | ENT_HTML401);
@@ -148,7 +166,10 @@ if ($currentruleset != 'custom.rules') {
 		$rules_map = suricata_load_rules_map($rulefile);
 }
 
-/* Load up our enablesid and disablesid arrays with enabled or disabled SIDs */
+/* Process the current category rules through any auto SID MGMT changes if enabled */
+suricata_auto_sid_mgmt($rules_map, $a_rule[$id], FALSE);
+
+/* Load up our enablesid and disablesid arrays with manually enabled or disabled SIDs */
 $enablesid = suricata_load_sid_mods($a_rule[$id]['rule_sid_on']);
 $disablesid = suricata_load_sid_mods($a_rule[$id]['rule_sid_off']);
 
@@ -159,12 +180,16 @@ if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) &
 	$sid = $_POST['sid'];
 
 	// See if the target SID is in our list of modified SIDs,
-	// and toggle it back to default if present; otherwise,
+	// and toggle it opposite state if present; otherwise,
 	// add it to the appropriate modified SID list.
-	if (isset($enablesid[$gid][$sid]))
+	if (isset($enablesid[$gid][$sid])) {
 		unset($enablesid[$gid][$sid]);
-	elseif (isset($disablesid[$gid][$sid]))
+		$disablesid[$gid][$sid] = "disablesid";
+	}
+	elseif (isset($disablesid[$gid][$sid])) {
 		unset($disablesid[$gid][$sid]);
+		$enablesid[$gid][$sid] = "enablesid";
+	}
 	else {
 		if ($rules_map[$gid][$sid]['disabled'] == 1)
 			$enablesid[$gid][$sid] = "enablesid";
@@ -198,8 +223,12 @@ if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) &
 		unset($a_rule[$id]['rule_sid_off']);
 
 	/* Update the config.xml file. */
-	write_config();
+	write_config("Suricata pkg: modified state for rule {$gid}:{$sid} on {$a_rule[$id]['interface']}.");
 
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('suricata_rules');
+
+	// Set a scroll-to anchor location
 	$anchor = "rule_{$gid}_{$sid}";
 }
 elseif ($_POST['disable_all'] && !empty($rules_map)) {
@@ -238,7 +267,10 @@ elseif ($_POST['disable_all'] && !empty($rules_map)) {
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
 
-	write_config();
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('suricata_rules');
+
+	write_config("Suricata pkg: disabled all rules in category {$currentruleset} for {$a_rule[$id]['interface']}.");
 }
 elseif ($_POST['enable_all'] && !empty($rules_map)) {
 
@@ -275,7 +307,10 @@ elseif ($_POST['enable_all'] && !empty($rules_map)) {
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
 
-	write_config();
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('suricata_rules');
+
+	write_config("Suricata pkg: enable all rules in category {$currentruleset} for {$a_rule[$id]['interface']}.");
 }
 elseif ($_POST['resetcategory'] && !empty($rules_map)) {
 
@@ -314,7 +349,10 @@ elseif ($_POST['resetcategory'] && !empty($rules_map)) {
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
 
-	write_config();
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('suricata_rules');
+
+	write_config("Suricata pkg: remove enablesid/disablesid changes for category {$currentruleset} on {$a_rule[$id]['interface']}.");
 }
 elseif ($_POST['resetall'] && !empty($rules_map)) {
 
@@ -322,51 +360,64 @@ elseif ($_POST['resetall'] && !empty($rules_map)) {
 	unset($a_rule[$id]['rule_sid_on']);
 	unset($a_rule[$id]['rule_sid_off']);
 
+	// We changed a rule state, remind user to apply the changes
+	mark_subsystem_dirty('suricata_rules');
+
 	/* Update the config.xml file. */
-	write_config();
+	write_config("Suricata pkg: remove all enablesid/disablesid changes for {$a_rule[$id]['interface']}.");
 }
 elseif ($_POST['clear']) {
 	unset($a_rule[$id]['customrules']);
-	write_config();
+	write_config("Suricata pkg: clear all custom rules for {$a_rule[$id]['interface']}.");
 	$rebuild_rules = true;
+	conf_mount_rw();
 	suricata_generate_yaml($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 	$pconfig['customrules'] = '';
 }
 elseif ($_POST['cancel']) {
 	$pconfig['customrules'] = base64_decode($a_rule[$id]['customrules']);
+	clear_subsystem_dirty('suricata_rules');
 }
 elseif ($_POST['save']) {
 	$pconfig['customrules'] = $_POST['customrules'];
 	if ($_POST['customrules'])
-		$a_rule[$id]['customrules'] = base64_encode($_POST['customrules']);
+		$a_rule[$id]['customrules'] = base64_encode(str_replace("\r\n", "\n", $_POST['customrules']));
 	else
 		unset($a_rule[$id]['customrules']);
-	write_config();
+	write_config("Suricata pkg: save modified custom rules for {$a_rule[$id]['interface']}.");
 	$rebuild_rules = true;
+	conf_mount_rw();
 	suricata_generate_yaml($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 	/* Signal Suricata to "live reload" the rules */
 	suricata_reload_config($a_rule[$id]);
+	clear_subsystem_dirty('suricata_rules');
 }
 elseif ($_POST['apply']) {
 
 	/* Save new configuration */
-	write_config();
+	write_config("Suricata pkg: new rules configuration for {$a_rule[$id]['interface']}.");
 
 	/*************************************************/
 	/* Update the suricata.yaml file and rebuild the */
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	suricata_generate_yaml($a_rule[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Signal Suricata to "live reload" the rules */
 	suricata_reload_config($a_rule[$id]);
+
+	// We have saved changes and done a soft restart, so clear "dirty" flag
+	clear_subsystem_dirty('suricata_rules');
 }
 
-require_once("guiconfig.inc");
 include_once("head.inc");
 
 $if_friendly = convert_friendly_interface_to_friendly_descr($pconfig['interface']);
@@ -392,19 +443,27 @@ if ($savemsg) {
 <input type='hidden' name='openruleset' id='openruleset' value='<?=$currentruleset;?>'/>
 <input type='hidden' name='sid' id='sid' value=''/>
 <input type='hidden' name='gid' id='gid' value=''/>
+
+<?php if (is_subsystem_dirty('suricata_rules')): ?><p>
+<?php print_info_box_np(gettext("A change has been made to a rule state.") . "<br/>" . gettext("Click APPLY when finished to send the changes to the running configuration."));?>
+<?php endif; ?>
+
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tbody>
 	<tr><td>
 	<?php
 		$tab_array = array();
-		$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+		$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 		$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-		$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+		$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 		$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-		$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+		$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 		$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 		$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-		$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+		$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 		$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+		$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+		$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 		display_top_tabs($tab_array, true);
 		echo '</td></tr>';
 		echo '<tr><td class="tabnavtbl">';
@@ -422,6 +481,7 @@ if ($savemsg) {
 	</td></tr>
 	<tr><td><div id="mainarea">
 		<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="4" cellspacing="0">
+			<tbody>
 			<tr>
 				<td class="listtopic"><?php echo gettext("Available Rule Categories"); ?></td>
 			</tr>
@@ -430,7 +490,7 @@ if ($savemsg) {
 					<select id="selectbox" name="selectbox" class="formselect" onChange="go();">
 					<option value='custom.rules'>custom.rules</option>
 					<?php
-						$files = explode("||", $pconfig['rulesets']);
+						$files = $categories;
 						if ($a_rule[$id]['ips_policy_enable'] == 'on')
 							$files[] = "IPS Policy - " . ucfirst($a_rule[$id]['ips_policy']);
 						if ($a_rule[$id]['autoflowbitrules'] == 'on')
@@ -478,6 +538,7 @@ if ($savemsg) {
 			<tr>
 				<td class="vncell">
 					<table width="100%" align="center" border="0" cellpadding="0" cellspacing="0">
+						<tbody>
 						<tr>
 							<td rowspan="5" width="48%" valign="middle"><input type="submit" name="apply" id="apply" value="<?php echo gettext("Apply"); ?>" class="formbtn" 
 							title="<?php echo gettext("Click to rebuild the rules with your changes"); ?>"/><br/><br/>
@@ -534,6 +595,7 @@ if ($savemsg) {
 							gettext("clicking here") . ".</a>";?></td>
 						</tr>
 						<?php endif;?>
+						</tbody>
 					</table>
 				</td>
 			</tr>
@@ -544,7 +606,7 @@ if ($savemsg) {
 				<td>
 					<table id="myTable" class="sortable" style="table-layout: fixed;" width="100%" border="0" cellpadding="0" cellspacing="0">
 						<colgroup>
-							<col width="14" align="left" valign="middle">
+							<col width="16" align="center" valign="middle">
 							<col width="6%" align="center" axis="number">
 							<col width="9%" align="center" axis="number">
 							<col width="52" align="center" axis="string">
@@ -555,8 +617,8 @@ if ($savemsg) {
 							<col axis="string">
 						</colgroup>
 						<thead>
-						   <tr>
-							<th class="list">&nbsp;</th>
+						   <tr class="sortableHeaderRowIdentifier">
+							<th class="list sorttable_nosort">&nbsp;</th>
 							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Proto"); ?></th>
@@ -570,18 +632,35 @@ if ($savemsg) {
 						<tbody>
 
 					<?php
-						$counter = $enable_cnt = $disable_cnt = 0;
+						$counter = $enable_cnt = $disable_cnt = $managed_count = 0;
 						foreach ($rules_map as $k1 => $rulem) {
 							foreach ($rulem as $k2 => $v) {
 								$sid = suricata_get_sid($v['rule']);
 								$gid = suricata_get_gid($v['rule']);
-
-								if (isset($disablesid[$gid][$sid])) {
+								$ruleset = $currentruleset;
+								$style = "";
+
+								if ($v['managed'] == 1) {
+									if ($v['disabled'] == 1) {
+										$textss = "<span class=\"gray\">";
+										$textse = "</span>";
+										$style= "style=\"opacity: 0.4; filter: alpha(opacity=40);\"";
+										$title = gettext("Auto-disabled by settings on SID Mgmt tab");
+									}
+									else {
+										$textss = $textse = "";
+										$ruleset = "suricata.rules";
+										$title = gettext("Auto-managed by settings on SID Mgmt tab");
+									}
+									$iconb = "icon_advanced.gif";
+									$managed_count++;
+								}
+								elseif (isset($disablesid[$gid][$sid])) {
 									$textss = "<span class=\"gray\">";
 									$textse = "</span>";
 									$iconb = "icon_reject_d.gif";
 									$disable_cnt++;
-									$title = gettext("Disabled by user. Click to toggle to default state");
+									$title = gettext("Disabled by user. Click to toggle to enabled state");
 								}
 								elseif (($v['disabled'] == 1) && (!isset($enablesid[$gid][$sid]))) {
 									$textss = "<span class=\"gray\">";
@@ -594,7 +673,7 @@ if ($savemsg) {
 									$textss = $textse = "";
 									$iconb = "icon_reject.gif";
 									$enable_cnt++;
-									$title = gettext("Enabled by user. Click to toggle to default state");
+									$title = gettext("Enabled by user. Click to toggle to disabled state");
 								}
 								else {
 									$textss = $textse = "";
@@ -623,36 +702,44 @@ if ($savemsg) {
 								$message = suricata_get_msg($v['rule']);
 								$sid_tooltip = gettext("View the raw text for this rule");
 
-								echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\" sorttable_customkey=\"\">{$textss}
-								<a id=\"rule_{$gid}_{$sid}\" href='#'><input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
-								document.getElementById('gid').value='{$gid}';\" 
-								src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
-								title='{$title}' name=\"toggle[]\"/></a>{$textse}
-							       </td>
-							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+								echo "<tr><td class=\"listt\" style=\"align:center;\" valign=\"middle\">{$textss}";
+
+								if ($v['managed'] == 1) {
+									echo "<img {$style} src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\" 
+									title='{$title}'/>{$textse}";
+								}
+								else {
+									echo "<a id=\"rule_{$gid}_{$sid}\" href='#'><input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
+									document.getElementById('gid').value='{$gid}';\" 
+									src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
+									title='{$title}' name=\"toggle[]\"/></a>{$textse}";
+								}
+							       echo "</td>
+
+							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									{$textss}{$gid}{$textse}
 							       </td>
-							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									<a href=\"javascript: void(0)\" 
-									onclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\" 
+									onclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\" 
 									title='{$sid_tooltip}'>{$textss}{$sid}{$textse}</a>
 							       </td>
-							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr\" style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									{$textss}{$protocol}{$textse}
 							       </td>
-							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									{$srcspan}{$source}</span>
 							       </td>
-							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									{$srcprtspan}{$source_port}</span>
 							       </td>
-							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 									{$dstspan}{$destination}</span>
 							       </td>
-							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
+							       <td class=\"listr ellipsis\" nowrap style=\"text-align:center;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\">
 								       {$dstprtspan}{$destination_port}</span>
 							       </td>
-								<td class=\"listbg\" style=\"word-wrap:break-word; whitespace:pre-line;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$currentruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\"> 
+								<td class=\"listbg\" style=\"word-wrap:break-word; whitespace:pre-line;\" ondblclick=\"wopen('suricata_rules_edit.php?id={$id}&openruleset={$ruleset}&sid={$sid}&gid={$gid}','FileViewer',800,600);\"> 
 									{$textss}{$message}{$textse}
 							       </td>
 							</tr>";
@@ -667,13 +754,15 @@ if ($savemsg) {
 			<tr>
 				<td>
 					<table width="100%" border="0" cellspacing="0" cellpadding="1">
+						<tbody>
 						<tr>
 							<td width="16"></td>
 							<td class="vexpl" height="35" valign="top">
 							<strong><?php echo gettext("---  Category Rules Summary  ---") . "</strong><br/>" . 
 							gettext("Total Rules: {$counter}") . "&nbsp;&nbsp;&nbsp;&nbsp;" . 
 							gettext("Enabled: {$enable_cnt}") . "&nbsp;&nbsp;&nbsp;&nbsp;" . 
-							gettext("Disabled: {$disable_cnt}"); ?></td>
+							gettext("Disabled: {$disable_cnt}") . "&nbsp;&nbsp;&nbsp;&nbsp;" . 
+							gettext("Auto-Managed: {$managed_count}"); ?></td>
 						</tr>
 						<tr>
 							<td width="16"><img src="../themes/<?= $g['theme']; ?>/images/icons/icon_block.gif"
@@ -695,14 +784,29 @@ if ($savemsg) {
 								width="11" height="11"></td>
 							<td nowrap><?php echo gettext("Rule changed to Disabled by user"); ?></td>
 						</tr>
+					<?php if (!empty($cat_mods)): ?>
+						<tr>
+							<td width="16"><img src="../themes/<?= $g['theme']; ?>/images/icons/icon_advanced.gif"
+								width="11" height="11"></td>
+							<td nowrap><?php echo gettext("Rule auto-enabled by files configured on SID Mgmt tab"); ?></td>
+						</tr>
+						<tr>
+							<td width="16"><img style="opacity: 0.4; filter: alpha(opacity=40);" src="../themes/<?= $g['theme']; ?>/images/icons/icon_advanced.gif"
+								width="11" height="11"></td>
+							<td nowrap><?php echo gettext("Rule auto-disabled by files configured on SID Mgmt tab"); ?></td>
+						</tr>
+					<?php endif; ?>
+						</tbody>
 					</table>
 				</td>
 			</tr>
 		<?php endif;?>
+			</tbody>
 		</table>
 	</div>
 	</td>
 	</tr>
+	</tbody>
 </table>
 </form>
 <script language="javascript" type="text/javascript">
diff --git a/config/suricata/suricata_rules_edit.php b/config/suricata/suricata_rules_edit.php
index 0a4bd62a..8329272f 100644
--- a/config/suricata/suricata_rules_edit.php
+++ b/config/suricata/suricata_rules_edit.php
@@ -73,6 +73,8 @@ $wrap_flag = "off";
 // Correct displayed file title if necessary
 if ($file == "Auto-Flowbit Rules")
 	$displayfile = FLOWBITS_FILENAME;
+elseif ($file == "suricata.rules")
+	$displayfile = "Currently Active Rules";
 else
 	$displayfile = $file;
 
@@ -102,6 +104,8 @@ elseif (isset($_GET['sid']) && is_numericint($_GET['sid']) && isset($_GET['gid']
 	// If flowbit rule, point to interface-specific file
 	if ($file == "Auto-Flowbit Rules")
 		$rules_map = suricata_load_rules_map("{$suricatacfgdir}rules/" . FLOWBITS_FILENAME);
+	elseif ($file == "suricata.rules")
+		$rules_map = suricata_load_rules_map("{$suricatacfgdir}rules/suricata.rules");
 	else
 		$rules_map = suricata_load_rules_map("{$suricatadir}rules/{$file}");
 	$contents = $rules_map[$_GET['gid']][trim($_GET['sid'])]['rule'];
diff --git a/config/suricata/suricata_rules_flowbits.php b/config/suricata/suricata_rules_flowbits.php
index 8d0fd5d3..b16353cb 100644
--- a/config/suricata/suricata_rules_flowbits.php
+++ b/config/suricata/suricata_rules_flowbits.php
@@ -159,7 +159,6 @@ include_once("head.inc");
 ?>
 
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC" >
-
 <?php
 include("fbegin.inc");
 if ($input_errors) print_input_errors($input_errors);
@@ -227,7 +226,7 @@ if ($savemsg)
 				<col axis="string">
 			</colgroup>
 			<thead>
-			   <tr>
+			   <tr class="sortableHeaderRowIdentifier">
 				<th class="listhdrr" axis="number"><?php echo gettext("SID"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Source"); ?></th>
@@ -274,7 +273,7 @@ if ($savemsg)
 
 							// Use "echo" to write the table HTML row-by-row.
 							echo "<tr>" . 
-								"<td class=\"listr\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
+								"<td class=\"listr\" style=\"sorttable_customkey:{$sid};\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
 								"<td class=\"listr\" style=\"text-align:center;\">{$protocol}</td>" . 
 								"<td class=\"listr ellipsis\" nowrap style=\"text-align:center;\"><span title=\"{$rule_content[2]}\">{$source}</span></td>" . 
 								"<td class=\"listr ellipsis\" nowrap style=\"text-align:center;\"><span title=\"{$rule_content[5]}\">{$destination}</span></td>" . 
diff --git a/config/suricata/suricata_rulesets.php b/config/suricata/suricata_rulesets.php
index c939ef25..ce32af20 100644
--- a/config/suricata/suricata_rulesets.php
+++ b/config/suricata/suricata_rulesets.php
@@ -47,7 +47,7 @@ $suricatadir = SURICATADIR;
 $flowbit_rules_file = FLOWBITS_FILENAME;
 
 // Array of default events rules for Suricata
-$default_rules = array( "decoder-events.rules", "files.rules", "http-events.rules", 
+$default_rules = array( "decoder-events.rules", "dns-events.rules", "files.rules", "http-events.rules", 
 			"smtp-events.rules", "stream-events.rules", "tls-events.rules" );
 
 if (!is_array($config['installedpackages']['suricata']['rule'])) {
@@ -63,15 +63,12 @@ if (is_null($id))
 	$id = 0;
 
 if (isset($id) && $a_nat[$id]) {
-	$pconfig['enable'] = $a_nat[$id]['enable'];
-	$pconfig['interface'] = $a_nat[$id]['interface'];
-	$pconfig['rulesets'] = $a_nat[$id]['rulesets'];
-	$pconfig['autoflowbitrules'] = $a_nat[$id]['autoflowbitrules'];
+	$pconfig['autoflowbits'] = $a_nat[$id]['autoflowbitrules'];
 	$pconfig['ips_policy_enable'] = $a_nat[$id]['ips_policy_enable'];
 	$pconfig['ips_policy'] = $a_nat[$id]['ips_policy'];
 }
 
-$if_real = get_real_interface($pconfig['interface']);
+$if_real = get_real_interface($a_nat[$id]['interface']);
 $suricata_uuid = $a_nat[$id]['uuid'];
 $snortdownload = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'] == 'on' ? 'on' : 'off';
 $emergingdownload = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'] == 'on' ? 'on' : 'off';
@@ -81,6 +78,8 @@ $snortcommunitydownload = $config['installedpackages']['suricata']['config'][0][
 $no_emerging_files = false;
 $no_snort_files = false;
 
+$enabled_rulesets_array = explode("||", $a_nat[$id]['rulesets']);
+
 /* Test rule categories currently downloaded to $SURICATADIR/rules and set appropriate flags */
 if ($emergingdownload == 'on') {
 	$test = glob("{$suricatadir}rules/" . ET_OPEN_FILE_PREFIX . "*.rules");
@@ -147,81 +146,73 @@ if ($_POST["save"]) {
 			@unlink("{$suricatadir}suricata_{$suricata_uuid}_{$if_real}/rules/{$flowbit_rules_file}");
 	}
 
-	write_config();
+	write_config("Suricata pkg: save enabled rule categories for {$a_nat[$id]['interface']}.");
 
 	/*************************************************/
 	/* Update the suricata.yaml file and rebuild the */
 	/* rules for this interface.                     */
 	/*************************************************/
 	$rebuild_rules = true;
+	conf_mount_rw();
 	suricata_generate_yaml($a_nat[$id]);
+	conf_mount_ro();
 	$rebuild_rules = false;
 
 	/* Signal Suricata to "live reload" the rules */
 	suricata_reload_config($a_nat[$id]);
+
+	$pconfig = $_POST;
+	$enabled_rulesets_array = explode("||", $enabled_items);
+	if (suricata_is_running($suricata_uuid, $if_real))
+		$savemsg = gettext("Suricata is 'live-loading' the new rule set on this interface.");
 }
 elseif ($_POST['unselectall']) {
 	// Remove all but the default events and files rules
-	$a_nat[$id]['rulesets'] = implode("||", $default_rules);
-
-	if ($_POST['ips_policy_enable'] == "on") {
-		$a_nat[$id]['ips_policy_enable'] = 'on';
-		$a_nat[$id]['ips_policy'] = $_POST['ips_policy'];
-	}
-	else {
-		$a_nat[$id]['ips_policy_enable'] = 'off';
-		unset($a_nat[$id]['ips_policy']);
-	}
+	$enabled_rulesets_array = array();
+	$enabled_rulesets_array = implode("||", $default_rules);
 
-	write_config();
-	sync_suricata_package_config();
+	$savemsg = gettext("All rule categories have been de-selected.  ");
+	if ($_POST['ips_policy_enable'])
+		$savemsg .= gettext("Only the rules included in the selected IPS Policy will be used.");
+	else
+		$savemsg .= gettext("There currently are no inspection rules enabled for this Suricata instance!");
 }
 elseif ($_POST['selectall']) {
 	// Start with the required default events and files rules
-	$rulesets = $default_rules;
-
-	if ($_POST['ips_policy_enable'] == "on") {
-		$a_nat[$id]['ips_policy_enable'] = 'on';
-		$a_nat[$id]['ips_policy'] = $_POST['ips_policy'];
-	}
-	else {
-		$a_nat[$id]['ips_policy_enable'] = 'off';
-		unset($a_nat[$id]['ips_policy']);
-	}
+	$enabled_rulesets_array = $default_rules;
 
 	if ($emergingdownload == 'on') {
 		$files = glob("{$suricatadir}rules/" . ET_OPEN_FILE_PREFIX . "*.rules");
 		foreach ($files as $file)
-			$rulesets[] = basename($file);
+			$enabled_rulesets_array[] = basename($file);
 	}
 	elseif ($etpro == 'on') {
 		$files = glob("{$suricatadir}rules/" . ET_PRO_FILE_PREFIX . "*.rules");
 		foreach ($files as $file)
-			$rulesets[] = basename($file);
+			$enabled_rulesets_array[] = basename($file);
 	}
 
 	if ($snortcommunitydownload == 'on') {
 		$files = glob("{$suricatadir}rules/" . GPL_FILE_PREFIX . "community.rules");
 		foreach ($files as $file)
-			$rulesets[] = basename($file);
+			$enabled_rulesets_array[] = basename($file);
 	}
 
 	/* Include the Snort VRT rules only if enabled and no IPS policy is set */
-	if ($snortdownload == 'on' && $a_nat[$id]['ips_policy_enable'] == 'off') {
+	if ($snortdownload == 'on' && empty($_POST['ips_policy_enable'])) {
 		$files = glob("{$suricatadir}rules/" . VRT_FILE_PREFIX . "*.rules");
 		foreach ($files as $file)
-			$rulesets[] = basename($file);
+			$enabled_rulesets_array[] = basename($file);
 	}
-
-	$a_nat[$id]['rulesets'] = implode("||", $rulesets);
-
-	write_config();
-	sync_suricata_package_config();
 }
 
+// Get any automatic rule category enable/disable modifications
+// if auto-SID Mgmt is enabled.
+$cat_mods = suricata_sid_mgmt_auto_categories($a_nat[$id], FALSE);
+
 // See if we have any Auto-Flowbit rules and enable
 // the VIEW button if we do.
-if ($a_nat[$id]['autoflowbitrules'] == 'on') {
+if ($pconfig['autoflowbits'] == 'on') {
 	if (file_exists("{$suricatadir}suricata_{$suricata_uuid}_{$if_real}/rules/{$flowbit_rules_file}") &&
 	    filesize("{$suricatadir}suricata_{$suricata_uuid}_{$if_real}/rules/{$flowbit_rules_file}") > 0) {
 		$btn_view_flowb_rules = " title=\"" . gettext("View flowbit-required rules") . "\"";
@@ -232,9 +223,7 @@ if ($a_nat[$id]['autoflowbitrules'] == 'on') {
 else
 	$btn_view_flowb_rules = " disabled";
 
-$enabled_rulesets_array = explode("||", $a_nat[$id]['rulesets']);
-
-$if_friendly = convert_friendly_interface_to_friendly_descr($pconfig['interface']);
+$if_friendly = convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']);
 $pgtitle = gettext("Suricata IDS: Interface {$if_friendly} - Categories");
 include_once("head.inc");
 ?>
@@ -258,18 +247,21 @@ if ($savemsg) {
 <form action="suricata_rulesets.php" method="post" name="iform" id="iform">
 <input type="hidden" name="id" id="id" value="<?=$id;?>" />
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php    
 	$tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), true, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php?instance={$id}");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php?instance={$id}");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 	echo '</td></tr>';
 	echo '<tr><td class="tabnavtbl">';
@@ -289,6 +281,7 @@ if ($savemsg) {
 	<td>
 	<div id="mainarea">
 	<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tbody>
 <?php 
 	$isrulesfolderempty = glob("{$suricatadir}rules/*.rules");
 	$iscfgdirempty = array();
@@ -307,18 +300,19 @@ if ($savemsg) {
 <?php else: ?>
 		<tr>
 			<td>
-			<table width="100%" border="0"
-				cellpadding="0" cellspacing="0">
+			<table width="100%" border="0" cellpadding="0" cellspacing="0">
+			<tbody>
 			<tr>
 				<td colspan="4" class="listtopic"><?php echo gettext("Automatic flowbit resolution"); ?><br/></td>
 			</tr>
 			<tr>
-				<td colspan="4" valign="center" class="listn">
+				<td colspan="4" style="vertical-align: middle;" class="listn">
 					<table width="100%" border="0" cellpadding="2" cellspacing="0">
+					   <tbody>
 					   <tr>
 						<td width="15%" class="listn"><?php echo gettext("Resolve Flowbits"); ?></td>
 						<td width="85%"><input name="autoflowbits" id="autoflowbitrules" type="checkbox" value="on" 
-						<?php if ($a_nat[$id]['autoflowbitrules'] == "on" || empty($a_nat[$id]['autoflowbitrules'])) echo "checked"; ?>/>
+						<?php if ($pconfig['autoflowbits'] == "on" || empty($pconfig['autoflowbits'])) echo "checked"; ?>/>
 						&nbsp;&nbsp;<span class="vexpl"><?php echo gettext("If checked, Suricata will auto-enable rules required for checked flowbits.  ");
 						echo gettext("The Default is "); ?><strong><?php echo gettext("Checked."); ?></strong></span></td>
 					   </tr>
@@ -340,6 +334,7 @@ if ($savemsg) {
 						<?php echo "<span class=\"red\"><strong>" . gettext("Note:  ") . "</strong></span>" . gettext("Auto-enabled rules generating unwanted alerts should have their GID:SID added to the Suppression List for the interface."); ?>
 						<br/></td>
 					   </tr>
+					   </tbody>
 					</table>
 				</td>
 			</tr>
@@ -349,8 +344,9 @@ if ($savemsg) {
 				<td colspan="4" class="listtopic"><?php echo gettext("Snort IPS Policy selection"); ?><br/></td>
 			</tr>
 			<tr>
-				<td colspan="4" valign="center" class="listn">
+				<td colspan="4" style="vertical-align: middle;" class="listn">
 					<table width="100%" border="0" cellpadding="2" cellspacing="0">
+					   <tbody>
 					   <tr>
 						<td width="15%" class="listn"><?php echo gettext("Use IPS Policy"); ?></td>
 						<td width="85%"><input name="ips_policy_enable" id="ips_policy_enable" type="checkbox" value="on" <?php if ($a_nat[$id]['ips_policy_enable'] == "on") echo "checked"; ?>
@@ -365,7 +361,9 @@ if ($savemsg) {
 						"although Emerging Threats categories may still be selected if enabled on the Global Settings tab.  " .
 						"These will be added to the pre-defined Snort IPS policy rules from the Snort VRT."); ?><br/></td>
 					   </tr>
-					   <tr id="ips_row1">
+					   </tbody>
+					   <tbody id="ips_controls">
+					   <tr>
 						<td width="15%" class="listn"><?php echo gettext("IPS Policy Selection"); ?></td>
 						<td width="85%"><select name="ips_policy" class="formselect" <?=$policy_select_disable?> >
 									<option value="connectivity" <?php if ($pconfig['ips_policy'] == "connected") echo "selected"; ?>><?php echo gettext("Connectivity"); ?></option>
@@ -374,7 +372,7 @@ if ($savemsg) {
 								</select>
 						&nbsp;&nbsp;<span class="vexpl"><?php echo gettext("Snort IPS policies are:  Connectivity, Balanced or Security."); ?></span></td>
 					   </tr>
-					   <tr id="ips_row2">
+					   <tr>
 						<td width="15%">&nbsp;</td>
 						<td width="85%">
 						<?php echo gettext("Connectivity blocks most major threats with few or no false positives.  " . 
@@ -383,6 +381,7 @@ if ($savemsg) {
 						"Security is a stringent policy.  It contains everything in the first two " .
 						"plus policy-type rules such as Flash in an Excel file."); ?><br/></td>
 					   </tr>
+					   </tbody>
 					</table>
 				</td>
 			</tr>
@@ -392,15 +391,27 @@ if ($savemsg) {
 			</tr>
 			<tr>
 				<td colspan="4">
-					<table width=90% align="center" border="0" cellpadding="2" cellspacing="0">
-						<tr height="45px">
-							<td valign="middle"><input value="Select All" class="formbtns" type="submit" name="selectall" id="selectall" title="<?php echo gettext("Add all to enforcing rules"); ?>"/></td>
-							<td valign="middle"><input value="Unselect All" class="formbtns" type="submit" name="unselectall" id="unselectall" title="<?php echo gettext("Remove all from enforcing rules"); ?>"/></td>
-							<td valign="middle"><input value=" Save " class="formbtns" type="submit" name="save" id="save" title="<?php echo gettext("Save changes to enforcing rules and rebuild"); ?>"/></td>
-							<td valign="middle"><span class="vexpl"><?php echo gettext("Click to save changes and auto-resolve flowbit rules (if option is selected above)"); ?></span></td>
+					<table width="95%" style="margin-left: auto; margin-right: auto;" border="0" cellpadding="2" cellspacing="0">
+						<tbody>
+						<tr height="32px">
+							<td style="vertical-align: middle;"><input value="Select All" class="formbtns" type="submit" name="selectall" id="selectall" title="<?php echo gettext("Add all to enforcing rules"); ?>"/></td>
+							<td style="vertical-align: middle;"><input value="Unselect All" class="formbtns" type="submit" name="unselectall" id="unselectall" title="<?php echo gettext("Remove all from enforcing rules"); ?>"/></td>
+							<td style="vertical-align: middle;"><input value=" Save " class="formbtns" type="submit" name="save" id="save" title="<?php echo gettext("Save changes to enforcing rules and rebuild"); ?>"/></td>
+							<td style="vertical-align: middle;"><span class="vexpl"><?php echo gettext("Click to save changes and auto-resolve flowbit rules (if option is selected above)"); ?></span></td>
+						</tr>
+					<?php if (!empty($cat_mods)): ?>
+						<tr height="20px">
+							<td colspan="4" style="vertical-align: middle;"><img style="vertical-align: text-top;" src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" />
+							<?=gettext("- Category is auto-enabled by SID Mgmt conf files");?>&nbsp;&nbsp;&nbsp;
+							<img style="opacity: 0.4; filter: alpha(opacity=40); vertical-align: text-top;" src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" />
+							<?=gettext("- Category is auto-disabled by SID Mgmt conf files");?></td>
 						</tr>
+					<?php endif; ?>
+						</tbody>
 					</table>
+				</td>
 			</tr>
+
 			<?php if ($no_community_files)
 				$msg_community = "NOTE: Snort Community Rules have not been downloaded.  Perform a Rules Update to enable them.";
 			      else
@@ -412,15 +423,29 @@ if ($savemsg) {
 				<td width="5%" class="listhdrr"><?php echo gettext("Enabled"); ?></td>
 				<td colspan="5" class="listhdrr"><?php echo gettext('Ruleset: Snort GPLv2 Community Rules');?></td>
 			</tr>
-			<?php if (in_array($community_rules_file, $enabled_rulesets_array)): ?>
+			<?php if (isset($cat_mods[$community_rules_file])): ?>
+				<?php if ($cat_mods[$community_rules_file] == 'enabled') : ?>
+					<tr>
+						<td width="5%" class="listr" style="text-align: center;">
+						<img src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" title="<?=gettext("Auto-managed by settings on SID Mgmt tab");?>" /></td>
+						<td colspan="5" class="listr"><a href='suricata_rules.php?id=<?=$id;?>&openruleset=<?=$community_rules_file;?>'><?=gettext("{$msg_community}");?></a></td>
+					</tr>
+				<?php else: ?>
+					<tr>
+						<td width="5%" class="listr" style="text-align: center;">
+						<img style="opacity: 0.4; filter: alpha(opacity=40);" src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" title="<?=gettext("Auto-managed by settings on SID Mgmt tab");?>" /></td>
+						<td colspan="5" class="listr"><?=gettext("{$msg_community}"); ?></td>
+					</tr>
+				<?php endif; ?>
+			<?php elseif (in_array($community_rules_file, $enabled_rulesets_array)): ?>
 			<tr>
-				<td width="5" class="listr" align="center" valign="top">
+				<td width="5%" class="listr" style="text-align: center;">
 				<input type="checkbox" name="toenable[]" value="<?=$community_rules_file;?>" checked="checked"/></td>
 				<td colspan="5" class="listr"><a href='suricata_rules.php?id=<?=$id;?>&openruleset=<?=$community_rules_file;?>'><?php echo gettext("{$msg_community}"); ?></a></td>
 			</tr>
 			<?php else: ?>
 			<tr>
-				<td width="5" class="listr" align="center" valign="top">
+				<td width="5%" class="listr" style="text-align: center;">
 				<input type="checkbox" name="toenable[]" value="<?=$community_rules_file;?>" <?php if ($snortcommunitydownload == 'off') echo "disabled"; ?>/></td>
 				<td colspan="5" class="listr"><?php echo gettext("{$msg_community}"); ?></td>
 			</tr>
@@ -438,19 +463,19 @@ if ($savemsg) {
 			?>
 			<tr id="frheader">
 				<?php if ($emergingdownload == 'on' && !$no_emerging_files): ?>
-					<td width="5%" class="listhdrr" align="center"><?php echo gettext("Enabled"); ?></td>
+					<td width="5%" class="listhdrr" style="text-align: center;"><?php echo gettext("Enabled"); ?></td>
 					<td width="45%" class="listhdrr"><?php echo gettext('Ruleset: ET Open Rules');?></td>
 				<?php elseif ($etpro == 'on' && !$no_emerging_files): ?>
-					<td width="5%" class="listhdrr" align="center"><?php echo gettext("Enabled"); ?></td>
+					<td width="5%" class="listhdrr" style="text-align: center;"><?php echo gettext("Enabled"); ?></td>
 					<td width="45%" class="listhdrr"><?php echo gettext('Ruleset: ET Pro Rules');?></td>
 				<?php else: ?>
-					<td colspan="2" align="center" width="50%" class="listhdrr"><?php echo gettext("{$et_type} rules {$msg_emerging}"); ?></td>
+					<td colspan="2" style="text-align: center;" width="50%" class="listhdrr"><?php echo gettext("{$et_type} rules {$msg_emerging}"); ?></td>
 				<?php endif; ?>
 				<?php if ($snortdownload == 'on' && !$no_snort_files): ?>
-					<td width="5%" class="listhdrr" align="center"><?php echo gettext("Enabled"); ?></td>
+					<td width="5%" class="listhdrr" style="text-align: center;"><?php echo gettext("Enabled"); ?></td>
 					<td width="45%" class="listhdrr"><?php echo gettext('Ruleset: Snort VRT Rules');?></td>
 				<?php else: ?>
-					<td colspan="2" align="center" width="50%" class="listhdrr"><?php echo gettext("Snort VRT rules {$msg_snort}"); ?></td>
+					<td colspan="2" style="text-align: center;" width="50%" class="listhdrr"><?php echo gettext("Snort VRT rules {$msg_snort}"); ?></td>
 				<?php endif; ?>
 				</tr>
 			<?php
@@ -482,15 +507,28 @@ if ($savemsg) {
 					echo "<tr>\n";
 					if (!empty($emergingrules[$j])) {
 						$file = $emergingrules[$j];
-						echo "<td width='5%' class='listr' align=\"center\" valign=\"top\">";
+						echo "<td width='5%' class='listr' align=\"center\">";
 						if(is_array($enabled_rulesets_array)) {
-							if(in_array($file, $enabled_rulesets_array))
+							if(in_array($file, $enabled_rulesets_array) && !isset($cat_mods[$file]))
 								$CHECKED = " checked=\"checked\"";
 							else
 								$CHECKED = "";
 						} else
 							$CHECKED = "";
-						echo "	\n<input type='checkbox' name='toenable[]' value='$file' {$CHECKED} />\n";
+						if (isset($cat_mods[$file])) {
+							if (in_array($file, $enabled_rulesets_array))
+								echo "<input type='hidden' name='toenable[]' value='{$file}' />\n";
+							if ($cat_mods[$file] == 'enabled') {
+								$CHECKED = "enabled";
+								echo "	\n<img src=\"../themes/{$g['theme']}/images/icons/icon_advanced.gif\" width=\"11\" height=\"11\" border=\"0\" title=\"" . gettext("Auto-enabled by settings on SID Mgmt tab") . "\" />\n";
+							}
+							else {
+								echo "	\n<img style=\"opacity: 0.4; filter: alpha(opacity=40);\" src=\"../themes/{$g['theme']}/images/icons/icon_advanced.gif\" width=\"11\" height=\"11\" border=\"0\" title=\"" . gettext("Auto-disabled by settings on SID Mgmt tab") . "\" />\n";
+							}
+						}
+						else {
+							echo "	\n<input type='checkbox' name='toenable[]' value='{$file}' {$CHECKED} />\n";
+						}
 						echo "</td>\n";
 						echo "<td class='listr' width='45%' >\n";
 						if (empty($CHECKED))
@@ -503,17 +541,30 @@ if ($savemsg) {
 
 					if (!empty($snortrules[$j])) {
 						$file = $snortrules[$j];
-						echo "<td class='listr' width='5%' align=\"center\" valign=\"top\">";
+						echo "<td class='listr' width='5%' align=\"center\">";
 						if(is_array($enabled_rulesets_array)) {
 							if (!empty($disable_vrt_rules))
 								$CHECKED = $disable_vrt_rules;
-							elseif(in_array($file, $enabled_rulesets_array))
+							elseif(in_array($file, $enabled_rulesets_array) && !isset($cat_mods[$file]))
 								$CHECKED = " checked=\"checked\"";
 							else
 								$CHECKED = "";
 						} else
 							$CHECKED = "";
-						echo "	\n<input type='checkbox' name='toenable[]' value='{$file}' {$CHECKED} />\n";
+						if (isset($cat_mods[$file])) {
+							if (in_array($file, $enabled_rulesets_array))
+								echo "<input type='hidden' name='toenable[]' value='{$file}' />\n";
+							if ($cat_mods[$file] == 'enabled') {
+								$CHECKED = "enabled";
+								echo "	\n<img src=\"../themes/{$g['theme']}/images/icons/icon_advanced.gif\" width=\"11\" height=\"11\" border=\"0\" title=\"" . gettext("Auto-enabled by settings on SID Mgmt tab") . "\" />\n";
+							}
+							else {
+								echo "	\n<img style=\"opacity: 0.4; filter: alpha(opacity=40);\" src=\"../themes/{$g['theme']}/images/icons/icon_advanced.gif\" width=\"11\" height=\"11\" border=\"0\" title=\"" . gettext("Auto-disabled by settings on SID Mgmt tab") . "\" />\n";
+							}
+						}
+						else {
+							echo "	\n<input type='checkbox' name='toenable[]' value='{$file}' {$CHECKED} />\n";
+						}
 						echo "</td>\n";
 						echo "<td class='listr' width='45%' >\n";
 						if (empty($CHECKED) || $CHECKED == "disabled")
@@ -526,21 +577,30 @@ if ($savemsg) {
 				echo "</tr>\n";
 			}
 		?>
-	</table>
+			</tbody>
+			</table>
 	</td>
 </tr>
-<tr>
-<td colspan="4" class="vexpl">&nbsp;<br/></td>
-</tr>
-			<tr>
-				<td colspan="4" align="center" valign="middle">
-				<input value="Save" type="submit" name="save" id="save" class="formbtn" title=" <?php echo gettext("Click to Save changes and rebuild rules"); ?>"/></td>
-			</tr>
+	<?php if (!empty($cat_mods)): ?>
+		<tr>
+			<td colspan="4" style="vertical-align: middle;"><br/>
+			<img style="vertical-align: text-top;" src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" />
+			<?=gettext(" - Category auto-enabled by parameters in SID Mgmt conf files");?><br/>
+			<img style="opacity: 0.4; filter: alpha(opacity=40); vertical-align: text-top;" src="../themes/<?=$g['theme'];?>/images/icons/icon_advanced.gif" width="11" height="11" border="0" />
+			<?=gettext(" - Category auto-disabled by parameters in SID Mgmt conf files");?><br/><br/></td>
+		</tr>
+	<?php endif; ?>
+	<tr height="32px">
+		<td colspan="4" style="vertical-align: bottom; text-align: center;">
+		<input value="Save" type="submit" name="save" id="save" class="formbtn" title=" <?php echo gettext("Click to Save changes and rebuild rules"); ?>"/></td>
+	</tr>
 <?php endif; ?>
+</tbody>
 </table>
 </div>
 </td>
 </tr>
+</tbody>
 </table>
 </form>
 <?php
@@ -566,28 +626,29 @@ h += 96;
 
 function enable_change()
 {
- var endis = !(document.iform.ips_policy_enable.checked);
- document.iform.ips_policy.disabled=endis;
-
- if (endis) {
-	document.getElementById("ips_row1").style.display="none";
-	document.getElementById("ips_row2").style.display="none";
-	document.getElementById("ips_col1").className="vexpl";
-	document.getElementById("ips_col2").className="vexpl";
- }
- else {
-	document.getElementById("ips_row1").style.display="table-row";
-	document.getElementById("ips_row2").style.display="table-row";
-	document.getElementById("ips_col1").className="vncell";
-	document.getElementById("ips_col2").className="vtable";
- }
- for (var i = 0; i < document.iform.elements.length; i++) {
-    if (document.iform.elements[i].type == 'checkbox') {
-       var str = document.iform.elements[i].value;
-       if (str.substr(0,6) == "snort_")
-          document.iform.elements[i].disabled = !(endis);
-    }
- }
+
+	if (document.getElementById("ips_policy_enable")) {
+		var endis = !(document.iform.ips_policy_enable.checked);
+		document.iform.ips_policy.disabled=endis;
+
+		if (endis) {
+			document.getElementById("ips_controls").style.display="none";
+			document.getElementById("ips_col1").className="";
+			document.getElementById("ips_col2").className="";
+		}
+		else {
+			document.getElementById("ips_controls").style.display="";
+			document.getElementById("ips_col1").className="vncell";
+			document.getElementById("ips_col2").className="vtable";
+		}
+	}
+	for (var i = 0; i < document.iform.elements.length; i++) {
+		if (document.iform.elements[i].type == 'checkbox') {
+			var str = document.iform.elements[i].value;
+			if (str.substr(0,6) == "snort_")
+				document.iform.elements[i].disabled = !(endis);
+		}
+	}
 }
 
 // Set initial state of dynamic HTML form controls
diff --git a/config/suricata/suricata_select_alias.php b/config/suricata/suricata_select_alias.php
index c11802c2..47bbec4a 100644
--- a/config/suricata/suricata_select_alias.php
+++ b/config/suricata/suricata_select_alias.php
@@ -153,8 +153,8 @@ include("head.inc");
 				<col width="35%" align="left" axis="string">
 			</colgroup>
 			<thead>
-			   <tr>
-				<th class="listhdrr"></th>
+			   <tr class="sortableHeaderRowIdentifier">
+				<th class="listhdrr sorttable_nosort"></th>
 				<th class="listhdrr" axis="string"><?=gettext("Alias Name"); ?></th>
 				<th class="listhdrr" axis="string"><?=gettext("Values"); ?></th>
 				<th class="listhdrr" axis="string"><?=gettext("Description"); ?></th>
diff --git a/config/suricata/suricata_sid_mgmt.php b/config/suricata/suricata_sid_mgmt.php
new file mode 100644
index 00000000..c69a9fcd
--- /dev/null
+++ b/config/suricata/suricata_sid_mgmt.php
@@ -0,0 +1,597 @@
+<?php
+/*
+ * suricata_sid_mgmt.php
+ *
+ * Portions of this code are based on original work done for the
+ * Snort package for pfSense from the following contributors:
+ * 
+ * Copyright (C) 2005 Bill Marquette <bill.marquette@gmail.com>.
+ * Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
+ * Copyright (C) 2006 Scott Ullrich
+ * Copyright (C) 2009 Robert Zelaya Sr. Developer
+ * Copyright (C) 2012 Ermal Luci
+ * All rights reserved.
+ *
+ * Adapted for Suricata by:
+ * Copyright (C) 2014 Bill Meeks
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once("guiconfig.inc");
+require_once("/usr/local/pkg/suricata/suricata.inc");
+
+global $g, $config, $rebuild_rules;
+
+$suricatadir = SURICATADIR;
+$pconfig = array();
+
+// Grab saved settings from configuration
+if (!is_array($config['installedpackages']['suricata']['rule']))
+	$config['installedpackages']['suricata']['rule'] = array();
+$a_nat = &$config['installedpackages']['suricata']['rule'];
+
+$pconfig['auto_manage_sids'] = $config['installedpackages']['suricata']['config'][0]['auto_manage_sids'];
+
+// Hard-code the path where SID Mods Lists are stored
+// and disregard any user-supplied path element.
+$sidmods_path = SID_MODS_PATH;
+
+// Set default to not show SID modification lists editor controls
+$sidmodlist_edit_style = "display: none;";
+
+if (!empty($_POST))
+	$pconfig = $_POST;
+
+function suricata_is_sidmodslist_active($sidlist) {
+
+	/*****************************************************
+	 * This function checks all the configured Suricata  *
+	 * interfaces to see if the passed SID Mods List is  *
+	 * used by an interface.                             *
+	 *                                                   *
+	 * Returns: TRUE  if List is in use                  *
+	 *          FALSE if List is not in use              *
+	 *****************************************************/
+
+	global $g, $config;
+
+	if (!is_array($config['installedpackages']['suricata']['rule']))
+		return FALSE;
+
+	foreach ($config['installedpackages']['suricata']['rule'] as $rule) {
+		if ($rule['enable_sid_file'] == $sidlist) {
+			return TRUE;
+		}
+		if ($rule['disable_sid_file'] == $sidlist) {
+			return TRUE;
+		}
+		if ($rule['modify_sid_file'] == $sidlist) {
+			return TRUE;
+		}
+	}
+	return FALSE;
+}
+
+if (isset($_POST['upload'])) {
+	if ($_FILES["sidmods_fileup"]["error"] == UPLOAD_ERR_OK) {
+		$tmp_name = $_FILES["sidmods_fileup"]["tmp_name"];
+		$name = basename($_FILES["sidmods_fileup"]["name"]);
+		move_uploaded_file($tmp_name, "{$sidmods_path}{$name}");
+	}
+	else
+		$input_errors[] = gettext("Failed to upload file {$_FILES["sidmods_fileup"]["name"]}");
+}
+
+if (isset($_POST['sidlist_delete']) && isset($_POST['sidlist_fname'])) {
+	if (!suricata_is_sidmodslist_active(basename($_POST['sidlist_fname'])))
+		unlink_if_exists($sidmods_path . basename($_POST['sidlist_fname']));
+	else
+		$input_errors[] = gettext("This SID Mods List is currently assigned to an interface and cannot be deleted.");
+}
+
+if (isset($_POST['sidlist_edit']) && isset($_POST['sidlist_fname'])) {
+	$file = $sidmods_path . basename($_POST['sidlist_fname']);
+	$data = file_get_contents($file);
+	if ($data !== FALSE) {
+		$sidmodlist_data = htmlspecialchars($data);
+		$sidmodlist_edit_style = "display: table-row-group;";
+		$sidmodlist_name = basename($_POST['sidlist_fname']);
+		unset($data);
+	}
+	else {
+		$input_errors[] = gettext("An error occurred reading the file.");
+	}
+}
+
+if (isset($_POST['save']) && isset($_POST['sidlist_data'])) {
+	if (strlen(basename($_POST['sidlist_name'])) > 0) {
+		$file = $sidmods_path . basename($_POST['sidlist_name']);
+		$data = str_replace("\r\n", "\n", $_POST['sidlist_data']);
+		file_put_contents($file, $data);
+		unset($data);
+	}
+	else {
+		$input_errors[] = gettext("You must provide a valid filename for the SID Mods List.");
+		$sidmodlist_edit_style = "display: table-row-group;";
+	}
+}
+
+if (isset($_POST['save_auto_sid_conf'])) {
+	$config['installedpackages']['suricata']['config'][0]['auto_manage_sids'] = $pconfig['auto_manage_sids'] ? "on" : "off";
+
+	// Grab the SID Mods config for the interfaces from the form's controls array
+	foreach ($_POST['sid_state_order'] as $k => $v) {
+		$a_nat[$k]['sid_state_order'] = $v;
+	}
+	foreach ($_POST['enable_sid_file'] as $k => $v) {
+		if ($v == "None") {
+			unset($a_nat[$k]['enable_sid_file']);
+			continue;
+		}
+		$a_nat[$k]['enable_sid_file'] = $v;
+	}
+	foreach ($_POST['disable_sid_file'] as $k => $v) {
+		if ($v == "None") {
+			unset($a_nat[$k]['disable_sid_file']);
+			continue;
+		}
+		$a_nat[$k]['disable_sid_file'] = $v;
+	}
+	foreach ($_POST['modify_sid_file'] as $k => $v) {
+		if ($v == "None") {
+			unset($a_nat[$k]['modify_sid_file']);
+			continue;
+		}
+		$a_nat[$k]['modify_sid_file'] = $v;
+	}
+
+	// Write the new configuration
+	write_config("Suricata pkg: updated automatic SID management settings.");
+
+	$intf_msg = "";
+
+	// If any interfaces were marked for restart, then do it
+	if (is_array($_POST['torestart'])) {
+		foreach ($_POST['torestart'] as $k) {
+			// Update the suricata.yaml file and
+			// rebuild rules for this interface.
+			$rebuild_rules = true;
+			conf_mount_rw();
+			suricata_generate_yaml($a_nat[$k]);
+			conf_mount_ro();
+			$rebuild_rules = false;
+
+			// Signal Suricata to "live reload" the rules
+			suricata_reload_config($a_nat[$k]);
+
+			$intf_msg .= convert_friendly_interface_to_friendly_descr($a_nat[$k]['interface']) . ", ";
+		}
+		$savemsg = gettext("Changes were applied to these interfaces: " . trim($intf_msg, ' ,') . " and Suricata signaled to live-load the new rules.");
+	}
+}
+
+if (isset($_POST['sidlist_dnload']) && isset($_POST['sidlist_fname'])) {
+	$file = $sidmods_path . basename($_POST['sidlist_fname']);
+	if (file_exists($file)) {
+		ob_start(); //important or other posts will fail
+		if (isset($_SERVER['HTTPS'])) {
+			header('Pragma: ');
+			header('Cache-Control: ');
+		} else {
+			header("Pragma: private");
+			header("Cache-Control: private, must-revalidate");
+		}
+		header("Content-Type: application/octet-stream");
+		header("Content-length: " . filesize($file));
+		header("Content-disposition: attachment; filename = " . basename($file));
+		ob_end_clean(); //important or other post will fail
+		readfile($file);
+	}
+	else
+		$savemsg = gettext("Unable to locate the file specified!");
+}
+
+if (isset($_POST['sidlist_dnload_all_x'])) {
+	$save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"');
+	$file_name = "suricata_sid_conf_files_{$save_date}.tar.gz";
+	exec("cd {$sidmods_path} && /usr/bin/tar -czf /tmp/{$file_name} *");
+
+	if (file_exists("/tmp/{$file_name}")) {
+		ob_start(); //important or other posts will fail
+		if (isset($_SERVER['HTTPS'])) {
+			header('Pragma: ');
+			header('Cache-Control: ');
+		} else {
+			header("Pragma: private");
+			header("Cache-Control: private, must-revalidate");
+		}
+		header("Content-Type: application/octet-stream");
+		header("Content-length: " . filesize("/tmp/{$file_name}"));
+		header("Content-disposition: attachment; filename = {$file_name}");
+		ob_end_clean(); //important or other post will fail
+		readfile("/tmp/{$file_name}");
+
+		// Clean up the temp file
+		@unlink("/tmp/{$file_name}");
+	}
+	else
+		$savemsg = gettext("An error occurred while creating the gzip archive!");
+}
+
+// Get all files in the SID Mods Lists sub-directory as an array
+// Leave this as the last thing before spewing the page HTML
+// so we can pick up any changes made to files in code above.
+$sidmodfiles = return_dir_as_array($sidmods_path);
+$sidmodselections = array_merge(Array( "None" ), $sidmodfiles);
+
+$pgtitle = gettext("Suricata: SID Management");
+include_once("head.inc");
+
+?>
+
+<body link="#000000" vlink="#000000" alink="#000000">
+
+<?php
+include_once("fbegin.inc");
+
+/* Display Alert message, under form tag or no refresh */
+if ($input_errors)
+	print_input_errors($input_errors);
+?>
+
+<form action="suricata_sid_mgmt.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
+<input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
+<input type="hidden" name="sidlist_fname" id="sidlist_fname" value=""/>
+
+<?php
+if ($savemsg) {
+	/* Display save message */
+	print_info_box($savemsg);
+}
+?>
+
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tbody>
+	<tr><td>
+	<?php
+        	$tab_array = array();
+	        $tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
+        	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
+		$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
+		$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
+		$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
+		$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
+		$tab_array[] = array(gettext("Suppress"), false, "/suricata/suricata_suppress.php");
+		$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
+		$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+		$tab_array[] = array(gettext("SID Mgmt"), true, "/suricata/suricata_sid_mgmt.php");
+		$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
+        	display_top_tabs($tab_array, true);
+	?>
+	</td></tr>
+	<tr><td>
+		<div id="mainarea">
+		<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
+			<tbody>
+			<tr>
+				<td colspan="2" valign="top" class="listtopic"><?php echo gettext("General Settings"); ?></td>
+			</tr>
+			<tr>
+				<td width="22%" valign="top" class="vncell"><?php echo gettext("Enable Automatic SID State Management"); ?></td>
+				<td width="78%" class="vtable"><input type="checkbox" id="auto_manage_sids" name="auto_manage_sids" value="on" 
+				<?php if ($pconfig['auto_manage_sids'] == 'on') echo " checked"; ?> onclick="enable_sid_conf();" />&nbsp;<?=gettext("Enable automatic management of rule state ") . 
+				gettext("and content using configuration files.  Default is ") . "<strong>" . gettext("Not Checked") . "</strong>";?>.<br/><br/>
+				<?=gettext("Suricata will automatically enable/disable/modify text rules upon each update using criteria specified in configuration files.  ") . 
+				gettext("The supported configuration file format is the same as that used in the PulledPork and Oinkmaster enablesid.conf, disablesid.conf and ") . 
+				gettext("modifysid.conf files.  You can either upload existing files or create your own."); ?>
+				</td>
+			</tr>
+			</tbody>
+			<tbody id="sid_conf_rows">
+			<tr>
+				<td  colspan="2" valign="top" class="listtopic"><?php echo gettext("SID Management Configuration Files"); ?></td>
+			</tr>
+			<tr>
+				<td colspan="2" class="vtable" align="center" >
+					<table width="100%" border="0" cellpadding="4" cellspacing="0">
+						<tbody id="uploader" style="display: none;">
+						<tr>
+							<td class="list"><br/><?php echo gettext("Click BROWSE to select a file to import, and then click UPLOAD.  Click CLOSE to quit."); ?></td>
+						</tr>
+						<tr>
+							<td class="list"><input type="file" name="sidmods_fileup" id="sidmods_fileup" class="formfld file" size="50" />
+								&nbsp;&nbsp;<input type="submit" name="upload" id="upload" value="<?=gettext("Upload");?>" 
+								title="<?=gettext("Upload selected SID mods list to firewall");?>"/>&nbsp;&nbsp;<input type="button" 
+								value="<?=gettext("Close");?>" onClick="document.getElementById('uploader').style.display='none';" /><br/></td>
+							<td class="list"></td>
+						</tr>
+						</tbody>
+						<tbody>
+						<tr>
+							<td>
+								<table id="maintable" width="100%" border="0" cellpadding="4" cellspacing="0">
+									<colgroup>
+										<col style="width: 45%;">
+										<col style="width: 25%;">
+										<col style="width: 15%;">
+										<col style="width: 15%;">
+									</colgroup>
+									<thead>
+										<tr>
+											<th class="listhdrr"><?php echo gettext("SID Mods List File Name"); ?></th>
+											<th class="listhdrr"><?php echo gettext("Last Modified Time"); ?></th>
+											<th class="listhdrr"><?php echo gettext("File Size"); ?></th>
+											<th class="list" align="left"><img style="cursor:pointer;" name="sidlist_new" id="sidlist_new" 
+											src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" 
+											height="17" border="0" title="<?php echo gettext('Create a new SID Mods List');?>" 
+											onClick="document.getElementById('sidlist_data').value=''; document.getElementById('sidlist_name').value=''; document.getElementById('sidlist_editor').style.display='table-row-group'; document.getElementById('sidlist_name').focus();" />
+											<img style="cursor:pointer;" name="sidlist_import" id="sidlist_import" 
+											onClick="document.getElementById('uploader').style.display='table-row-group';" 
+											src="../themes/<?= $g['theme']; ?>/images/icons/icon_import_alias.gif" width="17" 
+											height="17" border="0" title="<?php echo gettext('Import/Upload a SID Mods List');?>"/>
+											<input type="image" name="sidlist_dnload_all" id="sidlist_dnload_all" 
+											src="../tree/page-file_play.gif" width="16" height="16" border="0" 
+											title="<?php echo gettext('Download all SID Mods List files in a single gzip archive');?>"/>
+											</th>
+										</tr>
+									</thead>
+									<tbody>
+								<?php foreach ($sidmodfiles as $file): ?>
+									<tr>
+										<td class="listr"><?php echo gettext($file); ?></td>
+										<td class="listr"><?=date('M-d Y g:i a', filemtime("{$sidmods_path}{$file}")); ?></td>
+										<td class="listr"><?=format_bytes(filesize("{$sidmods_path}{$file}")); ?> </td>
+										<td class="list"><input type="image" name="sidlist_edit[]" id="sidlist_edit[]" 
+										onClick="document.getElementById('sidlist_fname').value='<?=$file;?>';" 
+										src="../themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" width="17" 
+										height="17" border="0" title="<?php echo gettext('Edit this SID Mods List');?>"/>
+										<input type="image" name="sidlist_delete[]" id="sidlist_delete[]" 
+										onClick="document.getElementById('sidlist_fname').value='<?=$file;?>'; 
+										return confirm('<?=gettext("Are you sure you want to permanently delete this file?  Click OK to continue or CANCEL to quit.");?>');" 
+										src="../themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" 
+										height="17" border="0" title="<?php echo gettext('Delete this SID Mods List');?>"/>
+										<input type="image" name="sidlist_dnload[]" id="sidlist_dnload[]" 
+										onClick="document.getElementById('sidlist_fname').value='<?=$file;?>';" 
+										src="../tree/page-file_play.gif" width="16" height="16" border="0" 
+										title="<?php echo gettext('Download this SID Mods List file');?>"/>
+										</td>
+									</tr>
+								<?php endforeach; ?>
+									</tbody>
+									<tbody id="sidlist_editor" style="<?=$sidmodlist_edit_style;?>">
+									<tr>
+										<td colspan="4">&nbsp;</td>
+									</tr>
+									<tr>
+										<td colspan="4"><strong><?=gettext("File Name: ");?></strong><input type="text" size="45" class="formfld file" id="sidlist_name" name="sidlist_name" value="<?=$sidmodlist_name;?>" />
+										&nbsp;&nbsp;<input type="submit" id="save" name="save" value="<?=gettext(" Save ");?>" title="<?=gettext("Save changes and close editor");?>" />
+										&nbsp;&nbsp;<input type="button" id="cancel" name="cancel" value="<?=gettext("Cancel");?>" onClick="document.getElementById('sidlist_editor').style.display='none';"  
+										title="<?=gettext("Abandon changes and quit editor");?>" /></td>
+									</tr>
+									<tr>
+										<td colspan="4">&nbsp;</td>
+									</tr>
+									<tr>
+										<td colspan="4"><textarea wrap="off" cols="80" rows="20" name="sidlist_data" id="sidlist_data" 
+										style="width:95%; height:100%;"><?=$sidmodlist_data;?></textarea>
+										</td>
+									</tr>
+									</tbody>
+									<tbody>
+									<tr>
+										<td colspan="3" class="vexpl"><br/><span class="red"><strong><?php echo gettext("Note:"); ?></strong></span>
+										<br/><?php echo gettext("SID Mods Lists are stored as local files on the firewall and their contents are " . 
+										"not saved as part of the firewall configuration file."); ?></td>
+										<td class="list"></td>
+									</tr>
+									<tr>
+										<td colspan="3" class="vexpl"><br/><strong><?php echo gettext("File List Controls:"); ?></strong><br/><br/>
+										&nbsp;&nbsp;<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" height="17" border="0" />
+										&nbsp;<?=gettext("Opens the editor window to create a new SID Mods List.  You must provide a valid filename before saving.");?><br/>
+										&nbsp;&nbsp;<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_import_alias.gif" width="17" height="17" border="0" />
+										&nbsp;<?=gettext("Opens the file upload control for uploading a new SID Mods List from your local machine.");?><br/>
+										&nbsp;&nbsp;<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" width="17" height="17" border="0" />
+										&nbsp;<?=gettext("Opens the SID Mods List in a text edit control for viewing or editing its contents.");?><br/>
+										&nbsp;&nbsp;<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0" />
+										&nbsp;<?=gettext("Deletes the SID Mods List from the file system after confirmation.");?><br/>
+										&nbsp;&nbsp;<img src="../tree/page-file_play.gif" width="16" height="16" border="0" />
+										&nbsp;<?=gettext("Downloads the SID Mods List file to your local machine.");?><br/>
+										</td>
+										<td class="list"></td>
+									</tr>
+									</tbody>
+								</table>
+							</td>
+						</tr>
+						</tbody>
+					</table>
+				</td>
+			</tr>
+			<tr>
+				<td  colspan="2" valign="top" class="listtopic"><?php echo gettext("Interface SID Management File Assignments"); ?></td>
+			</tr>
+			<tr>
+				<td colspan="2" class="vtable" align="center" >
+					<table width="100%" border="0" cellpadding="2" cellspacing="0">
+						<tbody>
+						<tr>
+							<td>
+								<table width="100%" border="0" cellpadding="0" cellspacing="0">
+									<colgroup>
+										<col width="4%" align="center">
+										<col width="20" align="center">
+										<col width="16%" align="center">
+										<col width="20%" align="center">
+										<col width="20%" align="center">
+										<col width="20%" align="center">
+									</colgroup>
+									<thead>
+									   <tr>
+										<th class="listhdrr"><?=gettext("Rebuild"); ?></th>
+										<th class="listhdrr"><?=gettext("Interface"); ?></th>
+										<th class="listhdrr"><?=gettext("SID State Order"); ?></th>
+										<th class="listhdrr"><?=gettext("Enable SID File"); ?></th>
+										<th class="listhdrr"><?=gettext("Disable SID File"); ?></th>
+										<th class="listhdrr"><?=gettext("Modify SID File"); ?></th>
+									   </tr>
+									</thead>
+									<tbody>
+								   <?php foreach ($a_nat as $k => $natent): ?>
+									<tr>
+										<td class="listr" align="center">
+											<input type="checkbox" name="torestart[]" id="torestart[]" value="<?=$k;?>" title="<?=gettext("Apply new configuration and rebuild rules for this interface when saving");?>" />
+										</td>
+										<td class="listbg"><?=convert_friendly_interface_to_friendly_descr($natent['interface']); ?></td>
+										<td class="listr" align="center">
+											<select name="sid_state_order[<?=$k?>]" class="formselect" id="sid_state_order[<?=$k?>]">
+												<?php
+													foreach (array("disable_enable" => "Disable, Enable", "enable_disable" => "Enable, Disable") as $key => $order) {
+														if ($key == $natent['sid_state_order'])
+															echo "<option value='{$key}' selected>";
+														else
+															echo "<option value='{$key}'>";
+														echo htmlspecialchars($order) . '</option>';
+													}
+												?>
+											</select>
+										</td>
+										<td class="listr" align="center">
+											<select name="enable_sid_file[<?=$k?>]" class="formselect" id="enable_sid_file[<?=$k?>]">
+												<?php
+													foreach ($sidmodselections as $choice) {
+														if ($choice == $natent['enable_sid_file'])
+															echo "<option value='{$choice}' selected>";
+														else
+															echo "<option value='{$choice}'>";
+														echo htmlspecialchars(gettext($choice)) . '</option>';
+													}
+												?>
+											</select>
+										</td>
+										<td class="listr" align="center">
+											<select name="disable_sid_file[<?=$k?>]" class="formselect" id="disable_sid_file[<?=$k?>]">
+												<?php
+													foreach ($sidmodselections as $choice) {
+														if ($choice == $natent['disable_sid_file'])
+															echo "<option value='{$choice}' selected>";
+														else
+															echo "<option value='{$choice}'>";
+														echo htmlspecialchars(gettext($choice)) . '</option>';
+													}
+												?>
+											</select>
+										</td>
+										<td class="listr" align="center">
+											<select name="modify_sid_file[<?=$k?>]" class="formselect" id="modify_sid_file[<?=$k?>]">
+												<?php
+													foreach ($sidmodselections as $choice) {
+														if ($choice == $natent['modify_sid_file'])
+															echo "<option value='{$choice}' selected>";
+														else
+															echo "<option value='{$choice}'>";
+														echo htmlspecialchars(gettext($choice)) . '</option>';
+													}
+												?>
+											</select>
+										</td>
+									</tr>
+								   <?php endforeach; ?>
+									</tbody>
+								</table>
+							</td>
+						</tr>
+						<tr>
+							<td class="vexpl">&nbsp;
+							</td>
+						</tr>
+						<tr>
+							<td>
+								<table width="100%" cellpadding="2" cellspacing="2" border="0">
+									<tbody>
+									<tr>
+										<td colspan="2" class="vexpl" style="text-align: bottom;"><strong><span class="red"><?=gettext("Notes:");?></span></strong></td>
+									</tr>
+									<tr>
+										<td class="vexpl" style="vertical-align: top;"><?=gettext("1.");?></td>
+										<td class="vexpl"><?=gettext("Check the box beside an interface to immediately apply new auto-SID management ") . 
+										gettext("changes and signal Suricata to live-load the new rules for the interface when clicking SAVE; ") . 
+										gettext("otherwise only the new file assignments will be saved.");?>
+										</td>
+									</tr>
+									<tr>
+										<td class="vexpl" style="vertical-align: top;"><?=gettext("2.");?></td>
+										<td class="vexpl"><?=gettext("SID State Order controls the order in which enable and disable state modifications are performed.  ") . 
+										gettext("An example would be to disable an entire category and later enable only a rule or two from it.  In this case you would ") . 
+										gettext("choose 'disable,enable' for the State Order.  Note that the last action performed takes priority.");?>
+										</td>
+									</tr>
+									<tr>
+										<td class="vexpl" style="vertical-align: top;"><?=gettext("3.");?></td>
+										<td class="vexpl"><?=gettext("The Enable SID File, Disable SID File and Modify SID File controls specify which rule modification ") . 
+										gettext("files are run automatically for the interface.  Setting a file control to 'None' disables that modification.  ") . 
+										gettext("Setting all file controls for an interface to 'None' disables automatic SID state management for the interface.");?>
+										</td>
+									</tr>
+									</tbody>
+								</table>
+							</td>
+						</tr>
+						</tbody>
+					</table>
+				</td>
+			</tr>
+			</tbody>
+			<tbody>
+			<tr>
+				<td colspan="2" class="vexpl" align="center"><input type="submit" id="save_auto_sid_conf" name="save_auto_sid_conf" class="formbtn" value="<?=gettext("Save");?>" title="<?=gettext("Save SID Management configuration");?>" />
+				&nbsp;&nbsp;<?=gettext("Remember to save changes before exiting this page"); ?>
+				</td>
+			</tr>
+			</tbody>
+		</table>
+		</div>
+	</td></tr>
+	</tbody>
+</table>
+</form>
+
+
+<?php include("fend.inc"); ?>
+<script type="text/javascript">
+
+function enable_sid_conf() {
+	var endis = !document.iform.auto_manage_sids.checked;
+	if (endis) {
+		document.getElementById("sid_conf_rows").style.display = "none";
+	}
+	else {
+		document.getElementById("sid_conf_rows").style.display = "";
+	}
+}
+
+enable_sid_conf();
+
+</script>
+</body>
+</html>
diff --git a/config/suricata/suricata_suppress.php b/config/suricata/suricata_suppress.php
index 4f2e8d0d..2fd2deeb 100644
--- a/config/suricata/suricata_suppress.php
+++ b/config/suricata/suricata_suppress.php
@@ -127,18 +127,21 @@ if ($input_errors) {
 
 <form action="/suricata/suricata_suppress.php" method="post"><?php if ($savemsg) print_info_box($savemsg); ?>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tbody>
 <tr><td>
 <?php
         $tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), true, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
 	display_top_tabs($tab_array, true);
 ?>
 </td>
@@ -172,6 +175,7 @@ if ($input_errors) {
 				</td>
 				<td height="20px" valign="middle" nowrap class="list">
 					<table border="0" cellspacing="0" cellpadding="1">
+						<tbody>
 						<tr>
 							<td valign="middle"><a
 							href="suricata_suppress_edit.php?id=<?=$i;?>"><img
@@ -192,6 +196,7 @@ if ($input_errors) {
 							<td>&nbsp;</td>
 						<?php endif; ?>
 						</tr>
+						</tbody>
 					</table>
 				</td>
 			</tr>
@@ -200,6 +205,7 @@ if ($input_errors) {
 				<td class="list" colspan="2"></td>
 				<td  class="list">
 					<table border="0" cellspacing="0" cellpadding="1">
+						<tbody>
 						<tr>
 							<td valign="middle" width="17">&nbsp;</td>
 							<td valign="middle"><a
@@ -207,6 +213,7 @@ if ($input_errors) {
 							src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif"
 							width="17" height="17" border="0" title="<?php echo gettext("add a new list"); ?>"></a></td>
 						</tr>
+						</tbody>
 					</table>
 				</td>
 			</tr>
@@ -224,6 +231,7 @@ if ($input_errors) {
 	gettext("You must first unassign the Suppress List on the Interface Edit tab."); ?>
 	</p></span></td>
 </tr>
+</tbody>
 </table>
 </form>
 <?php include("fend.inc"); ?>
diff --git a/config/suricata/suricata_suppress_edit.php b/config/suricata/suricata_suppress_edit.php
index d4549e56..24572789 100644
--- a/config/suricata/suricata_suppress_edit.php
+++ b/config/suricata/suricata_suppress_edit.php
@@ -157,15 +157,17 @@ if ($savemsg)
 <tr><td>
 <?php
         $tab_array = array();
-	$tab_array[] = array(gettext("Suricata Interfaces"), false, "/suricata/suricata_interfaces.php");
+	$tab_array[] = array(gettext("Interfaces"), false, "/suricata/suricata_interfaces.php");
 	$tab_array[] = array(gettext("Global Settings"), false, "/suricata/suricata_global.php");
-	$tab_array[] = array(gettext("Update Rules"), false, "/suricata/suricata_download_updates.php");
+	$tab_array[] = array(gettext("Updates"), false, "/suricata/suricata_download_updates.php");
 	$tab_array[] = array(gettext("Alerts"), false, "/suricata/suricata_alerts.php");
-	$tab_array[] = array(gettext("Blocked"), false, "/suricata/suricata_blocked.php");
+	$tab_array[] = array(gettext("Blocks"), false, "/suricata/suricata_blocked.php");
 	$tab_array[] = array(gettext("Pass Lists"), false, "/suricata/suricata_passlist.php");
 	$tab_array[] = array(gettext("Suppress"), true, "/suricata/suricata_suppress.php");
-	$tab_array[] = array(gettext("Logs Browser"), false, "/suricata/suricata_logs_browser.php");
+	$tab_array[] = array(gettext("Logs View"), false, "/suricata/suricata_logs_browser.php");
 	$tab_array[] = array(gettext("Logs Mgmt"), false, "/suricata/suricata_logs_mgmt.php");
+	$tab_array[] = array(gettext("SID Mgmt"), false, "/suricata/suricata_sid_mgmt.php");
+	$tab_array[] = array(gettext("Sync"), false, "/pkg_edit.php?xml=suricata/suricata_sync.xml");
         display_top_tabs($tab_array, true);
 ?>
 </td></tr>
diff --git a/config/suricata/suricata_sync.xml b/config/suricata/suricata_sync.xml
new file mode 100644
index 00000000..a85a3d63
--- /dev/null
+++ b/config/suricata/suricata_sync.xml
@@ -0,0 +1,216 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+  <copyright>
+<![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+based on snortsync.xml developed as part
+of pfSense (http://www.pfSense.com)  
+Copyright (C) 2013 Marcello Coutinho
+based on pfblocker_sync.xml
+All rights reserved.
+
+modified for use with Suricata package  
+Copyright (C) 2014 Bill Meeks
+All rights reserved.
+
+Based on m0n0wall (http://m0n0.ch/wall)
+Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+All rights reserved.
+*/
+/* ========================================================================== */
+/*
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code MUST retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form MUST reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+*/
+/* ========================================================================== */
+]]></copyright>
+	<description><![CDATA[Describe your package here]]></description>
+	<requirements>Describe your package requirements here</requirements>
+	<faq>Currently there are no FAQ items provided.</faq>
+	<name>suricatasync</name>
+	<version>1.0</version>
+	<title>Suricata: XMLRPC Sync</title>
+	<include_file>/usr/local/pkg/suricata/suricata.inc</include_file>
+	<tabs>
+		<tab>
+			<text>Interfaces</text>
+			<url>/suricata/suricata_interfaces.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Global Settings</text>
+			<url>/suricata/suricata_global.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Updates</text>
+			<url>/suricata/suricata_download_updates.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Alerts</text>
+			<url>/suricata/suricata_alerts.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Blocks</text>
+			<url>/suricata/suricata_blocked.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Pass Lists</text>
+			<url>/suricata/suricata_passlist.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Suppress</text>
+			<url>/suricata/suricata_suppress.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Logs View</text>
+			<url>/suricata/suricata_logs_browser.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Logs Mgmt</text>
+			<url>/suricata/suricata_logs_mgmt.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>SID Mgmt</text>
+			<url>/suricata/suricata_sid_mgmt.php</url>
+			<no_drop_down/>
+		</tab>
+		<tab>
+			<text>Sync</text>
+			<url>/pkg_edit.php?xml=suricata/suricata_sync.xml</url>
+			<no_drop_down/>
+			<active/>
+		</tab>
+	</tabs>
+	<fields>
+		<field>
+			<name>Suricata Package XMLRPC Sync Settings</name>
+			<type>listtopic</type>
+		</field>
+		<field>
+			<fielddescr>Enable Sync</fielddescr>
+			<fieldname>varsynconchanges</fieldname>
+			<description><![CDATA[All changes will be synced with apply config to the IPs listed below if this option is checked.<br/><br/>
+						<b>Important:</b> While using "Sync to hosts defined below", only sync from host A to B, A to C but <b>do not</B> enable XMLRPC sync <b>to</b> A. This will result in a loop!]]></description>
+			<type>select</type>
+			<required/>
+			<default_value>disabled</default_value>
+			<options>
+				<option><name>Sync to configured system backup server</name><value>auto</value></option>
+				<option><name>Sync to host(s) defined below</name><value>manual</value></option>
+				<option><name>Do not sync this package configuration</name><value>disabled</value></option>
+			</options>
+		</field>
+		<field>
+			<fielddescr>XMLRPC Timeout</fielddescr>
+			<fieldname>varsynctimeout</fieldname>
+			<description><![CDATA[Timeout in seconds for the XMLRPC timeout. Default: 150]]></description>
+			<type>input</type>
+			<default_value>150</default_value>
+			<size>5</size>
+		</field>
+
+		<field>
+			<fielddescr>Refresh Rule Sets</fielddescr>
+			<fieldname>vardownloadrules</fieldname>
+			<description><![CDATA[Ask target hosts to refresh rule sets files on each sync operation.<br/><br/>
+					During each Suricata package sync operation, ask the target remote host to check for 
+					a new set of posted rule sets files and refresh the local copies if necessary.  The default is 
+					to refresh the files if newer versions have been posted.<br/><br/>
+					<b>Note: </b>The sync process will wait for the rules download and rebuild to finish on the target remote host before returning.]]></description>
+			<type>select</type>
+			<default_value>yes</default_value>
+			<options>
+				<option><name>Signal target host to refresh rules files</name><value>yes</value></option>
+				<option><name>Do NOT ask target host to refresh rules files</name><value>no</value></option>
+			</options>
+		</field>
+
+		<field>
+			<fielddescr>Replication Targets</fielddescr>
+			<fieldname>none</fieldname>
+			<type>rowhelper</type>
+			<rowhelper>
+				<rowhelperfield>
+					<fielddescr>Enable</fielddescr>
+					<fieldname>varsyncdestinenable</fieldname>
+					<description><![CDATA[Enable this host as a replication target]]></description>
+					<type>checkbox</type>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>Protocol</fielddescr>
+					<fieldname>varsyncprotocol</fieldname>
+					<description><![CDATA[Choose the protocol of the destination host. Probably <b>http</b> or <b>https</b>]]></description>
+					<type>select</type>
+					<default_value>HTTP</default_value>
+					<options>
+						<option><name>HTTP</name><value>http</value></option>
+						<option><name>HTTPS</name><value>https</value></option>
+					</options>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>IP-Address</fielddescr>
+					<fieldname>varsyncipaddress</fieldname>
+					<description><![CDATA[IP Address of the destination host.]]></description>
+					<type>input</type>
+					<size>15</size>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>Port</fielddescr>
+					<fieldname>varsyncport</fieldname>
+					<description><![CDATA[Choose the sync port of the destination host.]]></description>
+					<type>input</type>
+					<size>3</size>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>Admin Password</fielddescr>
+					<fieldname>varsyncpassword</fieldname>
+					<description><![CDATA[Password of the user "admin" on the destination host.]]></description>
+					<type>password</type>
+					<size>20</size>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>Start Suricata</fielddescr>
+					<fieldname>varsyncsuricatastart</fieldname>
+					<description><![CDATA[Start Suricata on target host if not already running.]]></description>
+					<type>checkbox</type>
+					<value>ON</value>
+				</rowhelperfield>
+			</rowhelper>
+		</field>
+	</fields>
+	<custom_delete_php_command>
+	</custom_delete_php_command>	
+	<custom_php_resync_config_command>
+		write_config("Suricata pkg: updating CARP sync info.");suricata_sync_on_changes();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/config/suricata/suricata_uninstall.php b/config/suricata/suricata_uninstall.php
index 2a82e473..280e2394 100644
--- a/config/suricata/suricata_uninstall.php
+++ b/config/suricata/suricata_uninstall.php
@@ -44,6 +44,8 @@ global $config, $g;
 
 $suricatadir = SURICATADIR;
 $suricatalogdir = SURICATALOGDIR;
+$sidmodspath = SID_MODS_PATH;
+$iprep_path = IPREP_PATH;
 $rcdir = RCFILEPREFIX;
 $suricata_rules_upd_log = RULES_UPD_LOGFILE;
 $suri_pf_table = SURICATA_PF_TABLE;
@@ -71,9 +73,9 @@ sleep(1);
 unlink_if_exists("{$g['varrun_path']}/barnyard2_*.pid");
 
 /* Remove the Suricata cron jobs. */
-install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/suricata/suricata_check_for_rule_updates.php", false);
-install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_check_cron_misc.inc", false);
-install_cron_job("pfctl -t {$suri_pf_table} -T expire" , false);
+install_cron_job("suricata_check_for_rule_updates.php", false);
+install_cron_job("suricata_check_cron_misc.inc", false);
+install_cron_job("{$suri_pf_table}" , false);
 
 /* See if we are to keep Suricata log files on uninstall */
 if ($config['installedpackages']['suricata']['config'][0]['clearlogs'] == 'on') {
@@ -82,6 +84,9 @@ if ($config['installedpackages']['suricata']['config'][0]['clearlogs'] == 'on')
 	mwexec("/bin/rm -rf {$suricatalogdir}");
 }
 
+// Mount filesystem read-write to remove our files
+conf_mount_rw();
+
 /* Remove the Suricata GUI app directories */
 mwexec("/bin/rm -rf /usr/local/pkg/suricata");
 mwexec("/bin/rm -rf /usr/local/www/suricata");
@@ -105,12 +110,15 @@ if (!empty($widgets)) {
 		}
 	}
 	$config['widgets']['sequence'] = implode(",", $widgetlist);
-	write_config();
+	write_config("Suricata pkg: remove Suricata Dashboard Widget on package deinstall.");
 }
 @unlink("/usr/local/www/widgets/include/widget-suricata.inc");
 @unlink("/usr/local/www/widgets/widgets/suricata_alerts.widget.php");
 @unlink("/usr/local/www/widgets/javascript/suricata_alerts.js");
 
+// Finished with filesystem mods so remount it read-only
+conf_mount_ro();
+
 /* Keep this as a last step */
 if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] != 'on') {
 	log_error(gettext("Not saving settings... all Suricata configuration info and logs deleted..."));
@@ -118,6 +126,8 @@ if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] !
 	unset($config['installedpackages']['suricatasync']);
 	@unlink("{$suricata_rules_upd_log}");
 	mwexec("/bin/rm -rf {$suricatalogdir}");
+	mwexec("/bin/rm -rf {$sidmodspath}");
+	mwexec("/bin/rm -rf {$iprep_path}");
 	log_error(gettext("[Suricata] The package has been removed from this system..."));
 }
 
diff --git a/config/suricata/suricata_yaml_template.inc b/config/suricata/suricata_yaml_template.inc
index 44fd1d5f..82c449d3 100644
--- a/config/suricata/suricata_yaml_template.inc
+++ b/config/suricata/suricata_yaml_template.inc
@@ -15,6 +15,10 @@ max-pending-packets: {$max_pend_pkts}
 # Runmode the engine should use.
 runmode: autofp
 
+# If set to auto, the variable is internally switched to 'router' in IPS 
+# mode and 'sniffer-only' in IDS mode.
+host-mode: auto
+
 # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
 autofp-scheduler: active-packets
 
@@ -55,9 +59,7 @@ outputs:
       enabled: {$http_log_enabled}
       filename: http.log
       append: {$http_log_append}
-      #extended: yes     # enable this for extended logging information
-      #custom: yes       # enabled the custom logging format (defined by customformat)
-      #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
+      extended: {$http_log_extended}
       filetype: regular
 
   - pcap-log:
@@ -82,8 +84,8 @@ outputs:
   - syslog:
       enabled: {$alert_syslog}
       identity: suricata
-      facility: auth
-      level: Info
+      facility: {$alert_syslog_facility}
+      level: {$alert_syslog_priority}
 
   - drop:
       enabled: no
@@ -94,8 +96,8 @@ outputs:
   - file-store:
       enabled: {$file_store_enabled}
       log-dir: files
-      force-magic: no
-      force-md5: no
+      force-magic: {$json_log_magic}
+      force-md5: {$json_log_md5}
       waldo: file.waldo
 
   - file-log:
@@ -106,6 +108,21 @@ outputs:
       force-magic: {$json_log_magic}
       force-md5: {$json_log_md5}
 
+  - dns-log:
+      enabled: {$dns_log_enabled}
+      filename: dns.log
+      append: {$dns_log_append}
+      filetype: regular
+
+  - eve-log:
+      enabled: {$enable_eve_log}
+      type: {$eve_output_type}
+      filename: eve.json
+      identity: "suricata"
+      facility: {$eve_systemlog_facility}
+      level: {$eve_systemlog_priority}
+      types: {$eve_out_types}
+
 # Magic file. The extension .mgc is added to the value here.
 magic-file: /usr/share/misc/magic
 
@@ -233,12 +250,13 @@ logging:
       filename: {$suricatalogdir}suricata_{$if_real}{$suricata_uuid}/suricata.log
   - syslog:
       enabled: {$suricata_use_syslog}
-      facility: auth
+      facility: {$suricata_use_syslog_facility}
       format: "[%i] <%d> -- "
 
 pcap:
   - interface: {$if_real}
     checksum-checks: auto
+    promisc: {$intf_promisc_mode}
 
 # For FreeBSD ipfw(8) divert(4) support.
 #   ipfw add 100 divert 8000 ip from any to any
@@ -276,8 +294,8 @@ action-order:
   - alert
 
 # IP Reputation
-#reputation-categories-file: {$suricatacfgdir}/iprep/categories.txt
-#default-reputation-path: {$suricatacfgdir}/iprep
+#reputation-categories-file: {$iprep_path}/categories.txt
+#default-reputation-path: {$iprep_path}
 #reputation-files:
 # - reputation.list
 
@@ -293,6 +311,47 @@ pcre:
   match-limit: 3500
   match-limit-recursion: 1500
 
+# Holds details on the app-layer. The protocols section details each protocol.
+app-layer:
+  protocols:
+    tls:
+      enabled: {$tls_parser}
+      detection-ports:
+        dp: 443
+      #no-reassemble: yes
+    dcerpc:
+      enabled: {$dcerpc_parser}
+    ftp:
+      enabled: {$ftp_parser}
+    ssh:
+      enabled: {$ssh_parser}
+    smtp:
+      enabled: {$smtp_parser}
+    imap:
+      enabled: {$imap_parser}
+    msn:
+      enabled: {$msn_parser}
+    smb:
+      enabled: {$smb_parser}
+      detection-ports:
+        dp: 139
+    dns:
+      global-memcap: {$dns_global_memcap}
+      state-memcap: {$dns_state_memcap}
+      request-flood: {$dns_request_flood_limit}
+
+      tcp:
+        enabled: {$dns_parser_tcp}
+        detection-ports:
+          dp: 53
+      udp:
+        enabled: {$dns_parser_udp}
+        detection-ports:
+          dp: 53
+    http:
+      enabled: {$http_parser}
+      memcap: {$http_parser_memcap}
+
 ###########################################################################
 # Configure libhtp.
 libhtp:
diff --git a/config/tinydns/tinydns.inc b/config/tinydns/tinydns.inc
index 70e149e1..8fb6170f 100644
--- a/config/tinydns/tinydns.inc
+++ b/config/tinydns/tinydns.inc
@@ -92,10 +92,11 @@ svscan_start () {
         /usr/bin/env \
         PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
         /usr/sbin/daemon -f /bin/sh -c "\$command \$svscan_servicedir 2>&1 | /usr/local/bin/multilog t \$logdir" > /dev/null
+
 EOD;
 if ($enableipmonitoring) {
 	$svscan .= <<<EOD
-        minicron {$refreshinterval} {$g['varrun_path']}/ping_hosts.pid "/etc/ping_hosts.sh; cd {$g['varetc_path']}/tinydns/root && /usr/local/bin/tinydns-data"
+       /usr/local/bin/minicron {$refreshinterval} {$g['varrun_path']}/ping_hosts.pid "/usr/local/bin/ping_hosts.sh"
 EOD;
 }
 $svscan .= <<<EOD
@@ -105,6 +106,7 @@ $svscan .= <<<EOD
 svscan_stop_post () {
         echo "Stopping svscan."
         find -L "\$svscan_servicedir" -mindepth 1 -maxdepth 2 -type d \( \! -path "\$svscan_servicedir/*/*" -or -name 'log' \) -print0 | xargs -0 /usr/local/bin/svc -dx
+		/bin/pkill -F /var/run/ping_hosts.pid
 }
 
 run_rc_command "\$1"
@@ -117,11 +119,12 @@ EOD;
 	$filename = "tinydns.sh";
 	$start = "/usr/local/bin/php -q -d auto_prepend_file=config.inc <<ENDPHP
 <?php
+	require_once(\"functions.inc\");
 	require_once(\"/usr/local/pkg/tinydns.inc\");
 	tinydns_custom_php_changeip_command();
 	tinydns_create_zone_file();\n";
 	if ($enableipmonitoring) {
-		$start .= "tinydns_setup_ping_items();\n";
+		$start .= 	"tinydns_setup_ping_items();\n";
 	}
 	$start .= "?>
 ENDPHP\n";
@@ -140,7 +143,6 @@ ENDPHP\n";
 	/bin/rm -rf {$g['varetc_path']}/dnscache* 2>/dev/null
 	/bin/rm -rf {$g['varetc_path']}/axfrdns 2>/dev/null
 	/bin/rm -rf {$g['varrun_path']}/axfrdns 2>/dev/null
-	/bin/pkill -F /var/run/ping_hosts.pid
 
 ENDSH;
 
@@ -359,16 +361,16 @@ function tinydns_get_record_status($record, $pingthreshold = "", $wanpingthresho
 	return "UP";
 }
 
-function tinydns_get_backup_record($record) {
+function tinydns_get_backup_record($record, $recordtype) {
 	global $g, $config;
 	if($config['installedpackages']['tinydnsdomains']) {
 		foreach($config['installedpackages']['tinydnsdomains']['config'] as $domain) {
-			if($domain['ipaddress'] == $record) {
-				/* if no failover host exists, simply return original record */
+			if($domain['hostname'] == $record && $domain['recordtype'] == $recordtype) {
+				/* if no failover host exists, simply return original ipaddress */
 				if(!$domain['row'])
-					return $record;
+					return $domain['ipaddress'];
 				foreach($domain['row'] as $row) {
-					$status = tinydns_get_record_status($row['failoverip']);
+					$status = tinydns_get_record_status($row['monitorip']);
 					if($status == "UP")
 						return $row['failoverip'];
 				}
@@ -398,39 +400,60 @@ function tinydns_setup_ping_items() {
 	 *   status and create a database of the status information that we can use.
 	 */
 	foreach($config['installedpackages']['tinydnsdomains']['config'] as $domain) {
-		if(!in_array($domain['ipaddress'], $processed)) {
-			fwrite($fd, $ip . "|" . $domain['ipaddress'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php\n");
-			$processed[] = $domain['ipaddress'];
-		}
-		if($domain['monitorip'] <> "")
-			$monitorip = $domain['monitorip'];
+		if(!$domain['monitorip'])
+			continue;
+		if($domain['recordtype'] == "AAAA")
+			$inet = "inet6";
+		else
+			$inet = "";
+		$monitorip = $domain['monitorip'];
+		$interface = $domain['interface'];
 		if($domain['row']) {
 			foreach($domain['row'] as $row) {
 				if($row['pingthreshold'])
 					$pingthreshold = $row['pingthreshold'];
 				else
-					$row['pingthreshold'] = "";
+					$pingthreshold = "";
+				
+				if($row['wanpingthreshold'])
+					$wanpingthreshold = $row['wanpingthreshold'];
+				else
+					$wanpingthreshold = "";
+				
+				$info = get_interface_info($row['interface']);
+				if($domain['recordtype'] == "AAAA")					
+					$ip = $info['ipaddrv6'];
+				else
+					$ip = $info['ipaddr'];
+				
 				if($row['monitorip']) {
 					if(!in_array($row['monitorip'], $processed)) {
-						fwrite($fd, $ip . "|" . $row['monitorip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}\n");
+						fwrite($fd, $ip . "|" . $row['monitorip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}|{$wanpingthreshold}|{$inet}\n");
 						$processed[] = $row['monitorip'];
 					}
 				} else {
 					if(!in_array($monitorip, $processed)) {
-						fwrite($fd, $ip . "|" . $monitorip . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}\n");
+						fwrite($fd, $ip . "|" . $monitorip . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}|{$wanpingthreshold}|{$inet}\n");
 						$processed[] = $monitorip;
 					}
 				}
 			}
 		}
+		
+		$info = get_interface_info($domain['interface']);
+		if($domain['recordtype'] == "AAAA") 			
+			$ip = $info['ipaddrv6'];
+		else
+			$ip = $info['ipaddr'];
+			
 		if($domain['monitorip']) {
 			if(!in_array($domain['monitorip'], $processed)) {
-				fwrite($fd, $ip . "|" . $domain['monitorip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}\n");
+				fwrite($fd, $ip . "|" . $domain['monitorip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}|{$wanpingthreshold}|{$inet}\n");
 				$processed[] = $domain['monitorip'];
 			}
 		} else {
 			if(!in_array($row['failoverip'], $processed)) {
-				fwrite($fd, $ip . "|" . $row['failoverip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}\n");
+				fwrite($fd, $ip . "|" . $row['failoverip'] . "|1|/usr/local/pkg/tinydns_down.php|/usr/local/pkg/tinydns_up.php|{$pingthreshold}|{$wanpingthreshold}|{$inet}\n");
 				$processed[] = $row['failoverip'];
 			}
 		}
@@ -535,7 +558,9 @@ function tinydns_create_zone_file() {
 		for($x=0; $x< count($config['installedpackages']['tinydnsdomains']['config']); $x++) {
 			$domain = $config['installedpackages']['tinydnsdomains']['config'][$x];
 			$record_data = "";
+			$monitorip = "";
 			$hostname = $domain['hostname'];
+			$recordtype = $domain['recordtype'];
 			$ipaddress = $domain['ipaddress'];
 			$ttl = $domain['ttl'];
 			$dist = $domain['dist'];
@@ -549,9 +574,9 @@ function tinydns_create_zone_file() {
 				if($status == "DOWN") {
 					if($debug)
 						log_error("$ipaddress monitor ip $monitorip is offline.");
-					$ipaddress = tinydns_get_backup_record($ipaddress);
+					$ipaddress = tinydns_get_backup_record($hostname, $recordtype);
 					if($debug)
-						log_error("tinydns_get_backup_record returned $ipaddress ");
+						log_error("tinydns_get_backup_record for $hostname returned $ipaddress ");
 				}
 			}
 			$record_data = tinydns_get_rowline_data($ipaddress, $domain['recordtype'], $ttl, $hostname, $domain['rdns'], $dist, $domain['src_port'], $domain['src_weight'], $domain['src_priority'], $domain['src_timestamp']);
@@ -694,7 +719,8 @@ function tinydns_do_xmlrpc_sync($sync_to_ip, $password) {
 	
 	/* tell tinydns to reload our settings on the destionation sync host. */
 	$method = 'pfsense.exec_php';
-	$execcmd  = "require_once('/usr/local/pkg/tinydns.inc');\n";
+	$execcmd  = "require_once('functions.inc');\n";
+	$execcmd .= "require_once('/usr/local/pkg/tinydns.inc');\n";
 	$execcmd .= "tinydns_custom_php_changeip_command();\n";
 	$execcmd .= "tinydns_create_zone_file();\n";
 	if ($config['installedpackages']['tinydns']['config'][0]['enableipmonitoring']) {
@@ -1099,6 +1125,9 @@ function tinydns_get_dns_record_type($tinydnsrecord) {
 		case($tinydnsrecord[0] == "+"):
 			$rtype = "A";
 			break;
+		case($tinydnsrecord[0] == ":"):
+			$rtype = "AAAA";
+			break;
 		case($tinydnsrecord[0] == "@"):
 			$rtype = "MX";
 			break;
diff --git a/config/tinydns/tinydns_domains.xml b/config/tinydns/tinydns_domains.xml
index bf2194b3..52d287f5 100644
--- a/config/tinydns/tinydns_domains.xml
+++ b/config/tinydns/tinydns_domains.xml
@@ -83,6 +83,10 @@
 			<fieldname>recordtype</fieldname>
 		</columnitem>
 		<columnitem>
+			<fielddescr>Prio</fielddescr>
+			<fieldname>dist</fieldname>
+		</columnitem>
+		<columnitem>
 			<fielddescr>rDNS</fielddescr>
 			<fieldname>rdns</fieldname>
 		</columnitem>
@@ -94,6 +98,10 @@
 			<fielddescr>TTL</fielddescr>
 			<fieldname>ttl</fieldname>
 		</columnitem>
+		<columnitem>
+			<fielddescr>monitoring</fielddescr>
+			<fieldname>monitorip</fieldname>
+		</columnitem>
 	</adddeleteeditpagefields>
 	<fields>
 		<field>
@@ -250,6 +258,13 @@
 			<size>35</size>
 		</field>
 		<field>
+			<fielddescr>Interface</fielddescr>
+			<description>interface to ping via</description>
+			<fieldname>interface</fieldname>
+			<type>interfaces_selection</type>
+			<size>1</size>
+		</field>
+		<field>
 			<fielddescr>Failover hold time</fielddescr>
 			<description>Time in minutes before DNS switches to backup host</description>
 			<fieldname>threshhold</fieldname>
@@ -295,6 +310,13 @@
 				    <type>input</type>
 				    <size>15</size>
 				</rowhelperfield>
+				<rowhelperfield>
+				    <fielddescr>interface</fielddescr>
+				    <fieldname>interface</fieldname>
+				    <description>interface to ping via</description>
+				    <type>interfaces_selection</type>
+				    <size>1</size>
+				</rowhelperfield>
 		    </rowhelper>
 		</field>
 	</fields>
diff --git a/config/tinydns/tinydns_status.php b/config/tinydns/tinydns_status.php
index ba119da9..afc37f1c 100644
--- a/config/tinydns/tinydns_status.php
+++ b/config/tinydns/tinydns_status.php
@@ -30,6 +30,7 @@
 */
 
 require("guiconfig.inc");
+require("tinydns.inc");
 
 /* Defaults to this page but if no settings are present, redirect to setup page */
 if(!$config['installedpackages']['tinydnsdomains']['config'])
@@ -79,10 +80,11 @@ if ($pf_version < 2.0)
     <td class="tabcont" >
       <table width="100%" border="0" cellpadding="0" cellspacing="0">
 	<tr>
-          <td width="55%" class="listhdrr">IP</td>
-          <td width="15%" class="listhdrr">Status</td>
+          <td width="45%" class="listhdrr">IP</td>
+          <td width="10%" class="listhdrr">Status</td>
           <td width="15%" class="listhdrr">In Service</td>
-          <td width="25%" class="listhdrr">Response time</td>
+		  <td width="15%" class="listhdrr">Monitor ip</td>
+          <td width="15%" class="listhdrr">Response time</td>
 		</tr>
 
 <?php
@@ -104,7 +106,8 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 		$status = file_get_contents("/var/db/pingstatus/$monitorip");
 	else
 		$status = "N/A";
-	if(stristr($tinydns_data, "+{$hostname}:{$ipaddress}"))
+	$ip6 = tinydns_get_ip6_format($ipaddress);
+	if(stristr($tinydns_data, "+{$hostname}:{$ipaddress}") || stristr($tinydns_data, "={$hostname}:{$ipaddress}") || stristr($tinydns_data, ":{$hostname}:28:{$ip6}"))
 		$inservice = "<FONT COLOR='GREEN'>YES</FONT>";
 	else
 		$inservice = "<FONT COLOR='BLUE'>NO</FONT>";
@@ -115,8 +118,10 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 	echo "<td class=\"listlr\">";
 	if(stristr($status,"DOWN"))
 		echo "<FONT COLOR='red'>DOWN</FONT>";
-	else
+	else if(stristr($status,"UP"))
 		echo "UP";
+	else
+		echo "N/A";
 	echo "</td>";
 
 	echo "<td class=\"listlr\">";
@@ -130,7 +135,16 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 		$msstatus = file_get_contents("/var/db/pingmsstatus/$monitorip");
 	else
 		$msstatus = "N/A";
-	echo "<!-- " . $monitorip . " -->" . $msstatus;
+	echo $monitorip;
+	echo "</td>";
+	echo "<td class=\"listlr\">";
+	if(!$monitorip)
+		$monitorip = $ipaddress;
+	if(file_exists("/var/db/pingmsstatus/$monitorip"))
+		$msstatus = file_get_contents("/var/db/pingmsstatus/$monitorip");
+	else
+		$msstatus = "N/A";
+	echo $msstatus;
 	echo "</td>";
 	echo "</tr>";
 
@@ -146,7 +160,8 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 		echo $ipaddress;
 		if($row['loadbalance'])
 			echo " (LB)";
-		if(stristr($tinydns_data, "+{$hostname}:{$row['failoverip']}"))
+		$ip6 = tinydns_get_ip6_format($row['failoverip']);
+		if(stristr($tinydns_data, "+{$hostname}:{$row['failoverip']}") || stristr($tinydns_data, "={$hostname}:{$row['failoverip']}") || stristr($tinydns_data, ":{$hostname}:28:{$ip6}"))
 			$inservice = "<FONT COLOR='GREEN'>YES</FONT>";
 		else
 			$inservice = "<FONT COLOR='BLUE'>NO</FONT>";
@@ -154,8 +169,11 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 		echo "<td class=\"listlr\">";
 		if(stristr($status,"DOWN"))
 			echo "<FONT COLOR='red'>DOWN</FONT>";
-		else
+		else if(stristr($status,"UP"))
 			echo "UP";
+		else
+			echo "N/A";
+
 		echo "</td>";
 
 		echo "<td class=\"listlr\">";
@@ -169,8 +187,17 @@ foreach($config['installedpackages']['tinydnsdomains']['config'] as $ping) {
 			$msstatus = file_get_contents("/var/db/pingmsstatus/$monitorip");
 		else
 			$msstatus = "N/A";
+		echo $monitorip;
+		echo "</td>";
+		echo "<td class=\"listlr\">";
+		if(!$monitorip)
+			$monitorip = $ipaddress;
+		if(file_exists("/var/db/pingmsstatus/$monitorip"))
+			$msstatus = file_get_contents("/var/db/pingmsstatus/$monitorip");
+		else
+			$msstatus = "N/A";
 
-		echo "<!-- " . $monitorip . " -->" . $msstatus;
+		echo $msstatus;
 		echo "</td>";
 		echo "</tr>";
 	}
diff --git a/config/tinydns/tinydns_view_logs.php b/config/tinydns/tinydns_view_logs.php
index 57daa02e..4b4f3c3f 100644
--- a/config/tinydns/tinydns_view_logs.php
+++ b/config/tinydns/tinydns_view_logs.php
@@ -32,7 +32,7 @@
 require("guiconfig.inc");
 
 if($_REQUEST['getactivity']) {
-	$tinydnslogs = `cat /var/run/service/tinydns/log/main/current | /usr/local/bin/tai64nlocal | php -f /usr/local/pkg/tinydns_parse_logs.php | grep -v ":0"`;
+	$tinydnslogs = `cat /var/run/service/tinydns/log/main/current | /usr/local/bin/tai64nlocal | php -f /usr/local/pkg/tinydns_parse_logs.php | grep -v ":0 "`;
 	echo "TinyDNS Server logs as of " . date("D M j G:i:s T Y")  . "\n\n";
 	echo $tinydnslogs;
 	exit;
@@ -53,8 +53,9 @@ include("head.inc");
 
 /* NEED TO FIX */
 if ($_POST['clear']) {
-//	exec("rm /etc/tinydns/log/main/current");
-//	exec("touch /etc/tinydns/log/main/current");
+	exec("rm /var/etc/tinydns/log/main/current");
+	exec("touch /var/etc/tinydns/log/main/current");
+	exec("chown Gdnslog /var/etc/tinydns/log/main/current");
 }
 
 ?>
diff --git a/config/zabbix2/zabbix2-agent.xml b/config/zabbix2/zabbix2-agent.xml
index 57ef7be3..3d2400ad 100644
--- a/config/zabbix2/zabbix2-agent.xml
+++ b/config/zabbix2/zabbix2-agent.xml
@@ -6,7 +6,7 @@
 /* ========================================================================== */
 /*
     zabbix2-agent.xml
-    part of the Zebedee package for pfSense
+    part of the Zabbix package for pfSense
     Copyright (C) 2013 Danilo G. Baio
 	Copyright (C) 2013 Marcello Coutinho
 	
@@ -41,7 +41,7 @@
 	<name>zabbixagent</name>
 	<title>Services: Zabbix-2 Agent</title>
 	<category>Monitoring</category>
-	<version>0.8.1</version>
+	<version>0.8.3</version>
 	<include_file>/usr/local/pkg/zabbix2.inc</include_file>
 	<addedit_string>Zabbix Agent has been created/modified.</addedit_string>
 	<delete_string>Zabbix Agent has been deleted.</delete_string>
diff --git a/config/zabbix2/zabbix2-proxy.xml b/config/zabbix2/zabbix2-proxy.xml
index b51d1d6b..00d9b106 100644
--- a/config/zabbix2/zabbix2-proxy.xml
+++ b/config/zabbix2/zabbix2-proxy.xml
@@ -6,7 +6,7 @@
 /* ========================================================================== */
 /*
     zabbix2-proxy.xml
-    part of the Zebedee package for pfSense
+    part of the Zabbix package for pfSense
     Copyright (C) 2013 Danilo G. Baio
     Copyright (C) 2013 Marcello Coutinho
 
@@ -41,7 +41,7 @@
 	<name>zabbixproxy</name>
 	<title>Services: Zabbix-2 Proxy</title>
 	<category>Monitoring</category>
-	<version>0.8.1</version>
+	<version>0.8.3</version>
 	<include_file>/usr/local/pkg/zabbix2.inc</include_file>
 	<addedit_string>Zabbix Proxy has been created/modified.</addedit_string>
 	<delete_string>Zabbix Proxy has been deleted.</delete_string>
diff --git a/config/zabbix2/zabbix2.inc b/config/zabbix2/zabbix2.inc
index c2ff4244..13713988 100644
--- a/config/zabbix2/zabbix2.inc
+++ b/config/zabbix2/zabbix2.inc
@@ -3,7 +3,7 @@
 /* ========================================================================== */
 /*
     zabbix2-proxy.inc
-    part of the Zebedee package for pfSense
+    part of the Zabbix package for pfSense
     Copyright (C) 2013 Danilo G. Baio
 	Copyright (C) 2013 Marcello Coutinho
 
diff --git a/pkg_config.10.xml b/pkg_config.10.xml
index 83542812..b48cf388 100644
--- a/pkg_config.10.xml
+++ b/pkg_config.10.xml
@@ -53,7 +53,7 @@
 		<descr><![CDATA[The most widely used name server software]]></descr>
 		<website>http://www.isc.org/downloads/BIND/</website>
 		<category>Services</category>
-		<version>9.9.5_17 pkg v 0.3.3</version>
+		<version>9.9.5_17 pkg v 0.3.5</version>
 		<status>RC</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/bind/bind.xml</config_file>
@@ -79,19 +79,6 @@
 		<configurationfile>filer.xml</configurationfile>
 	</package>
 	<package>
-		<name>Country Block</name>
-		<website/>
-		<descr>Block countries - This has been replaced by pfblocker. &lt;u&gt;This is a legacy app&lt;/u&gt;</descr>
-		<category>Firewall</category>
-		<pkginfolink>https://forum.pfsense.org/index.php/topic,25732.0.html</pkginfolink>
-		<config_file>https://packages.pfsense.org/packages/config/countryblock/countryblock.xml</config_file>
-		<version>0.2.4</version>
-		<status>Beta</status>
-		<required_version>2.2</required_version>
-		<maintainer>tom@tomschaefer.org</maintainer>
-		<configurationfile>countryblock.xml</configurationfile>
-	</package>
-	<package>
 		<name>Strikeback</name>
 		<descr>Detect port scans with iplog and strikeback</descr>
 		<website/>
@@ -196,7 +183,7 @@
 		<build_pbi>
 			<ports_before>security/openssl</ports_before>
 			<custom_name>haproxy-devel</custom_name>
-			<port>/usr/ports/net/haproxy-devel</port>
+			<port>/usr/ports/net/haproxy</port>
 		</build_pbi>
 		<build_options>WITH_OPENSSL_PORT=yes;OPTIONS_UNSET_FORCE=PCRE DPCRE;OPTIONS_SET_FORCE=OPENSSL SPCRE</build_options>
 	</package>
@@ -209,11 +196,11 @@
 			In addition this package allows URL forwarding which can be convenient for hosting multiple websites behind pfSense using 1 IP address.<br>
 			<b>Backup your location config before updating from 0.2.x to 0.3 package version.</b>]]></descr>
 		<category>Network Management</category>
-		<version>2.4.9_2kg v0.41</version>
+		<version>2.4.9_2kg v0.42</version>
 		<status>ALPHA</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/apache_mod_security-dev/apache_virtualhost.xml</config_file>
-		<depends_on_package_pbi>proxy_mod_security-2.4.9_2-##ARCH##.pbi git-1.9.3-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>proxy_mod_security-2.4.9_4-##ARCH##.pbi git-1.9.3-##ARCH##.pbi</depends_on_package_pbi>
 		<configurationfile>apache_virtualhost.xml</configurationfile>
 		<build_pbi>
 			<custom_name>proxy_mod_security</custom_name>
@@ -230,11 +217,11 @@
 		<website>http://www.modsecurity.org/</website>
 		<descr>ModSecurity is a web application firewall that can work either embedded or as a reverse proxy. It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. In addition this package allows URL forwarding which can be convenient for hosting multiple websites behind pfSense using 1 IP address.</descr>
 		<category>Network Management</category>
-		<version>0.1.6</version>
+		<version>0.1.7</version>
 		<status>ALPHA</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/apache_mod_security/apache_mod_security.xml</config_file>
-		<depends_on_package_pbi>proxy_mod_security-2.2.27_2-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>proxy_mod_security-2.2.27_5-##ARCH##.pbi</depends_on_package_pbi>
 		<configurationfile>apache_mod_security.xml</configurationfile>
 		<build_pbi>
 			<custom_name>proxy_mod_security</custom_name>
@@ -256,7 +243,7 @@
 			<port>net/avahi</port>
 		</build_pbi>
 		<depends_on_package_pbi>avahi-0.6.31-##ARCH##.pbi</depends_on_package_pbi>
-		<version>0.6.31 pkg v1.03</version>
+		<version>0.6.31 pkg v1.05</version>
 		<status>ALPHA</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/avahi/avahi.xml</config_file>
@@ -282,6 +269,23 @@
 		<noembedded>true</noembedded>
 	</package>
 	<package>
+		<name>ntopng</name>
+		<website>http://www.ntop.org/</website>
+		<descr>ntopng (replaces ntop) is a network probe that shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user's terminal. In Web mode it acts as a Web server, creating an HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics.</descr>
+		<category>Network Management</category>
+		<depends_on_package_pbi>ntopng-1.1_2-##ARCH##.pbi</depends_on_package_pbi>
+		<build_pbi>
+			<ports_before>databases/redis databases/gdbm net/GeoIP x11-fonts/font-util x11-fonts/webfonts graphics/graphviz</ports_before>
+			<port>net/ntopng</port>
+		</build_pbi>
+		<version>1.1 v0.2</version>
+		<status>ALPHA</status>
+		<required_version>2.2</required_version>
+		<config_file>https://packages.pfsense.org/packages/config/ntopng/ntopng.xml</config_file>
+		<configurationfile>ntopng.xml</configurationfile>
+		<noembedded>true</noembedded>
+	</package>
+	<package>
 		<name>Notes</name>
 		<website/>
 		<descr>Track things you want to note for this system.</descr>
@@ -364,14 +368,14 @@
 		<website>http://www.snort.org</website>
 		<descr>Snort is an open source network intrusion prevention and detection system (IDS/IPS). Combining the benefits of signature, protocol, and anomaly-based inspection.</descr>
 		<category>Security</category>
-		<depends_on_package_pbi>snort-2.9.6.0-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>snort-2.9.6.2-##ARCH##.pbi</depends_on_package_pbi>
 		<build_pbi>
 			<port>security/snort</port>
 			<ports_after>security/barnyard2</ports_after>
 		</build_pbi>
-		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE FLEXRESP3 GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS;NOPORTDOCS=true</build_options>
+		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS</build_options>
 		<config_file>https://packages.pfsense.org/packages/config/snort/snort.xml</config_file>
-		<version>2.9.6.0 pkg v3.0.13</version>
+		<version>2.9.6.2 pkg v3.1.2</version>
 		<required_version>2.2</required_version>
 		<status>Stable</status>
 		<configurationfile>/snort.xml</configurationfile>
@@ -453,7 +457,7 @@
 		<config_file>https://packages.pfsense.org/packages/config/dansguardian/dansguardian.xml</config_file>
 		<pkginfolink>https://forum.pfsense.org/index.php/topic,43786.0.html</pkginfolink>
 		<depends_on_package_pbi>dansguardian-2.12.0.3_2-##ARCH##.pbi</depends_on_package_pbi>
-		<version>2.12.0.3_2 pkg v.0.1.11</version>
+		<version>2.12.0.3_2 pkg v.0.1.12</version>
 		<status>beta</status>
 		<required_version>2.2</required_version>
 		<configurationfile>dansguardian.xml</configurationfile>
@@ -509,7 +513,7 @@
 		<build_pbi>
 			<port>net/openbgpd</port>
 		</build_pbi>
-		<version>0.9.1</version>
+		<version>0.9.2</version>
 		<status>STABLE</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/OpenBGPD_package</pkginfolink>
 		<required_version>2.2</required_version>
@@ -635,7 +639,7 @@
 		<descr>pfSense version of TinyDNS which features failover host support</descr>
 		<website>http://cr.yp.to/djbdns.html</website>
 		<category>Services</category>
-		<version>1.0.6.18</version>
+		<version>1.0.6.19</version>
 		<status>Beta</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/Tinydns_package</pkginfolink>
 		<required_version>2.2</required_version>
@@ -653,7 +657,7 @@
 		<descr>VMware Tools</descr>
 		<website>http://open-vm-tools.sourceforge.net/</website>
 		<category>Services</category>
-		<version>8.7.0.3046 (build-425873)</version>
+		<version>1280544_6</version>
 		<status>Stable</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/Open_VM_Tools_package</pkginfolink>
 		<required_version>2.2</required_version>
@@ -662,15 +666,15 @@
 		<build_pbi>
 			<port>emulators/open-vm-tools-nox11</port>
 		</build_pbi>
-		<depends_on_package_pbi>open-vm-tools-1280544_4-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>open-vm-tools-1280544_6-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>AutoConfigBackup</name>
-		<maintainer>portal@bsdperimeter.com</maintainer>
-		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires pfSense Premium Support Portal Subscription from https://portal.pfsense.org</descr>
+		<maintainer>coreteam@pfsense.org</maintainer>
+		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted before being sent to the server.  Requires Gold Subscription from https://portal.pfsense.org</descr>
 		<website>https://portal.pfsense.org</website>
 		<category>Services</category>
-		<version>1.25</version>
+		<version>1.27</version>
 		<status>Stable</status>
 		<required_version>2.2</required_version>
 		<pkginfolink>https://doc.pfsense.org/index.php/AutoConfigBackup</pkginfolink>
@@ -814,11 +818,11 @@
 					On pfSense docs there is a how-to which could help you on porting users.]]></descr>
 		<pkginfolink>https://doc.pfsense.org/index.php/FreeRADIUS_2.x_package</pkginfolink>
 		<category>System</category>
-		<version>2.1.12_1/2.2.5 pkg v1.6.7_3</version>
+		<version>2.1.12_1/2.2.5_3 pkg v1.6.7_3</version>
 		<status>RC1</status>
 		<required_version>2.2</required_version>
 		<maintainer>nachtfalkeaw@web.de</maintainer>
-		<depends_on_package_pbi>freeradius-2.2.5-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>freeradius-2.2.5_3-##ARCH##.pbi</depends_on_package_pbi>
 		<config_file>https://packages.pfsense.org/packages/config/freeradius2/freeradius.xml</config_file>
 		<configurationfile>freeradius.xml</configurationfile>
 		<after_install_info>Please visit Services: FreeRADIUS</after_install_info>
@@ -834,7 +838,7 @@
 		<website>http://bandwidthd.sourceforge.net/</website>
 		<descr>BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.</descr>
 		<category>System</category>
-		<version>2.0.1_6 pkg v.0.4</version>
+		<version>2.0.1_6 pkg v.0.5</version>
 		<status>BETA</status>
 		<required_version>2.2</required_version>
 		<depends_on_package_pbi>bandwidthd-2.0.1_6-##ARCH##.pbi</depends_on_package_pbi>
@@ -916,7 +920,7 @@
 		<descr>High performance web proxy cache.</descr>
 		<website>http://www.squid-cache.org/</website>
 		<category>Network</category>
-		<version>2.7.9 pkg v.4.3.5</version>
+		<version>2.7.9 pkg v.4.3.6</version>
 		<status>Stable</status>
 		<required_version>2.2</required_version>
 		<maintainer>fernando@netfilter.com.br seth.mos@dds.nl mfuchs77@googlemail.com jimp@pfsense.org</maintainer>
@@ -963,7 +967,7 @@
 		<pkginfolink>https://forum.pfsense.org/index.php/topic,48347.0.html</pkginfolink>
 		<website>http://www.squid-cache.org/</website>
 		<category>Network</category>
-		<version>3.3.10 pkg 2.2.7</version>
+		<version>3.3.11_1 pkg 2.2.7</version>
 		<status>beta</status>
 		<required_version>2.2</required_version>
 		<maintainer>marcellocoutinho@gmail.com fernando@netfilter.com.br seth.mos@dds.nl mfuchs77@googlemail.com jimp@pfsense.org</maintainer>
@@ -975,7 +979,7 @@
 		<build_options>c-icap_UNSET_FORCE=IPV6;squid_UNSET_FORCE=AUTH_SMB AUTH_SQL DNS_HELPER FS_COSS ESI SNMP ECAP STACKTRACES STRICT_HTTP TP_IPF TP_IPFW VIA_DB DEBUG DOCS EXAMPLES AUTH_SASL;squid_SET_FORCE=ARP_ACL AUTH_KERB AUTH_LDAP AUTH_NIS CACHE_DIGESTS DELAY_POOLS FOLLOW_XFF TP_PF MSSL_CRTD WCCP WCCPV2 FS_AUFS HTCP ICAP ICMP IDENT IPV6 KQUEUE LARGEFILE SSL SSL_CRTD</build_options>
 		<config_file>https://packages.pfsense.org/packages/config/squid3/33/squid.xml</config_file>
 		<configurationfile>squid.xml</configurationfile>
-		<depends_on_package_pbi>squid-3.3.11-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>squid-3.3.11_1-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>LCDproc</name>
@@ -1198,14 +1202,14 @@
 		<website>http://wiki.nagios.org/index.php/Howtos:nrpe_nsca</website>
 		<descr>NRPE is an addon for Nagios that allows you to execute plugins on remote Linux/Unix hosts. This is useful if you need to monitor local resources/attributes like disk usage, CPU load, memory usage, etc. on a remote host.</descr>
 		<category>Services</category>
-		<depends_on_package_pbi>nrpe-2.15_1-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>nrpe-2.15_3-##ARCH##.pbi</depends_on_package_pbi>
 		<build_pbi>
 			<ports_before>net-mgmt/nagios-plugins</ports_before>
 			<port>net-mgmt/nrpe</port>
 		</build_pbi>
 		<build_options>nrpe_SET_FORCE=SSL;nrpe_UNSET_FORCE=ARGS</build_options>
 		<config_file>https://packages.pfsense.org/packages/config/nrpe2/nrpe2.xml</config_file>
-		<version>2.15_1 v2.2</version>
+		<version>2.15_3 v2.2</version>
 		<status>Beta</status>
 		<required_version>2.2</required_version>
 		<maintainer>erik@erikkristensen.com</maintainer>
@@ -1271,7 +1275,7 @@
 	</package>
 	<package>
 		<name>Quagga OSPF</name>
-		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenOSPFD and OpenBGPD. Installing both will break things.</descr>
+		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenBGPD. Installing both will break things.</descr>
 		<maintainer>jimp@pfsense.org</maintainer>
 		<version>0.99.22.3 v0.6.2</version>
 		<category>Routing</category>
@@ -1413,7 +1417,7 @@
 		<descr>Monitoring agent.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-agent.xml</config_file>
-		<version>zabbix2-agent-2.2.3_1 pkg v0.8.1</version>
+		<version>zabbix2-agent-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.2</required_version>
 		<configurationfile>zabbix2-agent.xml</configurationfile>
@@ -1422,14 +1426,14 @@
 			<custom_name>zabbix22-agent</custom_name>
 			<port>net-mgmt/zabbix22-agent</port>
 		</build_pbi>
-		<depends_on_package_pbi>zabbix22-agent-2.2.3_1-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>zabbix22-agent-2.2.5-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>Zabbix-2 Proxy</name>
 		<descr>Monitoring agent proxy.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-proxy.xml</config_file>
-		<version>zabbix2-proxy-2.2.3_1 pkg v0.8_1</version>
+		<version>zabbix2-proxy-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.2</required_version>
 		<configurationfile>zabbix2-proxy.xml</configurationfile>
@@ -1439,7 +1443,7 @@
 			<port>net-mgmt/zabbix22-proxy</port>
 		</build_pbi>
 		<build_options>OPTIONS_SET+= SQLITE IPV6;OPTIONS_UNSET+= MYSQL JABBER GSSAPI</build_options>
-		<depends_on_package_pbi>zabbix22-proxy-2.2.3_1-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>zabbix22-proxy-2.2.5-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<!-- This does not exist yet, this is here to trigger a PBI build -->
@@ -1464,7 +1468,7 @@
 		<pkginfolink>https://doc.pfsense.org/index.php/Sudo_Package</pkginfolink>
 		<descr><![CDATA[sudo allows delegation of privileges to users in the shell so commands can be run as other users, such as root.]]></descr>
 		<category>Security</category>
-		<version>0.2.1</version>
+		<version>0.2.2</version>
 		<status>Beta</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/sudo/sudo.xml</config_file>
@@ -1473,7 +1477,7 @@
 		<build_pbi>
 			<port>security/sudo</port>
 		</build_pbi>
-		<depends_on_package_pbi>sudo-1.8.10p2-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>sudo-1.8.10p3-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>Service Watchdog</name>
@@ -1539,9 +1543,9 @@
 	<package>
 		<name>suricata</name>
 		<website>http://suricata-ids.org/</website>
-		<descr><![CDATA[Suricata is the OISF IDP engine, the open source Intrusion Detection and Prevention Engine.]]></descr>
+		<descr><![CDATA[High Performance Network IDS, IPS and Security Monitoring engine by OISF.]]></descr>
 		<category>Security</category>
-		<version>1.4.6 pkg v1.0.6</version>
+		<version>2.0.3 pkg v2.0.1</version>
 		<status>Stable</status>
 		<required_version>2.2</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/suricata/suricata.xml</config_file>
@@ -1551,7 +1555,7 @@
 			<ports_after>security/barnyard2</ports_after>
 		</build_pbi>
 		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP BRO;suricata_SET=IPFW PORTS_PCAP TESTS;suricata_UNSET=PRELUDE</build_options>
-		<depends_on_package_pbi>suricata-1.4.6-##ARCH##.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>suricata-2.0.3-##ARCH##.pbi</depends_on_package_pbi>
 	</package>
 </packages>
 </pfsensepkgs>
diff --git a/pkg_config.7.xml b/pkg_config.7.xml
index f3fce773..fad0b9da 100644
--- a/pkg_config.7.xml
+++ b/pkg_config.7.xml
@@ -29,20 +29,6 @@
 		<configurationfile>filemgr.xml</configurationfile>
       </package>
       <package>
-		<name>Country Block</name>
-		<website/>
-		<descr>Block countries</descr>
-		<category>Firewall</category>
-		<pkginfolink>https://forum.pfsense.org/index.php/topic,25732.0.html</pkginfolink>
-		<config_file>http://packages.pfsense.org/packages/config/countryblock/countryblock.xml</config_file>
-		<depends_on_package_base_url>http://files.pfsense.org/packages/7/All/</depends_on_package_base_url>
-		<version>0.2.4</version>
-		<status>Beta</status>
-		<required_version>1.2.2</required_version>
-		<maintainer>tom@tomschaefer.org</maintainer>
-		<configurationfile>countryblock.xml</configurationfile>
-      </package>
-      <package>
 		<name>IP-Blocklist</name>
 		<website/>
 		<descr>IP-Blocklist is the new PeerBlock. IP lists are used to add deny/allow rules to the firewall for in &amp; out traffic.</descr>
@@ -529,10 +515,10 @@
     <package>
       <name>AutoConfigBackup</name>
       <maintainer>portal@pfsense.org</maintainer>
-      <descr>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires pfSense Premium Support Portal Subscription from https://portal.pfsense.org</descr>
+      <descr>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires Gold Subscription from https://portal.pfsense.org</descr>
       <website>https://portal.pfsense.org</website>
       <category>Services</category>
-      <version>1.20</version>
+      <version>1.26</version>
       <status>Stable</status>
       <required_version>1.2</required_version>
       <pkginfolink>https://doc.pfsense.org/index.php/AutoConfigBackup</pkginfolink>
diff --git a/pkg_config.8.xml b/pkg_config.8.xml
index abf9a69b..f4aaa704 100644
--- a/pkg_config.8.xml
+++ b/pkg_config.8.xml
@@ -53,7 +53,7 @@
 		<descr><![CDATA[The most widely used name server software]]></descr>
 		<website>http://www.isc.org/downloads/BIND/</website>
 		<category>Services</category>
-		<version>9.9.5_10 pkg v 0.3.4</version>
+		<version>9.9.5_10 pkg v 0.3.5</version>
 		<status>RC</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/bind/bind.xml</config_file>
@@ -81,20 +81,6 @@
 		<configurationfile>filer.xml</configurationfile>
 	</package>
 	<package>
-		<name>Country Block</name>
-		<website/>
-		<descr>Block countries - This has been replaced by pfblocker. &lt;u&gt;This is a legacy app&lt;/u&gt;</descr>
-		<category>Firewall</category>
-		<pkginfolink>https://forum.pfsense.org/index.php/topic,25732.0.html</pkginfolink>
-		<config_file>https://packages.pfsense.org/packages/config/countryblock/countryblock.xml</config_file>
-		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<version>0.2.4</version>
-		<status>Beta</status>
-		<required_version>1.2.2</required_version>
-		<maintainer>tom@tomschaefer.org</maintainer>
-		<configurationfile>countryblock.xml</configurationfile>
-	</package>
-	<package>
 		<name>Strikeback</name>
 		<descr>Detect port scans with iplog and strikeback</descr>
 		<website/>
@@ -192,14 +178,14 @@
 				Supports acl's for smart backend switching.]]></descr>
 		<website>http://haproxy.1wt.eu/</website>
 		<category>Services</category>
-		<version>1.5-dev22 pkg v 0.9</version>
+		<version>1.5.3 pkg v 0.10</version>
 		<status>Release</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/haproxy-devel/haproxy.xml</config_file>
 		<configurationfile>haproxy.xml</configurationfile>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
 		<depends_on_package>haproxy-1.4.22.tbz</depends_on_package>
-		<depends_on_package_pbi>haproxy-devel-1.5-dev22-i386.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>haproxy-devel-1.5.3-i386.pbi</depends_on_package_pbi>
 		<build_port_path>/usr/ports/net/haproxy-devel</build_port_path>
 		<build_pbi>
 			<ports_before>security/openssl</ports_before>
@@ -339,7 +325,7 @@
 		</build_pbi>
 		<depends_on_package>avahi-app-0.6.29_1.tbz</depends_on_package>
 		<depends_on_package_pbi>avahi-0.6.31-i386.pbi</depends_on_package_pbi>
-		<version>0.6.31 pkg v1.04</version>
+		<version>0.6.31 pkg v1.05</version>
 		<status>ALPHA</status>
 		<required_version>1.2.3</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/avahi/avahi.xml</config_file>
@@ -381,6 +367,24 @@
 		<noembedded>true</noembedded>
 	</package>
 	<package>
+		<name>ntopng</name>
+		<website>http://www.ntop.org/</website>
+		<descr>ntopng (replaces ntop) is a network probe that shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user's terminal. In Web mode it acts as a Web server, creating an HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics.</descr>
+		<category>Network Management</category>
+		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
+		<depends_on_package_pbi>ntopng-1.1_1-i386.pbi</depends_on_package_pbi>
+		<build_pbi>
+			<ports_before>databases/redis databases/gdbm net/GeoIP x11-fonts/font-util x11-fonts/webfonts graphics/graphviz</ports_before>
+			<port>net/ntopng</port>
+		</build_pbi>
+		<version>1.1 v0.2</version>
+		<status>ALPHA</status>
+		<required_version>2.1.4</required_version>
+		<config_file>https://packages.pfsense.org/packages/config/ntopng/ntopng.xml</config_file>
+		<configurationfile>ntopng.xml</configurationfile>
+		<noembedded>true</noembedded>
+	</package>
+	<package>
 		<name>FreeSWITCH</name>
 		<website>http://www.freeswitch.org/</website>
 		<descr>FreeSWITCH is an open source telephony platform designed to facilitate the creation of voice and chat driven products scaling from a soft-phone up to a soft-switch.  It can be used as a simple switching engine, a PBX, a media gateway or a media server to host IVR applications using simple scripts or XML to control the callflow. </descr>
@@ -504,29 +508,15 @@
 		<descr>Snort is an open source network intrusion prevention and detection system (IDS/IPS). Combining the benefits of signature, protocol, and anomaly-based inspection.</descr>
 		<category>Security</category>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<depends_on_package>mysql55-client-5.5.35.tbz</depends_on_package>
-		<depends_on_package>barnyard2-1.13.tbz</depends_on_package>
-		<depends_on_package>libnet-1.1.6_1,1.tbz </depends_on_package>
-		<depends_on_package>libdnet-1.11_3.tbz</depends_on_package>
-		<depends_on_package>libpcap-1.5.2.tbz</depends_on_package>
-		<depends_on_package>daq-2.0.1.tbz</depends_on_package>
-		<depends_on_package>snort-2.9.6.0.tbz</depends_on_package>
-		<depends_on_package_pbi>snort-2.9.6.0-i386.pbi</depends_on_package_pbi>
-		<build_port_path>/usr/ports/devel/pcre</build_port_path>
-		<build_port_path>/usr/ports/net/daq</build_port_path>
-		<build_port_path>/usr/ports/net/libnet</build_port_path>
-		<build_port_path>/usr/ports/net/libpcap</build_port_path>
-		<build_port_path>/usr/ports/security/barnyard2</build_port_path>
-		<build_port_path>/usr/ports/databases/mysql55-client</build_port_path>
-		<build_port_path>/usr/ports/security/snort</build_port_path>
+		<depends_on_package_pbi>snort-2.9.6.2-i386.pbi</depends_on_package_pbi>
 		<build_pbi>
 			<port>security/snort</port>
 			<ports_after>security/barnyard2</ports_after>
 		</build_pbi>
-		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP BRO;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE FLEXRESP3 GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS;NOPORTDOCS=true</build_options>
+		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP BRO;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS</build_options>
 		<config_file>https://packages.pfsense.org/packages/config/snort/snort.xml</config_file>
-		<version>2.9.6.0 pkg v3.0.13</version>
-		<required_version>2.0</required_version>
+		<version>2.9.6.2 pkg v3.1.2</version>
+		<required_version>2.1</required_version>
 		<status>Stable</status>
 		<configurationfile>/snort.xml</configurationfile>
 		<after_install_info>Please visit the Snort settings tab first and select your desired rules. Afterwards visit the update rules tab to download your configured rules.</after_install_info>
@@ -611,7 +601,7 @@
 		<depends_on_package>dansguardian-2.12.0.3.tbz</depends_on_package>
 		<depends_on_package>ca_root_nss-3.14.1.tbz</depends_on_package>
 		<depends_on_package_pbi>dansguardian-2.12.0.3_2-i386.pbi</depends_on_package_pbi>
-		<version>2.12.0.3_2 pkg v.0.1.10</version>
+		<version>2.12.0.3_2 pkg v.0.1.12</version>
 		<status>beta</status>
 		<required_version>2.0</required_version>
 		<configurationfile>dansguardian.xml</configurationfile>
@@ -682,7 +672,7 @@
 		<build_pbi>
 			<port>net/openbgpd</port>
 		</build_pbi>
-		<version>0.9.1</version>
+		<version>0.9.2</version>
 		<status>STABLE</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/OpenBGPD_package</pkginfolink>
 		<required_version>1.3</required_version>
@@ -692,28 +682,6 @@
 		<depends_on_package_pbi>openbgpd-5.2.20121209-i386.pbi</depends_on_package_pbi>
 	</package>
 	<package>
-		<name>OpenOSPFD</name>
-		<descr>This package is now considered deprecated. Please use the Quagga OSPF instead. -- WARNING! Installs files to the same place as Quagga OSPF. Installing both will result in a broken state, remove this package before installing Quagga OSPF.</descr>
-		<maintainer>cmb@pfsense.org</maintainer>
-		<version>0.5.2</version>
-		<category>Routing</category>
-		<status>DEPRECATED</status>
-		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<depends_on_package>openospfd-4.6.tbz</depends_on_package>
-		<depends_on_package_pbi>openospfd-4.6-i386.pbi</depends_on_package_pbi>
-		<config_file>https://packages.pfsense.org/packages/config/openospfd/openospfd.xml</config_file>
-		<build_port_path>/usr/ports/net/openospfd</build_port_path>
-		<build_port_path>/usr/ports/devel/libevent</build_port_path>
-		<build_pbi>
-			<ports_before>devel/libevent</ports_before>
-			<port>net/openospfd</port>
-		</build_pbi>
-		<pkginfolink></pkginfolink>
-		<required_version>1.2.1</required_version>
-		<configurationfile>openospfd.xml</configurationfile>
-		<depends_on_package>libevent-1.4.14b_1.tbz</depends_on_package>
-	</package>
-	<package>
 		<name>Lightsquid</name>
 		<descr>High perfomance web proxy report (LightSquid). Proxy realtime stat (SQStat). Requires squid HTTP proxy.</descr>
 		<website>http://lightsquid.sf.net/</website>
@@ -861,7 +829,7 @@
 		<descr>pfSense version of TinyDNS which features failover host support</descr>
 		<website>http://cr.yp.to/djbdns.html</website>
 		<category>Services</category>
-		<version>1.0.6.18</version>
+		<version>1.0.6.19</version>
 		<status>Beta</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/Tinydns_package</pkginfolink>
 		<required_version>2.0</required_version>
@@ -923,10 +891,10 @@
 	<package>
 		<name>AutoConfigBackup</name>
 		<maintainer>portal@pfsense.org</maintainer>
-		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires pfSense Premium Support Portal Subscription from https://portal.pfsense.org</descr>
+		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted before being sent to the server.  Requires Gold Subscription from https://portal.pfsense.org</descr>
 		<website>https://portal.pfsense.org</website>
 		<category>Services</category>
-		<version>1.25</version>
+		<version>1.27</version>
 		<status>Stable</status>
 		<required_version>1.2</required_version>
 		<pkginfolink>https://doc.pfsense.org/index.php/AutoConfigBackup</pkginfolink>
@@ -1094,13 +1062,13 @@
 					On pfSense docs there is a how-to which could help you on porting users.]]></descr>
 		<pkginfolink>https://doc.pfsense.org/index.php/FreeRADIUS_2.x_package</pkginfolink>
 		<category>System</category>
-		<version>2.1.12_1/2.2.4 pkg v1.6.7_3</version>
+		<version>2.1.12_1/2.2.5_3 pkg v1.6.7_3</version>
 		<status>RC1</status>
 		<required_version>2.0</required_version>
 		<maintainer>nachtfalkeaw@web.de</maintainer>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
 		<depends_on_package>freeradius-2.1.12_1.tbz</depends_on_package>
-		<depends_on_package_pbi>freeradius-2.2.4-i386.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>freeradius-2.2.5_3-i386.pbi</depends_on_package_pbi>
 		<depends_on_package>mysql-client-5.1.63.tbz</depends_on_package>
 		<depends_on_package>postgresql-client-8.4.12.tbz</depends_on_package>
 		<depends_on_package>openldap-sasl-client-2.4.23.tbz</depends_on_package>
@@ -1119,7 +1087,7 @@
 		<website>http://bandwidthd.sourceforge.net/</website>
 		<descr>BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.</descr>
 		<category>System</category>
-		<version>2.0.1_5 pkg v.0.4</version>
+		<version>2.0.1_5 pkg v.0.5</version>
 		<status>BETA</status>
 		<required_version>1.2.1</required_version>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
@@ -1238,7 +1206,7 @@
 		<pkginfolink>https://forum.pfsense.org/index.php/topic,48347.0.html</pkginfolink>
 		<website>http://www.squid-cache.org/</website>
 		<category>Network</category>
-		<version>3.1.20 pkg 2.1.0</version>
+		<version>3.1.20 pkg 2.1.1</version>
 		<status>beta</status>
 		<required_version>2.0</required_version>
 		<maintainer>marcellocoutinho@gmail.com fernando@netfilter.com.br seth.mos@dds.nl mfuchs77@googlemail.com jimp@pfsense.org</maintainer>
@@ -1703,7 +1671,7 @@
 	</package>
 	<package>
 		<name>Quagga OSPF</name>
-		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenOSPFD and OpenBGPD. Installing both will break things.</descr>
+		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenBGPD. Installing both will break things.</descr>
 		<maintainer>jimp@pfsense.org</maintainer>
 		<version>0.99.22.3 v0.6.2</version>
 		<category>Routing</category>
@@ -1854,7 +1822,7 @@
 		<descr>Monitoring agent.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-agent.xml</config_file>
-		<version>zabbix2-agent-2.2.2 pkg v0.8.2</version>
+		<version>zabbix2-agent-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.0</required_version>
 		<configurationfile>zabbix2-agent.xml</configurationfile>
@@ -1865,15 +1833,15 @@
 			<port>net-mgmt/zabbix22-agent</port>
 		</build_pbi>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<depends_on_package>zabbix22-agent-2.2.2.tbz</depends_on_package>
-		<depends_on_package_pbi>zabbix22-agent-2.2.2-i386.pbi</depends_on_package_pbi>
+		<depends_on_package>zabbix22-agent-2.2.5.tbz</depends_on_package>
+		<depends_on_package_pbi>zabbix22-agent-2.2.5-i386.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>Zabbix-2 Proxy</name>
 		<descr>Monitoring agent proxy.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-proxy.xml</config_file>
-		<version>zabbix2-proxy-2.2.2 pkg v0.8.2</version>
+		<version>zabbix2-proxy-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.0</required_version>
 		<configurationfile>zabbix2-proxy.xml</configurationfile>
@@ -1885,8 +1853,8 @@
 		</build_pbi>
 		<build_options>OPTIONS_SET+= SQLITE IPV6;OPTIONS_UNSET+= MYSQL JABBER GSSAPI</build_options>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<depends_on_package>zabbix22-proxy-2.2.2.tbz</depends_on_package>
-		<depends_on_package_pbi>zabbix22-proxy-2.2.2-i386.pbi</depends_on_package_pbi>
+		<depends_on_package>zabbix22-proxy-2.2.5.tbz</depends_on_package>
+		<depends_on_package_pbi>zabbix22-proxy-2.2.5-i386.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<!-- This does not exist yet, this is here to trigger a PBI build -->
@@ -1993,9 +1961,9 @@
 	<package>
 		<name>suricata</name>
 		<website>http://suricata-ids.org/</website>
-		<descr><![CDATA[Suricata is the OISF IDP engine, the open source Intrusion Detection and Prevention Engine.]]></descr>
+		<descr><![CDATA[High Performance Network IDS, IPS and Security Monitoring engine by OISF.]]></descr>
 		<category>Security</category>
-		<version>1.4.6 pkg v1.0.6</version>
+		<version>2.0.3 pkg v2.0.1</version>
 		<status>Stable</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/suricata/suricata.xml</config_file>
@@ -2007,7 +1975,7 @@
 		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP BRO;suricata_SET=IPFW PORTS_PCAP TESTS;suricata_UNSET=PRELUDE</build_options>
 		<build_port_path>/usr/ports/security/suricata</build_port_path>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<depends_on_package_pbi>suricata-1.4.6-i386.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>suricata-2.0.3-i386.pbi</depends_on_package_pbi>
 	</package>
 </packages>
 </pfsensepkgs>
diff --git a/pkg_config.8.xml.amd64 b/pkg_config.8.xml.amd64
index 657da79a..02e8a7d2 100644
--- a/pkg_config.8.xml.amd64
+++ b/pkg_config.8.xml.amd64
@@ -53,7 +53,7 @@
 		<descr><![CDATA[The most widely used name server software]]></descr>
 		<website>http://www.isc.org/downloads/BIND/</website>
 		<category>Services</category>
-		<version>9.9.5_10 pkg v 0.3.4</version>
+		<version>9.9.5_10 pkg v 0.3.5</version>
 		<status>RC</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/bind/bind.xml</config_file>
@@ -81,20 +81,6 @@
 		<configurationfile>filer.xml</configurationfile>
 	</package>
 	<package>
-		<name>Country Block</name>
-		<website/>
-		<descr>Block countries - This has been replaced by pfblocker. &lt;u&gt;This is a legacy app&lt;/u&gt;</descr>
-		<category>Firewall</category>
-		<pkginfolink>https://forum.pfsense.org/index.php/topic,25732.0.html</pkginfolink>
-		<config_file>https://packages.pfsense.org/packages/config/countryblock/countryblock.xml</config_file>
-		<depends_on_package_base_url>https://files.pfsense.org/packages/8/All/</depends_on_package_base_url>
-		<version>0.2.4</version>
-		<status>Beta</status>
-		<required_version>1.2.2</required_version>
-		<maintainer>tom@tomschaefer.org</maintainer>
-		<configurationfile>countryblock.xml</configurationfile>
-	</package>
-	<package>
 		<name>File Manager</name>
 		<website/>
 		<descr>PHP File Manager</descr>
@@ -179,14 +165,14 @@
 				Supports acl's for smart backend switching.]]></descr>
 		<website>http://haproxy.1wt.eu/</website>
 		<category>Services</category>
-		<version>1.5-dev22 pkg v 0.9</version>
+		<version>1.5.3 pkg v 0.10</version>
 		<status>Release</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/haproxy-devel/haproxy.xml</config_file>
 		<configurationfile>haproxy.xml</configurationfile>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
 		<depends_on_package>haproxy-1.4.22.tbz</depends_on_package>
-		<depends_on_package_pbi>haproxy-devel-1.5-dev22-amd64.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>haproxy-devel-1.5.3-amd64.pbi</depends_on_package_pbi>
 		<build_port_path>/usr/ports/net/haproxy-devel</build_port_path>
 		<build_pbi>
 			<ports_before>security/openssl</ports_before>
@@ -326,7 +312,7 @@
 		</build_pbi>
 		<depends_on_package>avahi-0.6.29.tbz</depends_on_package>
 		<depends_on_package_pbi>avahi-0.6.31-amd64.pbi</depends_on_package_pbi>
-		<version>0.6.31 pkg v1.04</version>
+		<version>0.6.31 pkg v1.05</version>
 		<status>ALPHA</status>
 		<required_version>1.2.3</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/avahi/avahi.xml</config_file>
@@ -368,6 +354,24 @@
 		<noembedded>true</noembedded>
 	</package>
 	<package>
+		<name>ntopng</name>
+		<website>http://www.ntop.org/</website>
+		<descr>ntopng (replaces ntop) is a network probe that shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user's terminal. In Web mode it acts as a Web server, creating an HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, an HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics.</descr>
+		<category>Network Management</category>
+		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
+		<depends_on_package_pbi>ntopng-1.1_1-amd64.pbi</depends_on_package_pbi>
+		<build_pbi>
+			<ports_before>databases/redis databases/gdbm net/GeoIP x11-fonts/font-util x11-fonts/webfonts graphics/graphviz</ports_before>
+			<port>net/ntopng</port>
+		</build_pbi>
+		<version>1.1 v0.2</version>
+		<status>ALPHA</status>
+		<required_version>2.1.4</required_version>
+		<config_file>https://packages.pfsense.org/packages/config/ntopng/ntopng.xml</config_file>
+		<configurationfile>ntopng.xml</configurationfile>
+		<noembedded>true</noembedded>
+	</package>
+	<package>
 		<name>FreeSWITCH</name>
 		<website>http://www.freeswitch.org/</website>
 		<descr>FreeSWITCH is an open source telephony platform designed to facilitate the creation of voice and chat driven products scaling from a soft-phone up to a soft-switch.  It can be used as a simple switching engine, a PBX, a media gateway or a media server to host IVR applications using simple scripts or XML to control the callflow. </descr>
@@ -491,29 +495,15 @@
 		<descr>Snort is an open source network intrusion prevention and detection system (IDS/IPS). Combining the benefits of signature, protocol, and anomaly-based inspection.</descr>
 		<category>Security</category>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
-		<depends_on_package>mysql55-client-5.5.35.tbz</depends_on_package>
-		<depends_on_package>barnyard2-1.13.tbz</depends_on_package>
-		<depends_on_package>libnet-1.1.6_1,1.tbz </depends_on_package>
-		<depends_on_package>libdnet-1.11_3.tbz</depends_on_package>
-		<depends_on_package>libpcap-1.5.2.tbz</depends_on_package>
-		<depends_on_package>daq-2.0.1.tbz</depends_on_package>
-		<depends_on_package>snort-2.9.6.0.tbz</depends_on_package>
-		<depends_on_package_pbi>snort-2.9.6.0-amd64.pbi</depends_on_package_pbi>
-		<build_port_path>/usr/ports/devel/pcre</build_port_path>
-		<build_port_path>/usr/ports/net/daq</build_port_path>
-		<build_port_path>/usr/ports/net/libnet</build_port_path>
-		<build_port_path>/usr/ports/net/libpcap</build_port_path>
-		<build_port_path>/usr/ports/security/barnyard2</build_port_path>
-		<build_port_path>/usr/ports/databases/mysql55-client</build_port_path>
-		<build_port_path>/usr/ports/security/snort</build_port_path>
+		<depends_on_package_pbi>snort-2.9.6.2-amd64.pbi</depends_on_package_pbi>
 		<build_pbi>
 			<port>security/snort</port>
 			<ports_after>security/barnyard2</ports_after>
 		</build_pbi>
-		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE FLEXRESP3 GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS;NOPORTDOCS=true</build_options>
+		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP;snort_SET=TARGETBASED PERFPROFILE SOURCEFIRE GRE IPV6 MPLS NORMALIZER ZLIB;snort_UNSET=PULLEDPORK;perl_SET=THREADS</build_options>
 		<config_file>https://packages.pfsense.org/packages/config/snort/snort.xml</config_file>
-		<version>2.9.6.0 pkg v3.0.13</version>
-		<required_version>2.0</required_version>
+		<version>2.9.6.2 pkg v3.1.2</version>
+		<required_version>2.1</required_version>
 		<status>Stable</status>
 		<configurationfile>/snort.xml</configurationfile>
 		<after_install_info>Please visit the Snort settings tab first and select your desired rules. Afterwards visit the update rules tab to download your configured rules.</after_install_info>
@@ -598,7 +588,7 @@
 		<depends_on_package>dansguardian-2.12.0.3.tbz</depends_on_package>
 		<depends_on_package>ca_root_nss-3.14.1.tbz</depends_on_package>
 		<depends_on_package_pbi>dansguardian-2.12.0.3_2-amd64.pbi</depends_on_package_pbi>
-		<version>2.12.0.3_2 pkg v.0.1.10</version>
+		<version>2.12.0.3_2 pkg v.0.1.12</version>
 		<status>beta</status>
 		<required_version>2.0</required_version>
 		<configurationfile>dansguardian.xml</configurationfile>
@@ -669,7 +659,7 @@
 		<build_pbi>
 			<port>net/openbgpd</port>
 		</build_pbi>
-		<version>0.9.1</version>
+		<version>0.9.2</version>
 		<status>STABLE</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/OpenBGPD_package</pkginfolink>
 		<required_version>1.3</required_version>
@@ -679,28 +669,6 @@
 		<depends_on_package_pbi>openbgpd-5.2.20121209-amd64.pbi</depends_on_package_pbi>
 	</package>
 	<package>
-		<name>OpenOSPFD</name>
-		<descr>This package is now considered deprecated. Please use the Quagga OSPF instead. -- WARNING! Installs files to the same place as Quagga OSPF. Installing both will result in a broken state, remove this package before installing Quagga OSPF.</descr>
-		<maintainer>cmb@pfsense.org</maintainer>
-		<version>0.5.2</version>
-		<category>Routing</category>
-		<status>DEPRECATED</status>
-		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
-		<depends_on_package>openospfd-4.6.tbz</depends_on_package>
-		<depends_on_package_pbi>openospfd-4.6-amd64.pbi</depends_on_package_pbi>
-		<config_file>https://packages.pfsense.org/packages/config/openospfd/openospfd.xml</config_file>
-		<build_port_path>/usr/ports/net/openospfd</build_port_path>
-		<build_port_path>/usr/ports/devel/libevent</build_port_path>
-		<build_pbi>
-			<ports_before>devel/libevent</ports_before>
-			<port>net/openospfd</port>
-		</build_pbi>
-		<pkginfolink></pkginfolink>
-		<required_version>1.2.1</required_version>
-		<configurationfile>openospfd.xml</configurationfile>
-		<depends_on_package>libevent-1.4.14b_1.tbz</depends_on_package>
-	</package>
-	<package>
 		<name>Lightsquid</name>
 		<descr>High perfomance web proxy report (LightSquid). Proxy realtime stat (SQStat). Requires squid HTTP proxy.</descr>
 		<website>http://lightsquid.sf.net/</website>
@@ -848,7 +816,7 @@
 		<descr>pfSense version of TinyDNS which features failover host support</descr>
 		<website>http://cr.yp.to/djbdns.html</website>
 		<category>Services</category>
-		<version>1.0.6.18</version>
+		<version>1.0.6.19</version>
 		<status>Beta</status>
 		<pkginfolink>https://doc.pfsense.org/index.php/Tinydns_package</pkginfolink>
 		<required_version>2.0</required_version>
@@ -910,10 +878,10 @@
 	<package>
 		<name>AutoConfigBackup</name>
 		<maintainer>portal@pfsense.org</maintainer>
-		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted on the server.  Requires pfSense Premium Support Portal Subscription from https://portal.pfsense.org</descr>
+		<descr>Automatically backs up your pfSense configuration.  All contents are encrypted before being sent to the server.  Requires Gold Subscription from https://portal.pfsense.org</descr>
 		<website>https://portal.pfsense.org</website>
 		<category>Services</category>
-		<version>1.25</version>
+		<version>1.27</version>
 		<status>Stable</status>
 		<required_version>1.2</required_version>
 		<pkginfolink>https://doc.pfsense.org/index.php/AutoConfigBackup</pkginfolink>
@@ -1081,13 +1049,13 @@
 					On pfSense docs there is a how-to which could help you on porting users.]]></descr>
 		<pkginfolink>https://doc.pfsense.org/index.php/FreeRADIUS_2.x_package</pkginfolink>
 		<category>System</category>
-		<version>2.1.12_1/2.2.4 pkg v1.6.7_3</version>
+		<version>2.1.12_1/2.2.5_3 pkg v1.6.7_3</version>
 		<status>RC1</status>
 		<required_version>2.0</required_version>
 		<maintainer>nachtfalkeaw@web.de</maintainer>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
 		<depends_on_package>freeradius-2.1.12_1.tbz</depends_on_package>
-		<depends_on_package_pbi>freeradius-2.2.4-amd64.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>freeradius-2.2.5_3-amd64.pbi</depends_on_package_pbi>
 		<depends_on_package>mysql-client-5.1.63.tbz</depends_on_package>
 		<depends_on_package>postgresql-client-9.0.8.tbz</depends_on_package>
 		<depends_on_package>openldap-sasl-client-2.4.31_1.tbz</depends_on_package>
@@ -1106,7 +1074,7 @@
 		<website>http://bandwidthd.sourceforge.net/</website>
 		<descr>BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address's utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.</descr>
 		<category>System</category>
-		<version>2.0.1_5 pkg v.0.4</version>
+		<version>2.0.1_5 pkg v.0.5</version>
 		<status>BETA</status>
 		<required_version>1.2.1</required_version>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
@@ -1225,7 +1193,7 @@
 		<pkginfolink>https://forum.pfsense.org/index.php/topic,48347.0.html</pkginfolink>
 		<website>http://www.squid-cache.org/</website>
 		<category>Network</category>
-		<version>3.1.20 pkg 2.1.0</version>
+		<version>3.1.20 pkg 2.1.1</version>
 		<status>beta</status>
 		<required_version>2.0</required_version>
 		<maintainer>marcellocoutinho@gmail.com fernando@netfilter.com.br seth.mos@dds.nl mfuchs77@googlemail.com jimp@pfsense.org</maintainer>
@@ -1690,7 +1658,7 @@
 	</package>
 	<package>
 		<name>Quagga OSPF</name>
-		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenOSPFD and OpenBGPD. Installing both will break things.</descr>
+		<descr>OSPF routing protocol using Quagga -- WARNING! Installs files to the same place as OpenBGPD. Installing both will break things.</descr>
 		<maintainer>jimp@pfsense.org</maintainer>
 		<version>0.99.22.3 v0.6.2</version>
 		<category>Routing</category>
@@ -1841,7 +1809,7 @@
 		<descr>Monitoring agent.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-agent.xml</config_file>
-		<version>zabbix2-agent-2.2.2 pkg v0.8.2</version>
+		<version>zabbix2-agent-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.0</required_version>
 		<configurationfile>zabbix2-agent.xml</configurationfile>
@@ -1852,15 +1820,15 @@
 			<port>net-mgmt/zabbix22-agent</port>
 		</build_pbi>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
-		<depends_on_package>zabbix22-agent-2.2.2.tbz</depends_on_package>
-		<depends_on_package_pbi>zabbix22-agent-2.2.2-amd64.pbi</depends_on_package_pbi>
+		<depends_on_package>zabbix22-agent-2.2.5.tbz</depends_on_package>
+		<depends_on_package_pbi>zabbix22-agent-2.2.5-amd64.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<name>Zabbix-2 Proxy</name>
 		<descr>Monitoring agent proxy.</descr>
 		<category>Services</category>
 		<config_file>https://packages.pfsense.org/packages/config/zabbix2/zabbix2-proxy.xml</config_file>
-		<version>zabbix2-proxy-2.2.2 pkg v0.8.2</version>
+		<version>zabbix2-proxy-2.2.5 pkg v0.8.3</version>
 		<status>BETA</status>
 		<required_version>2.0</required_version>
 		<configurationfile>zabbix2-proxy.xml</configurationfile>
@@ -1872,8 +1840,8 @@
 		</build_pbi>
 		<build_options>OPTIONS_SET+= SQLITE IPV6;OPTIONS_UNSET+= MYSQL JABBER GSSAPI</build_options>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
-		<depends_on_package>zabbix22-proxy-2.2.2.tbz</depends_on_package>
-		<depends_on_package_pbi>zabbix22-proxy-2.2.2-amd64.pbi</depends_on_package_pbi>
+		<depends_on_package>zabbix22-proxy-2.2.5.tbz</depends_on_package>
+		<depends_on_package_pbi>zabbix22-proxy-2.2.5-amd64.pbi</depends_on_package_pbi>
 	</package>
 	<package>
 		<!-- This does not exist yet, this is here to trigger a PBI build -->
@@ -1980,9 +1948,9 @@
 	<package>
 		<name>suricata</name>
 		<website>http://suricata-ids.org/</website>
-		<descr><![CDATA[Suricata is the OISF IDP engine, the open source Intrusion Detection and Prevention Engine.]]></descr>
+		<descr><![CDATA[High Performance Network IDS, IPS and Security Monitoring engine by OISF.]]></descr>
 		<category>Security</category>
-		<version>1.4.6 pkg v1.0.6</version>
+		<version>2.0.3 pkg v2.0.1</version>
 		<status>Stable</status>
 		<required_version>2.1</required_version>
 		<config_file>https://packages.pfsense.org/packages/config/suricata/suricata.xml</config_file>
@@ -1994,7 +1962,7 @@
 		<build_options>barnyard2_UNSET=ODBC PGSQL PRELUDE;barnyard2_SET=GRE IPV6 MPLS MYSQL PORT_PCAP BRO;suricata_SET=IPFW PORTS_PCAP TESTS;suricata_UNSET=PRELUDE</build_options>
 		<build_port_path>/usr/ports/security/suricata</build_port_path>
 		<depends_on_package_base_url>https://files.pfsense.org/packages/amd64/8/All/</depends_on_package_base_url>
-		<depends_on_package_pbi>suricata-1.4.6-amd64.pbi</depends_on_package_pbi>
+		<depends_on_package_pbi>suricata-2.0.3-amd64.pbi</depends_on_package_pbi>
 	</package>
 </packages>
 </pfsensepkgs>