Hi,

Using ids.cgi (Services -> Intrusion Detection) breaks the rule file by splitting some lines in 2 lines, and therefore the snort fails to start.

Actions to recreate the error: expand one rule group (emerging-current_events for example), uncheck the rules containing POODLE, save.

In /var/log/messages I saw snort generating a FATAL ERROR

FATAL ERROR: /etc/snort/rules/emerging-current_events.rules(1943) Bad pattern length!

At line 1943 in /etc/snort/rules/emerging-current_events.rules is this:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Flash Action Script Invalid Regex CVE-2013-0634";flow:established,to_client; file_data; flowbits:isset,OLE.WithFlash; content:"RegExp"; distance:0; content:""; distance:0;pcre:"/^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|/R";reference:cve,2013-0364; classtype:trojan-activity; sid:2016401; rev:3;)

Clearly the line 1943 is not the one I've unchecked in the Web Interface - the ones I've unchecked are containing POODLE!
The above line 1943 is actually part of the rule, the last part of a rule. The rule was split in 2 lines after using ids.cgi.

Also, other rules were split in 2, not only the one I gave as example.
 

More details in the forum: http://forum.ipfire.org/viewtopic.php?f=52&t=12475

Best regards,
H&M