Add enable/disable for decoder & preproc rules

5 files changed, 336 insertions, 186 deletions

diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index 52aaed2a..d983d995 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -5,7 +5,7 @@
  * Copyright (C) 2006 Scott Ullrich
  * Copyright (C) 2009-2010 Robert Zelaya
  * Copyright (C) 2011-2012 Ermal Luci
- * Copyright (C) 2013 Bill Meeks
+ * Copyright (C) 2013,2014 Bill Meeks
  * part of pfSense
  * All rights reserved.
  *
@@ -1739,34 +1739,32 @@ function snort_write_enforcing_rules_file($rule_map, $rule_path) {
 	}
 }
 
-function snort_load_sid_mods($sids, $value) {
+function snort_load_sid_mods($sids) {
 
 	/*****************************************/
 	/* This function parses the string of    */
-	/* SID values in $sids and returns an    */
-	/* array with the SID as the key and     */
-	/* value.  The SID values in $sids are   */
+	/* GID:SID values in $sids and returns   */
+	/* an array with the GID and SID as the  */
+	/* keys.  The values in $sids are        */
 	/* assumed to be delimited by "||".      */
 	/*                                       */
-	/* $sids ==> string of SID values from   */
-	/*           saved config file.          */
+	/* $sids   ==> string of GID:SID values  */
+	/*             from the config file.     */
 	/*                                       */
-	/* $value ==> type of mod (enable or     */
-	/*            disable).  Not currently   */
-	/*            utilized, but maintained   */
-	/*            so as not to break legacy  */
-	/*            code elsewhere.            */
+	/* Returns ==> a multidimensional array  */
+	/*             with GID and SID as the   */
+	/*             keys ($result[GID][SID])  */
 	/*****************************************/
 
 	$result = array();
-	if (empty($sids) || empty($value))
+	if (empty($sids))
 		return $result;
 	$tmp = explode("||", $sids);
 	foreach ($tmp as $v) {
-		if (preg_match('/\s\d+/', $v, $match)) {
-			if (!is_array($result[trim($match[0])]))
-				$result[trim($match[0])] = array();
-			$result[trim($match[0])] = trim($match[0]);
+		if (preg_match('/(\d+)\s*:\s*(\d+)/', $v, $match)) {
+			if (!is_array($result[$match[1]]))
+				$result[$match[1]] = array();
+			$result[$match[1]][$match[2]] = "{$match[1]}:{$match[2]}";
 		}
 	}
 	unset($tmp);
@@ -1791,15 +1789,15 @@ function snort_modify_sids(&$rule_map, $snortcfg) {
 
 	/* Load up our enablesid and disablesid  */
 	/* arrays with lists of modified SIDs    */
-	$enablesid = snort_load_sid_mods($snortcfg['rule_sid_on'], "enablesid");
-	$disablesid = snort_load_sid_mods($snortcfg['rule_sid_off'], "disablesid");
+	$enablesid = snort_load_sid_mods($snortcfg['rule_sid_on']);
+	$disablesid = snort_load_sid_mods($snortcfg['rule_sid_off']);
 
 	/* Turn on any rules that need to be     */
 	/* forced "on" with enablesid mods.      */
 	if (!empty($enablesid)) {
 		foreach ($rule_map as $k1 => $rulem) {
 			foreach ($rulem as $k2 => $v) {
-				if (in_array($k2, $enablesid) && $v['disabled'] == 1) {
+				if (isset($enablesid[$k1][$k2]) && $v['disabled'] == 1) {
 					$rule_map[$k1][$k2]['rule'] = ltrim($v['rule'], " \t#");
 					$rule_map[$k1][$k2]['disabled'] = 0;
 				}
@@ -1812,7 +1810,7 @@ function snort_modify_sids(&$rule_map, $snortcfg) {
 	if (!empty($disablesid)) {
 		foreach ($rule_map as $k1 => $rulem) {
 			foreach ($rulem as $k2 => $v) {
-				if (in_array($k2, $disablesid) && $v['disabled'] == 0) {
+				if (isset($disablesid[$k1][$k2]) && $v['disabled'] == 0) {
 					$rule_map[$k1][$k2]['rule'] = "# " . $v['rule'];
 					$rule_map[$k1][$k2]['disabled'] = 1;
 				}
@@ -2209,12 +2207,13 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
 	/*                  to be written.                         */
 	/***********************************************************/
 
-	global $rebuild_rules;
+	global $g, $rebuild_rules;
 
 	$snortdir = SNORTDIR;
 	$flowbit_rules_file = FLOWBITS_FILENAME;
 	$snort_enforcing_rules_file = ENFORCING_RULES_FILENAME;
 	$no_rules_defined = true;
+	$enabled_rules = array();
 
 	/* If there is no reason to rebuild the rules, exit to save time. */
 	if (!$rebuild_rules)
@@ -2223,14 +2222,37 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
 	/* Log a message for rules rebuild in progress */
 	log_error(gettext("[Snort] Updating rules configuration for: " . snort_get_friendly_interface($snortcfg['interface']) . " ..."));
 
+	/* Enable all, some or none of the SDF rules depending on setting. */
+	if ($snortcfg['sensitive_data'] == 'on' && $snortcfg['protect_preproc_rules'] != 'on') {
+		if (file_exists(SNORTDIR."/preproc_rules/sensitive-data.rules")) {
+			$sdf_alert_pattern="(".preg_replace("/,/","|",$snortcfg['sdf_alert_data_type']).")";
+			$sd_tmp_file=file(SNORTDIR."/preproc_rules/sensitive-data.rules");
+			$sd_tmp_new_file="";
+			foreach ($sd_tmp_file as $sd_tmp_line)
+				$sd_tmp_new_file.=preg_match("/$sdf_alert_pattern/i",$sd_tmp_line) ? $sd_tmp_line : "";
+			file_put_contents("{$snortcfgdir}/preproc_rules/sensitive-data.rules",$sd_tmp_new_file,LOCK_EX);
+		}
+	}
+	elseif ($snortcfg['sensitive_data'] != 'on' && $snortcfg['protect_preproc_rules'] != 'on') {
+		/* Setting is "off", so disable all SDF rules. */
+		$sedcmd = '/^alert.*classtype:sdf/s/^/#/';
+		@file_put_contents("{$g['tmp_path']}/sedcmd", $sedcmd);
+		mwexec("/usr/bin/sed -I '' -f {$g['tmp_path']}/sedcmd {$snortcfgdir}/preproc_rules/sensitive-data.rules");
+		@unlink("{$g['tmp_path']}/sedcmd");
+	}
+
+	/* Load the decoder, preprocessor and sensitive-data  */
+	/* rules from the interface's preproc_rule directory  */
+	/* into the $enabled_rules array.                     */
+	$enabled_rules = snort_load_rules_map("{$snortcfgdir}/preproc_rules/");
+
 	/* Only rebuild rules if some are selected or an IPS Policy is enabled  */
 	if (!empty($snortcfg['rulesets']) || $snortcfg['ips_policy_enable'] == 'on') {
-		$enabled_rules = array();
 		$enabled_files = array();
 		$all_rules = array();
 		$no_rules_defined = false;
 
-		/* Load up all the rules into a Rules Map array. */
+		/* Load up all the text rules into a Rules Map array. */
 		$all_rules = snort_load_rules_map("{$snortdir}/rules/");
 
 		/* Create an array with the filenames of the enabled  */
@@ -2320,7 +2342,8 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
 			/* Just put an empty file to always have the file present */
 			snort_write_flowbit_rules_file(array(), "{$snortcfgdir}/rules/{$flowbit_rules_file}");
 	} else {
-		snort_write_enforcing_rules_file(array(), "{$snortcfgdir}/rules/{$snort_enforcing_rules_file}");
+		/* No regular rules or policy were selected, so just use the decoder and preproc rules */
+		snort_write_enforcing_rules_file($enabled_rules, "{$snortcfgdir}/rules/{$snort_enforcing_rules_file}");
 		snort_write_flowbit_rules_file(array(), "{$snortcfgdir}/rules/{$flowbit_rules_file}");
 	}
 
@@ -2333,7 +2356,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
 
 	/* Log a warning if the interface has no rules defined or enabled */
 	if ($no_rules_defined)
-		log_error(gettext("[Snort] Warning - no text rules selected for: " . snort_get_friendly_interface($snortcfg['interface']) . " ..."));
+		log_error(gettext("[Snort] Warning - no text rules or IPS-Policy selected for: " . snort_get_friendly_interface($snortcfg['interface']) . " ..."));
 
 	/* Build a new sid-msg.map file from the enabled */
 	/* rules and copy it to the interface directory. */
@@ -3219,43 +3242,9 @@ EOD;
 		$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
 	if (file_exists("{$snortcfgdir}/classification.config"))
 		$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
-	if (is_dir("{$snortcfgdir}/preproc_rules")) {
-		if ($snortcfg['sensitive_data'] == 'on' && $protect_preproc_rules == "off") {
-			$sedcmd = '/^#alert.*classtype:sdf/s/^#//';
-			if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")){
-				$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/sensitive-data.rules\n";
-				#enable only selected sensitive data
-				if (file_exists(SNORTDIR."/preproc_rules/sensitive-data.rules")){
-					$sdf_alert_pattern="(".preg_replace("/,/","|",$snortcfg['sdf_alert_data_type']).")";
-					$sd_tmp_file=file(SNORTDIR."/preproc_rules/sensitive-data.rules");
-					$sd_tmp_new_file="";
-					foreach ($sd_tmp_file as $sd_tmp_line)
-						$sd_tmp_new_file.=preg_match("/$sdf_alert_pattern/i",$sd_tmp_line) ? $sd_tmp_line : "";
-					file_put_contents("{$snortcfgdir}/preproc_rules/sensitive-data.rules",$sd_tmp_new_file,LOCK_EX);
-				}
-			}
-		} else
-			$sedcmd = '/^alert.*classtype:sdf/s/^/#/';
-		if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") &&
-		    file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules") && $protect_preproc_rules == "off") {
-			@file_put_contents("{$g['tmp_path']}/sedcmd", $sedcmd);
-			mwexec("/usr/bin/sed -I '' -f {$g['tmp_path']}/sedcmd {$snortcfgdir}/preproc_rules/preprocessor.rules");
-			mwexec("/usr/bin/sed -I '' -f {$g['tmp_path']}/sedcmd {$snortcfgdir}/preproc_rules/decoder.rules");
-			@unlink("{$g['tmp_path']}/sedcmd");
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/decoder.rules\n";
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/preprocessor.rules\n";
-		} else if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") &&
-			   file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules") && $protect_preproc_rules == "on") {
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/decoder.rules\n";
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/preprocessor.rules\n";
-		}
-		else {
-			$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-			log_error("[Snort] Seems preprocessor/decoder rules are missing, enabling autogeneration of them");
-		}
-	} else {
+	if (!file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") || !file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules")) {
 		$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-		log_error("[Snort] Seems preprocessor/decoder rules are missing, enabling autogeneration of them");
+		log_error("[Snort] Seems preprocessor and/or decoder rules are missing, enabling autogeneration of them in conf file.");
 	}
 
 	/* generate rule sections to load */
@@ -3673,9 +3662,8 @@ EOD;
 ipvar HOME_NET [{$home_net}]
 ipvar EXTERNAL_NET [{$external_net}]
 
-# Define Rule Paths #
+# Define Rule Path #
 var RULE_PATH {$snortcfgdir}/rules
-var PREPROC_RULE_PATH {$snortcfgdir}/preproc_rules
 
 # Define Servers #
 {$ipvardef}
diff --git a/config/snort/snort_migrate_config.php b/config/snort/snort_migrate_config.php
index 61989e99..1a812b24 100644
--- a/config/snort/snort_migrate_config.php
+++ b/config/snort/snort_migrate_config.php
@@ -1,8 +1,8 @@
 <?php
 /*
- * snort_migrate_config.inc
+ * snort_migrate_config.php
  *
- * Copyright (C) 2013 Bill Meeks
+ * Copyright (C) 2013, 2014 Bill Meeks
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -288,6 +288,40 @@ foreach ($rule as &$r) {
 		}
 	}
 
+	// Change any ENABLE_SID settings to new format of GID:SID
+	if (!empty($pconfig['rule_sid_on'])) {
+		$tmp = explode("||", $pconfig['rule_sid_on']);
+		$new_tmp = "";
+		foreach ($tmp as $v) {
+			if (strpos($v, ":") === false) {
+				if (preg_match('/(\d+)/', $v, $match))
+					$new_tmp .= "1:{$match[1]}||";
+			}
+		}
+		$new_tmp = rtrim($new_tmp, " ||");
+		if (!empty($new_tmp)) {
+			$pconfig['rule_sid_on'] = $new_tmp;
+			$updated_cfg = true;
+		}
+	}
+
+	// Change any DISABLE_SID settings to new format of GID:SID
+	if (!empty($pconfig['rule_sid_off'])) {
+		$tmp = explode("||", $pconfig['rule_sid_off']);
+		$new_tmp = "";
+		foreach ($tmp as $v) {
+			if (strpos($v, ":") === false) {
+				if (preg_match('/(\d+)/', $v, $match))
+					$new_tmp .= "1:{$match[1]}||";
+			}
+		}
+		$new_tmp = rtrim($new_tmp, " ||");
+		if (!empty($new_tmp)) {
+			$pconfig['rule_sid_off'] = $new_tmp;
+			$updated_cfg = true;
+		}
+	}
+
 	// Save the new configuration data into the $config array pointer
 	$r = $pconfig;
 }
diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php
index bfb7bb9c..a3c8eced 100644
--- a/config/snort/snort_post_install.php
+++ b/config/snort/snort_post_install.php
@@ -793,43 +793,9 @@ EOD;
 		$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
 	if (file_exists("{$snortcfgdir}/classification.config"))
 		$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
-	if (is_dir("{$snortcfgdir}/preproc_rules")) {
-		if ($snortcfg['sensitive_data'] == 'on' && $protect_preproc_rules == "off") {
-			$sedcmd = '/^#alert.*classtype:sdf/s/^#//';
-			if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")){
-				$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/sensitive-data.rules\n";
-				#enable only selected sensitive data
-				if (file_exists(SNORTDIR."/preproc_rules/sensitive-data.rules")){
-					$sdf_alert_pattern="(".preg_replace("/,/","|",$snortcfg['sdf_alert_data_type']).")";
-					$sd_tmp_file=file(SNORTDIR."/preproc_rules/sensitive-data.rules");
-					$sd_tmp_new_file="";
-					foreach ($sd_tmp_file as $sd_tmp_line)
-						$sd_tmp_new_file.=preg_match("/$sdf_alert_pattern/i",$sd_tmp_line) ? $sd_tmp_line : "";
-					file_put_contents("{$snortcfgdir}/preproc_rules/sensitive-data.rules",$sd_tmp_new_file,LOCK_EX);
-				}
-			}
-		} else
-			$sedcmd = '/^alert.*classtype:sdf/s/^/#/';
-		if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") &&
-		    file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules") && $protect_preproc_rules == "off") {
-			@file_put_contents("{$g['tmp_path']}/sedcmd", $sedcmd);
-			mwexec("/usr/bin/sed -I '' -f {$g['tmp_path']}/sedcmd {$snortcfgdir}/preproc_rules/preprocessor.rules");
-			mwexec("/usr/bin/sed -I '' -f {$g['tmp_path']}/sedcmd {$snortcfgdir}/preproc_rules/decoder.rules");
-			@unlink("{$g['tmp_path']}/sedcmd");
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/decoder.rules\n";
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/preprocessor.rules\n";
-		} else if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") &&
-			   file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules") && $protect_preproc_rules == "on") {
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/decoder.rules\n";
-			$snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/preprocessor.rules\n";
-		}
-		else {
-			$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-			log_error("[Snort] Seems preprocessor/decoder rules are missing, enabling autogeneration of them");
-		}
-	} else {
+	if (!file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") || !file_exists("{$snortcfgdir}/preproc_rules/preprocessor.rules")) {
 		$snort_misc_include_rules .= "config autogenerate_preprocessor_decoder_rules\n";
-		log_error("[Snort] Seems preprocessor/decoder rules are missing, enabling autogeneration of them");
+		log_error("[Snort] Seems preprocessor and/or decoder rules are missing, enabling autogeneration of them in conf file.");
 	}
 
 	/* generate rule sections to load */
@@ -1249,7 +1215,6 @@ ipvar EXTERNAL_NET [{$external_net}]
 
 # Define Rule Paths #
 var RULE_PATH {$snortcfgdir}/rules
-var PREPROC_RULE_PATH {$snortcfgdir}/preproc_rules
 
 # Define Servers #
 {$ipvardef}
@@ -1403,13 +1368,13 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') {
 	update_status(gettext("Saved settings detected..."));
 	/* Do one-time settings migration for new multi-engine configurations */
 	update_output_window(gettext("Please wait... migrating settings to new multi-engine configuration..."));
-	include "/usr/local/pkg/snort/snort_migrate_config.php";
+	include('/usr/local/pkg/snort/snort_migrate_config.php');
 	update_output_window(gettext("Please wait... rebuilding installation with saved settings..."));
 	log_error(gettext("[Snort] Downloading and updating configured rule types..."));
 	update_output_window(gettext("Please wait... downloading and updating configured rule types..."));
 	if ($pkg_interface <> "console")
 		$snort_gui_include = true;
-	include("/usr/local/pkg/snort/snort_check_for_rule_updates.php");
+	include('/usr/local/pkg/snort/snort_check_for_rule_updates.php');
 	update_status(gettext("Generating snort.conf configuration file from saved settings..."));
 	$rebuild_rules = true;
 
diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php
index a82d81d2..4307c8de 100755
--- a/config/snort/snort_rules.php
+++ b/config/snort/snort_rules.php
@@ -5,6 +5,7 @@
  * Copyright (C) 2004, 2005 Scott Ullrich
  * Copyright (C) 2008, 2009 Robert Zelaya
  * Copyright (C) 2011 Ermal Luci
+ * Copyright (C) 2013, 2014 Bill Meeks
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,7 +30,6 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 require_once("guiconfig.inc");
 require_once("/usr/local/pkg/snort/snort.inc");
 
@@ -51,7 +51,6 @@ if (is_null($id)) {
 }
 
 if (isset($id) && $a_rule[$id]) {
-	$pconfig['enable'] = $a_rule[$id]['enable'];
 	$pconfig['interface'] = $a_rule[$id]['interface'];
 	$pconfig['rulesets'] = $a_rule[$id]['rulesets'];
 	if (!empty($a_rule[$id]['customrules']))
@@ -109,8 +108,20 @@ $snort_uuid = $a_rule[$id]['uuid'];
 $snortcfgdir = "{$snortdir}/snort_{$snort_uuid}_{$if_real}";
 $snortdownload = $config['installedpackages']['snortglobal']['snortdownload'];
 $emergingdownload = $config['installedpackages']['snortglobal']['emergingthreats'];
+$etprodownload = $config['installedpackages']['snortglobal']['emergingthreats_pro'];
 $categories = explode("||", $pconfig['rulesets']);
 
+// add the standard rules files to the categories list
+$categories[] = "custom.rules";
+$categories[] = "decoder.rules";
+$categories[] = "preprocessor.rules";
+$categories[] = "sensitive-data.rules";
+if (!empty($a_rule[$id]['ips_policy']))
+	$categories[] = "IPS Policy - " . ucfirst($a_rule[$id]['ips_policy']);
+if ($a_rule[$id]['autoflowbitrules'] == 'on')
+	$categories[] = "Auto-Flowbit Rules";
+natcasesort($categories);
+
 if ($_GET['openruleset'])
 	$currentruleset = $_GET['openruleset'];
 else if ($_POST['openruleset'])
@@ -118,13 +129,6 @@ else if ($_POST['openruleset'])
 else
 	$currentruleset = $categories[0];
 
-if (empty($categories[0]) && ($currentruleset != "custom.rules") && ($currentruleset != "Auto-Flowbit Rules")) {
-	if (!empty($a_rule[$id]['ips_policy']))
-		$currentruleset = "IPS Policy - " . ucfirst($a_rule[$id]['ips_policy']);
-	else
-		$currentruleset = "custom.rules";
-}
-
 /* One last sanity check -- if the rules directory is empty, default to loading custom rules */
 $tmp = glob("{$snortdir}/rules/*.rules");
 if (empty($tmp))
@@ -136,58 +140,72 @@ if ($currentruleset != 'custom.rules') {
 	// Read the current rules file into our rules map array.
 	// If it is the auto-flowbits file, set the full path.
 	if ($currentruleset == "Auto-Flowbit Rules")
-		$rulefile = "{$snortcfgdir}/rules/" . FLOWBITS_FILENAME;
+		$rules_map = snort_load_rules_map("{$snortcfgdir}/rules/" . FLOWBITS_FILENAME);
 	// Test for the special case of an IPS Policy file.
-	if (substr($currentruleset, 0, 10) == "IPS Policy")
+	elseif (substr($currentruleset, 0, 10) == "IPS Policy")
 		$rules_map = snort_load_vrt_policy($a_rule[$id]['ips_policy']);
-	elseif (!file_exists($rulefile))
-		$input_errors[] = gettext("{$currentruleset} seems to be missing!!! Please verify rules files have been downloaded, then go to the Categories tab and save the rule set again.");
-	else
+	// Test for preproc_rules file and set the full path.
+	elseif (file_exists("{$snortdir}/preproc_rules/{$currentruleset}"))
+		$rules_map = snort_load_rules_map("{$snortdir}/preproc_rules/{$currentruleset}");
+	// Test for existence of regular text rules file and load it.
+	elseif (file_exists($rulefile))
 		$rules_map = snort_load_rules_map($rulefile);
+	else
+		$input_errors[] = gettext("{$currentruleset} seems to be missing!!! Please verify rules files have been downloaded, then go to the Categories tab and save the rule set again.");
 }
 
 /* Load up our enablesid and disablesid arrays with enabled or disabled SIDs */
-$enablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_on'], "enablesid");
-$disablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_off'], "disablesid");
+$enablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_on']);
+$disablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_off']);
 
 if ($_GET['act'] == "toggle" && $_GET['ids'] && !empty($rules_map)) {
 
+	// Get the GID tag embedded in the clicked rule icon.
+	$gid = $_GET['gid'];
+
 	// Get the SID tag embedded in the clicked rule icon.
 	$sid= $_GET['ids'];
 
 	// See if the target SID is in our list of modified SIDs,
 	// and toggle it if present; otherwise, add it to the
 	// appropriate list.
-	if (isset($enablesid[$sid])) {
-		unset($enablesid[$sid]);
-		if (!isset($disablesid[$sid]))
-			$disablesid[$sid] = "disablesid";
+	if (isset($enablesid[$gid][$sid])) {
+		unset($enablesid[$gid][$sid]);
+		if (!isset($disablesid[$gid][$sid]))
+			$disablesid[$gid][$sid] = "disablesid";
 	}
-	elseif (isset($disablesid[$sid])) {
-		unset($disablesid[$sid]);
-		if (!isset($enablesid[$sid]))
-			$enablesid[$sid] = "enablesid";
+	elseif (isset($disablesid[$gid][$sid])) {
+		unset($disablesid[$gid][$sid]);
+		if (!isset($enablesid[$gid][$sid]))
+			$enablesid[$gid][$sid] = "enablesid";
 	}
 	else {
-		if ($rules_map[1][$sid]['disabled'] == 1)
-			$enablesid[$sid] = "enablesid";
+		if ($rules_map[$gid][$sid]['disabled'] == 1)
+			$enablesid[$gid][$sid] = "enablesid";
 		else
-			$disablesid[$sid] = "disablesid";
+			$disablesid[$gid][$sid] = "disablesid";
 	}
 
 	// Write the updated enablesid and disablesid values to the config file.
 	$tmp = "";
-	foreach ($enablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($enablesid) as $k1) {
+		foreach (array_keys($enablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_on'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_on']);
+
 	$tmp = "";
-	foreach ($disablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($disablesid) as $k1) {
+		foreach (array_keys($disablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_off'] = $tmp;
 	else				
@@ -197,7 +215,7 @@ if ($_GET['act'] == "toggle" && $_GET['ids'] && !empty($rules_map)) {
 	write_config();
 
 	$_GET['openruleset'] = $currentruleset;
-	$anchor = "rule_{$sid}";
+	$anchor = "rule_{$gid}_{$sid}";
 }
 
 if ($_GET['act'] == "disable_all" && !empty($rules_map)) {
@@ -205,28 +223,37 @@ if ($_GET['act'] == "disable_all" && !empty($rules_map)) {
 	// Mark all rules in the currently selected category "disabled".
 	foreach (array_keys($rules_map) as $k1) {
 		foreach (array_keys($rules_map[$k1]) as $k2) {
-			if (isset($enablesid[$k2]))
-				unset($enablesid[$k2]);
-			$disablesid[$k2] = "disablesid";
+			if (isset($enablesid[$k1][$k2]))
+				unset($enablesid[$k1][$k2]);
+			$disablesid[$k1][$k2] = "disablesid";
 		}
 	}
+
 	// Write the updated enablesid and disablesid values to the config file.
 	$tmp = "";
-	foreach ($enablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($enablesid) as $k1) {
+		foreach (array_keys($enablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_on'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_on']);
+
 	$tmp = "";
-	foreach ($disablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($disablesid) as $k1) {
+		foreach (array_keys($disablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_off'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
+
 	write_config();
 
 	$_GET['openruleset'] = $currentruleset;
@@ -239,28 +266,36 @@ if ($_GET['act'] == "enable_all" && !empty($rules_map)) {
 	// Mark all rules in the currently selected category "enabled".
 	foreach (array_keys($rules_map) as $k1) {
 		foreach (array_keys($rules_map[$k1]) as $k2) {
-			if (isset($disablesid[$k2]))
-				unset($disablesid[$k2]);
-			$enablesid[$k2] = "enablesid";
+			if (isset($disablesid[$k1][$k2]))
+				unset($disablesid[$k1][$k2]);
+			$enablesid[$k1][$k2] = "enablesid";
 		}
 	}
 	// Write the updated enablesid and disablesid values to the config file.
 	$tmp = "";
-	foreach ($enablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($enablesid) as $k1) {
+		foreach (array_keys($enablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_on'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_on']);
+
 	$tmp = "";
-	foreach ($disablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($disablesid) as $k1) {
+		foreach (array_keys($disablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_off'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
+
 	write_config();
 
 	$_GET['openruleset'] = $currentruleset;
@@ -273,30 +308,38 @@ if ($_GET['act'] == "resetcategory" && !empty($rules_map)) {
 	// Reset any modified SIDs in the current rule category to their defaults.
 	foreach (array_keys($rules_map) as $k1) {
 		foreach (array_keys($rules_map[$k1]) as $k2) {
-			if (isset($enablesid[$k2]))
-				unset($enablesid[$k2]);
-			if (isset($disablesid[$k2]))
-				unset($disablesid[$k2]);
+			if (isset($enablesid[$k1][$k2]))
+				unset($enablesid[$k1][$k2]);
+			if (isset($disablesid[$k1][$k2]))
+				unset($disablesid[$k1][$k2]);
 		}
 	}
 
 	// Write the updated enablesid and disablesid values to the config file.
 	$tmp = "";
-	foreach ($enablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($enablesid) as $k1) {
+		foreach (array_keys($enablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_on'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_on']);
+
 	$tmp = "";
-	foreach ($disablesid as $k => $v) {
-		$tmp .= "||{$v} {$k}";
+	foreach (array_keys($disablesid) as $k1) {
+		foreach (array_keys($disablesid[$k1]) as $k2)
+			$tmp .= "{$k1}:{$k2}||";
 	}
+	$tmp = rtrim($tmp, "||");
+
 	if (!empty($tmp))
 		$a_rule[$id]['rule_sid_off'] = $tmp;
 	else				
 		unset($a_rule[$id]['rule_sid_off']);
+
 	write_config();
 
 	$_GET['openruleset'] = $currentruleset;
@@ -416,15 +459,15 @@ if ($savemsg) {
 		display_top_tabs($tab_array);
 		echo '</td></tr>';
 		echo '<tr><td class="tabnavtbl">';
-		$menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface ");;
-        $tab_array = array();
-        $tab_array[] = array($menu_iface . gettext("Settings"), false, "/snort/snort_interfaces_edit.php?id={$id}");
-	    $tab_array[] = array($menu_iface . gettext("Categories"), false, "/snort/snort_rulesets.php?id={$id}");
-        $tab_array[] = array($menu_iface . gettext("Rules"), true, "/snort/snort_rules.php?id={$id}");
-	    $tab_array[] = array($menu_iface . gettext("Variables"), false, "/snort/snort_define_servers.php?id={$id}");
-        $tab_array[] = array($menu_iface . gettext("Preprocessors"), false, "/snort/snort_preprocessors.php?id={$id}");
-	    $tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/snort/snort_barnyard.php?id={$id}");
-        display_top_tabs($tab_array);
+		$menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface ");
+		$tab_array = array();
+		$tab_array[] = array($menu_iface . gettext("Settings"), false, "/snort/snort_interfaces_edit.php?id={$id}");
+		$tab_array[] = array($menu_iface . gettext("Categories"), false, "/snort/snort_rulesets.php?id={$id}");
+		$tab_array[] = array($menu_iface . gettext("Rules"), true, "/snort/snort_rules.php?id={$id}");
+		$tab_array[] = array($menu_iface . gettext("Variables"), false, "/snort/snort_define_servers.php?id={$id}");
+		$tab_array[] = array($menu_iface . gettext("Preprocessors"), false, "/snort/snort_preprocessors.php?id={$id}");
+		$tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/snort/snort_barnyard.php?id={$id}");
+		display_top_tabs($tab_array);
 	?>
 	</td></tr>
 	<tr><td><div id="mainarea">
@@ -435,19 +478,14 @@ if ($savemsg) {
 
 			<tr>
 				<td class="vncell" height="30px"><strong><?php echo gettext("Category:"); ?></strong>&nbsp;&nbsp;<select id="selectbox" name="selectbox" class="formselect" onChange="go()">
-					<option value='?id=<?=$id;?>&openruleset=custom.rules'>custom.rules</option>
 					<?php
-					$files = explode("||", $pconfig['rulesets']);
-					if ($a_rule[$id]['ips_policy_enable'] == 'on')
-						$files[] = "IPS Policy - " . ucfirst($a_rule[$id]['ips_policy']);
-					if ($a_rule[$id]['autoflowbitrules'] == 'on')
-						$files[] = "Auto-Flowbit Rules";
-					natcasesort($files);
-					foreach ($files as $value) {
+					foreach ($categories as $value) {
 						if ($snortdownload != 'on' && substr($value, 0, 6) == "snort_")
 							continue;
 						if ($emergingdownload != 'on' && substr($value, 0, 8) == "emerging")
 							continue;
+						if ($etprodownload != 'on' && substr($value, 0, 6) == "etpro-")
+							continue;
 						if (empty($value))
 							continue;
 						echo "<option value='?id={$id}&openruleset={$value}' ";
@@ -491,7 +529,7 @@ if ($savemsg) {
 							<input type='hidden' name='id' value='<?=$id;?>'/>
 							<input type='hidden' name='openruleset' value='<?=$currentruleset;?>'/><br/><br/>
 							<span class="vexpl"><span class="red"><strong><?php echo gettext("Note: ") . "</strong></span>" . 
-							gettext("Snort must be restarted to activate any SID enable/disable changes made on this tab."); ?></span></td>
+							gettext("Snort must be restarted to activate any rule enable/disable changes made on this tab."); ?></span></td>
 							<td class="vexpl" valign="middle"><?php echo "<a href='?id={$id}&openruleset={$currentruleset}&act=resetcategory'>
 							<img src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\" width=\"15\" height=\"15\" 
 							onmouseout='this.src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\"' 
@@ -543,11 +581,14 @@ if ($savemsg) {
 			</tr>
 			<tr>
 				<td>
+
+				<?php if ($currentruleset != 'decoder.rules' && $currentruleset != 'preprocessor.rules'): ?>
 					<table id="myTable" class="sortable" style="table-layout: fixed;" width="100%" border="0" cellpadding="0" cellspacing="0">
 						<colgroup>
 							<col width="15" align="left" valign="middle">
-							<col width="9%" align="center" axis="number">
-							<col width="60" align="center" axis="string">
+							<col width="6%" align="center" axis="number">
+							<col width="8%" align="center" axis="number">
+							<col width="54" align="center" axis="string">
 							<col width="14%" align="center" axis="string">
 							<col width="11%" align="center" axis="string">
 							<col width="14%" align="center" axis="string">
@@ -558,6 +599,7 @@ if ($savemsg) {
 						<thead>
 						   <tr>
 							<th class="list">&nbsp;</th>
+							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Proto"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Source"); ?></th>
@@ -579,24 +621,24 @@ if ($savemsg) {
 						$counter = $enable_cnt = $disable_cnt = 0;
 						foreach ($rules_map as $k1 => $rulem) {
 							foreach ($rulem as $k2 => $v) {
-								$sid = snort_get_sid($v['rule']);
-								$gid = snort_get_gid($v['rule']);
+								$sid = $k2;
+								$gid = $k1;
 
-								if (isset($disablesid[$sid])) {
+								if (isset($disablesid[$gid][$sid])) {
 									$textss = "<span class=\"gray\">";
 									$textse = "</span>";
 									$iconb = "icon_reject_d.gif";
 									$disable_cnt++;
 									$title = gettext("Disabled by user. Click to toggle to enabled state");
 								}
-								elseif (($v['disabled'] == 1) && (!isset($enablesid[$sid]))) {
+								elseif (($v['disabled'] == 1) && (!isset($enablesid[$gid][$sid]))) {
 									$textss = "<span class=\"gray\">";
 									$textse = "</span>";
 									$iconb = "icon_block_d.gif";
 									$disable_cnt++;
 									$title = gettext("Disabled by default. Click to toggle to enabled state");
 								}
-								elseif (isset($enablesid[$sid])) {
+								elseif (isset($enablesid[$gid][$sid])) {
 									$textss = $textse = "";
 									$iconb = "icon_reject.gif";
 									$enable_cnt++;
@@ -630,13 +672,16 @@ if ($savemsg) {
 								$message = snort_get_msg($v['rule']);
 
 						echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\"> $textss
-								<a id=\"rule_{$sid}\" href='?id={$id}&openruleset={$currentruleset}&act=toggle&ids={$sid}'>
+								<a id=\"rule_{$gid}_{$sid}\" href='?id={$id}&openruleset={$currentruleset}&act=toggle&gid={$gid}&ids={$sid}'>
 								<img src=\"../themes/{$g['theme']}/images/icons/{$iconb}\"
 								width=\"11\" height=\"11\" border=\"0\"  
 								title='{$title}'></a>
 								$textse
 							       </td>
 							       <td class=\"listlr\" align=\"center\">
+									{$textss}{$gid}{$textse}
+							       </td>
+							       <td class=\"listlr\" align=\"center\">
 									{$textss}{$sid}{$textse}
 							       </td>
 							       <td class=\"listlr\" align=\"center\">
@@ -673,6 +718,119 @@ if ($savemsg) {
 						?>
 					    </tbody>
 					</table>
+
+				<?php else: ?>
+
+					<table id="myTable" class="sortable" style="table-layout: fixed;" width="100%" border="0" cellpadding="0" cellspacing="0">
+						<colgroup>
+							<col width="15" align="left" valign="middle">
+							<col width="6%" align="center" axis="number">
+							<col width="6%" align="center" axis="number">
+							<col width="22%" align="center" axis="string">
+							<col width="15%" align="center" axis="string">
+							<col align="left" axis="string">
+							<col width="22" align="right" valign="middle">
+						</colgroup>
+						<thead>
+						   <tr>
+							<th class="list">&nbsp;</th>
+							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
+							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
+							<th class="listhdrr"><?php echo gettext("Classification"); ?></th>
+							<th class="listhdrr"><?php echo gettext("IPS Policy"); ?></th>
+							<th class="listhdrr"><?php echo gettext("Message"); ?></th>
+							<th class="list"><a href="javascript: void(0)" 
+							onclick="wopen('snort_rules_edit.php?id=<?=$id;?>&openruleset=<?=$currentruleset;?>','FileViewer',800,600)">
+							<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_service_restart.gif" <?php
+							echo "onmouseover='this.src=\"../themes/{$g['theme']}/images/icons/icon_services_restart_mo.gif\"' 
+							onmouseout='this.src=\"../themes/{$g['theme']}/images/icons/icon_service_restart.gif\"' ";?>				
+							title="<?php echo gettext("Click to view full text of all the category rules"); ?>" width="17" height="17" border="0"></a></th>
+						   </tr>
+						</thead>
+						<tbody>
+							<?php
+								$counter = $enable_cnt = $disable_cnt = 0;
+								foreach ($rules_map as $k1 => $rulem) {
+									foreach ($rulem as $k2 => $v) {
+										$sid = snort_get_sid($v['rule']);
+										$gid = snort_get_gid($v['rule']);
+										if (isset($disablesid[$gid][$sid])) {
+											$textss = "<span class=\"gray\">";
+											$textse = "</span>";
+											$iconb = "icon_reject_d.gif";
+											$disable_cnt++;
+											$title = gettext("Disabled by user. Click to toggle to enabled state");
+										}
+										elseif (($v['disabled'] == 1) && (!isset($enablesid[$gid][$sid]))) {
+											$textss = "<span class=\"gray\">";
+											$textse = "</span>";
+											$iconb = "icon_block_d.gif";
+											$disable_cnt++;
+											$title = gettext("Disabled by default. Click to toggle to enabled state");
+										}
+										elseif (isset($enablesid[$gid][$sid])) {
+											$textss = $textse = "";
+											$iconb = "icon_reject.gif";
+											$enable_cnt++;
+											$title = gettext("Enabled by user. Click to toggle to disabled state");
+										}
+										else {
+											$textss = $textse = "";
+											$iconb = "icon_block.gif";
+											$enable_cnt++;
+											$title = gettext("Enabled by default. Click to toggle to disabled state");
+										}
+										$message = snort_get_msg($v['rule']);
+										$matches = array();
+										if (preg_match('/(?:classtype\b\s*:)\s*(\S*\s*;)/iU', $v['rule'], $matches))
+											$classtype = trim($matches[1], " ;");
+										else
+											$classtype = "No Classtype Defined";
+										$matches = array();
+										if (preg_match_all('/(\S*-ips)(?:\s*drop|alert)(?:,|\s*|;)/i', $v['rule'], $matches))
+											$policy = implode("<br/>", $matches[1]);
+										else
+											$policy = "none";
+
+										echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\"> $textss
+										<a id=\"rule_{$sid}\" href='?id={$id}&openruleset={$currentruleset}&act=toggle&ids={$sid}&gid={$gid}'>
+										<img src=\"../themes/{$g['theme']}/images/icons/{$iconb}\"
+										width=\"11\" height=\"11\" border=\"0\"  
+										title='{$title}'></a>
+										$textse
+								       		</td>
+									       <td class=\"listlr\" align=\"center\">
+											{$textss}{$gid}{$textse}
+									       </td>
+									       <td class=\"listlr\" align=\"center\">
+											{$textss}{$sid}{$textse}
+										</td>
+										<td class=\"listlr\" align=\"center\">
+											{$textss}{$classtype}</span>
+							       			</td>
+							       			<td class=\"listlr\" align=\"center\">
+								       			{$textss}{$policy}</span>
+								       		</td>
+										<td class=\"listbg\" style=\"word-wrap:break-word; whitespace:pre-line;\"><font color=\"white\"> 
+											{$textss}{$message}{$textse}</font>
+							       			</td>";
+									?>
+										<td align="right" valign="middle" nowrap class="listt">
+											<a href="javascript: void(0)" 
+											onclick="wopen('snort_rules_edit.php?id=<?=$id;?>&openruleset=<?=$currentruleset;?>&ids=<?=$sid;?>&gid=<?=$gid;?>','FileViewer',800,600)">
+											<img src="../themes/<?= $g['theme']; ?>/images/icons/icon_right.gif" 
+											title="<?php echo gettext("Click to view the entire rule text"); ?>" width="17" height="17" border="0"></a>
+										</td>
+									   	</tr>
+							<?php
+										$counter++;
+									}
+								}
+							unset($rulem, $v);
+							?>
+						</tbody>
+					</table>
+				<?php endif;?>
 				</td>
 			</tr>
 			<tr>
diff --git a/config/snort/snort_rules_edit.php b/config/snort/snort_rules_edit.php
index c0087464..28deccd5 100755
--- a/config/snort/snort_rules_edit.php
+++ b/config/snort/snort_rules_edit.php
@@ -4,6 +4,7 @@
  *
  * Copyright (C) 2004, 2005 Scott Ullrich
  * Copyright (C) 2011 Ermal Luci
+ * Copyright (C) 2014 Bill Meeks
  * All rights reserved.
  *
  * Adapted for FreeNAS by Volker Theile (votdev@gmx.de)
@@ -97,18 +98,22 @@ elseif (isset($_GET['ids'])) {
 	// If flowbit rule, point to interface-specific file
 	if ($file == "Auto-Flowbit Rules")
 		$rules_map = snort_load_rules_map("{$snortcfgdir}/rules/" . FLOWBITS_FILENAME);
+	elseif (file_exists("{$snortdir}/preproc_rules/{$file}"))
+		$rules_map = snort_load_rules_map("{$snortdir}/preproc_rules/{$file}");
 	else
 		$rules_map = snort_load_rules_map("{$snortdir}/rules/{$file}");
 	$contents = $rules_map[$_GET['gid']][trim($_GET['ids'])]['rule'];
 	$wrap_flag = "soft";
 }
-
 // Is it our special flowbit rules file?
 elseif ($file == "Auto-Flowbit Rules")
 	$contents = file_get_contents("{$snortcfgdir}/rules/{$flowbit_rules_file}");
 // Is it a rules file in the ../rules/ directory?
 elseif (file_exists("{$snortdir}/rules/{$file}"))
 	$contents = file_get_contents("{$snortdir}/rules/{$file}");
+// Is it a rules file in the ../preproc_rules/ directory?
+elseif (file_exists("{$snortdir}/preproc_rules/{$file}"))
+	$contents = file_get_contents("{$snortdir}/preproc_rules/{$file}");
 // Is it a fully qualified path and file?
 elseif (file_exists($file))
 	$contents = file_get_contents($file);