aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorbmeeks8 <bmeeks8@bellsouth.net>2015-07-03 22:25:20 -0400
committerbmeeks8 <bmeeks8@bellsouth.net>2015-07-03 22:25:20 -0400
commit168d9e3a981e7bbf9d54aa2dd8c1aed4d904238c (patch)
tree1b7d9834f2b226ec95c1e4fe901294066b9974ce
parent129844406855b3406d9d220df776a3e12ffc55da (diff)
downloadpfsense-packages-168d9e3a981e7bbf9d54aa2dd8c1aed4d904238c.tar.gz
pfsense-packages-168d9e3a981e7bbf9d54aa2dd8c1aed4d904238c.tar.bz2
pfsense-packages-168d9e3a981e7bbf9d54aa2dd8c1aed4d904238c.zip
Add new feature to hide deprecated rules categories in GUI.
-rw-r--r--config/snort/deprecated_rules62
-rwxr-xr-xconfig/snort/snort.inc67
-rwxr-xr-xconfig/snort/snort.xml5
-rwxr-xr-xconfig/snort/snort_check_for_rule_updates.php6
-rw-r--r--config/snort/snort_interfaces_global.php15
-rw-r--r--config/snort/snort_migrate_config.php8
-rw-r--r--config/snort/snort_post_install.php3
7 files changed, 166 insertions, 0 deletions
diff --git a/config/snort/deprecated_rules b/config/snort/deprecated_rules
new file mode 100644
index 00000000..d17cb395
--- /dev/null
+++ b/config/snort/deprecated_rules
@@ -0,0 +1,62 @@
+#
+# Obsoleted Snort VRT rule categories
+#
+snort_attack-responses.rules
+snort_backdoor.rules
+snort_bad-traffic.rules
+snort_botnet-cnc.rules
+snort_chat.rules
+snort_ddos.rules
+snort_dns.rules
+snort_dos.rules
+snort_experimental.rules
+snort_exploit.rules
+snort_finger.rules
+snort_ftp.rules
+snort_icmp-info.rules
+snort_icmp.rules
+snort_imap.rules
+snort_info.rules
+snort_misc.rules
+snort_multimedia.rules
+snort_mysql.rules
+snort_nntp.rules
+snort_oracle.rules
+snort_other-ids.rules
+snort_p2p.rules
+snort_phishing-spam.rules
+snort_policy.rules
+snort_pop2.rules
+snort_pop3.rules
+snort_rpc.rules
+snort_rservices.rules
+snort_scada.rules
+snort_scan.rules
+snort_shellcode.rules
+snort_smtp.rules
+snort_snmp.rules
+snort_specific-threats.rules
+snort_spyware-put.rules
+snort_telnet.rules
+snort_tftp.rules
+snort_virus.rules
+snort_voip.rules
+snort_web-activex.rules
+snort_web-attacks.rules
+snort_web-cgi.rules
+snort_web-client.rules
+snort_web-coldfusion.rules
+snort_web-frontpage.rules
+snort_web-iis.rules
+snort_web-misc.rules
+snort_web-php.rules
+#
+# Obsoleted Emerging Threats Categories
+#
+emerging-rbn-malvertisers.rules
+emerging-rbn.rules
+#
+# Obsoleted Emerging Threats PRO Categories
+#
+etpro-rbn-malvertisers.rules
+etpro-rbn.rules \ No newline at end of file
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index e6de14d6..027207b1 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -3668,6 +3668,73 @@ function snort_generate_conf($snortcfg) {
unset($home_net, $external_net, $ipvardef, $portvardef);
}
+function snort_remove_dead_rules() {
+
+ /********************************************************/
+ /* This function removes dead and deprecated rules */
+ /* category files from the base Snort rules directory */
+ /* and from the RULESETS setting of each interface. */
+ /* The file "deprecated_rules", if it exists, is used */
+ /* to determine which rules files to remove. */
+ /********************************************************/
+
+ global $config, $g;
+ $rulesdir = SNORTDIR . "/rules/";
+ $count = 0;
+ $cats = array();
+
+ // If there is no "deprecated_rules" file, then exit
+ if (!file_exists("{$rulesdir}deprecated_rules"))
+ return;
+
+ // Open a SplFileObject to read in deprecated rules
+ $file = new SplFileObject("{$rulesdir}/deprecated_rules");
+ $file->setFlags(SplFileObject::READ_AHEAD | SplFileObject::SKIP_EMPTY | SplFileObject::DROP_NEW_LINE);
+ while (!$file->eof()) {
+ $line = $file->fgets();
+
+ // Skip any lines with just spaces
+ if (trim($line) == "")
+ continue;
+
+ // Skip any comment lines starting with '#'
+ if (preg_match('/^\s*\#+/', $line))
+ continue;
+
+ $cats[] = $line;
+ }
+
+ // Close the SplFileObject since we are finished with it
+ $file = null;
+
+ // Delete any dead rules files from the Snort RULES directory
+ foreach ($cats as $file) {
+ if (file_exists("{$rulesdir}{$file}"))
+ $count++;
+ unlink_if_exists("{$rulesdir}{$file}");
+ }
+
+ // Log how many obsoleted files were removed
+ log_error(gettext("[Snort] Removed {$count} obsoleted rules category files."));
+
+ // Now remove any dead rules files from the interface configurations
+ if (!empty($cats) && is_array($config['installedpackages']['snortglobal']['rule'])) {
+ foreach ($config['installedpackages']['snortglobal']['rule'] as &$iface) {
+ $enabled_rules = explode("||", $iface['rulesets']);
+ foreach ($enabled_rules as $k => $v) {
+ foreach ($cats as $d) {
+ if (strpos(trim($v), $d) !== false)
+ unset($enabled_rules[$k]);
+ }
+ }
+ $iface['rulesets'] = implode("||", $enabled_rules);
+ }
+ }
+
+ // Clean up
+ unset($cats, $enabled_rules);
+}
+
/* Uses XMLRPC to synchronize the changes to a remote node */
function snort_sync_on_changes() {
global $config, $g;
diff --git a/config/snort/snort.xml b/config/snort/snort.xml
index c9401f05..a9b4bed4 100755
--- a/config/snort/snort.xml
+++ b/config/snort/snort.xml
@@ -94,6 +94,11 @@
<item>https://packages.pfsense.org/packages/config/snort/snort_sync.xml</item>
</additional_files_needed>
<additional_files_needed>
+ <prefix>/usr/local/pkg/snort/</prefix>
+ <chmod>077</chmod>
+ <item>https://packages.pfsense.org/packages/config/snort/deprecated_rules</item>
+ </additional_files_needed>
+ <additional_files_needed>
<prefix>/usr/local/www/snort/</prefix>
<chmod>077</chmod>
<item>https://packages.pfsense.org/packages/config/snort/snort_alerts.php</item>
diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php
index 19930f27..0c4543cd 100755
--- a/config/snort/snort_check_for_rule_updates.php
+++ b/config/snort/snort_check_for_rule_updates.php
@@ -682,6 +682,12 @@ if ($emergingthreats == 'on') {
}
}
+// If removing deprecated rules categories, then do it
+if ($config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on") {
+ log_error(gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories."));
+ snort_remove_dead_rules();
+}
+
function snort_apply_customizations($snortcfg, $if_real) {
global $vrt_enabled, $rebuild_rules;
diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php
index 6c1d56ac..b2ecefee 100644
--- a/config/snort/snort_interfaces_global.php
+++ b/config/snort/snort_interfaces_global.php
@@ -60,6 +60,7 @@ else {
$pconfig['clearblocks'] = $config['installedpackages']['snortglobal']['clearblocks'] == "on" ? 'on' : 'off';
$pconfig['verbose_logging'] = $config['installedpackages']['snortglobal']['verbose_logging'] == "on" ? 'on' : 'off';
$pconfig['openappid_detectors'] = $config['installedpackages']['snortglobal']['openappid_detectors'] == "on" ? 'on' : 'off';
+ $pconfig['hide_deprecated_rules'] = $config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on" ? 'on' : 'off';
}
/* Set sensible values for any empty default params */
@@ -100,6 +101,7 @@ if (!$input_errors) {
$config['installedpackages']['snortglobal']['clearblocks'] = $_POST['clearblocks'] ? 'on' : 'off';
$config['installedpackages']['snortglobal']['verbose_logging'] = $_POST['verbose_logging'] ? 'on' : 'off';
$config['installedpackages']['snortglobal']['openappid_detectors'] = $_POST['openappid_detectors'] ? 'on' : 'off';
+ $config['installedpackages']['snortglobal']['hide_deprecated_rules'] = $_POST['hide_deprecated_rules'] ? 'on' : 'off';
// If any rule sets are being turned off, then remove them
// from the active rules section of each interface. Start
@@ -136,6 +138,12 @@ if (!$input_errors) {
}
}
+ // If deprecated rules should be removed, then do it
+ if ($config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on") {
+ log_error(gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories."));
+ snort_remove_dead_rules();
+ }
+
$config['installedpackages']['snortglobal']['oinkmastercode'] = $_POST['oinkmastercode'];
$config['installedpackages']['snortglobal']['etpro_code'] = $_POST['etpro_code'];
@@ -334,6 +342,13 @@ if ($input_errors)
</td>
</tr>
<tr>
+ <td width="22%" valign="top" class="vncell"><?php echo gettext("Hide Deprecated Rules Categories"); ?></td>
+ <td width="78%" class="vtable"><input name="hide_deprecated_rules" id="hide_deprecated_rules" type="checkbox" value="yes"
+ <?php if ($pconfig['hide_deprecated_rules']=="on") echo "checked"; ?> />
+ &nbsp;&nbsp;<?php echo gettext("Hide deprecated rules categories in the GUI and remove them from the configuration. Default is ") .
+ "<strong>" . gettext("Not Checked") . "</strong>" . gettext("."); ?></td>
+</tr>
+<tr>
<td colspan="2" valign="top" class="listtopic"><?php echo gettext("Rules Update Settings"); ?></td>
</tr>
<tr>
diff --git a/config/snort/snort_migrate_config.php b/config/snort/snort_migrate_config.php
index dcc5aa76..2d8d8927 100644
--- a/config/snort/snort_migrate_config.php
+++ b/config/snort/snort_migrate_config.php
@@ -117,6 +117,14 @@ if (empty($config['installedpackages']['snortglobal']['openappid_detectors'])) {
}
/**********************************************************/
+/* Create new HIDE_DEPRECATED_RULES setting if not set */
+/**********************************************************/
+if (empty($config['installedpackages']['snortglobal']['hide_deprecated_rules'])) {
+ $config['installedpackages']['snortglobal']['hide_deprecated_rules'] = "off";
+ $updated_cfg = true;
+}
+
+/**********************************************************/
/* Migrate per interface settings if required. */
/**********************************************************/
foreach ($rule as &$r) {
diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php
index 2366c87d..0c0fb723 100644
--- a/config/snort/snort_post_install.php
+++ b/config/snort/snort_post_install.php
@@ -85,6 +85,9 @@ conf_mount_rw();
@rename("{$snortdir}/gen-msg.map-sample", "{$snortdir}/gen-msg.map");
//@rename("{$snortdir}/attribute_table.dtd-sample", "{$snortdir}/attribute_table.dtd");
+/* Move deprecated_rules file to SNORTDIR/rules directory */
+@rename("/usr/local/pkg/snort/deprecated_rules", "{$snortdir}/rules/deprecated_rules");
+
/* fix up the preprocessor rules filenames from a PBI package install */
$preproc_rules = array("decoder.rules", "preprocessor.rules", "sensitive-data.rules");
foreach ($preproc_rules as $file) {