diff options
| author | bmeeks8 <bmeeks8@bellsouth.net> | 2013-11-22 23:27:37 -0500 |
|---|---|---|
| committer | bmeeks8 <bmeeks8@bellsouth.net> | 2013-11-22 23:27:37 -0500 |
| commit | 3f6aaa9c4a7adf4570307eaae6a53e866b7fc897 (patch) | |
| tree | 7c2115c36abb3934b47a57e88d7b14c9d2c86195 /config/snort/snort.inc | |
| parent | 3fd53f7221352702ffe64f9de9ef7820b75e51b8 (diff) | |
| parent | 0d7e8e94c0854145806e91e7ff82015bb1c30330 (diff) | |
| download | pfsense-packages-3f6aaa9c4a7adf4570307eaae6a53e866b7fc897.tar.gz pfsense-packages-3f6aaa9c4a7adf4570307eaae6a53e866b7fc897.tar.bz2 pfsense-packages-3f6aaa9c4a7adf4570307eaae6a53e866b7fc897.zip | |
Merge branch 'master' of https://github.com/bmeeks8/pfsense-packages
Diffstat (limited to 'config/snort/snort.inc')
| -rwxr-xr-x | config/snort/snort.inc | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index 1a6f1ac6..0573d5f4 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -3204,8 +3204,18 @@ EOD; if (is_dir("{$snortcfgdir}/preproc_rules")) { if ($snortcfg['sensitive_data'] == 'on' && $protect_preproc_rules == "off") { $sedcmd = '/^#alert.*classtype:sdf/s/^#//'; - if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")) + if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")){ $snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/sensitive-data.rules\n"; + #enable only selected sensitive data + if (file_exists(SNORTDIR."/preproc_rules/sensitive-data.rules")){ + $sdf_alert_pattern="(".preg_replace("/,/","|",$snortcfg['sdf_alert_data_type']).")"; + $sd_tmp_file=file(SNORTDIR."/preproc_rules/sensitive-data.rules"); + $sd_tmp_new_file=""; + foreach ($sd_tmp_file as $sd_tmp_line) + $sd_tmp_new_file.=preg_match("/$sdf_alert_pattern/i",$sd_tmp_line) ? $sd_tmp_line : ""; + file_put_contents("{$snortcfgdir}/preproc_rules/sensitive-data.rules",$sd_tmp_new_file,LOCK_EX); + } + } } else $sedcmd = '/^alert.*classtype:sdf/s/^/#/'; if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") && |