aboutsummaryrefslogtreecommitdiffstats
path: root/config/snort/snort.inc
diff options
context:
space:
mode:
authorbmeeks8 <bmeeks8@bellsouth.net>2014-04-02 15:17:17 -0400
committerErmal <ermal.luci@gmail.com>2014-04-08 08:47:25 +0000
commit31f532f0a5ff302359a6659c9fc32821f094404c (patch)
tree9323b76de5c62f0dbd11b5e2442fda1559ad56d0 /config/snort/snort.inc
parenteb2396625555027c201e14085e9efd5cadaca8ec (diff)
downloadpfsense-packages-31f532f0a5ff302359a6659c9fc32821f094404c.tar.gz
pfsense-packages-31f532f0a5ff302359a6659c9fc32821f094404c.tar.bz2
pfsense-packages-31f532f0a5ff302359a6659c9fc32821f094404c.zip
Add support for new Barnyard2 output plugins.
Diffstat (limited to 'config/snort/snort.inc')
-rwxr-xr-xconfig/snort/snort.inc639
1 files changed, 328 insertions, 311 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index 847a0dba..1c9c5cd6 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -51,10 +51,10 @@ $snortver = array();
exec("/usr/local/bin/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver);
$snort_version = $snortver[0];
if (empty($snort_version))
- $snort_version = "2.9.5.6";
+ $snort_version = "2.9.6.0";
/* package version */
-$pfSense_snort_version = "3.0.4";
+$pfSense_snort_version = "3.0.5";
$snort_package_version = "Snort {$snort_version} pkg v{$pfSense_snort_version}";
// Define SNORTDIR and SNORTLIBDIR constants according to pfSense version
@@ -81,6 +81,7 @@ define("VRT_FILE_PREFIX", "snort_");
define("GPL_FILE_PREFIX", "GPLv2_");
define("ET_OPEN_FILE_PREFIX", "emerging-");
define("ET_PRO_FILE_PREFIX", "etpro-");
+define("IPREP_PATH", "/var/db/snort/iprep/");
/* Rebuild Rules Flag -- if "true", rebuild enforcing rules and flowbit-rules files */
$rebuild_rules = false;
@@ -498,21 +499,18 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false) {
return $valresult;
}
-/* checks to see if service is running yes/no and stop/start */
+/* checks to see if service is running */
function snort_is_running($snort_uuid, $if_real, $type = 'snort') {
global $config, $g;
- if (file_exists("{$g['varrun_path']}/{$type}_{$if_real}{$snort_uuid}.pid") && isvalidpid("{$g['varrun_path']}/{$type}_{$if_real}{$snort_uuid}.pid"))
- return 'yes';
-
- return 'no';
+ return isvalidpid("{$g['varrun_path']}/{$type}_{$if_real}{$snort_uuid}.pid");
}
function snort_barnyard_stop($snortcfg, $if_real) {
global $config, $g;
$snort_uuid = $snortcfg['uuid'];
- if (file_exists("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid") && isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) {
log_error("[Snort] Barnyard2 STOP for {$snortcfg['descr']}({$if_real})...");
killbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid");
}
@@ -522,7 +520,7 @@ function snort_stop($snortcfg, $if_real) {
global $config, $g;
$snort_uuid = $snortcfg['uuid'];
- if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid") && isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
log_error("[Snort] Snort STOP for {$snortcfg['descr']}({$if_real})...");
killbypid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid");
}
@@ -534,12 +532,13 @@ function snort_barnyard_start($snortcfg, $if_real) {
global $config, $g;
$snortdir = SNORTDIR;
+ $snortlogdir = SNORTLOGDIR;
$snort_uuid = $snortcfg['uuid'];
/* define snortbarnyardlog_chk */
- if ($snortcfg['barnyard_enable'] == 'on' && !empty($snortcfg['barnyard_mysql'])) {
+ if ($snortcfg['barnyard_enable'] == 'on') {
log_error("[Snort] Barnyard2 START for {$snortcfg['descr']}({$if_real})...");
- exec("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d /var/log/snort/snort_{$if_real}{$snort_uuid} -D -q");
+ mwexec("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q");
}
}
@@ -547,11 +546,12 @@ function snort_start($snortcfg, $if_real) {
global $config, $g;
$snortdir = SNORTDIR;
+ $snortlogdir = SNORTLOGDIR;
$snort_uuid = $snortcfg['uuid'];
if ($snortcfg['enable'] == 'on') {
log_error("[Snort] Snort START for {$snortcfg['descr']}({$if_real})...");
- exec("/usr/local/bin/snort -R {$snort_uuid} -D -q -l /var/log/snort/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}");
+ mwexec("/usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}");
}
else
return;
@@ -575,64 +575,44 @@ function snort_reload_config($snortcfg, $signal="SIGHUP") {
$snortdir = SNORTDIR;
$snort_uuid = $snortcfg['uuid'];
- $if_real = snort_get_real_interface($snortcfg['interface']);
+ $if_real = get_real_interface($snortcfg['interface']);
/******************************************************/
/* Only send the SIGHUP if Snort is running and we */
/* can find a valid PID for the process. */
/******************************************************/
- if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid") && isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
log_error("[Snort] Snort RELOAD CONFIG for {$snortcfg['descr']} ({$if_real})...");
- exec("/bin/pkill -{$signal} -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid 2>&1 &");
+ mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid");
}
}
-function snort_get_friendly_interface($interface) {
-
- if (function_exists('convert_friendly_interface_to_friendly_descr'))
- $iface = convert_friendly_interface_to_friendly_descr($interface);
- else {
- if (!$interface || ($interface == "wan"))
- $iface = "WAN";
- else if(strtolower($interface) == "lan")
- $iface = "LAN";
- else if(strtolower($interface) == "pppoe")
- $iface = "PPPoE";
- else if(strtolower($interface) == "pptp")
- $iface = "PPTP";
- else
- $iface = strtoupper($interface);
- }
-
- return $iface;
-}
+function snort_barnyard_reload_config($snortcfg, $signal="HUP") {
-/* get the real iface name of wan */
-function snort_get_real_interface($interface) {
- global $config;
+ /**************************************************************/
+ /* This function sends the passed SIGNAL to the Barnyard2 */
+ /* instance on the passed interface to cause Barnyard to */
+ /* reload and parse the running configuration without */
+ /* impacting packet processing. It also executes the reload */
+ /* as a background process and returns control immediately */
+ /* to the caller. */
+ /* */
+ /* $signal = HUP (default) parses and reloads config. */
+ /**************************************************************/
+ global $g;
- $lc_interface = strtolower($interface);
- if (function_exists('get_real_interface'))
- return get_real_interface($lc_interface);
- else {
- if ($lc_interface == "lan") {
- if ($config['inerfaces']['lan'])
- return $config['interfaces']['lan']['if'];
- return $interface;
- }
- if ($lc_interface == "wan")
- return $config['interfaces']['wan']['if'];
- $ifdescrs = array();
- for ($j = 1; isset($config['interfaces']['opt' . $j]); $j++) {
- $ifname = "opt{$j}";
- if(strtolower($ifname) == $lc_interface)
- return $config['interfaces'][$ifname]['if'];
- if(isset($config['interfaces'][$ifname]['descr']) && (strtolower($config['interfaces'][$ifname]['descr']) == $lc_interface))
- return $config['interfaces'][$ifname]['if'];
- }
- }
+ $snortdir = SNORTDIR;
+ $snort_uuid = $snortcfg['uuid'];
+ $if_real = get_real_interface($snortcfg['interface']);
- return $interface;
+ /******************************************************/
+ /* Only send the SIGHUP if Barnyard2 is running and */
+ /* we can find a valid PID for the process. */
+ /******************************************************/
+ if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) {
+ log_error("[Snort] Barnyard2 CONFIG RELOAD initiated for {$snortcfg['descr']} ({$if_real})...");
+ mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid");
+ }
}
/*
@@ -650,7 +630,7 @@ function snort_post_delete_logs($snort_uuid = 0) {
foreach ($config['installedpackages']['snortglobal']['rule'] as $value) {
if ($value['uuid'] != $snort_uuid)
continue;
- $if_real = snort_get_real_interface($value['interface']);
+ $if_real = get_real_interface($value['interface']);
$snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}";
if ($if_real != '') {
@@ -661,18 +641,14 @@ function snort_post_delete_logs($snort_uuid = 0) {
@unlink($file);
/* Clean-up packet capture files if any exist */
- $filelist = glob("{$snort_log_dir}/snort.log.*");
- foreach ($filelist as $file)
- @unlink($file);
+ unlink_if_exists("{$snort_log_dir}/snort.log.*");
- /* Clean-up stats files if they are enabled */
- if ($value['perform_stat'] == 'on') {
- $fd = fopen("{$snort_log_dir}/{$if_real}.stats", "w");
- if ($fd) {
- ftruncate($fd, 0);
- fclose($fd);
- }
- }
+ /* Clean-up Barnyard2 archived files if any exist */
+ unlink_if_exists("{$snort_log_dir}/barnyard2/archive/*");
+
+ /* Clean-up stats file if enabled */
+ if ($value['perform_stat'] == 'on')
+ file_put_contents("{$snort_log_dir}/{$if_real}.stats", "");
}
}
}
@@ -686,62 +662,16 @@ function snort_Getdirsize($node) {
return substr( $blah, 0, strpos($blah, 9) );
}
-/* func for log dir size limit cron */
-function snort_snortloglimit_install_cron($should_install) {
- global $config, $g;
-
- if (!is_array($config['cron']['item']))
- $config['cron']['item'] = array();
+function snort_snortloglimit_install_cron($should_install=TRUE) {
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], 'snort_check_cron_misc.inc')) {
- $is_installed = true;
- break;
- }
- $x++;
- }
-
- switch($should_install) {
- case true:
- if(!$is_installed) {
- $cron_item = array();
- $cron_item['minute'] = "*/5";
- $cron_item['hour'] = "*";
- $cron_item['mday'] = "*";
- $cron_item['month'] = "*";
- $cron_item['wday'] = "*";
- $cron_item['who'] = "root";
- $cron_item['command'] = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_cron_misc.inc";
- $config['cron']['item'][] = $cron_item;
- }
- break;
- case false:
- if($is_installed == true)
- unset($config['cron']['item'][$x]);
- break;
- }
+ install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_cron_misc.inc", $should_install, "*/5");
}
-/* func for updating cron */
function snort_rm_blocked_install_cron($should_install) {
global $config, $g;
- if (!is_array($config['cron']['item']))
- $config['cron']['item'] = array();
-
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], "snort2c")) {
- $is_installed = true;
- break;
- }
- $x++;
- }
-
$snort_rm_blocked_info_ck = $config['installedpackages']['snortglobal']['rm_blocked'];
+
if ($snort_rm_blocked_info_ck == "15m_b") {
$snort_rm_blocked_min = "*/2";
$snort_rm_blocked_hr = "*";
@@ -822,46 +752,15 @@ function snort_rm_blocked_install_cron($should_install) {
$snort_rm_blocked_wday = "*";
$snort_rm_blocked_expire = "2419200";
}
- switch($should_install) {
- case true:
- $cron_item = array();
- $cron_item['minute'] = $snort_rm_blocked_min;
- $cron_item['hour'] = $snort_rm_blocked_hr;
- $cron_item['mday'] = $snort_rm_blocked_mday;
- $cron_item['month'] = $snort_rm_blocked_month;
- $cron_item['wday'] = $snort_rm_blocked_wday;
- $cron_item['who'] = "root";
- $cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t $snort_rm_blocked_expire snort2c";
-
- /* Add cron job if not already installed, else just update the existing one */
- if (!$is_installed)
- $config['cron']['item'][] = $cron_item;
- elseif ($is_installed)
- $config['cron']['item'][$x] = $cron_item;
- break;
- case false:
- if ($is_installed == true)
- unset($config['cron']['item'][$x]);
- break;
- }
+
+ $command = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t $snort_rm_blocked_expire snort2c";
+ install_cron_job($command, $should_install, $snort_rm_blocked_min, $snort_rm_blocked_hr, $snort_rm_blocked_mday, $snort_rm_blocked_month, $snort_rm_blocked_wday, "root");
}
/* func to install snort update */
function snort_rules_up_install_cron($should_install) {
global $config, $g;
- if(!$config['cron']['item'])
- $config['cron']['item'] = array();
-
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], "snort_check_for_rule_updates.php")) {
- $is_installed = true;
- break;
- }
- $x++;
- }
$snort_rules_up_info_ck = $config['installedpackages']['snortglobal']['autorulesupdate7'];
/* See if a customized start time has been set for rule file updates */
@@ -924,28 +823,9 @@ function snort_rules_up_install_cron($should_install) {
$snort_rules_up_month = "*";
$snort_rules_up_wday = "*";
}
- switch($should_install) {
- case true:
- $cron_item = array();
- $cron_item['minute'] = $snort_rules_up_min;
- $cron_item['hour'] = $snort_rules_up_hr;
- $cron_item['mday'] = $snort_rules_up_mday;
- $cron_item['month'] = $snort_rules_up_month;
- $cron_item['wday'] = $snort_rules_up_wday;
- $cron_item['who'] = "root";
- $cron_item['command'] = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php";
-
- /* Add cron job if not already installed, else just update the existing one */
- if (!$is_installed)
- $config['cron']['item'][] = $cron_item;
- elseif ($is_installed)
- $config['cron']['item'][$x] = $cron_item;
- break;
- case false:
- if($is_installed == true)
- unset($config['cron']['item'][$x]);
- break;
- }
+
+ $command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/snort/snort_check_for_rule_updates.php";
+ install_cron_job($command, $should_install, $snort_rules_up_min, $snort_rules_up_hr, $snort_rules_up_mday, $snort_rules_up_month, $snort_rules_up_wday, "root");
}
/* Only run when all ifaces needed to sync. Expects filesystem rw */
@@ -967,14 +847,14 @@ function sync_snort_package_config() {
$snortconf = $config['installedpackages']['snortglobal']['rule'];
foreach ($snortconf as $value) {
- $if_real = snort_get_real_interface($value['interface']);
+ $if_real = get_real_interface($value['interface']);
/* create a snort.conf file for interface */
snort_generate_conf($value);
/* create barnyard2.conf file for interface */
if ($value['barnyard_enable'] == 'on')
- snort_create_barnyard2_conf($value, $if_real);
+ snort_generate_barnyard2_conf($value, $if_real);
}
/* create snort bootup file snort.sh only create once */
@@ -982,7 +862,7 @@ function sync_snort_package_config() {
$snortglob = $config['installedpackages']['snortglobal'];
- snort_snortloglimit_install_cron($snortglob['snortloglimit'] == 'on' ? true : false);
+ snort_snortloglimit_install_cron(true);
/* set the snort block hosts time IMPORTANT */
snort_rm_blocked_install_cron($snortglob['rm_blocked'] != "never_b" ? true : false);
@@ -1004,7 +884,19 @@ function snort_build_sid_msg_map($rules_path, $sid_file) {
/*************************************************************/
/* This function reads all the rules file in the passed */
/* $rules_path variable and produces a properly formatted */
- /* sid-msg.map file for use by Snort and/or barnyard2. */
+ /* sid-msg.map v2 file for use by Snort and/or barnyard2. */
+ /* */
+ /* This function produces the new v2 format sid-msg.map */
+ /* with the field layout as follows: */
+ /* */
+ /* GID || SID || REV || CLASSTYPE || PRI || MSG || REF ... */
+ /* */
+ /* On Entry: $rules_path --> array or directory of files */
+ /* or a single file containing */
+ /* the rules to read. */
+ /* $sid_file --> the complete destination path */
+ /* and filename for the output */
+ /* sid-msg.map file. */
/*************************************************************/
$sidMap = array();
@@ -1013,7 +905,7 @@ function snort_build_sid_msg_map($rules_path, $sid_file) {
/* First check if we were passed a directory, a single file */
/* or an array of filenames to read. Set our $rule_files */
/* variable accordingly. If we can't figure it out, return */
- /* and don't write a sid_msg_map file. */
+ /* and don't write a sid-msg.map file. */
if (is_string($rules_path)) {
if (is_dir($rules_path))
$rule_files = glob($rules_path . "*.rules");
@@ -1066,7 +958,11 @@ function snort_build_sid_msg_map($rules_path, $sid_file) {
$record = "";
/* Parse the rule to find sid and any references. */
+ $gid = '1'; // default to 1 for regular rules
$sid = '';
+ $rev = '';
+ $classtype = 'NOCLASS'; // required default for v2 format
+ $priority = '0'; // required default for v2 format
$msg = '';
$matches = '';
$sidEntry = '';
@@ -1074,23 +970,32 @@ function snort_build_sid_msg_map($rules_path, $sid_file) {
$msg = trim($matches[1]);
if (preg_match('/\bsid\s*:\s*(\d+)\s*;/i', $rule, $matches))
$sid = trim($matches[1]);
- if (!empty($sid) && !empty($msg)) {
- $sidEntry = $sid . ' || ' . $msg;
+ if (preg_match('/\bgid\s*:\s*(\d+)\s*;/i', $rule, $matches))
+ $gid = trim($matches[1]);
+ if (preg_match('/\brev\s*:\s*([^\;]+)/i', $rule, $matches))
+ $rev = trim($matches[1]);
+ if (preg_match('/\bclasstype\s*:\s*([^\;]+)/i', $rule, $matches))
+ $classtype = trim($matches[1]);
+ if (preg_match('/\bpriority\s*:\s*([^\;]+)/i', $rule, $matches))
+ $priority = trim($matches[1]);
+
+ if (!empty($gid) && !empty($sid) && !empty($msg)) {
+ $sidEntry = $gid . ' || ' . $sid . ' || ' . $rev . ' || ' . $classtype . ' || ';
+ $sidEntry .= $priority . ' || ' . $msg;
preg_match_all('/\breference\s*:\s*([^\;]+)/i', $rule, $matches);
foreach ($matches[1] as $ref)
$sidEntry .= " || " . trim($ref);
$sidEntry .= "\n";
- if (!is_array($sidMap[$sid]))
- $sidMap[$sid] = array();
- $sidMap[$sid] = $sidEntry;
+ $sidMap[] = $sidEntry;
}
}
}
- /* Sort the generated sid-msg map by sid */
- ksort($sidMap);
+ /* Sort the generated sid-msg map */
+ natcasesort($sidMap);
/* Now print the result to the supplied file */
- @file_put_contents($sid_file, array_values($sidMap));
+ @file_put_contents($sid_file, "#v2\n# sid-msg.map file auto-generated by Snort.\n\n");
+ @file_put_contents($sid_file, array_values($sidMap), FILE_APPEND);
}
function snort_merge_reference_configs($cfg_in, $cfg_out) {
@@ -1211,7 +1116,7 @@ function snort_load_rules_map($rules_path) {
* Read all the rules into the map array.
* The structure of the map array is:
*
- * map[gid][sid]['rule']['category']['disabled']['flowbits']
+ * map[gid][sid]['rule']['category']['disabled']['action']['flowbits']
*
* where:
* gid = Generator ID from rule, or 1 if general text
@@ -1221,6 +1126,7 @@ function snort_load_rules_map($rules_path) {
* category = File name of file containing the rule
* disabled = 1 if rule is disabled (commented out), 0 if
* rule is enabled
+ * action = alert|log|pass|drop|reject|sdrop
* flowbits = Array of applicable flowbits if rule contains
* flowbits options
***************************************************************/
@@ -1267,7 +1173,7 @@ function snort_load_rules_map($rules_path) {
/* Skip any non-rule lines unless we're in */
/* multiline mode. */
- if (!preg_match('/^\s*#*\s*(alert|drop|pass)/i', $rule) && !$b_Multiline)
+ if (!preg_match('/^\s*#*\s*(alert|log|pass|drop|reject|sdrop)/i', $rule) && !$b_Multiline)
continue;
/* Test for a multi-line rule; loop and reassemble */
@@ -1312,6 +1218,13 @@ function snort_load_rules_map($rules_path) {
else
$map_ref[$gid][$sid]['disabled'] = 0;
+ /* Grab the rule action (this is for a future option) */
+ $matches = array();
+ if (preg_match('/^\s*#*\s*(alert|log|pass|drop|reject|sdrop)/i', $rule, $matches))
+ $map_ref[$gid][$sid]['action'] = $matches[1];
+ else
+ $map_ref[$gid][$sid]['action'] = "";
+
/* Grab any associated flowbits from the rule. */
$map_ref[$gid][$sid]['flowbits'] = snort_get_flowbits($rule);
@@ -1829,9 +1742,10 @@ function snort_create_rc() {
/* after any changes to snort.conf saved in the GUI. */
/*********************************************************/
- global $config, $g;
+ global $config, $g, $pfs_version;
$snortdir = SNORTDIR;
+ $snortlogdir = SNORTLOGDIR;
$rcdir = RCFILEPREFIX;
// If no interfaces are configured for Snort, exit
@@ -1845,36 +1759,37 @@ function snort_create_rc() {
$start_snort_iface_start = array();
$start_snort_iface_stop = array();
+ // If not using PBI package, then make sure Barnyard2 can
+ // find the latest MySQL shared libs in /usr/local/lib/mysql
+ if ($pfs_version < 2.1) {
+ $sql_lib_path = "\n# Ensure MySQL shared libs are in ldconfig search path\n";
+ $sql_lib_path .= "/sbin/ldconfig -m /usr/local/lib/mysql";
+ $start_snort_iface_start[] = $sql_lib_path;
+ }
+
// Loop thru each configured interface and build
// the shell script.
foreach ($snortconf as $value) {
+ // Skip disabled Snort interfaces
+ if ($value['enable'] <> 'on')
+ continue;
$snort_uuid = $value['uuid'];
- $if_real = snort_get_real_interface($value['interface']);
+ $if_real = get_real_interface($value['interface']);
$start_barnyard = <<<EOE
if [ ! -f {$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid ]; then
- pid=`/bin/pgrep -f "barnyard2 -r {$snort_uuid} "`
+ pid=`/bin/pgrep -fn "barnyard2 -r {$snort_uuid} "`
else
pid=`/bin/pgrep -F {$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid`
fi
if [ ! -z \$pid ]; then
- /usr/bin/logger -p daemon.info -i -t SnortStartup "Barnyard2 STOP for {$value['descr']}({$snort_uuid}_{$if_real})..."
- /bin/pkill \$pid -a
- time=0 timeout=30
- while kill -0 \$pid 2>/dev/null; do
- sleep 1
- time=\$((time+1))
- if [ \$time -gt \$timeout ]; then
- break
- fi
- done
- if [ -f /var/run/barnyard2_{$if_real}{$snort_uuid}.pid ]; then
- /bin/rm /var/run/barnyard2_{$if_real}{$snort_uuid}.pid
- fi
+ /usr/bin/logger -p daemon.info -i -t SnortStartup "Barnyard2 SOFT RESTART for {$value['descr']}({$snort_uuid}_{$if_real})..."
+ /bin/pkill -HUP \$pid
+ else
+ /usr/bin/logger -p daemon.info -i -t SnortStartup "Barnyard2 START for {$value['descr']}({$snort_uuid}_{$if_real})..."
+ /usr/local/bin/barnyard2 -r {$snort_uuid} -f snort_{$snort_uuid}_{$if_real}.u2 --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q
fi
- /usr/bin/logger -p daemon.info -i -t SnortStartup "Barnyard2 START for {$value['descr']}({$snort_uuid}_{$if_real})..."
- /usr/local/bin/barnyard2 -r {$snort_uuid} -f snort_{$snort_uuid}_{$if_real}.u2 --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d /var/log/snort/snort_{$if_real}{$snort_uuid} -D -q
EOE;
$stop_barnyard2 = <<<EOE
@@ -1895,7 +1810,7 @@ EOE;
/bin/rm /var/run/barnyard2_{$if_real}{$snort_uuid}.pid
fi
else
- pid=`/bin/pgrep -f "barnyard2 -r {$snort_uuid} "`
+ pid=`/bin/pgrep -fn "barnyard2 -r {$snort_uuid} "`
if [ ! -z \$pid ]; then
/bin/pkill -f "barnyard2 -r {$snort_uuid} "
time=0 timeout=30
@@ -1910,7 +1825,7 @@ EOE;
fi
EOE;
- if ($value['barnyard_enable'] == 'on' && !empty($value['barnyard_mysql']))
+ if ($value['barnyard_enable'] == 'on')
$start_barnyard2 = $start_barnyard;
else
$start_barnyard2 = $stop_barnyard2;
@@ -1920,7 +1835,7 @@ EOE;
###### For Each Iface
# Start snort and barnyard2
if [ ! -f {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid ]; then
- pid=`/bin/pgrep -f "snort -R {$snort_uuid} "`
+ pid=`/bin/pgrep -fn "snort -R {$snort_uuid} "`
else
pid=`/bin/pgrep -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid`
fi
@@ -1930,7 +1845,7 @@ EOE;
/bin/pkill -HUP \$pid
else
/usr/bin/logger -p daemon.info -i -t SnortStartup "Snort START for {$value['descr']}({$snort_uuid}_{$if_real})..."
- /usr/local/bin/snort -R {$snort_uuid} -D -q -l /var/log/snort/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}
+ /usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}
fi
sleep 2
@@ -1956,10 +1871,10 @@ EOE;
/bin/rm /var/run/snort_{$if_real}{$snort_uuid}.pid
fi
else
- pid=`/bin/pgrep -f "snort -R {$snort_uuid} "`
+ pid=`/bin/pgrep -fn "snort -R {$snort_uuid} "`
if [ ! -z \$pid ]; then
/usr/bin/logger -p daemon.info -i -t SnortStartup "Snort STOP for {$value['descr']}({$snort_uuid}_{$if_real})..."
- /bin/pkill -f "snort -R {$snort_uuid} "
+ /bin/pkill -fn "snort -R {$snort_uuid} "
time=0 timeout=30
while kill -0 \$pid 2>/dev/null; do
sleep 1
@@ -2019,79 +1934,119 @@ EOD;
@chmod("{$rcdir}/snort.sh", 0755);
}
-/* open barnyard2.conf for writing */
-function snort_create_barnyard2_conf($snortcfg, $if_real) {
- global $config, $g;
-
- $snortdir = SNORTDIR;
- $snort_uuid = $snortcfg['uuid'];
-
- if (!file_exists("{$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf"))
- exec("/usr/bin/touch {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf");
-
- if (!file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/barnyard2/{$snort_uuid}_{$if_real}.waldo")) {
- @touch("/var/log/snort/snort_{$if_real}{$snort_uuid}/barnyard2/{$snort_uuid}_{$if_real}.waldo");
- mwexec("/bin/chmod 770 /var/log/snort/barnyard2/{$snort_uuid}_{$if_real}.waldo", true);
- }
-
- $barnyard2_conf_text = snort_generate_barnyard2_conf($snortcfg, $if_real);
+function snort_generate_barnyard2_conf($snortcfg, $if_real) {
- /* write out barnyard2_conf */
- @file_put_contents("{$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf", $barnyard2_conf_text);
-}
+ /****************************************************/
+ /* This function creates the barnyard2.conf config */
+ /* file for the passed interface when Barnyard2 is */
+ /* enabled. */
+ /****************************************************/
-/* open barnyard2.conf for writing" */
-function snort_generate_barnyard2_conf($snortcfg, $if_real) {
global $config, $g;
- $snortdir = SNORTDIR;
$snort_uuid = $snortcfg['uuid'];
+ $snortdir = SNORTDIR;
+ $snortcfgdir = SNORTDIR . "/snort_{$snort_uuid}_{$if_real}";
+ $snortlogdir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}";
+
+ // Create required directories for barnyard2 if missing
+ if (!is_dir("{$snortlogdir}/barnyard2"))
+ safe_mkdir("{$snortlogdir}/barnyard2");
+ if (!is_dir("{$snortlogdir}/barnyard2/archive"))
+ safe_mkdir("{$snortlogdir}/barnyard2/archive");
+
+ // Create the barnyard2 waldo file if missing
+ if (!file_exists("{$snortlogdir}/barnyard2/{$snort_uuid}_{$if_real}.waldo")) {
+ @touch("{$snortlogdir}/barnyard2/{$snort_uuid}_{$if_real}.waldo");
+ mwexec("/bin/chmod 770 {$snortlogdir}/barnyard2/{$snort_uuid}_{$if_real}.waldo", true);
+ }
+
+ // If there is no gen-msg.map file present, create an
+ // empty one so Barnyard2 will at least start.
+ if (!file_exists("{$snortcfgdir}/gen-msg.map"))
+ @file_put_contents("{$snortcfgdir}/gen-msg.map", "");
+
+ $snortbarnyard_hostname_info = php_uname("n");
+
+ // Set general config parameters
+ $gen_configs = "config quiet\nconfig daemon\nconfig decode_data_link\nconfig alert_with_interface_name\nconfig event_cache_size: 8192";
+ if ($snortcfg['barnyard_show_year'] == 'on')
+ $gen_configs .= "\nconfig show_year";
+ if ($snortcfg['barnyard_obfuscate_ip'] == 'on')
+ $gen_configs .= "\nconfig obfuscate";
+ if ($snortcfg['barnyard_dump_payload'] == 'on')
+ $gen_configs .= "\nconfig dump_payload";
+ if ($snortcfg['barnyard_archive_enable'] == 'on')
+ $gen_configs .= "\nconfig archivedir: {$snortlogdir}/barnyard2/archive";
+
+ // Set output plugins
+ $snortbarnyardlog_output_plugins = "";
+ if ($snortcfg['barnyard_mysql_enable'] == 'on') {
+ $by2_dbpwd = base64_decode($snortcfg['barnyard_dbpwd']);
+ $snortbarnyardlog_output_plugins .= "# database: log to a MySQL DB\noutput database: log, mysql, ";
+ if (isset($snortcfg['barnyard_sensor_name']) && strlen($snortcfg['barnyard_sensor_name']) > 0)
+ $snortbarnyardlog_output_plugins .= "sensor_name={$snortcfg['barnyard_sensor_name']}, ";
+ $snortbarnyardlog_output_plugins .= "user={$snortcfg['barnyard_dbuser']} password={$by2_dbpwd} ";
+ $snortbarnyardlog_output_plugins .= "dbname={$snortcfg['barnyard_dbname']} host={$snortcfg['barnyard_dbhost']}\n\n";
+ }
+ if ($snortcfg['barnyard_syslog_enable'] == 'on') {
+ $snortbarnyardlog_output_plugins .= "# syslog_full: log to a syslog receiver\noutput alert_syslog_full: ";
+ if (isset($snortcfg['barnyard_sensor_name']) && strlen($snortcfg['barnyard_sensor_name']) > 0)
+ $snortbarnyardlog_output_plugins .= "sensor_name {$snortcfg['barnyard_sensor_name']}, ";
+ else
+ $snortbarnyardlog_output_plugins .= "sensor_name {$snortbarnyard_hostname_info}, ";
+ if ($snortcfg['barnyard_syslog_local'] == 'on')
+ $snortbarnyardlog_output_plugins .= "local, log_facility LOG_AUTH, log_priority LOG_INFO\n\n";
+ else {
+ $snortbarnyardlog_output_plugins .= "server {$snortcfg['barnyard_syslog_rhost']}, protocol {$snortcfg['barnyard_syslog_proto']}, ";
+ $snortbarnyardlog_output_plugins .= "port {$snortcfg['barnyard_syslog_dport']}, operation_mode {$snortcfg['barnyard_syslog_opmode']}, ";
+ $snortbarnyardlog_output_plugins .= "log_facility {$snortcfg['barnyard_syslog_facility']}, log_priority {$snortcfg['barnyard_syslog_priority']}\n\n";
+ }
+ }
+ if ($snortcfg['barnyard_bro_ids_enable'] == 'on') {
+ $snortbarnyardlog_output_plugins .= "# alert_bro: log to a Bro-IDS receiver\n";
+ $snortbarnyardlog_output_plugins .= "output alert_bro: {$snortcfg['barnyard_bro_ids_rhost']}:{$snortcfg['barnyard_bro_ids_dport']}\n";
+ }
- /* TODO: add support for the other 5 output plugins */
- $snortbarnyardlog_database_info_chk = $snortcfg['barnyard_mysql'];
- $snortbarnyardlog_hostname_info_chk = php_uname("n");
- /* user add arguments */
+ // Trim leading and trailing newlines and spaces
+ $snortbarnyardlog_output_plugins = rtrim($snortbarnyardlog_output_plugins, "\n");
+
+ // User pass-through arguments
$snortbarnyardlog_config_pass_thru = str_replace("\r", "", base64_decode($snortcfg['barnconfigpassthru']));
+ // Create the conf file as a text string
$barnyard2_conf_text = <<<EOD
-# barnyard2.conf
+# barnyard2.conf
# barnyard2 can be found at http://www.securixlive.com/barnyard2/index.php
#
-# set the appropriate paths to the file(s) your Snort process is using
-
-config reference_file: {$snortdir}/snort_{$snort_uuid}_{$if_real}/reference.config
-config classification_file: {$snortdir}/snort_{$snort_uuid}_{$if_real}/classification.config
-config gen_file: {$snortdir}/snort_{$snort_uuid}_{$if_real}/gen-msg.map
-config sid_file: {$snortdir}/snort_{$snort_uuid}_{$if_real}/sid-msg.map
-config hostname: $snortbarnyardlog_hostname_info_chk
-config interface: {$if_real}
-config decode_data_link
-config waldo_file: /var/log/snort/snort_{$if_real}{$snort_uuid}/barnyard2/{$snort_uuid}_{$if_real}.waldo
-
-# Show year in timestamps
-config show_year
+## General Barnyard2 settings ##
+{$gen_configs}
+config reference_file: {$snortcfgdir}/reference.config
+config classification_file: {$snortcfgdir}/classification.config
+config sid_file: {$snortcfgdir}/sid-msg.map
+config gen_file: {$snortcfgdir}/gen-msg.map
+config hostname: {$snortbarnyard_hostname_info}
+config interface: {$if_real}
+config waldo_file: {$snortlogdir}/barnyard2/{$snort_uuid}_{$if_real}.waldo
+config logdir: {$snortlogdir}
## START user pass through ##
-
- {$snortbarnyardlog_config_pass_thru}
-
+{$snortbarnyardlog_config_pass_thru}
## END user pass through ##
-# Step 2: setup the input plugins
+## Setup input plugins ##
input unified2
-config logdir: /var/log/snort/snort_{$if_real}{$snort_uuid}
-
-# database: log to a variety of databases
-# output database: log, mysql, user=xxxx password=xxxxxx dbname=xxxx host=xxx.xxx.xxx.xxxx
-
- $snortbarnyardlog_database_info_chk
+## Setup output plugins ##
+{$snortbarnyardlog_output_plugins}
EOD;
- return $barnyard2_conf_text;
+ /* Write out barnyard2_conf text string to disk */
+ @file_put_contents("{$snortcfgdir}/barnyard2.conf", $barnyard2_conf_text);
+ unset($barnyard2_conf_text);
}
function snort_deinstall() {
@@ -2103,6 +2058,7 @@ function snort_deinstall() {
$snortlogdir = SNORTLOGDIR;
$rcdir = RCFILEPREFIX;
$snort_rules_upd_log = RULES_UPD_LOGFILE;
+ $iprep_path = IPREP_PATH;
log_error(gettext("[Snort] Snort package uninstall in progress..."));
@@ -2115,7 +2071,7 @@ function snort_deinstall() {
mwexec('/usr/bin/killall -9 snort', true);
sleep(2);
// Delete any leftover snort PID files in /var/run
- array_map('@unlink', glob("/var/run/snort_*.pid"));
+ unlink_if_exists("/var/run/snort_*.pid");
/* Make sure all active Barnyard2 processes are terminated */
/* Log a message only if a running process is detected */
@@ -2126,38 +2082,48 @@ function snort_deinstall() {
mwexec('/usr/bin/killall -9 barnyard2', true);
sleep(2);
// Delete any leftover barnyard2 PID files in /var/run
- array_map('@unlink', glob("/var/run/barnyard2_*.pid"));
+ unlink_if_exists("/var/run/barnyard2_*.pid");
/* Remove the snort user and group */
mwexec('/usr/sbin/pw userdel snort; /usr/sbin/pw groupdel snort', true);
- /* Remove snort cron entries Ugly code needs smoothness */
- if (!function_exists('snort_deinstall_cron')) {
- function snort_deinstall_cron($crontask) {
- global $config, $g;
-
- if(!is_array($config['cron']['item']))
- return;
+ /* Remove all the Snort cron jobs. */
+ install_cron_job("snort2c", false);
+ install_cron_job("snort_check_for_rule_updates.php", false);
+ install_cron_job("snort_check_cron_misc.inc", false);
+ configure_cron();
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], $crontask)) {
- $is_installed = true;
- break;
+ /* Remove our associated Dashboard widget config. If */
+ /* "save settings" is enabled, then save old widget */
+ /* container settings so we can restore them later. */
+ $widgets = $config['widgets']['sequence'];
+ if (!empty($widgets)) {
+ $widgetlist = explode(",", $widgets);
+ foreach ($widgetlist as $key => $widget) {
+ if (strstr($widget, "snort_alerts-container")) {
+ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') {
+ $config['installedpackages']['snortglobal']['dashboard_widget'] = $widget;
}
- $x++;
+ unset($widgetlist[$key]);
+ break;
}
- if ($is_installed == true)
- unset($config['cron']['item'][$x]);
}
+ $config['widgets']['sequence'] = implode(",", $widgetlist);
+ write_config();
}
- /* Remove all the Snort cron jobs. */
- snort_deinstall_cron("snort2c");
- snort_deinstall_cron("snort_check_for_rule_updates.php");
- snort_deinstall_cron("snort_check_cron_misc.inc");
- configure_cron();
+ /* See if we are to clear blocked hosts on uninstall */
+ if ($config['installedpackages']['snortglobal']['clearblocks'] == 'on') {
+ log_error(gettext("[Snort] Removing all blocked hosts from <snort2c> table..."));
+ mwexec("/sbin/pfctl -t snort2c -T flush");
+ }
+
+ /* See if we are to clear Snort log files on uninstall */
+ if ($config['installedpackages']['snortglobal']['clearlogs'] == 'on') {
+ log_error(gettext("[Snort] Clearing all Snort-related log files..."));
+ unlink_if_exists("{$snort_rules_upd_log}");
+ mwexec("/bin/rm -rf {$snortlogdir}");
+ }
/**********************************************************/
/* Test for existence of library backup tarballs in /tmp. */
@@ -2186,8 +2152,11 @@ function snort_deinstall() {
log_error(gettext("Not saving settings... all Snort configuration info and logs deleted..."));
unset($config['installedpackages']['snortglobal']);
unset($config['installedpackages']['snortsync']);
- @unlink("{$snort_rules_upd_log}");
+ unlink_if_exists("{$snort_rules_upd_log}");
+ log_error(gettext("[Snort] Flushing <snort2c> firewall table to remove addresses blocked by Snort..."));
+ mwexec("/sbin/pfctl -t snort2c -T flush");
mwexec("/bin/rm -rf {$snortlogdir}");
+ mwexec("/bin/rm -rf {$iprep_path}");
log_error(gettext("[Snort] The package has been removed from this system..."));
}
}
@@ -2220,7 +2189,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
return;
/* Log a message for rules rebuild in progress */
- log_error(gettext("[Snort] Updating rules configuration for: " . snort_get_friendly_interface($snortcfg['interface']) . " ..."));
+ log_error(gettext("[Snort] Updating rules configuration for: " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . " ..."));
/* Enable all, some or none of the SDF rules depending on setting. */
if ($snortcfg['sensitive_data'] == 'on' && $snortcfg['protect_preproc_rules'] != 'on') {
@@ -2280,6 +2249,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
$enabled_rules[$k1][$k2]['rule'] = $v['rule'];
$enabled_rules[$k1][$k2]['category'] = $v['category'];
$enabled_rules[$k1][$k2]['disabled'] = $v['disabled'];
+ $enabled_rules[$k1][$k2]['action'] = $v['action'];
$enabled_rules[$k1][$k2]['flowbits'] = $v['flowbits'];
}
}
@@ -2302,6 +2272,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
$enabled_rules[$k1][$k2]['rule'] = $p['rule'];
$enabled_rules[$k1][$k2]['category'] = $p['category'];
$enabled_rules[$k1][$k2]['disabled'] = $p['disabled'];
+ $enabled_rules[$k1][$k2]['action'] = $p['action'];
$enabled_rules[$k1][$k2]['flowbits'] = $p['flowbits'];
}
}
@@ -2314,7 +2285,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
/* Check for and disable any rules dependent upon disabled preprocessors if */
/* this option is enabled for the interface. */
if ($snortcfg['preproc_auto_rule_disable'] == "on") {
- log_error('[Snort] Checking for rules dependent on disabled preprocessors for: ' . snort_get_friendly_interface($snortcfg['interface']) . '...');
+ log_error('[Snort] Checking for rules dependent on disabled preprocessors for: ' . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . '...');
snort_filter_preproc_rules($snortcfg, $enabled_rules);
}
@@ -2323,7 +2294,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
/* If auto-flowbit resolution is enabled, generate the dependent flowbits rules file. */
if ($snortcfg['autoflowbitrules'] == 'on') {
- log_error('[Snort] Enabling any flowbit-required rules for: ' . snort_get_friendly_interface($snortcfg['interface']) . '...');
+ log_error('[Snort] Enabling any flowbit-required rules for: ' . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . '...');
$fbits = snort_resolve_flowbits($all_rules, $enabled_rules);
/* Check for and disable any flowbit-required rules the user has */
@@ -2333,7 +2304,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
/* Check for and disable any flowbit-required rules dependent upon */
/* disabled preprocessors if this option is enabled for the interface. */
if ($snortcfg['preproc_auto_rule_disable'] == "on") {
- log_error('[Snort] Checking flowbit rules dependent on disabled preprocessors for: ' . snort_get_friendly_interface($snortcfg['interface']) . '...');
+ log_error('[Snort] Checking flowbit rules dependent on disabled preprocessors for: ' . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . '...');
snort_filter_preproc_rules($snortcfg, $fbits, true);
}
snort_write_flowbit_rules_file($fbits, "{$snortcfgdir}/rules/{$flowbit_rules_file}");
@@ -2356,11 +2327,11 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) {
/* Log a warning if the interface has no rules defined or enabled */
if ($no_rules_defined)
- log_error(gettext("[Snort] Warning - no text rules or IPS-Policy selected for: " . snort_get_friendly_interface($snortcfg['interface']) . " ..."));
+ log_error(gettext("[Snort] Warning - no text rules or IPS-Policy selected for: " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . " ..."));
/* Build a new sid-msg.map file from the enabled */
/* rules and copy it to the interface directory. */
- log_error(gettext("[Snort] Building new sig-msg.map file for " . snort_get_friendly_interface($snortcfg['interface']) . "..."));
+ log_error(gettext("[Snort] Building new sig-msg.map file for " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . "..."));
snort_build_sid_msg_map("{$snortcfgdir}/rules/", "{$snortcfgdir}/sid-msg.map");
}
@@ -2485,7 +2456,7 @@ function snort_filter_preproc_rules($snortcfg, &$active_rules, $persist_log = fa
/* when flowbit-required rules are being assessed after the */
/* primary enforcing rules have been evaluated. */
/***************************************************************/
- $iface = snort_get_friendly_interface($snortcfg['interface']);
+ $iface = convert_friendly_interface_to_friendly_descr($snortcfg['interface']);
$file = "{$snortlogdir}/{$iface}_disabled_preproc_rules.log";
if ($persist_log)
$fp = fopen($file, 'a');
@@ -2551,7 +2522,7 @@ function snort_generate_conf($snortcfg) {
else
$protect_preproc_rules = "off";
- $if_real = snort_get_real_interface($snortcfg['interface']);
+ $if_real = get_real_interface($snortcfg['interface']);
$snort_uuid = $snortcfg['uuid'];
$snortcfgdir = "{$snortdir}/snort_{$snort_uuid}_{$if_real}";
@@ -2611,8 +2582,18 @@ function snort_generate_conf($snortcfg) {
/* define snortunifiedlog */
$snortunifiedlog_type = "";
- if ($snortcfg['snortunifiedlog'] == "on")
- $snortunifiedlog_type = "output unified2: filename snort_{$snort_uuid}_{$if_real}.u2, limit 128";
+ if ($snortcfg['barnyard_enable'] == "on") {
+ if (isset($snortcfg['unified2_log_limit']))
+ $u2_log_limit = "limit {$snortcfg['unified2_log_limit']}";
+ else
+ $u2_log_limit = "limit 128";
+
+ $snortunifiedlog_type = "output unified2: filename snort_{$snort_uuid}_{$if_real}.u2, {$u2_log_limit}";
+ if ($snortcfg['barnyard_log_vlan_events'] == 'on')
+ $snortunifiedlog_type .= ", vlan_event_types";
+ if ($snortcfg['barnyard_log_mpls_events'] == 'on')
+ $snortunifiedlog_type .= ", mpls_event_types";
+ }
/* define spoink */
$spoink_type = "";
@@ -2621,7 +2602,7 @@ function snort_generate_conf($snortcfg) {
if ($snortcfg['blockoffenderskill'] == "on")
$pfkill = "kill";
$spoink_wlist = snort_build_list($snortcfg, $snortcfg['whitelistname'], true);
- /* write whitelist */
+ /* write Pass List */
@file_put_contents("{$snortcfgdir}/{$snortcfg['whitelistname']}", implode("\n", $spoink_wlist));
$spoink_type = "output alert_pf: {$snortcfgdir}/{$snortcfg['whitelistname']},snort2c,{$snortcfg['blockoffendersip']},{$pfkill}";
}
@@ -3170,6 +3151,49 @@ preprocessor sensitive_data: \
EOD;
+ /* define IP Reputation preprocessor */
+ if (is_array($snortcfg['blist_files']['item'])) {
+ $blist_files = "";
+ $bIsFirst = TRUE;
+ foreach ($snortcfg['blist_files']['item'] as $blist) {
+ if ($bIsFirst) {
+ $blist_files .= "blacklist " . IPREP_PATH . $blist;
+ $bIsFirst = FALSE;
+ }
+ else
+ $blist_files .= ", \\ \n\tblacklist " . IPREP_PATH . $blist;
+ }
+ }
+ if (is_array($snortcfg['wlist_files']['item'])) {
+ $wlist_files = "";
+ $bIsFirst = TRUE;
+ foreach ($snortcfg['wlist_files']['item'] as $wlist) {
+ if ($bIsFirst) {
+ $wlist_files .= "whitelist " . IPREP_PATH . $wlist;
+ $bIsFirst = FALSE;
+ }
+ else
+ $wlist_files .= ", \\ \n\twhitelist " . IPREP_PATH . $wlist;
+ }
+ }
+ if (!empty($blist_files))
+ $ip_lists = $blist_files;
+ if (!empty($wlist_files))
+ $ip_lists .= ", \\ \n" . $wlist_files;
+ if ($snortcfg['iprep_scan_local'] == 'on')
+ $ip_lists .= ", \\ \n\tscan_local";
+
+ $reputation_preproc = <<<EOD
+# IP Reputation preprocessor #
+preprocessor reputation: \
+ memcap {$snortcfg['iprep_memcap']}, \
+ priority {$snortcfg['iprep_priority']}, \
+ nested_ip {$snortcfg['iprep_nested_ip']}, \
+ white {$snortcfg['iprep_white']}, \
+ {$ip_lists}
+
+EOD;
+
/* define servers as IP variables */
$snort_servers = array (
"dns_servers" => "\$HOME_NET", "smtp_servers" => "\$HOME_NET", "http_servers" => "\$HOME_NET",
@@ -3200,11 +3224,11 @@ EOD;
"ssl_preproc" => "ssl_preproc", "dnp3_preproc" => "dnp3_preproc", "modbus_preproc" => "modbus_preproc"
);
$snort_preproc = array (
- "perform_stat", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor", "ssl_preproc", "sip_preproc", "gtp_preproc", "ssh_preproc",
- "sf_portscan", "dce_rpc_2", "dns_preprocessor", "sensitive_data", "pop_preproc", "imap_preproc", "dnp3_preproc", "modbus_preproc"
+ "perform_stat", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor", "ssl_preproc", "sip_preproc", "gtp_preproc", "ssh_preproc", "sf_portscan",
+ "dce_rpc_2", "dns_preprocessor", "sensitive_data", "pop_preproc", "imap_preproc", "dnp3_preproc", "modbus_preproc", "reputation_preproc"
);
$default_disabled_preprocs = array(
- "sf_portscan", "gtp_preproc", "sensitive_data", "dnp3_preproc", "modbus_preproc"
+ "sf_portscan", "gtp_preproc", "sensitive_data", "dnp3_preproc", "modbus_preproc", "reputation_preproc", "perform_stat"
);
$snort_preprocessors = "";
foreach ($snort_preproc as $preproc) {
@@ -3754,14 +3778,7 @@ output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,src
EOD;
// Write out snort.conf file
- $conf = fopen("{$snortcfgdir}/snort.conf", "w");
- if(!$conf) {
- log_error("Could not open {$snortcfgdir}/snort.conf for writing.");
- conf_mount_ro();
- return -1;
- }
- fwrite($conf, $snort_conf_text);
- fclose($conf);
+ file_put_contents("{$snortcfgdir}/snort.conf", $snort_conf_text);
conf_mount_ro();
unset($snort_conf_text, $selected_rules_sections, $suppress_file_name, $snort_misc_include_rules, $spoink_type, $snortunifiedlog_type, $alertsystemlog_type);
unset($home_net, $external_net, $ipvardef, $portvardef);