diff options
| author | Marcello Coutinho <marcellocoutinho@gmail.com> | 2013-11-22 01:35:55 -0200 |
|---|---|---|
| committer | Marcello Coutinho <marcellocoutinho@gmail.com> | 2013-11-22 01:35:55 -0200 |
| commit | 0d7e8e94c0854145806e91e7ff82015bb1c30330 (patch) | |
| tree | 8294717c11c18a6b6c70188f0dfd88632365bf8b /config/snort/snort.inc | |
| parent | 595c831d2768547d49e6daf147889c6aee15f9a4 (diff) | |
| download | pfsense-packages-0d7e8e94c0854145806e91e7ff82015bb1c30330.tar.gz pfsense-packages-0d7e8e94c0854145806e91e7ff82015bb1c30330.tar.bz2 pfsense-packages-0d7e8e94c0854145806e91e7ff82015bb1c30330.zip | |
snort - add multi select combo option for sensitive data preprocessor
Diffstat (limited to 'config/snort/snort.inc')
| -rwxr-xr-x | config/snort/snort.inc | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index 1a6f1ac6..0573d5f4 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -3204,8 +3204,18 @@ EOD; if (is_dir("{$snortcfgdir}/preproc_rules")) { if ($snortcfg['sensitive_data'] == 'on' && $protect_preproc_rules == "off") { $sedcmd = '/^#alert.*classtype:sdf/s/^#//'; - if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")) + if (file_exists("{$snortcfgdir}/preproc_rules/sensitive-data.rules")){ $snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/sensitive-data.rules\n"; + #enable only selected sensitive data + if (file_exists(SNORTDIR."/preproc_rules/sensitive-data.rules")){ + $sdf_alert_pattern="(".preg_replace("/,/","|",$snortcfg['sdf_alert_data_type']).")"; + $sd_tmp_file=file(SNORTDIR."/preproc_rules/sensitive-data.rules"); + $sd_tmp_new_file=""; + foreach ($sd_tmp_file as $sd_tmp_line) + $sd_tmp_new_file.=preg_match("/$sdf_alert_pattern/i",$sd_tmp_line) ? $sd_tmp_line : ""; + file_put_contents("{$snortcfgdir}/preproc_rules/sensitive-data.rules",$sd_tmp_new_file,LOCK_EX); + } + } } else $sedcmd = '/^alert.*classtype:sdf/s/^/#/'; if (file_exists("{$snortcfgdir}/preproc_rules/decoder.rules") && |