aboutsummaryrefslogtreecommitdiffstats
path: root/config/snort
diff options
context:
space:
mode:
authorjim-p <jim@pingle.org>2009-10-11 23:29:47 -0400
committerjim-p <jim@pingle.org>2009-10-11 23:29:47 -0400
commit489dbb60f1083cbd5b5d55b281ccb170b1515b55 (patch)
tree35d756a9113398fa0fe8b778222978249558a08f /config/snort
parent05cab845de13d8dbf482179af4e65780729a5d4a (diff)
downloadpfsense-packages-489dbb60f1083cbd5b5d55b281ccb170b1515b55.tar.gz
pfsense-packages-489dbb60f1083cbd5b5d55b281ccb170b1515b55.tar.bz2
pfsense-packages-489dbb60f1083cbd5b5d55b281ccb170b1515b55.zip
Add rw/ro calls to snort. May fix issues on nano
Diffstat (limited to 'config/snort')
-rwxr-xr-xconfig/snort/snort.inc18
-rw-r--r--config/snort/snort_alerts.php2
-rw-r--r--config/snort/snort_check_for_rule_updates.php11
-rw-r--r--config/snort/snort_download_rules.php16
-rw-r--r--config/snort/snort_rules.php8
-rw-r--r--config/snort/snort_rulesets.php5
6 files changed, 46 insertions, 14 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index 575192b9..3eabcc0e 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -56,6 +56,7 @@ function sync_package_snort_reinstall()
function sync_package_snort()
{
global $config, $g;
+ conf_mount_rw();
mwexec("mkdir -p /var/log/snort/");
@@ -73,7 +74,6 @@ function sync_package_snort()
else
$snort_performance = "ac-bnfa";
- conf_mount_rw();
/* create a few directories and ensure the sample files are in place */
exec("/bin/mkdir -p /usr/local/etc/snort");
exec("/bin/mkdir -p /var/log/snort");
@@ -195,6 +195,7 @@ if ($config['installedpackages']['snort']['config'][0]['autorulesupdate7'] != ""
function create_barnyard2_conf() {
global $bconfig, $bg;
/* write out barnyard2_conf */
+ conf_mount_rw();
$barnyard2_conf_text = generate_barnyard2_conf();
$bconf = fopen("/usr/local/etc/barnyard2.conf", "w");
if(!$bconf) {
@@ -203,6 +204,7 @@ function create_barnyard2_conf() {
}
fwrite($bconf, $barnyard2_conf_text);
fclose($bconf);
+ conf_mount_ro();
}
/* open barnyard2.conf for writing" */
function generate_barnyard2_conf() {
@@ -265,7 +267,7 @@ input unified2
$snortbarnyardlog_database_info_chk
EOD;
-
+ conf_mount_rw();
return $barnyard2_conf_text;
}
@@ -679,7 +681,7 @@ else
if ($snort_rm_blocked_info_ck != "") {
function snort_rm_blocked_install_cron($should_install) {
global $config, $g;
-
+ conf_mount_rw();
if ($g['booting']==true)
return;
@@ -774,6 +776,7 @@ function snort_rm_blocked_install_cron($should_install) {
$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/sbin/expiretable -t $snort_rm_blocked_expire snort2c";
$config['cron']['item'][] = $cron_item;
write_config("Installed 15 minute filter reload for Time Based Rules");
+ conf_mount_rw();
configure_cron();
}
break;
@@ -782,6 +785,7 @@ function snort_rm_blocked_install_cron($should_install) {
if($x > 0) {
unset($config['cron']['item'][$x]);
write_config();
+ conf_mount_rw();
}
configure_cron();
}
@@ -802,7 +806,7 @@ function snort_rm_blocked_install_cron($should_install) {
if ($snort_rules_up_info_ck != "") {
function snort_rules_up_install_cron($should_install) {
global $config, $g;
-
+ conf_mount_rw();
if ($g['booting']==true)
return;
@@ -875,6 +879,7 @@ function snort_rules_up_install_cron($should_install) {
$cron_item['command'] = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort_check_for_rule_updates.php >> /usr/local/etc/snort_bkup/snort_update.log";
$config['cron']['item'][] = $cron_item;
write_config("Installed 15 minute filter reload for Time Based Rules");
+ conf_mount_rw();
configure_cron();
}
break;
@@ -883,6 +888,7 @@ function snort_rules_up_install_cron($should_install) {
if($x > 0) {
unset($config['cron']['item'][$x]);
write_config();
+ conf_mount_rw();
}
configure_cron();
}
@@ -1400,7 +1406,7 @@ include /usr/local/etc/snort/threshold.conf
{$selected_rules_sections}
EOD;
-
+ conf_mount_ro();
return $snort_conf_text;
}
@@ -1467,6 +1473,7 @@ function verify_downloaded_file($filename) {
/* extract rules */
function extract_snort_rules_md5($tmpfname) {
global $snort_filename, $snort_filename_md5, $console_mode;
+ conf_mount_rw();
ob_flush();
if(!$console_mode) {
$static_output = gettext("Extracting snort rules...");
@@ -1489,6 +1496,7 @@ function extract_snort_rules_md5($tmpfname) {
log_error("Snort rules extracted.");
echo "Snort rules extracted.";
}
+ conf_mount_ro();
}
/* verify MD5 against downloaded item */
diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php
index f463c0b9..e67b9b5f 100644
--- a/config/snort/snort_alerts.php
+++ b/config/snort/snort_alerts.php
@@ -42,7 +42,9 @@ if (!$nentries)
if ($_POST['clear']) {
exec("killall syslogd");
+ conf_mount_rw();
exec("rm {$snort_logfile}; touch {$snort_logfile}");
+ conf_mount_ro();
system_syslogd_start();
exec("/usr/bin/killall -HUP snort");
exec("/usr/bin/killall snort2c");
diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php
index 95adbaa6..17f56081 100644
--- a/config/snort/snort_check_for_rule_updates.php
+++ b/config/snort/snort_check_for_rule_updates.php
@@ -73,7 +73,8 @@ if(!$oinkid) {
/* premium_subscriber check */
//unset($config['installedpackages']['snort']['config'][0]['subscriber']);
-//write_config();
+//write_config(); // Will cause switch back to read-only on nanobsd
+//conf_mount_rw(); // Uncomment this if the previous line is uncommented
$premium_subscriber_chk = $config['installedpackages']['snort']['config'][0]['subscriber'];
if ($premium_subscriber_chk === on) {
@@ -92,6 +93,7 @@ if ($premium_url_chk === on) {
/* send current buffer */
ob_flush();
+conf_mount_rw();
/* remove old $tmpfname files */
if (file_exists("{$tmpfname}")) {
exec("/bin/rm -r {$tmpfname}");
@@ -177,7 +179,8 @@ $md5_check_old_parse = file_get_contents("{$snortdir}/{$snort_filename_md5}");
$md5_check_old = `/bin/echo "{$md5_check_old_parse}" | /usr/bin/awk '{ print $1 }'`;
/* Write out time of last sucsessful md5 to cache */
$config['installedpackages']['snort']['last_md5_download'] = date("Y-M-jS-h:i-A");
-write_config();
+write_config(); // Will cause switch back to read-only on nanobsd
+conf_mount_rw();
if ($md5_check_new == $md5_check_old) {
echo "Your rules are up to date...\n";
echo "You may start Snort now, check update.\n";
@@ -195,7 +198,8 @@ $emerg_md5_check_old_parse = file_get_contents("{$snortdir}/version.txt");
$emerg_md5_check_old = `/bin/echo "{$emerg_md5_check_old_parse}" | /usr/bin/awk '{ print $1 }'`;
/* Write out time of last sucsessful md5 to cache */
$config['installedpackages']['snort']['last_md5_download'] = date("Y-M-jS-h:i-A");
-write_config();
+write_config(); // Will cause switch back to read-only on nanobsd
+conf_mount_rw();
if ($emerg_md5_check_new == $emerg_md5_check_old) {
echo "Your emergingthreats rules are up to date...\n";
echo "You may start Snort now, check update.\n";
@@ -625,5 +629,6 @@ if (file_exists("/tmp/snort_download_halt.pid")) {
echo "The Rules update finished...\n";
echo "You may start snort now...\n";
}
+conf_mount_ro();
?>
diff --git a/config/snort/snort_download_rules.php b/config/snort/snort_download_rules.php
index 133f2d2a..6cb2f808 100644
--- a/config/snort/snort_download_rules.php
+++ b/config/snort/snort_download_rules.php
@@ -140,7 +140,9 @@ if(!$oinkid) {
/* premium_subscriber check */
//unset($config['installedpackages']['snort']['config'][0]['subscriber']);
-//write_config();
+//write_config(); // Will cause switch back to read-only on nanobsd
+//conf_mount_rw(); // Uncomment this if the previous line is uncommented
+
$premium_subscriber_chk = $config['installedpackages']['snort']['config'][0]['subscriber'];
if ($premium_subscriber_chk === on) {
@@ -187,6 +189,8 @@ if (file_exists($tmpfname)) {
/* unhide progress bar and lets end this party */
unhide_progress_bar_status();
+conf_mount_rw();
+
/* download md5 sig from snort.org */
if (file_exists("{$tmpfname}/{$snort_filename_md5}")) {
update_status(gettext("md5 temp file exists..."));
@@ -266,7 +270,8 @@ $md5_check_old_parse = file_get_contents("{$snortdir}/{$snort_filename_md5}");
$md5_check_old = `/bin/echo "{$md5_check_old_parse}" | /usr/bin/awk '{ print $1 }'`;
/* Write out time of last sucsessful md5 to cache */
$config['installedpackages']['snort']['last_md5_download'] = date("Y-M-jS-h:i-A");
-write_config();
+write_config(); // Will cause switch back to read-only on nanobsd
+conf_mount_rw();
if ($md5_check_new == $md5_check_old) {
update_status(gettext("Your rules are up to date..."));
update_output_window(gettext("You may start Snort now, check update."));
@@ -290,7 +295,8 @@ $emerg_md5_check_old_parse = file_get_contents("{$snortdir}/version.txt");
$emerg_md5_check_old = `/bin/echo "{$emerg_md5_check_old_parse}" | /usr/bin/awk '{ print $1 }'`;
/* Write out time of last sucsessful md5 to cache */
$config['installedpackages']['snort']['last_md5_download'] = date("Y-M-jS-h:i-A");
-write_config();
+write_config(); // Will cause switch back to read-only on nanobsd
+conf_mount_rw();
if ($emerg_md5_check_new == $emerg_md5_check_old) {
update_status(gettext("Your emergingthreats rules are up to date..."));
update_output_window(gettext("You may start Snort now, check update."));
@@ -747,7 +753,7 @@ if (file_exists("/tmp/snort_download_halt.pid")) {
/* hide progress bar and lets end this party */
hide_progress_bar_status();
-
+conf_mount_ro();
?>
<?php
@@ -772,7 +778,9 @@ function read_body_firmware($ch, $string) {
flush();
$counter = 0;
}
+ conf_mount_rw();
fwrite($fout, $string);
+ conf_mount_ro();
return $length;
}
diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php
index 233841b1..94c99f0e 100644
--- a/config/snort/snort_rules.php
+++ b/config/snort/snort_rules.php
@@ -29,8 +29,11 @@
require("guiconfig.inc");
require("config.inc");
-if(!is_dir("/usr/local/etc/snort/rules"))
+if(!is_dir("/usr/local/etc/snort/rules")) {
+ conf_mount_rw();
exec('mkdir /usr/local/etc/snort/rules/');
+ conf_mount_ro();
+}
/* Check if the rules dir is empy if so warn the user */
/* TODO give the user the option to delete the installed rules rules */
@@ -102,6 +105,8 @@ function get_middle($source, $beginning, $ending, $init_pos) {
function write_rule_file($content_changed, $received_file)
{
+ conf_mount_rw();
+
//read snort file with writing enabled
$filehandle = fopen($received_file, "w");
@@ -117,6 +122,7 @@ function write_rule_file($content_changed, $received_file)
//close file handle
fclose($filehandle);
+ conf_mount_rw();
}
function load_rule_file($incoming_file)
diff --git a/config/snort/snort_rulesets.php b/config/snort/snort_rulesets.php
index 8e5179d6..d839ae7a 100644
--- a/config/snort/snort_rulesets.php
+++ b/config/snort/snort_rulesets.php
@@ -31,8 +31,11 @@ require("guiconfig.inc");
require_once("service-utils.inc");
require("/usr/local/pkg/snort.inc");
-if(!is_dir("/usr/local/etc/snort/rules"))
+if(!is_dir("/usr/local/etc/snort/rules")) {
+ conf_mount_rw();
exec('mkdir /usr/local/etc/snort/rules/');
+ conf_mount_ro();
+}
/* Check if the rules dir is empy if so warn the user */
/* TODO give the user the option to delete the installed rules rules */