added shared object rules from private companies, improved rule extraction, fix and old snort double start error

3 files changed, 81 insertions, 20 deletions

diff --git a/config/snort/snort.xml b/config/snort/snort.xml
index e9a8c87d..14165e62 100644
--- a/config/snort/snort.xml
+++ b/config/snort/snort.xml
@@ -46,8 +46,8 @@
     <requirements>Describe your package requirements here</requirements>
     <faq>Currently there are no FAQ items provided.</faq>
 	<name>Snort</name>
-	<version>2.8.4</version>
-	<title>Services: Snort</title>
+	<version>2.8.4.1</version>
+	<title>Services: Snort 2.8.4.1 pkg v. 1.0</title>
 	<include_file>/usr/local/pkg/snort.inc</include_file>
 	<menu>
 		<name>Snort</name>
@@ -258,9 +258,14 @@
 			<description>Checking this option will automatically sync the snort configuration via XMLRPC to CARP cluster members.</description>
 			<type>checkbox</type>
 		</field>
+		<field>
+			<fielddescr>Snort signature info files.</fielddescr>
+			<fieldname>signatureinfo</fieldname>
+			<description>15,000 snort alert info summary files. At leats a 1GHz system requierment</description>
+			<type>checkbox</type>
+		</field>
     </fields>
 	<custom_add_php_command>
-        sync_package_snort();
 	</custom_add_php_command>
 	<custom_php_resync_config_command>
 		sync_package_snort();
diff --git a/config/snort/snort_download_rules.php b/config/snort/snort_download_rules.php
index 78bbf232..e508252e 100644
--- a/config/snort/snort_download_rules.php
+++ b/config/snort/snort_download_rules.php
@@ -180,8 +180,8 @@ if (file_exists("{$tmpfname}/{$snort_filename_md5}")) {
 } else {
     update_status(gettext("Downloading md5 file..."));
     ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)');
-    $image = @file_get_contents("http://dl.snort.org/{$premium_url}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz.md5?oink_code={$oinkid}");
-//    $image = @file_get_contents("http://www.mtest.local/pub-bin/oinkmaster.cgi/{$oinkid}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz.md5");
+//    $image = @file_get_contents("http://dl.snort.org/{$premium_url}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz.md5?oink_code={$oinkid}");
+    $image = @file_get_contents("http://www.mtest.local/pub-bin/oinkmaster.cgi/{$oinkid}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz.md5");
     $f = fopen("{$tmpfname}/snortrules-snapshot-2.8.tar.gz.md5", 'w');
     fwrite($f, $image);
     fclose($f);
@@ -235,8 +235,8 @@ if (file_exists("{$tmpfname}/{$snort_filename}")) {
 } else {
     update_status(gettext("There is a new set of Snort rules posted. Downloading..."));
     update_output_window(gettext("May take 4 to 10 min..."));
-//    download_file_with_progress_bar("http://www.mtest.local/pub-bin/oinkmaster.cgi/{$oinkid}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz", $tmpfname . "/{$snort_filename}", "read_body_firmware");
-    download_file_with_progress_bar("http://dl.snort.org/{$premium_url}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz?oink_code={$oinkid}", $tmpfname . "/{$snort_filename}", "read_body_firmware");
+    download_file_with_progress_bar("http://www.mtest.local/pub-bin/oinkmaster.cgi/{$oinkid}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz", $tmpfname . "/{$snort_filename}", "read_body_firmware");
+//    download_file_with_progress_bar("http://dl.snort.org/{$premium_url}/snortrules-snapshot-2.8{$premium_subscriber}.tar.gz?oink_code={$oinkid}", $tmpfname . "/{$snort_filename}", "read_body_firmware");
     update_all_status($static_output);
     update_status(gettext("Done downloading rules file."));
 }
@@ -270,27 +270,53 @@ $file_md5_ondisk2 = `/sbin/md5 {$tmpfname}/{$snort_filename} | /usr/bin/awk '{ p
     }
 }
 
-/* Untar snort rules file */
+/* Untar snort rules file individually to help people with low system specs */
 if (file_exists("{$tmpfname}/$snort_filename")) {
     update_status(gettext("Extracting rules..."));
     update_output_window(gettext("May take a while..."));
-    exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname}");
-    update_status(gettext("Done extracting."));
+    exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} etc/");
+	exec("`/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/precompiled/FreeBSD-7.0/i386/2.8.4/*`");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/bad-traffic.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/chat.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/dos.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/exploit.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/imap.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/misc.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/multimedia.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/netbios.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/nntp.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/p2p.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/smtp.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/sql.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/web-client.rules/");
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} so_rules/web-misc.rules/");
+    update_status(gettext("Done extracting Rules."));
 } else {
     update_status(gettext("The Download rules file missing..."));
     update_output_window(gettext("Error rules extracting failed..."));
     exit(0);
 }
 
+$signature_info_chk = $config['installedpackages']['snort']['config'][0]['signatureinfo'];
+if ($premium_url_chk == on) {
+	update_status(gettext("Extracting Signatures..."));
+	update_output_window(gettext("May take a while..."));
+	exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$tmpfname} doc/signatures/");
+	update_status(gettext("Done extracting Signatures."));
+}
 
-/*  Making Snort Directory */
+/*  Making Cleaning Snort Directory */
 if (file_exists("{$snortdir}")) {
-    update_status(gettext("Directory rules exists..."));
-    update_output_window(gettext("Directory rules exists..."));
+    update_status(gettext("Cleaning the snort Directory..."));
+    update_output_window(gettext("removing..."));
+	exec("/bin/rm -r {$snortdir}/*");
+    exec("/bin/rm -r /usr/local/lib/snort/dynamicrules/*");
 } else {
     update_status(gettext("Making Snort Directory..."));
     update_output_window(gettext("should be fast..."));
     exec("/bin/mkdir {$snortdir}");
+	exec("/bin/rm -r /usr/local/lib/snort/dynamicrules/*");
     update_status(gettext("Done making snort direcory."));
 }
 
@@ -298,13 +324,13 @@ if (file_exists("{$snortdir}")) {
 if (file_exists("{$tmpfname}/rules")) {
     update_status(gettext("Copying rules..."));
     update_output_window(gettext("May take a while..."));
-    exec("/bin/cp -r {$tmpfname}/rules {$snortdir}/rules");
+    exec("/bin/mv -f {$tmpfname}/rules {$snortdir}/rules");
     update_status(gettext("Done copping rules."));
     /* Write out time of last sucsessful rule install catch */
     $config['installedpackages']['snort']['last_rules_install'] = date("Y-M-jS-h:i-A");
     write_config();
 } else {
-    update_status(gettext("Directory rules exists..."));
+    update_status(gettext("Directory rules does not exists..."));
     update_output_window(gettext("Error copping rules direcory..."));
     exit(0);
 }
@@ -314,7 +340,7 @@ if (file_exists("{$tmpfname}/$snort_filename_md5")) {
     update_status(gettext("Copying md5 sig to snort directory..."));
     exec("/bin/cp {$tmpfname}/$snort_filename_md5 {$snortdir}/$snort_filename_md5");
 } else {
-    update_status(gettext("The md5 file exists..."));
+    update_status(gettext("The md5 file does not exist..."));
     update_output_window(gettext("Error copping config..."));
     exit(0);
 }
@@ -324,23 +350,53 @@ if (file_exists("{$tmpfname}/etc/Makefile.am")) {
     update_status(gettext("Copying configs to snort directory..."));
     exec("/bin/cp {$tmpfname}/etc/* {$snortdir}");
 } else {
-    update_status(gettext("The snort configs exists..."));
+    update_status(gettext("The snort configs does not exist..."));
     update_output_window(gettext("Error copping config..."));
     exit(0);
 }
 
 /*  Copy signatures dir to snort dir */
+$signature_info_chk = $config['installedpackages']['snort']['config'][0]['signatureinfo'];
+if ($premium_url_chk == on) {
 if (file_exists("{$tmpfname}/doc/signatures")) {
     update_status(gettext("Copying signatures..."));
     update_output_window(gettext("May take a while..."));
-    exec("/bin/cp -r {$tmpfname}/doc/signatures {$snortdir}/signatures");
+    exec("/bin/mv -f {$tmpfname}/doc/signatures {$snortdir}/signatures");
     update_status(gettext("Done copying signatures."));
 } else {
-    update_status(gettext("Directory signatures exists..."));
+    update_status(gettext("Directory signatures exist..."));
     update_output_window(gettext("Error copping signature..."));
     exit(0);
+  }
+}
+
+/*  Copy so_rules dir to snort lib dir */
+if (file_exists("{$tmpfname}/so_rules/precompiled/FreeBSD-7.0/i386/2.8.4/")) {
+    update_status(gettext("Copying so_rules..."));
+    update_output_window(gettext("May take a while..."));
+    exec("`/bin/cp -f {$tmpfname}/so_rules/precompiled/FreeBSD-7.0/i386/2.8.4/* /usr/local/lib/snort/dynamicrules/`");
+	exec("/bin/cp {$tmpfname}/so_rules/bad-traffic.rules {$snortdir}/rules/bad-traffic.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/chat.rules {$snortdir}/rules/chat.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/dos.rules {$snortdir}/rules/dos.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/exploit.rules {$snortdir}/rules/exploit.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/imap.rules {$snortdir}/rules/imap.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/misc.rules {$snortdir}/rules/misc.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/multimedia.rules {$snortdir}/rules/multimedia.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/netbios.rules {$snortdir}/rules/netbios.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/nntp.rules {$snortdir}/rules/nntp.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/p2p.rules {$snortdir}/rules/p2p.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/smtp.rules {$snortdir}/rules/smtp.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/sql.rules {$snortdir}/rules/sql.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/web-client.rules {$snortdir}/rules/web-client.so.rules");
+	exec("/bin/cp {$tmpfname}/so_rules/web.misc.rules {$snortdir}/rules/web.misc.so.rules");
+    update_status(gettext("Done copying so_rules."));
+} else {
+    update_status(gettext("Directory so_rules does not exist..."));
+    update_output_window(gettext("Error copping so_rules..."));
+    exit(0);
 }
 
+
 /* php code finish */
 update_status(gettext("Rules update finished..."));
 update_output_window(gettext("You may start Snort now finnal."));
diff --git a/config/snort/snort_rulesets.php b/config/snort/snort_rulesets.php
index 3d2e9ab4..527dc712 100644
--- a/config/snort/snort_rulesets.php
+++ b/config/snort/snort_rulesets.php
@@ -99,7 +99,7 @@ if(!$pgtitle_output)
 						<table id="sortabletable1" class="sortable" width="100%" border="0" cellpadding="0" cellspacing="0">
 						    <tr id="frheader">
 								<td width="5%" class="listhdrr">Enabled</td>
-								<td class="listhdrr">Ruleset</td>
+								<td class="listhdrr">Ruleset: Rules that end with "so.rules" are shared object rules.</td>
 								<!-- <td class="listhdrr">Description</td> -->
 							</tr>
 <?php