Fix rule saving and modification for snort

author: Ermal <eri@pfsense.org> 2011-09-02 11:14:40 +0000
committer: Ermal <eri@pfsense.org> 2011-09-02 11:17:50 +0000
commit: c35f5d138b4c1eba327517582c7de3b409e68e6b (patch)
tree: 9029470fc4ed439bb174921c86ef4952cc8d0f57 /config/snort
parent: bc6f12a877cfd593ceddcf1f51d11b0f898eb2d7 (diff)
download: pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.tar.gz
pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.tar.bz2
pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.zip
2 files changed, 193 insertions, 315 deletions
diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php
index 75233529..c9112945 100644
--- a/config/snort/snort_rules.php
+++ b/config/snort/snort_rules.php
@@ -139,56 +139,18 @@ function get_middle($source, $beginning, $ending, $init_pos) {
 
 function write_rule_file($content_changed, $received_file)
 {
-	//read snort file with writing enabled
-	$filehandle = fopen($received_file, "w");
-
-	//delimiter for each new rule is a new line
-	$delimiter = "\n";
-
-	//implode the array back into a string for writing purposes
-	$fullfile = implode($delimiter, $content_changed);
-
-	//write data to file
-	fwrite($filehandle, $fullfile);
-
-	//close file handle
-	fclose($filehandle);
-
+	@file_put_contents($received_file, implode("\n", $content_changed));
 }
 
 function load_rule_file($incoming_file)
 {
-
-	//read snort file
-	$filehandle = fopen($incoming_file, "r");
-
 	//read file into string, and get filesize
-	$contents = fread($filehandle, filesize($incoming_file));
-
-	//close handler
-	fclose ($filehandle);
-
-
-	//string for populating category select
-	$currentruleset = basename($rulefile);
-
-	//delimiter for each new rule is a new line
-	$delimiter = "\n";
+	$contents = @file_get_contents($incoming_file);
 
 	//split the contents of the string file into an array using the delimiter
-	$splitcontents = explode($delimiter, $contents);
-
-	return $splitcontents;
-
+	return explode("\n", $contents);
 }
 
-/*
-if ($_GET['openruleset'] != '' && $_GET['ids'] != '') {
-	header("Location: /snort/snort_rules.php?id=$id&openruleset={$_GET['openruleset']}&saved=yes");
-	exit;
-}
-*/
-
 $ruledir = "/usr/local/etc/snort/snort_{$iface_uuid}_{$if_real}/rules/";
 //$ruledir = "/usr/local/etc/snort/rules/";
 $dh  = opendir($ruledir);
@@ -206,8 +168,6 @@ if ($_GET['openruleset'])
 else
 	$rulefile = $ruledir.$files[0];
 
-//Load the rule file
-$splitcontents = load_rule_file($rulefile);
 
 if ($_POST)
 {
@@ -413,50 +373,26 @@ require_once("guiconfig.inc");
 include_once("head.inc");
 
 $pgtitle = "Snort: $id $iface_uuid $if_real Category: $currentruleset";
-
 ?>
 
-<body
-	link="#0000CC" vlink="#0000CC" alink="#0000CC">
-
-<?php include("fbegin.inc"); ?>
-<?if($pfsense_stable == 'yes'){echo '<p class="pgtitle">' . $pgtitle . '</p>';}?>
-
+<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
 <?php
+include("fbegin.inc");
+if ($pfsense_stable == 'yes'){echo '<p class="pgtitle">' . $pgtitle . '</p>';}
+
 echo "{$snort_general_css}\n";
 ?>
+<form action="snort_rules.php" method="post" name="iform" id="iform">
+<?php if ($_GET['saved'] == 'yes') {print_info_box_np2($message);}?>
 
-<div class="body2">
-
-<noscript>
-<div class="alert" ALIGN=CENTER><img
-	src="../themes/<?php echo $g['theme']; ?>/images/icons/icon_alert.gif" /><strong>Please
-enable JavaScript to view this content
-</CENTER></div>
-</noscript>
-
-
-<?php
-echo "<form action=\"snort_rules.php?id={$id}\" method=\"post\" name=\"iform\" id=\"iform\">";
-?> <?php if ($_GET['saved'] == 'yes') {print_info_box_np2($message);}?>
-</form>
-</script> <script language="javascript" type="text/javascript">
-<!--
+<script language="javascript" type="text/javascript">
 function go()
 {
-    var agt=navigator.userAgent.toLowerCase();
-    if (agt.indexOf("msie") != -1) {
-        box = document.forms.selectbox;
-    } else {
-        box = document.forms[1].selectbox;
-	}
+    var box = document.iform.selectbox;
     destination = box.options[box.selectedIndex].value;
     if (destination) 
 		location.href = destination;
 }
-// -->
-</script> <script type="text/javascript">
-<!--
 function popup(url) 
 {
  params  = 'width='+screen.width;
@@ -468,10 +404,9 @@ function popup(url)
  if (window.focus) {newwin.focus()}
  return false;
 }
-// -->
 </script>
 
-<table width="99%" border="0" cellpadding="0" cellspacing="0">
+<table style="table-layout:fixed;" width="99%" border="0" cellpadding="0" cellspacing="0">
 <tr><td>
 <?php
         $tab_array = array();
@@ -492,199 +427,156 @@ function popup(url)
         display_top_tabs($tab_array);
 ?>
 </td></tr>
-	<tr>
-		<td>
-		<div id="mainarea2">
-		<table id="maintable" class="tabcont" width="100%" border="0"
-			cellpadding="0" cellspacing="0">
-			<tr>
-				<td>
-				<table id="ruletable1" class="sortable" width="100%" border="0"
-					cellpadding="0" cellspacing="0">
-					<tr id="frheader">
-						<td width="3%" class="list">&nbsp;</td>
-						<td width="5%" class="listhdr">SID</td>
-						<td width="6%" class="listhdrr">Proto</td>
-						<td width="15%" class="listhdrr">Source</td>
-						<td width="10%" class="listhdrr">Port</td>
-						<td width="15%" class="listhdrr">Destination</td>
-						<td width="10%" class="listhdrr">Port</td>
-						<td width="32%" class="listhdrr">Message</td>
+<tr>
+	<td>
+	<div id="mainarea2">
+	<table id="maintable" class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
+		<tr>
+			<td class="listt" colspan="8">
+			<br>Category: 
+			<select id="selectbox" name="selectbox" class="formfld" onChange="go()">
+			<?php
+				foreach ($files as $value) {
+					echo "<option value='?id={$id}&openruleset={$ruledir}{$value}' ";
+					if ($value === $currentruleset)
+						echo "selected";
+					echo ">{$value}</option>\n";
+				}
+			?>
+			</select>
+			</td>
+		</tr>
+		<tr id="frheader">
+			<td width="3%" class="list">&nbsp;</td>
+			<td width="5%" class="listhdr">SID</td>
+			<td width="6%" class="listhdrr">Proto</td>
+			<td width="15%" class="listhdrr">Source</td>
+			<td width="10%" class="listhdrr">Port</td>
+			<td width="15%" class="listhdrr">Destination</td>
+			<td width="10%" class="listhdrr">Port</td>
+			<td width="32%" class="listhdrr">Message</td>
+		</tr>
+		<?php
+			//Load the rule file
+			$splitcontents = load_rule_file($rulefile);
+			foreach ( $splitcontents as $counter => $value )
+			{
+				$disabled = "False";
+				$comments = "False";
+				$findme = "# alert"; //find string for disabled alerts
+				$disabled_pos = strstr($value, $findme);
 
-					</tr>
-					<tr>
-					<?php
-
-					echo "<br>Category: ";
-
-					//string for populating category select
-					$currentruleset = basename($rulefile);
-
-					?>
-						<form name="forms"><select name="selectbox" class="formfld"
-							onChange="go()">
-							<?php
-							$i=0;
-							foreach ($files as $value)
-							{
-								$selectedruleset = "";
-								if ($files[$i] === $currentruleset)
-									$selectedruleset = "selected";
-								?>
-							<option
-								value="?id=<?=$id;?>&openruleset=<?=$ruledir;?><?=$files[$i];?>"
-								<?=$selectedruleset;?>><?=$files[$i];?></option>
-							<?php
-							$i++;
-
-							}
-							?>
-						</select></form>
-					</tr>
-					<?php
-
-					$counter = 0;
-					$printcounter = 0;
-
-					foreach ( $splitcontents as $value )
-					{
-
-						$counter++;
-						$disabled = "False";
-						$comments = "False";
-
-						$tempstring = $splitcontents[$counter];
-						$findme = "# alert"; //find string for disabled alerts
-
-						//find alert
-						$disabled_pos = strstr($tempstring, $findme);
-
-
-						//do soemthing, this rule is enabled
-						$counter2 = 1;
-
-						//retrieve sid value
-						$sid = get_middle($tempstring, 'sid:', ';', 0);
-
-						//check to see if the sid is numberical
-						$is_sid_num = is_numeric($sid);
-
-						//if SID is numerical, proceed
-						if ($is_sid_num)
-						{
-
-							//if find alert is false, then rule is disabled
-							if ($disabled_pos !== false){
-								$counter2 = $counter2+1;
-								$textss = "<span class=\"gray\">";
-								$textse = "</span>";
-								$iconb = "icon_block_d.gif";
-							}
-							else
-							{
-								$textss = $textse = "";
-								$iconb = "icon_block.gif";
-							}
-
-							if ($disabled_pos !== false){
-								$ischecked = "";
-							}else{
-								$ischecked = "checked";
-							}
-
-							$rule_content = explode(' ', $tempstring);
-
-							$protocol = $rule_content[$counter2];//protocol location
-							$counter2++;
-							$source = $rule_content[$counter2];//source location
-							$counter2++;
-							$source_port = $rule_content[$counter2];//source port location
-							$counter2 = $counter2+2;
-							$destination = $rule_content[$counter2];//destination location
-							$counter2++;
-							$destination_port = $rule_content[$counter2];//destination port location
-
-							if (strstr($tempstring, 'msg: "'))
-							$message = get_middle($tempstring, 'msg: "', '";', 0);
-							if (strstr($tempstring, 'msg:"'))
-							$message = get_middle($tempstring, 'msg:"', '";', 0);
-
-							echo "<tr>
-                                        <td class=\"listt\">
-                                        $textss\n";
-                                        ?>
-					<a
-						href="?id=<?=$id;?>&openruleset=<?=$rulefile;?>&act=toggle&ids=<?=$counter;?>"><img
-						src="../themes/<?= $g['theme']; ?>/images/icons/<?=$iconb;?>"
-						width="10" height="10" border="0"
-						title="click to toggle enabled/disabled status"></a>
-					<!-- <input name="enable" type="checkbox" value="yes" <?= $ischecked; ?> onClick="enable_change(false)"> -->
-					<!-- TODO: add checkbox and save so that that disabling is nicer -->
-						<?php
-						echo "$textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $sid
-                                        $textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $protocol";
-                                        ?>
-                                        <?php
-                                        $printcounter++;
-                                        echo "$textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $source
-                                        $textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $source_port
-                                        $textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $destination
-                                        $textse
-                                        </td>
-                                        <td class=\"listlr\">
-                                        $textss
-                                        $destination_port
-                                        $textse
-                                        </td>";
-                                        ?>
-					<td class="listbg"><font color="white"> <?php
-					echo "$textss
+				$counter2 = 1;
+				$sid = get_middle($value, 'sid:', ';', 0);
+				//check to see if the sid is numberical
+				if (!is_numeric($sid))
+					continue;
+
+				//if find alert is false, then rule is disabled
+				if ($disabled_pos !== false){
+					$counter2 = $counter2+1;
+					$textss = "<span class=\"gray\">";
+					$textse = "</span>";
+					$iconb = "icon_block_d.gif";
+
+					$ischecked = "";
+				} else {
+					$textss = $textse = "";
+					$iconb = "icon_block.gif";
+
+					$ischecked = "checked";
+				}
+
+				$rule_content = explode(' ', $value);
+
+				$protocol = $rule_content[$counter2];//protocol location
+				$counter2++;
+				$source = substr($rule_content[$counter2], 0, 20) . "...";//source location
+				$counter2++;
+				$source_port = $rule_content[$counter2];//source port location
+				$counter2 = $counter2+2;
+				$destination = substr($rule_content[$counter2], 0, 20) . "...";//destination location
+				$counter2++;
+				$destination_port = $rule_content[$counter2];//destination port location
+
+				if (strstr($value, 'msg: "'))
+					$message = get_middle($value, 'msg: "', '";', 0);
+				else if (strstr($value, 'msg:"'))
+					$message = get_middle($value, 'msg:"', '";', 0);
+
+                                       echo "<tr><td class=\"listt\"> $textss\n";
+		?>
+				<a href="?id=<?=$id;?>&openruleset=<?=$rulefile;?>&act=toggle&ids=<?=$counter;?>"><img
+					src="../themes/<?= $g['theme']; ?>/images/icons/<?=$iconb;?>"
+					width="10" height="10" border="0"
+					title="click to toggle enabled/disabled status"></a>
+				<!-- <input name="enable" type="checkbox" value="yes" <?= $ischecked; ?> onClick="enable_change(false)"> -->
+				<!-- TODO: add checkbox and save so that that disabling is nicer -->
+		<?php
+				echo "$textse
+                                       </td>
+                                       <td width='5%' class=\"listlr\">
+					$textss
+					$sid
+					$textse
+                                       </td>
+                                       <td width='6%' class=\"listlr\">
+					$textss
+					$protocol";
+					echo "$textse
+                                       </td>
+                                       <td width='20%' class=\"listlr\">
+					$textss
+					$source
+					$textse
+                                       </td>
+                                       <td width='5%' class=\"listlr\">
+					$textss
+					$source_port
+					$textse
+                                       </td>
+                                       <td width='20%' class=\"listlr\">
+					$textss
+					$destination
+					$textse
+                                       </td>
+                                       <td width='5%' class=\"listlr\">
+                                       $textss
+                                       $destination_port
+                                       $textse
+                                       </td>
+				<td width='30%' class=\"listbg\"><font color=\"white\"> 
+					$textss
 					$message
 					$textse
-                                        </td>";
-					?>
-					<td valign="middle" nowrap class="list">
+                                       </td>";
+		?>
+				<td valign="middle" nowrap class="list">
 					<table border="0" cellspacing="0" cellpadding="1">
-						<tr>
-							<td><a href="javascript: void(0)"
-								onclick="popup('snort_rules_edit.php?id=<?=$id;?>&openruleset=<?=$rulefile;?>&ids=<?=$counter;?>')"><img
-								src="../themes/<?= $g['theme']; ?>/images/icons/icon_e.gif"
-								title="edit rule" width="17" height="17" border="0"></a></td>
+					<tr>
+						<td><a href="javascript: void(0)"
+							onclick="popup('snort_rules_edit.php?id=<?=$id;?>&openruleset=<?=$rulefile;?>&ids=<?=$counter;?>')"><img
+							src="../themes/<?= $g['theme']; ?>/images/icons/icon_e.gif"
+							title="edit rule" width="17" height="17" border="0"></a></td>
 							<!-- Codes by Quackit.com -->
-						</tr>
+					</tr>
 					</table>
-					</td>
-					<?php
-						}
-					}
-					echo "   There are $printcounter rules in this category. <br><br>";
-					?>
-				
-				</table>
 				</td>
-			</tr>
-			<table class="tabcont" width="100%" border="0" cellspacing="0"
-				cellpadding="0">
+		<?php
+			}
+		?>
+				
+			</table>
+			</td>
+		</tr>
+		<tr>
+			<td class="listlr">
+			<?php echo "  <strong><span class='red'>There are {$counter} rules in this category. <br/><br/></span></strong>"; ?>
+			</td>
+		</tr>
+		<tr>
+			<td>
+			<table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="0">
 				<tr>
 					<td width="16"><img
 						src="../themes/<?= $g['theme']; ?>/images/icons/icon_block.gif"
@@ -697,36 +589,23 @@ function popup(url)
 						width="11" height="11"></td>
 					<td nowrap>Rule Disabled</td>
 				</tr>
-				<table class="tabcont" width="100%" border="0" cellspacing="0"
-					cellpadding="0">
-					<tr>
+				<tr>
 						<!-- TODO: add save and cancel for checkbox options -->
 						<!-- <td><pre><input name="Submit" type="submit" class="formbtn" value="Save">	<input type="button" class="formbtn" value="Cancel" onclick="history.back()"><pre></td> -->
-					</tr>
-				</table>
+				</tr>
 				<tr>
 					<td colspan="10">
-					<p><!--<strong><span class="red">Warning:<br>
-                  </span></strong>Editing these r</p>-->
-					
+					<p><!--<strong><span class="red">Warning:<br/> </span></strong>Editing these r</p>-->
 					</td>
 				</tr>
 			</table>
-		</table>
-		
-		</td>
-	</tr>
-
+			</td>
+		</tr>
+	</table>
+	</td>
+</tr>
 </table>
-
-</div>
-
-<?php
-
-include("fend.inc");
-echo $snort_custom_rnd_box;
-?>
-
-</div>
+</form>
+<?php include("fend.inc"); ?>
 </body>
 </html>
diff --git a/config/snort/snort_rules_edit.php b/config/snort/snort_rules_edit.php
index 666147dc..7c31b017 100644
--- a/config/snort/snort_rules_edit.php
+++ b/config/snort/snort_rules_edit.php
@@ -70,45 +70,35 @@ if (isset($_POST['openruleset']))
 	$file = $_POST['openruleset'];
 
 //read file into string, and get filesize also chk for empty files
-if (filesize($file) > 0 ) {
-	$contents2 = file_get_contents($file);
-}else{
-	$contents2 = '';
-}
+$contents = '';
+if (filesize($file) > 0 )
+	$contents = file_get_contents($file);
 
 //delimiter for each new rule is a new line
 $delimiter = "\n";
 
 //split the contents of the string file into an array using the delimiter
-$splitcontents = explode($delimiter, $contents2);
-
-if ($_POST) {
+$splitcontents = explode($delimiter, $contents);
+$findme = "# alert"; //find string for disabled alerts
+$highlight = "yes";
+if (strstr($splitcontents[$lineid], $findme))
 	$highlight = "no";
-	if($_POST['highlight'] == "yes")
-		$highlight = "yes";
-
-	if ($_POST['rows'] <> "")
-		$rows = $_POST['rows'];
-	else
-		$rows = 1;
-
-	if ($_POST['cols'] <> "")
-		$cols = $_POST['cols'];
-	else
-		$cols = 66;
+if ($highlight == "no")
+	$splitcontents[$lineid] = substr($splitcontents[$lineid], 2);
 
+if ($_POST) {
 	if ($_POST['save']) {
 
-		/* get the changes */
-		$rule_content2 = $_POST['code'];
-
 		//copy string into file array for writing
-		$splitcontents[$lineid] = $rule_content2;
+		if ($_POST['highlight'] == "yes")
+			$splitcontents[$lineid] = $_POST['code'];
+		else
+			$splitcontents[$lineid] = "# " . $_POST['code'];
 
 		//write the new .rules file
 		@file_put_contents($file, implode($delimiter, $splitcontents));
 
-		echo "<script> window.close(); </script>";
+		echo "<script> opener.window.location.reload(); window.close(); </script>";
 		exit;
 	}
 }
@@ -120,12 +110,12 @@ $pgtitle = array(gettext("Advanced"), gettext("File Editor"));
 <?php include("head.inc");?>
 
 <body link="#000000" vlink="#000000" alink="#000000">
+<form action="snort_rules_edit.php" method="post">
+	<?php if ($savemsg) print_info_box($savemsg); ?>
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr>
 	<td class="tabcont">
-	<form action="snort_rules_edit.php?id=<?=$id; ?>&openruleset=<?=$file; ?>&ids=<?=$ids; ?>" method="post">
 
-	<?php if ($savemsg) print_info_box($savemsg); ?>
 
 		<table width="100%" cellpadding="9" cellspacing="9" bgcolor="#eeeeee">
 		<tr>
@@ -144,13 +134,21 @@ $pgtitle = array(gettext("Advanced"), gettext("File Editor"));
 				<label for="highlighting_disabled"> <?=gettext("Disabled");?></label>
 			</td>
 		</tr>
+		<tr> 
+			<td valign="top" class="label"> 
+			<textarea wrap="off" style="width: 98%; margin: 7px;" 
+			class="<?php echo $language; ?>:showcolumns" rows="3" 
+			cols="66" name="code"><?=$splitcontents[$lineid];?></textarea>
+			</div> 
+			</td> 
+		</tr> 
 		<tr>
 			<td valign="top" class="label">
 			<div style="background: #eeeeee;" id="textareaitem"><!-- NOTE: The opening *and* the closing textarea tag must be on the same line. -->
-			<textarea
+			<textarea disabled
 				wrap="off" style="width: 98%; margin: 7px;"
 				class="<?php echo $language; ?>:showcolumns" rows="33"
-				cols="<?=$cols;?>" name="code"><?=$contents2;?></textarea>
+				cols="66" name="code2"><?=$contents;?></textarea>
 			</div>
 			</td>
 		</tr>
@@ -158,6 +156,7 @@ $pgtitle = array(gettext("Advanced"), gettext("File Editor"));
 	</td>
 </tr>
 </table>
+</form>
 <?php include("fend.inc");?>
 </body>
 </html>
author	Ermal <eri@pfsense.org>	2011-09-02 11:14:40 +0000
committer	Ermal <eri@pfsense.org>	2011-09-02 11:17:50 +0000
commit	c35f5d138b4c1eba327517582c7de3b409e68e6b (patch)
tree	9029470fc4ed439bb174921c86ef4952cc8d0f57 /config/snort
parent	bc6f12a877cfd593ceddcf1f51d11b0f898eb2d7 (diff)
download	pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.tar.gz pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.tar.bz2 pfsense-packages-c35f5d138b4c1eba327517582c7de3b409e68e6b.zip