aboutsummaryrefslogtreecommitdiffstats
path: root/config/snort
diff options
context:
space:
mode:
authorErmal <eri@pfsense.org>2012-07-14 21:17:51 +0000
committerErmal <eri@pfsense.org>2012-07-14 21:17:51 +0000
commita368d93cd9d13cef90fdaf505130106b151860ca (patch)
tree8c5ba1fca118a02a6b2b0e07d9be4c615ae88d89 /config/snort
parent3018b771d5e518e5a28b619ae2f89bb541352612 (diff)
downloadpfsense-packages-a368d93cd9d13cef90fdaf505130106b151860ca.tar.gz
pfsense-packages-a368d93cd9d13cef90fdaf505130106b151860ca.tar.bz2
pfsense-packages-a368d93cd9d13cef90fdaf505130106b151860ca.zip
Use ports from the configuration that can be overriden than hardcoded ones
Diffstat (limited to 'config/snort')
-rw-r--r--config/snort/snort.inc73
-rw-r--r--config/snort/snort_preprocessors.php12
2 files changed, 39 insertions, 46 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index f6181819..9fa3beab 100644
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -1048,6 +1048,29 @@ function snort_generate_conf($snortcfg) {
if(!empty($snortcfg['performance']))
$snort_performance = $snortcfg['performance'];
+ /* if user has defined a custom ssh port, use it */
+ if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port']))
+ $ssh_port = $config['system']['ssh']['port'];
+ else
+ $ssh_port = "22";
+ $ports = array(
+ "dns_ports" => "53", "smtp_ports" => "25", "mail_ports" => "25,143,465,691",
+ "http_ports" => "80", "oracle_ports" => "1521", "mssql_ports" => "1433",
+ "telnet_ports" => "23","snmp_ports" => "161", "ftp_ports" => "21",
+ "ssh_ports" => $ssh_port, "pop2_ports" => "109", "pop3_ports" => "110",
+ "imap_ports" => "143", "sip_proxy_ports" => "5060:5090,16384:32768",
+ "sip_ports" => "5060:5090,16384:32768", "auth_ports" => "113", "finger_ports" => "79",
+ "irc_ports" => "6665,6666,6667,6668,6669,7000", "smb_ports" => "139,445",
+ "nntp_ports" => "119", "rlogin_ports" => "513", "rsh_ports" => "514",
+ "ssl_ports" => "443,465,563,636,989,990,992,993,994,995",
+ "file_data_ports" => "\$HTTP_PORTS,110,143", "shellcode_ports" => "!80",
+ "sun_rpc_ports" => "111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779",
+ "DCERPC_NCACN_IP_TCP" => "139,445", "DCERPC_NCADG_IP_UDP" => "138,1024:",
+ "DCERPC_NCACN_IP_LONG" => "135,139,445,593,1024:", "DCERPC_NCACN_UDP_LONG" => "135,1024:",
+ "DCERPC_NCACN_UDP_SHORT" => "135,593,1024:", "DCERPC_NCACN_TCP" => "2103,2105,2107",
+ "DCERPC_BRIGHTSTORE" => "6503,6504"
+ );
+
/////////////////////////////
/* preprocessor code */
/* def perform_stat */
@@ -1061,13 +1084,14 @@ EOD;
if (!empty($snortcfg['flow_depth']))
$def_flow_depth_type = $snortcfg['flow_depth'];
+ $http_ports = str_replace(",", " ", $ports['http_ports']);
/* def http_inspect */
$http_inspect = <<<EOD
# HTTP Inspect #
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535
preprocessor http_inspect_server: server default \
- ports { 80 8080 } \
+ ports { {$http_ports } \
non_strict \
non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \
flow_depth {$def_flow_depth_type} \
@@ -1138,11 +1162,12 @@ preprocessor ftp_telnet_protocol: ftp client default \
EOD;
+ $smtp_ports = str_replace(",", " ", $ports['mail_ports']);
/* def smtp_preprocessor */
$smtp_preprocessor = <<<EOD
# SMTP preprocessor #
preprocessor SMTP: \
- ports { 25 465 691 } \
+ ports { {$mail_ports} } \
inspection_type stateful \
normalize cmds \
valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING \
@@ -1173,10 +1198,11 @@ preprocessor sfportscan: scan_type { all } \
EOD;
+ $sun_rpc_ports = str_replace(",", " ", $ports['sun_rpc_ports']);
/* def other_preprocs */
$other_preprocs = <<<EOD
# Other preprocs #
-preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779
+preprocessor rpc_decode: {$sun_rpc_ports}
# Back Orifice
preprocessor bo
@@ -1188,17 +1214,18 @@ EOD;
# DCE/RPC 2 #
preprocessor dcerpc2: memcap 102400, events [smb, co, cl]
preprocessor dcerpc2_server: default, policy WinXP, \
- detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
+ detect [smb [{$ports['smb_ports']}], tcp 135, udp 135, rpc-over-http-server 593], \
autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
smb_max_chain 3
EOD;
+ $dns_ports = str_replace(",", " ", $ports['dns_ports']);
/* def dns_preprocessor */
$dns_preprocessor = <<<EOD
# DNS preprocessor #
preprocessor dns: \
- ports { 53 } \
+ ports { {$dns_ports} } \
enable_rdata_overflow
EOD;
@@ -1222,30 +1249,6 @@ EOD;
"aim_servers" => "64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24"
);
- /* if user has defined a custom ssh port, use it */
- if(is_array($config['system']['ssh']) && isset($config['system']['ssh']['port']))
- $ssh_port = $config['system']['ssh']['port'];
- else
- $ssh_port = "22";
- $ports = array(
- "dns_ports" => "53", "smtp_ports" => "25", "mail_ports" => "25,143,465,691",
- "http_ports" => "80", "oracle_ports" => "1521", "mssql_ports" => "1433",
- "telnet_ports" => "23","snmp_ports" => "161", "ftp_ports" => "21",
- "ssh_ports" => $ssh_port, "pop2_ports" => "109", "pop3_ports" => "110",
- "imap_ports" => "143", "sip_proxy_ports" => "5060:5090,16384:32768",
- "sip_ports" => "5060:5090,16384:32768", "auth_ports" => "113", "finger_ports" => "79",
- "irc_ports" => "6665,6666,6667,6668,6669,7000", "smb_ports" => "139,445",
- "nntp_ports" => "119", "rlogin_ports" => "513", "rsh_ports" => "514",
- "ssl_ports" => "443,465,563,636,989,990,992,993,994,995",
- "ssl_ports_ignore" => "443,465,563,636,989,990,992,993,994,995",
- "file_data_ports" => "\$HTTP_PORTS,110,143", "shellcode_ports" => "!80",
- "sun_rpc_ports" => "111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779",
- "DCERPC_NCACN_IP_TCP" => "139,445", "DCERPC_NCADG_IP_UDP" => "138,1024:",
- "DCERPC_NCACN_IP_LONG" => "135,139,445,593,1024:", "DCERPC_NCACN_UDP_LONG" => "135,1024:",
- "DCERPC_NCACN_UDP_SHORT" => "135,593,1024:", "DCERPC_NCACN_TCP" => "2103,2105,2107",
- "DCERPC_BRIGHTSTORE" => "6503,6504"
- );
-
$vardef = "";
foreach ($servers as $alias => $avalue) {
if (!empty($snortcfg[$alias]))
@@ -1259,7 +1262,7 @@ EOD;
$ports[$alias] = $snortcfg["def_{$alias}"];
$portvardef .= "portvar " . strtoupper($alias) . " [" . $ports[$alias] . "]\n";
}
- $def_ssl_ports_ignore = str_replace(",", " ", $ports['ssl_ports_ignore']);
+ $def_ssl_ports_ignore = str_replace(",", " ", $ports['ssl_ports']);
$snort_preproc = array (
"perform_stat", "http_inspect", "other_preprocs", "ftp_preprocessor", "smtp_preprocessor",
@@ -1279,10 +1282,12 @@ EOD;
$snort_misc_include_rules .= "include {$snortcfgdir}/reference.config\n";
if (file_exists("{$snortcfgdir}/classification.config"))
$snort_misc_include_rules .= "include {$snortcfgdir}/classification.config\n";
- if (file_exists("{$snortdir}/preproc_rules/preprocessor.rules"))
- $snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/preprocessor.rules\n";
- if (file_exists("{$snortdir}/preproc_rules/decoder.rules"))
- $snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/decoder.rules\n";
+ if (is_dir("{$snortdir}/preproc_rules")) {
+ foreach (glob("{$snortdir}/preproc_rules/*.rules") as $file) {
+ $file = basename($file);
+ $snort_misc_include_rules .= "include \$PREPROC_RULE_PATH/{$file}\n";
+ }
+ }
/* generate rule sections to load */
$selected_rules_sections = "";
diff --git a/config/snort/snort_preprocessors.php b/config/snort/snort_preprocessors.php
index 29a1d7bb..339c0168 100644
--- a/config/snort/snort_preprocessors.php
+++ b/config/snort/snort_preprocessors.php
@@ -55,7 +55,6 @@ if (isset($id) && $a_nat[$id]) {
/* new options */
$pconfig['perform_stat'] = $a_nat[$id]['perform_stat'];
- $pconfig['ssl_ports_ignore'] = $a_nat[$id]['def_ssl_ports_ignore'];
$pconfig['flow_depth'] = $a_nat[$id]['flow_depth'];
$pconfig['max_queued_bytes'] = $a_nat[$id]['max_queued_bytes'];
$pconfig['max_queued_segs'] = $a_nat[$id]['max_queued_segs'];
@@ -75,7 +74,6 @@ if ($_POST) {
/* if no errors write to conf */
if (!$input_errors) {
/* post new options */
- if ($_POST['ssl_ports_ignore'] != "") { $natent['def_ssl_ports_ignore'] = $_POST['ssl_ports_ignore']; }else{ $natent['def_ssl_ports_ignore'] = ""; }
if ($_POST['flow_depth'] != "") { $natent['flow_depth'] = $_POST['flow_depth']; }else{ $natent['flow_depth'] = ""; }
if ($_POST['max_queued_bytes'] != "") { $natent['max_queued_bytes'] = $_POST['max_queued_bytes']; }else{ $natent['max_queued_bytes'] = ""; }
if ($_POST['max_queued_segs'] != "") { $natent['max_queued_segs'] = $_POST['max_queued_segs']; }else{ $natent['max_queued_segs'] = ""; }
@@ -301,16 +299,6 @@ include_once("head.inc");
vulnerabilities.</td>
</tr>
<tr>
- <td width="22%" valign="top" class="vncell">Define SSL_IGNORE</td>
- <td width="78%" class="vtable"><input name="ssl_ports_ignore"
- type="text" class="formfld" id="ssl_ports_ignore" size="40"
- value="<?=htmlspecialchars($pconfig['ssl_ports_ignore']);?>"> <br>
- <span class="vexpl"> Encrypted traffic should be ignored by Snort
- for both performance reasons and to reduce false positives.<br>
- Default: "443 465 563 636 989 990 992 993 994 995".</span> <strong>Please
- use spaces and not commas.</strong></td>
- </tr>
- <tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="Save">