Replace more hard-coded paths with system globals where possible.

5 files changed, 50 insertions, 28 deletions

diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index 1fdfb65b..f0819b4e 100755
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -44,7 +44,7 @@ require_once("filter.inc");
 ini_set("memory_limit", "256M");
 
 // Explicitly declare this as global so it works through function call includes 
-global $rebuild_rules, $pfSense_snort_version;
+global $g, $config, $rebuild_rules, $pfSense_snort_version;
 
 // Grab the Snort binary version programmatically, but if that fails use a safe default
 $snortver = array();
@@ -69,15 +69,15 @@ else {
 
 /* Define some useful constants for Snort */
 /* Be sure to include trailing slash on the URL defines */
-define("SNORTLOGDIR", "/var/log/snort");
+define("SNORTLOGDIR", "{$g['varlog_path']}/snort");
 define("SNORT_BIN_VERSION", "2.9.6.2");
 define("SNORT_ET_DNLD_FILENAME", "emerging.rules.tar.gz");
 define("SNORT_ETPRO_DNLD_FILENAME", "etpro.rules.tar.gz");
 define("SNORT_GPLV2_DNLD_FILENAME", "community-rules.tar.gz");
 define("SNORT_ENFORCING_RULES_FILENAME", "snort.rules");
 define("SNORT_RULES_UPD_LOGFILE", SNORTLOGDIR . "/snort_rules_update.log");
-define("SNORT_IPREP_PATH", "/var/db/snort/iprep/");
-define('SNORT_SID_MODS_PATH', '/var/db/snort/sidmods/');
+define("SNORT_IPREP_PATH", "{$g['vardb_path']}/snort/iprep/");
+define('SNORT_SID_MODS_PATH', "{$g['vardb_path']}/snort/sidmods/");
 if (!defined("FLOWBITS_FILENAME"))
 	define("FLOWBITS_FILENAME", "flowbit-required.rules");
 if (!defined("VRT_FILE_PREFIX"))
@@ -557,7 +557,18 @@ function snort_barnyard_stop($snortcfg, $if_real) {
 	$snort_uuid = $snortcfg['uuid'];
 	if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) {
 		log_error("[Snort] Barnyard2 STOP for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})...");
+		touch("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.stopping");
 		killbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid");
+
+		// Now wait up to 5 seconds for Barnyard2 to actually stop and clear its PID file
+		$count = 0;
+		do {
+			if (!isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid"))
+				break;
+			sleep(1);
+			$count++;
+		} while ($count < 5);
+		unlink_if_exists("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.stopping");
 	}
 }
 
@@ -567,7 +578,18 @@ function snort_stop($snortcfg, $if_real) {
 	$snort_uuid = $snortcfg['uuid'];
 	if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
 		log_error("[Snort] Snort STOP for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})...");
+		touch("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.stopping");
 		killbypid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid");
+
+		// Now wait up to 10 seconds for Snort to actually stop and clear its PID file
+		$count = 0;
+		do {
+			if (!isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid"))
+				break;
+			sleep(1);
+			$count++;
+		} while ($count < 10);
+		unlink_if_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.stopping");
 	}
 
 	snort_barnyard_stop($snortcfg, $if_real);
diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php
index f1cbb6c4..e7559660 100755
--- a/config/snort/snort_alerts.php
+++ b/config/snort/snort_alerts.php
@@ -383,9 +383,9 @@ if ($_POST['delete']) {
 if ($_POST['download']) {
 	$save_date = date("Y-m-d-H-i-s");
 	$file_name = "snort_logs_{$save_date}_{$if_real}.tar.gz";
-	exec("cd {$snortlogdir}/snort_{$if_real}{$snort_uuid} && /usr/bin/tar -czf /tmp/{$file_name} *");
+	exec("cd {$snortlogdir}/snort_{$if_real}{$snort_uuid} && /usr/bin/tar -czf {$g['tmp_path']}/{$file_name} *");
 
-	if (file_exists("/tmp/{$file_name}")) {
+	if (file_exists("{$g['tmp_path']}/{$file_name}")) {
 		ob_start(); //important or other posts will fail
 		if (isset($_SERVER['HTTPS'])) {
 			header('Pragma: ');
@@ -395,13 +395,13 @@ if ($_POST['download']) {
 			header("Cache-Control: private, must-revalidate");
 		}
 		header("Content-Type: application/octet-stream");
-		header("Content-length: " . filesize("/tmp/{$file_name}"));
+		header("Content-length: " . filesize("{$g['tmp_path']}/{$file_name}"));
 		header("Content-disposition: attachment; filename = {$file_name}");
 		ob_end_clean(); //important or other post will fail
-		readfile("/tmp/{$file_name}");
+		readfile("{$g['tmp_path']}/{$file_name}");
 
 		// Clean up the temp file
-		unlink_if_exists("/tmp/{$file_name}");
+		unlink_if_exists("{$g['tmp_path']}/{$file_name}");
 	}
 	else
 		$savemsg = gettext("An error occurred while creating archive");
@@ -623,13 +623,13 @@ if ($savemsg) {
 
 /* make sure alert file exists */
 if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
-	exec("tail -{$anentries} -r {$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert > /tmp/alert_{$snort_uuid}");
-	if (file_exists("/tmp/alert_{$snort_uuid}")) {
+	exec("tail -{$anentries} -r {$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert > {$g['tmp_path']}/alert_{$snort_uuid}");
+	if (file_exists("{$g['tmp_path']}/alert_{$snort_uuid}")) {
 		$tmpblocked = array_flip(snort_get_blocked_ips());
 		$counter = 0;
 		/*                 0         1           2      3      4    5    6    7      8     9    10    11             12    */
 		/* File format timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority */
-		$fd = fopen("/tmp/alert_{$snort_uuid}", "r");
+		$fd = fopen("{$g['tmp_path']}/alert_{$snort_uuid}", "r");
 		while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) {
 			if(count($fields) < 13)
 				continue;
@@ -748,7 +748,7 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 			$counter++;
 		}
 		fclose($fd);
-		unlink_if_exists("/tmp/alert_{$snort_uuid}");
+		unlink_if_exists("{$g['tmp_path']}/alert_{$snort_uuid}");
 	}
 }
 ?>
diff --git a/config/snort/snort_blocked.php b/config/snort/snort_blocked.php
index 2d0af2c3..39119210 100644
--- a/config/snort/snort_blocked.php
+++ b/config/snort/snort_blocked.php
@@ -91,20 +91,20 @@ if ($_POST['download'])
 	if (is_array($blocked_ips_array_save) && count($blocked_ips_array_save) > 0) {
 		$save_date = date("Y-m-d-H-i-s");
 		$file_name = "snort_blocked_{$save_date}.tar.gz";
-		safe_mkdir("/tmp/snort_blocked");
-		file_put_contents("/tmp/snort_blocked/snort_block.pf", "");
+		safe_mkdir("{$g['tmp_path']}/snort_blocked");
+		file_put_contents("{$g['tmp_path']}/snort_blocked/snort_block.pf", "");
 		foreach($blocked_ips_array_save as $counter => $fileline) {
 			if (empty($fileline))
 				continue;
 			$fileline = trim($fileline, " \n\t");
-			file_put_contents("/tmp/snort_blocked/snort_block.pf", "{$fileline}\n", FILE_APPEND);
+			file_put_contents("{$g['tmp_path']}/snort_blocked/snort_block.pf", "{$fileline}\n", FILE_APPEND);
 		}
 
 		// Create a tar gzip archive of blocked host IP addresses
-		exec("/usr/bin/tar -czf /tmp/{$file_name} -C/tmp/snort_blocked snort_block.pf");
+		exec("/usr/bin/tar -czf {$g['tmp_path']}/{$file_name} -C{$g['tmp_path']}/snort_blocked snort_block.pf");
 
 		// If we successfully created the archive, send it to the browser.
-		if(file_exists("/tmp/{$file_name}")) {
+		if(file_exists("{$g['tmp_path']}/{$file_name}")) {
 			ob_start(); //important or other posts will fail
 			if (isset($_SERVER['HTTPS'])) {
 				header('Pragma: ');
@@ -114,14 +114,14 @@ if ($_POST['download'])
 				header("Cache-Control: private, must-revalidate");
 			}
 			header("Content-Type: application/octet-stream");
-			header("Content-length: " . filesize("/tmp/{$file_name}"));
+			header("Content-length: " . filesize("{$g['tmp_path']}/{$file_name}"));
 			header("Content-disposition: attachment; filename = {$file_name}");
 			ob_end_clean(); //important or other post will fail
-			readfile("/tmp/{$file_name}");
+			readfile("{$g['tmp_path']}/{$file_name}");
 
 			// Clean up the temp files and directory
-			unlink_if_exists("/tmp/{$file_name}");
-			rmdir_recursive("/tmp/snort_blocked");
+			unlink_if_exists("{$g['tmp_path']}/{$file_name}");
+			rmdir_recursive("{$g['tmp_path']}/snort_blocked");
 		} else
 			$savemsg = gettext("An error occurred while creating archive");
 	} else
diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php
index d3bc4d63..040858b9 100644
--- a/config/snort/snort_post_install.php
+++ b/config/snort/snort_post_install.php
@@ -58,7 +58,7 @@ global $config, $g, $rebuild_rules, $pkg_interface, $snort_gui_include;
  * updated GUI package.                 *
  ****************************************/
 if (!defined('SNORT_SID_MODS_PATH'))
-	define('SNORT_SID_MODS_PATH', '/var/db/snort/sidmods/');
+	define('SNORT_SID_MODS_PATH', "{$g['vardb_path']}/snort/sidmods/");
 
 /****************************************
  * End of PHP caching workaround        *
diff --git a/config/snort/snort_sid_mgmt.php b/config/snort/snort_sid_mgmt.php
index 2ca8dba9..ea1a5b99 100644
--- a/config/snort/snort_sid_mgmt.php
+++ b/config/snort/snort_sid_mgmt.php
@@ -215,9 +215,9 @@ if (isset($_POST['sidlist_dnload']) && isset($_POST['sidlist_fname'])) {
 if (isset($_POST['sidlist_dnload_all_x'])) {
 	$save_date = date("Y-m-d-H-i-s");
 	$file_name = "snort_sid_conf_files_{$save_date}.tar.gz";
-	exec("cd {$sidmods_path} && /usr/bin/tar -czf /tmp/{$file_name} *");
+	exec("cd {$sidmods_path} && /usr/bin/tar -czf {$g['tmp_path']}/{$file_name} *");
 
-	if (file_exists("/tmp/{$file_name}")) {
+	if (file_exists("{$g['tmp_path']}/{$file_name}")) {
 		ob_start(); //important or other posts will fail
 		if (isset($_SERVER['HTTPS'])) {
 			header('Pragma: ');
@@ -227,13 +227,13 @@ if (isset($_POST['sidlist_dnload_all_x'])) {
 			header("Cache-Control: private, must-revalidate");
 		}
 		header("Content-Type: application/octet-stream");
-		header("Content-length: " . filesize("/tmp/{$file_name}"));
+		header("Content-length: " . filesize("{$g['tmp_path']}/{$file_name}"));
 		header("Content-disposition: attachment; filename = {$file_name}");
 		ob_end_clean(); //important or other post will fail
-		readfile("/tmp/{$file_name}");
+		readfile("{$g['tmp_path']}/{$file_name}");
 
 		// Clean up the temp file
-		unlink_if_exists("/tmp/{$file_name}");
+		unlink_if_exists("{$g['tmp_path']}/{$file_name}");
 	}
 	else
 		$savemsg = gettext("An error occurred while creating the gzip archive!");