snort-dev,add new start up snort.sh, add new dynamic_ip_reload.php

4 files changed, 273 insertions, 138 deletions

diff --git a/config/snort-dev/NOTES.txt b/config/snort-dev/NOTES.txt
index 584c84a0..9b4d8d0e 100644
--- a/config/snort-dev/NOTES.txt
+++ b/config/snort-dev/NOTES.txt
@@ -26,8 +26,6 @@ snort.inc
 Must be recoded so that it reads the [snortglobal] [snortglobal][rule] options in conf.xml and makes the files whitelist, snort.sh, snort.conf, and barnyard.conf.
 This is easy, just cut and paste from the old snort.inc. I will work on this.
 
-Should be working for only one interface. Add code to wirite files for every snort rule in conf.xml
-
 
 =================================
 Any Devs that would like to help please work on snort_rules_edit.php and snort_rules.php. They work but need cleaning up.
diff --git a/config/snort-dev/snort.inc b/config/snort-dev/snort.inc
index 8bd4e880..6422df2c 100644
--- a/config/snort-dev/snort.inc
+++ b/config/snort-dev/snort.inc
@@ -40,7 +40,8 @@ $id = $_GET['id'];
 if (isset($_POST['id']))

 	$id = $_POST['id'];

 

-

+$interface_fake = $config['installedpackages']['snortglobal']['rule'][$id][interface];

+$if_real = convert_friendly_interface_to_real_interface_name($interface_fake);

 

 /* Allow additional execution time 0 = no limit. */

 ini_set('max_execution_time', '9999');

@@ -66,8 +67,9 @@ function sync_package_snort_reinstall()
 /* make sure this func on writes to files and does not start snort */

 function sync_package_snort()

 {

-	global $config, $g;

+	global $config, $g, $id, $if_real;

 

+	if(!file_exists("/var/log/snort/"))

 	mwexec("mkdir -p /var/log/snort/");

 

 	if(!file_exists("/var/log/snort/alert"))

@@ -79,8 +81,8 @@ function sync_package_snort()
 	$bpfmaxinsns = $config['installedpackages']['snortglobal']['bpfmaxinsns'];

 

 	/* set the snort performance model */

-	if($config['installedpackages']['snortglobal']['rule'][0]['performance'])

-		$config['installedpackages']['snortglobal']['rule'][0]['performance'];

+	if($config['installedpackages']['snortglobal']['rule'][$id]['performance'])

+		$config['installedpackages']['snortglobal']['rule'][$id]['performance'];

 	else

 		$snort_performance = "lowmem";

 

@@ -89,6 +91,8 @@ function sync_package_snort()
 	exec("/bin/mkdir -p /usr/local/etc/snort");

 	exec("/bin/mkdir -p /var/log/snort");

 	exec("/bin/mkdir -p /usr/local/etc/snort/rules");

+

+	if(file_exists("/usr/local/etc/snort/snort.conf-sample")) {

 	exec("/bin/rm /usr/local/etc/snort/snort.conf-sample");

 	exec("/bin/rm /usr/local/etc/snort/threshold.conf-sample");

 	exec("/bin/rm /usr/local/etc/snort/sid-msg.map-sample");

@@ -99,25 +103,41 @@ function sync_package_snort()
 	exec("/bin/rm /usr/local/etc/snort/gen-msg.map-sample");

 	exec("/bin/rm /usr/local/etc/snort/sid");

 	exec("/bin/rm -f /usr/local/etc/rc.d/snort");

+	}

 	

-	/* create log directory */

-	$start  = "/bin/mkdir -p /var/log/snort\n";

+	/* create basic files */

+	if ($id != "") {

+	if(!file_exists("/usr/local/etc/snort/snort/snort_$id$if_real")) {

+	exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/");

+	exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules");

+		}

+	if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/gen-msg.map")) {

+	exec("/bin/cp /usr/local/etc/snort/classification.config /usr/local/etc/snort/snort_$id$if_real/classification.config");

+	exec("/bin/cp /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/snort_$id$if_real/gen-msg.map");

+	exec("/bin/cp /usr/local/etc/snort/reference.config /usr/local/etc/snort/snort_$id$if_real/reference.config");

+	exec("/bin/cp /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/snort_$id$if_real/sid-msg.map");

+	exec("/bin/cp /usr/local/etc/snort/unicode.map /usr/local/etc/snort/snort_$id$if_real/unicode.map");

+	exec("/bin/cp /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/snort_$id$if_real/threshold.conf");

+	exec("/bin/cp /usr/local/etc/snort/snort.conf /usr/local/etc/snort/snort_$id$if_real/snort.conf");

+	exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules");

+		}

+	}

 

 	/* snort advanced features - bpf tuning */

-	if($bpfbufsize)

-		$start .= "sysctl net.bpf.bufsize={$bpfbufsize}\n";

-	if($bpfmaxbufsize)

-		$start .= "sysctl net.bpf.maxbufsize={$bpfmaxbufsize}\n";

-	if($bpfmaxinsns)

-		$start .= "sysctl net.bpf.maxinsns={$bpfmaxinsns}\n";

+//	if($bpfbufsize)

+//		$start .= "sysctl net.bpf.bufsize={$bpfbufsize}\n";

+//	if($bpfmaxbufsize)

+//		$start .= "sysctl net.bpf.maxbufsize={$bpfmaxbufsize}\n";

+//	if($bpfmaxinsns)

+//		$start .= "sysctl net.bpf.maxinsns={$bpfmaxinsns}\n";

 

 	/* go ahead and issue bpf changes */

-	if($bpfbufsize)

-		mwexec_bg("sysctl net.bpf.bufsize={$bpfbufsize}");

-	if($bpfmaxbufsize)

-		mwexec_bg("sysctl net.bpf.maxbufsize={$bpfmaxbufsize}");

-	if($bpfmaxinsns)

-		mwexec_bg("sysctl net.bpf.maxinsns={$bpfmaxinsns}");

+//	if($bpfbufsize)

+//		mwexec_bg("sysctl net.bpf.bufsize={$bpfbufsize}");

+//	if($bpfmaxbufsize)

+//		mwexec_bg("sysctl net.bpf.maxbufsize={$bpfmaxbufsize}");

+//	if($bpfmaxinsns)

+//		mwexec_bg("sysctl net.bpf.maxinsns={$bpfmaxinsns}");

 

 /* let there be snort.sh for each rule */

 /* start snort.sh for writing */

@@ -131,6 +151,15 @@ $counter_rule += 1;
 $result_lan = $config['installedpackages']['snortglobal']['rule'][$counter_rule][interface];

 $if_real_c = convert_friendly_interface_to_real_interface_name($result_lan);

 

+$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$counter_rule]['barnyard_enable'];

+/* define snortbarnyardlog_chk */

+if ($snortbarnyardlog_info_chk == on) {

+

+$start_barnyard2 = "\nsleep 4\n/usr/local/bin/barnyard2 -c /usr/local/etc/snort/snort_$counter_rule$if_real_c/barnyard2.conf -d /var/log/snort -f snort.u2_$counter_rule$if_real_c -w /usr/local/etc/snort/snort_$counter_rule$if_real_c/barnyard2.waldo -D -q\n\n";

+

+}

+

+

 /* open snort.sh for writing" */

 conf_mount_rw();

 

@@ -163,68 +192,114 @@ $snort_sh_text = <<<EOD
 #!/bin/sh

 # This file was automatically generated

 # by the pfSense service handler.

+# Code added to protect from double starts on pfSense bootup

 

 rc_start() {

+

+        if [ "`ps -auwx | grep -v grep | grep "$if_real_c -c" | awk '{print $2;}'`" != "" ] ; then

+        snort_pid="`ps -auwx | grep -v grep | grep "$if_real_c -c" | awk '{print $2;}'`"

+        cp /var/log/system.log /var/log/system.log.bk

+        logger -p daemon.info -i -t SnortStartup "Snort already running, soft restart"

+        /usr/local/bin/php -f /usr/local/pkg/pf/snort_dynamic_ip_reload.php $counter $if_real_c

+        kill -HUP \${snort_pid}

+        sleep 3

+		AFTER_MEM=`top | grep Wired | awk '{print $12}'`

+        cp /var/log/system.log /var/log/snort/snort_sys_$if_real_c.log

+        /usr/sbin/clog -i -s 262144 /var/log/system.log

+        cp /var/log/system.log.bk /var/log/system.log

+        logger -p daemon.info -i -t SnortStartup "Snort Soft Reload For $counter_rule$if_real_c..."

+		logger -p daemon.info -i -t SnortStartup "MEM after $counter_rule$if_real_c START \${AFTER_MEM}"

+        exit 1

+        fi

+		

+		rc_start_real

+}

+

+rc_start_real() {

 	

-	if [ "ls -A /usr/local/etc/snort/snort_$counter_rule$if_real_c/rules" ] ; then

-	echo "rules exist"

-	else

-	echo "rules DONT exist"

-	exit 2

-	fi 

-

-	if [ "`pgrep -x snort`" = "" ] ; then

-	/bin/rm /tmp/snort_$counter_rule$if_real_c.sh.pid

-	fi 

-

-	if [ "`pgrep -x snort`" != "" ] ; then

-	logger -p daemon.info -i -t SnortStartup "Snort already running..."

-	/usr/local/bin/php -f /usr/local/pkg/pf/snort_dynamic_ip_reload.php

-	exit 1

-	fi

-

-if ls /tmp/snort_$counter_rule$if_real_c.sh.pid > /dev/null

-then

-    echo "snort_$counter_rule$if_real_c.sh is running"

-    exit 0

-else

-    echo "snort_$counter_rule$if_real_c.sh is not running"

-fi

+        # If no rules dir exit

+

+        if [ "ls -A /usr/local/etc/snort/snort_$counter_rule$if_real_c/rules" ] ; then

+        echo "rules DO exist"

+        else

+        exit 2

+        fi

+

+        # If Snort.sh is running exit

+

+        if ls /tmp/snort_$counter_rule$if_real_c.sh.pid > /dev/null ; then

+        echo "snort.sh is running"

+        exit 3

+        else

+        echo "snort.sh is not running"

+        fi

 

-echo "snort_$counter_rule$if_real_c.sh run" > /tmp/snort_$counter_rule$if_real_c.sh.pid

+        # If Snort proc is running exit

 

-echo "snort_$counter_rule$if_real_c.sh run" >> /tmp/snort_$counter_rule$if_real_c.sh_startup.log

+        if [ "`ps -auwx | grep -v grep | grep "$counter_rule$if_real_c -c" | awk '{print $2;}'`" != "" ] ; then

+        echo "Snort is  running"

+        exit 4

+        fi

 

-rm -f /var/run/snort_$counter_rule$if_real_c.sh

-BEFORE_MEM=`top | grep Wired | awk '{print $12}'`

-/bin/mkdir -p /var/log/snort

-/usr/bin/killall barnyard2

+        cp /var/log/system.log /var/log/system.log.bk

+        logger -p daemon.info -i -t SnortStartup "Snort is NOT running, hard restart"

 

-sleep 4

-/usr/local/bin/snort -G $counter_rule$if_real_c -R $counter_rule$if_real_c -c /usr/local/etc/snort/snort_$counter_rule$if_real_c/snort.conf -l /var/log/snort -D -i $if_real_c -q

+        if [ "`ps -auwx | grep -v grep | grep "$counter_rule$if_real_c -c" | awk '{print $2;}'`" = "" ] ; then

+        /bin/rm /tmp/snort_$counter_rule$if_real_c.sh.pid

+        fi

 

-# sleep 4

-# /usr/local/bin/barnyard2 -c /usr/local/etc/snort/snort_$counter_rule$if_real_c/barnyard2.conf -d /var/log/snort -f snort.u2 -w /usr/local/etc/snort/snort_$counter_rule$if_real_c/barnyard2.waldo -D -q

+        echo "snort_$counter_rule$if_real_c.sh run" > /tmp/snort_$counter_rule$if_real_c.sh.pid

 

-	sleep 2

-	MYSNORTLOG=`/usr/sbin/clog /var/log/system.log | grep snort | tail | grep 'Snort initialization completed successfully'`

+        echo "snort_$counter_rule$if_real_c.sh run" >> /tmp/snort_$counter_rule$if_real_c.sh_startup.log

+

+        # Start the interfaces

+

+        /usr/local/bin/snort -G $counter_rule$if_real_c -R $counter_rule$if_real_c -c /usr/local/etc/snort/snort_$counter_rule$if_real_c/snort.conf -l /var/log/snort -D -i $if_real_c -q

+

+        sleep 3

+        AFTER_MEM=`top | grep Wired | awk '{print $12}'`

+        cp /var/log/system.log /var/log/snort/snort_sys_$counter_rule$if_real_c.log

+        /usr/sbin/clog -i -s 262144 /var/log/system.log

+        cp /var/log/system.log.bk /var/log/system.log

+        logger -p daemon.info -i -t SnortStartup "Snort HARD Reload For $counter_rule$if_real_c..."

+        logger -p daemon.info -i -t SnortStartup "MEM after $counter_rule$if_real_c START \${AFTER_MEM}"

+        echo "snort is running, but snort.sh finished removed pid"

+        /bin/rm /tmp/snort_$counter_rule$if_real_c.sh.pid

 	

 }

 

 rc_stop() {

-	/usr/bin/killall snort; killall barnyard2

+

+		pid_s=`ps -auwx | grep -v grep | grep "$counter_rule$if_real_c -c" | awk '{print \$2;}'`

+		pid_b=`ps -auwx | grep -v grep | grep "snort.u2_$counter_rule$if_real_c" | awk '{print \$2;}'`

+	

+		if [ \${pid_s} ] ; then

+        cp /var/log/system.log /var/log/system.log.bk

+        logger -p daemon.info -i -t SnortStartup "Snort IS running, hard STOP"

+		/bin/kill \${pid_s}; /bin/kill \${pid_b};

+        sleep 3

+        AFTER_MEM=`top | grep Wired | awk '{print $12}'`

+        cp /var/log/system.log /var/log/snort/snort_sys_$counter_rule$if_real_c.log

+        /usr/sbin/clog -i -s 262144 /var/log/system.log

+        cp /var/log/system.log.bk /var/log/system.log

+        logger -p daemon.info -i -t SnortStartup "Snort HARD STOP For $counter_rule$if_real_c..."

+        logger -p daemon.info -i -t SnortStartup "MEM after $counter_rule$if_real_c STOP \${AFTER_MEM}"

+		fi

 }

 

 case $1 in

 	start)

 		rc_start

 		;;

+	start_real)

+		rc_start_real

+		;;

 	stop)

 		rc_stop

 		;;

 	restart)

 		rc_stop

-		rc_start

+		rc_start_real

 		;;

 esac

 

@@ -246,17 +321,12 @@ EOD;
 	create_snort_conf();

 

 /* create barnyard2 configuration file */

-$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['barnyard_enable'];

+$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable'];

 if ($snortbarnyardlog_info_chk == on)

        create_barnyard2_conf();

 

-	   /* snort will not start on install untill setting are set */

-	   /* do start snort create a funtion to start snort */

-if ($config['installedpackages']['snortglobal']['autorulesupdate7'] != "") {

-	/* start snort service */

-	conf_mount_ro();

-	start_service("snort");

-	}

+conf_mount_ro();

+

 }

 

 

@@ -265,9 +335,9 @@ function create_barnyard2_conf() {
         global $bconfig, $bg;

         /* write out barnyard2_conf */

         $barnyard2_conf_text = generate_barnyard2_conf();

-        $bconf = fopen("/usr/local/etc/snort/snort_0vr1/barnyard2.conf", "w");

+        $bconf = fopen("/usr/local/etc/snort/$id$if_real/barnyard2.conf", "w");

         if(!$bconf) {

-                log_error("Could not open /usr/local/etc/snort/snort_0vr1/barnyard2.conf for writing.");

+                log_error("Could not open /usr/local/etc/snort/$id$if_real/barnyard2.conf for writing.");

                 exit;

         }

         fwrite($bconf, $barnyard2_conf_text);

@@ -277,18 +347,15 @@ function create_barnyard2_conf() {
 /* open barnyard2.conf for writing" */

 function generate_barnyard2_conf() {

 

-        global $config, $g, $id;

+        global $config, $g, $id, $if_real;

         conf_mount_rw();

 

 /* define snortbarnyardlog */

 /* TODO add support for the other 5 output plugins */

 

-$snortbarnyardlog_database_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['barnyard_mysql'];

+$snortbarnyardlog_database_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_mysql'];

 $snortbarnyardlog_hostname_info_chk = exec("/bin/hostname");

 

-/* convert fake interfaces to real */

-$if_real = convert_friendly_interface_to_real_interface_name($config['installedpackages']['snortglobal']['rule'][0]['interface']);

-

 $snortbarnyardlog_interface_info_chk = $if_real;

 

 $barnyard2_conf_text = <<<EOD

@@ -343,13 +410,13 @@ EOD;
 }

 

 function create_snort_conf() {

-	global $config, $g;

+	global $config, $g, $id, $if_real;

 	/* write out snort.conf */

 	$snort_conf_text = generate_snort_conf();

 	conf_mount_rw();

-	$conf = fopen("/usr/local/etc/snort/snort_0vr1/snort.conf", "w");

+	$conf = fopen("/usr/local/etc/snort/snort_$id$if_real/snort.conf", "w");

 	if(!$conf) {

-		log_error("Could not open /usr/local/etc/snort/snort_0vr1/snort.conf for writing.");

+		log_error("Could not open /usr/local/etc/snort/$id$if_real/snort.conf for writing.");

 		exit;

 	}

 	fwrite($conf, $snort_conf_text);

@@ -359,7 +426,7 @@ function create_snort_conf() {
 

 function snort_deinstall() {

 

-	global $config, $g;

+	global $config, $g, $id, $if_real;

 

 	/* remove custom sysctl */

 	remove_text_from_file("/etc/sysctl.conf", "sysctl net.bpf.bufsize=20480");

@@ -434,7 +501,7 @@ snort_rules_up_deinstall_cron("");
 		

 	/* Unset snort registers in conf.xml IMPORTANT snort will not start with out this */

 	/* Keep this as a last step */

-	unset($config['installedpackages']['snortglobal']['rule'][0]['autorulesupdate7']);

+	unset($config['installedpackages']['snortglobal']['rule'][$id]['autorulesupdate7']);

     unset($config['installedpackages']['snortglobal']['rm_blocked']);

     write_config();

 	

@@ -442,169 +509,169 @@ snort_rules_up_deinstall_cron("");
 

 function generate_snort_conf() {

 

-	global $config, $g;

+	global $config, $g, $if_real, $id;

 	conf_mount_rw();

 	/* obtain external interface */

 	/* XXX: make multi wan friendly */

-	$snort_ext_int = $config['installedpackages']['snortglobal']['rule'][0]['interface'];

+	$snort_ext_int = $config['installedpackages']['snortglobal']['rule'][$id]['interface'];

 

-//	$snort_config_pass_thru = $config['installedpackages']['snortglobal']['rule'][0]['configpassthru'];

+//	$snort_config_pass_thru = $config['installedpackages']['snortglobal']['rule'][$id]['configpassthru'];

 	

 /* define snortalertlogtype */

-$snortalertlogtype = $config['installedpackages']['snortglobal']['rule'][0]['snortalertlogtype'];

+$snortalertlogtype = $config['installedpackages']['snortglobal']['rule'][$id]['snortalertlogtype'];

 if ($snortalertlogtype == fast)

     $snortalertlogtype_type = "output alert_fast: alert";

 else

 	$snortalertlogtype_type = "output alert_full: alert"; 

 

 /* define alertsystemlog */

-$alertsystemlog_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['alertsystemlog'];

+$alertsystemlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['alertsystemlog'];

 if ($alertsystemlog_info_chk == on)

     $alertsystemlog_type = "output alert_syslog: log_alert";

 

 /* define tcpdumplog */

-$tcpdumplog_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['tcpdumplog'];

+$tcpdumplog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['tcpdumplog'];

 if ($tcpdumplog_info_chk == on)

     $tcpdumplog_type = "output log_tcpdump: snorttcpd.log";

 

 /* define snortbarnyardlog_chk */

-$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['snortbarnyardlog'];

+$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['snortbarnyardlog'];

 if ($snortbarnyardlog_info_chk == on)

     $snortbarnyardlog_type = "barnyard2 -c /usr/local/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w /usr/local/etc/snort/barnyard2.waldo -D";

 

 /* define snortunifiedlog */

-$snortunifiedlog_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['snortunifiedlog'];

+$snortunifiedlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['snortunifiedlog'];

 if ($snortunifiedlog_info_chk == on)

-    $snortunifiedlog_type = "output unified2: filename snort.u2, limit 128";

+    $snortunifiedlog_type = "output unified2: filename snort.u2_$id$if_real, limit 128";

 

 /* define spoink */

-$spoink_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['blockoffenders7'];

+$spoink_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['blockoffenders7'];

 if ($spoink_info_chk == on)

     $spoink_type = "output alert_pf: /var/db/whitelist,snort2c";

 

 	/* define servers and ports snortdefservers */

 

 /* def DNS_SERVSERS */

-$def_dns_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_dns_servers'];

+$def_dns_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_dns_servers'];

 if ($def_dns_servers_info_chk == "")

 	$def_dns_servers_type = "\$HOME_NET";

 else 

 	$def_dns_servers_type = "$def_dns_servers_info_chk";

 

 /* def DNS_PORTS */

-$def_dns_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_dns_ports'];

+$def_dns_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_dns_ports'];

 if ($def_dns_ports_info_chk == "")

 	$def_dns_ports_type = "53";

 else 

 	$def_dns_ports_type = "$def_dns_ports_info_chk";

 

 /* def SMTP_SERVSERS */

-$def_smtp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_smtp_servers'];

+$def_smtp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_smtp_servers'];

 if ($def_smtp_servers_info_chk == "")

 	$def_smtp_servers_type = "\$HOME_NET";

 else 

 	$def_smtp_servers_type = "$def_smtp_servers_info_chk";

 

 /* def SMTP_PORTS */

-$def_smtp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_smtp_ports'];

+$def_smtp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_smtp_ports'];

 if ($def_smtp_ports_info_chk == "")

 	$def_smtp_ports_type = "25";

 else 

 	$def_smtp_ports_type = "$def_smtp_ports_info_chk";

 

 /* def MAIL_PORTS */

-$def_mail_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_mail_ports'];

+$def_mail_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_mail_ports'];

 if ($def_mail_ports_info_chk == "")

 	$def_mail_ports_type = "25,143,465,691";

 else 

 	$def_mail_ports_type = "$def_mail_ports_info_chk";

 	

 /* def HTTP_SERVSERS */

-$def_http_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_http_servers'];

+$def_http_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_http_servers'];

 if ($def_http_servers_info_chk == "")

 	$def_http_servers_type = "\$HOME_NET";

 else 

 	$def_http_servers_type = "$def_http_servers_info_chk";

 

 /* def WWW_SERVSERS */

-$def_www_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_www_servers'];

+$def_www_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_www_servers'];

 if ($def_www_servers_info_chk == "")

 	$def_www_servers_type = "\$HOME_NET";

 else 

 	$def_www_servers_type = "$def_www_servers_info_chk";

 

 /* def HTTP_PORTS */

-$def_http_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_http_ports'];

+$def_http_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_http_ports'];

 if ($def_http_ports_info_chk == "")

 	$def_http_ports_type = "80";

 else 

 	$def_http_ports_type = "$def_http_ports_info_chk";

 	

 /* def SQL_SERVSERS */

-$def_sql_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_sql_servers'];

+$def_sql_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_sql_servers'];

 if ($def_sql_servers_info_chk == "")

 	$def_sql_servers_type = "\$HOME_NET";

 else 

 	$def_sql_servers_type = "$def_sql_servers_info_chk";

 

 /* def ORACLE_PORTS */

-$def_oracle_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_oracle_ports'];

+$def_oracle_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_oracle_ports'];

 if ($def_oracle_ports_info_chk == "")

 	$def_oracle_ports_type = "1521";

 else 

 	$def_oracle_ports_type = "$def_oracle_ports_info_chk";

 

 /* def MSSQL_PORTS */

-$def_mssql_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_mssql_ports'];

+$def_mssql_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_mssql_ports'];

 if ($def_mssql_ports_info_chk == "")

 	$def_mssql_ports_type = "1433";

 else 

 	$def_mssql_ports_type = "$def_mssql_ports_info_chk";

 

 /* def TELNET_SERVSERS */

-$def_telnet_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_telnet_servers'];

+$def_telnet_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_telnet_servers'];

 if ($def_telnet_servers_info_chk == "")

 	$def_telnet_servers_type = "\$HOME_NET";

 else 

 	$def_telnet_servers_type = "$def_telnet_servers_info_chk";

 	

 /* def TELNET_PORTS */

-$def_telnet_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_telnet_ports'];

+$def_telnet_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_telnet_ports'];

 if ($def_telnet_ports_info_chk == "")

 	$def_telnet_ports_type = "23";

 else 

 	$def_telnet_ports_type = "$def_telnet_ports_info_chk";

 	

 /* def SNMP_SERVSERS */

-$def_snmp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_snmp_servers'];

+$def_snmp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_snmp_servers'];

 if ($def_snmp_servers_info_chk == "")

 	$def_snmp_servers_type = "\$HOME_NET";

 else 

 	$def_snmp_servers_type = "$def_snmp_servers_info_chk";

 	

 /* def SNMP_PORTS */

-$def_snmp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_snmp_ports'];

+$def_snmp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_snmp_ports'];

 if ($def_snmp_ports_info_chk == "")

 	$def_snmp_ports_type = "161";

 else 

 	$def_snmp_ports_type = "$def_snmp_ports_info_chk";

 	

 /* def FTP_SERVSERS */

-$def_ftp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_ftp_servers'];

+$def_ftp_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_ftp_servers'];

 if ($def_ftp_servers_info_chk == "")

 	$def_ftp_servers_type = "\$HOME_NET";

 else 

 	$def_ftp_servers_type = "$def_ftp_servers_info_chk";

 	

 /* def FTP_PORTS */

-$def_ftp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_ftp_ports'];

+$def_ftp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_ftp_ports'];

 if ($def_ftp_ports_info_chk == "")

 	$def_ftp_ports_type = "21";

 else 

 	$def_ftp_ports_type = "$def_ftp_ports_info_chk";

 	

 /* def SSH_SERVSERS */

-$def_ssh_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_ssh_servers'];

+$def_ssh_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_ssh_servers'];

 if ($def_ssh_servers_info_chk == "")

 	$def_ssh_servers_type = "\$HOME_NET";

 else 

@@ -617,105 +684,105 @@ else
 	$ssh_port = "22";

 	

 /* def SSH_PORTS */

-$def_ssh_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_ssh_ports'];

+$def_ssh_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_ssh_ports'];

 if ($def_ssh_ports_info_chk == "")

 	$def_ssh_ports_type = "{$ssh_port}";

 else 

 	$def_ssh_ports_type = "$def_ssh_ports_info_chk";

 	

 /* def POP_SERVSERS */

-$def_pop_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_pop_servers'];

+$def_pop_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_pop_servers'];

 if ($def_pop_servers_info_chk == "")

 	$def_pop_servers_type = "\$HOME_NET";

 else 

 	$def_pop_servers_type = "$def_pop_servers_info_chk";

 	

 /* def POP2_PORTS */

-$def_pop2_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_pop2_ports'];

+$def_pop2_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_pop2_ports'];

 if ($def_pop2_ports_info_chk == "")

 	$def_pop2_ports_type = "109";

 else 

 	$def_pop2_ports_type = "$def_pop2_ports_info_chk";

 	

 /* def POP3_PORTS */

-$def_pop3_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_pop3_ports'];

+$def_pop3_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_pop3_ports'];

 if ($def_pop3_ports_info_chk == "")

 	$def_pop3_ports_type = "110";

 else 

 	$def_pop3_ports_type = "$def_pop3_ports_info_chk";

 	

 /* def IMAP_SERVSERS */

-$def_imap_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_imap_servers'];

+$def_imap_servers_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_imap_servers'];

 if ($def_imap_servers_info_chk == "")

 	$def_imap_servers_type = "\$HOME_NET";

 else 

 	$def_imap_servers_type = "$def_imap_servers_info_chk";

 	

 /* def IMAP_PORTS */

-$def_imap_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_imap_ports'];

+$def_imap_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_imap_ports'];

 if ($def_imap_ports_info_chk == "")

 	$def_imap_ports_type = "143";

 else 

 	$def_imap_ports_type = "$def_imap_ports_info_chk";

 	

 /* def SIP_PROXY_IP */

-$def_sip_proxy_ip_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_sip_proxy_ip'];

+$def_sip_proxy_ip_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_sip_proxy_ip'];

 if ($def_sip_proxy_ip_info_chk == "")

 	$def_sip_proxy_ip_type = "\$HOME_NET";

 else 

 	$def_sip_proxy_ip_type = "$def_sip_proxy_ip_info_chk";

 	

 /* def SIP_PROXY_PORTS */

-$def_sip_proxy_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_sip_proxy_ports'];

+$def_sip_proxy_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_sip_proxy_ports'];

 if ($def_sip_proxy_ports_info_chk == "")

 	$def_sip_proxy_ports_type = "5060:5090,16384:32768";

 else 

 	$def_sip_proxy_ports_type = "$def_sip_proxy_ports_info_chk";

 	

 /* def AUTH_PORTS */

-$def_auth_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_auth_ports'];

+$def_auth_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_auth_ports'];

 if ($def_auth_ports_info_chk == "")

 	$def_auth_ports_type = "113";

 else 

 	$def_auth_ports_type = "$def_auth_ports_info_chk";

 	

 /* def FINGER_PORTS */

-$def_finger_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_finger_ports'];

+$def_finger_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_finger_ports'];

 if ($def_finger_ports_info_chk == "")

 	$def_finger_ports_type = "79";

 else 

 	$def_finger_ports_type = "$def_finger_ports_info_chk";

 	

 /* def IRC_PORTS */

-$def_irc_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_irc_ports'];

+$def_irc_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_irc_ports'];

 if ($def_irc_ports_info_chk == "")

 	$def_irc_ports_type = "6665,6666,6667,6668,6669,7000";

 else 

 	$def_irc_ports_type = "$def_irc_ports_info_chk";

 	

 /* def NNTP_PORTS */

-$def_nntp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_nntp_ports'];

+$def_nntp_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_nntp_ports'];

 if ($def_nntp_ports_info_chk == "")

 	$def_nntp_ports_type = "119";

 else 

 	$def_nntp_ports_type = "$def_nntp_ports_info_chk";

 	

 /* def RLOGIN_PORTS */

-$def_rlogin_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_rlogin_ports'];

+$def_rlogin_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_rlogin_ports'];

 if ($def_rlogin_ports_info_chk == "")

 	$def_rlogin_ports_type = "513";

 else 

 	$def_rlogin_ports_type = "$def_rlogin_ports_info_chk";

 	

 /* def RSH_PORTS */

-$def_rsh_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_rsh_ports'];

+$def_rsh_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_rsh_ports'];

 if ($def_rsh_ports_info_chk == "")

 	$def_rsh_ports_type = "514";

 else 

 	$def_rsh_ports_type = "$def_rsh_ports_info_chk";

 	

 /* def SSL_PORTS */

-$def_ssl_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][0]['def_ssl_ports'];

+$def_ssl_ports_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['def_ssl_ports'];

 if ($def_ssl_ports_info_chk == "")

 	$def_ssl_ports_type = "25,443,465,636,993,995";

 else 

@@ -729,8 +796,8 @@ else
 		$snort_ext_int = "ng0";

 

 	/* set the snort performance model */

-	if($config['installedpackages']['snortglobal']['rule'][0]['performance'])

-		$snort_performance = $config['installedpackages']['snortglobal']['rule'][0]['performance'];

+	if($config['installedpackages']['snortglobal']['rule'][$id]['performance'])

+		$snort_performance = $config['installedpackages']['snortglobal']['rule'][$id]['performance'];

 	else

 		$snort_performance = "lowmem";

 

@@ -1055,7 +1122,7 @@ function snort_rules_up_install_cron($should_install) {
 	fclose($whitelist);

 	

 	/* generate rule sections to load */

-	$enabled_rulesets = $config['installedpackages']['snortglobal']['rule'][0]['rulesets'];

+	$enabled_rulesets = $config['installedpackages']['snortglobal']['rule'][$id]['rulesets'];

 	if($enabled_rulesets) {

 		$selected_rules_sections = "";

 		$enabled_rulesets_array = split("\|\|", $enabled_rulesets);

@@ -1599,7 +1666,7 @@ function get_snort_alert($ip) {
 		if (preg_match("/\[\*\*\] (\[.*\]) (.*) (\[\*\*\])/", $fileline, $matches))

 			$alert_title = $matches[2];

 		if (preg_match("/(\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)/", $fileline, $matches))

-			$alert_ip = $matches[0];

+			$alert_ip = $matches[$id];

 		if($alert_ip == $ip) {

 			if(!$snort_config[$ip])

 				$snort_config[$ip] = $alert_title;

@@ -1612,7 +1679,7 @@ function get_snort_alert($ip) {
 function make_clickable($buffer) {

     global $config, $g;

     /* if clickable urls is disabled, simply return buffer back to caller */

-    $clickablalerteurls = $config['installedpackages']['snort']['config'][0]['oinkmastercode'];

+    $clickablalerteurls = $config['installedpackages']['snort']['config'][$id]['oinkmastercode'];

     if(!$clickablalerteurls)

     	return $buffer;

     $buffer = eregi_replace("(^|[ \n\r\t])((http(s?)://)(www\.)?([a-z0-9_-]+(\.[a-z0-9_-]+)+)(/[^/ \n\r]*)*)","\\1<a href=\"\\2\" target=\"_blank\">\\2</a>", $buffer);

diff --git a/config/snort-dev/snort_dynamic_ip_reload.php b/config/snort-dev/snort_dynamic_ip_reload.php
new file mode 100644
index 00000000..7c42c85f
--- /dev/null
+++ b/config/snort-dev/snort_dynamic_ip_reload.php
@@ -0,0 +1,59 @@
+<?php
+
+/* $Id$ */
+/*
+	snort_dynamic_ip_reload.php
+	Copyright (C) 2006 Scott Ullrich and Robert Zeleya
+	All rights reserved.
+
+	Redistribution and use in source and binary forms, with or without
+	modification, are permitted provided that the following conditions are met:
+
+	1. Redistributions of source code must retain the above copyright notice,
+	   this list of conditions and the following disclaimer.
+
+	2. Redistributions in binary form must reproduce the above copyright
+	   notice, this list of conditions and the following disclaimer in the
+	   documentation and/or other materials provided with the distribution.
+
+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+	POSSIBILITY OF SUCH DAMAGE.
+*/
+
+/* NOTE: this file gets included from the pfSense filter.inc plugin process */
+/* NOTE: file location /usr/local/pkg/pf, all files in pf dir get exec on filter reloads */
+
+require_once("/usr/local/pkg/snort/snort.inc");
+
+require_once("/usr/local/pkg/snort/snort.inc");
+
+/* get the varibles from the command line */
+/* Note: snort.sh sould only be using this */
+$id = $_SERVER["argv"][1];
+$if_real = $_SERVER["argv"][2];
+
+$test_iface = $config['installedpackages']['snortglobal']['rule'][$id]['interface'];
+
+if ($id == "" || $if_real == "" || $test_iface == "") {
+	exec("/usr/bin/logger -p daemon.info -i -t SnortDynIP \"ERORR starting snort_dynamic_ip_reload.php\"");
+	exit;
+	}
+
+if ($id != "" && $if_real != "") {
+	create_snort_conf();
+
+/* create barnyard2 configuration file */
+$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable'];
+if ($snortbarnyardlog_info_chk == on)
+       create_barnyard2_conf();
+}
+
+?>
\ No newline at end of file
diff --git a/config/snort-dev/snort_interfaces_edit.php b/config/snort-dev/snort_interfaces_edit.php
index f6fc2143..8d9def44 100644
--- a/config/snort-dev/snort_interfaces_edit.php
+++ b/config/snort-dev/snort_interfaces_edit.php
@@ -75,7 +75,7 @@ if (isset($_GET['dup']))
 /* convert fake interfaces to real */
 $if_real = convert_friendly_interface_to_real_interface_name($pconfig['interface']);
 
-if ($_POST) {
+if ($_POST["Submit"]) {
 
 	/* input validation */
 //	if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
@@ -160,21 +160,35 @@ if ($_POST) {
 				$a_nat[] = $natent;
 		}
 
-		touch($d_natconfdirty_path);
-
 		write_config();
 		// stop_service("snort");
 		//create_snort_conf();
 		//create_barnyard2_conf();
-		sync_package_snort();
-		// sleep(2);
-		// start_service("snort");
 
-		header("Location: snort_interfaces.php");
+		if ($pconfig['performance'] != "") {
+		sync_package_snort();
+		}
+		
+		if ($pconfig['performance'] != "") {		
+		header("Location: /snort/snort_interfaces_edit.php?id=$id");
+		}else{
+		touch($d_natconfdirty_path);
+		header("Location: /snort_interfaces.php");
+		}
 		exit;
 	}
 }
 
+		if ($_POST["Submit2"]) {
+		if ($pconfig['performance'] != "") {
+		sync_package_snort();
+		sleep(1);
+		exec("/bin/sh /usr/local/etc/rc.d/snort_{$id}{$if_real}.sh restart");
+		header("Location: /snort/snort_interfaces_edit.php?id=$id");
+		exit;
+			}
+		}
+
 $pgtitle = "Snort: Interface: $id$if_real Settings Edit";
 include("head.inc");
 
@@ -269,11 +283,8 @@ if($id != "")
 		{
 		
 		/* if base directories dont exist create them */
-		if(!file_exists("/usr/local/pkg/snort/snort_{$snortIf}_{$id}/"))
-			{
-			exec("/bin/mkdir -p /usr/local/pkg/snort/snort_{$snortIf}_{$id}/");
-			if(!file_exists("/usr/local/www/snort/snort_{$snortIf}_{$id}/"))
-			exec("/bin/mkdir -p /usr/local/www/snort/snort_{$snortIf}_{$id}/");
+			if(!file_exists("/usr/local/etc/snort/snort_{$id}{$if_real}/")) {
+			exec("/bin/mkdir -p /usr/local/etc/snort/snort_{$id}{$if_real}/");
 			}
 
     $tab_array = array();