snort-dev, add ips tab to rule db, add js ips table create

7 files changed, 319 insertions, 4 deletions

diff --git a/config/snort-dev/css/style_snort2.css b/config/snort-dev/css/style_snort2.css
index 6b5995cd..56fcb833 100644
--- a/config/snort-dev/css/style_snort2.css
+++ b/config/snort-dev/css/style_snort2.css
@@ -4,17 +4,16 @@
 a {
 	font-size: 11px;		
 }
-*/
-
+*/	
 
 #right {
 
 	position: relative;
 	top: -10px;
 	left: 0px;
-	width: 770px;
+	width: 800px;
 	margin-top: 0px;
-	margin-left: 5px;
+	margin-left: 0px;
 	margin-right: 5px;
 	padding-top: 20px;
 	padding-left: 0px;
diff --git a/config/snort-dev/snort_download_rules.inc b/config/snort-dev/snort_download_rules.inc
index e6a22477..8953a65c 100644
--- a/config/snort-dev/snort_download_rules.inc
+++ b/config/snort-dev/snort_download_rules.inc
@@ -207,6 +207,7 @@ function reapplyRuleSettings_run($sidRule_array)
 	// disable a sid
 	// sed -i '' "s/^\(alert.*sid:1225;.*\)/# \1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules	
 	// grep "^alert.*sid:.*;" rules/emerging-worm.rules | grep -oh "\w*sid:[0-9][^*;]\w*" | awk -F: '{print $2}'
+	// sed -n '/^320 || .*/{p;q;}' rules/ ../etc/sid-msg.map | awk -F '|' '{print $3}' | sed -e 's/^[ \t]*//'
 
 
 }
diff --git a/config/snort-dev/snort_install.inc b/config/snort-dev/snort_install.inc
index 1fb56780..c805d62c 100644
--- a/config/snort-dev/snort_install.inc
+++ b/config/snort-dev/snort_install.inc
@@ -252,6 +252,7 @@ function snort_postinstall()
 	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/close_9x9.gif');
 	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/new_tab_menu.png');
 	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/progress_bar2.gif');
+	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/progressbar.gif');
 	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/top_modal_bar_lil.jpg');
 	chdir ("/usr/local/www/snort/javascript/");
 	exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/javascript/jquery-1.6.2.min.js');
diff --git a/config/snort-dev/snort_interfaces_rules.php b/config/snort-dev/snort_interfaces_rules.php
index 2e2e7732..6c8f5a60 100644
--- a/config/snort-dev/snort_interfaces_rules.php
+++ b/config/snort-dev/snort_interfaces_rules.php
@@ -61,6 +61,7 @@ $a_rules = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'All', '');
 	$listOnRules = array();
 	$listOnRules = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'All', '');
 	
+	$listUsedRules = array();	
 	foreach ($listOnRules as $listOnRule)
 	{
 	
diff --git a/config/snort-dev/snort_json_get.php b/config/snort-dev/snort_json_get.php
index 84cc8ed7..965ac4de 100644
--- a/config/snort-dev/snort_json_get.php
+++ b/config/snort-dev/snort_json_get.php
@@ -46,6 +46,15 @@ require_once("/usr/local/pkg/snort/snort_new.inc");
 
 session_start(); // alwaya at the very top of a php page or "Cannot send session cache limiter - headers already sent"
 
+// get json blocls sids
+if ($_GET['snortsamjson'] == 1) {
+	
+	exec('cat /usr/local/etc/snort/sn_6TPXv7a/rules/dbBlockSplit/splitSidblock' . $_GET['fileid'] . '.block', $output);
+	echo $output[0];
+	
+}
+
+
 // upload created log tar to user
 if ($_GET['snortGetUpdate'] == 1) {
 	
diff --git a/config/snort-dev/snort_json_post.php b/config/snort-dev/snort_json_post.php
index 359dd23a..ee9d9ead 100644
--- a/config/snort-dev/snort_json_post.php
+++ b/config/snort-dev/snort_json_post.php
@@ -62,6 +62,19 @@ function snortJsonReturnCode($returnStatus)
 	}
 }
 
+// snortsam save settings
+if ($_POST['snortSamSaveSettings'] == 1) {
+
+	unset($_POST['snortSamSaveSettings']);
+	
+	function snortSamSaveFunc() 
+	{	
+		print_r($_POST[snortsam][db]);
+	}
+	snortSamSaveFunc();
+	
+}
+
 // row from db by uuid
 if ($_POST['snortSidRuleEdit'] == 1) {
 	
diff --git a/config/snort-dev/snort_ruleset_ips.php b/config/snort-dev/snort_ruleset_ips.php
new file mode 100644
index 00000000..18c49b35
--- /dev/null
+++ b/config/snort-dev/snort_ruleset_ips.php
@@ -0,0 +1,291 @@
+<?php
+/* $Id$ */
+/*
+ snort_interfaces.php
+ part of m0n0wall (http://m0n0.ch/wall)
+
+ Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
+ Copyright (C) 2008-2009 Robert Zelaya.
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once("guiconfig.inc");
+require_once("/usr/local/pkg/snort/snort_new.inc");
+require_once("/usr/local/pkg/snort/snort_gui.inc");
+
+// set page vars
+
+if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) {
+	echo 'Error: more than one uuid';
+	exit(0);
+}
+
+// set page vars
+if (isset($_GET['uuid'])) {
+	$uuid = $_GET['uuid'];
+}
+
+if (isset($_GET['rdbuuid'])) {
+	$rdbuuid = $_GET['rdbuuid'];
+}else{
+	$ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid);
+	$rdbuuid = $ruledbname_pre1['ruledbname'];
+}
+
+//$a_list = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'uuid', $uuid);
+
+// create dropdown list
+function snortDropDownListJson($list, $setting) {
+  foreach ($list as $iday => $iday2) {
+  
+    echo "\n" . "'<option value=\"{$iday}\"";  if($iday == $setting) echo " selected "; echo '>' . htmlspecialchars($iday2) . '</option>\' + "\n" +' . "\r";            
+      
+  } 
+}
+	
+	$countGetEnableSidArray = count($getEnableSid);	
+
+	$pgtitle = "Services: Snort: Ruleset Ips:";
+	include("/usr/local/pkg/snort/snort_head.inc");
+
+?>
+
+<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
+
+<div id="loadingWaiting">
+  <p class="loadingWaitingMessage"><img src="./images/loading.gif" /> <br>Please Wait...</p>
+</div>
+
+<?php include("fbegin.inc"); ?>
+<!-- hack to fix the hardcoed fbegin link in header -->
+<div id="header-left2">
+<a href="../index.php" id="status-link2">
+<img src="./images/transparent.gif" border="0"></img>
+</a>
+</div>
+
+<div class="body2"><!-- hack to fix the hardcoed fbegin link in header -->
+<div id="header-left2"><a href="../index.php" id="status-link2"><img src="./images/transparent.gif" border="0"></img></a></div>
+
+<form id="iform" >
+
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tr>
+		<td>
+
+		<div class="newtabmenu" style="margin: 1px 0px; width: 775px;"><!-- Tabbed bar code-->
+		<ul class="newtabmenu">
+				<li><a href="/snort/snort_interfaces.php"><span>Snort Interfaces</span></a></li>
+				<li><a href="/snort/snort_interfaces_edit.php?uuid=<?=$uuid;?>"><span>If Settings</span></a></li>
+				<li><a href="/snort/snort_rulesets.php?uuid=<?=$uuid;?>"><span>Categories</span></a></li>
+				<li><a href="/snort/snort_rules.php?uuid=<?=$uuid;?>"><span>Rules</span></a></li>
+				<li class="newtabmenu_active"><a href="/snort/snort_ruleset_ips.php?uuid=<?=$uuid;?>"><span>Ruleset Ips</span></a></li>
+				<li><a href="/snort/snort_define_servers.php?uuid=<?=$uuid;?>"><span>Servers</span></a></li>
+				<li><a href="/snort/snort_preprocessors.php?uuid=<?=$uuid;?>"><span>Preprocessors</span></a></li>
+				<li><a href="/snort/snort_barnyard.php?uuid=<?=$uuid;?>"><span>Barnyard2</span></a></li>			
+		</ul>
+		</div>
+
+		</td>
+	</tr>
+	<tr>
+		<td id="tdbggrey">		
+		<table width="100%" border="0" cellpadding="10px" cellspacing="0">
+		<tr>
+		<td class="tabnavtbl">
+		<table width="100%" border="0" cellpadding="6" cellspacing="0">
+		<!-- START MAIN AREA -->
+		
+		<tr>
+			<td>							
+				<input id="next" name="next" type="submit" class="formbtn" value=">>" />
+			</td>
+			<td>
+				<a class="getBlockFileNum" href="#" ><span>1</span></a>
+			</td>
+			<td>
+				<a class="getBlockFileNum" href="#" ><span>2</span></a>
+			</td>
+			<td>	
+				<input id="prev" name="prev" type="submit" class="formbtn" value="<<" >
+			</td>
+		</tr>	
+
+<table width="100%" border="0" cellpadding="10px" cellspacing="0">	
+		<input type="hidden" name="snortSamSaveSettings" value="1" /> <!-- what to do, save -->
+		<input type="hidden" name="dbName" value="snortDBrules" /> <!-- what db-->
+		<input type="hidden" name="dbTable" value="SnortruleSigsIps" /> <!-- what db table-->
+		<input type="hidden" name="ifaceTab" value="snort_ruleset_ips" /> <!-- what interface tab -->
+
+	<tr id="frheader" >
+		<td width="1%" class="listhdrr2">&nbsp;&nbsp;&nbsp;On</td>
+		<td width="1%" class="listhdrr2">&nbsp;&nbsp;&nbsp;Sid</td>
+		<td width="1%" class="listhdrr2">&nbsp;&nbsp;&nbsp;Source</td>
+		<td width="1%" class="listhdrr2">&nbsp;&nbsp;&nbsp;Amount</td>
+		<td width="1%" class="listhdrr2">&nbsp;&nbsp;&nbsp;Duration</td>
+		<td width="20%" class="listhdrr2">Message</td>												
+	</tr>
+	
+	<tbody class="rulesetloopblock">
+	
+	</tbody>
+	
+</table>
+<br>
+<table>
+<tr>
+	<td>
+		<input name="Submit" type="submit" class="formbtn" value="Save">
+		<input id="cancel" type="button" class="formbtn" value="Cancel">
+	</td>	
+</tr>
+</table>
+
+		</form >
+		<!-- STOP MAIN AREA -->
+		</table>
+		</td>
+		</tr>			
+		</table>
+	</td>
+	</tr>
+</table>
+</div>
+
+<script type="text/javascript">
+
+//prepare the form when the DOM is ready 
+jQuery(document).ready(function() {
+
+
+	jQuery('.getBlockFileNum').live('click', function(){
+		jQuery.getJSON("/snort/snort_json_get.php?snortsamjson=1", { fileid: this.text }, function(data) {
+			jQuery('.hidemetr').remove();
+			makeLargeSidTables(data);
+		});		
+	});	
+
+	//showLoading('#loadingWaiting');
+
+	// NOTE: needs to be watched
+	// change url on selected dropdown rule	
+	jQuery('select[name=selectbox]').change(function() {
+		window.location.replace(jQuery(this).val());
+	});
+
+function makeLargeSidTables(snortObjlist) {
+	
+	// disable Row Append if row count is less than 0
+	var countRowAppend = snortObjlist.length;
+	
+	// if rowcount is not empty do this
+	if (countRowAppend > 0){
+	
+		// Break up append row adds by chunks of 300
+		// NOTE: ie9 is still giving me issues on deleted.rules 6000 sigs. I should break up the json code above into smaller parts.
+		incrementallyProcess(function (i){
+		  // loop code goes in here
+	
+			if (isEven(i) === true){
+				var rowIsEvenOdd = 'odd_ruleset2';
+			}else{ 
+				var rowIsEvenOdd = 'even_ruleset2';
+			}
+			
+			if (snortObjlist[i].enable === 'on'){
+				var rulesetChecked = 'checked'; 
+			}else{
+				var rulesetChecked = '';
+			}
+		
+			jQuery('.rulesetloopblock').append(	
+					"\n" + '<tr class="hidemetr" id="ipstable_' + snortObjlist[i].sid + '" valign="top">' + "\n" +
+					'<td class="' + rowIsEvenOdd + '">' + "\n" +
+						'<input class="domecheck" id="checkbox_' + snortObjlist[i].sid + '" name="snortsam[db][' + snortObjlist[i].sid + '][enable]" value="' + snortObjlist[i].enable + '" checked="' + rulesetChecked + '" type="checkbox">' + "\n" +
+					'</td>' + "\n" +
+					'<td class="' + rowIsEvenOdd + '" id="sid_' + snortObjlist[i].sid + '" >' + snortObjlist[i].sid + '</td>' + "\n" +
+					'<td class="' + rowIsEvenOdd + '">' + "\n" +
+						'<select class="formfld2" id="who_' + snortObjlist[i].sid + '" name="snortsam[db][' + snortObjlist[i].sid + '][who]">' + "\n" +
+						<?php 					
+						$memoryPerfList = array('src' => 'SRC', 'dst' => 'DST', 'both' => 'BOTH');					
+						snortDropDownListJson($memoryPerfList, 'src');					
+						?>							
+						'</select>' + "\n" +
+					'</td>' + "\n" +
+					'<td class="' + rowIsEvenOdd + '">' + "\n" +
+						'<input class="formfld2" id="timeamount_' + snortObjlist[i].sid + '" name="snortsam[db][' + snortObjlist[i].sid + '][timeamount]" type="text" size="7" value="' + snortObjlist[i].timeamount + '">' + "\n" +
+					'</td>' + "\n" +
+						'<td class="' + rowIsEvenOdd + '">' + "\n" +
+						'<select class="formfld2" id="timetype_' + snortObjlist[i].sid + '" name="snortsam[db][' + snortObjlist[i].sid + '][timetype]" >' + "\n" +
+						<?php
+						// 'days', 'months', 'weeks', 'years', 'minutes', 'seconds', 'hours' ALWAYS		
+						$memoryPerfList = array('minutes' => 'MINUTES', 'seconds' => 'SECONDS', 'hours' => 'HOURS', 'days' => 'DAYS', 'weeks' => 'WEEKS', 'months' => 'MONTHS', 'ALWAYS' => 'ALWAYS', );					
+						snortDropDownListJson($memoryPerfList, 'days');					
+						?>
+						'</select>' + "\n" +
+					'</td>' + "\n" +
+					'<td class="listbg" id="msg_' + snortObjlist[i].sid + '"><font color="white">' + snortObjlist[i].msg + '</font></td>' + "\n" +
+				'</tr>' + "\n"					
+			);
+		  
+		}, 
+		snortObjlist,  // Object to work with the case Json object
+		500, // chunk size
+		200, // how many secs to wait
+		function (){
+		
+		// if rowcount is more than 300
+		if (countRowAppend > 200){		
+			// call to please wait	
+			hideLoading('#loadingWaiting');
+		}	
+		
+		}); // end incrament
+	} // end of if stopRowAppend
+	
+}; // END make table func
+
+
+jQuery.getJSON("/snort/snort_json_get.php?snortsamjson=1", { fileid: "1" }, function(data) {
+	jQuery('.hidemetr').remove();
+	makeLargeSidTables(data);
+});	
+
+}); // end of document ready
+
+
+
+
+</script>
+
+
+<!-- footer do not touch below -->
+<?php 
+include("fend.inc"); 
+echo $snort_custom_rnd_box;
+?>
+
+
+</body>
+</html>