diff options
| -rwxr-xr-x | config/snort/snort.inc | 217 | ||||
| -rw-r--r-- | config/snort/snort.priv.inc | 1 | ||||
| -rwxr-xr-x | config/snort/snort.xml | 9 | ||||
| -rwxr-xr-x | config/snort/snort_interfaces.php | 33 | ||||
| -rwxr-xr-x | config/snort/snort_interfaces_edit.php | 5 | ||||
| -rw-r--r-- | config/snort/snort_post_install.php | 58 | ||||
| -rw-r--r-- | config/snort/snort_service_utils.php | 121 |
7 files changed, 380 insertions, 64 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index fbeea89f..466efac1 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -551,7 +551,7 @@ function snort_barnyard_stop($snortcfg, $if_real) { $snort_uuid = $snortcfg['uuid']; if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) { - log_error("[Snort] Barnyard2 STOP for {$snortcfg['descr']}({$if_real})..."); + log_error("[Snort] Barnyard2 STOP for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); killbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid"); } } @@ -561,28 +561,35 @@ function snort_stop($snortcfg, $if_real) { $snort_uuid = $snortcfg['uuid']; if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) { - log_error("[Snort] Snort STOP for {$snortcfg['descr']}({$if_real})..."); + log_error("[Snort] Snort STOP for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); killbypid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid"); } snort_barnyard_stop($snortcfg, $if_real); } -function snort_barnyard_start($snortcfg, $if_real) { +function snort_barnyard_start($snortcfg, $if_real, $background=FALSE) { global $config, $g; $snortdir = SNORTDIR; $snortlogdir = SNORTLOGDIR; $snort_uuid = $snortcfg['uuid']; - /* define snortbarnyardlog_chk */ if ($snortcfg['barnyard_enable'] == 'on') { - log_error("[Snort] Barnyard2 START for {$snortcfg['descr']}({$if_real})..."); - mwexec("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q"); + if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) { + snort_barnyard_reload_config($snortcfg, "HUP"); + } + else { + log_error("[Snort] Barnyard2 START for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); + if ($background) + mwexec_bg("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q"); + else + mwexec("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q"); + } } } -function snort_start($snortcfg, $if_real) { +function snort_start($snortcfg, $if_real, $background=FALSE) { global $config, $g; $snortdir = SNORTDIR; @@ -590,27 +597,56 @@ function snort_start($snortcfg, $if_real) { $snort_uuid = $snortcfg['uuid']; if ($snortcfg['enable'] == 'on') { - log_error("[Snort] Snort START for {$snortcfg['descr']}({$if_real})..."); - mwexec("/usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}"); + if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) { + snort_reload_config($snortcfg, "SIGHUP"); + snort_barnyard_start($snortcfg, $if_real, $background); + } + else { + log_error("[Snort] Snort START for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); + if ($background) + mwexec_bg("/usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}"); + else + mwexec("/usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}"); + snort_barnyard_start($snortcfg, $if_real, $background); + } } else return; +} + +function snort_start_all_interfaces($background=FALSE) { + + /*************************************************************/ + /* This function starts all configured and enabled Snort */ + /* interfaces. */ + /*************************************************************/ + + global $g, $config; + + /* do nothing if no Snort interfaces active */ + if (!is_array($config['installedpackages']['snortglobal']['rule'])) + return; - snort_barnyard_start($snortcfg, $if_real); + foreach ($config['installedpackages']['snortglobal']['rule'] as $snortcfg) { + if ($snortcfg['enable'] != 'on') + continue; + snort_start($snortcfg, get_real_interface($snortcfg['interface']), $background); + } } -/**************************************************************/ -/* This function sends the passed SIGNAL to the Snort */ -/* instance on the passed interface to cause Snort to reload */ -/* and parse the running configuration without stopping */ -/* packet processing. It also executes the reload as a */ -/* background process and returns control immediately to the */ -/* caller. */ -/* */ -/* $signal = SIGHUP (default) parses and reloads config. */ -/* SIGURG updates Host Attribute Table. */ -/**************************************************************/ function snort_reload_config($snortcfg, $signal="SIGHUP") { + + /*************************************************************/ + /* This function sends the passed SIGNAL to the Snort */ + /* instance on the passed interface to cause Snort to */ + /* reload and parse the running configuration without */ + /* stopping packet processing. It also executes the */ + /* the reload as a background process and returns control */ + /* immediately to the caller. */ + /* */ + /* $signal = SIGHUP (default) parses and reloads config. */ + /* SIGURG updates Host Attribute Table. */ + /*************************************************************/ global $config, $g; $snortdir = SNORTDIR; @@ -622,23 +658,23 @@ function snort_reload_config($snortcfg, $signal="SIGHUP") { /* can find a valid PID for the process. */ /******************************************************/ if (isvalidpid("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) { - log_error("[Snort] Snort RELOAD CONFIG for {$snortcfg['descr']} ({$if_real})..."); + log_error("[Snort] Snort RELOAD CONFIG for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid"); } } function snort_barnyard_reload_config($snortcfg, $signal="HUP") { - /**************************************************************/ - /* This function sends the passed SIGNAL to the Barnyard2 */ - /* instance on the passed interface to cause Barnyard to */ - /* reload and parse the running configuration without */ - /* impacting packet processing. It also executes the reload */ - /* as a background process and returns control immediately */ - /* to the caller. */ - /* */ - /* $signal = HUP (default) parses and reloads config. */ - /**************************************************************/ + /*************************************************************/ + /* This function sends the passed SIGNAL to the Barnyard2 */ + /* instance on the passed interface to cause Barnyard to */ + /* reload and parse the running configuration without */ + /* impacting packet processing. It also executes the reload */ + /* as a background process and returns control immediately */ + /* to the caller. */ + /* */ + /* $signal = HUP (default) parses and reloads config. */ + /*************************************************************/ global $g; $snortdir = SNORTDIR; @@ -650,7 +686,7 @@ function snort_barnyard_reload_config($snortcfg, $signal="HUP") { /* we can find a valid PID for the process. */ /******************************************************/ if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid")) { - log_error("[Snort] Barnyard2 CONFIG RELOAD initiated for {$snortcfg['descr']} ({$if_real})..."); + log_error("[Snort] Barnyard2 CONFIG RELOAD initiated for " . convert_real_interface_to_friendly_descr($if_real) . "({$if_real})..."); mwexec_bg("/bin/pkill -{$signal} -F {$g['varrun_path']}/barnyard2_{$if_real}{$snort_uuid}.pid"); } } @@ -971,25 +1007,104 @@ function sync_snort_package_config() { /* do not start config build if rules is empty or there are no Snort settings */ if (!is_array($config['installedpackages']['snortglobal']) || !is_array($config['installedpackages']['snortglobal']['rule'])) { - @unlink("{$rcdir}snort.sh"); conf_mount_ro(); + + // Make sure no lingering <service> entries exist for Snort interfaces + $is_dirty = FALSE; + if (!is_array($config['installedpackges']['service'])) + $config['installedpackages']['service'] = array(); + foreach ($config['installedpackages']['service'] as $key => $service) { + if (strpos($service['name'], "snort_") !== FALSE) { + unset($config['installedpackages']['service'][$key]); + $is_dirty = TRUE; + } + if (strpos($service['name'], "barnyard2_") !== FALSE) { + unset($config['installedpackages']['service'][$key]); + $is_dirty = TRUE; + } + } + if ($is_dirty) + write_config("Snort pkg: removed snort interface service entry."); return; } $snortconf = $config['installedpackages']['snortglobal']['rule']; + $is_dirty = FALSE; foreach ($snortconf as $value) { + /* Skip configuration of any disabled interface */ + /* after removing its custom service entry. */ + if ($value['enable'] != 'on') { + foreach ($config['installedpackages']['service'] as $key => $service) { + if (isset($service['uuid']) && $service['uuid'] == $value['uuid'] && + $service['name'] == "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface']))) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/snort_{$uuid}.disabled"); + $is_dirty = TRUE; + } + if (isset($service['uuid']) && $service['uuid'] == $value['uuid'] && + $service['name'] == "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface']))) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/barnyard2_{$uuid}.disabled"); + $is_dirty = TRUE; + } + } + continue; + } + $if_real = get_real_interface($value['interface']); - /* create a snort.conf file for interface */ + /* create a snort.conf file for interface */ snort_generate_conf($value); - /* create barnyard2.conf file for interface */ + /* create barnyard2.conf file for interface */ if ($value['barnyard_enable'] == 'on') snort_generate_barnyard2_conf($value, $if_real); + + /* create a <service> entry for interface */ + $snort_found = FALSE; + $barnyard_found = FALSE; + foreach ($config['installedpackages']['service'] as $service) { + if (isset($service['uuid']) && $service['uuid'] == $value['uuid'] && + $service['name'] == "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface']))) { + $snort_found = TRUE; + } + if (isset($service['uuid']) && $service['uuid'] == $value['uuid'] && + $service['name'] == "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface']))) { + $barnyard_found = TRUE; + } + } + if (!$snort_found) { + $service = array(); + $service['name'] = "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface'])); + $service['description'] = "Snort IDS/IPS - " . convert_friendly_interface_to_friendly_descr($value['interface']); + $service['uuid'] = $value['uuid']; + $service['startcmd'] = "\$action='start';\$service='snort';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['stopcmd'] = "\$action='stop';\$service='snort';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['restartcmd'] = "\$action='restart';\$service='snort';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['custom_php_service_status_command'] = "\$action='status';\$service='snort';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $config['installedpackages']['service'][] = $service; + $is_dirty = TRUE; + } + if (!$barnyard_found && $value['barnyard_enable'] == 'on') { + $service = array(); + $service['name'] = "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($value['interface'])); + $service['description'] = "Barnyard2 Logging - " . convert_friendly_interface_to_friendly_descr($value['interface']); + $service['uuid'] = $value['uuid']; + $service['startcmd'] = "\$action='start';\$service='barnyard2';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['stopcmd'] = "\$action='stop';\$service='barnyard2';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['restartcmd'] = "\$action='restart';\$service='barnyard2';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['custom_php_service_status_command'] = "\$action='status';\$service='barnyard2';\$uuid={$value['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $config['installedpackages']['service'][] = $service; + $is_dirty = TRUE; + } } + // Call write_config() if we made any updates up above + if ($is_dirty) + write_config("Snort pkg: updated snort service entry configuration."); + /* create snort bootup file snort.sh only create once */ - snort_create_rc(); +// snort_create_rc(); $snortglob = $config['installedpackages']['snortglobal']; @@ -3067,6 +3182,26 @@ function snort_deinstall() { /* Remove the snort user and group */ mwexec('/usr/sbin/pw userdel snort; /usr/sbin/pw groupdel snort', true); + /* Remove our custom <service> entries from config */ + $is_dirty = FALSE; + if (!is_array($config['installedpackges']['service'])) + $config['installedpackages']['service'] = array(); + foreach ($config['installedpackages']['service'] as $key => $service) { + if (strpos($service['name'], "snort_") !== FALSE) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/snort_{$service['uuid']}.disabled"); + $is_dirty = TRUE; + continue; + } + if (strpos($service['name'], "barnyard2_") !== FALSE) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/barnyard2_{$service['uuid']}.disabled"); + $is_dirty = TRUE; + } + } + if ($is_dirty) + write_config("Snort pkg: removed all snort interface services."); + /* Remove all the existing Snort cron jobs. */ if (snort_cron_job_exists("snort2c", FALSE)) install_cron_job("snort2c", false); @@ -3765,12 +3900,8 @@ function snort_do_xmlrpc_sync($syncdownloadrules, $sync_to_ip, $port, $username, } $snortstart = ""; if ($syncstartsnort == "ON") { - $snortstart = "log_error(gettext(\"[snort] XMLRPC pkg sync: Checking Snort status...\"));\n"; - $snortstart .= "\tif (!is_process_running(\"snort\")) {\n"; - $snortstart .= "\t\tlog_error(gettext(\"[snort] XMLRPC pkg sync: Snort not running. Sending a start command...\"));\n"; - $snortstart .= "\t\t\$sh_script = RCFILEPREFIX . \"snort.sh\";\n"; - $snortstart .= "\t\tmwexec_bg(\"{\$sh_script} start\");\n\t}\n"; - $snortstart .= "\telse {\n\t\tlog_error(gettext(\"[snort] XMLRPC pkg CARP sync: Snort is running...\"));\n\t}\n"; + $snortstart = "log_error(gettext(\"[snort] XMLRPC pkg sync: Starting Snort if not running...\"));\n"; + $snortstart .= "\tsnort_start_all_interfaces(TRUE);\n"; } /*************************************************/ diff --git a/config/snort/snort.priv.inc b/config/snort/snort.priv.inc index 1af0e783..7376a1b2 100644 --- a/config/snort/snort.priv.inc +++ b/config/snort/snort.priv.inc @@ -43,6 +43,7 @@ $priv_list['page-services-snort']['match'][] = "snort/snort_iprep_list_browser.p $priv_list['page-services-snort']['match'][] = "snort/snort_generate_conf.php*"; $priv_list['page-services-snort']['match'][] = "snort/snort_interface_logs.php*"; $priv_list['page-services-snort']['match'][] = "snort/snort_log_mgmt.php*"; +$priv_list['page-services-snort']['match'][] = "snort/snort_service_utils.php*"; $priv_list['page-services-snort']['match'][] = "widgets/javascript/snort_alerts.js*"; $priv_list['page-services-snort']['match'][] = "widgets/include/widget-snort.inc*"; $priv_list['page-services-snort']['match'][] = "widgets/widgets/snort_alerts.widget.php*"; diff --git a/config/snort/snort.xml b/config/snort/snort.xml index b52a1b7e..573f8914 100755 --- a/config/snort/snort.xml +++ b/config/snort/snort.xml @@ -56,10 +56,6 @@ <url>/snort/snort_interfaces.php</url> </menu> <service> - <name>snort</name> - <rcfile>snort.sh</rcfile> - <executable>snort</executable> - <description>Snort IDS/IPS Daemon</description> </service> <tabs> </tabs> @@ -91,6 +87,11 @@ <additional_files_needed> <prefix>/usr/local/pkg/snort/</prefix> <chmod>077</chmod> + <item>https://packages.pfsense.org/packages/config/snort/snort_service_utils.php</item> + </additional_files_needed> + <additional_files_needed> + <prefix>/usr/local/pkg/snort/</prefix> + <chmod>077</chmod> <item>https://packages.pfsense.org/packages/config/snort/snort_sync.xml</item> </additional_files_needed> <additional_files_needed> diff --git a/config/snort/snort_interfaces.php b/config/snort/snort_interfaces.php index 697e611e..7903eba7 100755 --- a/config/snort/snort_interfaces.php +++ b/config/snort/snort_interfaces.php @@ -55,6 +55,18 @@ if (isset($_POST['del_x'])) { foreach ($_POST['rule'] as $rulei) { $if_real = get_real_interface($a_nat[$rulei]['interface']); $snort_uuid = $a_nat[$rulei]['uuid']; + foreach ($config['installedpackages']['service'] as $key => $service) { + if (isset($service['uuid']) && $service['uuid'] == $snort_uuid && + $service['name'] == "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($a_nat[$rulei]['interface']))) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/snort_{$snort_uuid}.disabled"); + } + if (isset($service['uuid']) && $service['uuid'] == $snort_uuid && + $service['name'] == "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($a_nat[$rulei]['interface']))) { + unset($config['installedpackages']['service'][$key]); + unlink_if_exists("{$g['varrun_path']}/barnyard2_{$snort_uuid}.disabled"); + } + } snort_stop($a_nat[$rulei], $if_real); exec("/bin/rm -r {$snortlogdir}/snort_{$if_real}{$snort_uuid}"); exec("/bin/rm -r {$snortdir}/snort_{$snort_uuid}_{$if_real}"); @@ -71,15 +83,6 @@ if (isset($_POST['del_x'])) { write_config("Snort pkg: deleted one or more Snort interfaces."); sleep(2); - /* if there are no ifaces remaining do not create snort.sh */ - if (!empty($config['installedpackages']['snortglobal']['rule'])) - snort_create_rc(); - else { - conf_mount_rw(); - @unlink("{$rcdir}snort.sh"); - conf_mount_ro(); - } - sync_snort_package_config(); header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); @@ -100,11 +103,13 @@ if ($_POST['bartoggle'] && is_numericint($_POST['id'])) { $if_friendly = convert_friendly_interface_to_friendly_descr($snortcfg['interface']); if (!snort_is_running($snortcfg['uuid'], $if_real, 'barnyard2')) { - log_error("Toggle (barnyard starting) for {$if_friendly}({$snortcfg['descr']})..."); + log_error("Toggle (barnyard starting) for {$if_friendly}({$if_real})..."); sync_snort_package_config(); snort_barnyard_start($snortcfg, $if_real); + unlink_if_exists("{$g['varrun_path']}/barnyard2_{$snortcfg['uuid']}.disabled"); } else { - log_error("Toggle (barnyard stopping) for {$if_friendly}({$snortcfg['descr']})..."); + log_error("Toggle (barnyard stopping) for {$if_friendly}({$if_real})..."); + touch("{$g['varrun_path']}/barnyard2_{$snortcfg['uuid']}.disabled"); snort_barnyard_stop($snortcfg, $if_real); } sleep(3); // So the GUI reports correctly @@ -117,16 +122,18 @@ if ($_POST['toggle'] && is_numericint($_POST['id'])) { $if_friendly = convert_friendly_interface_to_friendly_descr($snortcfg['interface']); if (snort_is_running($snortcfg['uuid'], $if_real)) { - log_error("Toggle (snort stopping) for {$if_friendly}({$snortcfg['descr']})..."); + log_error("Toggle (snort stopping) for {$if_friendly}({$if_real})..."); + touch("{$g['varrun_path']}/snort_{$snortcfg['uuid']}.disabled"); snort_stop($snortcfg, $if_real); } else { - log_error("Toggle (snort starting) for {$if_friendly}({$snortcfg['descr']})..."); + log_error("Toggle (snort starting) for {$if_friendly}({$if_real})..."); /* set flag to rebuild interface rules before starting Snort */ $rebuild_rules = true; sync_snort_package_config(); $rebuild_rules = false; snort_start($snortcfg, $if_real); + unlink_if_exists("{$g['varrun_path']}/snort_{$snortcfg['uuid']}.disabled"); } sleep(3); // So the GUI reports correctly } diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php index a49d6198..aff9b4f7 100755 --- a/config/snort/snort_interfaces_edit.php +++ b/config/snort/snort_interfaces_edit.php @@ -224,6 +224,7 @@ if ($_POST["save"] && !$input_errors) { if ($natent['interface'] != $a_rule[$id]['interface']) { $oif_real = get_real_interface($a_rule[$id]['interface']); if (snort_is_running($a_rule[$id]['uuid'], $oif_real)) { + touch("{$g['varrun_path']}/snort_{$a_rule[$id]['uuid']}.disabled"); snort_stop($a_rule[$id], $oif_real); $snort_start = true; } @@ -378,8 +379,10 @@ if ($_POST["save"] && !$input_errors) { sync_snort_package_config(); /* See if we need to restart Snort after an interface re-assignment */ - if ($snort_start == true) + if ($snort_start == true) { snort_start($natent, $if_real); + unlink_if_exists("{$g['varrun_path']}/snort_{$natent['uuid']}.disabled"); + } /*******************************************************/ /* Signal Snort to reload configuration if we changed */ diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php index 715adae2..5c47e151 100644 --- a/config/snort/snort_post_install.php +++ b/config/snort/snort_post_install.php @@ -220,10 +220,51 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') { // create barnyard2.conf file for interface if ($snortcfg['barnyard_enable'] == 'on') snort_generate_barnyard2_conf($snortcfg, $if_real); + + if ($snortcfg['enable'] != 'on') + continue; + + // Create a custom <service> entry for each enabled interface + $snort_found = FALSE; + $barnyard_found = FALSE; + foreach ($config['installedpackages']['service'] as $service) { + if (isset($service['uuid']) && $service['uuid'] == $snortcfg['uuid'] && + $service['name'] == "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($snortcfg['interface']))) { + $snort_found = TRUE; + } + if (isset($service['uuid']) && $service['uuid'] == $snortcfg['uuid'] && + $service['name'] == "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($snortcfg['interface']))) { + $barnyard_found = TRUE; + } + } + if (!$snort_found) { + $service = array(); + $service['name'] = "snort_" . strtolower(convert_friendly_interface_to_friendly_descr($snortcfg['interface'])); + $service['description'] = "Snort IDS/IPS - " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']); + $service['uuid'] = $snortcfg['uuid']; + $service['startcmd'] = "\$action='start';\$service='snort';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['stopcmd'] = "\$action='stop';\$service='snort';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['restartcmd'] = "\$action='restart';\$service='snort';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['custom_php_service_status_command'] = "\$action='status';\$service='snort';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $config['installedpackages']['service'][] = $service; + $is_dirty = TRUE; + } + if (!$barnyard_found && $snortcfg['barnyard_enable'] == 'on') { + $service = array(); + $service['name'] = "barnyard2_" . strtolower(convert_friendly_interface_to_friendly_descr($snortcfg['interface'])); + $service['description'] = "Barnyard2 Logging - " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']); + $service['uuid'] = $snortcfg['uuid']; + $service['startcmd'] = "\$action='start';\$service='barnyard2';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['stopcmd'] = "\$action='stop';\$service='barnyard2';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['restartcmd'] = "\$action='restart';\$service='barnyard2';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $service['custom_php_service_status_command'] = "\$action='status';\$service='barnyard2';\$uuid={$snortcfg['uuid']};\$rc = include '/usr/local/pkg/snort/snort_service_utils.php';"; + $config['installedpackages']['service'][] = $service; + $is_dirty = TRUE; + } } /* create snort bootup file snort.sh */ - snort_create_rc(); +// snort_create_rc(); /* Set Log Limit, Block Hosts Time and Rules Update Time */ snort_snortloglimit_install_cron(true); @@ -244,8 +285,19 @@ if ($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') { update_status(gettext("Starting Snort using rebuilt configuration...")); update_output_window(gettext("Please wait... while Snort is started...")); log_error(gettext("[Snort] Starting Snort using rebuilt configuration...")); - mwexec_bg("{$rcdir}snort.sh start"); - update_output_window(gettext("Snort is starting using the rebuilt configuration...")); +// mwexec_bg("{$rcdir}snort.sh start"); + foreach ($config['installedpackages']['snortglobal']['rule'] as $snortcfg) { + if ($snortcfg['enable'] != 'on') + continue; + $if_real = get_real_interface($snortcfg['interface']); + $snort_uuid = $snortcfg['uuid']; + update_output_window(gettext("Snort starting on " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']))); + log_error("[Snort] Snort START for " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . "({$if_real})..."); + mwexec_bg("/usr/local/bin/snort -R {$snort_uuid} -D -q -l {$snortlogdir}/snort_{$if_real}{$snort_uuid} --pid-path {$g['varrun_path']} --nolock-pidfile -G {$snort_uuid} -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}"); + if ($snortcfg['barnyard_enable'] == 'on') + mwexec_bg("/usr/local/bin/barnyard2 -r {$snort_uuid} -f \"snort_{$snort_uuid}_{$if_real}.u2\" --pid-path {$g['varrun_path']} --nolock-pidfile -c {$snortdir}/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d {$snortlogdir}/snort_{$if_real}{$snort_uuid} -D -q"); + } + update_output_window(gettext("Snort has started using the rebuilt configuration...")); } } diff --git a/config/snort/snort_service_utils.php b/config/snort/snort_service_utils.php new file mode 100644 index 00000000..f04987b2 --- /dev/null +++ b/config/snort/snort_service_utils.php @@ -0,0 +1,121 @@ +<?php +/* + * snort_service_utils.php + * + * Copyright (C) 2006 Scott Ullrich + * Copyright (C) 2009-2010 Robert Zelaya + * Copyright (C) 2011-2012 Ermal Luci + * Copyright (C) 2013,2014 Bill Meeks + * part of pfSense + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/***************************************************************************** + * This file is called by the custom service start, stop and status handlers * + * created for each enabled Snort and Barnyard interface. The calling code * + * is expected to set the following varibles to indicate the action desired. * + * * + * $action = start, stop, restart or status * + * $service = executable to act upon (snort or barnyard2) * + * $uuid = Unique Identifier ID for the rule interface * + * * + *****************************************************************************/ + +require_once("/usr/local/pkg/snort/snort.inc"); + +global $g, $config; + +if (empty($uuid)) { + log_error(gettext("[Snort] error in snort_service_utils.php ... no UUID provided.")); + return FALSE; +} +if (strtolower($service) != "snort" && strtolower($service) != "barnyard2") { + log_error(gettext("[Snort] error in snort_service_utils.php ... unrecognized service '{$service}' provided.")); + return FALSE; +} + +$service = strtolower($service); +$action = strtolower($action); + +// First find the correct [rule] index in our config using the UUID +if (!is_array($config['installedpackages']['snortglobal']['rule'])) + return FALSE; +foreach ($config['installedpackages']['snortglobal']['rule'] as $rule) { + if ($rule['uuid'] == $uuid) { + $if_real = get_real_interface($rule['interface']); + + // If interface is manually stopped, then don't try to start it + if (($action == 'start' || $action == 'restart') && file_exists("{$g['varrun_path']}/{$service}_{$uuid}.disabled")) { + log_error(gettext("[Snort] auto-start locked out by previous manual shutdown...must be started using Snort INTERFACES tab.")); + return FALSE; + } + + switch ($action) { + case 'start': + if ($service == "snort") + snort_start($rule, $if_real, TRUE); + elseif ($service == "barnyard2") + snort_barnyard_start($rule, $if_real, TRUE); + else + return FALSE; + return TRUE; + + case 'stop': + if ($service == "snort") + snort_stop($rule, $if_real); + elseif ($service == "barnyard2") + snort_barnyard_stop($rule, $if_real); + else + return FALSE; + return TRUE; + + case 'restart': + if ($service == "snort") { + snort_stop($rule, $if_real); + sleep(1); + snort_start($rule, $if_real, TRUE); + } + elseif ($service == "barnyard2") { + snort_barnyard_stop($rule, $if_real); + sleep(1); + snort_barnyard_start($rule, $if_real, TRUE); + } + else + return FALSE; + return TRUE; + + case 'status': + if (isvalidpid("{$g['varrun_path']}/{$service}_{$if_real}{$uuid}.pid")) + return TRUE; + else + return FALSE; + + default: + log_error(gettext("[Snort] error in snort_service_utils.php ... unrecognized action '{$action}' provided.")); + return FALSE; + } + } +} + +?> |