aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--config/snort/snort.inc128
-rw-r--r--config/snort/snort_interfaces.php3
-rw-r--r--config/snort/snort_interfaces_edit.php27
-rw-r--r--config/snort/snort_interfaces_suppress_edit.php14
-rw-r--r--config/snort/snort_interfaces_whitelist_edit.php6
5 files changed, 69 insertions, 109 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc
index c375766f..cbbebf26 100644
--- a/config/snort/snort.inc
+++ b/config/snort/snort.inc
@@ -79,7 +79,7 @@ function find_whitelist_key($find_wlist_number) {
return 0; /* XXX */
foreach ($config['installedpackages']['snortglobal']['whitelist']['item'] as $w_key => $value) {
- if ($value['uuid'] == $find_wlist_number)
+ if ($value['name'] == $find_wlist_number)
return $w_key;
}
}
@@ -93,8 +93,8 @@ function find_suppress_key($find_slist_number) {
if (!is_array($config['installedpackages']['snortglobal']['suppress']['item']))
return 0; /* XXX */
- foreach ($config['installedpackages']['snortglobal']['supppress']['item'] as $s_key => $value) {
- if ($value['uuid'] == $find_slist_number)
+ foreach ($config['installedpackages']['snortglobal']['suppress']['item'] as $s_key => $value) {
+ if ($value['name'] == $find_slist_number)
return $s_key;
}
}
@@ -1023,12 +1023,6 @@ function sync_snort_package_all($id, $if_real, $snort_uuid)
$result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface'];
$if_real = snort_get_real_interface($result_lan);
- /* create snort configuration file */
- create_snort_conf($id, $if_real, $snort_uuid);
-
- /* if rules exist cp rules to each iface */
- create_rules_iface($id, $if_real, $snort_uuid);
-
/* only build whitelist when needed */
if ($config['installedpackages']['snortglobal']['rule'][$id]['blockoffenders7'] == 'on')
create_snort_whitelist($id, $if_real);
@@ -1037,6 +1031,12 @@ function sync_snort_package_all($id, $if_real, $snort_uuid)
if ($config['installedpackages']['snortglobal']['rule'][$id]['suppresslistname'] != 'default')
create_snort_suppress($id, $if_real);
+ /* create snort configuration file */
+ create_snort_conf($id, $if_real, $snort_uuid);
+
+ /* if rules exist cp rules to each iface */
+ create_rules_iface($id, $if_real, $snort_uuid);
+
/* create snort bootup file snort.sh only create once */
create_snort_sh();
@@ -1073,12 +1073,6 @@ function sync_snort_package_empty()
$snort_uuid = $value['uuid'];
if ($if_real != '' && $snort_uuid != '') {
-
- /* create snort configuration file */
- create_snort_conf($id, $if_real, $snort_uuid);
-
- /* if rules exist cp rules to each iface */
- create_rules_iface($id, $if_real, $snort_uuid);
/* only build whitelist when needed */
if ($value['blockoffenders7'] == 'on')
@@ -1088,6 +1082,12 @@ function sync_snort_package_empty()
if ($value['suppresslistname'] != 'default')
create_snort_suppress($id, $if_real);
+ /* create snort configuration file */
+ create_snort_conf($id, $if_real, $snort_uuid);
+
+ /* if rules exist cp rules to each iface */
+ create_rules_iface($id, $if_real, $snort_uuid);
+
/* create barnyard2 configuration file */
$snortbarnyardlog_info_chk = $value['barnyard_enable'];
if ($snortbarnyardlog_info_chk == 'on')
@@ -1130,9 +1130,6 @@ function sync_snort_package_config()
if (!empty($if_real) && !empty($snort_uuid)) {
- /* create snort configuration file */
- create_snort_conf($id, $if_real, $snort_uuid);
-
/* only build whitelist when needed */
if ($value['blockoffenders7'] == 'on')
create_snort_whitelist($id, $if_real);
@@ -1141,6 +1138,9 @@ function sync_snort_package_config()
if ($value['suppresslistname'] != 'default')
create_snort_suppress($id, $if_real);
+ /* create snort configuration file */
+ create_snort_conf($id, $if_real, $snort_uuid);
+
/* create barnyard2 configuration file */
if ($value['barnyard_enable'] == 'on')
create_barnyard2_conf($id, $if_real, $snort_uuid);
@@ -1167,28 +1167,21 @@ function create_snort_suppress($id, $if_real) {
return;
if ($config['installedpackages']['snortglobal']['rule'][$id]['suppresslistname'] != 'default') {
+ $whitelist_key_s = find_suppress_key($config['installedpackages']['snortglobal']['rule'][$id]['suppresslistname']);
+ if (empty($whitelist_key_s))
+ return "";
- if (preg_match('/([0-9]+)$/', $config['installedpackages']['snortglobal']['rule'][$id]['suppresslistname'], $slist_num_wrt)) {
- $whitelist_key_s = find_suppress_key($slist_num_wrt[0]);
+ /* file name */
+ $suppress_file_name = $config['installedpackages']['snortglobal']['suppress']['item'][$whitelist_key_s]['name'];
- /* file name */
- $suppress_file_name = $config['installedpackages']['snortglobal']['suppress']['item'][$whitelist_key_s]['name'];
-
- /* Message */
- $s_data .= '# This file is auto generated by the snort package. Please do not edit this file by hand.' . "\n\n";
+ /* Message */
+ $s_data .= '# This file is auto generated by the snort package. Please do not edit this file by hand.' . "\n\n";
- /* user added arguments */
- $s_data .= str_replace("\r", "", base64_decode($config['installedpackages']['snortglobal']['suppress']['item'][$whitelist_key_s]['suppresspassthru']));
+ /* user added arguments */
+ $s_data .= str_replace("\r", "", base64_decode($config['installedpackages']['snortglobal']['suppress']['item'][$whitelist_key_s]['suppresspassthru']));
- /* open snort's whitelist for writing */
- $suppresslist_w = fopen("/usr/local/etc/snort/suppress/$suppress_file_name", "w");
- if(!$suppresslist_w) {
- log_error("Could not open /usr/local/etc/snort/suppress/$suppress_file_name for writing.");
- return;
- }
- fwrite($suppresslist_w, $s_data);
- fclose($suppresslist_w);
- }
+ /* open snort's whitelist for writing */
+ @file_put_contents("/usr/local/etc/snort/suppress/$suppress_file_name", $s_data);
}
}
@@ -1204,39 +1197,20 @@ function create_snort_whitelist($id, $if_real) {
$w_data = build_base_whitelist('whitelist', 'yes', 'yes', 'yes', 'yes', 'yes', 'no');
/* open snort's whitelist for writing */
- $whitelist_w = fopen("/usr/local/etc/snort/whitelist/defaultwlist", "w");
- if (!$whitelist_w) {
- log_error("Could not open /usr/local/etc/snort/whitelist/defaultwlist for writing.");
- return;
- }
- fwrite($whitelist_w, $w_data);
- fclose($whitelist_w);
-
- } else if (preg_match('/^([a-zA-z0-9]+)/', $config['installedpackages']['snortglobal']['rule'][$id]['whitelistname'], $wlist_name_wrt)) {
- if (preg_match('/([0-9]+)$/', $config['installedpackages']['snortglobal']['rule'][$id]['whitelistname'], $wlist_num_wrt)) {
- $whitelist_key_w = find_whitelist_key($wlist_num_wrt[0]);
+ @file_put_contents("/usr/local/etc/snort/whitelist/defaultwlist", $w_data);
- if (!is_array($config['installedpackages']['snortglobal']['whitelist']['item']))
- return;
+ } else if (!empty($config['installedpackages']['snortglobal']['rule'][$id]['whitelistname'])) {
+ $whitelist_key_w = find_whitelist_key($config['installedpackages']['snortglobal']['rule'][$id]['whitelistname']);
- $build_netlist = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['snortlisttype'];
- $wanip = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['wanips'];
- $wangw = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['wangateips'];
- $wandns = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['wandnsips'];
- $vips = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['vips'];
- $vpns = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w]['vpnips'];
+ if (!is_array($config['installedpackages']['snortglobal']['whitelist']['item']))
+ return;
- $w_data = build_base_whitelist($build_netlist, $wanip, $wangw, $wandns, $vips, $vpns, $whitelist_key_w);
+ $whitelist = $config['installedpackages']['snortglobal']['whitelist']['item'][$whitelist_key_w];
+ $w_data = build_base_whitelist($whitelist['snortlisttype'], $whitelist['wanips'], $whitelist['wangateips'],
+ $whitelist['wandnsips'], $whitelist['vips'], $whitelist['vpnips'], $whitelist_key_w);
- /* open snort's whitelist for writing */
- $whitelist_w = fopen("/usr/local/etc/snort/whitelist/$wlist_name_wrt[0]", "w");
- if(!$whitelist_w) {
- log_error("Could not open /usr/local/etc/snort/whitelist/$wlist_name_wrt[0] for writing.");
- return;
- }
- fwrite($whitelist_w, $w_data);
- fclose($whitelist_w);
- }
+ /* open snort's whitelist for writing */
+ @file_put_contents("/usr/local/etc/snort/whitelist/" . $config['installedpackages']['snortglobal']['rule'][$id]['whitelistname'], $w_data);
}
}
@@ -1245,8 +1219,8 @@ function create_snort_homenet($id, $if_real) {
if ($config['installedpackages']['snortglobal']['rule'][$id]['homelistname'] == 'default' || $config['installedpackages']['snortglobal']['rule'][$id]['homelistname'] == '')
return build_base_whitelist('netlist', 'yes', 'yes', 'yes', 'yes', 'yes', 'no');
- else if (preg_match('/([0-9]+)$/', $config['installedpackages']['snortglobal']['rule'][$id]['homelistname'], $hlist_num_wrt)) {
- $whitelist_key_h = find_whitelist_key($hlist_num_wrt[0]);
+ else if (!empty($config['installedpackages']['snortglobal']['rule'][$id]['homelistname'])) {
+ $whitelist_key_h = find_whitelist_key($config['installedpackages']['snortglobal']['rule'][$id]['homelistname']);
if (!is_array($config['installedpackages']['snortglobal']['whitelist']['item']))
return;
@@ -1265,8 +1239,8 @@ function create_snort_homenet($id, $if_real) {
function create_snort_externalnet($id, $if_real) {
global $config, $g;
- if (preg_match('/([0-9]+)$/', $config['installedpackages']['snortglobal']['rule'][$id]['externallistname'], $exlist_num_wrt)) {
- $whitelist_key_ex = find_whitelist_key($exlist_num_wrt[0]);
+ if (!empty($config['installedpackages']['snortglobal']['rule'][$id]['externallistname'])) {
+ $whitelist_key_ex = find_whitelist_key($config['installedpackages']['snortglobal']['rule'][$id]['externallistname']);
if (!is_array($config['installedpackages']['snortglobal']['whitelist']['item']))
return;
@@ -1740,23 +1714,19 @@ function generate_snort_conf($id, $if_real, $snort_uuid)
/* define spoink */
$spoink_type = "";
if ($snortcfg['blockoffenders7'] == "on") {
- if (preg_match('/^([a-zA-z0-9]+)/', $snortcfg['whitelistname'], $wlist_name_file)) {
- if ($wlist_name_file[0] == 'default')
- $spoink_whitelist_name = 'defaultwlist';
- else
- $spoink_whitelist_name = $wlist_name_file[0];
+ if ($snortcfg['whitelistname'] == "default")
+ $spoink_whitelist_name = 'defaultwlist';
+ else if (file_exists("/usr/local/etc/snort/whitelist/{$snortcfg['whitelistname']}"))
+ $spoink_whitelist_name = $snortcfg['whitelistname'];
- $spoink_type = "output alert_pf: /usr/local/etc/snort/whitelist/{$spoink_whitelist_name},snort2c";
- }
+ $spoink_type = "output alert_pf: /usr/local/etc/snort/whitelist/{$spoink_whitelist_name},snort2c";
}
/* define threshold file */
$threshold_file_name = "";
if ($snortcfg['suppresslistname'] != 'default') {
- if (preg_match('/^([a-zA-z0-9]+)/', $snortcfg['suppresslistname'], $slist_name_file2)) {
- $threshold_name = $slist_name_file2[0];
+ if (file_exists("/usr/local/etc/snort/suppress/{$snortcfg['suppresslistname']}"))
$threshold_file_name = "include /usr/local/etc/snort/suppress/{$threshold_name}";
- }
}
/* define servers and ports snortdefservers */
diff --git a/config/snort/snort_interfaces.php b/config/snort/snort_interfaces.php
index a192ca43..1d91eda8 100644
--- a/config/snort/snort_interfaces.php
+++ b/config/snort/snort_interfaces.php
@@ -157,7 +157,6 @@ if ($_GET['act'] == 'toggle' && is_numeric($id)) {
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' );
- header("Location: /snort/snort_interfaces.php");
}else{
@@ -168,8 +167,8 @@ if ($_GET['act'] == 'toggle' && is_numeric($id)) {
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' );
- header("Location: /snort/snort_interfaces.php");
}
+ header("Location: /snort/snort_interfaces.php");
exit;
}
diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php
index a67ba2ac..019a8af0 100644
--- a/config/snort/snort_interfaces_edit.php
+++ b/config/snort/snort_interfaces_edit.php
@@ -648,24 +648,19 @@ function enable_change(enable_change) {
class="formfld" id="suppresslistname">
<?php
/* find whitelist names and filter by type, make sure to track by uuid */
- $slist_select = $config['installedpackages']['snortglobal']['suppress']['item'];
- $sid = -1;
if ($pconfig['suppresslistname'] == 'default'){ $selected = 'selected'; }
- preg_match('/^([a-zA-z0-9]+)/', $pconfig['suppresslistname'], $slist_sub);
- echo "<option value=\"default\" $selected>default</option>
- ";
- foreach ($slist_select as $value):
- $sid += 1;
- $ilistname = $config['installedpackages']['snortglobal']['suppress']['item'][$sid]['name'];
- $suppress_uuid = $config['installedpackages']['snortglobal']['suppress']['item'][$sid]['uuid'];
- if ($ilistname == $slist_sub[0]){
- echo "<option value=\"$ilistname $suppress_uuid\" selected>";
- }else{
- echo "<option value=\"$ilistname $suppress_uuid\">";
+ echo "<option value=\"default\" $selected>default</option>";
+ if (is_array($config['installedpackages']['snortglobal']['suppress']['item'])) {
+ $slist_select = $config['installedpackages']['snortglobal']['suppress']['item'];
+ foreach ($slist_select as $value) {
+ $ilistname = $value['name'];
+ if ($ilistname == $pconfig['suppresslistname'])
+ echo "<option value='$ilistname' selected>";
+ else
+ echo "<option value='$ilistname'>";
+ echo htmlspecialchars($ilistname) . '</option>';
+ }
}
- echo htmlspecialchars($ilistname) . '</option>
- ';
- endforeach;
?>
</select><br>
<span class="vexpl">Choose the suppression or filtering file you
diff --git a/config/snort/snort_interfaces_suppress_edit.php b/config/snort/snort_interfaces_suppress_edit.php
index bf916500..7303349f 100644
--- a/config/snort/snort_interfaces_suppress_edit.php
+++ b/config/snort/snort_interfaces_suppress_edit.php
@@ -52,8 +52,8 @@ if (!is_numeric($id))
$id = 0; // XXX: safety belt
-/* gen uuid for each iface !inportant */
-if (!is_array($config['installedpackages']['snortglobal']['suppress']['item'][$id])) {
+/* gen uuid for each iface */
+if (is_array($config['installedpackages']['snortglobal']['suppress']['item'][$id])) {
if ($config['installedpackages']['snortglobal']['suppress']['item'][$id]['uuid'] == '') {
//$snort_uuid = gen_snort_uuid(strrev(uniqid(true)));
$suppress_uuid = 0;
@@ -61,9 +61,7 @@ if (!is_array($config['installedpackages']['snortglobal']['suppress']['item'][$i
$suppress_uuid = mt_rand(1, 65535);
$pconfig['uuid'] = $suppress_uuid;
}
- }
-
- if ($config['installedpackages']['snortglobal']['suppress']['item'][$id]['uuid'] != '') {
+ } else if ($config['installedpackages']['snortglobal']['suppress']['item'][$id]['uuid'] != '') {
$suppress_uuid = $config['installedpackages']['snortglobal']['suppress']['item'][$id]['uuid'];
}
}
@@ -98,14 +96,14 @@ if ($_POST['submit']) {
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
if(strtolower($_POST['name']) == "defaultwhitelist")
- $input_errors[] = "Whitelist file names may not be named defaultwhitelist.";
+ $input_errors[] = "Whitelist file names may not be named defaultwhitelist.";
$x = is_validwhitelistname($_POST['name']);
if (!isset($x)) {
$input_errors[] = "Reserved word used for whitelist file name.";
} else {
if (is_validwhitelistname($_POST['name']) == false)
- $input_errors[] = "Whitelist file name may only consist of the characters a-z, A-Z and 0-9 _. Note: No Spaces. Press Cancel to reset.";
+ $input_errors[] = "Whitelist file name may only consist of the characters a-z, A-Z and 0-9 _. Note: No Spaces. Press Cancel to reset.";
}
@@ -137,7 +135,7 @@ if ($_POST['submit']) {
sync_snort_package_config();
- header("Location: /snort/snort_interfaces_suppress_edit.php?id=$id");
+ header("Location: /snort/snort_interfaces_suppress.php");
exit;
}
diff --git a/config/snort/snort_interfaces_whitelist_edit.php b/config/snort/snort_interfaces_whitelist_edit.php
index 40f92318..8c54ac5a 100644
--- a/config/snort/snort_interfaces_whitelist_edit.php
+++ b/config/snort/snort_interfaces_whitelist_edit.php
@@ -58,9 +58,7 @@ if ($config['installedpackages']['snortglobal']['whitelist']['item'][$id]['uuid'
$whitelist_uuid = mt_rand(1, 65535);
$pconfig['uuid'] = $whitelist_uuid;
}
-}
-
-if ($config['installedpackages']['snortglobal']['whitelist']['item'][$id]['uuid'] != '') {
+} else if ($config['installedpackages']['snortglobal']['whitelist']['item'][$id]['uuid'] != '') {
$whitelist_uuid = $config['installedpackages']['snortglobal']['whitelist']['item'][$id]['uuid'];
}
@@ -209,7 +207,7 @@ if ($_POST['submit']) {
/* create whitelist and homenet file then sync files */
sync_snort_package_empty();
- header("Location: /snort/snort_interfaces_whitelist_edit.php?id=$id");
+ header("Location: /snort/snort_interfaces_whitelist.php");
exit;
}
//we received input errors, copy data to prevent retype