diff options
Diffstat (limited to 'config/snort-dev/snortsam-package-code/snort_download_rules.inc')
| -rw-r--r-- | config/snort-dev/snortsam-package-code/snort_download_rules.inc | 1036 |
1 files changed, 1036 insertions, 0 deletions
diff --git a/config/snort-dev/snortsam-package-code/snort_download_rules.inc b/config/snort-dev/snortsam-package-code/snort_download_rules.inc new file mode 100644 index 00000000..8953a65c --- /dev/null +++ b/config/snort-dev/snortsam-package-code/snort_download_rules.inc @@ -0,0 +1,1036 @@ +<?php +/* $Id$ */ +/* + + part of pfSense + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +/* + * WARNING: THIS FILE SHOULD NEVER BE IN WWWW DIR + * + */ + + +// create and cp to tmp db dir +if (!file_exists('/var/snort/')) { + exec('/bin/mkdir -p /var/snort/'); +} + +if (file_exists('/usr/local/pkg/snort/snortDBtemp')) { + exec('/bin/cp /usr/local/pkg/snort/snortDBtemp /var/snort/snortDBtemp'); +} + + +// fetch db Settings NONE Json +function snortSql_fetchAllSettings2($dbname, $table, $type, $id_uuid) +{ + + if ($dbname == '' || $table == '' || $type == '') { + return false; + } + + if ($dbname === 'snortDB' || $dbname === 'snortDBrules') { + $db = sqlite_open("/usr/local/pkg/snort/$dbname"); + } + + if ($dbname === 'snortDBtemp') { + $db = sqlite_open("/var/snort/$dbname"); + } + + if ($type === 'All') { + + $result = sqlite_query($db, + "SELECT * FROM {$table} where id > 0; + "); + + }else{ + + $result = sqlite_query($db, + "SELECT * FROM {$table} where {$type} = '{$id_uuid}'; + "); + } + + if ($type == 'rdbuuid' || $type == 'All') { + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + }else{ + $chktable = sqlite_fetch_array($result, SQLITE_ASSOC); + } + + sqlite_close($db); + + return $chktable; + + +} // end func + +function snortSql_updateRuleSetList($type, $value, $file_size, $downloaded, $filename) +{ + + $dbname = 'snortDBtemp'; + $table = 'SnortDownloads'; + $addDate = date(U); + + // do let user pick the DB path + $db = sqlite_open("/var/snort/{$dbname}"); + + if ($type === 'percent2'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}', filesize = '{$file_size}', downloaded = '{$downloaded}' where filename = '{$filename}'; + "); + } + + + if ($type === 'percent'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}' where filename = '{$filename}'; + "); + } + + if ($type === 'msg1'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '1'; + "); + } + + if ($type === 'msg2'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '2'; + "); + } + + /* + * INPORTANT: + * Register worker to prevent loops and ghost process + * Needs to be watched, + */ + + if ($type === 'working'){ + + $getmypid = getmypid(); + $getmyfilename = $_SERVER['SCRIPT_NAME']; + + $resultChk = sqlite_query($db, + "SELECT * FROM RegisterWorker WHERE uuid = 'jdjEf!773&h3bhFd6A'; + "); + + $resultChkFinal = sqlite_fetch_all($resultChk, SQLITE_ASSOC); + + if (!empty($resultChkFinal)) { + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE RegisterWorker SET date = '{$addDate}', processid = '{$getmypid}', filename = '{$getmyfilename}', working = '{$value}' where uuid = 'jdjEf!773&h3bhFd6A'; + "); + }else{ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO RegisterWorker (date, processid, filename, working, uuid) VALUES ('{$addDate}', '{$getmypid}', '{$getmyfilename}', '{$value}', 'jdjEf!773&h3bhFd6A'); + "); + } + } + + + if ($type === 'snortWait'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET waittime = '{$addDate}' where filename = '{$filename}'; + "); + } + + if (sqlite_changes($db) < 1){ + sqlite_close($db); + return 'Error in query'; + } + + sqlite_close($db); + + +} + +// reapply rule settings +function reapplyRuleSettings_run($sidRule_array) +{ + + $sid_array = snortSql_fetchAllSettings2('snortDBrules', 'SnortruleSigs', 'rdbuuid', $sidRule_array); + + if (!empty($sid_array)) { + foreach ($sid_array as $sid) + { + if (!empty($sid['enable']) && !empty($sid['signatureid']) && !empty($sid['rdbuuid']) && !empty($sid['signaturefilename'])) { + if ($sid['enable'] === 'on') { + exec('/usr/bin/sed -i \'\' \'s/^# \(.*sid:' . "{$sid['signatureid']}" . ';.*\)/\1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); + } + + if ($sid['enable'] === 'off') { + exec('/usr/bin/sed -i \'\' \'s/^\(alert.*sid:' . "{$sid['signatureid']}" . ';.*\)/# \1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); + } + } + } + } + + // NOTES: DO NOT REMOVE BELOW COMMENTS + // returns file pathe of the sid + // $testing = exec("grep -ri 'sid: \?1225; ' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules | tail -n1 | awk -F: '{print $1}'"); + // see if sid is enabled + // $testing2 = exec("sed -n '/^alert.*sid:1225;.*/p' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules"); + // enable a sid + // sed -i '' "s/^# \(.*sid:1225;.*\)/\1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules + // disable a sid + // sed -i '' "s/^\(alert.*sid:1225;.*\)/# \1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules + // grep "^alert.*sid:.*;" rules/emerging-worm.rules | grep -oh "\w*sid:[0-9][^*;]\w*" | awk -F: '{print $2}' + // sed -n '/^320 || .*/{p;q;}' rules/ ../etc/sid-msg.map | awk -F '|' '{print $3}' | sed -e 's/^[ \t]*//' + + +} + +function snortCmpareMD5($type, $path1, $path2, $filename_md5) +{ + update_output_window2('ms2', 'Checking ' . $filename_md5 . ' MD5...'); + + if (file_exists("{$path1}/{$filename_md5}")){ + + if ($type == 'string'){ + $md5_check_new = @file_get_contents("{$path1}/{$filename_md5}"); + $md5_check_old = @file_get_contents("{$path2}/{$filename_md5}"); + if ($md5_check_new !== $md5_check_old){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + if ($type == 'md5'){ + //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' + $md5_check_new2 = exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'"); + $md5_check_old2 = exec("/sbin/md5 {$path2}/{$filename_md5} | /usr/bin/awk '{print $4}'"); + if ($md5_check_new != $md5_check_old){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + if ($type == 'md5FileChk') { + //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' + $md5_check_new = trim(exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'")); + + $md5_check_old = exec("/bin/cat {$path1}/{$filename_md5}.md5"); + + $md5_check_old2 = trim(preg_replace('/"/', '', $md5_check_old)); + + if ($md5_check_new != $md5_check_old2){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + + + } + + update_output_window2('ms2', "$filename_md5 MD5 File Check Passed..."); + return true; +} + + +/* + * update_output_window: update bottom textarea dynamically. + */ +function update_output_window2($type, $text) +{ + if ($type === 'ms1') { + $msg = 1; + } + + if ($type === 'ms2') { + $msg = 2; + } + + if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on'){ + echo + ' +<script type="text/javascript"> +jQuery("#msg' . $msg . 'Text").remove(); +jQuery("#UpdateMsg' . $msg . '").append(\'<span id="msg' . $msg . 'Text">' . $text . '</span>\'); +</script> + '; + ob_flush(); + apc_clear_cache(); + + }else{ + echo "\n" . $type . ': ' . $text; + } + +} + +// returns array that matches pattern, option to replace objects in matches +function snortScanDirFilter2($arrayList, $pattmatch, $pattreplace, $pattreplacewith) +{ + foreach ( $arrayList as $val ) + { + if (preg_match($pattmatch, $val, $matches)) { + if ($pattreplace != '') { + $matches2 = preg_replace($pattreplace, $pattreplacewith, $matches[0]); + $filterDirList[] = $matches2; + }else{ + $filterDirList[] = $matches[0]; + } + } + } + return $filterDirList; +} + +// set page vars +$generalSettings = snortSql_fetchAllSettings2('snortDB', 'SnortSettings', 'id', '1'); + +// Setup file names and dir +$tmpfname = '/usr/local/etc/snort/snort_download'; +$snortdir = '/usr/local/etc/snort'; +$snortdir_rules = '/usr/local/etc/snort/snortDBrules/snort_rules'; +$emergingdir_rules = '/usr/local/etc/snort/snortDBrules/emerging_rules'; +$pfsensedir_rules = '/usr/local/etc/snort/snortDBrules/pfsense_rules'; +$customdir_rules = '/usr/local/etc/snort/snortDBrules/custom_rules'; +$snort_filename_md5 = 'snortrules-snapshot-2905.tar.gz.md5'; +$snort_filename = 'snortrules-snapshot-2905.tar.gz'; +$emergingthreats_filename_md5 = 'emerging.rules.tar.gz.md5'; +$emergingthreats_filename = 'emerging.rules.tar.gz'; +$pfsense_rules_filename_md5 = 'pfsense_rules.tar.gz.md5'; +$pfsense_rules_filename = 'pfsense_rules.tar.gz'; + +// START of MAIN function +function sendUpdateSnortLogDownload($console) +{ + + if ($console === 'console'){ + $GLOBALS['tmp']['snort']['downloadupdate']['console'] = 'on'; + } + + if ($console !== 'console') { + + echo + ' +<script type="text/javascript"> +jQuery.fn.centerModal = function () { + this.css("position","absolute"); + this.css("top", 70 + "px"); + this.css("left", ((jQuery(window).width() - this.outerWidth()) / 2) + jQuery(window).scrollLeft() + "px"); + return this; +} +jQuery("#loadingRuleUpadteGUI").show(); +jQuery(".snortModalUpdate").centerModal(); +jQuery("#pb4").progressBar(0, { showText: true, barImage: "/snort/images/progress_bar2.gif", width: 560, height: 43} ); +</script> + '; + + } + + + //bring in the global vars + global $generalSettings, $tmpfname, $snortdir, $snortdir_rules, $emergingdir_rules, $pfsensedir_rules, $customdir_rules, $snort_filename_md5, $snort_filename, $emergingthreats_filename_md5, $emergingthreats_filename, $pfsense_rules_filename_md5, $pfsense_rules_filename; + + /* Make shure snortdir exits */ + if (!file_exists("{$snortdir}")) { + exec("/bin/mkdir -p {$snortdir}"); + } + if (!file_exists("{$tmpfname}")) { + exec("/bin/mkdir -p {$tmpfname}"); + } + if (!file_exists("{$snortdir_rules}")) { + exec("/bin/mkdir -p {$snortdir_rules}"); + } + if (!file_exists("{$emergingdir_rules}")) { + exec("/bin/mkdir -p {$emergingdir_rules}"); + } + if (!file_exists("{$pfsensedir_rules}")) { + exec("/bin/mkdir -p {$pfsensedir_rules}"); + } + if (!file_exists("{$customdir_rules}")) { + exec("/bin/mkdir -p {$customdir_rules}"); + } + if (!file_exists("{$snortdir}/signatures")) { + exec("/bin/mkdir -p {$snortdir}/signatures"); + } + if (!file_exists('/usr/local/lib/snort/dynamicrules/')) { + exec('/bin/mkdir -p /usr/local/lib/snort/dynamicrules/'); + } + + + /* Set user agent to Mozilla */ + ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); + ini_set("memory_limit","150M"); + + + // Get file that does not use redirects, mostly for none snort.org downloads + function snort_file_get_contents($tmpfname, $snort_filename, $snort_UrlGet) + { + if (!file_exists("{$tmpfname}/{$snort_filename}") || filesize("{$tmpfname}/{$snort_filename}") <= 0){ + update_output_window2('ms2', 'Downloading ' . $snort_filename. ' MD5...'); + ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); + $file = file_get_contents("$snort_UrlGet/{$snort_filename}"); // use a @ infront of file_get_contents when in production + $f = fopen("{$tmpfname}/{$snort_filename}", 'w'); + fwrite($f, $file); + fclose($f); + update_output_window2('ms2', 'Finnished Downloading ' . $snort_filename. ' MD5...'); + } + } + + function read_header2($ch, $string) { + global $file_size, $fout; + $length = strlen($string); + $regs = ""; + ereg("(Content-Length:) (.*)", $string, $regs); + if($regs[2] <> "") { + $file_size = intval($regs[2]); + } + ob_flush(); + return $length; + } + + function read_body2($ch, $string) { + global $fout, $file_size, $downloaded, $sendto, $static_status, $static_output, $lastseen; + global $pkg_interface; + $length = strlen($string); + $downloaded += intval($length); + if($file_size > 0) { + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + } else + $downloadProgress = 0; + if($lastseen <> $downloadProgress and $downloadProgress < 101) { + if($sendto == "status") { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } else { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } + update_progress_bar($downloadProgress); + $lastseen = $downloadProgress; + } + if($fout) + fwrite($fout, $string); + ob_flush(); + return $length; + } + + /* + * update_progress_bar($percent): updates the javascript driven progress bar. + */ + function update_progress_bar2($percent, $file_size, $downloaded) + { + if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on') { + if (!empty($percent)) { + echo + ' +<script type="text/javascript"> +jQuery("#pb4").progressBar(' . $percent . ', { showText: true, barImage: "/snort/images/progress_bar2.gif", width: 560, height: 43} ); +</script> + '; + } + + }else{ + echo "\n" . 'percent: ' . $percent . ' filesize: ' . $file_size . ' downloaded: ' . $downloaded; + } + } + + + function read_body_firmware($ch, $string) + { + global $fout, $file_size, $downloaded, $counter; + $length = strlen($string); + $downloaded += intval($length); + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + $counter++; + if($counter > 150) { + update_progress_bar2($downloadProgress, $file_size, $downloaded); + flush(); + $counter = 0; + } + fwrite($fout, $string); + return $length; + } + + function download_file_with_progress_bar2($url_file, $destination, $workingfile, $readbody = 'read_body2') + { + global $ch, $fout, $file_size, $downloaded; + $file_size = 1; + $downloaded = 1; + $destination_file = $destination . '/' . $workingfile; + + /* open destination file */ + $fout = fopen($destination_file, "wb"); + + /* + * Originally by Author: Keyvan Minoukadeh + * Modified by Scott Ullrich to return Content-Length size + */ + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url_file); + curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'read_header2'); + curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($ch, CURLOPT_WRITEFUNCTION, $readbody); + curl_setopt($ch, CURLOPT_NOPROGRESS, '1'); + curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, '5'); + curl_setopt($ch, CURLOPT_TIMEOUT, 0); + + curl_exec($ch); + $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); + if($fout) + fclose($fout); + curl_close($ch); + return ($http_code == 200) ? true : $http_code; + } + +// ----------------------------------------------------- Begin Code -------------------------------------------- + + + // rm all tmp filea + @exec("/bin/rm -r $tmpfname/*"); + + // Set all downloads to be false, download by default + + $snort_md5_check_ok = false; + $emerg_md5_check_ok = false; + $pfsense_md5_check_ok = false; + + // define checks + $oinkid = $generalSettings['oinkmastercode']; + + $emergingthreatscode = $generalSettings['emergingthreatscode']; + + // dsable downloads if there settings are off + if ($generalSettings['snortdownload'] === 'off') { + $snort_md5_check_ok = true; + } + + if ($generalSettings['emergingthreatsdownload'] == 'off') { + $emerg_md5_check_ok = true; + } + + if ($oinkid == '' && $generalSettings['snortdownload'] === 'on') { + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'"); + return false; + } + + if ($emergingthreatscode === '' && $generalSettings['snortdownload'] === 'pro') { + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'"); + return false; + } + + if ($generalSettings['snortdownload'] === 'off' && $generalSettings['emergingthreatsdownload'] === 'off') { // note: basic and pro + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'SnortStartup: No rules have been selected to download.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'No rules have been selected to download.'"); + return false; + } + + /* + * Check MD5s and MARK + * + */ + + update_output_window2('ms1', 'Starting MD5 checks...'); + + // check is we need to wait + update_output_window2('ms2', 'Checking Wait Status for Snort.org...'); + $getSnort_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $snort_filename); + + if (date(U) > $getSnort_filename_Waittime_chk['waittime'] + 900) { + update_output_window2('ms2', 'Snort.org Wait Time Status: OK...'); + }else{ + update_output_window2('ms2', 'Snort.org Wait Time Status: Wait 15 min Please...'); + $snort_md5_check_ok = true; + $snort_wait = true; + } + + // check is we need to wait + update_output_window2('ms2', 'Checking Wait Status for Emergingthreats.net...'); + $getEmergingthreats_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $emergingthreats_filename); + + if (date(U) > $getEmergingthreats_filename_Waittime_chk['waittime'] + 900) { + update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: OK...'); + }else{ + update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: Wait 15 min Please...'); + $emerg_md5_check_ok = true; + $emerg_wait = true; + } + + // if all rules need wait stop + if ($snort_wait === true && $emerg_wait === true) { + return false; + } + + // download snort.org md5 and compare + if ($snort_md5_check_ok === false) { + + snort_file_get_contents($tmpfname, $snort_filename_md5, 'http://www.snort.org/pub-bin/oinkmaster.cgi/' . $oinkid); + snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename_md5); // finsh percent + + // if snort.org md5 do not match + if(snortCmpareMD5('string', $tmpfname, $snortdir_rules, $snort_filename_md5)) { + $snort_md5_check_ok = true; + } + + } + + // download emergingthreats.net md5 and compare + if ($emerg_md5_check_ok === false) { + + snort_file_get_contents($tmpfname, $emergingthreats_filename_md5, 'http://rules.emergingthreats.net/open/snort-2.9.0'); + snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename_md5); // finsh percent + + // if emergingthreats.net md5 do not match + if(snortCmpareMD5('string', $tmpfname, $emergingdir_rules, $emergingthreats_filename_md5)) { + $emerg_md5_check_ok = true; + } + + } + + // download pfsense.org md5 and compare + snort_file_get_contents($tmpfname, $pfsense_rules_filename_md5, 'http://www.pfsense.com/packages/config/snort/pfsense_rules'); + snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename_md5); // finsh percent + + // if pfsense.org md5 do not match + if(snortCmpareMD5('string', $tmpfname, $pfsensedir_rules, $pfsense_rules_filename_md5)) { + $pfsense_md5_check_ok = true; + } + + /* + * If all rule type is not check clean up. + */ + + /* Make Clean Snort Directory emergingthreats not checked */ + if ($snort_md5_check_ok === false && $emergingthreatsdownload === 'off') { + update_output_window2('ms1', 'Cleaning the emergingthreats Directory...'); + exec("/bin/rm {$snortdir}/emerging_rules/*.rules"); + exec("/bin/rm {$snortdir}/version.txt"); + update_output_window2('ms2', 'Done cleaning emrg direcory.'); + } + + /* Make Clean Snort Directory snort.org not checked */ + if ($emerg_md5_check_ok === false && $snortdownload !== 'on') { + update_output_window2('ms1', 'Cleaning the snort Directory...'); + exec("/bin/rm {$snortdir}/snort_rules/*.rules"); + exec("/bin/rm {$snortdir}/snortrules-snapshot-2905.tar.gz.md5"); + update_output_window2('ms2', 'Done cleaning snort direcory.'); + } + + + /* Check if were up to date exits */ + if ($snort_md5_check_ok === true && $emerg_md5_check_ok === true && $pfsense_md5_check_ok === true) { + update_output_window2('ms1', 'Your rules are up to date...'); + return false; + } + + + /* You are Not Up to date, always stop snort when updating rules for low end machines */; + update_output_window2('ms1', 'You are NOT up to date...'); + update_output_window2('ms2', 'Stopping Snort and Barnyard2 service...'); + $chk_if_snort_up = exec('pgrep -x snort'); + $chk_if_barnyad_up = exec('pgrep -x barnyad2'); + if ($chk_if_snort_up != '') { + exec('/usr/bin/touch /tmp/snort_download_halt.pid'); // IMPORTANT: incase of script crash or error, Mabe use DB + exec('/usr/bin/killall snort'); + if ($chk_if_barnyad_up != ''){ + exec('/usr/bin/killall barnyad2'); + } + sleep(2); + } + + + /* download snortrules file */ + if ($snort_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $snort_filename; + update_output_window2('ms1', 'Snort.org: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://www.snort.org/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); + //download_file_with_progress_bar2("http://theseusnetworking.com/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename); // finsh percent, add date time finnished + update_output_window2('ms2', 'Snort.org: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'Snort.org MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $snort_filename)) { + + $snort_filename_wait_ck = exec("/usr/bin/egrep '\bYou must wait 15\b' {$tmpfname}/{$snort_filename}"); + if ($snort_filename_wait_ck != '') { + update_output_window2('ms2', 'Snort.org: You must wait 15 min...'); + } + + // disable snort.org download + $snort_md5_check_ok = true; + $snort_filename_corrupted = true; + + } + } + + /* download emergingthreats file */ + if ($emerg_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $emergingthreats_filename; + update_output_window2('ms1', 'Emergingthreats.net: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://rules.emergingthreats.net/open/snort-2.9.0/{$emergingthreats_filename}", $tmpfname, $emergingthreats_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename); // finsh percent + update_output_window2('ms2', 'Emergingthreats.net: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'Emergingthreats MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $emergingthreats_filename)) { + + // disable snort.org download + $emerg_md5_check_ok = true; + $emerg_filename_corrupted = true; + + } + } + + /* download pfsense rule file */ + if ($pfsense_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $pfsense_rules_filename; + update_output_window2('ms1', 'pfSense.org: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://www.pfsense.com/packages/config/snort/pfsense_rules/{$pfsense_rules_filename}", $tmpfname, $pfsense_rules_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename); // finsh percent + update_output_window2('ms2', 'pfSense.org: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'pfSense.org MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $pfsense_rules_filename)) { + + // disable snort.org download + $pfsense_md5_check_ok = true; + + } + } + + // if both files are corrupted stop + if ($snort_filename_corrupted === true && $emerg_filename_corrupted === true) { + update_output_window2('ms1', 'Snort.org and Emergingthreats.net files are corrupted.'); + update_output_window2('ms2', 'Stoping Script...'); + return false; + } + + /* + * START: Untar Files + */ + + // Untar snort rules file individually to help people with low system specs + if ($snort_md5_check_ok === false && file_exists("{$tmpfname}/{$snort_filename}")) { + + update_output_window2('ms1', 'Extracting Snort.org rules...'); + update_output_window2('ms2', 'May take a while...'); + + function build_SnortRuleDir() + { + global $tmpfname, $snortdir, $snortdir_rules, $snort_filename; + + // find out if were in 1.2.3-RELEASE + $pfsense_ver_chk = exec('/bin/cat /etc/version'); + if ($pfsense_ver_chk === '1.2.3-RELEASE') { + $pfsense_stable = 'yes'; + }else{ + $pfsense_stable = 'no'; + } + + // get the system arch + $snort_arch_ck = exec('/usr/bin/uname -m'); + if ($snort_arch_ck === 'i386') { + $snort_arch = 'i386'; + }else{ + $snort_arch = 'x86-64'; // amd64 + } + + if ($pfsense_stable === 'yes') { + $freebsd_version_so = 'FreeBSD-7-3'; + }else{ + $freebsd_version_so = 'FreeBSD-8-1'; + } + + // extract snort.org rules and add prefix to all snort.org files + @exec("/bin/rm -r {$snortdir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} rules/"); + + $snort_dirList = scandir("{$snortdir_rules}/rules"); // Waning: only in php 5 + $snortrules_filterList = snortscandirfilter2($snort_dirList, '/.*\.rules/', '/\.rules/', ''); + + if (!empty($snortrules_filterList)) { + foreach ($snortrules_filterList as $snort_rule_move) + { + exec("/bin/mv -f {$snortdir_rules}/rules/{$snort_rule_move}.rules {$snortdir_rules}/rules/snort_{$snort_rule_move}.rules"); + } + } + + // extract so rules + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/"); + exec("/bin/mv -f {$snortdir_rules}/so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/* /usr/local/lib/snort/dynamicrules/"); + + // list so_rules and exclude dir + exec("/usr/bin/tar --exclude='precompiled' --exclude='src' -tf {$tmpfname}/{$snort_filename} so_rules", $so_rules_list); + + $so_rulesPattr = array('/\//', '/\.rules/'); + $so_rulesPattw = array('', ''); + + // build list of so rules + $so_rules_filterList = snortscandirfilter2($so_rules_list, '/\/.*\.rules/', $so_rulesPattr, $so_rulesPattw); + + if (!empty($so_rules_filterList)) { + // cp rule to so tmp dir + foreach ($so_rules_filterList as $so_rule) + { + + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/{$so_rule}.rules"); + + } + // mv and rename so rules + foreach ($so_rules_filterList as $so_rule_move) + { + exec("/bin/mv -f {$snortdir_rules}/so_rules/{$so_rule_move}.rules {$snortdir_rules}/rules/snort_{$so_rule_move}.so.rules"); + } + } + + exec("/bin/rm -r {$snortdir_rules}/so_rules"); + + // extract base etc files + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir} etc/"); + + } + build_SnortRuleDir(); + // cp md5 to main snort dir + exec("/bin/cp {$tmpfname}/{$snort_filename_md5} {$snortdir_rules}/{$snort_filename_md5}"); + update_output_window2('ms2', 'Done extracting Snort.org Rules.'); + } + + /* Untar emergingthreats rules to tmp */ + if ($emerg_md5_check_ok === false && file_exists("{$tmpfname}/{$emergingthreats_filename}")) { + if (file_exists("{$tmpfname}/{$emergingthreats_filename}")) { + update_output_window2('ms1', 'Extracting Emergingthreats Rules...'); + update_output_window2('ms2', 'May take a while...'); + @exec("/bin/rm -r {$emergingdir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$emergingthreats_filename} -C {$emergingdir_rules} rules/"); + exec("/bin/cp {$tmpfname}/{$emergingthreats_filename_md5} {$emergingdir_rules}/{$emergingthreats_filename_md5}"); + update_output_window2('ms2', 'Done extracting Emergingthreats.net Rules.'); + } + } + + /* Untar Pfsense rules to tmp */ + if ($pfsense_md5_check_ok === false && file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { + if (file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { + update_output_window2('ms1', 'Extracting Pfsense rules...'); + update_output_window2('ms1', 'May take a while...'); + @exec("/bin/rm -r {$pfsensedir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$pfsense_rules_filename} -C {$pfsensedir_rules} rules/"); + exec("/bin/cp {$tmpfname}/{$pfsense_rules_filename_md5} {$pfsensedir_rules}/{$pfsense_rules_filename_md5}"); + update_output_window2('ms2', 'Done extracting pfSense.org Rules.'); + + } + } + + /* double make shure cleanup emerg rules that dont belong */ + if (file_exists("/usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so")) { + exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so"); + exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example\*"); + } + + // make sure default rules are in the right format + update_output_window2('ms1', 'Reformatting Rules To One Standard...'); + update_output_window2('ms2', 'Please Wait...'); + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$snortdir_rules}/rules/*.rules"); // remove white spaces from begining of line + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + update_output_window2('ms2', 'Done...'); + + /* create a msg-map for snort */ + update_output_window2('ms1', 'Updating Alert Sid Messages...'); + update_output_window2('ms2', 'Please Wait...'); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$snortdir_rules}/rules > /usr/local/etc/snort/etc/sid-msg.map"); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$emergingdir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$pfsensedir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); + update_output_window2('ms2', 'Done...'); + + // create default dir + if (!file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/default/rules'); + } + + // cp new rules to default dir + exec('/bin/rm /usr/local/etc/snort/snortDBrules/DB/default/rules/*.rules'); + exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + + + // reapplay rules from DB cp base rules to dirs + $sidOnOff_array = snortSql_fetchAllSettings2('snortDBrules', 'Snortrules', 'All', ''); + + if (!empty($sidOnOff_array)) { + update_output_window2('ms1', 'Reapplying User Settings...'); + update_output_window2('ms2', 'Please Wait...'); + foreach ($sidOnOff_array as $preSid_Array) + { + if (!file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules")) { + exec("/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + } + + exec("/bin/rm /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules/*.rules"); + exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + reapplyRuleSettings_run($preSid_Array['uuid']); + update_output_window2('ms2', 'Done...'); + } + } + + // cp snort conf's to Ifaces + $ifaceConfMaps_array = snortSql_fetchAllSettings2('snortDB', 'SnortIfaces', 'All', ''); + + if (!empty($ifaceConfMaps_array)) { + update_output_window2('ms1', 'Reapplying User Settings...'); + update_output_window2('ms2', 'Please Wait...'); + foreach ($ifaceConfMaps_array as $preIfaceConfMaps_array) + { + // create iface dir if missing + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}")) { + exec("/bin/mkdir -p /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + } + + // create rules dir soft link if setting is default + if ($preIfaceConfMaps_array['ruledbname'] === 'default' || $preIfaceConfMaps_array['ruledbname'] === '') { + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/default/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); + } + } + + // create rules dir soft link if setting is not default + if ($preIfaceConfMaps_array['ruledbname'] !== 'default' || $preIfaceConfMaps_array['ruledbname'] != '') { + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules")) { + exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); + } + } + + exec("/bin/cp {$snortdir}/etc/*.config /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/*.conf /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/*.map /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/generators /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/sid /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + + reapplyRuleSettings_run($preSid_Array['uuid']); + update_output_window2('ms2', 'Done...'); + } + } + + + // remove old $tmpfname files */ + update_output_window2('ms1', 'Removing old files...'); + update_output_window2('ms2', 'Working...'); + if (file_exists('/usr/local/etc/snort/tmp')) { + exec("/bin/rm -r /usr/local/etc/snort/tmp/snort_rules_up"); + exec("/bin/rm -r /usr/local/etc/snort/tmp/rules_bk"); + apc_clear_cache(); + } + update_output_window2('ms2', 'Done...'); + + // php code to flush out cache some people are reportting missing files this might help + apc_clear_cache(); + exec("/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync"); + + // make all dirs snorts + exec("/usr/sbin/chown -R snort:snort /var/log/snort"); + exec("/usr/sbin/chown -R snort:snort /usr/local/etc/snort"); + exec("/usr/sbin/chown -R snort:snort /usr/local/lib/snort"); + exec("/bin/chmod -R 755 /var/log/snort"); + exec("/bin/chmod -R 755 /usr/local/etc/snort"); + exec("/bin/chmod -R 755 /usr/local/lib/snort"); + + + update_output_window2('ms1', 'Finnished Updateing...'); + update_output_window2('ms2', 'Finnished Updateing...'); + + + // if snort is running hard restart, if snort is not running do nothing + + // TODO: Restart Ifaces + +// ----------------------------------------------------- End Code -------------------------------------------- + +} // -------------------- END Main function ------------ + +//$argv[1] = 'console'; + + //$getWorkerStat = snortSql_fetchAllSettings2('snortDBtemp', 'RegisterWorker', 'uuid', 'jdjEf!773&h3bhFd6A'); + + //if ($getWorkerStat['working'] !== 'on') { + //snortSql_updateRuleSetList2('working', 'on', '', '', ''); // Register Worker on + //sendUpdateSnortLogDownload($argv[1]); // start main function + //snortSql_updateRuleSetList2('working', 'off', '', '', ''); // Register Worker off + //} + + + + + +?>
\ No newline at end of file |