aboutsummaryrefslogtreecommitdiffstats
path: root/config/snort/snort_blocked.php
diff options
context:
space:
mode:
Diffstat (limited to 'config/snort/snort_blocked.php')
-rw-r--r--config/snort/snort_blocked.php96
1 files changed, 21 insertions, 75 deletions
diff --git a/config/snort/snort_blocked.php b/config/snort/snort_blocked.php
index ddeae784..1ff7972c 100644
--- a/config/snort/snort_blocked.php
+++ b/config/snort/snort_blocked.php
@@ -38,7 +38,6 @@ if (!is_array($config['installedpackages']['snortglobal']['alertsblocks']))
$pconfig['brefresh'] = $config['installedpackages']['snortglobal']['alertsblocks']['brefresh'];
$pconfig['blertnumber'] = $config['installedpackages']['snortglobal']['alertsblocks']['blertnumber'];
-$pconfig['snortalertlogtype'] = $config['installedpackages']['snortglobal']['alertsblocks']['blertnumber'];
if (empty($pconfig['blertnumber']))
$bnentries = '500';
@@ -115,62 +114,6 @@ if ($_POST['save'])
}
-/* build filter funcs */
-function get_snort_alert_ip_src($fileline)
-{
- /* SRC IP */
- $re1='.*?'; # Non-greedy match on filler
- $re2='((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))(?![\\d])'; # IPv4 IP Address 1
-
- if ($c=preg_match_all ("/".$re1.$re2."/is", $fileline, $matches4))
- return $matches4[1][0];
-
- return "";
-}
-
-function get_snort_alert_disc($fileline)
-{
- /* disc */
- if (preg_match("/\[\*\*\] (\[.*\]) (.*) (\[\*\*\])/", $fileline, $matches))
- return "{$matches[2]}";
-
- return "";
-}
-
-/* tell the user what settings they have */
-$blockedtab_msg_chk = $config['installedpackages']['snortglobal']['rm_blocked'];
-if ($blockedtab_msg_chk == "1h_b") {
- $blocked_msg = "hour";
-}
-if ($blockedtab_msg_chk == "3h_b") {
- $blocked_msg = "3 hours";
-}
-if ($blockedtab_msg_chk == "6h_b") {
- $blocked_msg = "6 hours";
-}
-if ($blockedtab_msg_chk == "12h_b") {
- $blocked_msg = "12 hours";
-}
-if ($blockedtab_msg_chk == "1d_b") {
- $blocked_msg = "day";
-}
-if ($blockedtab_msg_chk == "4d_b") {
- $blocked_msg = "4 days";
-}
-if ($blockedtab_msg_chk == "7d_b") {
- $blocked_msg = "7 days";
-}
-if ($blockedtab_msg_chk == "28d_b") {
- $blocked_msg = "28 days";
-}
-
-if ($blockedtab_msg_chk != "never_b")
-{
- $blocked_msg_txt = "Hosts are removed every <strong>$blocked_msg</strong>.";
-}else{
- $blocked_msg_txt = "Settings are set to never <strong>remove</strong> hosts.";
-}
-
$pgtitle = "Services: Snort Blocked Hosts";
include_once("head.inc");
@@ -272,28 +215,31 @@ if ($pconfig['brefresh'] == 'on')
$blocked_ips_array[] = trim($blocked_ip, " \n\t");
}
}
- $input = array();
- $alert_ip_src_array = array();
- foreach (glob("/var/log/snort/*/alert") as $alert) {
- if ($pconfig['snortalertlogtype'] == 'full')
- $alerts_array = array_reverse(explode("\n\n", file_get_contents($alert)));
- else
- $alerts_array = array_reverse(file($alert));
- /* build the list and compare blocks to alerts */
- foreach($alerts_array as $counter => $fileline) {
- if (empty($fileline))
- continue;
-
- $alert_ip_src = get_snort_alert_ip_src($fileline);
- $alert_ip_disc = get_snort_alert_disc($fileline);
- $alert_ip_src_array[] = $alert_ip_src;
- if (!empty($blocked_ips_array) && in_array("$alert_ip_src", $blocked_ips_array)) {
- if (!isset($input[$alert_ip_src]))
- $input[$alert_ip_src] = "{$alert_ip_disc}\n";
+ $src_ip_list = array();
+ /* make sure alert file exists */
+ if (file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert")) {
+ $fd = fopen("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert", "r");
+ if ($fd) {
+ /* 0 1 2 3 4 5 6 7 8 9 10 11 12
+ /* File format timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority */
+ while(($fileline = @fgets($fd))) {
+ if (empty($fileline))
+ continue;
+ $fields = explode(",", $fileline);
+
+ $src_ip_list[$fields[6]] = "{$fields[4]} - {$fields[0]}";;
+ $src_ip_list[$fields[8]] = "{$fields[4]} - {$fields[0]}";;
}
+ fclose($fd);
}
}
+ $input = array();
+ foreach ($blocked_ips_array as $blocked_ip) {
+ if (isset($src_ip_list[$blocked_ip]))
+ $input[$blocked_ip] = $src_ip_list[$blocked_ip];
+ }
+
foreach($blocked_ips_array as $blocked_ip) {
if (is_ipaddr($blocked_ip) && !isset($input[$blocked_ip]))
$input[$blocked_ip] = "N\A\n";