diff options
Diffstat (limited to 'config/snort')
| -rwxr-xr-x | config/snort/snort.inc | 12 | ||||
| -rwxr-xr-x | config/snort/snort.xml | 2 | ||||
| -rwxr-xr-x | config/snort/snort_check_for_rule_updates.php | 17 | ||||
| -rw-r--r-- | config/snort/snort_defs.inc | 9 | ||||
| -rw-r--r-- | config/snort/snort_migrate_config.php | 4 | ||||
| -rw-r--r-- | config/snort/snort_passlist.php | 3 | ||||
| -rw-r--r-- | config/snort/snort_passlist_edit.php | 17 | ||||
| -rw-r--r-- | config/snort/snort_post_install.php | 4 |
8 files changed, 25 insertions, 43 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index 027207b1..fb8cd9d8 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -45,11 +45,6 @@ ini_set("memory_limit", "384M"); // Explicitly declare this as global so it works through function call includes global $g, $config, $rebuild_rules; -// Grab the Snort binary version programmatically, but if that fails use a safe default -$snortver = array(); -$snortbindir = SNORT_PBI_BINDIR; -exec("{$snortbindir}snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver); - /* Rebuild Rules Flag -- if "true", rebuild enforcing rules and flowbit-rules files */ $rebuild_rules = false; @@ -292,7 +287,8 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false, $extern if (empty($list)) return $list; $localnet = $list['localnets']; - $wanip = $list['wanips']; +// $wanip = $list['wanips']; + $wanip = 'yes'; $wangw = $list['wangateips']; $wandns = $list['wandnsips']; $vips = $list['vips']; @@ -471,7 +467,7 @@ function snort_build_list($snortcfg, $listname = "", $whitelist = false, $extern /* iterate all vips and add to whitelist */ if (is_array($config['virtualip']) && is_array($config['virtualip']['vip'])) { foreach($config['virtualip']['vip'] as $vip) { - if ($vip['subnet'] && $vip['mode'] != 'proxyarp') { + if ($vip['subnet']) { if (!in_array("{$vip['subnet']}/{$vip['subnet_bits']}", $home_net)) $home_net[] = "{$vip['subnet']}/{$vip['subnet_bits']}"; } @@ -3454,7 +3450,7 @@ function snort_prepare_rule_files($snortcfg, $snortcfgdir) { /* Build a new sid-msg.map file from the enabled */ /* rules and copy it to the interface directory. */ - log_error(gettext("[Snort] Building new sig-msg.map file for " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . "...")); + log_error(gettext("[Snort] Building new sid-msg.map file for " . convert_friendly_interface_to_friendly_descr($snortcfg['interface']) . "...")); snort_build_sid_msg_map("{$snortcfgdir}/rules/", "{$snortcfgdir}/sid-msg.map"); } diff --git a/config/snort/snort.xml b/config/snort/snort.xml index e3e1cdad..b8444009 100755 --- a/config/snort/snort.xml +++ b/config/snort/snort.xml @@ -45,7 +45,7 @@ </copyright> <description>Snort IDS/IPS Package</description> <name>Snort</name> - <version>3.2.6</version> + <version>3.2.7</version> <title>Services: Snort IDS</title> <include_file>/usr/local/pkg/snort/snort.inc</include_file> <menu> diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php index 0c4543cd..123661e4 100755 --- a/config/snort/snort_check_for_rule_updates.php +++ b/config/snort/snort_check_for_rule_updates.php @@ -64,19 +64,14 @@ $openappid_detectors = $config['installedpackages']['snortglobal']['openappid_de /* Working directory for downloaded rules tarballs and extraction */ $tmpfname = "{$g['tmp_path']}/snort_rules_up"; -/* Grab the Snort binary version programmatically and use it to construct */ -/* the proper Snort VRT rules tarball and md5 filenames. Fallback to a */ -/* default in the event we fail. */ -$snortver = array(); -exec("{$snortbindir}snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver); -// Save the version with decimal delimiters for use in extracting the rules -$snort_version = $snortver[0]; -if (empty($snort_version)) - $snort_version = SNORT_BIN_VERSION; +/* Use the Snort binary version to construct the proper Snort VRT */ +/* rules tarball and md5 filenames. Save the version with decimal */ +/* delimiters for use in extracting the rules. */ +$snort_version = SNORT_BIN_VERSION; // Create a collapsed version string for use in the tarball filename -$snortver[0] = str_replace(".", "", $snortver[0]); -$snort_filename = "snortrules-snapshot-{$snortver[0]}.tar.gz"; +$snortver = str_replace(".", "", SNORT_BIN_VERSION); +$snort_filename = "snortrules-snapshot-{$snortver}.tar.gz"; $snort_filename_md5 = "{$snort_filename}.md5"; $snort_rule_url = VRT_DNLD_URL; diff --git a/config/snort/snort_defs.inc b/config/snort/snort_defs.inc index 3f5c82e5..ac09db44 100644 --- a/config/snort/snort_defs.inc +++ b/config/snort/snort_defs.inc @@ -49,13 +49,12 @@ if (!defined("SNORTLOGDIR")) define("SNORTLOGDIR", "{$g['varlog_path']}/snort"); if (!defined("SNORT_BIN_VERSION")) { // Grab the Snort binary version programmatically - $snortver = array(); $snortbindir = SNORT_PBI_BINDIR; - mwexec("{$snortbindir}/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26", $snortver); - if (!empty($snortver[0])) - define("SNORT_BIN_VERSION", $snortver[0]); + $snortver = exec_command("{$snortbindir}/snort -V 2>&1 |/usr/bin/grep Version | /usr/bin/cut -c20-26"); + if (!empty($snortver)) + define("SNORT_BIN_VERSION", $snortver); else - define("SNORT_BIN_VERSION", "2.9.7.3"); + define("SNORT_BIN_VERSION", "2.9.7.5"); } if (!defined("SNORT_SID_MODS_PATH")) define('SNORT_SID_MODS_PATH', "{$g['vardb_path']}/snort/sidmods/"); diff --git a/config/snort/snort_migrate_config.php b/config/snort/snort_migrate_config.php index ae1daf6a..edcbb2d5 100644 --- a/config/snort/snort_migrate_config.php +++ b/config/snort/snort_migrate_config.php @@ -541,10 +541,10 @@ unset($r); // Log a message if we changed anything if ($updated_cfg) { - $config['installedpackages']['snortglobal']['snort_config_ver'] = "3.2.6"; log_error("[Snort] Settings successfully migrated to new configuration format..."); } -else +else { log_error("[Snort] Configuration version is current..."); +} ?> diff --git a/config/snort/snort_passlist.php b/config/snort/snort_passlist.php index 965f22d7..1b377a1f 100644 --- a/config/snort/snort_passlist.php +++ b/config/snort/snort_passlist.php @@ -197,7 +197,8 @@ if ($savemsg) { <p><?php echo gettext("1. Here you can create Pass List files for your Snort package rules. Hosts on a Pass List are never blocked by Snort."); ?><br/> <?php echo gettext("2. Add all the IP addresses or networks (in CIDR notation) you want to protect against Snort block decisions."); ?><br/> <?php echo gettext("3. The default Pass List includes the WAN IP and gateway, defined DNS servers, VPNs and locally-attached networks."); ?><br/> - <?php echo gettext("4. Be careful, it is very easy to get locked out of your system by altering the default settings."); ?></p></span></td> + <?php echo gettext("4. Be careful, it is very easy to get locked out of your system by altering the default settings."); ?><br/> + <?php echo gettext("5. To use a custom Pass List on an interface, you must manually assign the list using the drop-down control on the Interface Settings tab."); ?></p></span></td> </tr> <tr> <td width="100%"><span class="vexpl"><?php echo gettext("Remember you must restart Snort on the interface for changes to take effect!"); ?></span></td> diff --git a/config/snort/snort_passlist_edit.php b/config/snort/snort_passlist_edit.php index 75724344..25ebcc82 100644 --- a/config/snort/snort_passlist_edit.php +++ b/config/snort/snort_passlist_edit.php @@ -3,7 +3,7 @@ * snort_passlist_edit.php * Copyright (C) 2004 Scott Ullrich * Copyright (C) 2011-2012 Ermal Luci - * Copyright (C) 2014 Bill Meeks + * Copyright (C) 2015 Bill Meeks * All rights reserved. * * originially part of m0n0wall (http://m0n0.ch/wall) @@ -71,7 +71,7 @@ if (isset($id) && isset($a_passlist[$id])) { $pconfig['address'] = $a_passlist[$id]['address']; $pconfig['descr'] = html_entity_decode($a_passlist[$id]['descr']); $pconfig['localnets'] = $a_passlist[$id]['localnets']; - $pconfig['wanips'] = $a_passlist[$id]['wanips']; +// $pconfig['wanips'] = $a_passlist[$id]['wanips']; $pconfig['wangateips'] = $a_passlist[$id]['wangateips']; $pconfig['wandnsips'] = $a_passlist[$id]['wandnsips']; $pconfig['vips'] = $a_passlist[$id]['vips']; @@ -87,7 +87,7 @@ if ($_GET['act'] == "import") { $pconfig['address'] = htmlspecialchars($_GET['address']); $pconfig['descr'] = htmlspecialchars($_GET['descr']); $pconfig['localnets'] = htmlspecialchars($_GET['localnets'])? 'yes' : 'no'; - $pconfig['wanips'] = htmlspecialchars($_GET['wanips'])? 'yes' : 'no'; +// $pconfig['wanips'] = htmlspecialchars($_GET['wanips'])? 'yes' : 'no'; $pconfig['wangateips'] = htmlspecialchars($_GET['wangateips'])? 'yes' : 'no'; $pconfig['wandnsips'] = htmlspecialchars($_GET['wandnsips'])? 'yes' : 'no'; $pconfig['vips'] = htmlspecialchars($_GET['vips'])? 'yes' : 'no'; @@ -168,7 +168,7 @@ if ($_POST['save']) { $p_list['name'] = $_POST['name']; $p_list['uuid'] = $passlist_uuid; $p_list['localnets'] = $_POST['localnets']? 'yes' : 'no'; - $p_list['wanips'] = $_POST['wanips']? 'yes' : 'no'; +// $p_list['wanips'] = $_POST['wanips']? 'yes' : 'no'; $p_list['wangateips'] = $_POST['wangateips']? 'yes' : 'no'; $p_list['wandnsips'] = $_POST['wandnsips']? 'yes' : 'no'; $p_list['vips'] = $_POST['vips']? 'yes' : 'no'; @@ -255,7 +255,6 @@ if ($savemsg) <tr> <td colspan="2" valign="top" class="listtopic"><?php echo gettext("Add auto-generated IP Addresses."); ?></td> </tr> - <tr> <td width="22%" valign="top" class="vncell"><?php echo gettext("Local Networks"); ?></td> <td width="78%" class="vtable"><input name="localnets" type="checkbox" @@ -263,14 +262,6 @@ if ($savemsg) <?php if($pconfig['localnets'] == 'yes'){ echo "checked";} if($pconfig['localnets'] == ''){ echo "checked";} ?> /> <span class="vexpl"> <?php echo gettext("Add firewall Local Networks to the list (excluding WAN)."); ?> </span></td> </tr> - - <tr> - <td width="22%" valign="top" class="vncell"><?php echo gettext("WAN IPs"); ?></td> - <td width="78%" class="vtable"><input name="wanips" type="checkbox" - id="wanips" size="40" value="yes" - <?php if($pconfig['wanips'] == 'yes'){ echo "checked";} if($pconfig['wanips'] == ''){ echo "checked";} ?> /> - <span class="vexpl"> <?php echo gettext("Add WAN interface IPs to the list."); ?> </span></td> - </tr> <tr> <td width="22%" valign="top" class="vncell"><?php echo gettext("WAN Gateways"); ?></td> <td width="78%" class="vtable"><input name="wangateips" diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php index 280f0efe..bbb2642c 100644 --- a/config/snort/snort_post_install.php +++ b/config/snort/snort_post_install.php @@ -265,8 +265,8 @@ if (stristr($config['widgets']['sequence'], "snort_alerts-container") === FALSE) $config['widgets']['sequence'] .= ",{$snort_widget_container}"; /* Update Snort package version in configuration */ -$config['installedpackages']['snortglobal']['snort_config_ver'] = "3.2.6"; -write_config("Snort pkg v3.2.6: post-install configuration saved."); +$config['installedpackages']['snortglobal']['snort_config_ver'] = $config['installedpackages']['package'][get_pkg_id("snort")]['version']; +write_config("Snort pkg v{$config['installedpackages']['package'][get_pkg_id("snort")]['version']}: post-install configuration saved."); /* Done with post-install, so clear flag */ unset($g['snort_postinstall']); |