diff options
Diffstat (limited to 'config/snort')
| -rw-r--r-- | config/snort/deprecated_rules | 62 | ||||
| -rwxr-xr-x | config/snort/snort.inc | 67 | ||||
| -rwxr-xr-x | config/snort/snort.xml | 5 | ||||
| -rwxr-xr-x | config/snort/snort_check_for_rule_updates.php | 6 | ||||
| -rw-r--r-- | config/snort/snort_interfaces_global.php | 15 | ||||
| -rw-r--r-- | config/snort/snort_migrate_config.php | 8 | ||||
| -rw-r--r-- | config/snort/snort_post_install.php | 3 |
7 files changed, 166 insertions, 0 deletions
diff --git a/config/snort/deprecated_rules b/config/snort/deprecated_rules new file mode 100644 index 00000000..d17cb395 --- /dev/null +++ b/config/snort/deprecated_rules @@ -0,0 +1,62 @@ +# +# Obsoleted Snort VRT rule categories +# +snort_attack-responses.rules +snort_backdoor.rules +snort_bad-traffic.rules +snort_botnet-cnc.rules +snort_chat.rules +snort_ddos.rules +snort_dns.rules +snort_dos.rules +snort_experimental.rules +snort_exploit.rules +snort_finger.rules +snort_ftp.rules +snort_icmp-info.rules +snort_icmp.rules +snort_imap.rules +snort_info.rules +snort_misc.rules +snort_multimedia.rules +snort_mysql.rules +snort_nntp.rules +snort_oracle.rules +snort_other-ids.rules +snort_p2p.rules +snort_phishing-spam.rules +snort_policy.rules +snort_pop2.rules +snort_pop3.rules +snort_rpc.rules +snort_rservices.rules +snort_scada.rules +snort_scan.rules +snort_shellcode.rules +snort_smtp.rules +snort_snmp.rules +snort_specific-threats.rules +snort_spyware-put.rules +snort_telnet.rules +snort_tftp.rules +snort_virus.rules +snort_voip.rules +snort_web-activex.rules +snort_web-attacks.rules +snort_web-cgi.rules +snort_web-client.rules +snort_web-coldfusion.rules +snort_web-frontpage.rules +snort_web-iis.rules +snort_web-misc.rules +snort_web-php.rules +# +# Obsoleted Emerging Threats Categories +# +emerging-rbn-malvertisers.rules +emerging-rbn.rules +# +# Obsoleted Emerging Threats PRO Categories +# +etpro-rbn-malvertisers.rules +etpro-rbn.rules
\ No newline at end of file diff --git a/config/snort/snort.inc b/config/snort/snort.inc index e6de14d6..027207b1 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -3668,6 +3668,73 @@ function snort_generate_conf($snortcfg) { unset($home_net, $external_net, $ipvardef, $portvardef); } +function snort_remove_dead_rules() { + + /********************************************************/ + /* This function removes dead and deprecated rules */ + /* category files from the base Snort rules directory */ + /* and from the RULESETS setting of each interface. */ + /* The file "deprecated_rules", if it exists, is used */ + /* to determine which rules files to remove. */ + /********************************************************/ + + global $config, $g; + $rulesdir = SNORTDIR . "/rules/"; + $count = 0; + $cats = array(); + + // If there is no "deprecated_rules" file, then exit + if (!file_exists("{$rulesdir}deprecated_rules")) + return; + + // Open a SplFileObject to read in deprecated rules + $file = new SplFileObject("{$rulesdir}/deprecated_rules"); + $file->setFlags(SplFileObject::READ_AHEAD | SplFileObject::SKIP_EMPTY | SplFileObject::DROP_NEW_LINE); + while (!$file->eof()) { + $line = $file->fgets(); + + // Skip any lines with just spaces + if (trim($line) == "") + continue; + + // Skip any comment lines starting with '#' + if (preg_match('/^\s*\#+/', $line)) + continue; + + $cats[] = $line; + } + + // Close the SplFileObject since we are finished with it + $file = null; + + // Delete any dead rules files from the Snort RULES directory + foreach ($cats as $file) { + if (file_exists("{$rulesdir}{$file}")) + $count++; + unlink_if_exists("{$rulesdir}{$file}"); + } + + // Log how many obsoleted files were removed + log_error(gettext("[Snort] Removed {$count} obsoleted rules category files.")); + + // Now remove any dead rules files from the interface configurations + if (!empty($cats) && is_array($config['installedpackages']['snortglobal']['rule'])) { + foreach ($config['installedpackages']['snortglobal']['rule'] as &$iface) { + $enabled_rules = explode("||", $iface['rulesets']); + foreach ($enabled_rules as $k => $v) { + foreach ($cats as $d) { + if (strpos(trim($v), $d) !== false) + unset($enabled_rules[$k]); + } + } + $iface['rulesets'] = implode("||", $enabled_rules); + } + } + + // Clean up + unset($cats, $enabled_rules); +} + /* Uses XMLRPC to synchronize the changes to a remote node */ function snort_sync_on_changes() { global $config, $g; diff --git a/config/snort/snort.xml b/config/snort/snort.xml index c9401f05..a9b4bed4 100755 --- a/config/snort/snort.xml +++ b/config/snort/snort.xml @@ -94,6 +94,11 @@ <item>https://packages.pfsense.org/packages/config/snort/snort_sync.xml</item> </additional_files_needed> <additional_files_needed> + <prefix>/usr/local/pkg/snort/</prefix> + <chmod>077</chmod> + <item>https://packages.pfsense.org/packages/config/snort/deprecated_rules</item> + </additional_files_needed> + <additional_files_needed> <prefix>/usr/local/www/snort/</prefix> <chmod>077</chmod> <item>https://packages.pfsense.org/packages/config/snort/snort_alerts.php</item> diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php index 19930f27..0c4543cd 100755 --- a/config/snort/snort_check_for_rule_updates.php +++ b/config/snort/snort_check_for_rule_updates.php @@ -682,6 +682,12 @@ if ($emergingthreats == 'on') { } } +// If removing deprecated rules categories, then do it +if ($config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on") { + log_error(gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories.")); + snort_remove_dead_rules(); +} + function snort_apply_customizations($snortcfg, $if_real) { global $vrt_enabled, $rebuild_rules; diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php index 6c1d56ac..b2ecefee 100644 --- a/config/snort/snort_interfaces_global.php +++ b/config/snort/snort_interfaces_global.php @@ -60,6 +60,7 @@ else { $pconfig['clearblocks'] = $config['installedpackages']['snortglobal']['clearblocks'] == "on" ? 'on' : 'off'; $pconfig['verbose_logging'] = $config['installedpackages']['snortglobal']['verbose_logging'] == "on" ? 'on' : 'off'; $pconfig['openappid_detectors'] = $config['installedpackages']['snortglobal']['openappid_detectors'] == "on" ? 'on' : 'off'; + $pconfig['hide_deprecated_rules'] = $config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on" ? 'on' : 'off'; } /* Set sensible values for any empty default params */ @@ -100,6 +101,7 @@ if (!$input_errors) { $config['installedpackages']['snortglobal']['clearblocks'] = $_POST['clearblocks'] ? 'on' : 'off'; $config['installedpackages']['snortglobal']['verbose_logging'] = $_POST['verbose_logging'] ? 'on' : 'off'; $config['installedpackages']['snortglobal']['openappid_detectors'] = $_POST['openappid_detectors'] ? 'on' : 'off'; + $config['installedpackages']['snortglobal']['hide_deprecated_rules'] = $_POST['hide_deprecated_rules'] ? 'on' : 'off'; // If any rule sets are being turned off, then remove them // from the active rules section of each interface. Start @@ -136,6 +138,12 @@ if (!$input_errors) { } } + // If deprecated rules should be removed, then do it + if ($config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on") { + log_error(gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories.")); + snort_remove_dead_rules(); + } + $config['installedpackages']['snortglobal']['oinkmastercode'] = $_POST['oinkmastercode']; $config['installedpackages']['snortglobal']['etpro_code'] = $_POST['etpro_code']; @@ -334,6 +342,13 @@ if ($input_errors) </td> </tr> <tr> + <td width="22%" valign="top" class="vncell"><?php echo gettext("Hide Deprecated Rules Categories"); ?></td> + <td width="78%" class="vtable"><input name="hide_deprecated_rules" id="hide_deprecated_rules" type="checkbox" value="yes" + <?php if ($pconfig['hide_deprecated_rules']=="on") echo "checked"; ?> /> + <?php echo gettext("Hide deprecated rules categories in the GUI and remove them from the configuration. Default is ") . + "<strong>" . gettext("Not Checked") . "</strong>" . gettext("."); ?></td> +</tr> +<tr> <td colspan="2" valign="top" class="listtopic"><?php echo gettext("Rules Update Settings"); ?></td> </tr> <tr> diff --git a/config/snort/snort_migrate_config.php b/config/snort/snort_migrate_config.php index dcc5aa76..2d8d8927 100644 --- a/config/snort/snort_migrate_config.php +++ b/config/snort/snort_migrate_config.php @@ -117,6 +117,14 @@ if (empty($config['installedpackages']['snortglobal']['openappid_detectors'])) { } /**********************************************************/ +/* Create new HIDE_DEPRECATED_RULES setting if not set */ +/**********************************************************/ +if (empty($config['installedpackages']['snortglobal']['hide_deprecated_rules'])) { + $config['installedpackages']['snortglobal']['hide_deprecated_rules'] = "off"; + $updated_cfg = true; +} + +/**********************************************************/ /* Migrate per interface settings if required. */ /**********************************************************/ foreach ($rule as &$r) { diff --git a/config/snort/snort_post_install.php b/config/snort/snort_post_install.php index 2366c87d..0c0fb723 100644 --- a/config/snort/snort_post_install.php +++ b/config/snort/snort_post_install.php @@ -85,6 +85,9 @@ conf_mount_rw(); @rename("{$snortdir}/gen-msg.map-sample", "{$snortdir}/gen-msg.map"); //@rename("{$snortdir}/attribute_table.dtd-sample", "{$snortdir}/attribute_table.dtd"); +/* Move deprecated_rules file to SNORTDIR/rules directory */ +@rename("/usr/local/pkg/snort/deprecated_rules", "{$snortdir}/rules/deprecated_rules"); + /* fix up the preprocessor rules filenames from a PBI package install */ $preproc_rules = array("decoder.rules", "preprocessor.rules", "sensitive-data.rules"); foreach ($preproc_rules as $file) { |