diff options
Diffstat (limited to 'config')
| -rw-r--r-- | config/snort/snort.inc | 6 | ||||
| -rw-r--r-- | config/snort/snort_interfaces_edit.php | 46 |
2 files changed, 48 insertions, 4 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index 98d7ebfa..6aef1eed 100644 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -1383,7 +1383,11 @@ function generate_snort_conf($id, $if_real, $snort_uuid) else if (file_exists("/usr/local/etc/snort/whitelist/{$snortcfg['whitelistname']}")) $spoink_whitelist_name = $snortcfg['whitelistname']; - $spoink_type = "output alert_pf: /usr/local/etc/snort/whitelist/{$spoink_whitelist_name},snort2c"; + $pfkill = ""; + if ($snortcfg['blockoffenderskill'] == "on") + $pfkill = "kill"; + + $spoink_type = "output alert_pf: /usr/local/etc/snort/whitelist/{$spoink_whitelist_name},snort2c,{$snortcfg['blockoffendersip']},{$pfkill}"; } /* define threshold file */ diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php index 3b4ae8b4..90f48a4b 100644 --- a/config/snort/snort_interfaces_edit.php +++ b/config/snort/snort_interfaces_edit.php @@ -128,6 +128,8 @@ if (isset($id) && $a_nat[$id]) { $pconfig['descr'] = $a_nat[$id]['descr']; $pconfig['performance'] = $a_nat[$id]['performance']; $pconfig['blockoffenders7'] = $a_nat[$id]['blockoffenders7']; + $pconfig['blockoffenderskill'] = $a_nat[$id]['blockoffenderskill']; + $pconfig['blockoffendersip'] = $a_nat[$id]['blockoffendersip']; $pconfig['whitelistname'] = $a_nat[$id]['whitelistname']; $pconfig['homelistname'] = $a_nat[$id]['homelistname']; $pconfig['externallistname'] = $a_nat[$id]['externallistname']; @@ -204,6 +206,11 @@ if (isset($_GET['dup'])) $natent['blockoffenders7'] = 'on'; else $natent['blockoffenders7'] = 'off'; + if ($_POST['blockoffenderskill'] == "on") + $natent['blockoffenderskill'] = 'on'; + if ($_POST['blockoffendersip']) + $natent['blockoffendersip'] = $_POST['blockoffendersip']; + $natent['whitelistname'] = $_POST['whitelistname'] ? $_POST['whitelistname'] : $pconfig['whitelistname']; $natent['homelistname'] = $_POST['homelistname'] ? $_POST['homelistname'] : $pconfig['homelistname']; $natent['externallistname'] = $_POST['externallistname'] ? $_POST['externallistname'] : $pconfig['externallistname']; @@ -340,6 +347,12 @@ enable JavaScript to view this content</strong></div> <script language="JavaScript"> <!-- +function enable_blockoffenders() { + var endis = !(document.iform.blockoffenders7.checked); + document.iform.blockoffenderskill.disabled=endis; + document.iform.blockoffendersip.disabled=endis; +} + function enable_change(enable_change) { endis = !(document.iform.enable.checked || enable_change); // make shure a default answer is called if this is envoked. @@ -562,14 +575,40 @@ function enable_change(enable_change) { </tr> <tr> <td width="22%" valign="top" class="vncell2">Block offenders</td> - <td width="78%" class="vtable"><input name="blockoffenders7" - type="checkbox" value="on" + <td width="78%" class="vtable"> + <input name="blockoffenders7" id="blockoffenders7" type="checkbox" value="on" <?php if ($pconfig['blockoffenders7'] == "on") echo "checked"; ?> - onClick="enable_change(false)"><br> + onClick="enable_blockoffenders()"><br> Checking this option will automatically block hosts that generate a Snort alert.</td> </tr> <tr> + <td width="22%" valign="top" class="vncell2">Kill states</td> + <td width="78%" class="vtable"> + <input name="blockoffenderskill" id="blockoffenderskill" type="checkbox" value="on" <?php if ($pconfig['blockoffenderskill'] == "on") echo "checked"; ?>> + <br/>Should firewall states be killed for the blocked ip + </td> + </tr> + <tr> + <td width="22%" valign="top" class="vncell2">Which ip to block</td> + <td width="78%" class="vtable"> + <select name="blockoffendersip" class="formfld" id="blockoffendersip"> + <?php + foreach (array("src", "dst", "both") as $btype) { + if ($value['snortlisttype'] == 'whitelist') { + if ($btype == $pconfig['blockoffendersip']) + echo "<option value='{$btype}' selected>"; + else + echo "<option value='{$btype}'>"; + echo htmlspecialchars($btype) . '</option>'; + } + } + ?> + </select> + <br/> Which ip extracted from the packet you want to block + </td> + </tr> + <tr> <td width="22%" valign="top" class="vncell2">Whitelist</td> <td width="78%" class="vtable"> <select name="whitelistname" class="formfld" id="whitelistname"> @@ -687,6 +726,7 @@ function enable_change(enable_change) { <script language="JavaScript"> <!-- enable_change(false); +enable_blockoffenders(); //--> </script> |