diff options
Diffstat (limited to 'packages')
| -rw-r--r-- | packages/snort/snort.inc | 41 | ||||
| -rw-r--r-- | packages/snort/snort.xml | 8 | ||||
| -rw-r--r-- | packages/snort/snort_blocked.php | 7 |
3 files changed, 53 insertions, 3 deletions
diff --git a/packages/snort/snort.inc b/packages/snort/snort.inc index fd27ad49..0f00687a 100644 --- a/packages/snort/snort.inc +++ b/packages/snort/snort.inc @@ -489,7 +489,11 @@ $snort_alert_file_split = split("\n", file_get_contents("/var/log/snort/alert")) /* obtain alert description for an ip address */ function get_snort_alert($ip) { - global $snort_alert_file_split; + global $snort_alert_file_split, $snort_config; + if(!$snort_config) + $snort_config = read_snort_config_cache(); + if($snort_config[$ip]) + return $snort_config[$ip]; if(!$snort_alert_file_split) $snort_alert_file_split = split("\n", file_get_contents("/var/log/snort/alert")); foreach($snort_alert_file_split as $fileline) { @@ -497,13 +501,20 @@ function get_snort_alert($ip) { $alert_title = $matches[2]; if (preg_match("/(\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)/", $fileline, $matches)) $alert_ip = $matches[0]; - if($alert_ip == $ip) + if($alert_ip == $ip) { + if(!$snort_config[$ip]) + $snort_config[$ip] = $alert_title; return $alert_title; + } } return "n/a"; } function make_clickable($buffer) { + /* if clickable urls is disabled, simply return buffer back to caller */ + $clickablalerteurls = $config['installedpackages']['snort']['config'][0]['oinkmastercode']; + if(!$clickablalerteurls) + return $buffer; $buffer = eregi_replace("(^|[ \n\r\t])((http(s?)://)(www\.)?([a-z0-9_-]+(\.[a-z0-9_-]+)+)(/[^/ \n\r]*)*)","\\1<a href=\"\\2\" target=\"_blank\">\\2</a>", $buffer); $buffer = eregi_replace("(^|[ \n\r\t])((ftp://)(www\.)?([a-z0-9_-]+(\.[a-z0-9_-]+)+)(/[^/ \n\r]*)*)","\\1<a href=\"\\2\" target=\"_blank\">\\2</a>", $buffer); $buffer = eregi_replace("([a-z_-][a-z0-9\._-]*@[a-z0-9_-]+(\.[a-z0-9_-]+)+)","<a href=\"mailto:\\1\">\\1</a>", $buffer); @@ -513,4 +524,30 @@ function make_clickable($buffer) { return $buffer; } +function read_snort_config_cache() { + global $g, $config, $snort_config; + if($snort_config) + return $snort_config; + if(file_exists($g['tmp_path'] . '/snort_config.cache')) { + $snort_config = unserialize(file_get_contents($g['tmp_path'] . '/snort_config.cache')); + return $snort_config; + } + return; +} + +function write_snort_config_cache($snort_config) { + global $g, $config; + conf_mount_rw(); + $configcache = fopen($g['tmp_path'] . '/snort_config.cache', "w"); + if(!$configcache) { + log_error("Could not open {$g['tmp_path']}/snort_config.cache for writing."); + return false; + } + fwrite($configcache, serialize($snort_config)); + fclose($configcache); + conf_mount_ro(); + return true; +} + + ?>
\ No newline at end of file diff --git a/packages/snort/snort.xml b/packages/snort/snort.xml index 73b720c1..5bdf9a06 100644 --- a/packages/snort/snort.xml +++ b/packages/snort/snort.xml @@ -162,7 +162,13 @@ <field> <fielddescr>Whitelist VPNs automatically</fielddescr> <fieldname>whitelistvpns</fieldname> - <description>Checking this option will install whitelists for all VPNs</description> + <description>Checking this option will install whitelists for all VPNs.</description> + <type>checkbox</type> + </field> + <field> + <fielddescr>Convert snort alerts urls to clickable links</fielddescr> + <fieldname>clickablalerteurls</fieldname> + <description>Checking this option will automatically convert URLs in the Snort alerts tab to clickable links.</description> <type>checkbox</type> </field> <field> diff --git a/packages/snort/snort_blocked.php b/packages/snort/snort_blocked.php index 875b8b4a..778e607c 100644 --- a/packages/snort/snort_blocked.php +++ b/packages/snort/snort_blocked.php @@ -123,3 +123,10 @@ This page lists hosts that have been blocked by Snort. Hosts are automatically </body> </html> + +<?php + +/* write out snort cache */ +write_snort_config_cache($snort_config); + +?>
\ No newline at end of file |