From 9a4da8fc0de9f80f4a034d03506e8bfe9adceaaa Mon Sep 17 00:00:00 2001
From: Ermal
Date: Sat, 14 Jul 2012 06:23:20 +0000
Subject: Switch to output alert_csv to fix all issues with snort
alerts/blocked descr
---
config/snort/snort_alerts.php | 482 +++++++++++++-----------------------------
1 file changed, 148 insertions(+), 334 deletions(-)
(limited to 'config/snort/snort_alerts.php')
diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php
index 0c6334d9..ea96d673 100644
--- a/config/snort/snort_alerts.php
+++ b/config/snort/snort_alerts.php
@@ -37,10 +37,6 @@
require_once("guiconfig.inc");
require_once("/usr/local/pkg/snort/snort.inc");
-/* load only javascript that is needed */
-$snort_load_sortabletable = 'yes';
-$snort_load_mootools = 'yes';
-
$snortalertlogt = $config['installedpackages']['snortglobal']['snortalertlogtype'];
if ($_GET['instance'])
@@ -66,8 +62,7 @@ if (is_array($config['installedpackages']['snortglobal']['alertsblocks'])) {
$pconfig['arefresh'] = 'off';
}
-if ($_POST['save'])
-{
+if ($_POST['save']) {
if (!is_array($config['installedpackages']['snortglobal']['alertsblocks']))
$config['installedpackages']['snortglobal']['alertsblocks'] = array();
$config['installedpackages']['snortglobal']['alertsblocks']['arefresh'] = $_POST['arefresh'] ? 'on' : 'off';
@@ -79,22 +74,50 @@ if ($_POST['save'])
exit;
}
-if ($_GET['action'] == "clear" || $_POST['delete']) {
- if (file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert")) {
- conf_mount_rw();
- snort_post_delete_logs($snort_uuid);
- $fd = fopen("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert", "w");
- if ($fd) {
- @ftruncate($fd, 0);
- fclose($fd);
+if ($_GET['act'] == "addsuppress" && is_numeric($_GET['sidid']) && is_numeric($_GET['gen_id'])) {
+ $suppress = "suppress gen_id {$_GET['gen_id']}, sig_id {$_GET['sidid']}\n";
+ if (!is_array($config['installedpackages']['snortglobal']['suppress']))
+ $config['installedpackages']['snortglobal']['suppress'] = array();
+ if (!is_array($config['installedpackages']['snortglobal']['suppress']['item']))
+ $config['installedpackages']['snortglobal']['suppress']['item'] = array();
+ $a_suppress = &$config['installedpackages']['snortglobal']['suppress']['item'];
+
+ if (empty($a_instance[$instanceid]['suppresslistname']) || $a_instance[$instanceid]['suppresslistname'] == 'default') {
+ $s_list = array();
+ $s_list['name'] = $a_instance[$instanceid]['interface'] . "suppress";
+ $s_list['uuid'] = uniqid();
+ $s_list['descr'] = "Auto generted list for suppress";
+ $s_list['suppresspassthru'] = base64_encode($suppress);
+ $a_suppress[] = $s_list;
+ $a_instance[$instanceid]['suppresslistname'] = $s_list['name'];
+ } else {
+ foreach ($a_suppress as $a_id => $alist) {
+ if ($alist['name'] == $a_instance[$instanceid]['suppresslistname']) {
+ if (!empty($alist['suppresspassthru'])) {
+ $tmplist = base64_decode($alist['suppresspassthru']);
+ $tmplist .= "\n{$suppress}";
+ $alist['suppresspassthru'] = base64_encode($tmplist);
+ $a_suppress[$a_id] = $alist;
+ }
+ }
}
- conf_mount_ro();
- /* XXX: This is needed is snort is run as snort user */
- //mwexec('/usr/sbin/chown snort:snort /var/log/snort/*', true);
- mwexec('/bin/chmod 660 /var/log/snort/*', true);
- if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid"))
- mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a");
}
+ write_config();
+ sync_snort_package_config();
+}
+
+if ($_GET['action'] == "clear" || $_POST['delete']) {
+ conf_mount_rw();
+ snort_post_delete_logs($snort_uuid);
+ $fd = @fopen("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert", "w+");
+ if ($fd)
+ fclose($fd);
+ conf_mount_ro();
+ /* XXX: This is needed is snort is run as snort user */
+ //mwexec('/usr/sbin/chown snort:snort /var/log/snort/*', true);
+ mwexec('/bin/chmod 660 /var/log/snort/*', true);
+ if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid"))
+ mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a");
header("Location: /snort/snort_alerts.php?instance={$instanceid}");
exit;
}
@@ -114,140 +137,13 @@ if ($_POST['download']) {
header("Content-length: ".filesize($file));
header("Content-disposition: attachment; filename = {$file_name}");
readfile("$file");
- exec("/bin/rm /tmp/{$file_name}");
+ @unlink("/tmp/{$file_name}");
}
header("Location: /snort/snort_alerts.php?instance={$instanceid}");
exit;
}
-/* WARNING: took me forever to figure reg expression, dont lose */
-// $fileline = '12/09-18:12:02.086733 [**] [122:6:0] (portscan) TCP Filtered Decoy Portscan [**] [Priority: 3] {PROTO:255} 125.135.214.166 -> 70.61.243.50';
-function get_snort_alert_date($fileline)
-{
- /* date full date \d+\/\d+-\d+:\d+:\d+\.\d+\s */
- if (preg_match("/\d+\/\d+-\d+:\d+:\d\d/", $fileline, $matches))
- $alert_date = "$matches[0]";
-
- return $alert_date;
-}
-
-function get_snort_alert_disc($fileline)
-{
- /* disc */
- if (preg_match("/\[\*\*\] (\[.*\]) (.*) (\[\*\*\])/", $fileline, $matches))
- $alert_disc = "$matches[2]";
-
- return $alert_disc;
-}
-
-function get_snort_alert_class($fileline)
-{
- /* class */
- if (preg_match('/\[Classification:\s.+[^\d]\]/', $fileline, $matches))
- $alert_class = "$matches[0]";
-
- return $alert_class;
-}
-
-function get_snort_alert_priority($fileline)
-{
- /* Priority */
- if (preg_match('/Priority:\s\d/', $fileline, $matches))
- $alert_priority = "$matches[0]";
-
- return $alert_priority;
-}
-
-function get_snort_alert_proto($fileline)
-{
- /* Priority */
- if (preg_match('/\{.+\}/', $fileline, $matches))
- $alert_proto = "$matches[0]";
-
- return $alert_proto;
-}
-
-function get_snort_alert_proto_full($fileline)
-{
- /* Protocal full */
- if (preg_match('/.+\sTTL/', $fileline, $matches))
- $alert_proto_full = "$matches[0]";
-
- return $alert_proto_full;
-}
-
-function get_snort_alert_ip_src($fileline)
-{
- /* SRC IP */
- $re1='.*?'; # Non-greedy match on filler
- $re2='((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))(?![\\d])'; # IPv4 IP Address 1
-
- if (preg_match_all ("/".$re1.$re2."/is", $fileline, $matches))
- $alert_ip_src = $matches[1][0];
-
- return $alert_ip_src;
-}
-
-function get_snort_alert_src_p($fileline)
-{
- /* source port */
- if (preg_match('/:\d+\s-/', $fileline, $matches))
- $alert_src_p = "$matches[0]";
-
- return $alert_src_p;
-}
-
-function get_snort_alert_flow($fileline)
-{
- /* source port */
- if (preg_match('/(->|<-)/', $fileline, $matches))
- $alert_flow = "$matches[0]";
-
- return $alert_flow;
-}
-
-function get_snort_alert_ip_dst($fileline)
-{
- /* DST IP */
- $re1dp='.*?'; # Non-greedy match on filler
- $re2dp='(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?![\\d])'; # Uninteresting: ipaddress
- $re3dp='.*?'; # Non-greedy match on filler
- $re4dp='((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))(?![\\d])'; # IPv4 IP Address 1
-
- if (preg_match_all("/".$re1dp.$re2dp.$re3dp.$re4dp."/is", $fileline, $matches))
- $alert_ip_dst = $matches[1][0];
-
- return $alert_ip_dst;
-}
-
-function get_snort_alert_dst_p($fileline)
-{
- /* dst port */
- if (preg_match('/:\d+$/', $fileline, $matches))
- $alert_dst_p = "$matches[0]";
-
- return $alert_dst_p;
-}
-
-function get_snort_alert_dst_p_full($fileline)
-{
- /* dst port full */
- if (preg_match('/:\d+\n[A-Z]+\sTTL/', $fileline, $matches))
- $alert_dst_p = "$matches[0]";
-
- return $alert_dst_p;
-}
-
-function get_snort_alert_sid($fileline)
-{
- /* SID */
- if (preg_match('/\[\d+:\d+:\d+\]/', $fileline, $matches))
- $alert_sid = "$matches[0]";
-
- return $alert_sid;
-}
-
$pgtitle = "Services: Snort: Snort Alerts";
include_once("head.inc");
@@ -263,7 +159,12 @@ if ($pconfig['arefresh'] == 'on')
echo "\n";
?>
-' . $pgtitle . '
';}?>
+' . $pgtitle . '';}
+ /* Display Alert message */
+ if ($input_errors) {
+ print_input_errors($input_errors); // TODO: add checks
+ }
+?>
|
-
-
-
-
+ |
+
-
-
-
- # |
- PRI |
- PROTO |
- DESCRIPTION |
- CLASS |
- SRC |
- SPORT |
- FLOW |
- DST |
- DPORT |
- SID |
- Date |
-
-
- $fileline) {
- if (empty($fileline))
- continue;
- if ($counter > $anentries)
- break;
-
- /* Date */
- $alert_date_str = get_snort_alert_date($fileline);
- if($alert_date_str != '')
- $alert_date = $alert_date_str;
- else
- $alert_date = 'empty';
-
- /* Discription */
- $alert_disc_str = get_snort_alert_disc($fileline);
- if(empty($alert_disc_str))
- $alert_disc = 'empty';
- else
- $alert_disc = $alert_disc_str;
-
- /* Classification */
- $alert_class_str = get_snort_alert_class($fileline);
- if($alert_class_str != '')
- {
- $alert_class_match = array('[Classification:',']');
- $alert_class = str_replace($alert_class_match, '', "$alert_class_str");
- }else{
- $alert_class = 'Prep';
- }
-
- /* Priority */
- $alert_priority_str = get_snort_alert_priority($fileline);
- if($alert_priority_str != '')
- {
- $alert_priority_match = array('Priority: ',']');
- $alert_priority = str_replace($alert_priority_match, '', "$alert_priority_str");
- }else{
- $alert_priority = 'empty';
- }
-
- /* Protocol */
- /* Detect alert file type */
- if ($snortalertlogt == 'full')
- {
- $alert_proto_str = get_snort_alert_proto_full($fileline);
- }else{
- $alert_proto_str = get_snort_alert_proto($fileline);
- }
-
- if($alert_proto_str != '')
- {
- $alert_proto_match = array(" TTL",'{','}');
- $alert_proto = str_replace($alert_proto_match, '', "$alert_proto_str");
- }else{
- $alert_proto = 'empty';
- }
-
- /* IP SRC */
- $alert_ip_src_str = get_snort_alert_ip_src($fileline);
- if($alert_ip_src_str != '')
- {
- $alert_ip_src = $alert_ip_src_str;
- }else{
- $alert_ip_src = 'empty';
- }
-
- /* IP SRC Port */
- $alert_src_p_str = get_snort_alert_src_p($fileline);
- if($alert_src_p_str != '')
- {
- $alert_src_p_match = array(' -',':');
- $alert_src_p = str_replace($alert_src_p_match, '', "$alert_src_p_str");
- }else{
- $alert_src_p = 'empty';
- }
-
- /* Flow */
- $alert_flow_str = get_snort_alert_flow($fileline);
- if($alert_flow_str != '')
- {
- $alert_flow = $alert_flow_str;
- }else{
- $alert_flow = 'empty';
- }
-
- /* IP Destination */
- $alert_ip_dst_str = get_snort_alert_ip_dst($fileline);
- if($alert_ip_dst_str != '')
- {
- $alert_ip_dst = $alert_ip_dst_str;
- }else{
- $alert_ip_dst = 'empty';
- }
-
- /* IP DST Port */
- if ($snortalertlogt == 'full')
- {
- $alert_dst_p_str = get_snort_alert_dst_p_full($fileline);
- }else{
- $alert_dst_p_str = get_snort_alert_dst_p($fileline);
- }
-
- if($alert_dst_p_str != '')
- {
- $alert_dst_p_match = array(':',"\n"," TTL");
- $alert_dst_p_str2 = str_replace($alert_dst_p_match, '', "$alert_dst_p_str");
- $alert_dst_p_match2 = array('/[A-Z]/');
- $alert_dst_p = preg_replace($alert_dst_p_match2, '', "$alert_dst_p_str2");
- }else{
- $alert_dst_p = 'empty';
- }
-
- /* SID */
- $alert_sid_str = get_snort_alert_sid($fileline);
-
- if($alert_sid_str != '')
- {
- $alert_sid_match = array('[',']');
- $alert_sid = str_replace($alert_sid_match, '', "$alert_sid_str");
- }else{
- $alert_sid_str = 'empty';
- }
-
- /* NOTE: using one echo improves performance by 2x */
- echo "
- {$counter} |
- {$alert_priority} |
- {$alert_proto} |
- {$alert_disc} |
- {$alert_class} |
- {$alert_ip_src} |
- {$alert_src_p} |
- {$alert_flow} |
- {$alert_ip_dst} |
- {$alert_dst_p} |
- {$alert_sid} |
- {$alert_date} |
+
+
+
+
+
+
+
+ # |
+ PRI |
+ PROTO |
+ DESCRIPTION |
+ CLASS |
+ SRC |
+ SPORT |
+ DST |
+ DPORT |
+ SID |
+ Date |
+
+
+ $anentries)
+ break;
+ $fields = explode(",", $fileline);
+
+ /* Date */
+ $alert_date = $fields[0];
+ /* Description */
+ $alert_descr = $fields[4];
+ /* Priority */
+ $alert_priority = $fields[12];
+ /* Protocol */
+ $alert_proto = $fields[5];
+ /* IP SRC */
+ $alert_ip_src = $fields[6];
+ /* IP SRC Port */
+ $alert_src_p = $fields[7];
+ /* IP Destination */
+ $alert_ip_dst = $fields[8];
+ /* IP DST Port */
+ $alert_dst_p = $fields[9];
+ /* SID */
+ $alert_sid_str = "{$fields[1]}:{$fields[2]}:{$fields[3]}";
+ $alert_class = $fields[10];
+
+ echo "
+ {$counter} |
+ {$alert_priority} |
+ {$alert_proto} |
+ {$alert_descr} |
+ {$alert_class} |
+ {$alert_ip_src} |
+ {$alert_src_p} |
+ {$alert_ip_dst} |
+ {$alert_dst_p} |
+
+ {$alert_sid_str}
+
+
+ |
+ {$alert_date} |
\n";
- }
+
+ $counter++;
}
- ?>
+ fclose($fd);
+ }
+}
+?>
|
+
+
+
+
+ |
--
cgit v1.2.3
|