From 595c831d2768547d49e6daf147889c6aee15f9a4 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Mon, 18 Nov 2013 18:59:41 -0500 Subject: Snort 2.9.5.5 pkg v3.0.0 update --- config/snort/snort_interfaces_global.php | 138 ++++++++++++++++++++----------- 1 file changed, 88 insertions(+), 50 deletions(-) (limited to 'config/snort/snort_interfaces_global.php') diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php index 089255b6..77cb0e7c 100644 --- a/config/snort/snort_interfaces_global.php +++ b/config/snort/snort_interfaces_global.php @@ -58,7 +58,7 @@ $pconfig['snortcommunityrules'] = $config['installedpackages']['snortglobal']['s if (empty($pconfig['snortloglimit'])) $pconfig['snortloglimit'] = 'on'; if (empty($pconfig['rule_update_starttime'])) - $pconfig['rule_update_starttime'] = '00:03'; + $pconfig['rule_update_starttime'] = '00:30'; if ($_POST['rule_update_starttime']) { if (!preg_match('/^([01]?[0-9]|2[0-3]):?([0-5][0-9])$/', $_POST['rule_update_starttime'])) @@ -71,15 +71,49 @@ if ($_POST['snortdownload'] == "on" && empty($_POST['oinkmastercode'])) if ($_POST['emergingthreats_pro'] == "on" && empty($_POST['etpro_code'])) $input_errors[] = "You must supply a subscription code in the box provided in order to enable Emerging Threats Pro rules!"; -/* if no errors move foward */ +/* if no errors move foward with save */ if (!$input_errors) { if ($_POST["Submit"]) { $config['installedpackages']['snortglobal']['snortdownload'] = $_POST['snortdownload'] ? 'on' : 'off'; - $config['installedpackages']['snortglobal']['oinkmastercode'] = $_POST['oinkmastercode']; $config['installedpackages']['snortglobal']['snortcommunityrules'] = $_POST['snortcommunityrules'] ? 'on' : 'off'; $config['installedpackages']['snortglobal']['emergingthreats'] = $_POST['emergingthreats'] ? 'on' : 'off'; $config['installedpackages']['snortglobal']['emergingthreats_pro'] = $_POST['emergingthreats_pro'] ? 'on' : 'off'; + + // If any rule sets are being turned off, then remove them + // from the active rules section of each interface. Start + // by building an arry of prefixes for the disabled rules. + $disabled_rules = array(); + $disable_ips_policy = false; + if ($config['installedpackages']['snortglobal']['snortdownload'] == 'off') { + $disabled_rules[] = VRT_FILE_PREFIX; + $disable_ips_policy = true; + } + if ($config['installedpackages']['snortglobal']['snortcommunityrules'] == 'off') + $disabled_rules[] = GPL_FILE_PREFIX; + if ($config['installedpackages']['snortglobal']['emergingthreats'] == 'off') + $disabled_rules[] = ET_OPEN_FILE_PREFIX; + if ($config['installedpackages']['snortglobal']['emergingthreats_pro'] == 'off') + $disabled_rules[] = ET_PRO_FILE_PREFIX; + + // Now walk all the configured interface rulesets and remove + // any matching the disabled ruleset prefixes. + foreach ($config['installedpackages']['snortglobal']['rule'] as &$iface) { + // Disable Snort IPS policy if VRT rules are disabled + if ($disable_ips_policy) { + $iface['ips_policy_enable'] = 'off'; + unset($iface['ips_policy']); + } + $enabled_rules = explode("||", $iface['rulesets']); + foreach ($enabled_rules as $k => $v) { + foreach ($disabled_rules as $d) + if (strpos(trim($v), $d) !== false) + unset($enabled_rules[$k]); + } + $iface['rulesets'] = implode("||", $enabled_rules); + } + + $config['installedpackages']['snortglobal']['oinkmastercode'] = $_POST['oinkmastercode']; $config['installedpackages']['snortglobal']['etpro_code'] = $_POST['etpro_code']; $config['installedpackages']['snortglobal']['rm_blocked'] = $_POST['rm_blocked']; @@ -122,7 +156,7 @@ if (!$input_errors) { } } -$pgtitle = 'Services: Snort: Global Settings'; +$pgtitle = gettext("Snort: Global Settings"); include_once("head.inc"); ?> @@ -137,7 +171,7 @@ if($pfsense_stable == 'yes') /* Display Alert message, under form tag or no refresh */ if ($input_errors) - print_input_errors($input_errors); // TODO: add checks + print_input_errors($input_errors); ?> @@ -162,11 +196,10 @@ if ($input_errors)
- + - + - + - + -
' , ''); ?>" . gettext("Snort VRT") . "" . gettext(" rules");?> @@ -175,45 +208,44 @@ if ($input_errors) - +
 
+
+ -
 
-
'on') echo 'disabled'; ?>>
+ class="formfld unknown" id="oinkmastercode" size="52" + value="">
' , ''); ?>" . gettext("Snort Community") . "" . gettext(" rules");?> - + > +
> -

' ,''); ?>
 +

" . gettext("Note: ") . "" . + gettext("If you are a Snort VRT Paid Subscriber, the community ruleset is already built into your download of the ") . + gettext("Snort VRT rules, and there is no benefit in adding this rule set.");?>
' , ''); ?>" . gettext("Emerging Threats") . "" . gettext(" rules");?> @@ -236,20 +268,19 @@ if ($input_errors) +
" . gettext("Note:") . "" . " " . gettext("The ETPro rules contain all of the ETOpen rules, so the ETOpen rules are not required and are disabled when the ETPro rules are selected."); ?>
+ -
 
-
'on') echo 'disabled'; ?>>
+ class="formfld unknown" id="etpro_code" size="52" + value="">
@@ -276,7 +307,7 @@ if ($input_errors)
>   " . gettext("Default") . " " . gettext("is ") . "" . gettext("00:03") . ""; ?>.

@@ -304,44 +335,42 @@ if ($input_errors)
> -
-
+
+
- - +
MB -   ', ''); ?>" . gettext("MB:") . "";?>  + +  " . gettext("20%") . "" . gettext(" of available space.");?>
- +    -

- ', ''); ?> +   +

+ " . gettext("Hint:") . "" . gettext(" in most cases, 1 hour is a good choice.");?> - + - >   + >   @@ -351,10 +380,8 @@ if ($input_errors)   -
- +   +

@@ -367,15 +394,17 @@ if ($input_errors) -- cgit v1.2.3