From c88494af6b8a845218030028fd424f7eb048cd69 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Wed, 2 Apr 2014 15:24:03 -0400 Subject: Use $_POST for config changes and add misc fixes and improvements. --- config/snort/snort_rules.php | 329 ++++++++++++++++++------------------------- 1 file changed, 140 insertions(+), 189 deletions(-) (limited to 'config/snort/snort_rules.php') diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php index afc764fc..158999f9 100755 --- a/config/snort/snort_rules.php +++ b/config/snort/snort_rules.php @@ -37,38 +37,28 @@ global $g, $rebuild_rules; $snortdir = SNORTDIR; $rules_map = array(); +$categories = array(); $pconfig = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'])) $config['installedpackages']['snortglobal']['rule'] = array(); $a_rule = &$config['installedpackages']['snortglobal']['rule']; -$id = $_GET['id']; -if (isset($_POST['id'])) +if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; +elseif (isset($_GET['id']) && is_numericint($_GET['id'])) + $id = htmlspecialchars($_GET['id']); + if (is_null($id)) { - header("Location: /snort/snort_interfaces.php"); - exit; + header("Location: /snort/snort_interfaces.php"); + exit; } -if (isset($id) && $a_rule[$id]) { +if (isset($id) && isset($a_rule[$id])) { $pconfig['interface'] = $a_rule[$id]['interface']; $pconfig['rulesets'] = $a_rule[$id]['rulesets']; } -function truncate($string, $length) { - - /******************************** - * This function truncates the * - * passed string to the length * - * specified adding ellipsis if * - * truncation was necessary. * - ********************************/ - if (strlen($string) > $length) - $string = substr($string, 0, ($length - 2)) . "..."; - return $string; -} - function add_title_attribute($tag, $title) { /******************************** @@ -102,15 +92,19 @@ function add_title_attribute($tag, $title) { } /* convert fake interfaces to real */ -$if_real = snort_get_real_interface($pconfig['interface']); +$if_real = get_real_interface($pconfig['interface']); $snort_uuid = $a_rule[$id]['uuid']; $snortcfgdir = "{$snortdir}/snort_{$snort_uuid}_{$if_real}"; $snortdownload = $config['installedpackages']['snortglobal']['snortdownload']; +$snortcommunitydownload = $config['installedpackages']['snortglobal']['snortcommunityrules'] == 'on' ? 'on' : 'off'; $emergingdownload = $config['installedpackages']['snortglobal']['emergingthreats']; $etprodownload = $config['installedpackages']['snortglobal']['emergingthreats_pro']; -$categories = explode("||", $pconfig['rulesets']); -// add the standard rules files to the categories list +// Add any previously saved rules files to the categories array +if (!empty($pconfig['rulesets'])) + $categories = explode("||", $pconfig['rulesets']); + +// add the standard rules files to the categories array $categories[] = "custom.rules"; $categories[] = "decoder.rules"; $categories[] = "preprocessor.rules"; @@ -121,20 +115,19 @@ if ($a_rule[$id]['autoflowbitrules'] == 'on') $categories[] = "Auto-Flowbit Rules"; natcasesort($categories); -if ($_GET['openruleset']) - $currentruleset = $_GET['openruleset']; -else if ($_POST['openruleset']) +if (isset($_POST['openruleset'])) $currentruleset = $_POST['openruleset']; +elseif (isset($_GET['openruleset'])) + $currentruleset = htmlspecialchars($_GET['openruleset']); else - $currentruleset = $categories[0]; + $currentruleset = $categories[key($categories)]; /* One last sanity check -- if the rules directory is empty, default to loading custom rules */ $tmp = glob("{$snortdir}/rules/*.rules"); if (empty($tmp)) $currentruleset = "custom.rules"; -$ruledir = "{$snortdir}/rules"; -$rulefile = "{$ruledir}/{$currentruleset}"; +$rulefile = "{$snortdir}/rules/{$currentruleset}"; if ($currentruleset != 'custom.rules') { // Read the current rules file into our rules map array. // If it is the auto-flowbits file, set the full path. @@ -157,13 +150,11 @@ if ($currentruleset != 'custom.rules') { $enablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_on']); $disablesid = snort_load_sid_mods($a_rule[$id]['rule_sid_off']); -if ($_GET['act'] == "toggle" && $_GET['ids'] && !empty($rules_map)) { - - // Get the GID tag embedded in the clicked rule icon. - $gid = $_GET['gid']; +if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) && !empty($rules_map)) { - // Get the SID tag embedded in the clicked rule icon. - $sid= $_GET['ids']; + // Get the GID:SID tags embedded in the clicked rule icon. + $gid = $_POST['gid']; + $sid = $_POST['sid']; // See if the target SID is in our list of modified SIDs, // and toggle it back to default if present; otherwise, @@ -207,11 +198,9 @@ if ($_GET['act'] == "toggle" && $_GET['ids'] && !empty($rules_map)) { /* Update the config.xml file. */ write_config(); - $_GET['openruleset'] = $currentruleset; $anchor = "rule_{$gid}_{$sid}"; } - -if ($_GET['act'] == "disable_all" && !empty($rules_map)) { +elseif ($_POST['disable_all'] && !empty($rules_map)) { // Mark all rules in the currently selected category "disabled". foreach (array_keys($rules_map) as $k1) { @@ -248,13 +237,8 @@ if ($_GET['act'] == "disable_all" && !empty($rules_map)) { unset($a_rule[$id]['rule_sid_off']); write_config(); - - $_GET['openruleset'] = $currentruleset; - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; } - -if ($_GET['act'] == "enable_all" && !empty($rules_map)) { +elseif ($_POST['enable_all'] && !empty($rules_map)) { // Mark all rules in the currently selected category "enabled". foreach (array_keys($rules_map) as $k1) { @@ -290,13 +274,8 @@ if ($_GET['act'] == "enable_all" && !empty($rules_map)) { unset($a_rule[$id]['rule_sid_off']); write_config(); - - $_GET['openruleset'] = $currentruleset; - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; } - -if ($_GET['act'] == "resetcategory" && !empty($rules_map)) { +elseif ($_POST['resetcategory'] && !empty($rules_map)) { // Reset any modified SIDs in the current rule category to their defaults. foreach (array_keys($rules_map) as $k1) { @@ -334,13 +313,8 @@ if ($_GET['act'] == "resetcategory" && !empty($rules_map)) { unset($a_rule[$id]['rule_sid_off']); write_config(); - - $_GET['openruleset'] = $currentruleset; - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; } - -if ($_GET['act'] == "resetall" && !empty($rules_map)) { +elseif ($_POST['resetall'] && !empty($rules_map)) { // Remove all modified SIDs from config.xml and save the changes. unset($a_rule[$id]['rule_sid_on']); @@ -348,23 +322,20 @@ if ($_GET['act'] == "resetall" && !empty($rules_map)) { /* Update the config.xml file. */ write_config(); - - $_GET['openruleset'] = $currentruleset; - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; } - -if ($_POST['clear']) { +else if ($_POST['cancel']) { + $pconfig['customrules'] = base64_decode($a_rule[$id]['customrules']); +} +elseif ($_POST['clear']) { unset($a_rule[$id]['customrules']); write_config(); $rebuild_rules = true; snort_generate_conf($a_rule[$id]); $rebuild_rules = false; - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; + $pconfig['customrules'] = ''; } - -if ($_POST['submit']) { +elseif ($_POST['save']) { + $pconfig['customrules'] = $_POST['customrules']; if ($_POST['customrules']) $a_rule[$id]['customrules'] = base64_encode($_POST['customrules']); else @@ -385,11 +356,12 @@ if ($_POST['submit']) { $input_errors[] = "Custom rules have errors:\n {$error}"; } else { - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; + /* Soft-restart Snort to live-load new rules */ + snort_reload_config($a_rule[$id]); + $savemsg = gettext("Custom rules validated successfully and have been saved to the Snort configuration files. "); + $savemsg .= gettext("Any active Snort process on this interface has been signalled to live-load the new rules."); } } - else if ($_POST['apply']) { /* Save new configuration */ write_config(); @@ -404,29 +376,18 @@ else if ($_POST['apply']) { /* Soft-restart Snort to live-load new rules */ snort_reload_config($a_rule[$id]); - - /* Return to this same page */ - header("Location: /snort/snort_rules.php?id={$id}&openruleset={$currentruleset}"); - exit; -} -else if ($_POST['cancel']) { - - /* Return to this same page */ - header("Location: /snort/snort_rules.php?id={$id}"); - exit; } require_once("guiconfig.inc"); include_once("head.inc"); -$if_friendly = snort_get_friendly_interface($pconfig['interface']); +$if_friendly = convert_friendly_interface_to_friendly_descr($a_rule[$id]['interface']); $pgtitle = gettext("Snort: Interface {$if_friendly} - Rules: {$currentruleset}"); ?> ' . $pgtitle . '

';} /* Display message */ if ($input_errors) { @@ -440,6 +401,10 @@ if ($savemsg) { ?>
+ + + + '; echo ' - - @@ -520,43 +485,50 @@ if ($savemsg) { - @@ -579,18 +550,18 @@ if ($savemsg) { @@ -875,10 +825,11 @@ if ($savemsg) {
'; $menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface "); @@ -461,9 +427,10 @@ if ($savemsg) { $tab_array[] = array($menu_iface . gettext("Categories"), false, "/snort/snort_rulesets.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Rules"), true, "/snort/snort_rules.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Variables"), false, "/snort/snort_define_servers.php?id={$id}"); - $tab_array[] = array($menu_iface . gettext("Preprocessors"), false, "/snort/snort_preprocessors.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Preprocs"), false, "/snort/snort_preprocessors.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/snort/snort_barnyard.php?id={$id}"); - display_top_tabs($tab_array); + $tab_array[] = array($menu_iface . gettext("IP Rep"), false, "/snort/snort_ip_reputation.php?id={$id}"); + display_top_tabs($tab_array, true); ?>
@@ -471,20 +438,21 @@ if ($savemsg) {
     
- -
- " title=" "/>   + " title=" "/>   " title=""/>   " onclick="return confirm('')" title=""/> - - + - - - + + + @@ -564,14 +536,13 @@ if ($savemsg) {
" class="formbtn" - title=""/> - -

+ 		" class="formbtn" + title=""/>

" . - gettext("Snort must be restarted to activate any rule enable/disable changes made on this tab."); ?>		 - "?> + title='" . gettext("Click to remove enable/disable changes for rules in the selected category only") . "'/>"?>   
- "?> + title='" . gettext("Click to remove all enable/disable changes for rules in all categories") . "'/>"?>   
- "?> + title='" . gettext("Click to disable all rules in the selected category") . "'/>"?>   
- "?> + title='" . gettext("Click to enable all rules in the selected category") . "'/>"?>   
+ + title="" width="17" height="17" border="0"> +   
 
" . gettext("WARNING: ") . "" . gettext("You should not disable flowbit rules! Add Suppress List entries for them instead by ") . - "" . + "" . gettext("clicking here") . ".";?>
+ - + - - + + - + - + - @@ -599,20 +570,13 @@ if ($savemsg) { - + - + - - $rulem) { @@ -660,51 +624,47 @@ if ($savemsg) { $dstspan = add_title_attribute($textss, $rule_content[5]); $dstprtspan = add_title_attribute($textss, $rule_content[6]); - $protocol = $rule_content[1]; //protocol field - $source = truncate($rule_content[2], 14); //source field - $source_port = truncate($rule_content[3], 10); //source port field - $destination = truncate($rule_content[5], 14); //destination field - $destination_port = truncate($rule_content[6], 10); //destination port field - $message = snort_get_msg($v['rule']); - - echo " - - - - - - - - "; ?> - - @@ -735,12 +694,6 @@ if ($savemsg) { - @@ -788,35 +741,30 @@ if ($savemsg) { else $policy = "none"; - echo " - + - - + - - "; ?> -
- - title="" width="17" height="17" border="0">
$textss - - - $textse + $protocol = $rule_content[1]; //protocol field + $source = $rule_content[2]; //source field + $source_port = $rule_content[3]; //source port field + $destination = $rule_content[5]; //destination field + $destination_port = $rule_content[6]; //destination port field + $message = snort_get_msg($v['rule']); // description field + $sid_tooltip = gettext("View the raw text for this rule"); + + echo "
{$textss} + {$textse} + {$textss}{$gid}{$textse} - {$textss}{$sid}{$textse} + + {$textss}{$sid}{$textse} + {$textss}{$protocol}{$textse} + {$srcspan}{$source} + {$srcprtspan}{$source_port} + {$dstspan}{$destination} + {$dstprtspan}{$destination_port} - {$textss}{$message}{$textse} + + {$textss}{$message}{$textse} - - " width="17" height="17" border="0"> -
- - title="" width="17" height="17" border="0">
$textss - - - $textse - + echo "
{$textss} + {$textse} + {$textss}{$gid}{$textse} - {$textss}{$sid}{$textse} - + + {$textss}{$sid}{$textse} + {$textss}{$classtype} + {$textss}{$policy} - {$textss}{$message}{$textse} + + {$textss}{$message}{$textse} - - " width="17" height="17" border="0"> -
+ +