From ffc45ec8be2950474f43e2a7d84590d7416cbfd0 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Wed, 2 Apr 2014 15:14:19 -0400 Subject: Add support for IP Reputation preprocessor. --- config/snort/snort_ip_list_mgmt.php | 275 +++++++++++++++++ config/snort/snort_ip_reputation.php | 474 ++++++++++++++++++++++++++++++ config/snort/snort_iprep_list_browser.php | 99 +++++++ 3 files changed, 848 insertions(+) create mode 100644 config/snort/snort_ip_list_mgmt.php create mode 100644 config/snort/snort_ip_reputation.php create mode 100644 config/snort/snort_iprep_list_browser.php (limited to 'config/snort') diff --git a/config/snort/snort_ip_list_mgmt.php b/config/snort/snort_ip_list_mgmt.php new file mode 100644 index 00000000..ae4a1032 --- /dev/null +++ b/config/snort/snort_ip_list_mgmt.php @@ -0,0 +1,275 @@ +. + * All rights reserved. + * + * modified for the pfsense snort package + * Copyright (C) 2009-2010 Robert Zelaya. + * Copyright (C) 2014 Bill Meeks + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort.inc"); + +if (!is_array($config['installedpackages']['snortglobal']['rule'])) + $config['installedpackages']['snortglobal']['rule'] = array(); + +// Hard-code the path where IP Lists are stored +// and disregard any user-supplied path element. +$iprep_path = IPREP_PATH; + +// Set default to not show IP List editor controls +$iplist_edit_style = "display: none;"; + +function snort_is_iplist_active($iplist) { + + /*************************************************** + * This function checks all the configured Snort * + * interfaces to see if the passed IP List is used * + * as a whitelist or blacklist by an interface. * + * * + * Returns: TRUE if IP List is in use * + * FALSE if IP List is not in use * + ***************************************************/ + + global $g, $config; + + if (!is_array($config['installedpackages']['snortglobal']['rule'])) + return FALSE; + + foreach ($config['installedpackages']['snortglobal']['rule'] as $rule) { + if (is_array($rule['wlist_files']['item'])) { + foreach ($rule['wlist_files']['item'] as $file) { + if ($file == $iplist) + return TRUE; + } + } + if (is_array($rule['blist_files']['item'])) { + foreach ($rule['blist_files']['item'] as $file) { + if ($file == $iplist) + return TRUE; + } + } + } + return FALSE; +} + + +if (isset($_POST['upload'])) { + if ($_FILES["iprep_fileup"]["error"] == UPLOAD_ERR_OK) { + $tmp_name = $_FILES["iprep_fileup"]["tmp_name"]; + $name = $_FILES["iprep_fileup"]["name"]; + move_uploaded_file($tmp_name, "{$iprep_path}{$name}"); + } + else + $input_errors[] = gettext("Failed to upload file {$_FILES["iprep_fileup"]["name"]}"); +} + +if (isset($_POST['iplist_delete']) && isset($_POST['iplist_fname'])) { + if (!snort_is_iplist_active($_POST['iplist_fname'])) + unlink_if_exists("{$iprep_path}{$_POST['iplist_fname']}"); + else + $input_errors[] = gettext("This IP List is currently assigned as a Whitelist or Blackist for an interface and cannot be deleted."); +} + +if (isset($_POST['iplist_edit']) && isset($_POST['iplist_fname'])) { + $file = $iprep_path . basename($_POST['iplist_fname']); + $data = file_get_contents($file); + if ($data !== FALSE) { + $iplist_data = htmlspecialchars($data); + $iplist_edit_style = "display: table-row-group;"; + $iplist_name = basename($_POST['iplist_fname']); + unset($data); + } + else { + $input_errors[] = gettext("An error occurred reading the file."); + } +} + +if (isset($_POST['save']) && isset($_POST['iplist_data'])) { + if (strlen(basename($_POST['iplist_name'])) > 0) { + $file = $iprep_path . basename($_POST['iplist_name']); + $data = str_replace("\r\n", "\n", $_POST['iplist_data']); + file_put_contents($file, $data); + unset($data); + } + else { + $input_errors[] = gettext("You must provide a valid filename for the IP List."); + $iplist_edit_style = "display: table-row-group;"; + } +} + +// Get all files in the IP Lists sub-directory as an array +// Leave this as the last thing before spewing the page HTML +// so we can pick up any changes made to files in code above. +$ipfiles = return_dir_as_array($iprep_path); + +$pgtitle = gettext("Snort: IP Reputation Lists"); +include_once("head.inc"); + +?> + + + + + +
+ + + + + + + + + + + + + + + + + +
+ +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+ ');" + src="../themes//images/icons/icon_x.gif" width="17" + height="17" border="0" title=""/>
 
+   " title="" /> +   " onClick="document.getElementById('iplist_editor').style.display='none';" + title="" />
 
+

+



+    +  
+    +  
+    +  
+    +  
+
+
+
+ + + diff --git a/config/snort/snort_ip_reputation.php b/config/snort/snort_ip_reputation.php new file mode 100644 index 00000000..a59021db --- /dev/null +++ b/config/snort/snort_ip_reputation.php @@ -0,0 +1,474 @@ + 4095) + $input_errors[] = gettext("The value for Memory Cap must be an integer between 1 and 4095."); + + // if no errors write to conf + if (!$input_errors) { + + $natent['reputation_preproc'] = $_POST['reputation_preproc'] ? 'on' : 'off'; + $natent['iprep_scan_local'] = $_POST['iprep_scan_local'] ? 'on' : 'off'; + $natent['iprep_memcap'] = $_POST['iprep_memcap']; + $natent['iprep_priority'] = $_POST['iprep_priority']; + $natent['iprep_nested_ip'] = $_POST['iprep_nested_ip']; + $natent['iprep_white'] = $_POST['iprep_white']; + + $a_nat[$id] = $natent; + + write_config(); + + // Update the snort conf file for this interface + $rebuild_rules = false; + snort_generate_conf($a_nat[$id]); + + // Soft-restart Snort to live-load new variables + snort_reload_config($a_nat[$id]); + $pconfig = $natent; + } + else + $pconfig = $_POST; +} + +$if_friendly = convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']); +$pgtitle = gettext("Snort: Interface {$if_friendly} IP Reputation Preprocessor"); +include_once("head.inc"); + +?> + + + + +
+ + + + + + + '; + echo ' + + + + +
+
'; + $menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface "); + $tab_array = array(); + $tab_array[] = array($menu_iface . gettext(" Settings"), false, "/snort/snort_interfaces_edit.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Categories"), false, "/snort/snort_rulesets.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Rules"), false, "/snort/snort_rules.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Variables"), false, "/snort/snort_define_servers.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Preprocs"), false, "/snort/snort_preprocessors.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/snort/snort_barnyard.php?id={$id}"); + $tab_array[] = array($menu_iface . gettext("IP Rep"), true, "/snort/snort_ip_reputation.php?id={$id}"); + display_top_tabs($tab_array, true); + ?> +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ /> + " . gettext("Not Checked.") . ""; ?> +
  + " . + gettext("500.") . "
" . gettext("The Minimum value is ") . + "" . gettext("1 MB") . "" . gettext(" and the Maximum is ") . "" . + gettext("4095 MB.") . " " . gettext("Enter an integer value between 1 and 4095."); ?>
+
+ /> + " . gettext("Not Checked.") . ""; ?>
+

+ +
+ /> +  /> +  /> +
+ " . gettext("Inner") . "."; ?> +
+ /> +  /> +
+ " . gettext("Default is ") . "" . gettext("Whitelist") . "."; ?> +
+ /> +  /> +
+ " . gettext("Unblack") . "."; ?> +
  + " /> +    +
+ + + + + + + + + + + + + + + + + + $f): + $class = "listr"; + if (!file_exists("{$iprep_path}{$f}")) { + $filedate = gettext("Unknown -- file missing"); + $class .= " red"; + } + else + $filedate = date('M-d Y g:i a', filemtime("{$iprep_path}{$f}")); + ?> + + + + + + + + + + +
+
+
+ + + + + + + + + + + + + + + + + + $f): + $class = "listr"; + if (!file_exists("{$iprep_path}{$f}")) { + $filedate = gettext("Unknown -- file missing"); + $class .= " red"; + } + else + $filedate = date('M-d Y g:i a', filemtime("{$iprep_path}{$f}")); + ?> + + + + + + + + + + +
+
+
+
+
+
+ + + + + + diff --git a/config/snort/snort_iprep_list_browser.php b/config/snort/snort_iprep_list_browser.php new file mode 100644 index 00000000..3e4d6b6a --- /dev/null +++ b/config/snort/snort_iprep_list_browser.php @@ -0,0 +1,99 @@ + + + + + + + + + + + + + + + + + +
+ Home + + Close +
+
+ +
+ +   +
+ 		+ +
+ -- cgit v1.2.3