From 10cab278e653f00bd8ec0ee0e82d30e5c7798042 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Wed, 19 Feb 2014 14:08:14 -0500 Subject: BETA version of Suricata 1.4.6 IDS package v0.1 for pfSense. --- config/suricata/suricata_download_updates.php | 241 ++++++++++++++++++++++++++ 1 file changed, 241 insertions(+) create mode 100644 config/suricata/suricata_download_updates.php (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php new file mode 100644 index 00000000..8ff30e9b --- /dev/null +++ b/config/suricata/suricata_download_updates.php @@ -0,0 +1,241 @@ + + + + + +' . $pgtitle . '

';}?> + + + +
+ + + + + + +
+ +
+
+ + + + +
+
+ + + + +
+
+

+ +

+   --> +   
+ SNORT VRT RULES  --> +   
+ SNORT GPLv2 COMMUNITY RULES  --> +   
+

+
+
+
+ + + + +
+
+

+
+
+ + ' . gettext("Update Rules") . '
+

+ ' . gettext("WARNING:") . '  ' . gettext('No rule types have been selected for download. ') . + gettext('Visit the ') . 'Global Settings Tab' . gettext(' to select rule types.') . '
'; + + echo '

' . "\n"; + } else { + + echo ' +
' . "\n"; + + } + + ?>
+

+
+
+
+ + + + +
+
+

+
+
+ " . gettext("View Log") . ""; + echo "          \n"; + }else{ + echo " +    " . gettext("Log is empty.") . "\n"; + } + echo '

' . gettext("The log file is limited to 1024K in size and automatically clears when the limit is exceeded."); + ?> +
+

+
+
+ +
+ + + + + +
+
+ +   " . + gettext(" and ") . "" . gettext("EmergingThreats.net") . "" . + gettext(" will go down from time to time. Please be patient."); ?> +
+
+ +
+
+
+
+ +
+ + + -- cgit v1.2.3 From b33b9a9d050bd5bc8247fc4c95ff7bde39d612f2 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Wed, 19 Feb 2014 22:34:27 -0500 Subject: Incorporate Ermal's comments into Suricata BETA pkg code. --- config/suricata/suricata_download_updates.php | 215 ++++++++++++-------------- 1 file changed, 97 insertions(+), 118 deletions(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index 8ff30e9b..ecfd5f8b 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -34,7 +34,6 @@ require_once("/usr/local/pkg/suricata/suricata.inc"); /* Define some locally required variables from Suricata constants */ $suricatadir = SURICATADIR; $suricata_rules_upd_log = RULES_UPD_LOGFILE; -$log = $suricata_rules_upd_log; /* load only javascript that is needed */ $suricata_load_jquery = 'yes'; @@ -56,7 +55,7 @@ else { $et_name = "EMERGING THREATS RULES"; } -/* quick md5s chk */ +/* quick md5 chk of downloaded rules */ $snort_org_sig_chk_local = 'N/A'; if (file_exists("{$suricatadir}{$snort_rules_file}.md5")) $snort_org_sig_chk_local = file_get_contents("{$suricatadir}{$snort_rules_file}.md5"); @@ -70,48 +69,45 @@ if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) $snort_community_sig_chk_local = file_get_contents("{$suricatadir}{$snort_community_rules_filename}.md5"); /* Check for postback to see if we should clear the update log file. */ -if (isset($_POST['clear'])) { +if ($_POST['clear']) { if (file_exists("{$suricata_rules_upd_log}")) mwexec("/bin/rm -f {$suricata_rules_upd_log}"); } -if (isset($_POST['update'])) { +if ($_POST['update']) { header("Location: /suricata/suricata_download_rules.php"); exit; } /* check for logfile */ -$suricata_rules_upd_log_chk = 'no'; if (file_exists("{$suricata_rules_upd_log}")) $suricata_rules_upd_log_chk = 'yes'; +else + $suricata_rules_upd_log_chk = 'no'; -$pgtitle = gettext("Suricata: Rule Updates"); +if ($_POST['view']&& $suricata_rules_upd_log_chk == 'yes') { + $contents = @file_get_contents($suricata_rules_upd_log); + if (empty($contents)) + $input_errors[] = gettext("Unable to read log file: {$suricata_rules_upd_log}"); +} + +$pgtitle = gettext("Suricata: Update Rules Set Files"); include_once("head.inc"); ?> -' . $pgtitle . '

';}?> - - - +
@@ -128,111 +124,94 @@ h += 96; ?> - + + + +
+
- - + + + + + + + -
-
- + + + + +

+ - + + -
-
-

- -

-   --> -   
- SNORT VRT RULES  --> -   
- SNORT GPLv2 COMMUNITY RULES  --> -   
-

-
- 		  --->
-
- - + + -
-
-

-
-
- - ' . gettext("Update Rules") . '
-

- ' . gettext("WARNING:") . '  ' . gettext('No rule types have been selected for download. ') . - gettext('Visit the ') . 'Global Settings Tab' . gettext(' to select rule types.') . '
'; - - echo '

' . "\n"; - } else { - - echo ' -
' . "\n"; - - } - - ?>
-

-
- 		SNORT VRT RULES  --->
-
- - - + + -
-
-

-
-
- " . gettext("View Log") . ""; - echo "          \n"; - }else{ - echo " -    " . gettext("Log is empty.") . "\n"; - } - echo '

' . gettext("The log file is limited to 1024K in size and automatically clears when the limit is exceeded."); - ?> -
-

-
- 		SNORT GPLv2 COMMUNITY RULES  --->
- -
+

+
+ +

+

+    + Global Settings Tab' . gettext(' to select rule types.'); ?> +

+ +
+ " name="update" id="submit" class="formbtn" + title=""/>

+ +
- - + + + + + + + + + + + - -
-
- -   " . - gettext(" and ") . "" . gettext("EmergingThreats.net") . "" . - gettext(" will go down from time to time. Please be patient."); ?> +
+ +
+ " name="view" id="view" class="formbtn" + title=""/> +            + " name="clear" id="clear" class="formbtn" + title="" onClick="return confirm('Are you sure?\nOK to confirm, or CANCEL to quit');"/> +
+ +
+    
+ +


+
+
+
-
- +
+

+ +   " . + gettext(" and ") . "" . gettext("EmergingThreats.net") . "" . + gettext(" will go down from time to time. Please be patient."); ?>
-
- - + +
-- cgit v1.2.3 From c1717f2d9752d19c54e86e1bcb6cb81f5b253710 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Mon, 24 Feb 2014 00:45:10 -0500 Subject: Bug fixes and replace $_GET with $_POST where possible. --- config/suricata/suricata_download_updates.php | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index ecfd5f8b..200bc834 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -91,6 +91,9 @@ if ($_POST['view']&& $suricata_rules_upd_log_chk == 'yes') { $input_errors[] = gettext("Unable to read log file: {$suricata_rules_upd_log}"); } +if ($_POST['hide']) + $contents = ""; + $pgtitle = gettext("Suricata: Update Rules Set Files"); include_once("head.inc"); ?> @@ -174,15 +177,20 @@ include_once("head.inc");
+ + " name="hide" id="hide" class="formbtn" + title=""/> + " name="view" id="view" class="formbtn" - title=""/> -            + title=""/> + +          " name="clear" id="clear" class="formbtn" - title="" onClick="return confirm('Are you sure?\nOK to confirm, or CANCEL to quit');"/> + title="" onClick="return confirm('Are you sure?\nOK to confirm, or CANCEL to quit');"/>

-    
+




@@ -201,7 +209,7 @@ include_once("head.inc"); -

+
  " . gettext(" and ") . "" . gettext("EmergingThreats.net") . "" . -- cgit v1.2.3 From 9a7842704430cf8d2af118df85efa156d85f950f Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Fri, 28 Feb 2014 20:26:59 -0500 Subject: Match standard GUI style and add a 'force update' feature. --- config/suricata/suricata_download_updates.php | 118 ++++++++++++++++++++------ 1 file changed, 90 insertions(+), 28 deletions(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index 200bc834..6cc585c6 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -35,9 +35,6 @@ require_once("/usr/local/pkg/suricata/suricata.inc"); $suricatadir = SURICATADIR; $suricata_rules_upd_log = RULES_UPD_LOGFILE; -/* load only javascript that is needed */ -$suricata_load_jquery = 'yes'; -$suricata_load_jquery_colorbox = 'yes'; $snortdownload = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules']; $emergingthreats = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules']; $etpro = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules']; @@ -52,21 +49,48 @@ if ($etpro == "on") { } else { $emergingthreats_filename = ET_DNLD_FILENAME; - $et_name = "EMERGING THREATS RULES"; + $et_name = "EMERGING THREATS OPEN RULES"; } /* quick md5 chk of downloaded rules */ -$snort_org_sig_chk_local = 'N/A'; -if (file_exists("{$suricatadir}{$snort_rules_file}.md5")) +if ($snortdownload == 'on') { + $snort_org_sig_chk_local = 'Not Downloaded'; + $snort_org_sig_date = 'Not Downloaded'; +} +else { + $snort_org_sig_chk_local = 'Not Enabled'; + $snort_org_sig_date = 'Not Enabled'; +} +if (file_exists("{$suricatadir}{$snort_rules_file}.md5")){ $snort_org_sig_chk_local = file_get_contents("{$suricatadir}{$snort_rules_file}.md5"); + $snort_org_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$snort_rules_file}.md5")); +} -$emergingt_net_sig_chk_local = 'N/A'; -if (file_exists("{$suricatadir}{$emergingthreats_filename}.md5")) +if ($etpro == "on" || $emergingthreats == "on") { + $emergingt_net_sig_chk_local = 'Not Downloaded'; + $emergingt_net_sig_date = 'Not Downloaded'; +} +else { + $emergingt_net_sig_chk_local = 'Not Enabled'; + $emergingt_net_sig_date = 'Not Enabled'; +} +if (file_exists("{$suricatadir}{$emergingthreats_filename}.md5")) { $emergingt_net_sig_chk_local = file_get_contents("{$suricatadir}{$emergingthreats_filename}.md5"); + $emergingt_net_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$emergingthreats_filename}.md5")); +} -$snort_community_sig_chk_local = 'N/A'; -if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) +if ($snortcommunityrules == 'on') { + $snort_community_sig_chk_local = 'Not Downloaded'; + $snort_community_sig_sig_date = 'Not Downloaded'; +} +else { + $snort_community_sig_chk_local = 'Not Enabled'; + $snort_community_sig_sig_date = 'Not Enabled'; +} +if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) { $snort_community_sig_chk_local = file_get_contents("{$suricatadir}{$snort_community_rules_filename}.md5"); + $snort_community_sig_sig_date = date(DATE_RFC850, filemtime("{$suricatadir}{$snort_community_rules_filename}.md5")); +} /* Check for postback to see if we should clear the update log file. */ if ($_POST['clear']) { @@ -74,7 +98,28 @@ if ($_POST['clear']) { mwexec("/bin/rm -f {$suricata_rules_upd_log}"); } -if ($_POST['update']) { +if ($_POST['check']) { + // Go see if new updates for rule sets are available + header("Location: /suricata/suricata_download_rules.php"); + exit; +} + +if ($_POST['force']) { + // Mount file system R/W since we need to remove files + conf_mount_rw(); + + // Remove the existing MD5 signature files to force a download + if (file_exists("{$suricatadir}{$emergingthreats_filename}.md5")) + @unlink("{$suricatadir}{$emergingthreats_filename}.md5"); + if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5")) + @unlink("{$suricatadir}{$snort_community_rules_filename}.md5"); + if (file_exists("{$suricatadir}{$snort_rules_file}.md5")) + @unlink("{$suricatadir}{$snort_rules_file}.md5"); + + // Revert file system to R/O. + conf_mount_ro(); + + // Go download the updates header("Location: /suricata/suricata_download_rules.php"); exit; } @@ -131,21 +176,32 @@ include_once("head.inc");
- + @@ -156,16 +212,22 @@ include_once("head.inc"); @@ -178,15 +240,15 @@ include_once("head.inc");
- " name="hide" id="hide" class="formbtn" + " name="hide" id="hide" class="formbtn" title=""/> - " name="view" id="view" class="formbtn" + " name="view" id="view" class="formbtn" title=""/> -          - " name="clear" id="clear" class="formbtn" - title="" onClick="return confirm('Are you sure?\nOK to confirm, or CANCEL to quit');"/> +      + " name="clear" id="clear" class="formbtn" + title="" onClick="return confirm('Are you sure you want to delete the log contents?\nOK to confirm, or CANCEL to quit');"/>

@@ -211,7 +273,7 @@ include_once("head.inc"); -- cgit v1.2.3 From 9574aaf65833effdd9d3ac8c087c6ddecf899173 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Sat, 1 Mar 2014 17:57:41 -0500 Subject: Change rule set names from all caps to regular case and some formatting. --- config/suricata/suricata_download_updates.php | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index 6cc585c6..46030bd0 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -45,11 +45,11 @@ $snort_community_rules_filename = GPLV2_DNLD_FILENAME; if ($etpro == "on") { $emergingthreats_filename = ETPRO_DNLD_FILENAME; - $et_name = "EMERGING THREATS PRO RULES"; + $et_name = "Emerging Threats Pro Rules"; } else { $emergingthreats_filename = ET_DNLD_FILENAME; - $et_name = "EMERGING THREATS OPEN RULES"; + $et_name = "Emerging Threats Open Rules"; } /* quick md5 chk of downloaded rules */ @@ -183,25 +183,25 @@ include_once("head.inc");

- +
+ + + + + + + - + + - + + + - + +
  --->
SNORT VRT RULES  --->
SNORT GPLv2 COMMUNITY RULES  --->

-

-

-    +
     + +
+

+   Global Settings Tab' . gettext(' to select rule types.'); ?> -

+


- " name="update" id="submit" class="formbtn" - title=""/>

+ " name="check" id="check" class="formbtn" + title=""/>     + " name="force" id="force" class="formbtn" + title="" + onclick="return confirm('');"/> +


-   " . +  " . gettext(" and ") . "" . gettext("EmergingThreats.net") . "" . gettext(" will go down from time to time. Please be patient."); ?>
- + - - - + + + - - - + + + - - - + + +
  --->
SNORT VRT RULES  --->Snort VRT Rules
SNORT GPLv2 COMMUNITY RULES  --->Snort GPLv2 Community Rules

@@ -225,7 +225,7 @@ include_once("head.inc"); " name="check" id="check" class="formbtn" title=""/>     " name="force" id="force" class="formbtn" - title="" + title="" onclick="return confirm('');"/>

-- cgit v1.2.3 From 3bb4d3df6243a654d9a323df8bc4c648da22c18f Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Fri, 7 Mar 2014 15:45:10 -0500 Subject: Add new 'Last Update' time and status message to window. --- config/suricata/suricata_download_updates.php | 28 ++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index 46030bd0..a353b054 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -40,6 +40,16 @@ $emergingthreats = $config['installedpackages']['suricata']['config'][0]['enable $etpro = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules']; $snortcommunityrules = $config['installedpackages']['suricata']['config'][0]['snortcommunityrules']; +/* Get last update information if available */ +if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_time'])) + $last_rule_upd_time = htmlspecialchars($config['installedpackages']['suricata']['config'][0]['last_rule_upd_time']); +else + $last_rule_upd_time = gettext("Unknown"); +if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_status'])) + $last_rule_upd_status = htmlspecialchars($config['installedpackages']['suricata']['config'][0]['last_rule_upd_status']); +else + $last_rule_upd_status = gettext("Unknown"); + $snort_rules_file = VRT_DNLD_FILENAME; $snort_community_rules_filename = GPLV2_DNLD_FILENAME; @@ -209,6 +219,22 @@ include_once("head.inc"); + + + + + + + + + + + + + +
+ + @@ -226,7 +252,7 @@ include_once("head.inc"); title=""/>     " name="force" id="force" class="formbtn" title="" - onclick="return confirm('');"/> + onclick="return confirm('');"/>

-- cgit v1.2.3 From ca24f17206d370ac5b31ec5a5b535ad2599ecd1e Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Tue, 18 Mar 2014 12:44:38 -0400 Subject: Store last update time as timestamp instead of date string. --- config/suricata/suricata_download_updates.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'config/suricata/suricata_download_updates.php') diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php index a353b054..bae467e4 100644 --- a/config/suricata/suricata_download_updates.php +++ b/config/suricata/suricata_download_updates.php @@ -42,7 +42,7 @@ $snortcommunityrules = $config['installedpackages']['suricata']['config'][0]['sn /* Get last update information if available */ if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_time'])) - $last_rule_upd_time = htmlspecialchars($config['installedpackages']['suricata']['config'][0]['last_rule_upd_time']); + $last_rule_upd_time = date('M-d Y H:i', $config['installedpackages']['suricata']['config'][0]['last_rule_upd_time']); else $last_rule_upd_time = gettext("Unknown"); if (!empty($config['installedpackages']['suricata']['config'][0]['last_rule_upd_status'])) -- cgit v1.2.3