From 19598c0fc7074cfbb42e32cd8f0354c74a7c6c22 Mon Sep 17 00:00:00 2001 From: robiscool Date: Wed, 1 Jun 2011 19:01:11 -0700 Subject: snort-dev, add update code, add update tab --- config/snort-dev/css/style_snort2.css | 16 +- config/snort-dev/snort_download_rules.inc | 409 ++++++++++++++++++++++++++++ config/snort-dev/snort_download_updates.php | 333 ++++++++++++++++++++++ config/snort-dev/snort_headbase.inc | 1 + config/snort-dev/snort_json_get.php | 43 ++- 5 files changed, 791 insertions(+), 11 deletions(-) create mode 100644 config/snort-dev/snort_download_rules.inc create mode 100644 config/snort-dev/snort_download_updates.php (limited to 'config') diff --git a/config/snort-dev/css/style_snort2.css b/config/snort-dev/css/style_snort2.css index 07d21de6..54ce4af6 100644 --- a/config/snort-dev/css/style_snort2.css +++ b/config/snort-dev/css/style_snort2.css @@ -87,7 +87,7 @@ a { visibility:hidden; } -#loadingWaiting, #loadingRuleEditGUI{ +#loadingWaiting, #loadingRuleEditGUI, #loadingRuleUpadteGUI{ display:none; position:fixed; left:0; @@ -99,24 +99,22 @@ a { color: #ffffff; } -.loadingRuleEditGUIDiv { +.loadingWaitingMessage{ position: absolute; - top: 2%; - left: 5%; - right: 5%; - bottom: 50%; + top: 25%; + left: 50%; color: #ffffff; z-index: 9999; text-align: center; } -.loadingWaitingMessage { +.loadingWaitingUpdateGUI{ position: absolute; top: 25%; - left: 50%; + left: 35%; color: #ffffff; z-index: 9999; text-align: center; @@ -241,7 +239,7 @@ padding-bottom: 12px; .vncell2 { background-color: #eeeeee; padding-right: 5px; - padding-left: 8px; + padding-left: 5px; border-bottom: 1px solid #999999; font-size: 11px; } diff --git a/config/snort-dev/snort_download_rules.inc b/config/snort-dev/snort_download_rules.inc new file mode 100644 index 00000000..92714795 --- /dev/null +++ b/config/snort-dev/snort_download_rules.inc @@ -0,0 +1,409 @@ +#!/usr/local/bin/php + "") { + $file_size = intval($regs[2]); + } + ob_flush(); + return $length; + } + + function read_body2($ch, $string) { + global $fout, $file_size, $downloaded, $sendto, $static_status, $static_output, $lastseen; + global $pkg_interface; + $length = strlen($string); + $downloaded += intval($length); + if($file_size > 0) { + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + } else + $downloadProgress = 0; + if($lastseen <> $downloadProgress and $downloadProgress < 101) { + if($sendto == "status") { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } else { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } + update_progress_bar($downloadProgress); + $lastseen = $downloadProgress; + } + if($fout) + fwrite($fout, $string); + ob_flush(); + return $length; + } + + /* + * update_progress_bar($percent): updates the javascript driven progress bar. + */ + function update_progress_bar2($percent, $file_size, $downloaded) + { + if($percent > 100) $percent = 1; + + if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on') + { + snortSql_updateRuleSetList('percent2', $percent, $file_size, $downloaded, $GLOBALS['tmp']['snort']['downloadupdate']['workingfile']); // write out percent to db + }else{ + echo "\n" . 'percent: ' . $percent . ' filesize: ' . $file_size . ' downloaded: ' . $downloaded; + } + } + + + function read_body_firmware($ch, $string) { + global $fout, $file_size, $downloaded, $counter; + $length = strlen($string); + $downloaded += intval($length); + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + $counter++; + if($counter > 150) { + update_progress_bar2($downloadProgress, $file_size, $downloaded); + flush(); + $counter = 0; + } + fwrite($fout, $string); + return $length; + } + + function download_file_with_progress_bar2($url_file, $destination, $workingfile, $readbody = 'read_body2') { + global $ch, $fout, $file_size, $downloaded; + $file_size = 1; + $downloaded = 1; + $destination_file = $destination . '/' . $workingfile; + + /* open destination file */ + $fout = fopen($destination_file, "wb"); + + /* + * Originally by Author: Keyvan Minoukadeh + * Modified by Scott Ullrich to return Content-Length size + */ + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url_file); + curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'read_header2'); + curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($ch, CURLOPT_WRITEFUNCTION, $readbody); + curl_setopt($ch, CURLOPT_NOPROGRESS, '1'); + curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, '5'); + curl_setopt($ch, CURLOPT_TIMEOUT, 0); + + curl_exec($ch); + $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); + if($fout) + fclose($fout); + curl_close($ch); + return ($http_code == 200) ? true : $http_code; + } + +// ----------------------------------------------------- Begin Code -------------------------------------------- + + /* + if (!file_exists("{$tmpfname}/{$snort_filename}")) + { + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $snort_filename; + snortSql_updateRuleSetList('working', 'on', '', '', $snort_filename); // finish downloading + //download_file_with_progress_bar2("http://www.snort.org/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname . "/{$snort_filename}", "read_body_firmware"); + download_file_with_progress_bar2("http://theseusnetworking.com/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); + snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename); // finsh percent + snortSql_updateRuleSetList('working', 'off', '', '', $snort_filename); // finish downloading + } + */ + + + + // rm all tmp filea + exec("/bin/rm -r $tmpfname/\*"); + + // Set all downloads to be true so NO download by default + $snort_md5_check_ok = true; + $emerg_md5_check_ok = true; + $pfsense_md5_check_ok = true; + + /* define checks */ + $snortdownload = $generalSettings['snortdownload']; + //$oinkid = $generalSettings['oinkmastercode']; + $oinkid = '55a1b7a1291b55ac3c157124133744cfc386bb83'; // remove when finished testing + + $emergingthreats = $generalSettings['emergingthreatsdownload']; + $emergingthreatscode = $generalSettings['emergingthreatscode']; + + + + if ($oinkid == '' && $snortdownload == 'on') + { + update_output_window2('ms1', 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'"); + exit; + } + + if ($snortdownload != "on" && $emergingthreats != "on") + { + update_output_window2('ms1', 'SnortStartup: No rules have been selected to download.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'No rules have been selected to download.'"); + exit; + } + + /* + * Check MD5s and MARK + * + */ + update_output_window2('ms1', 'Starting MD5 checks.....'); + + // download snort.org md5 and compare + snort_file_get_contents($tmpfname, $snort_filename_md5, 'http://www.snort.org/pub-bin/oinkmaster.cgi/' . $oinkid); + + // if snort.org md5 do not match + if(!snortCmpareMD5('string', $tmpfname, $snortdir, $snort_filename_md5)) + { + $snort_md5_check_ok = false; + } + + // download emergingthreats.net md5 and compare + snort_file_get_contents($tmpfname, $emergingthreats_filename_md5, 'http://rules.emergingthreats.net/open/snort-2.9.0'); + + // if emergingthreats.net md5 do not match + if(!snortCmpareMD5('string', $tmpfname, $snortdir, $emergingthreats_filename_md5)) + { + $emerg_md5_check_ok = false; + } + + // download pfsense.org md5 and compare + snort_file_get_contents($tmpfname, $pfsense_rules_filename_md5, 'http://www.pfsense.com/packages/config/snort/pfsense_rules'); + + // if pfsense.org md5 do not match + if(!snortCmpareMD5('string', $tmpfname, $snortdir, $pfsense_rules_filename_md5)) + { + $pfsense_md5_check_ok = false; + } + + + + +// ----------------------------------------------------- End Code -------------------------------------------- + +} // -------------------- END Main function ------------ + +$argv[1] = 'console'; + +sendUpdateSnortLogDownload($argv[1]); // start main function + + + + + + +?> \ No newline at end of file diff --git a/config/snort-dev/snort_download_updates.php b/config/snort-dev/snort_download_updates.php new file mode 100644 index 00000000..4f99cda8 --- /dev/null +++ b/config/snort-dev/snort_download_updates.php @@ -0,0 +1,333 @@ +. + All rights reserved. + + Pfsense snort GUI + Copyright (C) 2008-2011 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + + +// set page vars + +$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); + +header("Cache-Control: no-cache, must-revalidate"); +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); + + + $pgtitle = 'Services: Snort: Updates'; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + +
+


Please Wait...

+
+ +
+ +
+ +
+ + + + + + + + + + +
Yellow Bar
Yellow Bar
+
+ + + + + + +
+ + + + +
+
+ + + + + + + + + + + +
+ +
+ +
+ +
+ +
+ + +
+ +
+
+ + + + + + + + + +
+ There are rule databases that are ready to be updated. + +
+
+ + + + + + +
SIGNATURE RULESET DATABASES:
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ +
OnSignature DB NameMD5 VersionNew Rule DB Available 
+ +SNORT.ORGtcpATTACK-RESPONSES directory listing + +
+ +EMERGINGTHREATS.NETtcpATTACK-RESPONSES directory listing + +
+ +PFSENSE.ORGtcpATTACK-RESPONSES directory listing + +
+
+ + + + +
+ +
+
+ + + + +
+
+
+ + + +
+ +
+
+ + + + + +
+ + + Note: +   Snort.org and Emergingthreats.net will go down from time to time. Please be patient. +
+
+
+ + + + + + + + + + + + + diff --git a/config/snort-dev/snort_headbase.inc b/config/snort-dev/snort_headbase.inc index 4cf02489..6a2492ad 100644 --- a/config/snort-dev/snort_headbase.inc +++ b/config/snort-dev/snort_headbase.inc @@ -8,6 +8,7 @@ + diff --git a/config/snort-dev/snort_json_get.php b/config/snort-dev/snort_json_get.php index a8cdcd2d..1fdcc1e7 100644 --- a/config/snort-dev/snort_json_get.php +++ b/config/snort-dev/snort_json_get.php @@ -2,10 +2,49 @@ require_once("guiconfig.inc"); require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_download_rules.inc"); +session_start(); // alwaya at the very top of a php page or "Cannot send session cache limiter - headers already sent" - - +// upload created log tar to user +if ($_GET['snortGetUpdate'] == 1) +{ + + $tmpfname = "/usr/local/etc/snort/snort_download"; + $snort_filename = "snortrules-snapshot-2905.tar.gz"; + + + $snortSessionPath = $_SESSION['tmp']['snort']['snort_download_updates']; + + if (!file_exists("{$tmpfname}/{$snort_filename}")) + { + + if ($snortSessionPath['download']['working'] != '1') + { + unset($_SESSION['tmp']); + $snortSessionPath['download']['working'] = '1'; + sendUpdateSnortLogDownload(); + } + + } + + $time = time(); + while((time() - $time) < 30) { + // query memcache, database, etc. for new data + $data = $datasource->getLatest(); + + // if we have new data return it + if(!empty($data)) { + echo json_encode($data); + ob_flush(); + flush(); + break; + } + + usleep(25000); + } + +} // end main if -- cgit v1.2.3