From 195dee5f7411de7fe55087bb819b02f8f864c7fc Mon Sep 17 00:00:00 2001 From: robiscool Date: Wed, 21 Sep 2011 11:28:59 -0700 Subject: snort-dev, remove orion package add snort-dev package --- config/orionids-dev/css/new_tab_menu.css | 110 - config/orionids-dev/css/style_snort2.css | 571 ---- config/orionids-dev/images/alert.jpg | Bin 13730 -> 0 bytes config/orionids-dev/images/arrow_down.png | Bin 379 -> 0 bytes .../orionids-dev/images/awesome-overlay-sprite.png | Bin 214 -> 0 bytes config/orionids-dev/images/close_9x9.gif | Bin 836 -> 0 bytes config/orionids-dev/images/controls.png | Bin 1633 -> 0 bytes config/orionids-dev/images/down.gif | Bin 54 -> 0 bytes config/orionids-dev/images/down2.gif | Bin 60 -> 0 bytes config/orionids-dev/images/footer.jpg | Bin 57411 -> 0 bytes config/orionids-dev/images/footer2.jpg | Bin 31878 -> 0 bytes config/orionids-dev/images/icon-table-sort-asc.png | Bin 2906 -> 0 bytes .../orionids-dev/images/icon-table-sort-desc.png | Bin 2913 -> 0 bytes config/orionids-dev/images/icon-table-sort.png | Bin 3025 -> 0 bytes config/orionids-dev/images/icon_excli.png | Bin 5280 -> 0 bytes config/orionids-dev/images/loading.gif | Bin 404 -> 0 bytes config/orionids-dev/images/logo.jpg | Bin 74306 -> 0 bytes config/orionids-dev/images/logo22.png | Bin 27841 -> 0 bytes config/orionids-dev/images/new_tab_menu.png | Bin 3257 -> 0 bytes config/orionids-dev/images/page_white_text.png | Bin 342 -> 0 bytes config/orionids-dev/images/progress_bar2.gif | Bin 63777 -> 0 bytes config/orionids-dev/images/progressbar.gif | Bin 1052 -> 0 bytes config/orionids-dev/images/top_modal_bar_lil.jpg | Bin 11071 -> 0 bytes config/orionids-dev/images/transparent.gif | Bin 156 -> 0 bytes config/orionids-dev/images/transparentbg.png | Bin 2818 -> 0 bytes config/orionids-dev/images/up.gif | Bin 54 -> 0 bytes config/orionids-dev/images/up2.gif | Bin 60 -> 0 bytes config/orionids-dev/javascript/jquery-1.6.2.min.js | 18 - config/orionids-dev/javascript/jquery.form.js | 785 ----- .../javascript/jquery.progressbar.min.js | 20 - config/orionids-dev/javascript/snort_globalsend.js | 442 --- config/orionids-dev/orion.xml | 272 -- config/orionids-dev/patches/SnortSam/TODAO.txt | 1 - .../patches/SnortSam/snortsam-2.8.6.1.diff | 3021 ------------------ .../patches/inlinemode_options_flags.txt | 0 .../patches/spoink_patch/2.8.6/Makefile.am | 17 - .../patches/spoink_patch/2.8.6/Makefile.in | 445 --- .../patches/spoink_patch/2.8.6/plugbase.c | 1544 ---------- .../orionids-dev/patches/spoink_patch/2.8.6/util.c | 3233 -------------------- config/orionids-dev/patches/spoink_patch/spo_pf.c | 462 --- config/orionids-dev/patches/spoink_patch/spo_pf.h | 60 - config/orionids-dev/snortDB | Bin 16384 -> 0 bytes config/orionids-dev/snortDBrules | Bin 18432 -> 0 bytes config/orionids-dev/snortDBtemp | Bin 7168 -> 0 bytes config/orionids-dev/snort_alerts.php | 189 -- config/orionids-dev/snort_barnyard.php | 289 -- config/orionids-dev/snort_blocked.php | 193 -- config/orionids-dev/snort_build.inc | 1288 -------- config/orionids-dev/snort_define_servers.php | 450 --- config/orionids-dev/snort_download_rules.inc | 1036 ------- config/orionids-dev/snort_download_updates.php | 365 --- config/orionids-dev/snort_gui.inc | 83 - config/orionids-dev/snort_head.inc | 148 - config/orionids-dev/snort_headbase.inc | 73 - config/orionids-dev/snort_help_info.php | 353 --- config/orionids-dev/snort_install.inc | 429 --- config/orionids-dev/snort_interfaces.php | 415 --- config/orionids-dev/snort_interfaces_edit.php | 536 ---- config/orionids-dev/snort_interfaces_global.php | 367 --- config/orionids-dev/snort_interfaces_rules.php | 289 -- .../orionids-dev/snort_interfaces_rules_edit.php | 282 -- config/orionids-dev/snort_interfaces_suppress.php | 211 -- .../snort_interfaces_suppress_edit.php | 231 -- config/orionids-dev/snort_interfaces_whitelist.php | 241 -- .../snort_interfaces_whitelist_edit.php | 341 --- config/orionids-dev/snort_json_get.php | 137 - config/orionids-dev/snort_json_post.php | 568 ---- config/orionids-dev/snort_new.inc | 1368 --------- config/orionids-dev/snort_preprocessors.php | 337 -- config/orionids-dev/snort_rules.php | 600 ---- config/orionids-dev/snort_rules_ips.php | 471 --- config/orionids-dev/snort_rulesets.php | 347 --- config/orionids-dev/snort_rulesets_ips.php | 411 --- config/snort-dev/css/new_tab_menu.css | 110 + config/snort-dev/css/style_snort2.css | 571 ++++ config/snort-dev/images/alert.jpg | Bin 0 -> 13730 bytes config/snort-dev/images/arrow_down.png | Bin 0 -> 379 bytes config/snort-dev/images/awesome-overlay-sprite.png | Bin 0 -> 214 bytes config/snort-dev/images/close_9x9.gif | Bin 0 -> 836 bytes config/snort-dev/images/controls.png | Bin 0 -> 1633 bytes config/snort-dev/images/down.gif | Bin 0 -> 54 bytes config/snort-dev/images/down2.gif | Bin 0 -> 60 bytes config/snort-dev/images/footer.jpg | Bin 0 -> 57411 bytes config/snort-dev/images/footer2.jpg | Bin 0 -> 31878 bytes config/snort-dev/images/icon-table-sort-asc.png | Bin 0 -> 2906 bytes config/snort-dev/images/icon-table-sort-desc.png | Bin 0 -> 2913 bytes config/snort-dev/images/icon-table-sort.png | Bin 0 -> 3025 bytes config/snort-dev/images/icon_excli.png | Bin 0 -> 5280 bytes config/snort-dev/images/loading.gif | Bin 0 -> 404 bytes config/snort-dev/images/logo.jpg | Bin 0 -> 74306 bytes config/snort-dev/images/logo22.png | Bin 0 -> 27841 bytes config/snort-dev/images/new_tab_menu.png | Bin 0 -> 3257 bytes config/snort-dev/images/page_white_text.png | Bin 0 -> 342 bytes config/snort-dev/images/progress_bar2.gif | Bin 0 -> 63777 bytes config/snort-dev/images/progressbar.gif | Bin 0 -> 1052 bytes config/snort-dev/images/top_modal_bar_lil.jpg | Bin 0 -> 11071 bytes config/snort-dev/images/transparent.gif | Bin 0 -> 156 bytes config/snort-dev/images/transparentbg.png | Bin 0 -> 2818 bytes config/snort-dev/images/up.gif | Bin 0 -> 54 bytes config/snort-dev/images/up2.gif | Bin 0 -> 60 bytes config/snort-dev/javascript/jquery-1.6.2.min.js | 18 + config/snort-dev/javascript/jquery.form.js | 785 +++++ .../snort-dev/javascript/jquery.progressbar.min.js | 20 + config/snort-dev/javascript/snort_globalsend.js | 442 +++ config/snort-dev/patches/SnortSam/TODAO.txt | 1 + .../patches/SnortSam/snortsam-2.8.6.1.diff | 3021 ++++++++++++++++++ .../snort-dev/patches/inlinemode_options_flags.txt | 0 .../patches/spoink_patch/2.8.6/Makefile.am | 17 + .../patches/spoink_patch/2.8.6/Makefile.in | 445 +++ .../patches/spoink_patch/2.8.6/plugbase.c | 1544 ++++++++++ config/snort-dev/patches/spoink_patch/2.8.6/util.c | 3233 ++++++++++++++++++++ config/snort-dev/patches/spoink_patch/spo_pf.c | 462 +++ config/snort-dev/patches/spoink_patch/spo_pf.h | 60 + config/snort-dev/snort.xml | 272 ++ config/snort-dev/snortDB | Bin 0 -> 16384 bytes config/snort-dev/snortDBrules | Bin 0 -> 18432 bytes config/snort-dev/snortDBtemp | Bin 0 -> 7168 bytes config/snort-dev/snort_alerts.php | 189 ++ config/snort-dev/snort_barnyard.php | 289 ++ config/snort-dev/snort_blocked.php | 193 ++ config/snort-dev/snort_build.inc | 1288 ++++++++ config/snort-dev/snort_define_servers.php | 450 +++ config/snort-dev/snort_download_rules.inc | 1036 +++++++ config/snort-dev/snort_download_updates.php | 365 +++ config/snort-dev/snort_gui.inc | 83 + config/snort-dev/snort_head.inc | 148 + config/snort-dev/snort_headbase.inc | 73 + config/snort-dev/snort_help_info.php | 353 +++ config/snort-dev/snort_install.inc | 429 +++ config/snort-dev/snort_interfaces.php | 415 +++ config/snort-dev/snort_interfaces_edit.php | 536 ++++ config/snort-dev/snort_interfaces_global.php | 367 +++ config/snort-dev/snort_interfaces_rules.php | 289 ++ config/snort-dev/snort_interfaces_rules_edit.php | 282 ++ config/snort-dev/snort_interfaces_suppress.php | 211 ++ .../snort-dev/snort_interfaces_suppress_edit.php | 231 ++ config/snort-dev/snort_interfaces_whitelist.php | 241 ++ .../snort-dev/snort_interfaces_whitelist_edit.php | 341 +++ config/snort-dev/snort_json_get.php | 137 + config/snort-dev/snort_json_post.php | 568 ++++ config/snort-dev/snort_new.inc | 1368 +++++++++ config/snort-dev/snort_preprocessors.php | 337 ++ config/snort-dev/snort_rules.php | 600 ++++ config/snort-dev/snort_rules_ips.php | 471 +++ config/snort-dev/snort_rulesets.php | 347 +++ config/snort-dev/snort_rulesets_ips.php | 411 +++ 146 files changed, 23049 insertions(+), 23049 deletions(-) delete mode 100644 config/orionids-dev/css/new_tab_menu.css delete mode 100644 config/orionids-dev/css/style_snort2.css delete mode 100644 config/orionids-dev/images/alert.jpg delete mode 100644 config/orionids-dev/images/arrow_down.png delete mode 100644 config/orionids-dev/images/awesome-overlay-sprite.png delete mode 100644 config/orionids-dev/images/close_9x9.gif delete mode 100644 config/orionids-dev/images/controls.png delete mode 100644 config/orionids-dev/images/down.gif delete mode 100644 config/orionids-dev/images/down2.gif delete mode 100644 config/orionids-dev/images/footer.jpg delete mode 100644 config/orionids-dev/images/footer2.jpg delete mode 100644 config/orionids-dev/images/icon-table-sort-asc.png delete mode 100644 config/orionids-dev/images/icon-table-sort-desc.png delete mode 100644 config/orionids-dev/images/icon-table-sort.png delete mode 100644 config/orionids-dev/images/icon_excli.png delete mode 100644 config/orionids-dev/images/loading.gif delete mode 100644 config/orionids-dev/images/logo.jpg delete mode 100644 config/orionids-dev/images/logo22.png delete mode 100644 config/orionids-dev/images/new_tab_menu.png delete mode 100644 config/orionids-dev/images/page_white_text.png delete mode 100644 config/orionids-dev/images/progress_bar2.gif delete mode 100644 config/orionids-dev/images/progressbar.gif delete mode 100644 config/orionids-dev/images/top_modal_bar_lil.jpg delete mode 100644 config/orionids-dev/images/transparent.gif delete mode 100644 config/orionids-dev/images/transparentbg.png delete mode 100644 config/orionids-dev/images/up.gif delete mode 100644 config/orionids-dev/images/up2.gif delete mode 100644 config/orionids-dev/javascript/jquery-1.6.2.min.js delete mode 100644 config/orionids-dev/javascript/jquery.form.js delete mode 100644 config/orionids-dev/javascript/jquery.progressbar.min.js delete mode 100644 config/orionids-dev/javascript/snort_globalsend.js delete mode 100644 config/orionids-dev/orion.xml delete mode 100644 config/orionids-dev/patches/SnortSam/TODAO.txt delete mode 100644 config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff delete mode 100644 config/orionids-dev/patches/inlinemode_options_flags.txt delete mode 100644 config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am delete mode 100644 config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in delete mode 100644 config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c delete mode 100644 config/orionids-dev/patches/spoink_patch/2.8.6/util.c delete mode 100644 config/orionids-dev/patches/spoink_patch/spo_pf.c delete mode 100644 config/orionids-dev/patches/spoink_patch/spo_pf.h delete mode 100644 config/orionids-dev/snortDB delete mode 100644 config/orionids-dev/snortDBrules delete mode 100644 config/orionids-dev/snortDBtemp delete mode 100644 config/orionids-dev/snort_alerts.php delete mode 100644 config/orionids-dev/snort_barnyard.php delete mode 100644 config/orionids-dev/snort_blocked.php delete mode 100644 config/orionids-dev/snort_build.inc delete mode 100644 config/orionids-dev/snort_define_servers.php delete mode 100644 config/orionids-dev/snort_download_rules.inc delete mode 100644 config/orionids-dev/snort_download_updates.php delete mode 100644 config/orionids-dev/snort_gui.inc delete mode 100644 config/orionids-dev/snort_head.inc delete mode 100644 config/orionids-dev/snort_headbase.inc delete mode 100644 config/orionids-dev/snort_help_info.php delete mode 100644 config/orionids-dev/snort_install.inc delete mode 100644 config/orionids-dev/snort_interfaces.php delete mode 100644 config/orionids-dev/snort_interfaces_edit.php delete mode 100644 config/orionids-dev/snort_interfaces_global.php delete mode 100644 config/orionids-dev/snort_interfaces_rules.php delete mode 100644 config/orionids-dev/snort_interfaces_rules_edit.php delete mode 100644 config/orionids-dev/snort_interfaces_suppress.php delete mode 100644 config/orionids-dev/snort_interfaces_suppress_edit.php delete mode 100644 config/orionids-dev/snort_interfaces_whitelist.php delete mode 100644 config/orionids-dev/snort_interfaces_whitelist_edit.php delete mode 100644 config/orionids-dev/snort_json_get.php delete mode 100644 config/orionids-dev/snort_json_post.php delete mode 100644 config/orionids-dev/snort_new.inc delete mode 100644 config/orionids-dev/snort_preprocessors.php delete mode 100644 config/orionids-dev/snort_rules.php delete mode 100644 config/orionids-dev/snort_rules_ips.php delete mode 100644 config/orionids-dev/snort_rulesets.php delete mode 100644 config/orionids-dev/snort_rulesets_ips.php create mode 100644 config/snort-dev/css/new_tab_menu.css create mode 100644 config/snort-dev/css/style_snort2.css create mode 100644 config/snort-dev/images/alert.jpg create mode 100644 config/snort-dev/images/arrow_down.png create mode 100644 config/snort-dev/images/awesome-overlay-sprite.png create mode 100644 config/snort-dev/images/close_9x9.gif create mode 100644 config/snort-dev/images/controls.png create mode 100644 config/snort-dev/images/down.gif create mode 100644 config/snort-dev/images/down2.gif create mode 100644 config/snort-dev/images/footer.jpg create mode 100644 config/snort-dev/images/footer2.jpg create mode 100644 config/snort-dev/images/icon-table-sort-asc.png create mode 100644 config/snort-dev/images/icon-table-sort-desc.png create mode 100644 config/snort-dev/images/icon-table-sort.png create mode 100644 config/snort-dev/images/icon_excli.png create mode 100644 config/snort-dev/images/loading.gif create mode 100644 config/snort-dev/images/logo.jpg create mode 100644 config/snort-dev/images/logo22.png create mode 100644 config/snort-dev/images/new_tab_menu.png create mode 100644 config/snort-dev/images/page_white_text.png create mode 100644 config/snort-dev/images/progress_bar2.gif create mode 100644 config/snort-dev/images/progressbar.gif create mode 100644 config/snort-dev/images/top_modal_bar_lil.jpg create mode 100644 config/snort-dev/images/transparent.gif create mode 100644 config/snort-dev/images/transparentbg.png create mode 100644 config/snort-dev/images/up.gif create mode 100644 config/snort-dev/images/up2.gif create mode 100644 config/snort-dev/javascript/jquery-1.6.2.min.js create mode 100644 config/snort-dev/javascript/jquery.form.js create mode 100644 config/snort-dev/javascript/jquery.progressbar.min.js create mode 100644 config/snort-dev/javascript/snort_globalsend.js create mode 100644 config/snort-dev/patches/SnortSam/TODAO.txt create mode 100644 config/snort-dev/patches/SnortSam/snortsam-2.8.6.1.diff create mode 100644 config/snort-dev/patches/inlinemode_options_flags.txt create mode 100644 config/snort-dev/patches/spoink_patch/2.8.6/Makefile.am create mode 100644 config/snort-dev/patches/spoink_patch/2.8.6/Makefile.in create mode 100644 config/snort-dev/patches/spoink_patch/2.8.6/plugbase.c create mode 100644 config/snort-dev/patches/spoink_patch/2.8.6/util.c create mode 100644 config/snort-dev/patches/spoink_patch/spo_pf.c create mode 100644 config/snort-dev/patches/spoink_patch/spo_pf.h create mode 100644 config/snort-dev/snort.xml create mode 100644 config/snort-dev/snortDB create mode 100644 config/snort-dev/snortDBrules create mode 100644 config/snort-dev/snortDBtemp create mode 100644 config/snort-dev/snort_alerts.php create mode 100644 config/snort-dev/snort_barnyard.php create mode 100644 config/snort-dev/snort_blocked.php create mode 100644 config/snort-dev/snort_build.inc create mode 100644 config/snort-dev/snort_define_servers.php create mode 100644 config/snort-dev/snort_download_rules.inc create mode 100644 config/snort-dev/snort_download_updates.php create mode 100644 config/snort-dev/snort_gui.inc create mode 100644 config/snort-dev/snort_head.inc create mode 100644 config/snort-dev/snort_headbase.inc create mode 100644 config/snort-dev/snort_help_info.php create mode 100644 config/snort-dev/snort_install.inc create mode 100644 config/snort-dev/snort_interfaces.php create mode 100644 config/snort-dev/snort_interfaces_edit.php create mode 100644 config/snort-dev/snort_interfaces_global.php create mode 100644 config/snort-dev/snort_interfaces_rules.php create mode 100644 config/snort-dev/snort_interfaces_rules_edit.php create mode 100644 config/snort-dev/snort_interfaces_suppress.php create mode 100644 config/snort-dev/snort_interfaces_suppress_edit.php create mode 100644 config/snort-dev/snort_interfaces_whitelist.php create mode 100644 config/snort-dev/snort_interfaces_whitelist_edit.php create mode 100644 config/snort-dev/snort_json_get.php create mode 100644 config/snort-dev/snort_json_post.php create mode 100644 config/snort-dev/snort_new.inc create mode 100644 config/snort-dev/snort_preprocessors.php create mode 100644 config/snort-dev/snort_rules.php create mode 100644 config/snort-dev/snort_rules_ips.php create mode 100644 config/snort-dev/snort_rulesets.php create mode 100644 config/snort-dev/snort_rulesets_ips.php (limited to 'config') diff --git a/config/orionids-dev/css/new_tab_menu.css b/config/orionids-dev/css/new_tab_menu.css deleted file mode 100644 index 1592be9f..00000000 --- a/config/orionids-dev/css/new_tab_menu.css +++ /dev/null @@ -1,110 +0,0 @@ -/* - new_tab_menu.css - part of pfSense - Copyright (C) 2010-2011 Robert Zelaya - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - - Replace your old tab menu with the following code. To add a second tab menu line just cut and paste again. - The following code is dependent on new_tab_menu.css and images/new_tab_menu.png. - - - - - - - -*/ - - -.spannewtab { - font-size: 0.9em; -} - -.newtabmenu ul, li{ - border:0; - margin:0; padding:0; - list-style:none; -} - -.newtabmenu li{float:left; margin-right:2px; text-align: center;} -.newtabmenu a:link, .newtabmenu a:visited{ - background:url(/snort/images/new_tab_menu.png) right 45px; - color:#ffffff; /* noactive font */ - display:block; - /* fix for IE6 */ - display: inline-block; - /* END */ - font-weight:bold; - font-size:.9em; - height:20px; - line-height:20px; - text-decoration:none; -} -.newtabmenu a span{ - background:url(/snort/images/new_tab_menu.png) left 45px; - display:block; - /* fix for IE6 */ - display: inline-block; - /* END */ - height:20px; - margin-right:7px; - padding-left:7px; -} -.newtabmenu a:hover{ - background:url(/snort/images/new_tab_menu.png) right 23px; - display:block; - /* fix for IE6 */ - display: inline-block; - /* END */ - color:#ffffff; /* hover over font */ -} -.newtabmenu a:hover span{ - background:url(/snort/images/new_tab_menu.png) left 23px; - display:block; - /* fix for IE6 */ - display: inline-block; - /* END */ -} - -/* -------------------------------- */ -/* ACTIVE ELEMENTS */ -.newtabmenu_active a:link, .newtabmenu_active a:visited, .newtabmenu_active a:visited, .newtabmenu_active a:hover{ - color:#000000; /* active font */ - background:url(/snort/images/new_tab_menu.png) right 0 no-repeat; -} -.newtabmenu_active a span, .newtabmenu_active a:hover span{ - background:url(/snort/images/new_tab_menu.png) left 0 no-repeat; -} diff --git a/config/orionids-dev/css/style_snort2.css b/config/orionids-dev/css/style_snort2.css deleted file mode 100644 index 16b2e327..00000000 --- a/config/orionids-dev/css/style_snort2.css +++ /dev/null @@ -1,571 +0,0 @@ -@charset "utf-8"; - - -/* ips tab css */ - -#infotext_ips { - - vertical-align: middle; - -} - -.nextClickList { - margin-bottom: 5px; -} - -.nextClickListColorEven { - padding-top: 2px; - padding-bottom: 2px; - padding-left: 10px; - padding-right: 10px; - background-color: #ffffff; - font-size: 11px; - border-bottom-color: #999999; - border-bottom-width: 1px; - border-bottom-style: solid; - border-right-color: #999999; - border-right-width: 1px; - border-right-style: solid; -} - -.nextClickListColorOdd { - padding-top: 2px; - padding-bottom: 2px; - padding-left: 10px; - padding-right: 10px; - background-color: #eeeeee; - font-size: 11px; - border-bottom-color: #999999; - border-bottom-width: 1px; - border-bottom-style: solid; - border-right-color: #999999; - border-right-width: 1px; - border-right-style: solid; -} - - -#right { - - position: relative; - top: -10px; - left: 0px; - width: 800px; - margin-top: 0px; - margin-left: 0px; - margin-right: 5px; - padding-top: 20px; - padding-left: 0px; - padding-right: 0px; - padding-bottom: 90px; - min-height: 400px; - -} - -.odd_ruleset2 { - text-align: center; - background-color: #ffffff; - border-left: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 11px; - padding-right: 2px; - padding-left: 2px; - padding-top: 4px; - padding-bottom: 4px; -} - -.even_ruleset2 { - text-align: center; - background-color: #eeeeee; - border-left: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 11px; - padding-right: 2px; - padding-left: 2px; - padding-top: 4px; - padding-bottom: 4px; -} - -.odd_ruleset { - - background-color: #ffffff; - border-left: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 14px; - padding-right: 2px; - padding-left: 20px; - padding-top: 2px; - padding-bottom: 2px; - -} - -.even_ruleset { - - background-color: #eeeeee; - border-left: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 14px; - padding-right: 2px; - padding-left: 20px; - padding-top: 2px; - padding-bottom: 2px; - -} - -.rulesetbkg { - background-color: #eeeeee; - padding-right: 0px; - padding-left: 0px; - border-bottom: 1px solid #999999; - font-size: 15px; -} - - -.hiddendownloadlink { - visibility:hidden; -} - -#loadingWaiting, #loadingRuleEditGUI, #loadingRuleUpadteGUI{ - display:none; - position:fixed; - left:0; - top:0; - width:100%; - height:100%; - background-image:url("/snort/images/transparentbg.png"); - z-index: 9998; - color: #ffffff; -} - -.loadingWaitingMessage{ - - text-align: center; - margin-top:40px; - -} - -.snortModal { - width:500px; - height:300px; - position:absolute; - z-index:999; - background-color:#000; -} - -.snortModalTop { - width:500px; - height:25px; - background-image:url( '/snort/images/top_modal_bar_lil.jpg' ); - background-repeat:repeat-x; - margin-bottom:1px; -} - -.snortModalTitle { - text-align: center; -} - -.snortModalTopClose { - width:9px; - height:9px; - float:right; - margin-right:10px; - margin-top:8px; -} - -.snortModalUpdate { - width: 700px; - height: 200px; - z-index:999; - background-color:#000000; -} - -.snortModalTopUpdate { - width: 700px; - height: 25px; - background-image:url( '/snort/images/top_modal_bar_lil.jpg' ); - background-repeat:repeat-x; - margin-bottom:1px; -} - -.snortModalTitleUpdate { - position:absolute; - left: 50px; - width: 600px; - margin-top: 0px; - margin-bottom: 0px; -} - -.snortModalTitleUpdateMsg1 { - top: 50px; - font-weight: bold; - font-size: 24px; -} - -.snortModalTitleUpdateBar { - top: 90px; -} - -.snortModalTitleUpdateMsg2 { - top: 145px; -} - -.listhdrr2 { - background-color: #BBBBBB; - padding-right: 1px; - padding-left: 1px; - font-weight: bold; - border-right: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 11px; - padding-top: 5px; - padding-bottom: 5px; -} - -.listtopic2 { - border-bottom: 1px solid #999999; - font-size: 11px; - background-color: #eeeeee; - padding-right: 16px; - padding-left: 6px; - color: #000000; - font-weight: bold; - padding-top: 5px; - padding-bottom: 5px; -} - -.listtopic3 { - border-bottom: 1px solid #999999; - font-size: 11px; - background-color: #eeeeee; - padding-right: 6px; - padding-left: 16px; - color: #000000; - font-weight: bold; -} - -#footer2 { - background-color: transparent; - background-image: url("/snort/images/logo22.png"); - width: 720px; - height: 60px; - text-align: center; - font-size: 0.8em; -} - -.alert { - position:absolute; - top:10px; - left:-25px; - width:100%; - height:90%; - z-index:999; - background:#FCE9C0; - background-position: 15px; - border-top:2px solid #DBAC48; - border-bottom:2px solid #DBAC48; - padding: 15px 10px 85% 50px; -} - -.formpre { - font-family:arial; - font-size: 1.1em; -} - -#download_rules { - font-family: arial; - font-size: 13px; - font-weight: bold; - text-align: center; -} - -#download_rules_td { - font-family: arial; - font-size: 13px; - font-weight: bold; - text-align: center; -} - -/* hack fix the hard coded fbegin link */ -#header-left2 { - position: absolute; - background-position: center center; - height: 67px; - width: 147px; - top: -77px; - left: 8px; - float: left; - z-index:999; -} -#header-left2 #status-link2 { - position: relative; - top: 3px; - left: 2px; -} -/* end of fbegin hack */ - -.body2 { - font-family:arial; - font-size:12px; -} - -.tabcont { - background-color: #dddddd; - padding-right: 12px; - padding-left: 12px; - padding-top: 12px; - padding-bottom: 12px; -} - -.tabcont2 { - background-color: #eeeeee; - padding-right: 12px; - padding-left: 12px; - padding-top: 12px; - padding-bottom: 12px; -} - -.vncell2 { - background-color: #eeeeee; - padding-right: 5px; - padding-left: 5px; - border-bottom: 1px solid #999999; - font-size: 11px; -} - -.vncelltextbox { - background-color: #eeeeee; - padding-top: 8px; - padding-bottom: 8px; - padding-right: 8px; - padding-left: 8px; - border-bottom-width: 1px; - border-bottom-style: solid; - border-bottom-color: #999999; - font-size: 11px; -} - -/* global tab, white lil box */ -.vncell3 { - width: 50px; - background-color: #eeeeee; - padding-right: 2px; - padding-left: 2px; - border-bottom-width: 1px; - border-bottom-style: solid; - border-bottom-color: #999999; - font-size: 11px; -} - -.vncellreq2 { -background-color: #eeeeee; -padding-right: 20px; -padding-left: 8px; -font-weight: bold; -border-bottom-width: 1px; -border-bottom-style: solid; -border-bottom-color: #999999; -font-size: 11px; -} - -/* Start of main css Pfsense */ -/* Start of main css Pfsense */ - -.textstyle { - font-family: "Arial", "Helvetica", "sans-serif"; - font-size: 12px; - font-style: normal; - background-color: #666; - color: #CCC; -} -.textstyle p2 a { - font-family: Arial, Helvetica, sans-serif; - font-size: 12px; - font-style: normal; - color: #CCC; -} - -.textstyle p { - font-family: Arial, Helvetica, sans-serif; - font-size: 24px; - font-weight: bold; - color: #FFF; - text-decoration: underline; -} -.textstyle p2 { - font-family: Arial, Helvetica, sans-serif; - font-size: 12px; - color: #CCC; -} - -/* Start of main css for table sort */ -/* Start of main css for table sort */ - -table { - margin: 0; - padding: 0; - border: 0; - font-weight: inherit; - font-style: inherit; - font-family: Arial, Helvetica, sans-serif; - vertical-align: baseline; -} - -/* Tables still need 'cellspacing="0"' in the markup. */ -table { border-collapse: separate; border-spacing: 0; } -caption, th, td { text-align: left; font-weight:400; } - -/* Remove possible quote marks (") from ,
. */ -blockquote:before, blockquote:after, q:before, q:after { content: ""; } -blockquote, q { quotes: "" ""; } - -#container { - width: auto; - margin: 0px; - padding-top: 10px; - padding-bottom: 10px; -} - - - -/************************************************************** - - Sortable Table - v 1.4 - -**************************************************************/ - - - -th { - background-color: #eee; - background: #eee url(/snort/images/icon-table-sort.png) no-repeat 2px 8px; - padding: 4px 4px 4px 14px; -} - -.allRow { - background-color: #eee; - padding: 4px; -} - -tr.altRow { - background-color: #fff; -} - -.leftAlign { - text-align: left; -} - -.centerAlign { - text-align: center; -} - -.rightAlign { - text-align: right; -} - -.sortedASC { - background: url(/snort/images/icon-table-sort-asc.png) no-repeat 2px 4px #eee; -} - -.sortedDESC { - background: url(/snort/images/icon-table-sort-desc.png) no-repeat 2px 10px #eee; -} - -.tableHeaderOver { - cursor: pointer; - color: #354158; -} - - -tr.selected { - background-color: #9999ff; - color: #000000; -} - -tr.over { - background-color: #993333; - color: #fff; - cursor: pointer; -} - -tr.hide { - display: none; -} -/***************************/ - -.mainTableFilter { - position: absolute; - top: 0; - left: -10px; - width: auto; -} - -.tableFilter { - border: 1px solid #ccc; - padding: 2px; - margin: 5px 0 10px 0; -} - -.tableFilter input { - border: 1px solid #ccc; -} - -.tableFilter select { - border: 1px solid #ccc; -} - -.listbg2 { - border-right: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 11px; - background-color: #090; - color: #000; - padding-right: 16px; - padding-left: 6px; - padding-top: 4px; - padding-bottom: 4px; -} - -.listbg3 { - border-right: 1px solid #999999; - border-bottom: 1px solid #999999; - font-size: 11px; - background-color: #777777; - color: #000; - padding-right: 16px; - padding-left: 6px; - padding-top: 4px; - padding-bottom: 4px; -} - -#tdbggrey { - -background-color: #ddd; - -} - -.formfld2 -{ -padding-left: 8px; -font-size: small; -} - -/*********Input Highlight*****************/ - -.formfld2 { - outline:none; - transition: all 0.25s ease-in-out; - -webkit-transition: all 0.25s ease-in-out; - -moz-transition: all 0.25s ease-in-out; - border-radius:1px; - -webkit-border-radius:1px; - -moz-border-radius:1px; - border:1px solid rgba(0,0,0, 0.2); -} - -.formfld2:focus { - box-shadow: 0 0 2px rgba(156, 156, 156, 1); - -webkit-box-shadow: 0 0 2px rgba(156, 156, 156, 1); - -moz-box-shadow: 0 0 2px rgba(156, 156, 156, 1); - border:1px solid rgba(156,156,156, 0.8); -} - diff --git a/config/orionids-dev/images/alert.jpg b/config/orionids-dev/images/alert.jpg deleted file mode 100644 index 96c24e35..00000000 Binary files a/config/orionids-dev/images/alert.jpg and /dev/null differ diff --git a/config/orionids-dev/images/arrow_down.png b/config/orionids-dev/images/arrow_down.png deleted file mode 100644 index 2c4e2793..00000000 Binary files a/config/orionids-dev/images/arrow_down.png and /dev/null differ diff --git a/config/orionids-dev/images/awesome-overlay-sprite.png b/config/orionids-dev/images/awesome-overlay-sprite.png deleted file mode 100644 index c3af7dd9..00000000 Binary files a/config/orionids-dev/images/awesome-overlay-sprite.png and /dev/null differ diff --git a/config/orionids-dev/images/close_9x9.gif b/config/orionids-dev/images/close_9x9.gif deleted file mode 100644 index 326f5fa5..00000000 Binary files a/config/orionids-dev/images/close_9x9.gif and /dev/null differ diff --git a/config/orionids-dev/images/controls.png b/config/orionids-dev/images/controls.png deleted file mode 100644 index e1e97982..00000000 Binary files a/config/orionids-dev/images/controls.png and /dev/null differ diff --git a/config/orionids-dev/images/down.gif b/config/orionids-dev/images/down.gif deleted file mode 100644 index 2b3c99fc..00000000 Binary files a/config/orionids-dev/images/down.gif and /dev/null differ diff --git a/config/orionids-dev/images/down2.gif b/config/orionids-dev/images/down2.gif deleted file mode 100644 index 71bf92eb..00000000 Binary files a/config/orionids-dev/images/down2.gif and /dev/null differ diff --git a/config/orionids-dev/images/footer.jpg b/config/orionids-dev/images/footer.jpg deleted file mode 100644 index 4af05707..00000000 Binary files a/config/orionids-dev/images/footer.jpg and /dev/null differ diff --git a/config/orionids-dev/images/footer2.jpg b/config/orionids-dev/images/footer2.jpg deleted file mode 100644 index 3332e085..00000000 Binary files a/config/orionids-dev/images/footer2.jpg and /dev/null differ diff --git a/config/orionids-dev/images/icon-table-sort-asc.png b/config/orionids-dev/images/icon-table-sort-asc.png deleted file mode 100644 index 0c127919..00000000 Binary files a/config/orionids-dev/images/icon-table-sort-asc.png and /dev/null differ diff --git a/config/orionids-dev/images/icon-table-sort-desc.png b/config/orionids-dev/images/icon-table-sort-desc.png deleted file mode 100644 index 5c52f2d0..00000000 Binary files a/config/orionids-dev/images/icon-table-sort-desc.png and /dev/null differ diff --git a/config/orionids-dev/images/icon-table-sort.png b/config/orionids-dev/images/icon-table-sort.png deleted file mode 100644 index 3cae604b..00000000 Binary files a/config/orionids-dev/images/icon-table-sort.png and /dev/null differ diff --git a/config/orionids-dev/images/icon_excli.png b/config/orionids-dev/images/icon_excli.png deleted file mode 100644 index 4b54fa31..00000000 Binary files a/config/orionids-dev/images/icon_excli.png and /dev/null differ diff --git a/config/orionids-dev/images/loading.gif b/config/orionids-dev/images/loading.gif deleted file mode 100644 index cbc00f09..00000000 Binary files a/config/orionids-dev/images/loading.gif and /dev/null differ diff --git a/config/orionids-dev/images/logo.jpg b/config/orionids-dev/images/logo.jpg deleted file mode 100644 index fa01d818..00000000 Binary files a/config/orionids-dev/images/logo.jpg and /dev/null differ diff --git a/config/orionids-dev/images/logo22.png b/config/orionids-dev/images/logo22.png deleted file mode 100644 index 64ed9d75..00000000 Binary files a/config/orionids-dev/images/logo22.png and /dev/null differ diff --git a/config/orionids-dev/images/new_tab_menu.png b/config/orionids-dev/images/new_tab_menu.png deleted file mode 100644 index f0e4cbeb..00000000 Binary files a/config/orionids-dev/images/new_tab_menu.png and /dev/null differ diff --git a/config/orionids-dev/images/page_white_text.png b/config/orionids-dev/images/page_white_text.png deleted file mode 100644 index 813f712f..00000000 Binary files a/config/orionids-dev/images/page_white_text.png and /dev/null differ diff --git a/config/orionids-dev/images/progress_bar2.gif b/config/orionids-dev/images/progress_bar2.gif deleted file mode 100644 index 81766a93..00000000 Binary files a/config/orionids-dev/images/progress_bar2.gif and /dev/null differ diff --git a/config/orionids-dev/images/progressbar.gif b/config/orionids-dev/images/progressbar.gif deleted file mode 100644 index 6d167f5b..00000000 Binary files a/config/orionids-dev/images/progressbar.gif and /dev/null differ diff --git a/config/orionids-dev/images/top_modal_bar_lil.jpg b/config/orionids-dev/images/top_modal_bar_lil.jpg deleted file mode 100644 index f0049de8..00000000 Binary files a/config/orionids-dev/images/top_modal_bar_lil.jpg and /dev/null differ diff --git a/config/orionids-dev/images/transparent.gif b/config/orionids-dev/images/transparent.gif deleted file mode 100644 index e7ccd741..00000000 Binary files a/config/orionids-dev/images/transparent.gif and /dev/null differ diff --git a/config/orionids-dev/images/transparentbg.png b/config/orionids-dev/images/transparentbg.png deleted file mode 100644 index 86918930..00000000 Binary files a/config/orionids-dev/images/transparentbg.png and /dev/null differ diff --git a/config/orionids-dev/images/up.gif b/config/orionids-dev/images/up.gif deleted file mode 100644 index 89596771..00000000 Binary files a/config/orionids-dev/images/up.gif and /dev/null differ diff --git a/config/orionids-dev/images/up2.gif b/config/orionids-dev/images/up2.gif deleted file mode 100644 index 21c5a254..00000000 Binary files a/config/orionids-dev/images/up2.gif and /dev/null differ diff --git a/config/orionids-dev/javascript/jquery-1.6.2.min.js b/config/orionids-dev/javascript/jquery-1.6.2.min.js deleted file mode 100644 index 48590ecb..00000000 --- a/config/orionids-dev/javascript/jquery-1.6.2.min.js +++ /dev/null @@ -1,18 +0,0 @@ -/*! - * jQuery JavaScript Library v1.6.2 - * http://jquery.com/ - * - * Copyright 2011, John Resig - * Dual licensed under the MIT or GPL Version 2 licenses. - * http://jquery.org/license - * - * Includes Sizzle.js - * http://sizzlejs.com/ - * Copyright 2011, The Dojo Foundation - * Released under the MIT, BSD, and GPL Licenses. - * - * Date: Thu Jun 30 14:16:56 2011 -0400 - */ -(function(a,b){function cv(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cs(a){if(!cg[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){ch||(ch=c.createElement("iframe"),ch.frameBorder=ch.width=ch.height=0),b.appendChild(ch);if(!ci||!ch.createElement)ci=(ch.contentWindow||ch.contentDocument).document,ci.write((c.compatMode==="CSS1Compat"?"":"")+""),ci.close();d=ci.createElement(a),ci.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ch)}cg[a]=e}return cg[a]}function cr(a,b){var c={};f.each(cm.concat.apply([],cm.slice(0,b)),function(){c[this]=a});return c}function cq(){cn=b}function cp(){setTimeout(cq,0);return cn=f.now()}function cf(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ce(){try{return new a.XMLHttpRequest}catch(b){}}function b$(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g0){c!=="border"&&f.each(e,function(){c||(d-=parseFloat(f.css(a,"padding"+this))||0),c==="margin"?d+=parseFloat(f.css(a,c+this))||0:d-=parseFloat(f.css(a,"border"+this+"Width"))||0});return d+"px"}d=bx(a,b,b);if(d<0||d==null)d=a.style[b]||0;d=parseFloat(d)||0,c&&f.each(e,function(){d+=parseFloat(f.css(a,"padding"+this))||0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+this+"Width"))||0),c==="margin"&&(d+=parseFloat(f.css(a,c+this))||0)});return d+"px"}function bm(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text||b.textContent||b.innerHTML||"").replace(be,"/*$0*/")),b.parentNode&&b.parentNode.removeChild(b)}function bl(a){f.nodeName(a,"input")?bk(a):"getElementsByTagName"in a&&f.grep(a.getElementsByTagName("input"),bk)}function bk(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bj(a){return"getElementsByTagName"in a?a.getElementsByTagName("*"):"querySelectorAll"in a?a.querySelectorAll("*"):[]}function bi(a,b){var c;if(b.nodeType===1){b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase();if(c==="object")b.outerHTML=a.outerHTML;else if(c!=="input"||a.type!=="checkbox"&&a.type!=="radio"){if(c==="option")b.selected=a.defaultSelected;else if(c==="input"||c==="textarea")b.defaultValue=a.defaultValue}else a.checked&&(b.defaultChecked=b.checked=a.checked),b.value!==a.value&&(b.value=a.value);b.removeAttribute(f.expando)}}function bh(a,b){if(b.nodeType===1&&!!f.hasData(a)){var c=f.expando,d=f.data(a),e=f.data(b,d);if(d=d[c]){var g=d.events;e=e[c]=f.extend({},d);if(g){delete e.handle,e.events={};for(var h in g)for(var i=0,j=g[h].length;i=0===c})}function V(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function N(a,b){return(a&&a!=="*"?a+".":"")+b.replace(z,"`").replace(A,"&")}function M(a){var b,c,d,e,g,h,i,j,k,l,m,n,o,p=[],q=[],r=f._data(this,"events");if(!(a.liveFired===this||!r||!r.live||a.target.disabled||a.button&&a.type==="click")){a.namespace&&(n=new RegExp("(^|\\.)"+a.namespace.split(".").join("\\.(?:.*\\.)?")+"(\\.|$)")),a.liveFired=this;var s=r.live.slice(0);for(i=0;ic)break;a.currentTarget=e.elem,a.data=e.handleObj.data,a.handleObj=e.handleObj,o=e.handleObj.origHandler.apply(e.elem,arguments);if(o===!1||a.isPropagationStopped()){c=e.level,o===!1&&(b=!1);if(a.isImmediatePropagationStopped())break}}return b}}function K(a,c,d){var e=f.extend({},d[0]);e.type=a,e.originalEvent={},e.liveFired=b,f.event.handle.call(c,e),e.isDefaultPrevented()&&d[0].preventDefault()}function E(){return!0}function D(){return!1}function m(a,c,d){var e=c+"defer",g=c+"queue",h=c+"mark",i=f.data(a,e,b,!0);i&&(d==="queue"||!f.data(a,g,b,!0))&&(d==="mark"||!f.data(a,h,b,!0))&&setTimeout(function(){!f.data(a,g,b,!0)&&!f.data(a,h,b,!0)&&(f.removeData(a,e,!0),i.resolve())},0)}function l(a){for(var b in a)if(b!=="toJSON")return!1;return!0}function k(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(j,"$1-$2").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNaN(d)?i.test(d)?f.parseJSON(d):d:parseFloat(d)}catch(g){}f.data(a,c,d)}else d=b}return d}var c=a.document,d=a.navigator,e=a.location,f=function(){function J(){if(!e.isReady){try{c.documentElement.doScroll("left")}catch(a){setTimeout(J,1);return}e.ready()}}var e=function(a,b){return new e.fn.init(a,b,h)},f=a.jQuery,g=a.$,h,i=/^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/\d/,n=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,o=/^[\],:{}\s]*$/,p=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,q=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,r=/(?:^|:|,)(?:\s*\[)+/g,s=/(webkit)[ \/]([\w.]+)/,t=/(opera)(?:.*version)?[ \/]([\w.]+)/,u=/(msie) ([\w.]+)/,v=/(mozilla)(?:.*? rv:([\w.]+))?/,w=/-([a-z])/ig,x=function(a,b){return b.toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeType){this.context=this[0]=a,this.length=1;return this}if(a==="body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"||a.charAt(a.length-1)!==">"||a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]||!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d?d.ownerDocument||d:c,j=n.exec(a),j?e.isPlainObject(d)?(a=[c.createElement(j[1])],e.fn.attr.call(a,d,!0)):a=[k.createElement(j[1])]:(j=e.buildFragment([g[1]],[k]),a=(j.cacheable?e.clone(j.fragment):j.fragment).childNodes);return e.merge(this,a)}h=c.getElementById(g[2]);if(h&&h.parentNode){if(h.id!==g[2])return f.find(a);this.length=1,this[0]=h}this.context=c,this.selector=a;return this}return!d||d.jquery?(d||f).find(a):this.constructor(d).find(a)}if(e.isFunction(a))return f.ready(a);a.selector!==b&&(this.selector=a.selector,this.context=a.context);return e.makeArray(a,this)},selector:"",jquery:"1.6.2",length:0,size:function(){return this.length},toArray:function(){return F.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this[this.length+a]:this[a]},pushStack:function(a,b,c){var d=this.constructor();e.isArray(a)?E.apply(d,a):e.merge(d,a),d.prevObject=this,d.context=this.context,b==="find"?d.selector=this.selector+(this.selector?" ":"")+c:b&&(d.selector=this.selector+"."+b+"("+c+")");return d},each:function(a,b){return e.each(this,a,b)},ready:function(a){e.bindReady(),A.done(a);return this},eq:function(a){return a===-1?this.slice(a):this.slice(a,+a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:function(a){return this.pushStack(e.map(this,function(b,c){return a.call(b,c,b)}))},end:function(){return this.prevObject||this.constructor(null)},push:E,sort:[].sort,splice:[].splice},e.fn.init.prototype=e.fn,e.extend=e.fn.extend=function(){var a,c,d,f,g,h,i=arguments[0]||{},j=1,k=arguments.length,l=!1;typeof i=="boolean"&&(l=i,i=arguments[1]||{},j=2),typeof i!="object"&&!e.isFunction(i)&&(i={}),k===j&&(i=this,--j);for(;j0)return;A.resolveWith(c,[e]),e.fn.trigger&&e(c).trigger("ready").unbind("ready")}},bindReady:function(){if(!A){A=e._Deferred();if(c.readyState==="complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.frameElement==null}catch(d){}c.documentElement.doScroll&&b&&J()}}},isFunction:function(a){return e.type(a)==="function"},isArray:Array.isArray||function(a){return e.type(a)==="array"},isWindow:function(a){return a&&typeof a=="object"&&"setInterval"in a},isNaN:function(a){return a==null||!m.test(a)||isNaN(a)},type:function(a){return a==null?String(a):I[C.call(a)]||"object"},isPlainObject:function(a){if(!a||e.type(a)!=="object"||a.nodeType||e.isWindow(a))return!1;if(a.constructor&&!D.call(a,"constructor")&&!D.call(a.constructor.prototype,"isPrototypeOf"))return!1;var c;for(c in a);return c===b||D.call(a,c)},isEmptyObject:function(a){for(var b in a)return!1;return!0},error:function(a){throw a},parseJSON:function(b){if(typeof b!="string"||!b)return null;b=e.trim(b);if(a.JSON&&a.JSON.parse)return a.JSON.parse(b);if(o.test(b.replace(p,"@").replace(q,"]").replace(r,"")))return(new Function("return "+b))();e.error("Invalid JSON: "+b)},parseXML:function(b,c,d){a.DOMParser?(d=new DOMParser,c=d.parseFromString(b,"text/xml")):(c=new ActiveXObject("Microsoft.XMLDOM"),c.async="false",c.loadXML(b)),d=c.documentElement,(!d||!d.nodeName||d.nodeName==="parsererror")&&e.error("Invalid XML: "+b);return c},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(w,x)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,c,d){var f,g=0,h=a.length,i=h===b||e.isFunction(a);if(d){if(i){for(f in a)if(c.apply(a[f],d)===!1)break}else for(;g0&&a[0]&&a[j-1]||j===0||e.isArray(a));if(k)for(;i1?h.call(arguments,0):c,--e||g.resolveWith(g,h.call(b,0))}}var b=arguments,c=0,d=b.length,e=d,g=d<=1&&a&&f.isFunction(a.promise)?a:f.Deferred();if(d>1){for(;c
a",d=a.getElementsByTagName("*"),e=a.getElementsByTagName("a")[0];if(!d||!d.length||!e)return{};g=c.createElement("select"),h=g.appendChild(c.createElement("option")),i=a.getElementsByTagName("input")[0],k={leadingWhitespace:a.firstChild.nodeType===3,tbody:!a.getElementsByTagName("tbody").length,htmlSerialize:!!a.getElementsByTagName("link").length,style:/top/.test(e.getAttribute("style")),hrefNormalized:e.getAttribute("href")==="/a",opacity:/^0.55$/.test(e.style.opacity),cssFloat:!!e.style.cssFloat,checkOn:i.value==="on",optSelected:h.selected,getSetAttribute:a.className!=="t",submitBubbles:!0,changeBubbles:!0,focusinBubbles:!1,deleteExpando:!0,noCloneEvent:!0,inlineBlockNeedsLayout:!1,shrinkWrapBlocks:!1,reliableMarginRight:!0},i.checked=!0,k.noCloneChecked=i.cloneNode(!0).checked,g.disabled=!0,k.optDisabled=!h.disabled;try{delete a.test}catch(v){k.deleteExpando=!1}!a.addEventListener&&a.attachEvent&&a.fireEvent&&(a.attachEvent("onclick",function(){k.noCloneEvent=!1}),a.cloneNode(!0).fireEvent("onclick")),i=c.createElement("input"),i.value="t",i.setAttribute("type","radio"),k.radioValue=i.value==="t",i.setAttribute("checked","checked"),a.appendChild(i),l=c.createDocumentFragment(),l.appendChild(a.firstChild),k.checkClone=l.cloneNode(!0).cloneNode(!0).lastChild.checked,a.innerHTML="",a.style.width=a.style.paddingLeft="1px",m=c.getElementsByTagName("body")[0],o=c.createElement(m?"div":"body"),p={visibility:"hidden",width:0,height:0,border:0,margin:0},m&&f.extend(p,{position:"absolute",left:-1e3,top:-1e3});for(t in p)o.style[t]=p[t];o.appendChild(a),n=m||b,n.insertBefore(o,n.firstChild),k.appendChecked=i.checked,k.boxModel=a.offsetWidth===2,"zoom"in a.style&&(a.style.display="inline",a.style.zoom=1,k.inlineBlockNeedsLayout=a.offsetWidth===2,a.style.display="",a.innerHTML="
",k.shrinkWrapBlocks=a.offsetWidth!==2),a.innerHTML="
t
",q=a.getElementsByTagName("td"),u=q[0].offsetHeight===0,q[0].style.display="",q[1].style.display="none",k.reliableHiddenOffsets=u&&q[0].offsetHeight===0,a.innerHTML="",c.defaultView&&c.defaultView.getComputedStyle&&(j=c.createElement("div"),j.style.width="0",j.style.marginRight="0",a.appendChild(j),k.reliableMarginRight=(parseInt((c.defaultView.getComputedStyle(j,null)||{marginRight:0}).marginRight,10)||0)===0),o.innerHTML="",n.removeChild(o);if(a.attachEvent)for(t in{submit:1,change:1,focusin:1})s="on"+t,u=s in a,u||(a.setAttribute(s,"return;"),u=typeof a[s]=="function"),k[t+"Bubbles"]=u;o=l=g=h=m=j=a=i=null;return k}(),f.boxModel=f.support.boxModel;var i=/^(?:\{.*\}|\[.*\])$/,j=/([a-z])([A-Z])/g;f.extend({cache:{},uuid:0,expando:"jQuery"+(f.fn.jquery+Math.random()).replace(/\D/g,""),noData:{embed:!0,object:"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000",applet:!0},hasData:function(a){a=a.nodeType?f.cache[a[f.expando]]:a[f.expando];return!!a&&!l(a)},data:function(a,c,d,e){if(!!f.acceptData(a)){var g=f.expando,h=typeof c=="string",i,j=a.nodeType,k=j?f.cache:a,l=j?a[f.expando]:a[f.expando]&&f.expando;if((!l||e&&l&&!k[l][g])&&h&&d===b)return;l||(j?a[f.expando]=l=++f.uuid:l=f.expando),k[l]||(k[l]={},j||(k[l].toJSON=f.noop));if(typeof c=="object"||typeof c=="function")e?k[l][g]=f.extend(k[l][g],c):k[l]=f.extend(k[l],c);i=k[l],e&&(i[g]||(i[g]={}),i=i[g]),d!==b&&(i[f.camelCase(c)]=d);if(c==="events"&&!i[c])return i[g]&&i[g].events;return h?i[f.camelCase(c)]||i[c]:i}},removeData:function(b,c,d){if(!!f.acceptData(b)){var e=f.expando,g=b.nodeType,h=g?f.cache:b,i=g?b[f.expando]:f.expando;if(!h[i])return;if(c){var j=d?h[i][e]:h[i];if(j){delete j[c];if(!l(j))return}}if(d){delete h[i][e];if(!l(h[i]))return}var k=h[i][e];f.support.deleteExpando||h!=a?delete h[i]:h[i]=null,k?(h[i]={},g||(h[i].toJSON=f.noop),h[i][e]=k):g&&(f.support.deleteExpando?delete b[f.expando]:b.removeAttribute?b.removeAttribute(f.expando):b[f.expando]=null)}},_data:function(a,b,c){return f.data(a,b,c,!0)},acceptData:function(a){if(a.nodeName){var b=f.noData[a.nodeName.toLowerCase()];if(b)return b!==!0&&a.getAttribute("classid")===b}return!0}}),f.fn.extend({data:function(a,c){var d=null;if(typeof a=="undefined"){if(this.length){d=f.data(this[0]);if(this[0].nodeType===1){var e=this[0].attributes,g;for(var h=0,i=e.length;h-1)return!0;return!1},val:function(a){var c,d,e=this[0];if(!arguments.length){if(e){c=f.valHooks[e.nodeName.toLowerCase()]||f.valHooks[e.type];if(c&&"get"in c&&(d=c.get(e,"value"))!==b)return d;d=e.value;return typeof d=="string"?d.replace(p,""):d==null?"":d}return b}var g=f.isFunction(a);return this.each(function(d){var e=f(this),h;if(this.nodeType===1){g?h=a.call(this,d,e.val()):h=a,h==null?h="":typeof h=="number"?h+="":f.isArray(h)&&(h=f.map(h,function(a){return a==null?"":a+""})),c=f.valHooks[this.nodeName.toLowerCase()]||f.valHooks[this.type];if(!c||!("set"in c)||c.set(this,h,"value")===b)this.value=h}})}}),f.extend({valHooks:{option:{get:function(a){var b=a.attributes.value;return!b||b.specified?a.value:a.text}},select:{get:function(a){var b,c=a.selectedIndex,d=[],e=a.options,g=a.type==="select-one";if(c<0)return null;for(var h=g?c:0,i=g?c+1:e.length;h=0}),c.length||(a.selectedIndex=-1);return c}}},attrFn:{val:!0,css:!0,html:!0,text:!0,data:!0,width:!0,height:!0,offset:!0},attrFix:{tabindex:"tabIndex"},attr:function(a,c,d,e){var g=a.nodeType;if(!a||g===3||g===8||g===2)return b;if(e&&c in f.attrFn)return f(a)[c](d);if(!("getAttribute"in a))return f.prop(a,c,d);var h,i,j=g!==1||!f.isXMLDoc(a);j&&(c=f.attrFix[c]||c,i=f.attrHooks[c],i||(t.test(c)?i=w:v&&c!=="className"&&(f.nodeName(a,"form")||u.test(c))&&(i=v)));if(d!==b){if(d===null){f.removeAttr(a,c);return b}if(i&&"set"in i&&j&&(h=i.set(a,d,c))!==b)return h;a.setAttribute(c,""+d);return d}if(i&&"get"in i&&j&&(h=i.get(a,c))!==null)return h;h=a.getAttribute(c);return h===null?b:h},removeAttr:function(a,b){var c;a.nodeType===1&&(b=f.attrFix[b]||b,f.support.getSetAttribute?a.removeAttribute(b):(f.attr(a,b,""),a.removeAttributeNode(a.getAttributeNode(b))),t.test(b)&&(c=f.propFix[b]||b)in a&&(a[c]=!1))},attrHooks:{type:{set:function(a,b){if(q.test(a.nodeName)&&a.parentNode)f.error("type property can't be changed");else if(!f.support.radioValue&&b==="radio"&&f.nodeName(a,"input")){var c=a.value;a.setAttribute("type",b),c&&(a.value=c);return b}}},tabIndex:{get:function(a){var c=a.getAttributeNode("tabIndex");return c&&c.specified?parseInt(c.value,10):r.test(a.nodeName)||s.test(a.nodeName)&&a.href?0:b}},value:{get:function(a,b){if(v&&f.nodeName(a,"button"))return v.get(a,b);return b in a?a.value:null},set:function(a,b,c){if(v&&f.nodeName(a,"button"))return v.set(a,b,c);a.value=b}}},propFix:{tabindex:"tabIndex",readonly:"readOnly","for":"htmlFor","class":"className",maxlength:"maxLength",cellspacing:"cellSpacing",cellpadding:"cellPadding",rowspan:"rowSpan",colspan:"colSpan",usemap:"useMap",frameborder:"frameBorder",contenteditable:"contentEditable"},prop:function(a,c,d){var e=a.nodeType;if(!a||e===3||e===8||e===2)return b;var g,h,i=e!==1||!f.isXMLDoc(a);i&&(c=f.propFix[c]||c,h=f.propHooks[c]);return d!==b?h&&"set"in h&&(g=h.set(a,d,c))!==b?g:a[c]=d:h&&"get"in h&&(g=h.get(a,c))!==b?g:a[c]},propHooks:{}}),w={get:function(a,c){return f.prop(a,c)?c.toLowerCase():b},set:function(a,b,c){var d;b===!1?f.removeAttr(a,c):(d=f.propFix[c]||c,d in a&&(a[d]=!0),a.setAttribute(c,c.toLowerCase()));return c}},f.support.getSetAttribute||(f.attrFix=f.propFix,v=f.attrHooks.name=f.attrHooks.title=f.valHooks.button={get:function(a,c){var d;d=a.getAttributeNode(c);return d&&d.nodeValue!==""?d.nodeValue:b},set:function(a,b,c){var d=a.getAttributeNode(c);if(d){d.nodeValue=b;return b}}},f.each(["width","height"],function(a,b){f.attrHooks[b]=f.extend(f.attrHooks[b],{set:function(a,c){if(c===""){a.setAttribute(b,"auto");return c}}})})),f.support.hrefNormalized||f.each(["href","src","width","height"],function(a,c){f.attrHooks[c]=f.extend(f.attrHooks[c],{get:function(a){var d=a.getAttribute(c,2);return d===null?b:d}})}),f.support.style||(f.attrHooks.style={get:function(a){return a.style.cssText.toLowerCase()||b},set:function(a,b){return a.style.cssText=""+b}}),f.support.optSelected||(f.propHooks.selected=f.extend(f.propHooks.selected,{get:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}})),f.support.checkOn||f.each(["radio","checkbox"],function(){f.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var x=/\.(.*)$/,y=/^(?:textarea|input|select)$/i,z=/\./g,A=/ /g,B=/[^\w\s.|`]/g,C=function(a){return a.replace(B,"\\$&")};f.event={add:function(a,c,d,e){if(a.nodeType!==3&&a.nodeType!==8){if(d===!1)d=D;else if(!d)return;var g,h;d.handler&&(g=d,d=g.handler),d.guid||(d.guid=f.guid++);var i=f._data(a);if(!i)return;var j=i.events,k=i.handle;j||(i.events=j={}),k||(i.handle=k=function(a){return typeof f!="undefined"&&(!a||f.event.triggered!==a.type)?f.event.handle.apply(k.elem,arguments):b}),k.elem=a,c=c.split(" ");var l,m=0,n;while(l=c[m++]){h=g?f.extend({},g):{handler:d,data:e},l.indexOf(".")>-1?(n=l.split("."),l=n.shift(),h.namespace=n.slice(0).sort().join(".")):(n=[],h.namespace=""),h.type=l,h.guid||(h.guid=d.guid);var o=j[l],p=f.event.special[l]||{};if(!o){o=j[l]=[];if(!p.setup||p.setup.call(a,e,n,k)===!1)a.addEventListener?a.addEventListener(l,k,!1):a.attachEvent&&a.attachEvent("on"+l,k)}p.add&&(p.add.call(a,h),h.handler.guid||(h.handler.guid=d.guid)),o.push(h),f.event.global[l]=!0}a=null}},global:{},remove:function(a,c,d,e){if(a.nodeType!==3&&a.nodeType!==8){d===!1&&(d=D);var g,h,i,j,k=0,l,m,n,o,p,q,r,s=f.hasData(a)&&f._data(a),t=s&&s.events;if(!s||!t)return;c&&c.type&&(d=c.handler,c=c.type);if(!c||typeof c=="string"&&c.charAt(0)==="."){c=c||"";for(h in t)f.event.remove(a,h+c);return}c=c.split(" ");while(h=c[k++]){r=h,q=null,l=h.indexOf(".")<0,m=[],l||(m=h.split("."),h=m.shift(),n=new RegExp("(^|\\.)"+f.map(m.slice(0).sort(),C).join("\\.(?:.*\\.)?")+"(\\.|$)")),p=t[h];if(!p)continue;if(!d){for(j=0;j=0&&(h=h.slice(0,-1),j=!0),h.indexOf(".")>=0&&(i=h.split("."),h=i. -shift(),i.sort());if(!!e&&!f.event.customEvent[h]||!!f.event.global[h]){c=typeof c=="object"?c[f.expando]?c:new f.Event(h,c):new f.Event(h),c.type=h,c.exclusive=j,c.namespace=i.join("."),c.namespace_re=new RegExp("(^|\\.)"+i.join("\\.(?:.*\\.)?")+"(\\.|$)");if(g||!e)c.preventDefault(),c.stopPropagation();if(!e){f.each(f.cache,function(){var a=f.expando,b=this[a];b&&b.events&&b.events[h]&&f.event.trigger(c,d,b.handle.elem)});return}if(e.nodeType===3||e.nodeType===8)return;c.result=b,c.target=e,d=d!=null?f.makeArray(d):[],d.unshift(c);var k=e,l=h.indexOf(":")<0?"on"+h:"";do{var m=f._data(k,"handle");c.currentTarget=k,m&&m.apply(k,d),l&&f.acceptData(k)&&k[l]&&k[l].apply(k,d)===!1&&(c.result=!1,c.preventDefault()),k=k.parentNode||k.ownerDocument||k===c.target.ownerDocument&&a}while(k&&!c.isPropagationStopped());if(!c.isDefaultPrevented()){var n,o=f.event.special[h]||{};if((!o._default||o._default.call(e.ownerDocument,c)===!1)&&(h!=="click"||!f.nodeName(e,"a"))&&f.acceptData(e)){try{l&&e[h]&&(n=e[l],n&&(e[l]=null),f.event.triggered=h,e[h]())}catch(p){}n&&(e[l]=n),f.event.triggered=b}}return c.result}},handle:function(c){c=f.event.fix(c||a.event);var d=((f._data(this,"events")||{})[c.type]||[]).slice(0),e=!c.exclusive&&!c.namespace,g=Array.prototype.slice.call(arguments,0);g[0]=c,c.currentTarget=this;for(var h=0,i=d.length;h-1?f.map(a.options,function(a){return a.selected}).join("-"):"":f.nodeName(a,"select")&&(c=a.selectedIndex);return c},J=function(c){var d=c.target,e,g;if(!!y.test(d.nodeName)&&!d.readOnly){e=f._data(d,"_change_data"),g=I(d),(c.type!=="focusout"||d.type!=="radio")&&f._data(d,"_change_data",g);if(e===b||g===e)return;if(e!=null||g)c.type="change",c.liveFired=b,f.event.trigger(c,arguments[1],d)}};f.event.special.change={filters:{focusout:J,beforedeactivate:J,click:function(a){var b=a.target,c=f.nodeName(b,"input")?b.type:"";(c==="radio"||c==="checkbox"||f.nodeName(b,"select"))&&J.call(this,a)},keydown:function(a){var b=a.target,c=f.nodeName(b,"input")?b.type:"";(a.keyCode===13&&!f.nodeName(b,"textarea")||a.keyCode===32&&(c==="checkbox"||c==="radio")||c==="select-multiple")&&J.call(this,a)},beforeactivate:function(a){var b=a.target;f._data(b,"_change_data",I(b))}},setup:function(a,b){if(this.type==="file")return!1;for(var c in H)f.event.add(this,c+".specialChange",H[c]);return y.test(this.nodeName)},teardown:function(a){f.event.remove(this,".specialChange");return y.test(this.nodeName)}},H=f.event.special.change.filters,H.focus=H.beforeactivate}f.support.focusinBubbles||f.each({focus:"focusin",blur:"focusout"},function(a,b){function e(a){var c=f.event.fix(a);c.type=b,c.originalEvent={},f.event.trigger(c,null,c.target),c.isDefaultPrevented()&&a.preventDefault()}var d=0;f.event.special[b]={setup:function(){d++===0&&c.addEventListener(a,e,!0)},teardown:function(){--d===0&&c.removeEventListener(a,e,!0)}}}),f.each(["bind","one"],function(a,c){f.fn[c]=function(a,d,e){var g;if(typeof a=="object"){for(var h in a)this[c](h,d,a[h],e);return this}if(arguments.length===2||d===!1)e=d,d=b;c==="one"?(g=function(a){f(this).unbind(a,g);return e.apply(this,arguments)},g.guid=e.guid||f.guid++):g=e;if(a==="unload"&&c!=="one")this.one(a,d,e);else for(var i=0,j=this.length;i0?this.bind(b,a,c):this.trigger(b)},f.attrFn&&(f.attrFn[b]=!0)}),function(){function u(a,b,c,d,e,f){for(var g=0,h=d.length;g0){j=i;break}}i=i[a]}d[g]=j}}}function t(a,b,c,d,e,f){for(var g=0,h=d.length;g+~,(\[\\]+)+|[>+~])(\s*,\s*)?((?:.|\r|\n)*)/g,d=0,e=Object.prototype.toString,g=!1,h=!0,i=/\\/g,j=/\W/;[0,0].sort(function(){h=!1;return 0});var k=function(b,d,f,g){f=f||[],d=d||c;var h=d;if(d.nodeType!==1&&d.nodeType!==9)return[];if(!b||typeof b!="string")return f;var i,j,n,o,q,r,s,t,u=!0,w=k.isXML(d),x=[],y=b;do{a.exec(""),i=a.exec(y);if(i){y=i[3],x.push(i[1]);if(i[2]){o=i[3];break}}}while(i);if(x.length>1&&m.exec(b))if(x.length===2&&l.relative[x[0]])j=v(x[0]+x[1],d);else{j=l.relative[x[0]]?[d]:k(x.shift(),d);while(x.length)b=x.shift(),l.relative[b]&&(b+=x.shift()),j=v(b,j)}else{!g&&x.length>1&&d.nodeType===9&&!w&&l.match.ID.test(x[0])&&!l.match.ID.test(x[x.length-1])&&(q=k.find(x.shift(),d,w),d=q.expr?k.filter(q.expr,q.set)[0]:q.set[0]);if(d){q=g?{expr:x.pop(),set:p(g)}:k.find(x.pop(),x.length===1&&(x[0]==="~"||x[0]==="+")&&d.parentNode?d.parentNode:d,w),j=q.expr?k.filter(q.expr,q.set):q.set,x.length>0?n=p(j):u=!1;while(x.length)r=x.pop(),s=r,l.relative[r]?s=x.pop():r="",s==null&&(s=d),l.relative[r](n,s,w)}else n=x=[]}n||(n=j),n||k.error(r||b);if(e.call(n)==="[object Array]")if(!u)f.push.apply(f,n);else if(d&&d.nodeType===1)for(t=0;n[t]!=null;t++)n[t]&&(n[t]===!0||n[t].nodeType===1&&k.contains(d,n[t]))&&f.push(j[t]);else for(t=0;n[t]!=null;t++)n[t]&&n[t].nodeType===1&&f.push(j[t]);else p(n,f);o&&(k(o,h,f,g),k.uniqueSort(f));return f};k.uniqueSort=function(a){if(r){g=h,a.sort(r);if(g)for(var b=1;b0},k.find=function(a,b,c){var d;if(!a)return[];for(var e=0,f=l.order.length;e":function(a,b){var c,d=typeof b=="string",e=0,f=a.length;if(d&&!j.test(b)){b=b.toLowerCase();for(;e=0)?c||d.push(h):c&&(b[g]=!1));return!1},ID:function(a){return a[1].replace(i,"")},TAG:function(a,b){return a[1].replace(i,"").toLowerCase()},CHILD:function(a){if(a[1]==="nth"){a[2]||k.error(a[0]),a[2]=a[2].replace(/^\+|\s*/g,"");var b=/(-?)(\d*)(?:n([+\-]?\d*))?/.exec(a[2]==="even"&&"2n"||a[2]==="odd"&&"2n+1"||!/\D/.test(a[2])&&"0n+"+a[2]||a[2]);a[2]=b[1]+(b[2]||1)-0,a[3]=b[3]-0}else a[2]&&k.error(a[0]);a[0]=d++;return a},ATTR:function(a,b,c,d,e,f){var g=a[1]=a[1].replace(i,"");!f&&l.attrMap[g]&&(a[1]=l.attrMap[g]),a[4]=(a[4]||a[5]||"").replace(i,""),a[2]==="~="&&(a[4]=" "+a[4]+" ");return a},PSEUDO:function(b,c,d,e,f){if(b[1]==="not")if((a.exec(b[3])||"").length>1||/^\w/.test(b[3]))b[3]=k(b[3],null,null,c);else{var g=k.filter(b[3],c,d,!0^f);d||e.push.apply(e,g);return!1}else if(l.match.POS.test(b[0])||l.match.CHILD.test(b[0]))return!0;return b},POS:function(a){a.unshift(!0);return a}},filters:{enabled:function(a){return a.disabled===!1&&a.type!=="hidden"},disabled:function(a){return a.disabled===!0},checked:function(a){return a.checked===!0},selected:function(a){a.parentNode&&a.parentNode.selectedIndex;return a.selected===!0},parent:function(a){return!!a.firstChild},empty:function(a){return!a.firstChild},has:function(a,b,c){return!!k(c[3],a).length},header:function(a){return/h\d/i.test(a.nodeName)},text:function(a){var b=a.getAttribute("type"),c=a.type;return a.nodeName.toLowerCase()==="input"&&"text"===c&&(b===c||b===null)},radio:function(a){return a.nodeName.toLowerCase()==="input"&&"radio"===a.type},checkbox:function(a){return a.nodeName.toLowerCase()==="input"&&"checkbox"===a.type},file:function(a){return a.nodeName.toLowerCase()==="input"&&"file"===a.type},password:function(a){return a.nodeName.toLowerCase()==="input"&&"password"===a.type},submit:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"submit"===a.type},image:function(a){return a.nodeName.toLowerCase()==="input"&&"image"===a.type},reset:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"reset"===a.type},button:function(a){var b=a.nodeName.toLowerCase();return b==="input"&&"button"===a.type||b==="button"},input:function(a){return/input|select|textarea|button/i.test(a.nodeName)},focus:function(a){return a===a.ownerDocument.activeElement}},setFilters:{first:function(a,b){return b===0},last:function(a,b,c,d){return b===d.length-1},even:function(a,b){return b%2===0},odd:function(a,b){return b%2===1},lt:function(a,b,c){return bc[3]-0},nth:function(a,b,c){return c[3]-0===b},eq:function(a,b,c){return c[3]-0===b}},filter:{PSEUDO:function(a,b,c,d){var e=b[1],f=l.filters[e];if(f)return f(a,c,b,d);if(e==="contains")return(a.textContent||a.innerText||k.getText([a])||"").indexOf(b[3])>=0;if(e==="not"){var g=b[3];for(var h=0,i=g.length;h=0}},ID:function(a,b){return a.nodeType===1&&a.getAttribute("id")===b},TAG:function(a,b){return b==="*"&&a.nodeType===1||a.nodeName.toLowerCase()===b},CLASS:function(a,b){return(" "+(a.className||a.getAttribute("class"))+" ").indexOf(b)>-1},ATTR:function(a,b){var c=b[1],d=l.attrHandle[c]?l.attrHandle[c](a):a[c]!=null?a[c]:a.getAttribute(c),e=d+"",f=b[2],g=b[4];return d==null?f==="!=":f==="="?e===g:f==="*="?e.indexOf(g)>=0:f==="~="?(" "+e+" ").indexOf(g)>=0:g?f==="!="?e!==g:f==="^="?e.indexOf(g)===0:f==="$="?e.substr(e.length-g.length)===g:f==="|="?e===g||e.substr(0,g.length+1)===g+"-":!1:e&&d!==!1},POS:function(a,b,c,d){var e=b[2],f=l.setFilters[e];if(f)return f(a,c,b,d)}}},m=l.match.POS,n=function(a,b){return"\\"+(b-0+1)};for(var o in l.match)l.match[o]=new RegExp(l.match[o].source+/(?![^\[]*\])(?![^\(]*\))/.source),l.leftMatch[o]=new RegExp(/(^(?:.|\r|\n)*?)/.source+l.match[o].source.replace(/\\(\d+)/g,n));var p=function(a,b){a=Array.prototype.slice.call(a,0);if(b){b.push.apply(b,a);return b}return a};try{Array.prototype.slice.call(c.documentElement.childNodes,0)[0].nodeType}catch(q){p=function(a,b){var c=0,d=b||[];if(e.call(a)==="[object Array]")Array.prototype.push.apply(d,a);else if(typeof a.length=="number")for(var f=a.length;c",e.insertBefore(a,e.firstChild),c.getElementById(d)&&(l.find.ID=function(a,c,d){if(typeof c.getElementById!="undefined"&&!d){var e=c.getElementById(a[1]);return e?e.id===a[1]||typeof e.getAttributeNode!="undefined"&&e.getAttributeNode("id").nodeValue===a[1]?[e]:b:[]}},l.filter.ID=function(a,b){var c=typeof a.getAttributeNode!="undefined"&&a.getAttributeNode("id");return a.nodeType===1&&c&&c.nodeValue===b}),e.removeChild(a),e=a=null}(),function(){var a=c.createElement("div");a.appendChild(c.createComment("")),a.getElementsByTagName("*").length>0&&(l.find.TAG=function(a,b){var c=b.getElementsByTagName(a[1]);if(a[1]==="*"){var d=[];for(var e=0;c[e];e++)c[e].nodeType===1&&d.push(c[e]);c=d}return c}),a.innerHTML="",a.firstChild&&typeof a.firstChild.getAttribute!="undefined"&&a.firstChild.getAttribute("href")!=="#"&&(l.attrHandle.href=function(a){return a.getAttribute("href",2)}),a=null}(),c.querySelectorAll&&function(){var a=k,b=c.createElement("div"),d="__sizzle__";b.innerHTML="

";if(!b.querySelectorAll||b.querySelectorAll(".TEST").length!==0){k=function(b,e,f,g){e=e||c;if(!g&&!k.isXML(e)){var h=/^(\w+$)|^\.([\w\-]+$)|^#([\w\-]+$)/.exec(b);if(h&&(e.nodeType===1||e.nodeType===9)){if(h[1])return p(e.getElementsByTagName(b),f);if(h[2]&&l.find.CLASS&&e.getElementsByClassName)return p(e.getElementsByClassName(h[2]),f)}if(e.nodeType===9){if(b==="body"&&e.body)return p([e.body],f);if(h&&h[3]){var i=e.getElementById(h[3]);if(!i||!i.parentNode)return p([],f);if(i.id===h[3])return p([i],f)}try{return p(e.querySelectorAll(b),f)}catch(j){}}else if(e.nodeType===1&&e.nodeName.toLowerCase()!=="object"){var m=e,n=e.getAttribute("id"),o=n||d,q=e.parentNode,r=/^\s*[+~]/.test(b);n?o=o.replace(/'/g,"\\$&"):e.setAttribute("id",o),r&&q&&(e=e.parentNode);try{if(!r||q)return p(e.querySelectorAll("[id='"+o+"'] "+b),f)}catch(s){}finally{n||m.removeAttribute("id")}}}return a(b,e,f,g)};for(var e in a)k[e]=a[e];b=null}}(),function(){var a=c.documentElement,b=a.matchesSelector||a.mozMatchesSelector||a.webkitMatchesSelector||a.msMatchesSelector;if(b){var d=!b.call(c.createElement("div"),"div"),e=!1;try{b.call(c.documentElement,"[test!='']:sizzle")}catch(f){e=!0}k.matchesSelector=function(a,c){c=c.replace(/\=\s*([^'"\]]*)\s*\]/g,"='$1']");if(!k.isXML(a))try{if(e||!l.match.PSEUDO.test(c)&&!/!=/.test(c)){var f=b.call(a,c);if(f||!d||a.document&&a.document.nodeType!==11)return f}}catch(g){}return k(c,null,null,[a]).length>0}}}(),function(){var a=c.createElement("div");a.innerHTML="
";if(!!a.getElementsByClassName&&a.getElementsByClassName("e").length!==0){a.lastChild.className="e";if(a.getElementsByClassName("e").length===1)return;l.order.splice(1,0,"CLASS"),l.find.CLASS=function(a,b,c){if(typeof b.getElementsByClassName!="undefined"&&!c)return b.getElementsByClassName(a[1])},a=null}}(),c.documentElement.contains?k.contains=function(a,b){return a!==b&&(a.contains?a.contains(b):!0)}:c.documentElement.compareDocumentPosition?k.contains=function(a,b){return!!(a.compareDocumentPosition(b)&16)}:k.contains=function(){return!1},k.isXML=function(a){var b=(a?a.ownerDocument||a:0).documentElement;return b?b.nodeName!=="HTML":!1};var v=function(a,b){var c,d=[],e="",f=b.nodeType?[b]:b;while(c=l.match.PSEUDO.exec(a))e+=c[0],a=a.replace(l.match.PSEUDO,"");a=l.relative[a]?a+"*":a;for(var g=0,h=f.length;g0)for(h=g;h0:this.filter(a).length>0)},closest:function(a,b){var c=[],d,e,g=this[0];if(f.isArray(a)){var h,i,j={},k=1;if(g&&a.length){for(d=0,e=a.length;d-1:f(g).is(h))&&c.push({selector:i,elem:g,level:k});g=g.parentNode,k++}}return c}var l=T.test(a)||typeof a!="string"?f(a,b||this.context):0;for(d=0,e=this.length;d-1:f.find.matchesSelector(g,a)){c.push(g);break}g=g.parentNode;if(!g||!g.ownerDocument||g===b||g.nodeType===11)break}}c=c.length>1?f.unique(c):c;return this.pushStack(c,"closest",a)},index:function(a){if(!a||typeof a=="string")return f.inArray(this[0],a?f(a):this.parent().children());return f.inArray(a.jquery?a[0]:a,this)},add:function(a,b){var c=typeof a=="string"?f(a,b):f.makeArray(a&&a.nodeType?[a]:a),d=f.merge(this.get(),c);return this.pushStack(V(c[0])||V(d[0])?d:f.unique(d))},andSelf:function(){return this.add(this.prevObject)}}),f.each({parent:function(a){var b=a.parentNode;return b&&b.nodeType!==11?b:null},parents:function(a){return f.dir(a,"parentNode")},parentsUntil:function(a,b,c){return f.dir(a,"parentNode",c)},next:function(a){return f.nth(a,2,"nextSibling")},prev:function(a){return f.nth(a,2,"previousSibling")},nextAll:function(a){return f.dir(a,"nextSibling")},prevAll:function(a){return f.dir(a,"previousSibling")},nextUntil:function(a,b,c){return f.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return f.dir(a,"previousSibling",c)},siblings:function(a){return f.sibling(a.parentNode.firstChild,a)},children:function(a){return f.sibling(a.firstChild)},contents:function(a){return f.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:f.makeArray(a.childNodes)}},function(a,b){f.fn[a]=function(c,d){var e=f.map(this,b,c),g=S.call(arguments);O.test(a)||(d=c),d&&typeof d=="string"&&(e=f.filter(d,e)),e=this.length>1&&!U[a]?f.unique(e):e,(this.length>1||Q.test(d))&&P.test(a)&&(e=e.reverse());return this.pushStack(e,a,g.join(","))}}),f.extend({filter:function(a,b,c){c&&(a=":not("+a+")");return b.length===1?f.find.matchesSelector(b[0],a)?[b[0]]:[]:f.find.matches(a,b)},dir:function(a,c,d){var e=[],g=a[c];while(g&&g.nodeType!==9&&(d===b||g.nodeType!==1||!f(g).is(d)))g.nodeType===1&&e.push(g),g=g[c];return e},nth:function(a,b,c,d){b=b||1;var e=0;for(;a;a=a[c])if(a.nodeType===1&&++e===b)break;return a},sibling:function(a,b){var c=[];for(;a;a=a.nextSibling)a.nodeType===1&&a!==b&&c.push(a);return c}});var X=/ jQuery\d+="(?:\d+|null)"/g,Y=/^\s+/,Z=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,$=/<([\w:]+)/,_=/",""],legend:[1,"
","
"],thead:[1,"","
"],tr:[2,"","
"],td:[3,"","
"],col:[2,"","
"],area:[1,"",""],_default:[0,"",""]};bf.optgroup=bf.option,bf.tbody=bf.tfoot=bf.colgroup=bf.caption=bf.thead,bf.th=bf.td,f.support.htmlSerialize||(bf._default=[1,"div
","
"]),f.fn.extend({text:function(a){if(f.isFunction(a))return this.each(function(b){var c=f(this);c.text(a.call(this,b,c.text()))});if(typeof a!="object"&&a!==b)return this.empty().append((this[0]&&this[0].ownerDocument||c).createTextNode(a));return f.text(this)},wrapAll:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapAll(a.call(this,b))});if(this[0]){var b=f(a,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstChild&&a.firstChild.nodeType===1)a=a.firstChild;return a}).append(this)}return this},wrapInner:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapInner(a.call(this,b))});return this.each(function(){var b=f(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){return this.each(function(){f(this).wrapAll(a)})},unwrap:function(){return this.parent().each(function(){f.nodeName(this,"body")||f(this).replaceWith(this.childNodes)}).end()},append:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.appendChild(a)})},prepend:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.insertBefore(a,this.firstChild)})},before:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this)});if(arguments.length){var a=f(arguments[0]);a.push.apply(a,this.toArray());return this.pushStack(a,"before",arguments)}},after:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this.nextSibling)});if(arguments.length){var a=this.pushStack(this,"after",arguments);a.push.apply(a,f(arguments[0]).toArray());return a}},remove:function(a,b){for(var c=0,d;(d=this[c])!=null;c++)if(!a||f.filter(a,[d]).length)!b&&d.nodeType===1&&(f.cleanData(d.getElementsByTagName("*")),f.cleanData([d])),d.parentNode&&d.parentNode.removeChild(d);return this},empty:function(){for(var a=0,b;(b=this[a])!=null;a++){b.nodeType===1&&f.cleanData(b.getElementsByTagName("*"));while(b.firstChild)b.removeChild(b.firstChild)}return this},clone:function(a,b){a=a==null?!1:a,b=b==null?a:b;return this.map(function(){return f.clone(this,a,b)})},html:function(a){if(a===b)return this[0]&&this[0].nodeType===1?this[0].innerHTML.replace(X,""):null;if(typeof a=="string"&&!bb.test(a)&&(f.support.leadingWhitespace||!Y.test(a))&&!bf[($.exec(a)||["",""])[1].toLowerCase()]){a=a.replace(Z,"<$1>");try{for(var c=0,d=this.length;c1&&l0?this.clone(!0):this).get();f(e[h])[b](j),d=d.concat(j -)}return this.pushStack(d,a,e.selector)}}),f.extend({clone:function(a,b,c){var d=a.cloneNode(!0),e,g,h;if((!f.support.noCloneEvent||!f.support.noCloneChecked)&&(a.nodeType===1||a.nodeType===11)&&!f.isXMLDoc(a)){bi(a,d),e=bj(a),g=bj(d);for(h=0;e[h];++h)bi(e[h],g[h])}if(b){bh(a,d);if(c){e=bj(a),g=bj(d);for(h=0;e[h];++h)bh(e[h],g[h])}}e=g=null;return d},clean:function(a,b,d,e){var g;b=b||c,typeof b.createElement=="undefined"&&(b=b.ownerDocument||b[0]&&b[0].ownerDocument||c);var h=[],i;for(var j=0,k;(k=a[j])!=null;j++){typeof k=="number"&&(k+="");if(!k)continue;if(typeof k=="string")if(!ba.test(k))k=b.createTextNode(k);else{k=k.replace(Z,"<$1>");var l=($.exec(k)||["",""])[1].toLowerCase(),m=bf[l]||bf._default,n=m[0],o=b.createElement("div");o.innerHTML=m[1]+k+m[2];while(n--)o=o.lastChild;if(!f.support.tbody){var p=_.test(k),q=l==="table"&&!p?o.firstChild&&o.firstChild.childNodes:m[1]===""&&!p?o.childNodes:[];for(i=q.length-1;i>=0;--i)f.nodeName(q[i],"tbody")&&!q[i].childNodes.length&&q[i].parentNode.removeChild(q[i])}!f.support.leadingWhitespace&&Y.test(k)&&o.insertBefore(b.createTextNode(Y.exec(k)[0]),o.firstChild),k=o.childNodes}var r;if(!f.support.appendChecked)if(k[0]&&typeof (r=k.length)=="number")for(i=0;i=0)return b+"px"}}}),f.support.opacity||(f.cssHooks.opacity={get:function(a,b){return bo.test((b&&a.currentStyle?a.currentStyle.filter:a.style.filter)||"")?parseFloat(RegExp.$1)/100+"":b?"1":""},set:function(a,b){var c=a.style,d=a.currentStyle;c.zoom=1;var e=f.isNaN(b)?"":"alpha(opacity="+b*100+")",g=d&&d.filter||c.filter||"";c.filter=bn.test(g)?g.replace(bn,e):g+" "+e}}),f(function(){f.support.reliableMarginRight||(f.cssHooks.marginRight={get:function(a,b){var c;f.swap(a,{display:"inline-block"},function(){b?c=bx(a,"margin-right","marginRight"):c=a.style.marginRight});return c}})}),c.defaultView&&c.defaultView.getComputedStyle&&(by=function(a,c){var d,e,g;c=c.replace(bp,"-$1").toLowerCase();if(!(e=a.ownerDocument.defaultView))return b;if(g=e.getComputedStyle(a,null))d=g.getPropertyValue(c),d===""&&!f.contains(a.ownerDocument.documentElement,a)&&(d=f.style(a,c));return d}),c.documentElement.currentStyle&&(bz=function(a,b){var c,d=a.currentStyle&&a.currentStyle[b],e=a.runtimeStyle&&a.runtimeStyle[b],f=a.style;!bq.test(d)&&br.test(d)&&(c=f.left,e&&(a.runtimeStyle.left=a.currentStyle.left),f.left=b==="fontSize"?"1em":d||0,d=f.pixelLeft+"px",f.left=c,e&&(a.runtimeStyle.left=e));return d===""?"auto":d}),bx=by||bz,f.expr&&f.expr.filters&&(f.expr.filters.hidden=function(a){var b=a.offsetWidth,c=a.offsetHeight;return b===0&&c===0||!f.support.reliableHiddenOffsets&&(a.style.display||f.css(a,"display"))==="none"},f.expr.filters.visible=function(a){return!f.expr.filters.hidden(a)});var bB=/%20/g,bC=/\[\]$/,bD=/\r?\n/g,bE=/#.*$/,bF=/^(.*?):[ \t]*([^\r\n]*)\r?$/mg,bG=/^(?:color|date|datetime|email|hidden|month|number|password|range|search|tel|text|time|url|week)$/i,bH=/^(?:about|app|app\-storage|.+\-extension|file|widget):$/,bI=/^(?:GET|HEAD)$/,bJ=/^\/\//,bK=/\?/,bL=/)<[^<]*)*<\/script>/gi,bM=/^(?:select|textarea)/i,bN=/\s+/,bO=/([?&])_=[^&]*/,bP=/^([\w\+\.\-]+:)(?:\/\/([^\/?#:]*)(?::(\d+))?)?/,bQ=f.fn.load,bR={},bS={},bT,bU;try{bT=e.href}catch(bV){bT=c.createElement("a"),bT.href="",bT=bT.href}bU=bP.exec(bT.toLowerCase())||[],f.fn.extend({load:function(a,c,d){if(typeof a!="string"&&bQ)return bQ.apply(this,arguments);if(!this.length)return this;var e=a.indexOf(" ");if(e>=0){var g=a.slice(e,a.length);a=a.slice(0,e)}var h="GET";c&&(f.isFunction(c)?(d=c,c=b):typeof c=="object"&&(c=f.param(c,f.ajaxSettings.traditional),h="POST"));var i=this;f.ajax({url:a,type:h,dataType:"html",data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?f("
").append(c.replace(bL,"")).find(g):c)),d&&i.each(d,[c,b,a])}});return this},serialize:function(){return f.param(this.serializeArray())},serializeArray:function(){return this.map(function(){return this.elements?f.makeArray(this.elements):this}).filter(function(){return this.name&&!this.disabled&&(this.checked||bM.test(this.nodeName)||bG.test(this.type))}).map(function(a,b){var c=f(this).val();return c==null?null:f.isArray(c)?f.map(c,function(a,c){return{name:b.name,value:a.replace(bD,"\r\n")}}):{name:b.name,value:c.replace(bD,"\r\n")}}).get()}}),f.each("ajaxStart ajaxStop ajaxComplete ajaxError ajaxSuccess ajaxSend".split(" "),function(a,b){f.fn[b]=function(a){return this.bind(b,a)}}),f.each(["get","post"],function(a,c){f[c]=function(a,d,e,g){f.isFunction(d)&&(g=g||e,e=d,d=b);return f.ajax({type:c,url:a,data:d,success:e,dataType:g})}}),f.extend({getScript:function(a,c){return f.get(a,b,c,"script")},getJSON:function(a,b,c){return f.get(a,b,c,"json")},ajaxSetup:function(a,b){b?f.extend(!0,a,f.ajaxSettings,b):(b=a,a=f.extend(!0,f.ajaxSettings,b));for(var c in{context:1,url:1})c in b?a[c]=b[c]:c in f.ajaxSettings&&(a[c]=f.ajaxSettings[c]);return a},ajaxSettings:{url:bT,isLocal:bH.test(bU[1]),global:!0,type:"GET",contentType:"application/x-www-form-urlencoded",processData:!0,async:!0,accepts:{xml:"application/xml, text/xml",html:"text/html",text:"text/plain",json:"application/json, text/javascript","*":"*/*"},contents:{xml:/xml/,html:/html/,json:/json/},responseFields:{xml:"responseXML",text:"responseText"},converters:{"* text":a.String,"text html":!0,"text json":f.parseJSON,"text xml":f.parseXML}},ajaxPrefilter:bW(bR),ajaxTransport:bW(bS),ajax:function(a,c){function w(a,c,l,m){if(s!==2){s=2,q&&clearTimeout(q),p=b,n=m||"",v.readyState=a?4:0;var o,r,u,w=l?bZ(d,v,l):b,x,y;if(a>=200&&a<300||a===304){if(d.ifModified){if(x=v.getResponseHeader("Last-Modified"))f.lastModified[k]=x;if(y=v.getResponseHeader("Etag"))f.etag[k]=y}if(a===304)c="notmodified",o=!0;else try{r=b$(d,w),c="success",o=!0}catch(z){c="parsererror",u=z}}else{u=c;if(!c||a)c="error",a<0&&(a=0)}v.status=a,v.statusText=c,o?h.resolveWith(e,[r,c,v]):h.rejectWith(e,[v,c,u]),v.statusCode(j),j=b,t&&g.trigger("ajax"+(o?"Success":"Error"),[v,d,o?r:u]),i.resolveWith(e,[v,c]),t&&(g.trigger("ajaxComplete",[v,d]),--f.active||f.event.trigger("ajaxStop"))}}typeof a=="object"&&(c=a,a=b),c=c||{};var d=f.ajaxSetup({},c),e=d.context||d,g=e!==d&&(e.nodeType||e instanceof f)?f(e):f.event,h=f.Deferred(),i=f._Deferred(),j=d.statusCode||{},k,l={},m={},n,o,p,q,r,s=0,t,u,v={readyState:0,setRequestHeader:function(a,b){if(!s){var c=a.toLowerCase();a=m[c]=m[c]||a,l[a]=b}return this},getAllResponseHeaders:function(){return s===2?n:null},getResponseHeader:function(a){var c;if(s===2){if(!o){o={};while(c=bF.exec(n))o[c[1].toLowerCase()]=c[2]}c=o[a.toLowerCase()]}return c===b?null:c},overrideMimeType:function(a){s||(d.mimeType=a);return this},abort:function(a){a=a||"abort",p&&p.abort(a),w(0,a);return this}};h.promise(v),v.success=v.done,v.error=v.fail,v.complete=i.done,v.statusCode=function(a){if(a){var b;if(s<2)for(b in a)j[b]=[j[b],a[b]];else b=a[v.status],v.then(b,b)}return this},d.url=((a||d.url)+"").replace(bE,"").replace(bJ,bU[1]+"//"),d.dataTypes=f.trim(d.dataType||"*").toLowerCase().split(bN),d.crossDomain==null&&(r=bP.exec(d.url.toLowerCase()),d.crossDomain=!(!r||r[1]==bU[1]&&r[2]==bU[2]&&(r[3]||(r[1]==="http:"?80:443))==(bU[3]||(bU[1]==="http:"?80:443)))),d.data&&d.processData&&typeof d.data!="string"&&(d.data=f.param(d.data,d.traditional)),bX(bR,d,c,v);if(s===2)return!1;t=d.global,d.type=d.type.toUpperCase(),d.hasContent=!bI.test(d.type),t&&f.active++===0&&f.event.trigger("ajaxStart");if(!d.hasContent){d.data&&(d.url+=(bK.test(d.url)?"&":"?")+d.data),k=d.url;if(d.cache===!1){var x=f.now(),y=d.url.replace(bO,"$1_="+x);d.url=y+(y===d.url?(bK.test(d.url)?"&":"?")+"_="+x:"")}}(d.data&&d.hasContent&&d.contentType!==!1||c.contentType)&&v.setRequestHeader("Content-Type",d.contentType),d.ifModified&&(k=k||d.url,f.lastModified[k]&&v.setRequestHeader("If-Modified-Since",f.lastModified[k]),f.etag[k]&&v.setRequestHeader("If-None-Match",f.etag[k])),v.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+(d.dataTypes[0]!=="*"?", */*; q=0.01":""):d.accepts["*"]);for(u in d.headers)v.setRequestHeader(u,d.headers[u]);if(d.beforeSend&&(d.beforeSend.call(e,v,d)===!1||s===2)){v.abort();return!1}for(u in{success:1,error:1,complete:1})v[u](d[u]);p=bX(bS,d,c,v);if(!p)w(-1,"No Transport");else{v.readyState=1,t&&g.trigger("ajaxSend",[v,d]),d.async&&d.timeout>0&&(q=setTimeout(function(){v.abort("timeout")},d.timeout));try{s=1,p.send(l,w)}catch(z){status<2?w(-1,z):f.error(z)}}return v},param:function(a,c){var d=[],e=function(a,b){b=f.isFunction(b)?b():b,d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(b)};c===b&&(c=f.ajaxSettings.traditional);if(f.isArray(a)||a.jquery&&!f.isPlainObject(a))f.each(a,function(){e(this.name,this.value)});else for(var g in a)bY(g,a[g],c,e);return d.join("&").replace(bB,"+")}}),f.extend({active:0,lastModified:{},etag:{}});var b_=f.now(),ca=/(\=)\?(&|$)|\?\?/i;f.ajaxSetup({jsonp:"callback",jsonpCallback:function(){return f.expando+"_"+b_++}}),f.ajaxPrefilter("json jsonp",function(b,c,d){var e=b.contentType==="application/x-www-form-urlencoded"&&typeof b.data=="string";if(b.dataTypes[0]==="jsonp"||b.jsonp!==!1&&(ca.test(b.url)||e&&ca.test(b.data))){var g,h=b.jsonpCallback=f.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,i=a[h],j=b.url,k=b.data,l="$1"+h+"$2";b.jsonp!==!1&&(j=j.replace(ca,l),b.url===j&&(e&&(k=k.replace(ca,l)),b.data===k&&(j+=(/\?/.test(j)?"&":"?")+b.jsonp+"="+h))),b.url=j,b.data=k,a[h]=function(a){g=[a]},d.always(function(){a[h]=i,g&&f.isFunction(i)&&a[h](g[0])}),b.converters["script json"]=function(){g||f.error(h+" was not called");return g[0]},b.dataTypes[0]="json";return"script"}}),f.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/javascript|ecmascript/},converters:{"text script":function(a){f.globalEval(a);return a}}}),f.ajaxPrefilter("script",function(a){a.cache===b&&(a.cache=!1),a.crossDomain&&(a.type="GET",a.global=!1)}),f.ajaxTransport("script",function(a){if(a.crossDomain){var d,e=c.head||c.getElementsByTagName("head")[0]||c.documentElement;return{send:function(f,g){d=c.createElement("script"),d.async="async",a.scriptCharset&&(d.charset=a.scriptCharset),d.src=a.url,d.onload=d.onreadystatechange=function(a,c){if(c||!d.readyState||/loaded|complete/.test(d.readyState))d.onload=d.onreadystatechange=null,e&&d.parentNode&&e.removeChild(d),d=b,c||g(200,"success")},e.insertBefore(d,e.firstChild)},abort:function(){d&&d.onload(0,1)}}}});var cb=a.ActiveXObject?function(){for(var a in cd)cd[a](0,1)}:!1,cc=0,cd;f.ajaxSettings.xhr=a.ActiveXObject?function(){return!this.isLocal&&ce()||cf()}:ce,function(a){f.extend(f.support,{ajax:!!a,cors:!!a&&"withCredentials"in a})}(f.ajaxSettings.xhr()),f.support.ajax&&f.ajaxTransport(function(c){if(!c.crossDomain||f.support.cors){var d;return{send:function(e,g){var h=c.xhr(),i,j;c.username?h.open(c.type,c.url,c.async,c.username,c.password):h.open(c.type,c.url,c.async);if(c.xhrFields)for(j in c.xhrFields)h[j]=c.xhrFields[j];c.mimeType&&h.overrideMimeType&&h.overrideMimeType(c.mimeType),!c.crossDomain&&!e["X-Requested-With"]&&(e["X-Requested-With"]="XMLHttpRequest");try{for(j in e)h.setRequestHeader(j,e[j])}catch(k){}h.send(c.hasContent&&c.data||null),d=function(a,e){var j,k,l,m,n;try{if(d&&(e||h.readyState===4)){d=b,i&&(h.onreadystatechange=f.noop,cb&&delete cd[i]);if(e)h.readyState!==4&&h.abort();else{j=h.status,l=h.getAllResponseHeaders(),m={},n=h.responseXML,n&&n.documentElement&&(m.xml=n),m.text=h.responseText;try{k=h.statusText}catch(o){k=""}!j&&c.isLocal&&!c.crossDomain?j=m.text?200:404:j===1223&&(j=204)}}}catch(p){e||g(-1,p)}m&&g(j,k,m,l)},!c.async||h.readyState===4?d():(i=++cc,cb&&(cd||(cd={},f(a).unload(cb)),cd[i]=d),h.onreadystatechange=d)},abort:function(){d&&d(0,1)}}}});var cg={},ch,ci,cj=/^(?:toggle|show|hide)$/,ck=/^([+\-]=)?([\d+.\-]+)([a-z%]*)$/i,cl,cm=[["height","marginTop","marginBottom","paddingTop","paddingBottom"],["width","marginLeft","marginRight","paddingLeft","paddingRight"],["opacity"]],cn,co=a.webkitRequestAnimationFrame||a.mozRequestAnimationFrame||a.oRequestAnimationFrame;f.fn.extend({show:function(a,b,c){var d,e;if(a||a===0)return this.animate(cr("show",3),a,b,c);for(var g=0,h=this.length;g=e.duration+this.startTime){this.now=this.end,this.pos=this.state=1,this.update(),e.animatedProperties[this.prop]=!0;for(g in e.animatedProperties)e.animatedProperties[g]!==!0&&(c=!1);if(c){e.overflow!=null&&!f.support.shrinkWrapBlocks&&f.each(["","X","Y"],function(a,b){d.style["overflow"+b]=e.overflow[a]}),e.hide&&f(d).hide();if(e.hide||e.show)for(var i in e.animatedProperties)f.style(d,i,e.orig[i]);e.complete.call(d)}return!1}e.duration==Infinity?this.now=b:(h=b-this.startTime,this.state=h/e.duration,this.pos=f.easing[e.animatedProperties[this.prop]](this.state,h,0,1,e.duration),this.now=this.start+(this.end-this.start)*this.pos),this.update();return!0}},f.extend(f.fx,{tick:function(){for(var a=f.timers,b=0;b
";f.extend(b.style,{position:"absolute",top:0,left:0,margin:0,border:0,width:"1px",height:"1px",visibility:"hidden"}),b.innerHTML=j,a.insertBefore(b,a.firstChild),d=b.firstChild,e=d.firstChild,h=d.nextSibling.firstChild.firstChild,this.doesNotAddBorder=e.offsetTop!==5,this.doesAddBorderForTableAndCells=h.offsetTop===5,e.style.position="fixed",e.style.top="20px",this.supportsFixedPosition=e.offsetTop===20||e.offsetTop===15,e.style.position=e.style.top="",d.style.overflow="hidden",d.style.position="relative",this.subtractsBorderForOverflowNotVisible=e.offsetTop===-5,this.doesNotIncludeMarginInBodyOffset=a.offsetTop!==i,a.removeChild(b),f.offset.initialize=f.noop},bodyOffset:function(a){var b=a.offsetTop,c=a.offsetLeft;f.offset.initialize(),f.offset.doesNotIncludeMarginInBodyOffset&&(b+=parseFloat(f.css(a,"marginTop"))||0,c+=parseFloat(f.css(a,"marginLeft"))||0);return{top:b,left:c}},setOffset:function(a,b,c){var d=f.css(a,"position");d==="static"&&(a.style.position="relative");var e=f(a),g=e.offset(),h=f.css(a,"top"),i=f.css(a,"left"),j=(d==="absolute"||d==="fixed")&&f.inArray("auto",[h,i])>-1,k={},l={},m,n;j?(l=e.position(),m=l.top,n=l.left):(m=parseFloat(h)||0,n=parseFloat(i)||0),f.isFunction(b)&&(b=b.call(a,c,g)),b.top!=null&&(k.top=b.top-g.top+m),b.left!=null&&(k.left=b.left-g.left+n),"using"in b?b.using.call(a,k):e.css(k)}},f.fn.extend({position:function(){if(!this[0])return null;var a=this[0],b=this.offsetParent(),c=this.offset(),d=cu.test(b[0].nodeName)?{top:0,left:0}:b.offset();c.top-=parseFloat(f.css(a,"marginTop"))||0,c.left-=parseFloat(f.css(a,"marginLeft"))||0,d.top+=parseFloat(f.css(b[0],"borderTopWidth"))||0,d.left+=parseFloat(f.css(b[0],"borderLeftWidth"))||0;return{top:c.top-d.top,left:c.left-d.left}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||c.body;while(a&&!cu.test(a.nodeName)&&f.css(a,"position")==="static")a=a.offsetParent;return a})}}),f.each(["Left","Top"],function(a,c){var d="scroll"+c;f.fn[d]=function(c){var e,g;if(c===b){e=this[0];if(!e)return null;g=cv(e);return g?"pageXOffset"in g?g[a?"pageYOffset":"pageXOffset"]:f.support.boxModel&&g.document.documentElement[d]||g.document.body[d]:e[d]}return this.each(function(){g=cv(this),g?g.scrollTo(a?f(g).scrollLeft():c,a?c:f(g).scrollTop()):this[d]=c})}}),f.each(["Height","Width"],function(a,c){var d=c.toLowerCase();f.fn["inner"+c]=function(){var a=this[0];return a&&a.style?parseFloat(f.css(a,d,"padding")):null},f.fn["outer"+c]=function(a){var b=this[0];return b&&b.style?parseFloat(f.css(b,d,a?"margin":"border")):null},f.fn[d]=function(a){var e=this[0];if(!e)return a==null?null:this;if(f.isFunction(a))return this.each(function(b){var c=f(this);c[d](a.call(this,b,c[d]()))});if(f.isWindow(e)){var g=e.document.documentElement["client"+c];return e.document.compatMode==="CSS1Compat"&&g||e.document.body["client"+c]||g}if(e.nodeType===9)return Math.max(e.documentElement["client"+c],e.body["scroll"+c],e.documentElement["scroll"+c],e.body["offset"+c],e.documentElement["offset"+c]);if(a===b){var h=f.css(e,d),i=parseFloat(h);return f.isNaN(i)?h:i}return this.css(d,typeof a=="string"?a:a+"px")}}),a.jQuery=a.$=f})(window); \ No newline at end of file diff --git a/config/orionids-dev/javascript/jquery.form.js b/config/orionids-dev/javascript/jquery.form.js deleted file mode 100644 index 2b853df4..00000000 --- a/config/orionids-dev/javascript/jquery.form.js +++ /dev/null @@ -1,785 +0,0 @@ -/*! - * jQuery Form Plugin - * version: 2.49 (18-OCT-2010) - * @requires jQuery v1.3.2 or later - * - * Examples and documentation at: http://malsup.com/jquery/form/ - * Dual licensed under the MIT and GPL licenses: - * http://www.opensource.org/licenses/mit-license.php - * http://www.gnu.org/licenses/gpl.html - */ -;(function($) { - -/* - Usage Note: - ----------- - Do not use both ajaxSubmit and ajaxForm on the same form. These - functions are intended to be exclusive. Use ajaxSubmit if you want - to bind your own submit handler to the form. For example, - - $(document).ready(function() { - $('#myForm').bind('submit', function(e) { - e.preventDefault(); // <-- important - $(this).ajaxSubmit({ - target: '#output' - }); - }); - }); - - Use ajaxForm when you want the plugin to manage all the event binding - for you. For example, - - $(document).ready(function() { - $('#myForm').ajaxForm({ - target: '#output' - }); - }); - - When using ajaxForm, the ajaxSubmit function will be invoked for you - at the appropriate time. -*/ - -/** - * ajaxSubmit() provides a mechanism for immediately submitting - * an HTML form using AJAX. - */ -$.fn.ajaxSubmit = function(options) { - // fast fail if nothing selected (http://dev.jquery.com/ticket/2752) - if (!this.length) { - log('ajaxSubmit: skipping submit process - no element selected'); - return this; - } - - if (typeof options == 'function') { - options = { success: options }; - } - - var url = $.trim(this.attr('action')); - if (url) { - // clean url (don't include hash vaue) - url = (url.match(/^([^#]+)/)||[])[1]; - } - url = url || window.location.href || ''; - - options = $.extend(true, { - url: url, - type: this.attr('method') || 'GET', - iframeSrc: /^https/i.test(window.location.href || '') ? 'javascript:false' : 'about:blank' - }, options); - - // hook for manipulating the form data before it is extracted; - // convenient for use with rich editors like tinyMCE or FCKEditor - var veto = {}; - this.trigger('form-pre-serialize', [this, options, veto]); - if (veto.veto) { - log('ajaxSubmit: submit vetoed via form-pre-serialize trigger'); - return this; - } - - // provide opportunity to alter form data before it is serialized - if (options.beforeSerialize && options.beforeSerialize(this, options) === false) { - log('ajaxSubmit: submit aborted via beforeSerialize callback'); - return this; - } - - var n,v,a = this.formToArray(options.semantic); - if (options.data) { - options.extraData = options.data; - for (n in options.data) { - if(options.data[n] instanceof Array) { - for (var k in options.data[n]) { - a.push( { name: n, value: options.data[n][k] } ); - } - } - else { - v = options.data[n]; - v = $.isFunction(v) ? v() : v; // if value is fn, invoke it - a.push( { name: n, value: v } ); - } - } - } - - // give pre-submit callback an opportunity to abort the submit - if (options.beforeSubmit && options.beforeSubmit(a, this, options) === false) { - log('ajaxSubmit: submit aborted via beforeSubmit callback'); - return this; - } - - // fire vetoable 'validate' event - this.trigger('form-submit-validate', [a, this, options, veto]); - if (veto.veto) { - log('ajaxSubmit: submit vetoed via form-submit-validate trigger'); - return this; - } - - var q = $.param(a); - - if (options.type.toUpperCase() == 'GET') { - options.url += (options.url.indexOf('?') >= 0 ? '&' : '?') + q; - options.data = null; // data is null for 'get' - } - else { - options.data = q; // data is the query string for 'post' - } - - var $form = this, callbacks = []; - if (options.resetForm) { - callbacks.push(function() { $form.resetForm(); }); - } - if (options.clearForm) { - callbacks.push(function() { $form.clearForm(); }); - } - - // perform a load on the target only if dataType is not provided - if (!options.dataType && options.target) { - var oldSuccess = options.success || function(){}; - callbacks.push(function(data) { - var fn = options.replaceTarget ? 'replaceWith' : 'html'; - $(options.target)[fn](data).each(oldSuccess, arguments); - }); - } - else if (options.success) { - callbacks.push(options.success); - } - - options.success = function(data, status, xhr) { // jQuery 1.4+ passes xhr as 3rd arg - var context = options.context || options; // jQuery 1.4+ supports scope context - for (var i=0, max=callbacks.length; i < max; i++) { - callbacks[i].apply(context, [data, status, xhr || $form, $form]); - } - }; - - // are there files to upload? - var fileInputs = $('input:file', this).length > 0; - var mp = 'multipart/form-data'; - var multipart = ($form.attr('enctype') == mp || $form.attr('encoding') == mp); - - // options.iframe allows user to force iframe mode - // 06-NOV-09: now defaulting to iframe mode if file input is detected - if (options.iframe !== false && (fileInputs || options.iframe || multipart)) { - // hack to fix Safari hang (thanks to Tim Molendijk for this) - // see: http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d - if (options.closeKeepAlive) { - $.get(options.closeKeepAlive, fileUpload); - } - else { - fileUpload(); - } - } - else { - $.ajax(options); - } - - // fire 'notify' event - this.trigger('form-submit-notify', [this, options]); - return this; - - - // private function for handling file uploads (hat tip to YAHOO!) - function fileUpload() { - var form = $form[0]; - - if ($(':input[name=submit],:input[id=submit]', form).length) { - // if there is an input with a name or id of 'submit' then we won't be - // able to invoke the submit fn on the form (at least not x-browser) - alert('Error: Form elements must not have name or id of "submit".'); - return; - } - - var s = $.extend(true, {}, $.ajaxSettings, options); - s.context = s.context || s; - var id = 'jqFormIO' + (new Date().getTime()), fn = '_'+id; - window[fn] = function() { - var f = $io.data('form-plugin-onload'); - if (f) { - f(); - window[fn] = undefined; - try { delete window[fn]; } catch(e){} - } - } - var $io = $(''); - - var appendElem = jQuery('
success...'); - appendElem.appendTo('.loadingWaitingMessage'); - setTimeout(hideLoading('#loadingWaiting'), 3000); - } - - // After Save Calls display - var appendElem = jQuery('
success...'); - function finnish(){ - // hold msg for a min - setTimeout(function(){ - hideLoading('#loadingWaiting'); - appendElem.remove(); - updatestarted = 1; - }, 1200 ); - } - - function showResponse(data, responseText, statusText, xhr, $form){ - - // START of fill call to user - if (responseText === 'success') { - - // snort logs download success - if (data.downloadfilename !== '' && data.snortdownload === 'success'){ - downloadsnortlogs(data); - } - - // succsess display - if (data.snortgeneralsettings === 'success' || data.snortdelete === 'success' || data.snortreset === 'success'){ - // sucsses msg - appendElem.appendTo('.loadingWaitingMessage'); - - // Clean up Waiting code - finnish(); - - if (data.snortMiscTabCall === 'true'){ - jQuery.fn.miscTabCall(); // call tab misc functions - } - - if (data.snortreset) {location.reload();} // hard refresh - - } - - // END of fill call to user - }else{ - // On FAIL get some info back - //alert('responseText: \n' + data.responseText + 'FAIL'); - } - } - // END iform code - - // declare variable for iform - var options = { - beforeSubmit: showRequest, - dataType: 'json', - success: showResponse, - type: 'POST', - url: './snort_json_post.php' - }; - -}); // end of document ready - diff --git a/config/orionids-dev/orion.xml b/config/orionids-dev/orion.xml deleted file mode 100644 index 2bf853f4..00000000 --- a/config/orionids-dev/orion.xml +++ /dev/null @@ -1,272 +0,0 @@ - - - - - - . - All rights reserved. - */ -/* ========================================================================== */ -/* - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - */ -/* ========================================================================== */ - ]]> - - Describe your package here - Describe your package requirements here - Currently there are no FAQ items provided. - Orion - 2.9.0.5 - Services:2.9.0.5 pkg v. 2.0 - /usr/local/pkg/snort/snort_install.inc - - Orion - Setup snort specific settings -
Services
- /snort/snort_interfaces.php - - - orion - orion.sh - snort - Snort is the most widely deployed IDS/IPS technology worldwide. - - - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/orion.xml - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snortDB - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snortDBrules - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snortDBtemp - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_build.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_download_rules.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_gui.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_head.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_headbase.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_install.inc - - - /usr/local/pkg/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_new.inc - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_alerts.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_barnyard.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_blocked.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_define_servers.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_download_updates.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_help_info.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_edit.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_global.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_rules.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_rules_edit.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_suppress.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_suppress_edit.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_whitelist.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_interfaces_whitelist_edit.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_json_get.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_json_post.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_preprocessors.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_rules.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_rulesets.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_rules_ips.php - - - /usr/local/www/snort/ - 077 - http://www.pfsense.com/packages/config/orionids-dev/snort_rulesets_ips.php - - - /usr/local/bin/ - 077 - http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/create-sidmap.pl - - - /usr/local/bin/ - 077 - http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/make_snortsam_map.pl - - - /usr/local/bin/ - 077 - http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/oinkmaster.pl - - - /usr/local/bin/ - 077 - http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/snort_rename.pl - - - - - - - sync_snort_package(); - - - snort_postinstall(); - - - snort_deinstall(); - - diff --git a/config/orionids-dev/patches/SnortSam/TODAO.txt b/config/orionids-dev/patches/SnortSam/TODAO.txt deleted file mode 100644 index 3abf0303..00000000 --- a/config/orionids-dev/patches/SnortSam/TODAO.txt +++ /dev/null @@ -1 +0,0 @@ -Patch current snort 2.9 \ No newline at end of file diff --git a/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff b/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff deleted file mode 100644 index 983165e1..00000000 --- a/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff +++ /dev/null @@ -1,3021 +0,0 @@ -Index: snort-2.8.6.1/src/twofish.c -=================================================================== ---- snort-2.8.6.1/src/twofish.c (Revision 0) -+++ snort-2.8.6.1/src/twofish.c (Revision 3) -@@ -0,0 +1,971 @@ -+/* $Id: twofish.c,v 2.1 2008/12/15 20:36:05 fknobbe Exp $ -+ * -+ * -+ * Copyright (C) 1997-2000 The Cryptix Foundation Limited. -+ * Copyright (C) 2000 Farm9. -+ * Copyright (C) 2001 Frank Knobbe. -+ * All rights reserved. -+ * -+ * For Cryptix code: -+ * Use, modification, copying and distribution of this software is subject -+ * the terms and conditions of the Cryptix General Licence. You should have -+ * received a copy of the Cryptix General Licence along with this library; -+ * if not, you can download a copy from http://www.cryptix.org/ . -+ * -+ * For Farm9: -+ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and -+ * ciphertext stealing technique, added AsciiTwofish class for easy encryption -+ * decryption of text strings -+ * -+ * Frank Knobbe : -+ * --- April 2001, converted from C++ to C, prefixed global variables -+ * with TwoFish, substituted some defines, changed functions to make use of -+ * variables supplied in a struct, modified and added routines for modular calls. -+ * Cleaned up the code so that defines are used instead of fixed 16's and 32's. -+ * Created two general purpose crypt routines for one block and multiple block -+ * encryption using Joh's CBC code. -+ * Added crypt routines that use a header (with a magic and data length). -+ * (Basically a major rewrite). -+ * -+ * Note: Routines labeled _TwoFish are private and should not be used -+ * (or with extreme caution). -+ * -+ */ -+ -+#ifndef __TWOFISH_LIBRARY_SOURCE__ -+#define __TWOFISH_LIBRARY_SOURCE__ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef WIN32 -+ -+#ifndef u_long -+typedef unsigned long u_long; -+#endif -+#ifndef u_int32_t -+typedef unsigned long u_int32_t; -+#endif -+#ifndef u_word -+typedef unsigned short u_word; -+#endif -+#ifndef u_int16_t -+typedef unsigned short u_int16_t; -+#endif -+#ifndef u_char -+typedef unsigned char u_char; -+#endif -+#ifndef u_int8_t -+typedef unsigned char u_int8_t; -+#endif -+ -+#endif /* WIN32 */ -+ -+#include "twofish.h" -+ -+ -+bool TwoFish_srand=TRUE; /* if TRUE, first call of TwoFishInit will seed rand(); */ -+ /* of TwoFishInit */ -+ -+/* Fixed 8x8 permutation S-boxes */ -+static const u_int8_t TwoFish_P[2][256] = -+{ -+ { /* p0 */ -+ 0xA9, 0x67, 0xB3, 0xE8, 0x04, 0xFD, 0xA3, 0x76, 0x9A, 0x92, 0x80, 0x78, -+ 0xE4, 0xDD, 0xD1, 0x38, 0x0D, 0xC6, 0x35, 0x98, 0x18, 0xF7, 0xEC, 0x6C, -+ 0x43, 0x75, 0x37, 0x26, 0xFA, 0x13, 0x94, 0x48, 0xF2, 0xD0, 0x8B, 0x30, -+ 0x84, 0x54, 0xDF, 0x23, 0x19, 0x5B, 0x3D, 0x59, 0xF3, 0xAE, 0xA2, 0x82, -+ 0x63, 0x01, 0x83, 0x2E, 0xD9, 0x51, 0x9B, 0x7C, 0xA6, 0xEB, 0xA5, 0xBE, -+ 0x16, 0x0C, 0xE3, 0x61, 0xC0, 0x8C, 0x3A, 0xF5, 0x73, 0x2C, 0x25, 0x0B, -+ 0xBB, 0x4E, 0x89, 0x6B, 0x53, 0x6A, 0xB4, 0xF1, 0xE1, 0xE6, 0xBD, 0x45, -+ 0xE2, 0xF4, 0xB6, 0x66, 0xCC, 0x95, 0x03, 0x56, 0xD4, 0x1C, 0x1E, 0xD7, -+ 0xFB, 0xC3, 0x8E, 0xB5, 0xE9, 0xCF, 0xBF, 0xBA, 0xEA, 0x77, 0x39, 0xAF, -+ 0x33, 0xC9, 0x62, 0x71, 0x81, 0x79, 0x09, 0xAD, 0x24, 0xCD, 0xF9, 0xD8, -+ 0xE5, 0xC5, 0xB9, 0x4D, 0x44, 0x08, 0x86, 0xE7, 0xA1, 0x1D, 0xAA, 0xED, -+ 0x06, 0x70, 0xB2, 0xD2, 0x41, 0x7B, 0xA0, 0x11, 0x31, 0xC2, 0x27, 0x90, -+ 0x20, 0xF6, 0x60, 0xFF, 0x96, 0x5C, 0xB1, 0xAB, 0x9E, 0x9C, 0x52, 0x1B, -+ 0x5F, 0x93, 0x0A, 0xEF, 0x91, 0x85, 0x49, 0xEE, 0x2D, 0x4F, 0x8F, 0x3B, -+ 0x47, 0x87, 0x6D, 0x46, 0xD6, 0x3E, 0x69, 0x64, 0x2A, 0xCE, 0xCB, 0x2F, -+ 0xFC, 0x97, 0x05, 0x7A, 0xAC, 0x7F, 0xD5, 0x1A, 0x4B, 0x0E, 0xA7, 0x5A, -+ 0x28, 0x14, 0x3F, 0x29, 0x88, 0x3C, 0x4C, 0x02, 0xB8, 0xDA, 0xB0, 0x17, -+ 0x55, 0x1F, 0x8A, 0x7D, 0x57, 0xC7, 0x8D, 0x74, 0xB7, 0xC4, 0x9F, 0x72, -+ 0x7E, 0x15, 0x22, 0x12, 0x58, 0x07, 0x99, 0x34, 0x6E, 0x50, 0xDE, 0x68, -+ 0x65, 0xBC, 0xDB, 0xF8, 0xC8, 0xA8, 0x2B, 0x40, 0xDC, 0xFE, 0x32, 0xA4, -+ 0xCA, 0x10, 0x21, 0xF0, 0xD3, 0x5D, 0x0F, 0x00, 0x6F, 0x9D, 0x36, 0x42, -+ 0x4A, 0x5E, 0xC1, 0xE0 -+ }, -+ { /* p1 */ -+ 0x75, 0xF3, 0xC6, 0xF4, 0xDB, 0x7B, 0xFB, 0xC8, 0x4A, 0xD3, 0xE6, 0x6B, -+ 0x45, 0x7D, 0xE8, 0x4B, 0xD6, 0x32, 0xD8, 0xFD, 0x37, 0x71, 0xF1, 0xE1, -+ 0x30, 0x0F, 0xF8, 0x1B, 0x87, 0xFA, 0x06, 0x3F, 0x5E, 0xBA, 0xAE, 0x5B, -+ 0x8A, 0x00, 0xBC, 0x9D, 0x6D, 0xC1, 0xB1, 0x0E, 0x80, 0x5D, 0xD2, 0xD5, -+ 0xA0, 0x84, 0x07, 0x14, 0xB5, 0x90, 0x2C, 0xA3, 0xB2, 0x73, 0x4C, 0x54, -+ 0x92, 0x74, 0x36, 0x51, 0x38, 0xB0, 0xBD, 0x5A, 0xFC, 0x60, 0x62, 0x96, -+ 0x6C, 0x42, 0xF7, 0x10, 0x7C, 0x28, 0x27, 0x8C, 0x13, 0x95, 0x9C, 0xC7, -+ 0x24, 0x46, 0x3B, 0x70, 0xCA, 0xE3, 0x85, 0xCB, 0x11, 0xD0, 0x93, 0xB8, -+ 0xA6, 0x83, 0x20, 0xFF, 0x9F, 0x77, 0xC3, 0xCC, 0x03, 0x6F, 0x08, 0xBF, -+ 0x40, 0xE7, 0x2B, 0xE2, 0x79, 0x0C, 0xAA, 0x82, 0x41, 0x3A, 0xEA, 0xB9, -+ 0xE4, 0x9A, 0xA4, 0x97, 0x7E, 0xDA, 0x7A, 0x17, 0x66, 0x94, 0xA1, 0x1D, -+ 0x3D, 0xF0, 0xDE, 0xB3, 0x0B, 0x72, 0xA7, 0x1C, 0xEF, 0xD1, 0x53, 0x3E, -+ 0x8F, 0x33, 0x26, 0x5F, 0xEC, 0x76, 0x2A, 0x49, 0x81, 0x88, 0xEE, 0x21, -+ 0xC4, 0x1A, 0xEB, 0xD9, 0xC5, 0x39, 0x99, 0xCD, 0xAD, 0x31, 0x8B, 0x01, -+ 0x18, 0x23, 0xDD, 0x1F, 0x4E, 0x2D, 0xF9, 0x48, 0x4F, 0xF2, 0x65, 0x8E, -+ 0x78, 0x5C, 0x58, 0x19, 0x8D, 0xE5, 0x98, 0x57, 0x67, 0x7F, 0x05, 0x64, -+ 0xAF, 0x63, 0xB6, 0xFE, 0xF5, 0xB7, 0x3C, 0xA5, 0xCE, 0xE9, 0x68, 0x44, -+ 0xE0, 0x4D, 0x43, 0x69, 0x29, 0x2E, 0xAC, 0x15, 0x59, 0xA8, 0x0A, 0x9E, -+ 0x6E, 0x47, 0xDF, 0x34, 0x35, 0x6A, 0xCF, 0xDC, 0x22, 0xC9, 0xC0, 0x9B, -+ 0x89, 0xD4, 0xED, 0xAB, 0x12, 0xA2, 0x0D, 0x52, 0xBB, 0x02, 0x2F, 0xA9, -+ 0xD7, 0x61, 0x1E, 0xB4, 0x50, 0x04, 0xF6, 0xC2, 0x16, 0x25, 0x86, 0x56, -+ 0x55, 0x09, 0xBE, 0x91 -+ } -+}; -+ -+static bool TwoFish_MDSready=FALSE; -+static u_int32_t TwoFish_MDS[4][256]; /* TwoFish_MDS matrix */ -+ -+ -+#define TwoFish_LFSR1(x) (((x)>>1)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/2:0)) -+#define TwoFish_LFSR2(x) (((x)>>2)^(((x)&0x02)?TwoFish_MDS_GF_FDBK/2:0)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/4:0)) -+ -+#define TwoFish_Mx_1(x) ((u_int32_t)(x)) /* force result to dword so << will work */ -+#define TwoFish_Mx_X(x) ((u_int32_t)((x)^TwoFish_LFSR2(x))) /* 5B */ -+#define TwoFish_Mx_Y(x) ((u_int32_t)((x)^TwoFish_LFSR1(x)^TwoFish_LFSR2(x))) /* EF */ -+#define TwoFish_RS_rem(x) { u_int8_t b=(u_int8_t)(x>>24); u_int32_t g2=((b<<1)^((b&0x80)?TwoFish_RS_GF_FDBK:0))&0xFF; u_int32_t g3=((b>>1)&0x7F)^((b&1)?TwoFish_RS_GF_FDBK>>1:0)^g2; x=(x<<8)^(g3<<24)^(g2<<16)^(g3<<8)^b; } -+ -+/*#define TwoFish__b(x,N) (((u_int8_t *)&x)[((N)&3)^TwoFish_ADDR_XOR])*/ /* pick bytes out of a dword */ -+ -+#define TwoFish_b0(x) TwoFish__b(x,0) /* extract LSB of u_int32_t */ -+#define TwoFish_b1(x) TwoFish__b(x,1) -+#define TwoFish_b2(x) TwoFish__b(x,2) -+#define TwoFish_b3(x) TwoFish__b(x,3) /* extract MSB of u_int32_t */ -+ -+u_int8_t TwoFish__b(u_int32_t x,int n) -+{ n&=3; -+ while(n-->0) -+ x>>=8; -+ return (u_int8_t)x; -+} -+ -+ -+/* TwoFish Initialization -+ * -+ * This routine generates a global data structure for use with TwoFish, -+ * initializes important values (such as subkeys, sBoxes), generates subkeys -+ * and precomputes the MDS matrix if not already done. -+ * -+ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!') -+ * -+ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data. -+ * This pointer is used with all other crypt functions. -+ */ -+ -+TWOFISH *TwoFishInit(char *userkey) -+{ TWOFISH *tfdata; -+ int i,x,m; -+ char tkey[TwoFish_KEY_LENGTH+40]; -+ -+ tfdata=malloc(sizeof(TWOFISH)); /* allocate the TwoFish structure */ -+ if(tfdata!=NULL) -+ { if(*userkey) -+ { strncpy(tkey,userkey,TwoFish_KEY_LENGTH); /* use first 32 chars of user supplied password */ -+ tkey[TwoFish_KEY_LENGTH]=0; /* make sure it wasn't more */ -+ } -+ else -+ strcpy(tkey,TwoFish_DEFAULT_PW); /* if no key defined, use default password */ -+ for(i=0,x=0,m=strlen(tkey);ikey[i]=tkey[x++]; /* fill the whole keyspace with repeating key. */ -+ if(x==m) -+ x=0; -+ } -+ -+ if(!TwoFish_MDSready) -+ _TwoFish_PrecomputeMDSmatrix(); /* "Wake Up, Neo" */ -+ _TwoFish_MakeSubKeys(tfdata); /* generate subkeys */ -+ _TwoFish_ResetCBC(tfdata); /* reset the CBC */ -+ tfdata->output=NULL; /* nothing to output yet */ -+ tfdata->dontflush=FALSE; /* reset decrypt skip block flag */ -+ if(TwoFish_srand) -+ { TwoFish_srand=FALSE; -+ srand(time(NULL)); -+ } -+ } -+ return tfdata; /* return the data pointer */ -+} -+ -+ -+void TwoFishDestroy(TWOFISH *tfdata) -+{ if(tfdata!=NULL) -+ free(tfdata); -+} -+ -+ -+/* en/decryption with CBC mode */ -+unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) -+{ unsigned long rl; -+ -+ rl=len; /* remember how much data to crypt. */ -+ while(len>TwoFish_BLOCK_SIZE) /* and now we process block by block. */ -+ { _TwoFish_BlockCrypt(in,out,TwoFish_BLOCK_SIZE,decrypt,tfdata); /* de/encrypt it. */ -+ in+=TwoFish_BLOCK_SIZE; /* adjust pointers. */ -+ out+=TwoFish_BLOCK_SIZE; -+ len-=TwoFish_BLOCK_SIZE; -+ } -+ if(len>0) /* if we have less than a block left... */ -+ _TwoFish_BlockCrypt(in,out,len,decrypt,tfdata); /* ...then we de/encrypt that too. */ -+ if(tfdata->qBlockDefined && !tfdata->dontflush) /* in case len was exactly one block... */ -+ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); /* ...we need to write the... */ -+ /* ...remaining bytes of the buffer */ -+ return rl; -+} -+ -+/* en/decryption on one block only */ -+unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) -+{ /* qBlockPlain already zero'ed through ResetCBC */ -+ memcpy(tfdata->qBlockPlain,in,len); /* toss the data into it. */ -+ _TwoFish_BlockCrypt16(tfdata->qBlockPlain,tfdata->qBlockCrypt,decrypt,tfdata); /* encrypt just that block without CBC. */ -+ memcpy(out,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE); /* and return what we got */ -+ return TwoFish_BLOCK_SIZE; -+} -+ -+/* en/decryption without reset of CBC and output assignment */ -+unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) -+{ -+ if(in!=NULL && out!=NULL && len>0 && tfdata!=NULL) /* if we have valid data, then... */ -+ { if(len>TwoFish_BLOCK_SIZE) /* ...check if we have more than one block. */ -+ return _TwoFish_CryptRawCBC(in,out,len,decrypt,tfdata); /* if so, use the CBC routines... */ -+ else -+ return _TwoFish_CryptRaw16(in,out,len,decrypt,tfdata); /* ...otherwise just do one block. */ -+ } -+ return 0; -+} -+ -+ -+/* TwoFish Raw Encryption -+ * -+ * Does not use header, but does use CBC (if more than one block has to be encrypted). -+ * -+ * Input: Pointer to the buffer of the plaintext to be encrypted. -+ * Pointer to the buffer receiving the ciphertext. -+ * The length of the plaintext buffer. -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes encrypted if successful, otherwise 0. -+ */ -+ -+unsigned long TwoFishEncryptRaw(char *in, -+ char *out, -+ unsigned long len, -+ TWOFISH *tfdata) -+{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */ -+ tfdata->output=out; /* output straight into output buffer. */ -+ return _TwoFish_CryptRaw(in,out,len,FALSE,tfdata); /* and go for it. */ -+} -+ -+/* TwoFish Raw Decryption -+ * -+ * Does not use header, but does use CBC (if more than one block has to be decrypted). -+ * -+ * Input: Pointer to the buffer of the ciphertext to be decrypted. -+ * Pointer to the buffer receiving the plaintext. -+ * The length of the ciphertext buffer (at least one cipher block). -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes decrypted if successful, otherwise 0. -+ */ -+ -+unsigned long TwoFishDecryptRaw(char *in, -+ char *out, -+ unsigned long len, -+ TWOFISH *tfdata) -+{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */ -+ tfdata->output=out; /* output straight into output buffer. */ -+ return _TwoFish_CryptRaw(in,out,len,TRUE,tfdata); /* and go for it. */ -+} -+ -+/* TwoFish Free -+ * -+ * Free's the allocated buffer. -+ * -+ * Input: Pointer to the TwoFish structure -+ * -+ * Output: (none) -+ */ -+ -+void TwoFishFree(TWOFISH *tfdata) -+{ if(tfdata->output!=NULL) /* if a valid buffer is present... */ -+ { free(tfdata->output); /* ...then we free it for you... */ -+ tfdata->output=NULL; /* ...and mark as such. */ -+ } -+} -+ -+/* TwoFish Set Output -+ * -+ * If you want to allocate the output buffer yourself, -+ * then you can set it with this function. -+ * -+ * Input: Pointer to your output buffer -+ * Pointer to the TwoFish structure -+ * -+ * Output: (none) -+ */ -+ -+void TwoFishSetOutput(char *outp,TWOFISH *tfdata) -+{ tfdata->output=outp; /* (do we really need a function for this?) */ -+} -+ -+/* TwoFish Alloc -+ * -+ * Allocates enough memory for the output buffer that would be required -+ * -+ * Input: Length of the plaintext. -+ * Boolean flag for BinHex Output. -+ * Pointer to the TwoFish structure. -+ * -+ * Output: Returns a pointer to the memory allocated. -+ */ -+ -+void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata) -+{ -+/* TwoFishFree(tfdata); */ /* (don't for now) discard whatever was allocated earlier. */ -+ if(decrypt) /* if decrypting... */ -+ { if(binhex) /* ...and input is binhex encoded... */ -+ len/=2; /* ...use half as much for output. */ -+ len-=TwoFish_BLOCK_SIZE; /* Also, subtract the size of the header. */ -+ } -+ else -+ { len+=TwoFish_BLOCK_SIZE; /* the size is just increased by the header... */ -+ if(binhex) -+ len*=2; /* ...and doubled if output is to be binhexed. */ -+ } -+ tfdata->output=malloc(len+TwoFish_BLOCK_SIZE);/* grab some memory...plus some extra (it's running over somewhere, crashes without extra padding) */ -+ -+ return tfdata->output; /* ...and return to caller. */ -+} -+ -+/* bin2hex and hex2bin conversion */ -+void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex) -+{ u_int8_t *pi,*po,c; -+ -+ if(bintohex) -+ { for(pi=buf+len-1,po=buf+(2*len)-1;len>0;pi--,po--,len--) /* let's start from the end of the bin block. */ -+ { c=*pi; /* grab value. */ -+ c&=15; /* use lower 4 bits. */ -+ if(c>9) /* convert to ascii. */ -+ c+=('a'-10); -+ else -+ c+='0'; -+ *po--=c; /* set the lower nibble. */ -+ c=*pi; /* grab value again. */ -+ c>>=4; /* right shift 4 bits. */ -+ c&=15; /* make sure we only have 4 bits. */ -+ if(c>9) /* convert to ascii. */ -+ c+=('a'-10); -+ else -+ c+='0'; -+ *po=c; /* set the higher nibble. */ -+ } /* and keep going. */ -+ } -+ else -+ { for(pi=buf,po=buf;len>0;pi++,po++,len-=2) /* let's start from the beginning of the hex block. */ -+ { c=tolower(*pi++)-'0'; /* grab higher nibble. */ -+ if(c>9) /* convert to value. */ -+ c-=('0'-9); -+ *po=c<<4; /* left shit 4 bits. */ -+ c=tolower(*pi)-'0'; /* grab lower nibble. */ -+ if(c>9) /* convert to value. */ -+ c-=('0'-9); -+ *po|=c; /* and add to value. */ -+ } -+ } -+} -+ -+ -+/* TwoFish Encryption -+ * -+ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, -+ * this routine will alloc the memory. In addition, it will include a small 'header' -+ * containing the magic and some salt. That way the decrypt routine can check if the -+ * packet got decrypted successfully, and return 0 instead of garbage. -+ * -+ * Input: Pointer to the buffer of the plaintext to be encrypted. -+ * Pointer to the pointer to the buffer receiving the ciphertext. -+ * The pointer either points to user allocated output buffer space, or to NULL, in which case -+ * this routine will set the pointer to the buffer allocated through the struct. -+ * The length of the plaintext buffer. -+ * Can be -1 if the input is a null terminated string, in which case we'll count for you. -+ * Boolean flag for BinHex Output (if used, output will be twice as large as input). -+ * Note: BinHex conversion overwrites (converts) input buffer! -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes encrypted if successful, otherwise 0. -+ */ -+ -+unsigned long TwoFishEncrypt(char *in, -+ char **out, -+ signed long len, -+ bool binhex, -+ TWOFISH *tfdata) -+{ unsigned long ilen,olen; -+ -+ -+ if(len== -1) /* if we got -1 for len, we'll assume IN is a... */ -+ ilen=strlen(in); /* ...\0 terminated string and figure len out ourselves... */ -+ else -+ ilen=len; /* ...otherwise we trust you supply a correct length. */ -+ -+ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */ -+ { if(*out==NULL) /* if OUT points to a NULL pointer... */ -+ *out=TwoFishAlloc(ilen,binhex,FALSE,tfdata); /* ...we'll (re-)allocate buffer space. */ -+ if(*out!=NULL) -+ { tfdata->output=*out; /* set output buffer. */ -+ tfdata->header.salt=rand()*65536+rand(); /* toss in some salt. */ -+ tfdata->header.length[0]= (u_int8_t)(ilen); -+ tfdata->header.length[1]= (u_int8_t)(ilen>>8); -+ tfdata->header.length[2]= (u_int8_t)(ilen>>16); -+ tfdata->header.length[3]= (u_int8_t)(ilen>>24); -+ memcpy(tfdata->header.magic,TwoFish_MAGIC,TwoFish_MAGIC_LEN); /* set the magic. */ -+ olen=TwoFish_BLOCK_SIZE; /* set output counter. */ -+ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag */ -+ _TwoFish_BlockCrypt((u_int8_t *)&(tfdata->header),*out,olen,FALSE,tfdata); /* encrypt first block (without flush on 16 byte boundary). */ -+ olen+=_TwoFish_CryptRawCBC(in,*out+TwoFish_BLOCK_SIZE,ilen,FALSE,tfdata); /* and encrypt the rest (we do not reset the CBC flag). */ -+ if(binhex) /* if binhex... */ -+ { _TwoFish_BinHex(*out,olen,TRUE); /* ...convert output to binhex... */ -+ olen*=2; /* ...and size twice as large. */ -+ } -+ tfdata->output=*out; -+ return olen; -+ } -+ } -+ return 0; -+} -+ -+/* TwoFish Decryption -+ * -+ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, -+ * this routine will alloc the memory. In addition, it will check the small 'header' -+ * containing the magic. If magic does not match we return 0. Otherwise we return the -+ * amount of bytes decrypted (should be the same as the length in the header). -+ * -+ * Input: Pointer to the buffer of the ciphertext to be decrypted. -+ * Pointer to the pointer to the buffer receiving the plaintext. -+ * The pointer either points to user allocated output buffer space, or to NULL, in which case -+ * this routine will set the pointer to the buffer allocated through the struct. -+ * The length of the ciphertext buffer. -+ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you. -+ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input). -+ * Note: BinHex conversion overwrites (converts) input buffer! -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes decrypted if successful, otherwise 0. -+ */ -+ -+unsigned long TwoFishDecrypt(char *in, -+ char **out, -+ signed long len, -+ bool binhex, -+ TWOFISH *tfdata) -+{ unsigned long ilen,elen,olen; -+ const u_int8_t cmagic[TwoFish_MAGIC_LEN]=TwoFish_MAGIC; -+ u_int8_t *tbuf; -+ -+ -+ -+ if(len== -1) /* if we got -1 for len, we'll assume IN is... */ -+ ilen=strlen(in); /* ...\0 terminated binhex and figure len out ourselves... */ -+ else -+ ilen=len; /* ...otherwise we trust you supply a correct length. */ -+ -+ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */ -+ { if(*out==NULL) /* if OUT points to a NULL pointer... */ -+ *out=TwoFishAlloc(ilen,binhex,TRUE,tfdata); /* ...we'll (re-)allocate buffer space. */ -+ if(*out!=NULL) -+ { if(binhex) /* if binhex... */ -+ { _TwoFish_BinHex(in,ilen,FALSE); /* ...convert input to values... */ -+ ilen/=2; /* ...and size half as much. */ -+ } -+ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag. */ -+ -+ tbuf=(u_int8_t *)malloc(ilen+TwoFish_BLOCK_SIZE); /* get memory for data and header. */ -+ if(tbuf==NULL) -+ return 0; -+ tfdata->output=tbuf; /* set output to temp buffer. */ -+ -+ olen=_TwoFish_CryptRawCBC(in,tbuf,ilen,TRUE,tfdata)-TwoFish_BLOCK_SIZE; /* decrypt the whole thing. */ -+ memcpy(&(tfdata->header),tbuf,TwoFish_BLOCK_SIZE); /* copy first block into header. */ -+ tfdata->output=*out; -+ for(elen=0;elenheader.magic[elen]!=cmagic[elen]) -+ break; -+ if(elen==TwoFish_MAGIC_LEN) /* if magic matches then... */ -+ { elen=(tfdata->header.length[0]) | -+ (tfdata->header.length[1])<<8 | -+ (tfdata->header.length[2])<<16 | -+ (tfdata->header.length[3])<<24; /* .. we know how much to expect. */ -+ if(elen>olen) /* adjust if necessary. */ -+ elen=olen; -+ memcpy(*out,tbuf+TwoFish_BLOCK_SIZE,elen); /* copy data into intended output. */ -+ free(tbuf); -+ return elen; -+ } -+ free(tbuf); -+ } -+ } -+ return 0; -+} -+ -+void _TwoFish_PrecomputeMDSmatrix(void) /* precompute the TwoFish_MDS matrix */ -+{ u_int32_t m1[2]; -+ u_int32_t mX[2]; -+ u_int32_t mY[2]; -+ u_int32_t i, j; -+ -+ for (i = 0; i < 256; i++) -+ { j = TwoFish_P[0][i] & 0xFF; /* compute all the matrix elements */ -+ m1[0] = j; -+ mX[0] = TwoFish_Mx_X( j ) & 0xFF; -+ mY[0] = TwoFish_Mx_Y( j ) & 0xFF; -+ -+ j = TwoFish_P[1][i] & 0xFF; -+ m1[1] = j; -+ mX[1] = TwoFish_Mx_X( j ) & 0xFF; -+ mY[1] = TwoFish_Mx_Y( j ) & 0xFF; -+ -+ TwoFish_MDS[0][i] = m1[TwoFish_P_00] | /* fill matrix w/ above elements */ -+ mX[TwoFish_P_00] << 8 | -+ mY[TwoFish_P_00] << 16 | -+ mY[TwoFish_P_00] << 24; -+ TwoFish_MDS[1][i] = mY[TwoFish_P_10] | -+ mY[TwoFish_P_10] << 8 | -+ mX[TwoFish_P_10] << 16 | -+ m1[TwoFish_P_10] << 24; -+ TwoFish_MDS[2][i] = mX[TwoFish_P_20] | -+ mY[TwoFish_P_20] << 8 | -+ m1[TwoFish_P_20] << 16 | -+ mY[TwoFish_P_20] << 24; -+ TwoFish_MDS[3][i] = mX[TwoFish_P_30] | -+ m1[TwoFish_P_30] << 8 | -+ mY[TwoFish_P_30] << 16 | -+ mX[TwoFish_P_30] << 24; -+ } -+ TwoFish_MDSready=TRUE; -+} -+ -+ -+void _TwoFish_MakeSubKeys(TWOFISH *tfdata) /* Expand a user-supplied key material into a session key. */ -+{ u_int32_t k64Cnt = TwoFish_KEY_LENGTH / 8; -+ u_int32_t k32e[4]; /* even 32-bit entities */ -+ u_int32_t k32o[4]; /* odd 32-bit entities */ -+ u_int32_t sBoxKey[4]; -+ u_int32_t offset,i,j; -+ u_int32_t A, B, q=0; -+ u_int32_t k0,k1,k2,k3; -+ u_int32_t b0,b1,b2,b3; -+ -+ /* split user key material into even and odd 32-bit entities and */ -+ /* compute S-box keys using (12, 8) Reed-Solomon code over GF(256) */ -+ -+ -+ for (offset=0,i=0,j=k64Cnt-1;i<4 && offsetkey[offset++]; -+ k32e[i]|= tfdata->key[offset++]<<8; -+ k32e[i]|= tfdata->key[offset++]<<16; -+ k32e[i]|= tfdata->key[offset++]<<24; -+ k32o[i] = tfdata->key[offset++]; -+ k32o[i]|= tfdata->key[offset++]<<8; -+ k32o[i]|= tfdata->key[offset++]<<16; -+ k32o[i]|= tfdata->key[offset++]<<24; -+ sBoxKey[j] = _TwoFish_RS_MDS_Encode( k32e[i], k32o[i] ); /* reverse order */ -+ } -+ -+ /* compute the round decryption subkeys for PHT. these same subkeys */ -+ /* will be used in encryption but will be applied in reverse order. */ -+ i=0; -+ while(i < TwoFish_TOTAL_SUBKEYS) -+ { A = _TwoFish_F32( k64Cnt, q, k32e ); /* A uses even key entities */ -+ q += TwoFish_SK_BUMP; -+ -+ B = _TwoFish_F32( k64Cnt, q, k32o ); /* B uses odd key entities */ -+ q += TwoFish_SK_BUMP; -+ -+ B = B << 8 | B >> 24; -+ -+ A += B; -+ tfdata->subKeys[i++] = A; /* combine with a PHT */ -+ -+ A += B; -+ tfdata->subKeys[i++] = A << TwoFish_SK_ROTL | A >> (32-TwoFish_SK_ROTL); -+ } -+ -+ /* fully expand the table for speed */ -+ k0 = sBoxKey[0]; -+ k1 = sBoxKey[1]; -+ k2 = sBoxKey[2]; -+ k3 = sBoxKey[3]; -+ -+ for (i = 0; i < 256; i++) -+ { b0 = b1 = b2 = b3 = i; -+ switch (k64Cnt & 3) -+ { case 1: /* 64-bit keys */ -+ tfdata->sBox[ 2*i ] = TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0]) ^ TwoFish_b0(k0)]; -+ tfdata->sBox[ 2*i+1] = TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1]) ^ TwoFish_b1(k0)]; -+ tfdata->sBox[0x200+2*i ] = TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2]) ^ TwoFish_b2(k0)]; -+ tfdata->sBox[0x200+2*i+1] = TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3]) ^ TwoFish_b3(k0)]; -+ break; -+ case 0: /* 256-bit keys (same as 4) */ -+ b0 = (TwoFish_P[TwoFish_P_04][b0]) ^ TwoFish_b0(k3); -+ b1 = (TwoFish_P[TwoFish_P_14][b1]) ^ TwoFish_b1(k3); -+ b2 = (TwoFish_P[TwoFish_P_24][b2]) ^ TwoFish_b2(k3); -+ b3 = (TwoFish_P[TwoFish_P_34][b3]) ^ TwoFish_b3(k3); -+ case 3: /* 192-bit keys */ -+ b0 = (TwoFish_P[TwoFish_P_03][b0]) ^ TwoFish_b0(k2); -+ b1 = (TwoFish_P[TwoFish_P_13][b1]) ^ TwoFish_b1(k2); -+ b2 = (TwoFish_P[TwoFish_P_23][b2]) ^ TwoFish_b2(k2); -+ b3 = (TwoFish_P[TwoFish_P_33][b3]) ^ TwoFish_b3(k2); -+ case 2: /* 128-bit keys */ -+ tfdata->sBox[ 2*i ]= -+ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0]) ^ -+ TwoFish_b0(k1)]) ^ TwoFish_b0(k0)]; -+ -+ tfdata->sBox[ 2*i+1]= -+ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1]) ^ -+ TwoFish_b1(k1)]) ^ TwoFish_b1(k0)]; -+ -+ tfdata->sBox[0x200+2*i ]= -+ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2]) ^ -+ TwoFish_b2(k1)]) ^ TwoFish_b2(k0)]; -+ -+ tfdata->sBox[0x200+2*i+1]= -+ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3]) ^ -+ TwoFish_b3(k1)]) ^ TwoFish_b3(k0)]; -+ } -+ } -+} -+ -+ -+/** -+ * Encrypt or decrypt exactly one block of plaintext in CBC mode. -+ * Use "ciphertext stealing" technique described on pg. 196 -+ * of "Applied Cryptography" to encrypt the final partial -+ * (i.e. <16 byte) block if necessary. -+ * -+ * jojo: the "ciphertext stealing" requires we read ahead and have -+ * special handling for the last two blocks. Because of this, the -+ * output from the TwoFish algorithm is handled internally here. -+ * It would be better to have a higher level handle this as well as -+ * CBC mode. Unfortunately, I've mixed the two together, which is -+ * pretty crappy... The Java version separates these out correctly. -+ * -+ * fknobbe: I have reduced the CBC mode to work on memory buffer only. -+ * Higher routines should use an intermediate buffer and handle -+ * their output seperately (mainly so the data can be flushed -+ * in one chunk, not seperate 16 byte blocks...) -+ * -+ * @param in The plaintext. -+ * @param out The ciphertext -+ * @param size how much to encrypt -+ * @param tfdata: Pointer to the global data structure containing session keys. -+ * @return none -+ */ -+void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata) -+{ u_int8_t PnMinusOne[TwoFish_BLOCK_SIZE]; -+ u_int8_t CnMinusOne[TwoFish_BLOCK_SIZE]; -+ u_int8_t CBCplusCprime[TwoFish_BLOCK_SIZE]; -+ u_int8_t Pn[TwoFish_BLOCK_SIZE]; -+ u_int8_t *p,*pout; -+ unsigned long i; -+ -+ /* here is where we implement CBC mode and cipher block stealing */ -+ if(size==TwoFish_BLOCK_SIZE) -+ { /* if we are encrypting, CBC means we XOR the plain text block with the */ -+ /* previous cipher text block before encrypting */ -+ if(!decrypt && tfdata->qBlockDefined) -+ { for(p=in,i=0;iqBlockCrypt[i]; /* FK: I'm copying the xor'ed input into Pn... */ -+ } -+ else -+ memcpy(Pn,in,TwoFish_BLOCK_SIZE); /* FK: same here. we work of Pn all the time. */ -+ -+ /* TwoFish block level encryption or decryption */ -+ _TwoFish_BlockCrypt16(Pn,out,decrypt,tfdata); -+ -+ /* if we are decrypting, CBC means we XOR the result of the decryption */ -+ /* with the previous cipher text block to get the resulting plain text */ -+ if(decrypt && tfdata->qBlockDefined) -+ { for (p=out,i=0;iqBlockPlain[i]; -+ } -+ -+ /* save the input and output blocks, since CBC needs these for XOR */ -+ /* operations */ -+ _TwoFish_qBlockPush(Pn,out,tfdata); -+ } -+ else -+ { /* cipher block stealing, we are at Pn, */ -+ /* but since Cn-1 must now be replaced with CnC' */ -+ /* we pop it off, and recalculate Cn-1 */ -+ -+ if(decrypt) -+ { /* We are on an odd block, and had to do cipher block stealing, */ -+ /* so the PnMinusOne has to be derived differently. */ -+ -+ /* First we decrypt it into CBC and C' */ -+ _TwoFish_qBlockPop(CnMinusOne,PnMinusOne,tfdata); -+ _TwoFish_BlockCrypt16(CnMinusOne,CBCplusCprime,decrypt,tfdata); -+ -+ /* we then xor the first few bytes with the "in" bytes (Cn) */ -+ /* to recover Pn, which we put in out */ -+ for(p=in,pout=out,i=0;iprevCipher[i]; -+ -+ /* So at this point, out has PnMinusOne */ -+ _TwoFish_qBlockPush(CnMinusOne,PnMinusOne,tfdata); -+ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); -+ _TwoFish_FlushOutput(out,size,tfdata); -+ } -+ else -+ { _TwoFish_qBlockPop(PnMinusOne,CnMinusOne,tfdata); -+ memset(Pn,0,TwoFish_BLOCK_SIZE); -+ memcpy(Pn,in,size); -+ for(i=0;iqBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); -+ _TwoFish_FlushOutput(CnMinusOne,size,tfdata); /* old Cn-1 becomes new partial Cn */ -+ } -+ tfdata->qBlockDefined=FALSE; -+ } -+} -+ -+void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata) -+{ if(tfdata->qBlockDefined) -+ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); -+ memcpy(tfdata->prevCipher,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE); -+ memcpy(tfdata->qBlockPlain,p,TwoFish_BLOCK_SIZE); -+ memcpy(tfdata->qBlockCrypt,c,TwoFish_BLOCK_SIZE); -+ tfdata->qBlockDefined=TRUE; -+} -+ -+void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata) -+{ memcpy(p,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE ); -+ memcpy(c,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE ); -+ tfdata->qBlockDefined=FALSE; -+} -+ -+/* Reset's the CBC flag and zero's PrevCipher (through qBlockPlain) (important) */ -+void _TwoFish_ResetCBC(TWOFISH *tfdata) -+{ tfdata->qBlockDefined=FALSE; -+ memset(tfdata->qBlockPlain,0,TwoFish_BLOCK_SIZE); -+} -+ -+void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata) -+{ unsigned long i; -+ -+ for(i=0;idontflush;i++) -+ *tfdata->output++ = *b++; -+ tfdata->dontflush=FALSE; -+} -+ -+void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata) -+{ u_int32_t x0,x1,x2,x3; -+ u_int32_t k,t0,t1,R; -+ -+ -+ x0=*in++; -+ x0|=(*in++ << 8 ); -+ x0|=(*in++ << 16); -+ x0|=(*in++ << 24); -+ x1=*in++; -+ x1|=(*in++ << 8 ); -+ x1|=(*in++ << 16); -+ x1|=(*in++ << 24); -+ x2=*in++; -+ x2|=(*in++ << 8 ); -+ x2|=(*in++ << 16); -+ x2|=(*in++ << 24); -+ x3=*in++; -+ x3|=(*in++ << 8 ); -+ x3|=(*in++ << 16); -+ x3|=(*in++ << 24); -+ -+ if(decrypt) -+ { x0 ^= tfdata->subKeys[4]; /* swap input and output whitening keys when decrypting */ -+ x1 ^= tfdata->subKeys[5]; -+ x2 ^= tfdata->subKeys[6]; -+ x3 ^= tfdata->subKeys[7]; -+ -+ k = 7+(TwoFish_ROUNDS*2); -+ for (R = 0; R < TwoFish_ROUNDS; R += 2) -+ { t0 = _TwoFish_Fe320( tfdata->sBox, x0); -+ t1 = _TwoFish_Fe323( tfdata->sBox, x1); -+ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k--]; -+ x3 = x3 >> 1 | x3 << 31; -+ x2 = x2 << 1 | x2 >> 31; -+ x2 ^= t0 + t1 + tfdata->subKeys[k--]; -+ -+ t0 = _TwoFish_Fe320( tfdata->sBox, x2); -+ t1 = _TwoFish_Fe323( tfdata->sBox, x3); -+ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k--]; -+ x1 = x1 >> 1 | x1 << 31; -+ x0 = x0 << 1 | x0 >> 31; -+ x0 ^= t0 + t1 + tfdata->subKeys[k--]; -+ } -+ -+ x2 ^= tfdata->subKeys[0]; -+ x3 ^= tfdata->subKeys[1]; -+ x0 ^= tfdata->subKeys[2]; -+ x1 ^= tfdata->subKeys[3]; -+ } -+ else -+ { x0 ^= tfdata->subKeys[0]; -+ x1 ^= tfdata->subKeys[1]; -+ x2 ^= tfdata->subKeys[2]; -+ x3 ^= tfdata->subKeys[3]; -+ -+ k = 8; -+ for (R = 0; R < TwoFish_ROUNDS; R += 2) -+ { t0 = _TwoFish_Fe320( tfdata->sBox, x0); -+ t1 = _TwoFish_Fe323( tfdata->sBox, x1); -+ x2 ^= t0 + t1 + tfdata->subKeys[k++]; -+ x2 = x2 >> 1 | x2 << 31; -+ x3 = x3 << 1 | x3 >> 31; -+ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k++]; -+ -+ t0 = _TwoFish_Fe320( tfdata->sBox, x2); -+ t1 = _TwoFish_Fe323( tfdata->sBox, x3); -+ x0 ^= t0 + t1 + tfdata->subKeys[k++]; -+ x0 = x0 >> 1 | x0 << 31; -+ x1 = x1 << 1 | x1 >> 31; -+ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k++]; -+ } -+ -+ x2 ^= tfdata->subKeys[4]; -+ x3 ^= tfdata->subKeys[5]; -+ x0 ^= tfdata->subKeys[6]; -+ x1 ^= tfdata->subKeys[7]; -+ } -+ -+ *out++ = (u_int8_t)(x2 ); -+ *out++ = (u_int8_t)(x2 >> 8); -+ *out++ = (u_int8_t)(x2 >> 16); -+ *out++ = (u_int8_t)(x2 >> 24); -+ -+ *out++ = (u_int8_t)(x3 ); -+ *out++ = (u_int8_t)(x3 >> 8); -+ *out++ = (u_int8_t)(x3 >> 16); -+ *out++ = (u_int8_t)(x3 >> 24); -+ -+ *out++ = (u_int8_t)(x0 ); -+ *out++ = (u_int8_t)(x0 >> 8); -+ *out++ = (u_int8_t)(x0 >> 16); -+ *out++ = (u_int8_t)(x0 >> 24); -+ -+ *out++ = (u_int8_t)(x1 ); -+ *out++ = (u_int8_t)(x1 >> 8); -+ *out++ = (u_int8_t)(x1 >> 16); -+ *out++ = (u_int8_t)(x1 >> 24); -+} -+ -+/** -+ * Use (12, 8) Reed-Solomon code over GF(256) to produce a key S-box -+ * 32-bit entity from two key material 32-bit entities. -+ * -+ * @param k0 1st 32-bit entity. -+ * @param k1 2nd 32-bit entity. -+ * @return Remainder polynomial generated using RS code -+ */ -+u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1) -+{ u_int32_t i,r; -+ -+ for(r=k1,i=0;i<4;i++) /* shift 1 byte at a time */ -+ TwoFish_RS_rem(r); -+ r ^= k0; -+ for(i=0;i<4;i++) -+ TwoFish_RS_rem(r); -+ -+ return r; -+} -+ -+u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32) -+{ u_int8_t b0,b1,b2,b3; -+ u_int32_t k0,k1,k2,k3,result = 0; -+ -+ b0=TwoFish_b0(x); -+ b1=TwoFish_b1(x); -+ b2=TwoFish_b2(x); -+ b3=TwoFish_b3(x); -+ k0=k32[0]; -+ k1=k32[1]; -+ k2=k32[2]; -+ k3=k32[3]; -+ -+ switch (k64Cnt & 3) -+ { case 1: /* 64-bit keys */ -+ result = -+ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0] & 0xFF) ^ TwoFish_b0(k0)] ^ -+ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1] & 0xFF) ^ TwoFish_b1(k0)] ^ -+ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2] & 0xFF) ^ TwoFish_b2(k0)] ^ -+ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3] & 0xFF) ^ TwoFish_b3(k0)]; -+ break; -+ case 0: /* 256-bit keys (same as 4) */ -+ b0 = (TwoFish_P[TwoFish_P_04][b0] & 0xFF) ^ TwoFish_b0(k3); -+ b1 = (TwoFish_P[TwoFish_P_14][b1] & 0xFF) ^ TwoFish_b1(k3); -+ b2 = (TwoFish_P[TwoFish_P_24][b2] & 0xFF) ^ TwoFish_b2(k3); -+ b3 = (TwoFish_P[TwoFish_P_34][b3] & 0xFF) ^ TwoFish_b3(k3); -+ -+ case 3: /* 192-bit keys */ -+ b0 = (TwoFish_P[TwoFish_P_03][b0] & 0xFF) ^ TwoFish_b0(k2); -+ b1 = (TwoFish_P[TwoFish_P_13][b1] & 0xFF) ^ TwoFish_b1(k2); -+ b2 = (TwoFish_P[TwoFish_P_23][b2] & 0xFF) ^ TwoFish_b2(k2); -+ b3 = (TwoFish_P[TwoFish_P_33][b3] & 0xFF) ^ TwoFish_b3(k2); -+ case 2: /* 128-bit keys (optimize for this case) */ -+ result = -+ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0] & 0xFF) ^ TwoFish_b0(k1)] & 0xFF) ^ TwoFish_b0(k0)] ^ -+ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1] & 0xFF) ^ TwoFish_b1(k1)] & 0xFF) ^ TwoFish_b1(k0)] ^ -+ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2] & 0xFF) ^ TwoFish_b2(k1)] & 0xFF) ^ TwoFish_b2(k0)] ^ -+ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3] & 0xFF) ^ TwoFish_b3(k1)] & 0xFF) ^ TwoFish_b3(k0)]; -+ break; -+ } -+ return result; -+} -+ -+u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x) -+{ return lsBox[ TwoFish_b0(x)<<1 ]^ -+ lsBox[ ((TwoFish_b1(x)<<1)|1)]^ -+ lsBox[0x200+ (TwoFish_b2(x)<<1) ]^ -+ lsBox[0x200+((TwoFish_b3(x)<<1)|1)]; -+} -+ -+u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x) -+{ return lsBox[ (TwoFish_b3(x)<<1) ]^ -+ lsBox[ ((TwoFish_b0(x)<<1)|1)]^ -+ lsBox[0x200+ (TwoFish_b1(x)<<1) ]^ -+ lsBox[0x200+((TwoFish_b2(x)<<1)|1)]; -+} -+ -+u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R) -+{ return lsBox[ 2*TwoFish__b(x,R ) ]^ -+ lsBox[ 2*TwoFish__b(x,R+1)+1]^ -+ lsBox[0x200+2*TwoFish__b(x,R+2) ]^ -+ lsBox[0x200+2*TwoFish__b(x,R+3)+1]; -+} -+ -+ -+#endif - -Index: snort-2.8.6.1/src/twofish.h -=================================================================== ---- snort-2.8.6.1/src/twofish.h (Revision 0) -+++ snort-2.8.6.1/src/twofish.h (Revision 3) -@@ -0,0 +1,276 @@ -+/* $Id: twofish.h,v 2.1 2008/12/15 20:36:05 fknobbe Exp $ -+ * -+ * -+ * Copyright (C) 1997-2000 The Cryptix Foundation Limited. -+ * Copyright (C) 2000 Farm9. -+ * Copyright (C) 2001 Frank Knobbe. -+ * All rights reserved. -+ * -+ * For Cryptix code: -+ * Use, modification, copying and distribution of this software is subject -+ * the terms and conditions of the Cryptix General Licence. You should have -+ * received a copy of the Cryptix General Licence along with this library; -+ * if not, you can download a copy from http://www.cryptix.org/ . -+ * -+ * For Farm9: -+ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and -+ * ciphertext stealing technique, added AsciiTwofish class for easy encryption -+ * decryption of text strings -+ * -+ * Frank Knobbe : -+ * --- April 2001, converted from C++ to C, prefixed global variables -+ * with TwoFish, substituted some defines, changed functions to make use of -+ * variables supplied in a struct, modified and added routines for modular calls. -+ * Cleaned up the code so that defines are used instead of fixed 16's and 32's. -+ * Created two general purpose crypt routines for one block and multiple block -+ * encryption using Joh's CBC code. -+ * Added crypt routines that use a header (with a magic and data length). -+ * (Basically a major rewrite). -+ * -+ * Note: Routines labeled _TwoFish are private and should not be used -+ * (or with extreme caution). -+ * -+ */ -+ -+#ifndef __TWOFISH_LIBRARY_HEADER__ -+#define __TWOFISH_LIBRARY_HEADER__ -+ -+#ifndef FALSE -+#define FALSE 0 -+#endif -+#ifndef TRUE -+#define TRUE !FALSE -+#endif -+#ifndef bool -+#define bool int -+#endif -+ -+ -+/* Constants */ -+ -+#define TwoFish_DEFAULT_PW "SnortHas2FishEncryptionRoutines!" /* default password (not more than 32 chars) */ -+#define TwoFish_MAGIC "TwoFish" /* to indentify a successful decryption */ -+ -+enum -+{ TwoFish_KEY_SIZE = 256, /* Valid values: 64, 128, 192, 256 */ -+ /* User 256, other key sizes have not been tested. */ -+ /* (But should work. I substituted as much as */ -+ /* I could with this define.) */ -+ TwoFish_ROUNDS = 16, -+ TwoFish_BLOCK_SIZE = 16, /* bytes in a data-block */ -+ TwoFish_KEY_LENGTH = TwoFish_KEY_SIZE/8, /* 32= 256-bit key */ -+ TwoFish_TOTAL_SUBKEYS = 4+4+2*TwoFish_ROUNDS, -+ TwoFish_MAGIC_LEN = TwoFish_BLOCK_SIZE-8, -+ TwoFish_SK_BUMP = 0x01010101, -+ TwoFish_SK_ROTL = 9, -+ TwoFish_P_00 = 1, -+ TwoFish_P_01 = 0, -+ TwoFish_P_02 = 0, -+ TwoFish_P_03 = TwoFish_P_01 ^ 1, -+ TwoFish_P_04 = 1, -+ TwoFish_P_10 = 0, -+ TwoFish_P_11 = 0, -+ TwoFish_P_12 = 1, -+ TwoFish_P_13 = TwoFish_P_11 ^ 1, -+ TwoFish_P_14 = 0, -+ TwoFish_P_20 = 1, -+ TwoFish_P_21 = 1, -+ TwoFish_P_22 = 0, -+ TwoFish_P_23 = TwoFish_P_21 ^ 1, -+ TwoFish_P_24 = 0, -+ TwoFish_P_30 = 0, -+ TwoFish_P_31 = 1, -+ TwoFish_P_32 = 1, -+ TwoFish_P_33 = TwoFish_P_31 ^ 1, -+ TwoFish_P_34 = 1, -+ TwoFish_GF256_FDBK = 0x169, -+ TwoFish_GF256_FDBK_2 = 0x169 / 2, -+ TwoFish_GF256_FDBK_4 = 0x169 / 4, -+ TwoFish_RS_GF_FDBK = 0x14D, /* field generator */ -+ TwoFish_MDS_GF_FDBK = 0x169 /* primitive polynomial for GF(256) */ -+}; -+ -+ -+/* Global data structure for callers */ -+ -+typedef struct -+{ u_int32_t sBox[4 * 256]; /* Key dependent S-box */ -+ u_int32_t subKeys[TwoFish_TOTAL_SUBKEYS]; /* Subkeys */ -+ u_int8_t key[TwoFish_KEY_LENGTH]; /* Encryption Key */ -+ u_int8_t *output; /* Pointer to output buffer */ -+ u_int8_t qBlockPlain[TwoFish_BLOCK_SIZE]; /* Used by CBC */ -+ u_int8_t qBlockCrypt[TwoFish_BLOCK_SIZE]; -+ u_int8_t prevCipher[TwoFish_BLOCK_SIZE]; -+ struct /* Header for crypt functions. Has to be at least one block long. */ -+ { u_int32_t salt; /* Random salt in first block (will salt the rest through CBC) */ -+ u_int8_t length[4]; /* The amount of data following the header */ -+ u_int8_t magic[TwoFish_MAGIC_LEN]; /* Magic to identify successful decryption */ -+ } header; -+ bool qBlockDefined; -+ bool dontflush; -+} TWOFISH; -+ -+#ifndef __TWOFISH_LIBRARY_SOURCE__ -+ -+extern bool TwoFish_srand; /* if set to TRUE (default), first call of TwoFishInit will seed rand(); */ -+ /* call of TwoFishInit */ -+#endif -+ -+ -+/**** Public Functions ****/ -+ -+/* TwoFish Initialization -+ * -+ * This routine generates a global data structure for use with TwoFish, -+ * initializes important values (such as subkeys, sBoxes), generates subkeys -+ * and precomputes the MDS matrix if not already done. -+ * -+ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!') -+ * -+ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data. -+ * This pointer is used with all other crypt functions. -+ */ -+TWOFISH *TwoFishInit(char *userkey); -+ -+ -+/* TwoFish Destroy -+ * -+ * Nothing else but a free... -+ * -+ * Input: Pointer to the TwoFish structure. -+ * -+ */ -+void TwoFishDestroy(TWOFISH *tfdata); -+ -+ -+/* TwoFish Alloc -+ * -+ * Allocates enough memory for the output buffer as required. -+ * -+ * Input: Length of the plaintext. -+ * Boolean flag for BinHex Output. -+ * Pointer to the TwoFish structure. -+ * -+ * Output: Returns a pointer to the memory allocated. -+ */ -+void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata); -+ -+ -+/* TwoFish Free -+ * -+ * Free's the allocated buffer. -+ * -+ * Input: Pointer to the TwoFish structure -+ * -+ * Output: (none) -+ */ -+void TwoFishFree(TWOFISH *tfdata); -+ -+ -+/* TwoFish Set Output -+ * -+ * If you want to allocate the output buffer yourself, -+ * then you can set it with this function. -+ * -+ * Input: Pointer to your output buffer -+ * Pointer to the TwoFish structure -+ * -+ * Output: (none) -+ */ -+void TwoFishSetOutput(char *outp,TWOFISH *tfdata); -+ -+ -+/* TwoFish Raw Encryption -+ * -+ * Does not use header, but does use CBC (if more than one block has to be encrypted). -+ * -+ * Input: Pointer to the buffer of the plaintext to be encrypted. -+ * Pointer to the buffer receiving the ciphertext. -+ * The length of the plaintext buffer. -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes encrypted if successful, otherwise 0. -+ */ -+unsigned long TwoFishEncryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata); -+ -+/* TwoFish Raw Decryption -+ * -+ * Does not use header, but does use CBC (if more than one block has to be decrypted). -+ * -+ * Input: Pointer to the buffer of the ciphertext to be decrypted. -+ * Pointer to the buffer receiving the plaintext. -+ * The length of the ciphertext buffer (at least one cipher block). -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes decrypted if successful, otherwise 0. -+ */ -+unsigned long TwoFishDecryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata); -+ -+ -+/* TwoFish Encryption -+ * -+ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, -+ * this routine will alloc the memory. In addition, it will include a small 'header' -+ * containing the magic and some salt. That way the decrypt routine can check if the -+ * packet got decrypted successfully, and return 0 instead of garbage. -+ * -+ * Input: Pointer to the buffer of the plaintext to be encrypted. -+ * Pointer to the pointer to the buffer receiving the ciphertext. -+ * The pointer either points to user allocated output buffer space, or to NULL, in which case -+ * this routine will set the pointer to the buffer allocated through the struct. -+ * The length of the plaintext buffer. -+ * Can be -1 if the input is a null terminated string, in which case we'll count for you. -+ * Boolean flag for BinHex Output (if used, output will be twice as large as input). -+ * Note: BinHex conversion overwrites (converts) input buffer! -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes encrypted if successful, otherwise 0. -+ */ -+unsigned long TwoFishEncrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata); -+ -+ -+/* TwoFish Decryption -+ * -+ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, -+ * this routine will alloc the memory. In addition, it will check the small 'header' -+ * containing the magic. If magic does not match we return 0. Otherwise we return the -+ * amount of bytes decrypted (should be the same as the length in the header). -+ * -+ * Input: Pointer to the buffer of the ciphertext to be decrypted. -+ * Pointer to the pointer to the buffer receiving the plaintext. -+ * The pointer either points to user allocated output buffer space, or to NULL, in which case -+ * this routine will set the pointer to the buffer allocated through the struct. -+ * The length of the ciphertext buffer. -+ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you. -+ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input). -+ * Note: BinHex conversion overwrites (converts) input buffer! -+ * The TwoFish structure. -+ * -+ * Output: The amount of bytes decrypted if successful, otherwise 0. -+ */ -+unsigned long TwoFishDecrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata); -+ -+ -+/**** Private Functions ****/ -+ -+u_int8_t TwoFish__b(u_int32_t x,int n); -+void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex); -+unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); -+unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); -+unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); -+void _TwoFish_PrecomputeMDSmatrix(void); -+void _TwoFish_MakeSubKeys(TWOFISH *tfdata); -+void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata); -+void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata); -+void _TwoFish_ResetCBC(TWOFISH *tfdata); -+void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata); -+void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata); -+void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata); -+u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1); -+u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32); -+u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x); -+u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x); -+u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R); -+ -+ -+#endif - -Index: snort-2.8.6.1/src/plugin_enum.h -=================================================================== ---- snort-2.8.6.1/src/plugin_enum.h (Revision 1) -+++ snort-2.8.6.1/src/plugin_enum.h (Revision 3) -@@ -60,6 +60,7 @@ - PLUGIN_URILEN_CHECK, - PLUGIN_DYNAMIC, - PLUGIN_FLOWBIT, -+ PLUGIN_FWSAM, - PLUGIN_MAX /* sentinel value */ - }; - -Index: snort-2.8.6.1/src/fatal.h -=================================================================== ---- snort-2.8.6.1/src/fatal.h (Revision 0) -+++ snort-2.8.6.1/src/fatal.h (Revision 3) -@@ -0,0 +1,40 @@ -+/* $Id$ */ -+/* -+** Copyright (C) 2002-2008 Sourcefire, Inc. -+** Copyright (C) 1998-2002 Martin Roesch -+** -+** This program is free software; you can redistribute it and/or modify -+** it under the terms of the GNU General Public License Version 2 as -+** published by the Free Software Foundation. You may not use, modify or -+** distribute this program under any other version of the GNU General -+** Public License. -+** -+** This program is distributed in the hope that it will be useful, -+** but WITHOUT ANY WARRANTY; without even the implied warranty of -+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+** GNU General Public License for more details. -+** -+** You should have received a copy of the GNU General Public License -+** along with this program; if not, write to the Free Software -+** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+*/ -+ -+#ifndef __FATAL_H__ -+#define __FATAL_H__ -+ -+ -+/* -+ * in debugging mode print out the filename and the line number where the -+ * failure have occured -+ */ -+ -+ -+#ifdef DEBUG -+ #define FATAL(msg) { printf("%s:%d: ", __FILE__, __LINE__); FatalError( (char *) msg); } -+#else -+ #define FATAL(msg) FatalError( (char *) msg) -+#endif -+ -+ -+ -+#endif /* __FATAL_H__ */ - -Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c -=================================================================== ---- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 0) -+++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 3) -@@ -0,0 +1,1380 @@ -+/* $id: snortpatchb,v 1.2 2002/10/26 03:32:35 fknobbe Exp $ -+** -+** spo_alert_fwsam.c -+** -+** Copyright (c) 2001-2004 Frank Knobbe -+** -+** This program is free software; you can redistribute it and/or modify -+** it under the terms of the GNU General Public License as published by -+** the Free Software Foundation; either version 2 of the License, or -+** (at your option) any later version. -+** -+** This program is distributed in the hope that it will be useful, -+** but WITHOUT ANY WARRANTY; without even the implied warranty of -+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+** GNU General Public License for more details. -+** -+** You should have received a copy of the GNU General Public License -+** along with this program; if not, write to the Free Software -+** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+*/ -+ -+/* -+ * Purpose: -+ * -+ * This module sends alerts to a remote service on a host running SnortSam -+ * (the agent) which will block the intruding IP address on a variety of -+ * host and network firewalls. -+ * -+ * SnortSam also performs checks against a white-list of never-to-be-blocked IP addresses, -+ * can override block durations (for example for known proxies), and can detect attack conditions -+ * where too many blocks are received within a defined interval. If an attack is detected -+ * it will unblock the last x blocks and wait for the attack to end. -+ * -+ * See the SnortSam documentation for more information. -+ * -+ * -+ * Output Plugin Parameters: -+ *************************** -+ * -+ * output alert_fwsam: :/ -+ * -+ * : The IP address or host name of the host running SnortSam. -+ * : The port the remote SnortSam service listens on (default 898). -+ * : The key used for authentication (encryption really) -+ * of the communication to the remote service. -+ * -+ * Examples: -+ * -+ * output alert_fwsam: snortsambox/idspassword -+ * output alert_fwsam: fw1.domain.tld:898/mykey -+ * output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw -+ * -+ * -+ * Rule Options: -+ *************** -+ * -+ * fwsam: who[how],time; -+ * -+ * who: src, source, dst, dest, destination -+ * IP address to be blocked according to snort rule (some rules -+ * are reversed, i.e. homenet -> any [and you want to block any]). -+ * src denotes IP to the left of -> and dst denotes IP to the right -+ * -+ * how: Optional. In, out, src, dest, either, both, this, conn, connection -+ * Tells FW-1 to block packets INcoming from host, OUTgoing to host, -+ * EITHERway, or only THIS connection (IP/Service pair). -+ * See 'fw sam' for more information. May be ignored by other plugins. -+ * -+ * time: Duration of block in seconds. (Accepts 'days', 'months', 'weeks', -+ * 'years', 'minutes', 'seconds', 'hours'. Alternatively, a value of -+ * 0, or the keyword PERManent, INFinite, or ALWAYS, will block the -+ * host permanently. Be careful with this! -+ * Tells FW-1 (and others) how long to inhibit packets from the host. -+ * -+ * Examples: -+ * -+ * fwsam: src[either],15min; -+ * or dst[in], 2 days 4 hours -+ * or src, 1 hour -+ * -+ * (default: src[either],5min) -+ * -+ * -+ * Effect: -+ * -+ * Alerts are sent to the remote SnortSam services on Firewall-1 Management Stations -+ * or other hosts running SnortSam (as required for Cisco Routers and PIX). -+ * The remote services will invoke the SAM configuration via the fw sam -+ * command line, or by sending a packet to the SAM port 18183, or by using the official -+ * OPSEC API calls, or by telnetting into Cisco routers or PIX firewalls. -+ * The communication over the network is encrypted using two-fish. -+ * (Implementation ripped from CryptCat by Farm9 with permission.) -+ * -+ * Future Plans: -+ * -+ * - Custom alert trigger per rule (x alerts in y secs) --> Seems to exist in Snort 1.9 now. -+ * - Enable/Allow tagged fwsam: arguments to provide different values to -+ * different stations. --> Seems to be accomplished with custom rule-types -+ * -+ * -+ * Comments: -+ * -+ * It seem that above wishes can be implemented with todays setup. Feedback concerning -+ * these is greatly appreciated. -+ * -+*/ -+ -+ -+#include "spo_alert_fwsam.h" -+#include "twofish.h" -+/* external globals from rules.c */ -+extern char *file_name; -+extern int file_line; -+extern OptTreeNode *otn_tmp; -+extern char *snort_conf_dir; /* extern PV pv; */ -+ -+ -+/* my globals */ -+ -+FWsamList *FWsamStationList=NULL; /* Global (for all alert-types) list of snortsam stations */ -+FWsamOptions *FWsamOptionField=NULL; -+unsigned long FWsamMaxOptions=0; -+ -+ -+/* -+ * Function: AlertFWsamSetup() -+ * -+ * Purpose: Registers the output plugin keyword and initialization -+ * function into the output plugin list. This is the function that -+ * gets called from InitOutputPlugins() in plugbase.c. -+ * It also registers itself as a plugin in order to parse every rule -+ * and to set the appropiate flags from fwsam: option. -+ * -+ * Arguments: None. -+ * -+ * Returns: void function -+ * -+*/ -+void AlertFWsamSetup(void) -+{ -+ /* link the preprocessor keyword to the init function in -+ the preproc list */ -+ RegisterOutputPlugin("alert_fwsam", OUTPUT_TYPE_FLAG__ALERT, AlertFWsamInit); -+ RegisterRuleOption("fwsam", AlertFWsamOptionInit, NULL, OPT_TYPE_ACTION, NULL); -+ -+#ifdef FWSAMDEBUG /* This allows debugging of fwsam only */ -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Output plugin is plugged in...\n"); -+#endif -+} -+ -+ -+/* This function checks if a given snortsam station is already in -+ * a given list. -+*/ -+int FWsamStationExists(FWsamStation *who,FWsamList *list) -+{ -+ while(list) -+ { -+ if(list->station) { -+// if( who->stationip.s_addr==list->station->stationip.s_addr && -+ if(IP_EQUALITY(&who->stationip, &list->station->stationip) && -+ who->stationport==list->station->stationport) -+ return TRUE; -+ } -+ list=list->next; -+ } -+ return FALSE; -+} -+ -+/* -+ * Function: AlertFWsamInit(char *args) -+ * -+ * Purpose: Calls the argument parsing function, performs final setup on data -+ * structs, links the preproc function into the function list. -+ * -+ * Arguments: args => ptr to argument string -+ * -+ * Returns: void function -+ * -+*/ -+void AlertFWsamInit(char *args) -+{ char *ap; -+ unsigned long statip,cnt,again,i; -+ char *stathost,*statport,*statpass; -+ FWsamStation *station; -+ FWsamList *fwsamlist=NULL; /* alert-type dependent list of snortsam stations */ -+ FWsamList *listp,*newlistp; -+ struct hostent *hoste; -+ char buf[1024]=""; -+ FILE *fp; -+ FWsamOptions tempopt; -+ -+#ifdef FWSAMDEBUG -+ unsigned long hostcnt=0; -+ -+ -+ -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Output plugin initializing...\n"); -+#endif -+ -+ /* pv.alert_plugin_active = 1; */ -+ -+ /* parse the argument list from the rules file */ -+ -+ if(args == NULL) -+ FatalError("ERROR %s (%d) => [Alert_FWsam](AlertFWsamInit) No arguments to alert_fwsam preprocessor!\n", file_name, file_line); -+ -+ if(!FWsamOptionField && !FWsamMaxOptions) -+ { strncpy(buf,snort_conf_dir,sizeof(buf)-1); -+ strncpy(buf+strlen(buf),SID_MAPFILE,sizeof(buf)-strlen(buf)-1); -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Using file: %s\n",buf); -+#endif -+ fp=fopen(buf,"rt"); -+ if(!fp) -+ { strncpy(buf,snort_conf_dir,sizeof(buf)-1); -+ strncpy(buf+strlen(buf),SID_ALT_MAPFILE,sizeof(buf)-strlen(buf)-1); -+ fp=fopen(buf,"rt"); -+ } -+ if(fp) /* Check for presence of map file and read those in, sorted. */ -+ { LogMessage("INFO => [Alert_FWsam](AlertFWsamSetup) Using sid-map file: %s\n",buf); -+ -+ while(FWsamReadLine(buf,sizeof(buf),fp)) -+ if(*buf) -+ FWsamMaxOptions++; -+ if(FWsamMaxOptions) -+ { if((FWsamOptionField=(FWsamOptions *)malloc(sizeof(FWsamOptions)*FWsamMaxOptions))==NULL) -+ FatalError("ERROR => [Alert_FWsam](AlertFWsamSetup) malloc failed for OptionField!\n"); -+ fseek(fp,0,SEEK_SET); -+ for(cnt=0;cnt1) -+ { for(again=TRUE,cnt=FWsamMaxOptions-1;cnt>=1 && again;cnt--) -+ { for(again=FALSE,i=0;iFWsamOptionField[i+1].sid) -+ { memcpy(&tempopt,&(FWsamOptionField[i]),sizeof(FWsamOptions)); -+ memcpy(&(FWsamOptionField[i]),&(FWsamOptionField[i+1]),sizeof(FWsamOptions)); -+ memcpy(&(FWsamOptionField[i+1]),&tempopt,sizeof(FWsamOptions)); -+ again=TRUE; -+ } -+ } -+ } -+ } -+ } -+ else -+ FWsamMaxOptions=1; -+ fclose(fp); -+ } -+ else -+ FWsamMaxOptions=1; -+ } -+ -+ -+ ap=args; /* start at the beginning of the argument */ -+ while(*ap && isspace(*ap)) ap++; -+ while(*ap) -+ { stathost=ap; /* first argument should be host */ -+ statport=NULL; -+ statpass=NULL; -+ while(*ap && *ap!=':' && *ap!='/' && !isspace(*ap)) ap++; /* find token */ -+ switch(*ap) -+ { case ':': *ap++=0; /* grab the port */ -+ statport=ap; -+ while(*ap && *ap!='/' && !isspace(*ap)) ap++; -+ if(*ap!='/') -+ break; -+ case '/': *ap++=0; /* grab the key */ -+ statpass=ap; -+ while(*ap && !isspace(*ap)) ap++; -+ default: break; -+ } -+ if(*ap) -+ { *ap++=0; -+ while(isspace(*ap)) ap++; -+ } -+ /* now we have the first host with port and password (key) */ -+ /* next we check for valid/blank password/port */ -+ if(statpass!=NULL) -+ if(!*statpass) -+ statpass=NULL; -+ if(statport!=NULL) -+ if(!*statport) -+ statport=NULL; -+ statip=0; -+ /* now we check if a valid host was specified */ -+ if(inet_addr(stathost)==INADDR_NONE) -+ { hoste=gethostbyname(stathost); -+ if (!hoste) -+ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Unable to resolve host '%s'!\n",file_name,file_line,stathost); -+ else -+ statip=*(unsigned long *)hoste->h_addr; -+ } -+ else -+ { statip=inet_addr(stathost); -+ if(!statip) -+ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Invalid host address '%s'!\n",file_name,file_line,stathost); -+ } -+ if(statip) -+ { /* groovie, a valid host. Let's alloc and assemble the structure for it. */ -+ if((station=(FWsamStation *)malloc(sizeof(FWsamStation)))==NULL) -+ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for station!\n"); -+ -+// station->stationip.s_addr=statip; /* the IP address */ -+ station->stationip.ip32[0] = statip; /* the IP address */ -+ if(statport!=NULL && atoi(statport)>0) /* if the user specified one */ -+ station->stationport=atoi(statport); /* use users setting */ -+ else -+ station->stationport=FWSAM_DEFAULTPORT; /* set the default port */ -+ -+ if(statpass!=NULL) /* if specified by user */ -+ strncpy(station->stationkey,statpass,TwoFish_KEY_LENGTH); /* use defined key */ -+ else -+ station->stationkey[0]=0; -+ station->stationkey[TwoFish_KEY_LENGTH]=0; /* make sure it's terminated. (damn strncpy...) */ -+ -+ strcpy(station->initialkey,station->stationkey); -+ station->stationfish=TwoFishInit(station->stationkey); -+ -+ station->localsocketaddr.sin_port=htons(0); /* let's use dynamic ports for now */ -+ station->localsocketaddr.sin_addr.s_addr=0; -+ station->localsocketaddr.sin_family=AF_INET; -+ station->stationsocketaddr.sin_port=htons(station->stationport); -+ //station->stationsocketaddr.sin_addr=station->stationip; -+ station->stationsocketaddr.sin_addr.s_addr=station->stationip.ip32[0]; -+ station->stationsocketaddr.sin_family=AF_INET; /* load all socket crap and keep for later */ -+ -+ do -+ station->myseqno=rand(); /* the seqno this host will use */ -+ while(station->myseqno<20 || station->myseqno>65500); -+ station->mykeymod[0]=rand(); -+ station->mykeymod[1]=rand(); -+ station->mykeymod[2]=rand(); -+ station->mykeymod[3]=rand(); -+ station->stationseqno=0; /* peer hasn't answered yet. */ -+ -+ -+ if(!FWsamStationExists(station,FWsamStationList)) /* If we don't have the station already in global list....*/ -+ { if(FWsamCheckIn(station)) /* ...and we can talk to the agent... */ -+ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL) -+ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for global newlistp!\n"); -+ newlistp->station=station; -+ newlistp->next=NULL; -+ -+ if(!FWsamStationList) /* ... add it to the global list/ */ -+ FWsamStationList=newlistp; -+ else -+ { listp=FWsamStationList; -+ while(listp->next) -+ listp=listp->next; -+ listp->next=newlistp; -+ } -+ } -+ else -+ { TwoFishDestroy(station->stationfish); /* if not, we trash it. */ -+ free(station); -+ station=NULL; -+ } -+ } -+#ifdef FWSAMDEBUG -+ else -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in global list, skipping CheckIn.\n", sfip_ntoa(&station->stationip),station->stationport); -+#endif -+ -+ if(station) -+ { if(!FWsamStationExists(station,fwsamlist)) /* If we don't have the station already in local list....*/ -+ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL) -+ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for local newlistp!\n"); -+ newlistp->station=station; -+ newlistp->next=NULL; -+ -+ if(!fwsamlist) /* ... add it to the local list/ */ -+ fwsamlist=newlistp; -+ else -+ { listp=fwsamlist; -+ while(listp->next) -+ listp=listp->next; -+ listp->next=newlistp; -+ } -+ } -+ -+#ifdef FWSAMDEBUG -+ else -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in local list, skipping.\n",sfip_ntoa(&station->stationip),station->stationport); -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) #%i: Host %s [%s] port %i password %s\n",++hostcnt,stathost,sfip_ntoa(&station->stationip),station->stationport,station->stationkey); -+#endif -+ } -+ -+ } -+ } /* next one */ -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Linking fwsam alert function to call list...\n"); -+#endif -+ -+ /* Set the preprocessor function into the function list */ -+ AddFuncToOutputList(AlertFWsam, OUTPUT_TYPE_FLAG__ALERT, fwsamlist); -+ AddFuncToCleanExitList(AlertFWsamCleanExitFunc, fwsamlist); -+ AddFuncToRestartList(AlertFWsamRestartFunc, fwsamlist); -+} -+ -+ -+/* This routine reads in a str from a file, snips white-spaces -+ * off the front and back, removes comments, and pretties the -+ * string. Returns true or false if a line was read or not. -+*/ -+int FWsamReadLine(char *buf,unsigned long bufsize,FILE *fp) -+{ char *p; -+ -+ if(fgets(buf,bufsize-1,fp)) -+ { buf[bufsize-1]=0; -+ -+#ifdef FWSAMDEBUG_off -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamReadLine) Line: %s\n",buf); -+#endif -+ -+ p=buf; -+ while(isspace(*p)) -+ p++; -+ if(p>buf); -+ strcpy(buf,p); -+ if(*buf) -+ { p=buf+strlen(buf)-1; /* remove leading and trailing spaces */ -+ while(isspace(*p)) -+ *p-- =0; -+ } -+ p=buf; -+ if(*p=='#' || *p==';') -+ *p=0; -+ else -+ p++; -+ while(*p) /* remove inline comments (except escaped #'s and ;'s) */ -+ { if(*p=='#' || *p==';') -+ { if(*(p-1)=='\\') -+ strcpy(p-1,p); -+ else -+ *p=0; -+ } -+ else -+ p++; -+ } -+ return TRUE; -+ } -+ return FALSE; -+} -+ -+ -+/* Parses the duration of the argument, recognizing minutes, hours, etc.. -+*/ -+unsigned long FWsamParseDuration(char *p) -+{ unsigned long dur=0,tdu; -+ char *tok,c1,c2; -+ -+ while(*p) -+ { tok=p; -+ while(*p && isdigit(*p)) -+ p++; -+ if(*p) -+ { c1=tolower(*p); -+ *p=0; -+ p++; -+ if(*p && !isdigit(*p)) -+ { c2=tolower(*p++); -+ while(*p && !isdigit(*p)) -+ p++; -+ } -+ else -+ c2=0; -+ tdu=atol(tok); -+ switch(c1) -+ { case 'm': if(c2=='o') /* month */ -+ tdu*=(60*60*24*30); /* use 30 days */ -+ else -+ tdu*=60; /* minutes */ -+ case 's': break; /* seconds */ -+ case 'h': tdu*=(60*60); /* hours */ -+ break; -+ case 'd': tdu*=(60*60*24); /* days */ -+ break; -+ case 'w': tdu*=(60*60*24*7); /* week */ -+ break; -+ case 'y': tdu*=(60*60*24*365); /* year */ -+ break; -+ } -+ dur+=tdu; -+ } -+ else -+ dur+=atol(tok); -+ } -+ -+ return dur; -+} -+ -+ -+/* This routine parses an option line. It is called by FWsamParseLine, -+ * which parses the sid-block.map file, and also by AlertFWsamOptionInit, -+ * which is called by Snort when processing fwsam: options in rules. -+ * It returns TRUE it there is a possible option problem, otherwise FALSE. -+*/ -+int FWsamParseOption(FWsamOptions *optp,char *ap) -+{ int possprob=FALSE; -+ -+ /* set defaults */ -+ -+ optp->duration=300; /* default of 5 minute block */ -+ optp->how=FWSAM_HOW_INOUT; /* inbound and outbound block */ -+ optp->who=FWSAM_WHO_SRC; /* the source */ -+ optp->loglevel=FWSAM_LOG_LONGALERT; /* the log level default */ -+ /* parse the fwsam keywords */ -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) Parse Options Args: %s\n",ap); -+#endif -+ -+ if(*ap) /* should be dst/src (the WHO) or duration */ -+ { if(isdigit(*ap)) -+ optp->duration=FWsamParseDuration(ap); -+ else -+ { switch(*ap) /* yeah, we're lazy and check only the first character */ -+ { case 'p': ; /* permanent, perm */ -+ case 'f': ; /* forever */ -+ case 'i': optp->duration=0; /* infinite, inf */ -+ break; -+ case 'd': optp->who=FWSAM_WHO_DST; /* destination, dest, dst */ -+ break; -+ case 's': optp->who=FWSAM_WHO_SRC; /* source, src */ -+ break; -+ default: possprob=TRUE; -+ } -+ while(*ap && *ap!=',' && *ap!='[') -+ ap++; -+ if(*ap=='[') -+ { ap++; /* now we have the HOW */ -+ switch(*ap) -+ { case 'i': ; /* in */ -+ case 's': optp->how=FWSAM_HOW_IN; /* source, src */ -+ break; -+ case 'o': ; /* out */ -+ case 'd': optp->how=FWSAM_HOW_OUT; /* destination, dest, dst */ -+ break; -+ case 'b': ; /* both */ -+ case 'e': optp->how=FWSAM_HOW_INOUT; /* either */ -+ break; -+ case 't': ; /* this */ -+ case 'c': optp->how=FWSAM_HOW_THIS; /* connection, conn */ -+ break; -+ default: possprob=TRUE; -+ } -+ while(*ap && *ap!=',') -+ ap++; -+ } -+ if(*ap==',') -+ { ap++; -+ if(isdigit(*ap)) /* and figure out how long to block */ -+ optp->duration=FWsamParseDuration(ap); -+ else if(*ap=='p' || *ap=='f' || *ap=='i') -+ optp->duration=0; -+ else -+ possprob=TRUE; -+ } -+ else if(!*ap) -+ possprob=TRUE; -+ } -+ } -+ else -+ possprob=TRUE; -+ -+ return possprob; -+} -+ -+ -+/* This goes through the lines of sid-block.map and sets the -+ * options for fwsam if the file is being used. -+*/ -+void FWsamParseLine(FWsamOptions *optp,char *buf) -+{ char *ap; -+ -+ ap=buf; /* start at the beginning of the argument */ -+ -+ while(*ap) -+ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */ -+ *ap=' '; -+ if(isupper(*ap)) /* and set to lower case */ -+ *ap=tolower(*ap); -+ ap++; -+ } -+ while((ap=strrchr(buf,' '))!=NULL) /* remove spaces */ -+ strcpy(ap,ap+1); -+ -+ ap=buf; -+ if(*ap) -+ { while(*ap && *ap!=':' && *ap!='|') -+ ap++; -+ *ap++ =0; -+ while(*ap && (*ap==':' || *ap=='|')) -+ ap++; -+ -+ optp->sid=(unsigned long)atol(buf); -+ -+ if(FWsamParseOption(optp,ap)) -+ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); -+ } -+ else -+ optp->sid=0; -+} -+ -+ -+ -+/* -+ * Function: AlertFWsamOptionInit(char *data, OptTreeNode *otn, int protocol) -+ * -+ * Purpose: Parses each rule and sets the option flags in the tree. -+ * -+ * Arguments: args => ptr to argument string -+ * -+ * Returns: void function -+ * -+*/ -+void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol) -+{ -+ FWsamOptions *optp; -+ char *ap; -+ -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) FWsamOptionInit is parsing...\n"); -+#endif -+ -+ if((optp=(FWsamOptions *)malloc(sizeof(FWsamOptions)))==NULL) -+ FatalError("ERROR => [Alert_FWsam](AlertFWamOptionInit) malloc failed for opt!\n"); -+ -+ -+ ap=args; /* start at the beginning of the argument */ -+ -+ while(*ap) -+ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */ -+ *ap=' '; -+ if(isupper(*ap)) /* and set to lower case */ -+ *ap=tolower(*ap); -+ ap++; -+ } -+ while((ap=strrchr(args,' '))!=NULL) /* remove spaces */ -+ strcpy(ap,ap+1); -+ -+ -+ if(FWsamParseOption(optp,args)) -+ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); -+ -+ otn->ds_list[PLUGIN_FWSAM]=(FWsamOptions *)optp; -+} -+ -+ -+/* Generates a new encryption key for TwoFish based on seq numbers and a random that -+ * the SnortSam agents send on checkin (in protocol) -+*/ -+void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet) -+{ -+ //unsigned char newkey[TwoFish_KEY_LENGTH+2]; -+ char newkey[TwoFish_KEY_LENGTH+2]; -+ int i; -+ -+ newkey[0]=packet->snortseqno[0]; /* current snort seq # (which both know) */ -+ newkey[1]=packet->snortseqno[1]; -+ newkey[2]=packet->fwseqno[0]; /* current SnortSam seq # (which both know) */ -+ newkey[3]=packet->fwseqno[1]; -+ newkey[4]=packet->protocol[0]; /* the random SnortSam chose */ -+ newkey[5]=packet->protocol[1]; -+ -+ strncpy(newkey+6,station->stationkey,TwoFish_KEY_LENGTH-6); /* append old key */ -+ newkey[TwoFish_KEY_LENGTH]=0; -+ -+ newkey[0]^=station->mykeymod[0]; /* modify key with key modifiers which were */ -+ newkey[1]^=station->mykeymod[1]; /* exchanged during the check-in handshake. */ -+ newkey[2]^=station->mykeymod[2]; -+ newkey[3]^=station->mykeymod[3]; -+ newkey[4]^=station->fwkeymod[0]; -+ newkey[5]^=station->fwkeymod[1]; -+ newkey[6]^=station->fwkeymod[2]; -+ newkey[7]^=station->fwkeymod[3]; -+ -+ for(i=0;i<=7;i++) -+ if(newkey[i]==0) -+ newkey[i]++; -+ -+ strcpy(station->stationkey,newkey); -+ TwoFishDestroy(station->stationfish); -+ station->stationfish=TwoFishInit(newkey); -+} -+ -+ -+/* This routine will search the option list as defined -+ * by the sid-block.map file and return a pointer -+ * to the matching record. -+*/ -+FWsamOptions *FWsamGetOption(unsigned long sid) -+{ signed long i,step,diff,o,o2; -+ -+#ifdef FWSAM_FANCYFETCH /* Fancy-fetch jumps in decreasing n/2 steps and takes much less lookups */ -+ o=o2= -1; -+ i=step=FWsamMaxOptions>>1; -+ while(i>=0 && i1) -+ step=step>>1; -+ o2=o; -+ o=i; -+ if(diff>0) -+ i+=step; -+ else -+ i-=step; -+ } -+#else /* This is just a sequential list lookup */ -+ for(i=0;i pointer to the packet data struct -+ * msg => the message to print in the alert -+ * -+ * Returns: void function -+ * -+ ***************************************************************************/ -+void AlertFWsam(Packet *p, char *msg, void *arg, Event *event) -+{ FWsamOptions *optp; -+ FWsamPacket sampacket; -+ FWsamStation *station=NULL; -+ FWsamList *fwsamlist; -+ SOCKET stationsocket; -+ int i,len,deletestation,stationtry=0; -+ //unsigned char *encbuf,*decbuf; -+ char *encbuf,*decbuf; -+ static unsigned long lastbsip[FWSAM_REPET_BLOCKS],lastbdip[FWSAM_REPET_BLOCKS], -+ lastbduration[FWSAM_REPET_BLOCKS],lastbtime[FWSAM_REPET_BLOCKS]; -+ static unsigned short lastbsp[FWSAM_REPET_BLOCKS],lastbdp[FWSAM_REPET_BLOCKS], -+ lastbproto[FWSAM_REPET_BLOCKS],lastbpointer; -+ static unsigned char lastbmode[FWSAM_REPET_BLOCKS]; -+ static unsigned long btime=0; -+ -+ -+ if(otn_tmp==NULL) -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] NULL otn_tmp!\n"); -+#endif -+ return; -+ } -+ if(p == NULL) -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] NULL packet!\n"); -+#endif -+ return; -+ } -+ if(arg == NULL) -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] NULL arg!\n"); -+#endif -+ return; -+ } -+ -+ /* SnortSam does no IPv6 */ -+ if (!IS_IP4(p)) { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] not acting on non-IP4 packet!\n"); -+#endif -+ return; -+ } -+ -+ optp=NULL; -+ -+ if(FWsamOptionField) /* If using the file (field present), let's use that */ -+ optp=FWsamGetOption(event->sig_id); -+ -+ if(!optp) /* If file not present, check if an fwsam option was defined on the triggering rule */ -+ optp=otn_tmp->ds_list[PLUGIN_FWSAM]; -+ -+ if(optp) /* if options specified for this rule */ -+ { if(!btime) /* if this is the first time this function is */ -+ { for(i=0;i [Alert_FWsam] Alert -> Msg=\"%s\"\n",msg); -+ -+ LogMessage("DEBUG => [Alert_FWsam] Alert -> Option: %s[%s],%lu.\n",(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); -+#endif -+ -+ len=TRUE; -+ btime=(unsigned long)time(NULL); /* get current time */ -+ /* This is a cheap check to see if the blocking request matches any of the previous requests. */ -+ for(i=0;ihow==FWSAM_HOW_THIS)? /* if blocking mode SERVICE, check for src and dst */ -+ ( lastbsip[i]==p->iph->ip_src.s_addr && lastbdip[i]==p->iph->ip_dst.s_addr &&lastbproto[i]==p->iph->ip_proto && -+ ((p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP)? /* check port only of TCP or UDP */ -+/* ((optp->who==FWSAM_WHO_SRC)?(lastbsp[i]==p->sp):(lastbdp[i]==p->dp)):TRUE) ): */ -+ lastbdp[i]==p->dp:TRUE) ): -+ ((optp->who==FWSAM_WHO_SRC)?(lastbsip[i]==p->iph->ip_src.s_addr):(lastbdip[i]==p->iph->ip_dst.s_addr))) && /* otherwise if we block source, only compare source. Same for dest. */ -+ lastbduration[i]==optp->duration && -+ (lastbmode[i]&(FWSAM_HOW|FWSAM_WHO))==(optp->how|optp->who) && -+ (btime-lastbtime[i]<((optp->duration>FWSAM_REPET_TIME)?FWSAM_REPET_TIME:optp->duration))) -+ { len=FALSE; /* If so, we don't need to block again. */ -+ } -+ } -+ if(len) -+ { if(++lastbpointer>=FWSAM_REPET_BLOCKS) /* increase repetitive check pointer */ -+ lastbpointer=0; -+ lastbsip[lastbpointer]=p->iph->ip_src.s_addr; /* and note packet details */ -+ lastbdip[lastbpointer]=p->iph->ip_dst.s_addr; -+ lastbduration[lastbpointer]=optp->duration; -+ lastbmode[lastbpointer]=optp->how|optp->who|optp->loglevel; -+ lastbproto[lastbpointer]=p->iph->ip_proto; -+ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP) -+ { lastbsp[lastbpointer]=p->sp; /* set ports if TCP or UDP */ -+ lastbdp[lastbpointer]=p->dp; -+ } -+ lastbtime[lastbpointer]=btime; -+ -+ -+ while(fwsamlist!=NULL) -+ { station=fwsamlist->station; -+ //if(station->stationip.s_addr) -+ if(station->stationip.ip32[0]) -+ { deletestation=FALSE; -+ stationtry++; /* first try */ -+ /* create a socket for the station */ -+ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); -+ if(stationsocket==INVALID_SOCKET) -+ FatalError("ERROR => [Alert_FWsam] Funky socket error (socket)!\n"); -+ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) -+ FatalError("ERROR => [Alert_FWsam] Could not bind socket!\n"); -+ -+ /* let's connect to the agent */ -+ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) -+ { -+ LogMessage("WARNING => [Alert_FWsam] Could not send block to host %s. Will try later.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ stationtry=0; -+ } -+ else -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Connected to host %s.\n",sfip_ntoa(&station->stationip)); -+#endif -+ /* now build the packet */ -+ station->myseqno+=station->stationseqno; /* increase my seqno by adding agent seq no */ -+ sampacket.endiancheck=1; /* This is an endian indicator for Snortsam */ -+ sampacket.snortseqno[0]=(char)station->myseqno; -+ sampacket.snortseqno[1]=(char)(station->myseqno>>8); -+ sampacket.fwseqno[0]=(char)station->stationseqno;/* fill station seqno */ -+ sampacket.fwseqno[1]=(char)(station->stationseqno>>8); -+ sampacket.status=FWSAM_STATUS_BLOCK; /* set block mode */ -+ sampacket.version=FWSAM_PACKETVERSION; /* set packet version */ -+ sampacket.duration[0]=(char)optp->duration; /* set duration */ -+ sampacket.duration[1]=(char)(optp->duration>>8); -+ sampacket.duration[2]=(char)(optp->duration>>16); -+ sampacket.duration[3]=(char)(optp->duration>>24); -+ sampacket.fwmode=optp->how|optp->who|optp->loglevel; /* set the mode */ -+ sampacket.dstip[0]=(char)p->iph->ip_dst.s_addr; /* destination IP */ -+ sampacket.dstip[1]=(char)(p->iph->ip_dst.s_addr>>8); -+ sampacket.dstip[2]=(char)(p->iph->ip_dst.s_addr>>16); -+ sampacket.dstip[3]=(char)(p->iph->ip_dst.s_addr>>24); -+ sampacket.srcip[0]=(char)p->iph->ip_src.s_addr; /* source IP */ -+ sampacket.srcip[1]=(char)(p->iph->ip_src.s_addr>>8); -+ sampacket.srcip[2]=(char)(p->iph->ip_src.s_addr>>16); -+ sampacket.srcip[3]=(char)(p->iph->ip_src.s_addr>>24); -+ sampacket.protocol[0]=(char)p->iph->ip_proto; /* protocol */ -+ sampacket.protocol[1]=(char)(p->iph->ip_proto>>8);/* protocol */ -+ -+ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP) -+ { sampacket.srcport[0]=(char)p->sp; /* set ports */ -+ sampacket.srcport[1]=(char)(p->sp>>8); -+ sampacket.dstport[0]=(char)p->dp; -+ sampacket.dstport[1]=(char)(p->dp>>8); -+ } -+ else -+ sampacket.srcport[0]=sampacket.srcport[1]=sampacket.dstport[0]=sampacket.dstport[1]=0; -+ -+ sampacket.sig_id[0]=(char)event->sig_id; /* set signature ID */ -+ sampacket.sig_id[1]=(char)(event->sig_id>>8); -+ sampacket.sig_id[2]=(char)(event->sig_id>>16); -+ sampacket.sig_id[3]=(char)(event->sig_id>>24); -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Sending BLOCK\n"); -+ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",station->myseqno); -+ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); -+ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",FWSAM_STATUS_BLOCK); -+ LogMessage("DEBUG => [Alert_FWsam] Mode : %i\n",optp->how|optp->who|optp->loglevel); -+ LogMessage("DEBUG => [Alert_FWsam] Duration : %li\n",optp->duration); -+ LogMessage("DEBUG => [Alert_FWsam] Protocol : %i\n",GET_IPH_PROTO(p)); -+#ifdef SUP_IP6 -+ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",sfip_ntoa(GET_SRC_IP(p))); -+ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",sfip_ntoa(GET_DST_IP(p))); -+#else -+ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",inet_ntoa(p->iph->ip_src)); -+ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",inet_ntoa(p->iph->ip_dst)); -+#endif -+ LogMessage("DEBUG => [Alert_FWsam] Src Port : %i\n",p->sp); -+ LogMessage("DEBUG => [Alert_FWsam] Dest Port : %i\n",p->dp); -+ LogMessage("DEBUG => [Alert_FWsam] Sig_ID : %lu\n",event->sig_id); -+ -+#endif -+ -+ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get the encryption buffer */ -+ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt the packet with current key */ -+ -+ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */ -+ { LogMessage("WARNING => [Alert_FWsam] Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ stationtry=0; -+ } -+ else -+ { i=FWSAM_NETWAIT; -+#ifdef WIN32 -+ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#else -+ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#endif -+ while(i-- >1) /* the response packet */ -+ { waitms(10); /* wait for response (default maximum 3 secs */ -+ if(recv(stationsocket,encbuf,len,0)==len) -+ i=0; /* if we received packet we set the counter to 0. */ -+ /* by the time we check with if, it's already dec'ed to -1 */ -+ } -+ if(!i) /* id we timed out (i was one, then dec'ed)... */ -+ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ stationtry=0; -+ } -+ else /* got a packet */ -+ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */ -+ -+ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ -+ { strcpy(station->stationkey,station->initialkey); /* try the intial key */ -+ TwoFishDestroy(station->stationfish); -+ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */ -+ LogMessage("INFO => [Alert_FWsam] Had to use initial key!\n"); -+ } -+ if(len==sizeof(FWsamPacket)) /* valid decryption */ -+ { if(sampacket.version==FWSAM_PACKETVERSION)/* master speaks my language */ -+ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY -+ || sampacket.status==FWSAM_STATUS_RESYNC || sampacket.status==FWSAM_STATUS_HOLD) -+ { station->stationseqno=sampacket.fwseqno[0] | (sampacket.fwseqno[1]<<8); /* get stations seqno */ -+ station->lastcontact=(unsigned long)time(NULL); /* set the last contact time (not used yet) */ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": -+ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": -+ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": -+ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); -+ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); -+ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); -+ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status); -+ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version); -+#endif -+ if(sampacket.status==FWSAM_STATUS_HOLD) -+ { i=FWSAM_NETHOLD; /* Stay on hold for a maximum of 60 secs (default) */ -+ while(i-- >1) /* the response packet */ -+ { waitms(10); /* wait for response */ -+ if(recv(stationsocket,encbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,0)==sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE) -+ i=0; /* if we received packet we set the counter to 0. */ -+ } -+ if(!i) /* id we timed out (i was one, then dec'ed)... */ -+ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); -+ stationtry=0; -+ sampacket.status=FWSAM_STATUS_ERROR; -+ } -+ else /* got a packet */ -+ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */ -+ -+ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ -+ { strcpy(station->stationkey,station->initialkey); /* try the intial key */ -+ TwoFishDestroy(station->stationfish); -+ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */ -+ LogMessage("INFO => [Alert_FWsam] Had to use initial key again!\n"); -+ } -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": -+ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": -+ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": -+ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); -+ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); -+ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); -+ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status); -+ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version); -+#endif -+ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ -+ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ deletestation=TRUE; -+ sampacket.status=FWSAM_STATUS_ERROR; -+ } -+ else if(sampacket.version!=FWSAM_PACKETVERSION) /* invalid protocol version */ -+ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ deletestation=TRUE; -+ sampacket.status=FWSAM_STATUS_ERROR; -+ } -+ else if(sampacket.status!=FWSAM_STATUS_OK && sampacket.status!=FWSAM_STATUS_NEWKEY && sampacket.status!=FWSAM_STATUS_RESYNC) -+ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ deletestation=TRUE; -+ sampacket.status=FWSAM_STATUS_ERROR; -+ } -+ } -+ } -+ if(sampacket.status==FWSAM_STATUS_RESYNC) /* if station want's to resync... */ -+ { strcpy(station->stationkey,station->initialkey); /* ...we use the intial key... */ -+ memcpy(station->fwkeymod,sampacket.duration,4); /* and note the random key modifier */ -+ } -+ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) -+ { -+ FWsamNewStationKey(station,&sampacket); /* generate new TwoFish keys */ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Generated new encryption key...\n"); -+#endif -+ } -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ stationtry=0; -+ } -+ else if(sampacket.status==FWSAM_STATUS_ERROR) /* if SnortSam reports an error on second try, */ -+ { -+#ifdef WIN32 -+ closesocket(stationsocket); /* something is messed up and ... */ -+#else -+ close(stationsocket); -+#endif -+ if(stationtry>1) /* we ignore that station. */ -+ { deletestation=TRUE; /* flag for deletion */ -+ ErrorMessage("ERROR => [Alert_FWsam] Could not renegotiate key! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ } -+ else /* if we get an error on the first try, */ -+ { if(!FWsamCheckIn(station)) /* we first try to check in again. */ -+ { deletestation=TRUE; -+ ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ } -+ } -+ } -+ else /* an unknown status means trouble... */ -+ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ deletestation=TRUE; -+ } -+ } -+ else /* if the SnortSam agent uses a different packet version, we have no choice but to ignore it. */ -+ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ deletestation=TRUE; -+ } -+ } -+ else /* if the intial key failed to decrypt as well, the keys are not configured the same, and we ignore that SnortSam station. */ -+ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ deletestation=TRUE; -+ } -+ } -+ } -+ free(encbuf); /* release of the TwoFishAlloc'ed encryption buffer */ -+ } -+ if(stationtry==0 || deletestation) /* if everything went real well, or real bad... */ -+ { if(deletestation){ /* If it went bad, we remove the station from the list by marking the IP */ -+// station->stationip.s_addr=0; -+ station->stationip.ip32[0]=0; -+ } -+ fwsamlist=fwsamlist->next; -+ } -+ } -+ else -+ fwsamlist=fwsamlist->next; -+ } -+ } -+ else -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam] Skipping repetitive block.\n"); -+#endif -+ } -+ } -+} -+ -+/* FWsamCheckOut will be called when Snort exists. It de-registeres this snort sensor -+ * from the list of sensor that the SnortSam agent keeps. -+ */ -+void FWsamCheckOut(FWsamStation *station) -+{ FWsamPacket sampacket; -+ SOCKET stationsocket; -+ int i,len; -+ char *encbuf,*decbuf; -+ //unsigned char *encbuf,*decbuf; -+ -+ -+ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); -+ if(stationsocket==INVALID_SOCKET) -+ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Funky socket error (socket)!\n"); -+ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) -+ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Could not bind socket!\n"); -+ -+ /* let's connect to the agent */ -+ if(!connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) -+ { LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Disconnecting from host %s.\n",sfip_ntoa(&station->stationip)); -+ /* now build the packet */ -+ station->myseqno+=station->stationseqno; /* increase my seqno */ -+ sampacket.endiancheck=1; -+ sampacket.snortseqno[0]=(char)station->myseqno; -+ sampacket.snortseqno[1]=(char)(station->myseqno>>8); -+ sampacket.fwseqno[0]=(char)station->stationseqno; /* fill station seqno */ -+ sampacket.fwseqno[1]=(char)(station->stationseqno>>8); -+ sampacket.status=FWSAM_STATUS_CHECKOUT; /* checking out... */ -+ sampacket.version=FWSAM_PACKETVERSION; -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Sending CHECKOUT\n"); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Snort SeqNo: %x\n",station->myseqno); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Mgmt SeqNo : %x\n",station->stationseqno); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Status : %i\n",sampacket.status); -+ -+#endif -+ -+ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get encryption buffer */ -+ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt packet with current key */ -+ -+ if(send(stationsocket,encbuf,len,0)==len) -+ { i=FWSAM_NETWAIT; -+#ifdef WIN32 -+ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#else -+ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#endif -+ while(i-- >1) -+ { waitms(10); /* ...wait a maximum of 3 secs for response... */ -+ if(recv(stationsocket,encbuf,len,0)==len) /* ... for the status packet */ -+ i=0; -+ } -+ if(i) /* if we got the packet */ -+ { decbuf=(char *)&sampacket; -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); -+ -+ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ -+ { strcpy(station->stationkey,station->initialkey); /* try initial key */ -+ TwoFishDestroy(station->stationfish); /* toss this fish */ -+ station->stationfish=TwoFishInit(station->stationkey); /* re-initialze TwoFish with initial key */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* and try to decrypt again */ -+ LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Had to use initial key!\n"); -+ } -+ if(len==sizeof(FWsamPacket)) /* valid decryption */ -+ { if(sampacket.version!=FWSAM_PACKETVERSION) /* but don't really care since we are on the way out */ -+ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Protocol version error! What the hell, we're quitting anyway! :)\n"); -+ } -+ else -+ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Password mismatch! What the hell, we're quitting anyway! :)\n"); -+ } -+ } -+ free(encbuf); /* release TwoFishAlloc'ed buffer */ -+ } -+ else -+ LogMessage("WARNING => [Alert_FWsam] Could not connect to host %s for CheckOut. What the hell, we're quitting anyway! :)\n",sfip_ntoa(&station->stationip)); -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+} -+ -+ -+/* FWSamFree: Disconnects all FW-1 management stations, -+ * closes sockets, and frees the structures. -+ */ -+void FWsamFree(FWsamList *list) -+{ -+ FWsamList *next; -+ -+ while(list) /* Free pointer list for rule type */ -+ { -+ next=list->next; -+ free(list); -+ list=next; -+ } -+ list=FWsamStationList; -+ -+ while(list) /* Free global pointer list and stations */ -+ { -+ next=list->next; -+ if (list->station) -+ { -+ if(list->station->stationip.ip32[0]) -+ //if(list->station->stationip.s_addr) -+ FWsamCheckOut(list->station); /* Send a Check-Out to SnortSam, */ -+ -+ TwoFishDestroy(list->station->stationfish); /* toss the fish, */ -+ free(list->station); /* free station, */ -+ } -+ free(list); /* free pointer, */ -+ list=next; /* and move to next. */ -+ } -+ FWsamStationList=NULL; -+ if(FWsamOptionField) -+ free(FWsamOptionField); -+} -+ -+void AlertFWsamCleanExitFunc(int signal, void *arg) -+{ FWsamList *fwsamlist; -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamCleanExitFunc) Exiting...\n"); -+#endif -+ -+ fwsamlist=(FWsamList *)arg; -+ FWsamFree(fwsamlist); /* Free all elements */ -+} -+ -+void AlertFWsamRestartFunc(int signal, void *arg) -+{ FWsamList *fwsamlist; -+ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamRestartFunc) Restarting...\n"); -+#endif -+ -+ fwsamlist=(FWsamList *)arg; -+ FWsamFree(fwsamlist); /* Free all elements */ -+} -+ -+/* This routine registers this Snort sensor with SnortSam. -+ * It will also change the encryption key based on some variables. -+ */ -+int FWsamCheckIn(FWsamStation *station) -+{ int i,len,stationok=TRUE; -+ FWsamPacket sampacket; -+ char *encbuf,*decbuf; -+ //unsigned char *encbuf,*decbuf; -+ SOCKET stationsocket; -+ -+ -+ /* create a socket for the station */ -+ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); -+ if(stationsocket==INVALID_SOCKET) -+ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Funky socket error (socket)!\n"); -+ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) -+ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Could not bind socket!\n"); -+ -+ i=TRUE; -+ /* let's connect to the agent */ -+ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) -+ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not connect to host %s. Will try later.\n",sfip_ntoa(&station->stationip)); -+ else -+ { LogMessage("INFO => [Alert_FWsam](FWsamCheckIn) Connected to host %s.\n",sfip_ntoa(&station->stationip)); -+ /* now build the packet */ -+ sampacket.endiancheck=1; -+ sampacket.snortseqno[0]=(char)station->myseqno; /* fill my sequence number number */ -+ sampacket.snortseqno[1]=(char)(station->myseqno>>8); /* fill my sequence number number */ -+ sampacket.status=FWSAM_STATUS_CHECKIN; /* let's check in */ -+ sampacket.version=FWSAM_PACKETVERSION; /* set the packet version */ -+ memcpy(sampacket.duration,station->mykeymod,4); /* we'll send SnortSam our key modifier in the duration slot */ -+ /* (the checkin packet is just the plain initial key) */ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Sending CheckIn\n"); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",station->myseqno); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mode : %i\n",sampacket.status); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version); -+#endif -+ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get buffer for encryption */ -+ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt with initial key */ -+ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */ -+ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); -+ else -+ { i=FWSAM_NETWAIT; -+#ifdef WIN32 -+ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#else -+ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ -+#endif -+ while(i-- >1) -+ { waitms(10); /* wait a maximum of 3 secs for response */ -+ if(recv(stationsocket,encbuf,len,0)==len) -+ i=0; -+ } -+ if(!i) /* time up? */ -+ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); -+ else -+ { decbuf=(char *)&sampacket; /* got status packet */ -+ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt with initial key */ -+ if(len==sizeof(FWsamPacket)) /* valid decryption */ -+ { -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": -+ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": -+ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": -+ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mgmt SeqNo : %x\n",sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8)); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Status : %i\n",sampacket.status); -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version); -+#endif -+ if(sampacket.version==FWSAM_PACKETVERSION) /* master speaks my language */ -+ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) -+ { station->stationseqno=sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8); /* get stations seqno */ -+ station->lastcontact=(unsigned long)time(NULL); -+ -+ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) /* generate new keys */ -+ { memcpy(station->fwkeymod,sampacket.duration,4); /* note the key modifier */ -+ FWsamNewStationKey(station,&sampacket); /* and generate new TwoFish keys (with key modifiers) */ -+#ifdef FWSAMDEBUG -+ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Generated new encryption key...\n"); -+#endif -+ } -+ } -+ else /* weird, got a strange status back */ -+ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ stationok=FALSE; -+ } -+ } -+ else /* packet version does not match */ -+ { ErrorMessage("ERROR =>[Alert_FWsam](FWsamCheckIn) Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ stationok=FALSE; -+ } -+ } -+ else /* key does not match */ -+ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); -+ stationok=FALSE; -+ } -+ } -+ } -+ free(encbuf); /* release TwoFishAlloc'ed buffer */ -+ } -+#ifdef WIN32 -+ closesocket(stationsocket); -+#else -+ close(stationsocket); -+#endif -+ return stationok; -+} -+#undef FWSAMDEBUG -+ - -Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h -=================================================================== ---- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 0) -+++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 3) -@@ -0,0 +1,216 @@ -+/* $Id: snortpatchb,v 1.5 2005/10/06 08:50:39 fknobbe Exp $ -+** -+** spo_alert_fwsam.h -+** -+** Copyright (c) 2001-2004 Frank Knobbe -+** -+** This program is free software; you can redistribute it and/or modify -+** it under the terms of the GNU General Public License as published by -+** the Free Software Foundation; either version 2 of the License, or -+** (at your option) any later version. -+** -+** This program is distributed in the hope that it will be useful, -+** but WITHOUT ANY WARRANTY; without even the implied warranty of -+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+** GNU General Public License for more details. -+** -+** You should have received a copy of the GNU General Public License -+** along with this program; if not, write to the Free Software -+** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+*/ -+ -+/* This file gets included in plugbase.c when it is integrated into the rest -+ * of the program. -+ * -+ * For more info, see the beginning of spo_alert_fwsam.c -+ * -+ */ -+ -+#ifndef __SPO_FWSAM_H__ -+#define __SPO_FWSAM_H__ -+ -+#include "snort.h" -+#include "rules.h" -+#include "plugbase.h" -+#include "plugin_enum.h" -+#include "fatal.h" -+#include "util.h" -+#include "twofish.h" -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+ -+/* just some compatibility stuff */ -+#ifdef WIN32 -+#if !defined(_WINSOCKAPI_) && !defined(_WINSOCK2API_) -+#include -+#endif -+#define waitms(x) Sleep(x) -+ -+#else -+ -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef SOLARIS -+#include -+#endif -+ -+typedef int SOCKET; -+ -+#ifndef INVALID_SOCKET -+#define INVALID_SOCKET -1 -+#endif -+ -+#define waitms(x) usleep((x)*1000) -+ -+#endif -+ -+#ifndef FALSE -+#define FALSE 0 -+#endif -+#ifndef TRUE -+#define TRUE !FALSE -+#endif -+#ifndef bool -+#define bool int -+#endif -+ -+ -+#if defined(_DEBUG) || defined(DEBUG) -+#ifndef FWSAMDEBUG -+#define FWSAMDEBUG -+#endif -+#else -+#endif -+ -+ -+/* Official Snort PlugIn Number has been moved into plugin_enum.h */ -+ -+ -+/* fixed defines */ -+ -+#define FWSAM_DEFAULTPORT 898 /* Default port if user does not specify one in snort.conf */ -+ /* (Was unused last time I checked...) */ -+#define FWSAM_PACKETVERSION 14 /* version of the packet. Will increase with enhancements. */ -+ -+#define FWSAM_STATUS_CHECKIN 1 /* snort to fw */ -+#define FWSAM_STATUS_CHECKOUT 2 -+#define FWSAM_STATUS_BLOCK 3 -+#define FWSAM_STATUS_UNBLOCK 9 -+ -+#define FWSAM_STATUS_OK 4 /* fw to snort */ -+#define FWSAM_STATUS_ERROR 5 -+#define FWSAM_STATUS_NEWKEY 6 -+#define FWSAM_STATUS_RESYNC 7 -+#define FWSAM_STATUS_HOLD 8 -+ -+#define FWSAM_LOG_NONE 0 -+#define FWSAM_LOG_SHORTLOG 1 -+#define FWSAM_LOG_SHORTALERT 2 -+#define FWSAM_LOG_LONGLOG 3 -+#define FWSAM_LOG_LONGALERT 4 -+#define FWSAM_LOG (FWSAM_LOG_SHORTLOG|FWSAM_LOG_SHORTALERT|FWSAM_LOG_LONGLOG|FWSAM_LOG_LONGALERT) -+#define FWSAM_WHO_DST 8 -+#define FWSAM_WHO_SRC 16 -+#define FWSAM_WHO (FWSAM_WHO_DST|FWSAM_WHO_SRC) -+#define FWSAM_HOW_IN 32 -+#define FWSAM_HOW_OUT 64 -+#define FWSAM_HOW_INOUT (FWSAM_HOW_IN|FWSAM_HOW_OUT) -+#define FWSAM_HOW_THIS 128 -+#define FWSAM_HOW (FWSAM_HOW_IN|FWSAM_HOW_OUT|FWSAM_HOW_THIS) -+ -+ -+/* user adjustable defines */ -+ -+#define FWSAM_REPET_BLOCKS 10 /* Snort remembers this amount of last blocks and... */ -+#define FWSAM_REPET_TIME 20 /* ...checks if they fall within this time. If so,... */ -+ /* ...the blocking request is not send. */ -+ -+#define FWSAM_NETWAIT 300 /* 100th of a second. 3 sec timeout for network connections */ -+#define FWSAM_NETHOLD 6000 /* 100th of a second. 60 sec timeout for holding */ -+ -+#define SID_MAPFILE "sid-block.map" -+#define SID_ALT_MAPFILE "sid-fwsam.map" -+ -+#define FWSAM_FANCYFETCH /* This will invoke a fast sid lookup routine */ -+ -+ -+/* vars */ -+ -+typedef struct _FWsamstation /* structure of a mgmt station */ -+{ unsigned short myseqno; -+ unsigned short stationseqno; -+ unsigned char mykeymod[4]; -+ unsigned char fwkeymod[4]; -+ unsigned short stationport; -+ //struct in_addr stationip; -+ sfip_t stationip; -+ struct sockaddr_in localsocketaddr; -+ struct sockaddr_in stationsocketaddr; -+ TWOFISH *stationfish; -+ char initialkey[TwoFish_KEY_LENGTH+2]; -+ char stationkey[TwoFish_KEY_LENGTH+2]; -+ time_t lastcontact; -+/* time_t sleepstart; */ -+} FWsamStation; -+ -+typedef struct _FWsampacket /* 2 blocks (3rd block is header from TwoFish) */ -+{ unsigned short endiancheck; /* 0 */ -+ unsigned char srcip[4]; /* 2 */ -+ unsigned char dstip[4]; /* 6 */ -+ unsigned char duration[4]; /* 10 */ -+ unsigned char snortseqno[2]; /* 14 */ -+ unsigned char fwseqno[2]; /* 16 */ -+ unsigned char srcport[2]; /* 18 */ -+ unsigned char dstport[2]; /* 20 */ -+ unsigned char protocol[2]; /* 22 */ -+ unsigned char fwmode; /* 24 */ -+ unsigned char version; /* 25 */ -+ unsigned char status; /* 26 */ -+ unsigned char sig_id[4]; /* 27 */ -+ unsigned char fluff; /* 31 */ -+} FWsamPacket; /* 32 bytes in size */ -+ -+typedef struct _FWsamoptions /* snort rule options */ -+{ unsigned long sid; -+ unsigned long duration; -+ unsigned char who; -+ unsigned char how; -+ unsigned char loglevel; -+} FWsamOptions; -+ -+typedef struct _FWsamlistpointer -+{ FWsamStation *station; -+ struct _FWsamlistpointer *next; -+} FWsamList; -+ -+ -+/* functions */ -+void AlertFWsamSetup(void); -+void AlertFWsamInit(char *args); -+void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol); -+void AlertFWsamCleanExitFunc(int signal, void *arg); -+void AlertFWsamRestartFunc(int signal, void *arg); -+void AlertFWsam(Packet *p, char *msg, void *arg, Event *event); -+int FWsamCheckIn(FWsamStation *station); -+void FWsamCheckOut(FWsamStation *station); -+void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet); -+void FWsamFixPacketEndian(FWsamPacket *p); -+unsigned long FWsamParseDuration(char *p); -+void FWsamFree(FWsamList *fwsamlist); -+int FWsamStationExists(FWsamStation *who,FWsamList *list); -+int FWsamReadLine(char *,unsigned long,FILE *); -+void FWsamParseLine(FWsamOptions *,char *); -+FWsamOptions *FWsamGetOption(unsigned long); -+int FWsamParseOption(FWsamOptions *,char *); -+ -+#endif /* __SPO_FWSAM_H__ */ - -Index: snort-2.8.6.1/src/output-plugins/Makefile.am -=================================================================== ---- snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 1) -+++ snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 3) -@@ -11,6 +11,7 @@ - spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ - spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ - spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ -+spo_alert_fwsam.c spo_alert_fwsam.h \ - spo_alert_test.c spo_alert_test.h - - INCLUDES = @INCLUDES@ -Index: snort-2.8.6.1/src/plugbase.c -=================================================================== ---- snort-2.8.6.1/src/plugbase.c (Revision 1) -+++ snort-2.8.6.1/src/plugbase.c (Revision 3) -@@ -125,6 +125,7 @@ - #endif - - #include "output-plugins/spo_alert_test.h" -+#include "output-plugins/spo_alert_fwsam.h" - - extern ListHead *head_tmp; - extern PreprocConfigFuncNode *preproc_config_funcs; -@@ -1240,6 +1241,7 @@ - #endif - - AlertTestSetup(); -+ AlertFWsamSetup(); - } - - /**************************************************************************** -Index: snort-2.8.6.1/src/Makefile.am -=================================================================== ---- snort-2.8.6.1/src/Makefile.am (Revision 1) -+++ snort-2.8.6.1/src/Makefile.am (Revision 3) -@@ -52,7 +52,8 @@ - detection_filter.c detection_filter.h \ - rate_filter.c rate_filter.h \ - obfuscation.c obfuscation.h \ --rule_option_types.h -+rule_option_types.h \ -+twofish.c twofish.h - - snort_LDADD = output-plugins/libspo.a \ - detection-plugins/libspd.a \ -Index: snort-2.8.6.1/autojunk.sh -=================================================================== ---- snort-2.8.6.1/autojunk.sh (Revision 0) -+++ snort-2.8.6.1/autojunk.sh (Revision 3) -@@ -0,0 +1,7 @@ -+#!/bin/sh -+# the list of commands that need to run before we do a compile -+libtoolize --automake --copy -+aclocal -I m4 -+autoheader -+automake --add-missing --copy -+autoconf - -Index: snort-2.8.6.1/etc/snort.conf -=================================================================== ---- snort-2.8.6.1/etc/snort.conf (Revision 1) -+++ snort-2.8.6.1/etc/snort.conf (Revision 3) -@@ -277,6 +277,32 @@ - # prelude - # output alert_prelude - -+# snortsam -+# In order to cause Snort to send a blocking request to the SnortSam agent, -+# that agent has to be listed, including the port it listens on, -+# and the encryption key it is using. The statement for that is: -+# -+# output alert_fwsam: {SnortSam Station}:{port}/{password} -+# -+# {SnortSam Station}: IP address or host name of the host where SnortSam is running. -+# {port}: The port the remote SnortSam agent listens on. -+# {password}: The password, or key, used for encryption of the -+# communication to the remote agent. -+# -+# At the very least, the IP address or host name of the host running SnortSam -+# needs to be specified. If the port is omitted, it defaults to TCP port 898. -+# If the password is omitted, it defaults to a preset password. -+# (In which case it needs to be omitted on the SnortSam agent as well) -+# -+# More than one host can be specified, but has to be done on the same line. -+# Just separate them with one or more spaces. -+# -+# Examples: -+# -+# output alert_fwsam: firewall/idspassword -+# output alert_fwsam: fw1.domain.tld:898/mykey -+# output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw -+ - # metadata reference data. do not modify these lines - include classification.config - include reference.config diff --git a/config/orionids-dev/patches/inlinemode_options_flags.txt b/config/orionids-dev/patches/inlinemode_options_flags.txt deleted file mode 100644 index e69de29b..00000000 diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am deleted file mode 100644 index 0879c6e3..00000000 --- a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am +++ /dev/null @@ -1,17 +0,0 @@ -## $Id -AUTOMAKE_OPTIONS=foreign no-dependencies - -noinst_LIBRARIES = libspo.a - -libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \ -spo_alert_full.c spo_alert_full.h \ -spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \ -spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \ -spo_log_null.c spo_log_null.h spo_log_tcpdump.c \ -spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ -spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ -spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ -spo_alert_test.c spo_alert_test.h \ -spo_pf.h spo_pf.c - -INCLUDES = @INCLUDES@ diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in deleted file mode 100644 index 3f06cc31..00000000 --- a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in +++ /dev/null @@ -1,445 +0,0 @@ -# Makefile.in generated by automake 1.9.6 from Makefile.am. -# @configure_input@ - -# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005 Free Software Foundation, Inc. -# This Makefile.in is free software; the Free Software Foundation -# gives unlimited permission to copy and/or distribute it, -# with or without modifications, as long as this notice is preserved. - -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY, to the extent permitted by law; without -# even the implied warranty of MERCHANTABILITY or FITNESS FOR A -# PARTICULAR PURPOSE. - -@SET_MAKE@ - -srcdir = @srcdir@ -top_srcdir = @top_srcdir@ -VPATH = @srcdir@ -pkgdatadir = $(datadir)/@PACKAGE@ -pkglibdir = $(libdir)/@PACKAGE@ -pkgincludedir = $(includedir)/@PACKAGE@ -top_builddir = ../.. -am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd -INSTALL = @INSTALL@ -install_sh_DATA = $(install_sh) -c -m 644 -install_sh_PROGRAM = $(install_sh) -c -install_sh_SCRIPT = $(install_sh) -c -INSTALL_HEADER = $(INSTALL_DATA) -transform = $(program_transform_name) -NORMAL_INSTALL = : -PRE_INSTALL = : -POST_INSTALL = : -NORMAL_UNINSTALL = : -PRE_UNINSTALL = : -POST_UNINSTALL = : -build_triplet = @build@ -host_triplet = @host@ -subdir = src/output-plugins -DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in -ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 -am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ - $(top_srcdir)/configure.in -am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ - $(ACLOCAL_M4) -mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs -CONFIG_HEADER = $(top_builddir)/config.h -CONFIG_CLEAN_FILES = -LIBRARIES = $(noinst_LIBRARIES) -ARFLAGS = cru -libspo_a_AR = $(AR) $(ARFLAGS) -libspo_a_LIBADD = -am_libspo_a_OBJECTS = spo_alert_fast.$(OBJEXT) \ - spo_alert_full.$(OBJEXT) spo_alert_syslog.$(OBJEXT) \ - spo_alert_unixsock.$(OBJEXT) spo_csv.$(OBJEXT) \ - spo_database.$(OBJEXT) spo_log_null.$(OBJEXT) \ - spo_log_tcpdump.$(OBJEXT) spo_unified.$(OBJEXT) \ - spo_unified2.$(OBJEXT) spo_log_ascii.$(OBJEXT) \ - spo_alert_sf_socket.$(OBJEXT) spo_alert_prelude.$(OBJEXT) \ - spo_alert_arubaaction.$(OBJEXT) spo_alert_test.$(OBJEXT) \ - spo_pf.$(OBJEXT) -libspo_a_OBJECTS = $(am_libspo_a_OBJECTS) -DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir) -depcomp = -am__depfiles_maybe = -COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ - $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \ - $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ - $(AM_CFLAGS) $(CFLAGS) -CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ - $(AM_LDFLAGS) $(LDFLAGS) -o $@ -SOURCES = $(libspo_a_SOURCES) -DIST_SOURCES = $(libspo_a_SOURCES) -ETAGS = etags -CTAGS = ctags -DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) -ACLOCAL = @ACLOCAL@ -AMDEP_FALSE = @AMDEP_FALSE@ -AMDEP_TRUE = @AMDEP_TRUE@ -AMTAR = @AMTAR@ -AR = @AR@ -AUTOCONF = @AUTOCONF@ -AUTOHEADER = @AUTOHEADER@ -AUTOMAKE = @AUTOMAKE@ -AWK = @AWK@ -BUILD_DYNAMIC_EXAMPLES_FALSE = @BUILD_DYNAMIC_EXAMPLES_FALSE@ -BUILD_DYNAMIC_EXAMPLES_TRUE = @BUILD_DYNAMIC_EXAMPLES_TRUE@ -CC = @CC@ -CCDEPMODE = @CCDEPMODE@ -CFLAGS = @CFLAGS@ -CPP = @CPP@ -CPPFLAGS = @CPPFLAGS@ -CXX = @CXX@ -CXXCPP = @CXXCPP@ -CXXDEPMODE = @CXXDEPMODE@ -CXXFLAGS = @CXXFLAGS@ -CYGPATH_W = @CYGPATH_W@ -DEFS = @DEFS@ -DEPDIR = @DEPDIR@ -ECHO = @ECHO@ -ECHO_C = @ECHO_C@ -ECHO_N = @ECHO_N@ -ECHO_T = @ECHO_T@ -EGREP = @EGREP@ -EXEEXT = @EXEEXT@ -F77 = @F77@ -FFLAGS = @FFLAGS@ -HAVE_DYNAMIC_PLUGINS_FALSE = @HAVE_DYNAMIC_PLUGINS_FALSE@ -HAVE_DYNAMIC_PLUGINS_TRUE = @HAVE_DYNAMIC_PLUGINS_TRUE@ -HAVE_SUP_IP6_FALSE = @HAVE_SUP_IP6_FALSE@ -HAVE_SUP_IP6_TRUE = @HAVE_SUP_IP6_TRUE@ -HAVE_TARGET_BASED_FALSE = @HAVE_TARGET_BASED_FALSE@ -HAVE_TARGET_BASED_TRUE = @HAVE_TARGET_BASED_TRUE@ -HAVE_ZLIB_FALSE = @HAVE_ZLIB_FALSE@ -HAVE_ZLIB_TRUE = @HAVE_ZLIB_TRUE@ -INCLUDES = @INCLUDES@ -INSTALL_DATA = @INSTALL_DATA@ -INSTALL_PROGRAM = @INSTALL_PROGRAM@ -INSTALL_SCRIPT = @INSTALL_SCRIPT@ -INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ -LDFLAGS = @LDFLAGS@ -LEX = @LEX@ -LIBOBJS = @LIBOBJS@ -LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ -LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ -LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ -LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ -LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ -LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ -LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ -LIBS = @LIBS@ -LIBTOOL = @LIBTOOL@ -LN_S = @LN_S@ -LTLIBOBJS = @LTLIBOBJS@ -MAINT = @MAINT@ -MAINTAINER_MODE_FALSE = @MAINTAINER_MODE_FALSE@ -MAINTAINER_MODE_TRUE = @MAINTAINER_MODE_TRUE@ -MAKEINFO = @MAKEINFO@ -OBJEXT = @OBJEXT@ -PACKAGE = @PACKAGE@ -PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ -PACKAGE_NAME = @PACKAGE_NAME@ -PACKAGE_STRING = @PACKAGE_STRING@ -PACKAGE_TARNAME = @PACKAGE_TARNAME@ -PACKAGE_VERSION = @PACKAGE_VERSION@ -PATH_SEPARATOR = @PATH_SEPARATOR@ -RANLIB = @RANLIB@ -SED = @SED@ -SET_MAKE = @SET_MAKE@ -SHELL = @SHELL@ -STRIP = @STRIP@ -VERSION = @VERSION@ -YACC = @YACC@ -ac_ct_AR = @ac_ct_AR@ -ac_ct_CC = @ac_ct_CC@ -ac_ct_CXX = @ac_ct_CXX@ -ac_ct_F77 = @ac_ct_F77@ -ac_ct_RANLIB = @ac_ct_RANLIB@ -ac_ct_STRIP = @ac_ct_STRIP@ -am__fastdepCC_FALSE = @am__fastdepCC_FALSE@ -am__fastdepCC_TRUE = @am__fastdepCC_TRUE@ -am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@ -am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@ -am__include = @am__include@ -am__leading_dot = @am__leading_dot@ -am__quote = @am__quote@ -am__tar = @am__tar@ -am__untar = @am__untar@ -bindir = @bindir@ -build = @build@ -build_alias = @build_alias@ -build_cpu = @build_cpu@ -build_os = @build_os@ -build_vendor = @build_vendor@ -datadir = @datadir@ -exec_prefix = @exec_prefix@ -extra_incl = @extra_incl@ -host = @host@ -host_alias = @host_alias@ -host_cpu = @host_cpu@ -host_os = @host_os@ -host_vendor = @host_vendor@ -includedir = @includedir@ -infodir = @infodir@ -install_sh = @install_sh@ -libdir = @libdir@ -libexecdir = @libexecdir@ -localstatedir = @localstatedir@ -mandir = @mandir@ -mkdir_p = @mkdir_p@ -oldincludedir = @oldincludedir@ -prefix = @prefix@ -program_transform_name = @program_transform_name@ -sbindir = @sbindir@ -sharedstatedir = @sharedstatedir@ -sysconfdir = @sysconfdir@ -target_alias = @target_alias@ -AUTOMAKE_OPTIONS = foreign no-dependencies -noinst_LIBRARIES = libspo.a -libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \ -spo_alert_full.c spo_alert_full.h \ -spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \ -spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \ -spo_log_null.c spo_log_null.h spo_log_tcpdump.c \ -spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ -spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ -spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ -spo_alert_test.c spo_alert_test.h \ -spo_pf.h spo_pf.c - -all: all-am - -.SUFFIXES: -.SUFFIXES: .c .lo .o .obj -$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps) - @for dep in $?; do \ - case '$(am__configure_deps)' in \ - *$$dep*) \ - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ - && exit 0; \ - exit 1;; \ - esac; \ - done; \ - echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/output-plugins/Makefile'; \ - cd $(top_srcdir) && \ - $(AUTOMAKE) --foreign src/output-plugins/Makefile -.PRECIOUS: Makefile -Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status - @case '$?' in \ - *config.status*) \ - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ - *) \ - echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ - cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ - esac; - -$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh - -$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps) - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh - -clean-noinstLIBRARIES: - -test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES) -libspo.a: $(libspo_a_OBJECTS) $(libspo_a_DEPENDENCIES) - -rm -f libspo.a - $(libspo_a_AR) libspo.a $(libspo_a_OBJECTS) $(libspo_a_LIBADD) - $(RANLIB) libspo.a - -mostlyclean-compile: - -rm -f *.$(OBJEXT) - -distclean-compile: - -rm -f *.tab.c - -.c.o: - $(COMPILE) -c $< - -.c.obj: - $(COMPILE) -c `$(CYGPATH_W) '$<'` - -.c.lo: - $(LTCOMPILE) -c -o $@ $< - -mostlyclean-libtool: - -rm -f *.lo - -clean-libtool: - -rm -rf .libs _libs - -distclean-libtool: - -rm -f libtool -uninstall-info-am: - -ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) - list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ - unique=`for i in $$list; do \ - if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ - done | \ - $(AWK) ' { files[$$0] = 1; } \ - END { for (i in files) print i; }'`; \ - mkid -fID $$unique -tags: TAGS - -TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ - $(TAGS_FILES) $(LISP) - tags=; \ - here=`pwd`; \ - list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ - unique=`for i in $$list; do \ - if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ - done | \ - $(AWK) ' { files[$$0] = 1; } \ - END { for (i in files) print i; }'`; \ - if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \ - test -n "$$unique" || unique=$$empty_fix; \ - $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ - $$tags $$unique; \ - fi -ctags: CTAGS -CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ - $(TAGS_FILES) $(LISP) - tags=; \ - here=`pwd`; \ - list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ - unique=`for i in $$list; do \ - if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ - done | \ - $(AWK) ' { files[$$0] = 1; } \ - END { for (i in files) print i; }'`; \ - test -z "$(CTAGS_ARGS)$$tags$$unique" \ - || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ - $$tags $$unique - -GTAGS: - here=`$(am__cd) $(top_builddir) && pwd` \ - && cd $(top_srcdir) \ - && gtags -i $(GTAGS_ARGS) $$here - -distclean-tags: - -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags - -distdir: $(DISTFILES) - @srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \ - topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \ - list='$(DISTFILES)'; for file in $$list; do \ - case $$file in \ - $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \ - $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \ - esac; \ - if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ - dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \ - if test "$$dir" != "$$file" && test "$$dir" != "."; then \ - dir="/$$dir"; \ - $(mkdir_p) "$(distdir)$$dir"; \ - else \ - dir=''; \ - fi; \ - if test -d $$d/$$file; then \ - if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ - cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \ - fi; \ - cp -pR $$d/$$file $(distdir)$$dir || exit 1; \ - else \ - test -f $(distdir)/$$file \ - || cp -p $$d/$$file $(distdir)/$$file \ - || exit 1; \ - fi; \ - done -check-am: all-am -check: check-am -all-am: Makefile $(LIBRARIES) -installdirs: -install: install-am -install-exec: install-exec-am -install-data: install-data-am -uninstall: uninstall-am - -install-am: all-am - @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am - -installcheck: installcheck-am -install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install -mostlyclean-generic: - -clean-generic: - -distclean-generic: - -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) - -maintainer-clean-generic: - @echo "This command is intended for maintainers to use" - @echo "it deletes files that may require special tools to rebuild." -clean: clean-am - -clean-am: clean-generic clean-libtool clean-noinstLIBRARIES \ - mostlyclean-am - -distclean: distclean-am - -rm -f Makefile -distclean-am: clean-am distclean-compile distclean-generic \ - distclean-libtool distclean-tags - -dvi: dvi-am - -dvi-am: - -html: html-am - -info: info-am - -info-am: - -install-data-am: - -install-exec-am: - -install-info: install-info-am - -install-man: - -installcheck-am: - -maintainer-clean: maintainer-clean-am - -rm -f Makefile -maintainer-clean-am: distclean-am maintainer-clean-generic - -mostlyclean: mostlyclean-am - -mostlyclean-am: mostlyclean-compile mostlyclean-generic \ - mostlyclean-libtool - -pdf: pdf-am - -pdf-am: - -ps: ps-am - -ps-am: - -uninstall-am: uninstall-info-am - -.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \ - clean-libtool clean-noinstLIBRARIES ctags distclean \ - distclean-compile distclean-generic distclean-libtool \ - distclean-tags distdir dvi dvi-am html html-am info info-am \ - install install-am install-data install-data-am install-exec \ - install-exec-am install-info install-info-am install-man \ - install-strip installcheck installcheck-am installdirs \ - maintainer-clean maintainer-clean-generic mostlyclean \ - mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ - pdf pdf-am ps ps-am tags uninstall uninstall-am \ - uninstall-info-am - -# Tell versions [3.59,3.63) of GNU make to not export all variables. -# Otherwise a system limit (for SysV at least) may be exceeded. -.NOEXPORT: diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c b/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c deleted file mode 100644 index 31f381a8..00000000 --- a/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c +++ /dev/null @@ -1,1544 +0,0 @@ -/* $Id$ */ -/* -** Copyright (C) 2002-2010 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -*/ - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include -#include - -#ifdef HAVE_STRINGS_H -#include -#endif - -#ifndef WIN32 -#include -#include -#include -#endif /* !WIN32 */ -#include -#include - -#include "sf_types.h" -#include "plugbase.h" -#include "spo_plugbase.h" -#include "snort.h" -#include "debug.h" -#include "util.h" -#include "log.h" -#include "detect.h" - -/* built-in preprocessors */ -#include "preprocessors/spp_rpc_decode.h" -#include "preprocessors/spp_bo.h" -#include "preprocessors/spp_stream5.h" -#include "preprocessors/spp_arpspoof.h" -#include "preprocessors/spp_perfmonitor.h" -#include "preprocessors/spp_httpinspect.h" -#include "preprocessors/spp_sfportscan.h" -#include "preprocessors/spp_frag3.h" - -/* built-in detection plugins */ -#include "detection-plugins/sp_pattern_match.h" -#include "detection-plugins/sp_tcp_flag_check.h" -#include "detection-plugins/sp_icmp_type_check.h" -#include "detection-plugins/sp_icmp_code_check.h" -#include "detection-plugins/sp_ttl_check.h" -#include "detection-plugins/sp_ip_id_check.h" -#include "detection-plugins/sp_tcp_ack_check.h" -#include "detection-plugins/sp_tcp_seq_check.h" -#include "detection-plugins/sp_dsize_check.h" -#include "detection-plugins/sp_ipoption_check.h" -#include "detection-plugins/sp_rpc_check.h" -#include "detection-plugins/sp_icmp_id_check.h" -#include "detection-plugins/sp_icmp_seq_check.h" -#include "detection-plugins/sp_session.h" -#include "detection-plugins/sp_ip_tos_check.h" -#include "detection-plugins/sp_ip_fragbits.h" -#include "detection-plugins/sp_tcp_win_check.h" -#include "detection-plugins/sp_ip_same_check.h" -#include "detection-plugins/sp_ip_proto.h" -#include "detection-plugins/sp_ip_same_check.h" -#include "detection-plugins/sp_clientserver.h" -#include "detection-plugins/sp_byte_check.h" -#include "detection-plugins/sp_byte_jump.h" -#include "detection-plugins/sp_isdataat.h" -#include "detection-plugins/sp_pcre.h" -#include "detection-plugins/sp_flowbits.h" -#include "detection-plugins/sp_file_data.h" -#include "detection-plugins/sp_asn1.h" -#ifdef ENABLE_REACT -#include "detection-plugins/sp_react.h" -#endif -#ifdef ENABLE_RESPOND -#include "detection-plugins/sp_respond.h" -#endif -#include "detection-plugins/sp_ftpbounce.h" -#include "detection-plugins/sp_urilen_check.h" -#include "detection-plugins/sp_cvs.h" - -/* built-in output plugins */ -#include "output-plugins/spo_alert_syslog.h" -#include "output-plugins/spo_log_tcpdump.h" -#include "output-plugins/spo_database.h" -#include "output-plugins/spo_alert_fast.h" -#include "output-plugins/spo_alert_full.h" -#include "output-plugins/spo_alert_unixsock.h" -#include "output-plugins/spo_csv.h" -#include "output-plugins/spo_unified.h" -#include "output-plugins/spo_log_null.h" -#include "output-plugins/spo_log_ascii.h" -#include "output-plugins/spo_unified2.h" -#include "output-plugins/spo_pf.h" - -#ifdef ARUBA -#include "output-plugins/spo_alert_arubaaction.h" -#endif - -#ifdef HAVE_LIBPRELUDE -#include "output-plugins/spo_alert_prelude.h" -#endif - -#ifdef LINUX -#include "output-plugins/spo_alert_sf_socket.h" -#endif - -#include "output-plugins/spo_alert_test.h" - -extern ListHead *head_tmp; -extern PreprocConfigFuncNode *preproc_config_funcs; -extern OutputConfigFuncNode *output_config_funcs; -extern RuleOptConfigFuncNode *rule_opt_config_funcs; -extern RuleOptOverrideInitFuncNode *rule_opt_override_init_funcs; -extern RuleOptParseCleanupNode *rule_opt_parse_cleanup_list; -extern PreprocSignalFuncNode *preproc_restart_funcs; -extern PreprocSignalFuncNode *preproc_clean_exit_funcs; -extern PreprocSignalFuncNode *preproc_shutdown_funcs; -extern PreprocSignalFuncNode *preproc_reset_funcs; -extern PreprocSignalFuncNode *preproc_reset_stats_funcs; -extern PreprocStatsFuncNode *preproc_stats_funcs; -extern PluginSignalFuncNode *plugin_shutdown_funcs; -extern PluginSignalFuncNode *plugin_clean_exit_funcs; -extern PluginSignalFuncNode *plugin_restart_funcs; -extern OutputFuncNode *AlertList; -extern OutputFuncNode *LogList; - - -/**************************** Detection Plugin API ****************************/ -/* For translation from enum to char* */ -#ifdef DEBUG -static const char *optTypeMap[OPT_TYPE_MAX] = -{ - "action", - "logging", - "detection" -}; - -#define ENUM2STR(num, map) \ - ((num < sizeof(map)/sizeof(map[0])) ? map[num] : "undefined") -#endif - - -void RegisterRuleOptions(void) -{ - LogMessage("Initializing Plug-ins!\n"); - - SetupPatternMatch(); - SetupTCPFlagCheck(); - SetupIcmpTypeCheck(); - SetupIcmpCodeCheck(); - SetupTtlCheck(); - SetupIpIdCheck(); - SetupTcpAckCheck(); - SetupTcpSeqCheck(); - SetupDsizeCheck(); - SetupIpOptionCheck(); - SetupRpcCheck(); - SetupIcmpIdCheck(); - SetupIcmpSeqCheck(); - SetupSession(); - SetupIpTosCheck(); - SetupFragBits(); - SetupFragOffset(); - SetupTcpWinCheck(); - SetupIpProto(); - SetupIpSameCheck(); - SetupClientServer(); - SetupByteTest(); - SetupByteJump(); - SetupIsDataAt(); - SetupFileData(); - SetupPcre(); - SetupFlowBits(); - SetupAsn1(); -#ifdef ENABLE_REACT - SetupReact(); -#endif -#ifdef ENABLE_RESPOND - SetupRespond(); -#endif - SetupFTPBounce(); - SetupUriLenCheck(); - SetupCvs(); -} - -/**************************************************************************** - * - * Function: RegisterRuleOption(char *, void (*func)(), enum OptionType) - * - * Purpose: Associates a rule option keyword with an option setup/linking - * function. - * - * Arguments: keyword => The option keyword to associate with the option - * handler - * *func => function pointer to the handler - * type => used to determine where keyword is allowed - * - * Returns: void function - * - ***************************************************************************/ -void RegisterRuleOption(char *opt_name, RuleOptConfigFunc config_func, - RuleOptOverrideInitFunc override_init_func, - RuleOptType opt_type, - RuleOptOtnHandler otn_handler) -{ - RuleOptConfigFuncNode *node; - - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Registering keyword:func => %s/%s:%p\n", - ENUM2STR(opt_type, optTypeMap), opt_name, config_func);); - - node = (RuleOptConfigFuncNode *)SnortAlloc(sizeof(RuleOptConfigFuncNode)); - - if (rule_opt_config_funcs == NULL) - { - rule_opt_config_funcs = node; - } - else - { - RuleOptConfigFuncNode *tmp = rule_opt_config_funcs; - RuleOptConfigFuncNode *last; - - do - { - if (strcasecmp(tmp->keyword, opt_name) == 0) - { - free(node); - FatalError("Duplicate detection plugin keyword: %s.\n", - file_line, opt_name); - } - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - last->next = node; - } - - node->keyword = SnortStrdup(opt_name); - node->type = opt_type; - node->func = config_func; - node->otn_handler = otn_handler; - - if (override_init_func != NULL) - { - RuleOptOverrideInitFuncNode *node_override = - (RuleOptOverrideInitFuncNode *)SnortAlloc(sizeof(RuleOptOverrideInitFuncNode)); - - if (rule_opt_override_init_funcs == NULL) - { - rule_opt_override_init_funcs = node_override; - } - else - { - RuleOptOverrideInitFuncNode *tmp = rule_opt_override_init_funcs; - RuleOptOverrideInitFuncNode *last; - - do - { - if (strcasecmp(tmp->keyword, opt_name) == 0) - { - free(node_override); - FatalError("RegisterRuleOption: Duplicate detection plugin keyword:" - " (%s) (%s)!\n", tmp->keyword, opt_name); - } - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - last->next = node_override; - } - - node_override->keyword = SnortStrdup(opt_name); - node_override->type = opt_type; - node_override->func = override_init_func; - node_override->otn_handler = otn_handler; - } -} - -void RegisterOverrideKeyword(char *keyword, char *option, RuleOptOverrideFunc func) -{ - RuleOptOverrideInitFuncNode *node = rule_opt_override_init_funcs; - - while (node != NULL) - { - if (strcasecmp(node->keyword, keyword) == 0) - { - node->func(keyword, option, func); - break; - } - - node = node->next; - } -} - -/**************************************************************************** - * - * Function: DumpPlugIns() - * - * Purpose: Prints the keyword->function list - * - * Arguments: None. - * - * Returns: void function - * - ***************************************************************************/ -void DumpRuleOptions(void) -{ - RuleOptConfigFuncNode *node; - - node = rule_opt_config_funcs; - - LogMessage("-------------------------------------------------\n"); - LogMessage(" Keyword | Plugin Registered @\n"); - LogMessage("-------------------------------------------------\n"); - - while (node != NULL) - { - LogMessage("%-13s: %p\n", node->keyword, node->func); - node = node->next; - } - - LogMessage("-------------------------------------------------\n"); - LogMessage("\n"); -} - - -/**************************************************************************** - * - * Function: AddOptFuncToList(int (*func)(), OptTreeNode *) - * - * Purpose: Links the option detection module to the OTN - * - * Arguments: (*func)() => function pointer to the detection module - * otn => pointer to the current OptTreeNode - * - * Returns: void function - * - ***************************************************************************/ -OptFpList * AddOptFuncToList(RuleOptEvalFunc func, OptTreeNode *otn) -{ - OptFpList *ofp = (OptFpList *)SnortAlloc(sizeof(OptFpList)); - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n");); - - /* if there are no nodes on the function list... */ - if (otn->opt_func == NULL) - { - otn->opt_func = ofp; - } - else - { - OptFpList *tmp = otn->opt_func; - - /* walk to the end of the list */ - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = ofp; - } - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", func);); - - ofp->OptTestFunc = func; - - return ofp; -} - -/**************************************************************************** - * - * Function: AddRspFuncToList(int (*func)(), OptTreeNode *) - * - * Purpose: Adds Response function to OTN - * - * Arguments: (*func)() => function pointer to the response module - * otn => pointer to the current OptTreeNode - * - * Returns: void function - * - ***************************************************************************/ -void AddRspFuncToList(ResponseFunc func, OptTreeNode *otn, void *params) -{ - RspFpList *rsp = (RspFpList *)SnortAlloc(sizeof(RspFpList)); - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding response to list\n");); - - /* if there are no nodes on the function list... */ - if (otn->rsp_func == NULL) - { - otn->rsp_func = rsp; - } - else - { - RspFpList *tmp = otn->rsp_func; - - /* walk to the end of the list */ - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = rsp; - } - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set ResponseFunc to %p\n", func);); - - rsp->func = func; - rsp->params = params; -} - -void PostConfigInitPlugins(PluginSignalFuncNode *post_config_funcs) -{ - while (post_config_funcs != NULL) - { - post_config_funcs->func(0, post_config_funcs->arg); - post_config_funcs = post_config_funcs->next; - } -} - -void FreeRuleOptConfigFuncs(RuleOptConfigFuncNode *head) -{ - - while (head != NULL) - { - RuleOptConfigFuncNode *tmp = head; - - head = head->next; - - if (tmp->keyword != NULL) - free(tmp->keyword); - - free(tmp); - } -} - -void FreeRuleOptOverrideInitFuncs(RuleOptOverrideInitFuncNode *head) -{ - - while (head != NULL) - { - RuleOptOverrideInitFuncNode *tmp = head; - - head = head->next; - - if (tmp->keyword != NULL) - free(tmp->keyword); - - free(tmp); - } -} - -void FreePluginSigFuncs(PluginSignalFuncNode *head) -{ - while (head != NULL) - { - PluginSignalFuncNode *tmp = head; - - head = head->next; - - /* don't free sig->arg, that's free'd by the CleanExit/Restart func */ - free(tmp); - } -} - - -/************************** Preprocessor Plugin API ***************************/ -static void AddFuncToPreprocSignalList(PreprocSignalFunc, void *, - PreprocSignalFuncNode **, uint16_t, uint32_t); - - -void RegisterPreprocessors(void) -{ - LogMessage("Initializing Preprocessors!\n"); - - SetupARPspoof(); - SetupFrag3(); - SetupStream5(); - SetupRpcDecode(); - SetupBo(); - SetupHttpInspect(); - SetupPerfMonitor(); - SetupSfPortscan(); -} - -/**************************************************************************** - * - * Function: RegisterPreprocessor(char *, void (*)(char *)) - * - * Purpose: Associates a preprocessor statement with its function. - * - * Arguments: keyword => The option keyword to associate with the - * preprocessor - * *func => function pointer to the handler - * - * Returns: void function - * - ***************************************************************************/ -#ifndef SNORT_RELOAD -void RegisterPreprocessor(char *keyword, PreprocConfigFunc func) -#else -void RegisterPreprocessor(char *keyword, PreprocConfigFunc func, - PreprocReloadFunc rfunc, PreprocReloadSwapFunc sfunc, - PreprocReloadSwapFreeFunc ffunc) -#endif -{ - PreprocConfigFuncNode *node = - (PreprocConfigFuncNode *)SnortAlloc(sizeof(PreprocConfigFuncNode)); - - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:preproc => %s:%p\n", keyword, func);); - - if (preproc_config_funcs == NULL) - { - preproc_config_funcs = node; - } - else - { - PreprocConfigFuncNode *tmp = preproc_config_funcs; - PreprocConfigFuncNode *last; - - do - { - if (strcasecmp(tmp->keyword, keyword) == 0) - { - free(node); - FatalError("Duplicate preprocessor keyword: %s.\n", keyword); - } - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - last->next = node; - } - - node->keyword = SnortStrdup(keyword); - node->config_func = func; - -#ifdef SNORT_RELOAD - node->reload_func = rfunc; - node->reload_swap_func = sfunc; - node->reload_swap_free_func = ffunc; -#endif -} - -PreprocConfigFuncNode * GetPreprocConfig(char *keyword) -{ - PreprocConfigFuncNode *head = preproc_config_funcs; - - if (keyword == NULL) - return NULL; - - while (head != NULL) - { - if (strcasecmp(head->keyword, keyword) == 0) - return head; - - head = head->next; - } - - return NULL; -} - -PreprocConfigFunc GetPreprocConfigFunc(char *keyword) -{ - PreprocConfigFuncNode *head = preproc_config_funcs; - - if (keyword == NULL) - return NULL; - - while (head != NULL) - { - if (strcasecmp(head->keyword, keyword) == 0) - return head->config_func; - - head = head->next; - } - - return NULL; -} - -/**************************************************************************** - * - * Function: RegisterPreprocStats(char *keyword, void (*func)(int)) - * - * Purpose: Registers a function for printing preprocessor final stats - * (or other if it has a use for printing final stats) - * - * Arguments: keyword => keyword (preprocessor) whose stats will print - * func => function pointer to the handler - * - * Returns: void function - * - ***************************************************************************/ -void RegisterPreprocStats(char *keyword, PreprocStatsFunc func) -{ - PreprocStatsFuncNode *node; - - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering final stats function: " - "preproc => %s:%p\n", keyword, func);); - - node = (PreprocStatsFuncNode *)SnortAlloc(sizeof(PreprocStatsFuncNode)); - - if (preproc_stats_funcs == NULL) - { - preproc_stats_funcs = node; - } - else - { - PreprocStatsFuncNode *tmp = preproc_stats_funcs; - PreprocStatsFuncNode *last; - - do - { - if (strcasecmp(tmp->keyword, keyword) == 0) - { - free(node); - FatalError("Duplicate preprocessor keyword: %s.\n", keyword); - } - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - last->next = node; - } - - node->keyword = SnortStrdup(keyword); - node->func = func; -} - -/**************************************************************************** - * - * Function: DumpPreprocessors() - * - * Purpose: Prints the keyword->preprocess list - * - * Arguments: None. - * - * Returns: void function - * - ***************************************************************************/ -void DumpPreprocessors(void) -{ - PreprocConfigFuncNode *node = preproc_config_funcs; - - LogMessage("-------------------------------------------------\n"); - LogMessage(" Keyword | Preprocessor @ \n"); - LogMessage("-------------------------------------------------\n"); - - while (node != NULL) - { - LogMessage("%-13s: %p\n", node->keyword, node->config_func); - node = node->next; - } - - LogMessage("-------------------------------------------------\n\n"); -} - -int IsPreprocEnabled(uint32_t preproc_id) -{ - PreprocEvalFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - tSfPolicyId policy_id = getParserPolicy(); - SnortPolicy *p; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - p = sc->targeted_policies[policy_id]; - if (p == NULL) - return 0; - - for (node = p->preproc_eval_funcs; node != NULL; node = node->next) - { - if (node->preproc_id == preproc_id) - return 1; - } - - return 0; -} - -PreprocEvalFuncNode * AddFuncToPreprocList(PreprocEvalFunc func, uint16_t priority, - uint32_t preproc_id, uint32_t proto_mask) -{ - PreprocEvalFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - tSfPolicyId policy_id = getParserPolicy(); - SnortPolicy *p; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - p = sc->targeted_policies[policy_id]; - if (p == NULL) - return NULL; - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, - "Adding preprocessor function ID %d/bit %d/pri %d to list\n", - preproc_id, p->num_preprocs, priority);); - - node = (PreprocEvalFuncNode *)SnortAlloc(sizeof(PreprocEvalFuncNode)); - - if (p->preproc_eval_funcs == NULL) - { - p->preproc_eval_funcs = node; - } - else - { - PreprocEvalFuncNode *tmp = p->preproc_eval_funcs; - PreprocEvalFuncNode *last = NULL; - - do - { - if (tmp->preproc_id == preproc_id) - { - free(node); - FatalError("Preprocessor already registered with ID %d\n", - preproc_id); - } - - /* Insert higher priority preprocessors first. Lower priority - * number means higher priority */ - if (priority < tmp->priority) - break; - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - /* Priority higher than first item in list */ - if (last == NULL) - { - node->next = tmp; - p->preproc_eval_funcs = node; - } - else - { - node->next = tmp; - last->next = node; - } - } - - node->func = func; - node->priority = priority; - node->preproc_id = preproc_id; - node->preproc_bit = (1 << preproc_id); - node->proto_mask = proto_mask; - - p->num_preprocs++; - p->preproc_proto_mask |= proto_mask; - p->preproc_bit_mask |= node->preproc_bit; - - return node; -} - -void AddFuncToPreprocPostConfigList(PreprocPostConfigFunc func, void *data) -{ - PreprocPostConfigFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - node = (PreprocPostConfigFuncNode *)SnortAlloc(sizeof(PreprocPostConfigFuncNode)); - - if (sc->preproc_post_config_funcs == NULL) - { - sc->preproc_post_config_funcs = node; - } - else - { - PreprocPostConfigFuncNode *tmp = sc->preproc_post_config_funcs; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->data = data; - node->func = func; -} - -void PostConfigPreprocessors(SnortConfig *sc) -{ - PreprocPostConfigFuncNode *list; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config is NULL.\n", - __FILE__, __LINE__); - } - - snort_conf_for_parsing = sc; - - list = sc->preproc_post_config_funcs; - - for (; list != NULL; list = list->next) - { - if (list->func != NULL) - list->func(list->data); - } - - snort_conf_for_parsing = NULL; -} - -#ifdef SNORT_RELOAD -void SwapPreprocConfigurations(void) -{ - PreprocConfigFuncNode *node = preproc_config_funcs; - - for (; node != NULL; node = node->next) - { - if (node->reload_swap_func != NULL) - node->swap_free_data = node->reload_swap_func(); - } -} - -void FreeSwappedPreprocConfigurations(void) -{ - PreprocConfigFuncNode *node = preproc_config_funcs; - - for (; node != NULL; node = node->next) - { - if ((node->reload_swap_free_func != NULL) && - (node->swap_free_data != NULL)) - { - node->reload_swap_free_func(node->swap_free_data); - node->swap_free_data = NULL; - } - } -} - -void AddFuncToPreprocReloadVerifyList(PreprocReloadVerifyFunc func) -{ - PreprocReloadVerifyFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - node = (PreprocReloadVerifyFuncNode *)SnortAlloc(sizeof(PreprocReloadVerifyFuncNode)); - - if (sc->preproc_reload_verify_funcs == NULL) - { - sc->preproc_reload_verify_funcs = node; - } - else - { - PreprocReloadVerifyFuncNode *tmp = sc->preproc_reload_verify_funcs; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->func = func; -} - -void FreePreprocReloadVerifyFuncList(PreprocReloadVerifyFuncNode *head) -{ - while (head != NULL) - { - PreprocReloadVerifyFuncNode *tmp = head; - - head = head->next; - free(tmp); - } -} -#endif - -void AddFuncToConfigCheckList(PreprocCheckConfigFunc func) -{ - PreprocCheckConfigFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - node = (PreprocCheckConfigFuncNode *)SnortAlloc(sizeof(PreprocCheckConfigFuncNode)); - - if (sc->preproc_config_check_funcs == NULL) - { - sc->preproc_config_check_funcs = node; - } - else - { - PreprocCheckConfigFuncNode *tmp = sc->preproc_config_check_funcs; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->func = func; -} - -/* functions to aid in cleaning up after plugins */ -void AddFuncToPreprocRestartList(PreprocSignalFunc func, void *arg, - uint16_t priority, uint32_t preproc_id) -{ - AddFuncToPreprocSignalList(func, arg, &preproc_restart_funcs, priority, preproc_id); -} - -void AddFuncToPreprocCleanExitList(PreprocSignalFunc func, void *arg, - uint16_t priority, uint32_t preproc_id) -{ - AddFuncToPreprocSignalList(func, arg, &preproc_clean_exit_funcs, priority, preproc_id); -} - -void AddFuncToPreprocShutdownList(PreprocSignalFunc func, void *arg, - uint16_t priority, uint32_t preproc_id) -{ - AddFuncToPreprocSignalList(func, arg, &preproc_shutdown_funcs, priority, preproc_id); -} - -void AddFuncToPreprocResetList(PreprocSignalFunc func, void *arg, - uint16_t priority, uint32_t preproc_id) -{ - AddFuncToPreprocSignalList(func, arg, &preproc_reset_funcs, priority, preproc_id); -} - -void AddFuncToPreprocResetStatsList(PreprocSignalFunc func, void *arg, - uint16_t priority, uint32_t preproc_id) -{ - AddFuncToPreprocSignalList(func, arg, &preproc_reset_stats_funcs, priority, preproc_id); -} - -static void AddFuncToPreprocSignalList(PreprocSignalFunc func, void *arg, - PreprocSignalFuncNode **list, - uint16_t priority, uint32_t preproc_id) -{ - PreprocSignalFuncNode *node; - - if (list == NULL) - return; - - node = (PreprocSignalFuncNode *)SnortAlloc(sizeof(PreprocSignalFuncNode)); - - if (*list == NULL) - { - *list = node; - } - else - { - PreprocSignalFuncNode *tmp = *list; - PreprocSignalFuncNode *last = NULL; - - do - { - /* Insert higher priority stuff first. Lower priority - * number means higher priority */ - if (priority < tmp->priority) - break; - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - /* Priority higher than first item in list */ - if (last == NULL) - { - node->next = tmp; - *list = node; - } - else - { - node->next = tmp; - last->next = node; - } - } - - node->func = func; - node->arg = arg; - node->preproc_id = preproc_id; - node->priority = priority; -} - -void AddFuncToPreprocReassemblyPktList(PreprocReassemblyPktFunc func, uint32_t preproc_id) -{ - PreprocReassemblyPktFuncNode *node; - SnortConfig *sc = snort_conf_for_parsing; - tSfPolicyId policy_id = getParserPolicy(); - SnortPolicy *p; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - p = sc->targeted_policies[policy_id]; - if (p == NULL) - return; - - node = (PreprocReassemblyPktFuncNode *)SnortAlloc(sizeof(PreprocReassemblyPktFuncNode)); - - if (p->preproc_reassembly_pkt_funcs == NULL) - { - p->preproc_reassembly_pkt_funcs = node; - } - else - { - PreprocReassemblyPktFuncNode *tmp = p->preproc_reassembly_pkt_funcs; - - /* just insert at front of list */ - p->preproc_reassembly_pkt_funcs = node; - node->next = tmp; - } - - node->func = func; - node->preproc_id = preproc_id; -} - -void FreePreprocConfigFuncs(void) -{ - PreprocConfigFuncNode *head = preproc_config_funcs; - PreprocConfigFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - if (head->keyword != NULL) - free(head->keyword); - free(head); - head = tmp; - } -} - -void FreePreprocCheckConfigFuncs(PreprocCheckConfigFuncNode *head) -{ - PreprocCheckConfigFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - free(head); - head = tmp; - } -} - -void FreePreprocPostConfigFuncs(PreprocPostConfigFuncNode *head) -{ - PreprocPostConfigFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - free(head); - head = tmp; - } -} - -void FreePreprocStatsFuncs(PreprocStatsFuncNode *head) -{ - PreprocStatsFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - if (head->keyword != NULL) - free(head->keyword); - free(head); - head = tmp; - } -} - -void FreePreprocEvalFuncs(PreprocEvalFuncNode *head) -{ - PreprocEvalFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - //if (head->context) - // free(head->context); - free(head); - head = tmp; - } -} - -void FreePreprocReassemblyPktFuncs(PreprocReassemblyPktFuncNode *head) -{ - PreprocReassemblyPktFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - free(head); - head = tmp; - } -} - -void FreePreprocSigFuncs(PreprocSignalFuncNode *head) -{ - PreprocSignalFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - /* don't free sig->arg, that's free'd by the CleanExit/Restart func */ - free(head); - head = tmp; - } -} - -void CheckPreprocessorsConfig(SnortConfig *sc) -{ - PreprocCheckConfigFuncNode *idx; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config is NULL.\n", - __FILE__, __LINE__); - } - - snort_conf_for_parsing = sc; - - idx = sc->preproc_config_check_funcs; - - LogMessage("Verifying Preprocessor Configurations!\n"); - - while(idx != NULL) - { - idx->func(); - idx = idx->next; - } - - snort_conf_for_parsing = NULL; -} - -#ifdef SNORT_RELOAD -int VerifyReloadedPreprocessors(SnortConfig *sc) -{ - PreprocReloadVerifyFuncNode *node; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config is NULL.\n", - __FILE__, __LINE__); - } - - snort_conf_for_parsing = sc; - - node = sc->preproc_reload_verify_funcs; - while (node != NULL) - { - if (node->func != NULL) - { - if (node->func() == -1) - return -1; - } - - node = node->next; - } - - snort_conf_for_parsing = NULL; - - return 0; -} -#endif - - -/***************************** Output Plugin API *****************************/ -extern OutputConfigFuncNode *output_config_funcs; - -static void AppendOutputFuncList(OutputFunc, void *, OutputFuncNode **); - -void RegisterOutputPlugins(void) -{ - LogMessage("Initializing Output Plugins!\n"); - - AlertSyslogSetup(); - LogTcpdumpSetup(); - DatabaseSetup(); - AlertFastSetup(); - AlertFullSetup(); - AlertPfSetup(); -#ifndef WIN32 - /* Win32 doesn't support AF_UNIX sockets */ - AlertUnixSockSetup(); -#endif /* !WIN32 */ - AlertCSVSetup(); - LogNullSetup(); - UnifiedSetup(); - Unified2Setup(); - LogAsciiSetup(); - -#ifdef ARUBA - AlertArubaActionSetup(); -#endif - -#ifdef LINUX - /* This uses linux only capabilities */ - AlertSFSocket_Setup(); -#endif - -#ifdef HAVE_LIBPRELUDE - AlertPreludeSetup(); -#endif - - AlertTestSetup(); -} - -/**************************************************************************** - * - * Function: RegisterOutputPlugin(char *, void (*func)(Packet *, u_char *)) - * - * Purpose: Associates an output statement with its function. - * - * Arguments: keyword => The output keyword to associate with the - * output processor - * type => alert or log types - * *func => function pointer to the handler - * - * Returns: void function - * - ***************************************************************************/ -void RegisterOutputPlugin(char *keyword, int type_flags, OutputConfigFunc func) -{ - OutputConfigFuncNode *node = (OutputConfigFuncNode *)SnortAlloc(sizeof(OutputConfigFuncNode)); - - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:output => %s:%p\n", - keyword, func);); - - if (output_config_funcs == NULL) - { - output_config_funcs = node; - } - else - { - OutputConfigFuncNode *tmp = output_config_funcs; - OutputConfigFuncNode *last; - - do - { - if (strcasecmp(tmp->keyword, keyword) == 0) - { - free(node); - FatalError("Duplicate output keyword: %s\n", keyword); - } - - last = tmp; - tmp = tmp->next; - - } while (tmp != NULL); - - last->next = node; - } - - node->keyword = SnortStrdup(keyword); - node->func = func; - node->output_type_flags = type_flags; -} - -OutputConfigFunc GetOutputConfigFunc(char *keyword) -{ - OutputConfigFuncNode *head = output_config_funcs; - - if (keyword == NULL) - return NULL; - - while (head != NULL) - { - if (strcasecmp(head->keyword, keyword) == 0) - return head->func; - - head = head->next; - } - - return NULL; -} - -int GetOutputTypeFlags(char *keyword) -{ - OutputConfigFuncNode *head = output_config_funcs; - - if (keyword == NULL) - return 0; - - while (head != NULL) - { - if (strcasecmp(head->keyword, keyword) == 0) - return head->output_type_flags; - - head = head->next; - } - - return 0; -} - -void FreeOutputConfigFuncs(void) -{ - OutputConfigFuncNode *head = output_config_funcs; - OutputConfigFuncNode *tmp; - - while (head != NULL) - { - tmp = head->next; - if (head->keyword != NULL) - free(head->keyword); - free(head); - head = tmp; - } -} - -void FreeOutputList(OutputFuncNode *list) -{ - while (list != NULL) - { - OutputFuncNode *tmp = list; - - list = list->next; - free(tmp); - } -} - -/**************************************************************************** - * - * Function: DumpOutputPlugins() - * - * Purpose: Prints the keyword->preprocess list - * - * Arguments: None. - * - * Returns: void function - * - ***************************************************************************/ -void DumpOutputPlugins(void) -{ - OutputConfigFuncNode *idx = output_config_funcs; - - LogMessage("-------------------------------------------------\n"); - LogMessage(" Keyword | Output @ \n"); - LogMessage("-------------------------------------------------\n"); - while(idx != NULL) - { - LogMessage("%-13s: %p\n", idx->keyword, idx->func); - idx = idx->next; - } - LogMessage("-------------------------------------------------\n\n"); -} - -void AddFuncToOutputList(OutputFunc func, OutputType type, void *arg) -{ - switch (type) - { - case OUTPUT_TYPE__ALERT: - if (head_tmp != NULL) - AppendOutputFuncList(func, arg, &head_tmp->AlertList); - else - AppendOutputFuncList(func, arg, &AlertList); - - break; - - case OUTPUT_TYPE__LOG: - if (head_tmp != NULL) - AppendOutputFuncList(func, arg, &head_tmp->LogList); - else - AppendOutputFuncList(func, arg, &LogList); - - break; - - default: - /* just to be error-prone */ - FatalError("Unknown output type: %i. Possible bug, please " - "report.\n", type); - } -} - -void AppendOutputFuncList(OutputFunc func, void *arg, OutputFuncNode **list) -{ - OutputFuncNode *node; - - if (list == NULL) - return; - - node = (OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode)); - - if (*list == NULL) - { - *list = node; - } - else - { - OutputFuncNode *tmp = *list; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->func = func; - node->arg = arg; -} - - -/************************** Miscellaneous Functions **************************/ - -/* functions to aid in cleaning up after plugins - * Used for both rule options and output. Preprocessors have their own */ -void AddFuncToRestartList(PluginSignalFunc func, void *arg) -{ - AddFuncToSignalList(func, arg, &plugin_restart_funcs); -} - -void AddFuncToCleanExitList(PluginSignalFunc func, void *arg) -{ - AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs); -} - -void AddFuncToShutdownList(PluginSignalFunc func, void *arg) -{ - AddFuncToSignalList(func, arg, &plugin_shutdown_funcs); -} - -void AddFuncToPostConfigList(PluginSignalFunc func, void *arg) -{ - SnortConfig *sc = snort_conf_for_parsing; - - if (sc == NULL) - { - FatalError("%s(%d) Snort config for parsing is NULL.\n", - __FILE__, __LINE__); - } - - AddFuncToSignalList(func, arg, &sc->plugin_post_config_funcs); -} - -void AddFuncToSignalList(PluginSignalFunc func, void *arg, PluginSignalFuncNode **list) -{ - PluginSignalFuncNode *node; - - if (list == NULL) - return; - - node = (PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode)); - - if (*list == NULL) - { - *list = node; - } - else - { - PluginSignalFuncNode *tmp = *list; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->func = func; - node->arg = arg; -} - -void AddFuncToRuleOptParseCleanupList(RuleOptParseCleanupFunc func) -{ - RuleOptParseCleanupNode *node = - (RuleOptParseCleanupNode *)SnortAlloc(sizeof(RuleOptParseCleanupNode)); - - if (rule_opt_parse_cleanup_list == NULL) - { - rule_opt_parse_cleanup_list = node; - } - else - { - RuleOptParseCleanupNode *tmp = rule_opt_parse_cleanup_list; - - while (tmp->next != NULL) - tmp = tmp->next; - - tmp->next = node; - } - - node->func = func; -} - -void RuleOptParseCleanup(void) -{ - RuleOptParseCleanupNode *list = rule_opt_parse_cleanup_list; - - for (; list != NULL; list = list->next) - { - if (list->func != NULL) - list->func(); - } -} - -void FreeRuleOptParseCleanupList(RuleOptParseCleanupNode *head) -{ - while (head != NULL) - { - RuleOptParseCleanupNode *tmp = head; - - head = head->next; - free(tmp); - } -} - - diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/util.c b/config/orionids-dev/patches/spoink_patch/2.8.6/util.c deleted file mode 100644 index b2d3b38b..00000000 --- a/config/orionids-dev/patches/spoink_patch/2.8.6/util.c +++ /dev/null @@ -1,3233 +0,0 @@ -/* $Id$ */ -/* -** Copyright (C) 2002-2010 Sourcefire, Inc. -** Copyright (C) 2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -*/ - - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include - -#ifndef WIN32 -#include -#include -#include -#include -#include -#include -#endif /* !WIN32 */ - -#include -#include -#include -#include -#include -#include -#include - -#ifndef WIN32 -#include -#include -#include -#include -#endif /* !WIN32 */ - -#include - -#ifdef HAVE_STRINGS_H -#include -#endif - -#ifdef ZLIB -#include -#endif - -#include "snort.h" -#include "mstring.h" -#include "debug.h" -#include "util.h" -#include "parser.h" -#include "inline.h" -#include "build.h" -#include "plugbase.h" -#include "sf_types.h" -#include "sflsq.h" -#include "ipv6_port.h" - -#include "pcre.h" - -#include "mpse.h" - -#include "ppm.h" - -#ifdef TARGET_BASED -#include "sftarget_reader.h" -#endif - -#ifdef WIN32 -#include "win32/WIN32-Code/name.h" -#endif - -#include "stream5_common.h" - -#ifdef PATH_MAX -#define PATH_MAX_UTIL PATH_MAX -#else -#define PATH_MAX_UTIL 1024 -#endif /* PATH_MAX */ - -extern Stream5Stats s5stats; -extern int datalink; -extern pcap_t *pcap_handle; -extern PreprocStatsFuncNode *preproc_stats_funcs; - -static PcapPktStats pkt_stats; - -/* - * you may need to adjust this on the systems which don't have standard - * paths defined - */ -#ifndef _PATH_VARRUN -static char _PATH_VARRUN[STD_BUF]; -#endif - - -#ifdef NAME_MAX -#define NAME_MAX_UTIL NAME_MAX -#else -#define NAME_MAX_UTIL 256 -#endif /* NAME_MAX */ - -#define FILE_MAX_UTIL (PATH_MAX_UTIL + NAME_MAX_UTIL) - -/**************************************************************************** - * - * Function: CalcPct(uint64_t, uint64_t) - * - * Purpose: Calculate the percentage of a value compared to a total - * - * Arguments: cnt => the numerator in the equation - * total => the denominator in the calculation - * - * Returns: pct -> the percentage of cnt to value - * - ****************************************************************************/ -double CalcPct(uint64_t cnt, uint64_t total) -{ - double pct = 0.0; - - if (total == 0.0) - { - pct = (double)cnt; - } - else - { - pct = (double)cnt / (double)total; - } - - pct *= 100.0; - - return pct; -} - - -/**************************************************************************** - * - * Function: DisplayBanner() - * - * Purpose: Show valuable proggie info - * - * Arguments: None. - * - * Returns: 0 all the time - * - ****************************************************************************/ -int DisplayBanner(void) -{ - const char * info; - const char * pcre_ver; -#ifdef ZLIB - const char * zlib_ver; -#endif - - info = getenv("HOSTTYPE"); - if( !info ) - { - info=""; - } - - pcre_ver = pcre_version(); -#ifdef ZLIB - zlib_ver = zlib_version; -#endif - - LogMessage("\n"); - LogMessage(" ,,_ -*> Snort! <*-\n"); - LogMessage(" o\" )~ Version %s%s%s (Build %s) %s %s\n", - VERSION, -#ifdef SUP_IP6 - " IPv6", -#else - "", -#endif -#ifdef GRE - " GRE", -#else - "", -#endif - BUILD, -#ifdef GIDS - "inline", -#else - "", -#endif - info); - LogMessage(" '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team\n"); - LogMessage(" Copyright (C) 1998-2010 Sourcefire, Inc., et al.\n"); - LogMessage(" Using PCRE version: %s\n", pcre_ver); -#ifdef ZLIB - LogMessage(" Using ZLIB version: %s\n", zlib_ver); -#endif - LogMessage("\n"); - LogMessage(" ___ Built Date for Snort on Pfsense 2.0 is May 25 2010.\n"); - LogMessage(" ___/ f \\ Orion IPS Output Code Copyright (C) 2009-2010 Robert Zelaya.\n"); - LogMessage("/ p \\___/Sense\n"); - LogMessage("\\___/ \\\n"); - LogMessage(" \\___/ Using Snort.org dynamic plugins and Orion IPS source.\n"); - LogMessage("\n"); - - return 0; -} - - - -/**************************************************************************** - * - * Function: ts_print(register const struct, char *) - * - * Purpose: Generate a time stamp and stuff it in a buffer. This one has - * millisecond precision. Oh yeah, I ripped this code off from - * TCPdump, props to those guys. - * - * Arguments: timeval => clock struct coming out of libpcap - * timebuf => buffer to stuff timestamp into - * - * Returns: void function - * - ****************************************************************************/ -void ts_print(register const struct timeval *tvp, char *timebuf) -{ - register int s; - int localzone; - time_t Time; - struct timeval tv; - struct timezone tz; - struct tm *lt; /* place to stick the adjusted clock data */ - - /* if null was passed, we use current time */ - if(!tvp) - { - /* manual page (for linux) says tz is never used, so.. */ - bzero((char *) &tz, sizeof(tz)); - gettimeofday(&tv, &tz); - tvp = &tv; - } - - localzone = snort_conf->thiszone; - - /* - ** If we're doing UTC, then make sure that the timezone is correct. - */ - if (ScOutputUseUtc()) - localzone = 0; - - s = (tvp->tv_sec + localzone) % 86400; - Time = (tvp->tv_sec + localzone) - s; - - lt = gmtime(&Time); - - if (ScOutputIncludeYear()) - { - (void) SnortSnprintf(timebuf, TIMEBUF_SIZE, - "%02d/%02d/%02d-%02d:%02d:%02d.%06u ", - lt->tm_mon + 1, lt->tm_mday, lt->tm_year - 100, - s / 3600, (s % 3600) / 60, s % 60, - (u_int) tvp->tv_usec); - } - else - { - (void) SnortSnprintf(timebuf, TIMEBUF_SIZE, - "%02d/%02d-%02d:%02d:%02d.%06u ", lt->tm_mon + 1, - lt->tm_mday, s / 3600, (s % 3600) / 60, s % 60, - (u_int) tvp->tv_usec); - } -} - - - -/**************************************************************************** - * - * Function: gmt2local(time_t) - * - * Purpose: Figures out how to adjust the current clock reading based on the - * timezone you're in. Ripped off from TCPdump. - * - * Arguments: time_t => offset from GMT - * - * Returns: offset seconds from GMT - * - ****************************************************************************/ -int gmt2local(time_t t) -{ - register int dt, dir; - register struct tm *gmt, *loc; - struct tm sgmt; - - if(t == 0) - t = time(NULL); - - gmt = &sgmt; - *gmt = *gmtime(&t); - loc = localtime(&t); - - dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 + - (loc->tm_min - gmt->tm_min) * 60; - - dir = loc->tm_year - gmt->tm_year; - - if(dir == 0) - dir = loc->tm_yday - gmt->tm_yday; - - dt += dir * 24 * 60 * 60; - - return(dt); -} - - - - -/**************************************************************************** - * - * Function: copy_argv(u_char **) - * - * Purpose: Copies a 2D array (like argv) into a flat string. Stolen from - * TCPDump. - * - * Arguments: argv => 2D array to flatten - * - * Returns: Pointer to the flat string - * - ****************************************************************************/ -char *copy_argv(char **argv) -{ - char **p; - u_int len = 0; - char *buf; - char *src, *dst; - //void ftlerr(char *,...); - - p = argv; - if(*p == 0) - return 0; - - while(*p) - len += strlen(*p++) + 1; - - buf = (char *) calloc(1,len); - - if(buf == NULL) - { - FatalError("calloc() failed: %s\n", strerror(errno)); - } - p = argv; - dst = buf; - - while((src = *p++) != NULL) - { - while((*dst++ = *src++) != '\0'); - dst[-1] = ' '; - } - - dst[-1] = '\0'; - - /* Check for an empty string */ - dst = buf; - while (isspace((int)*dst)) - dst++; - - if (strlen(dst) == 0) - { - free(buf); - buf = NULL; - } - - return buf; -} - - -/**************************************************************************** - * - * Function: strip(char *) - * - * Purpose: Strips a data buffer of CR/LF/TABs. Replaces CR/LF's with - * NULL and TABs with spaces. - * - * Arguments: data => ptr to the data buf to be stripped - * - * Returns: void - * - * 3/7/07 - changed to return void - use strlen to get size of string - * - * Note that this function will turn all '\n' and '\r' into null chars - * so, e.g. 'Hello\nWorld\n' => 'Hello\x00World\x00' - * note that the string is now just 'Hello' and the length is shortened - * by more than just an ending '\n' or '\r' - ****************************************************************************/ -void strip(char *data) -{ - int size; - char *end; - char *idx; - - idx = data; - end = data + strlen(data); - size = end - idx; - - while(idx != end) - { - if((*idx == '\n') || - (*idx == '\r')) - { - *idx = 0; - size--; - } - if(*idx == '\t') - { - *idx = ' '; - } - idx++; - } -} - -/* - * Function: ErrorMessage(const char *, ...) - * - * Purpose: Print a message to stderr. - * - * Arguments: format => the formatted error string to print out - * ... => format commands/fillers - * - * Returns: void function - */ -void ErrorMessage(const char *format,...) -{ - char buf[STD_BUF+1]; - va_list ap; - - if (snort_conf == NULL) - return; - - va_start(ap, format); - - if (ScDaemonMode() || ScLogSyslog()) - { - vsnprintf(buf, STD_BUF, format, ap); - buf[STD_BUF] = '\0'; - syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "%s", buf); - } - else - { - vfprintf(stderr, format, ap); - } - va_end(ap); -} - -/* - * Function: LogMessage(const char *, ...) - * - * Purpose: Print a message to stderr or with logfacility. - * - * Arguments: format => the formatted error string to print out - * ... => format commands/fillers - * - * Returns: void function - */ -void LogMessage(const char *format,...) -{ - char buf[STD_BUF+1]; - va_list ap; - - if (snort_conf == NULL) - return; - - if (ScLogQuiet() && !ScDaemonMode() && !ScLogSyslog()) - return; - - va_start(ap, format); - - if (ScDaemonMode() || ScLogSyslog()) - { - vsnprintf(buf, STD_BUF, format, ap); - buf[STD_BUF] = '\0'; - syslog(LOG_DAEMON | LOG_NOTICE, "%s", buf); - } - else - { - vfprintf(stderr, format, ap); - } - - va_end(ap); -} - -/* - * Function: CreateApplicationEventLogEntry(const char *) - * - * Purpose: Add an entry to the Win32 "Application" EventLog - * - * Arguments: szMessage => the formatted error string to print out - * - * Returns: void function - */ -#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE) -void CreateApplicationEventLogEntry(const char *msg) -{ - HANDLE hEventLog; - char* pEventSourceName = "SnortService"; - - /* prepare to write to Application log on local host - * with Event Source of SnortService - */ - AddEventSource(pEventSourceName); - hEventLog = RegisterEventSource(NULL, pEventSourceName); - if (hEventLog == NULL) - { - /* Could not register the event source. */ - return; - } - - if (!ReportEvent(hEventLog, /* event log handle */ - EVENTLOG_ERROR_TYPE, /* event type */ - 0, /* category zero */ - EVMSG_SIMPLE, /* event identifier */ - NULL, /* no user security identifier */ - 1, /* one substitution string */ - 0, /* no data */ - &msg, /* pointer to array of strings */ - NULL)) /* pointer to data */ - { - /* Could not report the event. */ - } - - DeregisterEventSource(hEventLog); -} -#endif /* WIN32 && ENABLE_WIN32_SERVICE */ - - -/* - * Function: FatalError(const char *, ...) - * - * Purpose: When a fatal error occurs, this function prints the error message - * and cleanly shuts down the program - * - * Arguments: format => the formatted error string to print out - * ... => format commands/fillers - * - * Returns: void function - */ -NORETURN void FatalError(const char *format,...) -{ - char buf[STD_BUF+1]; - va_list ap; - - va_start(ap, format); - vsnprintf(buf, STD_BUF, format, ap); - va_end(ap); - - buf[STD_BUF] = '\0'; - - if ((snort_conf != NULL) && (ScDaemonMode() || ScLogSyslog())) - { - syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "FATAL ERROR: %s", buf); - } - else - { - fprintf(stderr, "ERROR: %s", buf); - fprintf(stderr,"Fatal Error, Quitting..\n"); -#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE) - CreateApplicationEventLogEntry(buf); -#endif - } - - exit(1); -} - - -/**************************************************************************** - * - * Function: CreatePidFile(char *) - * - * Purpose: Creates a PID file - * - * Arguments: Interface opened. - * - * Returns: void function - * - ****************************************************************************/ -static FILE *pid_lockfile = NULL; -static FILE *pid_file = NULL; -void CreatePidFile(char *intf) -{ - struct stat pt; - int pid = (int) getpid(); -#ifdef WIN32 - char dir[STD_BUF + 1]; -#endif - - if (!ScReadMode()) - { - LogMessage("Checking PID path...\n"); - - if (strlen(snort_conf->pid_path) != 0) - { - if((stat(snort_conf->pid_path, &pt) == -1) || - !S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1) - { -#ifndef WIN32 - /* Save this just in case it's reset with LogMessage call */ - int err = errno; - - LogMessage("WARNING: %s is invalid, trying " - "/var/run...\n", snort_conf->pid_path); - if (err) - { - LogMessage("Previous Error, errno=%d, (%s)\n", - err, strerror(err) == NULL ? "Unknown error" : strerror(err)); - } -#endif - memset(snort_conf->pid_path, 0, sizeof(snort_conf->pid_path)); - } - else - { - LogMessage("PID path stat checked out ok, " - "PID path set to %s\n", snort_conf->pid_path); - } - } - - if (strlen(snort_conf->pid_path) == 0) - { -#ifndef _PATH_VARRUN -# ifndef WIN32 - SnortStrncpy(_PATH_VARRUN, "/var/run/", sizeof(_PATH_VARRUN)); -# else - if (GetCurrentDirectory(sizeof(dir) - 1, dir)) - SnortStrncpy(_PATH_VARRUN, dir, sizeof(_PATH_VARRUN)); -# endif /* WIN32 */ -#else - LogMessage("PATH_VARRUN is set to %s on this operating " - "system\n", _PATH_VARRUN); -#endif /* _PATH_VARRUN */ - - stat(_PATH_VARRUN, &pt); - - if(!S_ISDIR(pt.st_mode) || access(_PATH_VARRUN, W_OK) == -1) - { - LogMessage("WARNING: _PATH_VARRUN is invalid, trying " - "/var/log...\n"); - SnortStrncpy(snort_conf->pid_path, "/var/log/", sizeof(snort_conf->pid_path)); - stat(snort_conf->pid_path, &pt); - - if(!S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1) - { - LogMessage("WARNING: %s is invalid, logging Snort " - "PID path to log directory (%s)\n", snort_conf->pid_path, - snort_conf->log_dir); - CheckLogDir(); - SnortSnprintf(snort_conf->pid_path, sizeof(snort_conf->pid_path), - "%s/", snort_conf->log_dir); - } - } - else - { - LogMessage("PID path stat checked out ok, " - "PID path set to %s\n", _PATH_VARRUN); - SnortStrncpy(snort_conf->pid_path, _PATH_VARRUN, sizeof(snort_conf->pid_path)); - } - } - } - - if(intf == NULL || strlen(snort_conf->pid_path) == 0) - { - /* snort_conf->pid_path should have some value by now - * so let us just be sane. */ - FatalError("CreatePidFile() failed to lookup interface or pid_path is unknown!\n"); - } - - SnortSnprintf(snort_conf->pid_filename, sizeof(snort_conf->pid_filename), - "%s/snort_%s%s.pid", snort_conf->pid_path, intf, snort_conf->pidfile_suffix); - -#ifndef WIN32 - if (!ScNoLockPidFile()) - { - char pid_lockfilename[STD_BUF+1]; - int lock_fd; - - /* First, lock the PID file */ - SnortSnprintf(pid_lockfilename, STD_BUF, "%s.lck", snort_conf->pid_filename); - pid_lockfile = fopen(pid_lockfilename, "w"); - - if (pid_lockfile) - { - struct flock lock; - lock_fd = fileno(pid_lockfile); - - lock.l_type = F_WRLCK; - lock.l_whence = SEEK_SET; - lock.l_start = 0; - lock.l_len = 0; - - if (fcntl(lock_fd, F_SETLK, &lock) == -1) - { - ClosePidFile(); - FatalError("Failed to Lock PID File \"%s\" for PID \"%d\"\n", snort_conf->pid_filename, pid); - } - } - } -#endif - - /* Okay, were able to lock PID file, now open and write PID */ - pid_file = fopen(snort_conf->pid_filename, "w"); - if(pid_file) - { - LogMessage("Writing PID \"%d\" to file \"%s\"\n", pid, snort_conf->pid_filename); - fprintf(pid_file, "%d\n", pid); - fflush(pid_file); - } - else - { - ErrorMessage("Failed to create pid file %s", snort_conf->pid_filename); - snort_conf->pid_filename[0] = 0; - } -} - -/**************************************************************************** - * - * Function: ClosePidFile(char *) - * - * Purpose: Releases lock on a PID file - * - * Arguments: None - * - * Returns: void function - * - ****************************************************************************/ -void ClosePidFile(void) -{ - if (pid_file) - { - fclose(pid_file); - pid_file = NULL; - } - if (pid_lockfile) - { - fclose(pid_lockfile); - pid_lockfile = NULL; - } -} - -/**************************************************************************** - * - * Function: SetUidGid() - * - * Purpose: Sets safe UserID and GroupID if needed - * - * Arguments: none - * - * Returns: void function - * - ****************************************************************************/ -void SetUidGid(int user_id, int group_id) -{ -#ifndef WIN32 - - if ((group_id != -1) && (getgid() != (gid_t)group_id)) - { - if (!InlineModeSetPrivsAllowed()) - { - ErrorMessage("Cannot set uid and gid when running Snort in " - "inline mode.\n"); - return; - } - - if (setgid(group_id) < 0) - FatalError("Cannot set gid: %d\n", group_id); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set gid to %d\n", group_id);); - } - - if ((user_id != -1) && (getuid() != (uid_t)user_id)) - { - struct passwd *pw = getpwuid(user_id); - - if (!InlineModeSetPrivsAllowed()) - { - ErrorMessage("Cannot set uid and gid when running Snort in " - "inline mode.\n"); - return; - } - - if (pw != NULL) - { - /* getpwuid and initgroups may use the same static buffers */ - char *username = SnortStrdup(pw->pw_name); - - if ((getuid() == 0) && (initgroups(username, group_id) < 0)) - { - free(username); - FatalError("Can not initgroups(%s,%d)", - username, group_id); - } - - free(username); - } - - /** just to be on a safe side... **/ - endgrent(); - endpwent(); - - if (setuid(user_id) < 0) - FatalError("Can not set uid: %d\n", user_id); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set uid to %d\n", user_id);); - } -#endif /* WIN32 */ -} - -#ifdef TIMESTATS - -static IntervalStats istats = {0}; -time_t start_time; - -void InitTimeStats(void) -{ - start_time = time(NULL); -} - -void ResetTimeStats(void) -{ - memset(&istats, 0, sizeof(istats)); -} - -/* This function prints out stats based on a configurable time - * interval. It is an indication on how well snort is */ -/* processing packets, including types, drops, etc */ -void DropStatsPerTimeInterval(void) -{ - double per_sec, per_minute, per_hour; - uint64_t recv, drop; - uint64_t total = 0; - uint32_t timestats_interval = ScTimestatsInterval(); - -#ifdef PCAP_CLOSE - if (UpdatePcapPktStats(0) != -1) -#else - if (UpdatePcapPktStats() != -1) -#endif - { - recv = GetPcapPktStatsRecv(); - drop = GetPcapPktStatsDrop(); - - istats.recv = recv - istats.recv_total; - istats.recv_total = recv; - - istats.drop = drop - istats.drop_total; - istats.drop_total = drop; - - /* calculate received packets by type */ - istats.tcp = pc.tcp - istats.tcp_total; - istats.tcp_total = pc.tcp; - - istats.udp = pc.udp - istats.udp_total; - istats.udp_total = pc.udp; - - istats.icmp = pc.icmp - istats.icmp_total; - istats.icmp_total = pc.icmp; - - istats.arp = pc.arp - istats.arp_total; - istats.arp_total = pc.arp; - -#ifdef GRE - istats.ip4ip4 = pc.ip4ip4 - istats.ip4ip4_total; - istats.ip4ip4_total = pc.ip4ip4; - - istats.ip4ip6 = pc.ip4ip6 - istats.ip4ip6_total; - istats.ip4ip6_total = pc.ip4ip6; - - istats.ip6ip4 = pc.ip6ip4 - istats.ip6ip4_total; - istats.ip6ip4_total = pc.ip6ip4; - - istats.ip6ip6 = pc.ip6ip6 - istats.ip6ip6_total; - istats.ip6ip6_total = pc.ip6ip6; - - istats.gre = pc.gre - istats.gre_total; - istats.gre_total = pc.gre; - - istats.gre_ip = pc.gre_ip - istats.gre_ip_total; - istats.gre_ip_total = pc.gre_ip; - - istats.gre_eth = pc.gre_eth - istats.gre_eth_total; - istats.gre_eth_total = pc.gre_eth; - - istats.gre_arp = pc.gre_arp - istats.gre_arp_total; - istats.gre_arp_total = pc.gre_arp; - - istats.gre_ipv6 = pc.gre_ipv6 - istats.gre_ipv6_total; - istats.gre_ipv6_total = pc.gre_ipv6; - - istats.gre_ipx = pc.gre_ipx - istats.gre_ipx_total; - istats.gre_ipx_total = pc.gre_ipx; - - istats.gre_loopback = pc.gre_loopback - istats.gre_loopback_total; - istats.gre_loopback_total = pc.gre_loopback; - - istats.gre_vlan = pc.gre_vlan - istats.gre_vlan_total; - istats.gre_vlan_total = pc.gre_vlan; - - istats.gre_ppp = pc.gre_ppp - istats.gre_ppp_total; - istats.gre_ppp_total = pc.gre_ppp; -#endif - -#ifdef DLT_IEEE802_11 /* if we are tracking wireless, add this to output */ - istats.wifi_mgmt = pc.wifi_mgmt - istats.wifi_mgmt_total; - istats.wifi_mgmt_total = pc.wifi_mgmt; - - istats.wifi_control = pc.wifi_control - istats.wifi_control_total; - istats.wifi_control_total = pc.wifi_control; - - istats.wifi_data = pc.wifi_data - istats.wifi_data_total; - istats.wifi_data_total = pc.wifi_data; -#endif - - istats.ipx = pc.ipx - istats.ipx_total; - istats.ipx_total = pc.ipx; - - istats.eapol = pc.eapol - istats.eapol_total; - istats.eapol_total = pc.eapol; - - istats.ipv6 = pc.ipv6 - istats.ipv6_total; - istats.ipv6_total = pc.ipv6; - - istats.ethloopback = pc.ethloopback - istats.ethloopback_total; - istats.ethloopback_total = pc.ethloopback; - - istats.other = pc.other - istats.other_total; - istats.other_total = pc.other; - - istats.discards = pc.discards - istats.discards_total; - istats.discards_total = pc.discards; - - if (pc.frags > 0) /* do we have any fragmented packets being seen? */ - { - istats.frags = pc.frags - istats.frags_total; - istats.frags_total = pc.frags; - - istats.frag_trackers = pc.frag_trackers - istats.frag_trackers_total; - istats.frag_trackers_total = pc.frag_trackers; - - istats.frag_rebuilt = pc.rebuilt_frags - istats.frag_rebuilt_total; - istats.frag_rebuilt_total = pc.rebuilt_frags; - - istats.frag_element = pc.rebuild_element - istats.frag_element_total; - istats.frag_element_total = pc.rebuild_element; - - istats.frag_incomp = pc.frag_incomp - istats.frag_incomp_total; - istats.frag_incomp_total = pc.frag_incomp; - - istats.frag_timeout = pc.frag_timeout - istats.frag_timeout_total; - istats.frag_timeout_total = pc.frag_timeout; - - istats.frag_mem_faults = pc.frag_mem_faults - istats.frag_mem_faults_total; - istats.frag_mem_faults_total = pc.frag_mem_faults; - } - - if (pc.tcp_stream_pkts > 0) /* do we have TCP stream re-assembly going on? */ - { - istats.tcp_str_packets = pc.tcp_stream_pkts - istats.tcp_str_packets_total; - istats.tcp_str_packets_total = pc.tcp_stream_pkts; - - istats.tcp_str_trackers = pc.tcp_streams - istats.tcp_str_trackers_total; - istats.tcp_str_trackers_total = pc.tcp_streams; - - istats.tcp_str_flushes = pc.rebuilt_tcp - istats.tcp_str_flushes_total; - istats.tcp_str_flushes_total = pc.rebuilt_tcp; - - istats.tcp_str_segs_used = pc.rebuilt_segs - istats.tcp_str_segs_used_total; - istats.tcp_str_segs_used_total = pc.rebuilt_segs; - - istats.tcp_str_segs_queued = pc.queued_segs - istats.tcp_str_segs_queued_total; - istats.tcp_str_segs_queued_total = pc.queued_segs; - - istats.tcp_str_mem_faults = pc.str_mem_faults - istats.tcp_str_mem_faults_total; - istats.tcp_str_mem_faults_total = pc.str_mem_faults; - } - - istats.processed = pc.total_processed - istats.processed_total; - istats.processed_total = pc.total_processed; - total = istats.processed; - - /* prepare packet type per time interval routine */ - LogMessage("================================================" - "===============================\n"); - - LogMessage("\n"); - LogMessage("Statistics Report (last %d seconds)\n", timestats_interval); - LogMessage("\n"); - - per_sec = (double)istats.recv / (double)timestats_interval; - - LogMessage("Packet Wire Totals:\n"); - LogMessage("Packets received: " FMTu64("13") "\n", istats.recv); - - if (timestats_interval >= SECONDS_PER_HOUR) - { - per_hour = (double)(istats.recv * SECONDS_PER_HOUR) / (double)timestats_interval; - LogMessage(" per hour: %13.2f\n", per_hour); - } - if (timestats_interval >= SECONDS_PER_MIN) - { - per_minute = (double)(istats.recv * SECONDS_PER_MIN) / (double)timestats_interval; - LogMessage(" per minute: %13.2f\n", per_minute); - } - LogMessage(" per second: %13.2f\n", per_sec); - LogMessage(" Packets dropped: " FMTu64("13") "\n", istats.drop); - LogMessage("\n"); - LogMessage("Packet Breakdown by Protocol (includes rebuilt packets):\n"); - - LogMessage(" TCP: " FMTu64("10") " (%.3f%%)\n", - istats.tcp, CalcPct(istats.tcp, total)); - LogMessage(" UDP: " FMTu64("10") " (%.3f%%)\n", - istats.udp, CalcPct(istats.udp, total)); - LogMessage(" ICMP: " FMTu64("10") " (%.3f%%)\n", - istats.icmp, CalcPct(istats.icmp, total)); - LogMessage(" ARP: " FMTu64("10") " (%.3f%%)\n", - istats.arp, CalcPct(istats.arp, total)); -#ifndef NO_NON_ETHER_DECODER - LogMessage(" EAPOL: " FMTu64("10") " (%.3f%%)\n", - istats.eapol, CalcPct(istats.eapol, total)); -#endif - LogMessage(" IPv6: " FMTu64("10") " (%.3f%%)\n", - istats.ipv6, CalcPct(istats.ipv6, total)); - LogMessage(" ETHLOOP: " FMTu64("10") " (%.3f%%)\n", - istats.ethloopback, CalcPct(istats.ethloopback, total)); - LogMessage(" IPX: " FMTu64("10") " (%.3f%%)\n", - istats.ipx, CalcPct(istats.ipx, total)); - -#ifdef GRE - LogMessage(" IP4/IP4: " FMTu64("-10") " (%.3f%%)\n", - istats.ip4ip4, CalcPct(istats.ip4ip4, total)); - LogMessage(" IP4/IP6: " FMTu64("-10") " (%.3f%%)\n", - istats.ip4ip6, CalcPct(istats.ip4ip6, total)); - LogMessage(" IP6/IP4: " FMTu64("-10") " (%.3f%%)\n", - istats.ip6ip4, CalcPct(istats.ip6ip4, total)); - LogMessage(" IP6/IP6: " FMTu64("-10") " (%.3f%%)\n", - istats.ip6ip6, CalcPct(istats.ip6ip6, total)); - LogMessage(" GRE: " FMTu64("10") " (%.3f%%)\n", - istats.gre, CalcPct(istats.gre, total)); - LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_eth, CalcPct(istats.gre_eth, total)); - LogMessage("GRE VLAN: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_vlan, CalcPct(istats.gre_vlan, total)); - LogMessage(" GRE IP: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_ip, CalcPct(istats.gre_ip, total)); - LogMessage("GRE IPv6: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_ipv6, CalcPct(istats.gre_ipv6, total)); - LogMessage("GRE PPTP: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_ppp, CalcPct(istats.gre_ppp, total)); - LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_arp, CalcPct(istats.gre_arp, total)); - LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_ipx, CalcPct(istats.gre_ipx, total)); - LogMessage("GRE LOOP: " FMTu64("-10") " (%.3f%%)\n", - istats.gre_loopback, CalcPct(istats.gre_loopback, total)); -#endif - - LogMessage(" FRAG: " FMTu64("10") " (%.3f%%)\n", - istats.frags, CalcPct(istats.frags, total)); - LogMessage(" OTHER: " FMTu64("10") " (%.3f%%)\n", - istats.other, CalcPct(istats.other, total)); - LogMessage(" DISCARD: " FMTu64("10") " (%.3f%%)\n", - istats.discards, CalcPct(istats.discards, total)); - LogMessage(" Total: " FMTu64("10") "\n", total); - - LogMessage("\n"); - - - /* handle case where wireless is enabled... */ - -#ifndef NO_NON_ETHER_DECODER -#ifdef DLT_IEEE802_11 - if (datalink == DLT_IEEE802_11) - { - LogMessage("\n"); - LogMessage("Wireless Stats:\n\n"); - LogMessage("Management Packets: " FMTu64("10") " (%.3f%%)\n", - istats.wifi_mgmt, CalcPct(istats.wifi_mgmt, total)); - LogMessage(" Control Packets: " FMTu64("10") " (%.3f%%)\n", - istats.wifi_control, CalcPct(istats.wifi_control, total)); - LogMessage(" Data Packets: " FMTu64("10") " (%.3f%%)\n", - istats.wifi_data, CalcPct(istats.wifi_data, total)); - LogMessage("\n"); - } - -#endif /* if wireless is enabled... */ -#endif // NO_NON_ETHER_DECODER - - /* handle case where we have snort seeing fragmented packets */ - - if (pc.frags > 0) /* begin if (pc.frags > 0) */ - { - LogMessage("\n"); - LogMessage("Fragmentation Stats:\n\n"); - LogMessage("Fragmented IP Packets: " FMTu64("10") "\n", istats.frags); - LogMessage(" Fragment Trackers: " FMTu64("10") "\n", istats.frag_trackers); - LogMessage(" Rebuilt IP Packets: " FMTu64("10") "\n", istats.frag_rebuilt); - LogMessage(" Frag Elements Used: " FMTu64("10") "\n", istats.frag_element); - LogMessage("Discarded(incomplete): " FMTu64("10") "\n", istats.frag_incomp); - LogMessage(" Discarded(timeout): " FMTu64("10") "\n", istats.frag_timeout); - LogMessage(" Frag2 memory faults: " FMTu64("10") "\n", istats.frag_mem_faults); - LogMessage("\n"); - } /* end if (pc.frags > 0) */ - - /* handle TCP stream re-assy stuff here */ - - if (pc.tcp_stream_pkts > 0) - { - LogMessage("\n"); - LogMessage("TCP Stream Reassembly Stats:\n\n"); - LogMessage(" TCP Packets Used: " FMTu64("10") "\n", istats.tcp_str_packets); - LogMessage(" Stream Trackers: " FMTu64("10") "\n", istats.tcp_str_trackers); - LogMessage(" Stream Flushes: " FMTu64("10") "\n", istats.tcp_str_flushes); - LogMessage(" Stream Segments Used: " FMTu64("10") "\n", istats.tcp_str_segs_used); - LogMessage("Stream Segments Queued: " FMTu64("10") "\n", istats.tcp_str_segs_queued); - LogMessage(" Stream4 Memory Faults: " FMTu64("10") "\n", istats.tcp_str_mem_faults); - LogMessage("\n"); - } - - //mpse_print_qinfo(); - - } /* end if pcap_stats(ps, &ps) */ - - alarm(timestats_interval); /* reset the alarm to go off again */ -} - -/* print out stats on how long snort ran */ -void TimeStats(void) -{ - -/* - * variable definitions for improved statistics handling - * - * end_time = time which snort finished running (unix epoch) - * total_secs = total amount of time snort ran - * int_total_secs = used to eliminate casts from this function (temp. var) - * days = number of days snort ran - * hrs = number of hrs snort ran - * mins = number of minutes snort ran - * secs = number of seconds snort ran - * - * ival = temp. variable for integer/modulus math - * ppd = packets per day processed - * pph = packets per hour processed - * ppm = packets per minute processed - * pps = packets per second processed - * - * hflag = used to flag when hrs = zero, but days > 0 - * mflag = used to flag when min = zero, but hrs > 0 - * - */ - - time_t end_time, total_secs; - uint32_t days = 0, hrs = 0, mins = 0, secs = 0, tmp = 0; - uint64_t pps = 0, ppm = 0, pph = 0, ppd = 0; - uint32_t int_total_secs = 0; - char hflag = 0, mflag = 0; - - - end_time = time(NULL); /* grab epoch for end time value (in seconds) */ - total_secs = end_time - start_time; /* total_secs is how many seconds snort ran for */ - - tmp = (uint32_t)total_secs; - int_total_secs = tmp; /* used for cast elimination */ - - days = tmp / SECONDS_PER_DAY; /* 86400 is number of seconds in a day */ - tmp = tmp % SECONDS_PER_DAY; /* grab remainder to process hours */ - hrs = tmp / SECONDS_PER_HOUR; /* 3600 is number of seconds in a(n) hour */ - tmp = tmp % SECONDS_PER_HOUR; /* grab remainder to process minutes */ - mins = tmp / SECONDS_PER_MIN; /* 60 is number of seconds in a minute */ - secs = tmp % SECONDS_PER_MIN; /* grab remainder to process seconds */ - - if (total_secs) - pps = (pc.total_from_pcap / int_total_secs); - else - pps = pc.total_from_pcap; /* guard against division by zero */ - - /* Use ErrorMessage because this is logged whether - * or not logging quietly */ - ErrorMessage("Snort ran for %u Days %u Hours %u Minutes %u Seconds\n", - days, hrs, mins, secs); - - if (days > 0) - { - ppd = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_DAY)); - ErrorMessage("Snort Analyzed " STDu64 " Packets Per Day\n", ppd); - hflag = 1; - } - - if (hrs > 0 || hflag == 1) - { - pph = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_HOUR)); - ErrorMessage("Snort Analyzed " STDu64 " Packets Per Hour\n", pph); - mflag = 1; - } - - if (mins > 0 || mflag == 1) - { - ppm = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_MIN)); - ErrorMessage("Snort Analyzed " STDu64 " Packets Per Minute\n", ppm); - } - - ErrorMessage("Snort Analyzed " STDu64 " Packets Per Second\n", pps); - ErrorMessage("\n"); -} -#endif /* TIMESTATS */ - - -#ifdef PCAP_CLOSE -int UpdatePcapPktStats(int cacheReturn) -#else -int UpdatePcapPktStats(void) -#endif -{ - struct pcap_stat ps; - uint32_t recv, drop; - static char not_initialized = 1; - -#ifdef PCAP_CLOSE - static int priorReturn = 0; - static int returnWasCached = 0; - - if ( !cacheReturn && returnWasCached ) - { - returnWasCached = 0; - return priorReturn; - } - priorReturn = -1; - returnWasCached = cacheReturn; -#endif - - if (not_initialized) - { - memset(&pkt_stats, 0, sizeof(PcapPktStats)); - not_initialized = 0; - } - - if ((pcap_handle == NULL) || ScReadMode()) - return -1; - - if (pcap_stats(pcap_handle, &ps) == -1) - { - pcap_perror(pcap_handle, "pcap_stats"); - return -1; - } - - recv = (uint32_t)ps.ps_recv; - drop = (uint32_t)ps.ps_drop; - -#ifdef LINUX_LIBPCAP_DOUBLES_STATS - recv /= 2; - drop /= 2; -#endif - -#ifdef LIBPCAP_ACCUMULATES - /* pcap recv wrapped */ - if (recv < pkt_stats.wrap_recv) - pkt_stats.recv += (uint64_t)UINT32_MAX; - - /* pcap drop wrapped */ - if (drop < pkt_stats.wrap_drop) - pkt_stats.drop += (uint64_t)UINT32_MAX; - - pkt_stats.wrap_recv = recv; - pkt_stats.wrap_drop = drop; -#else - pkt_stats.recv += (uint64_t)recv; - pkt_stats.drop += (uint64_t)drop; -#endif /* LIBPCAP_ACCUMULATES */ - -#ifdef PCAP_CLOSE - priorReturn = 0; -#endif - return 0; -} - -uint64_t GetPcapPktStatsRecv(void) -{ - return pkt_stats.recv + (uint64_t)pkt_stats.wrap_recv; -} - -uint64_t GetPcapPktStatsDrop(void) -{ - return pkt_stats.drop + (uint64_t)pkt_stats.wrap_drop; -} - - -#ifdef PCAP_CLOSE -/* exiting should be 0 for if not exiting, 1 if restarting, and 2 if exiting */ -#else -/* exiting should be 0 for if not exiting and 1 if exiting */ -#endif -void DropStats(int exiting) -{ - PreprocStatsFuncNode *idx; - uint64_t total = 0; - uint64_t pkts_recv; - uint64_t pkts_drop; - - total = pc.total_processed; - -#ifdef PPM_MGR - PPM_PRINT_SUMMARY(&snort_conf->ppm_cfg); -#endif - - LogMessage("================================================" - "===============================\n"); - -#ifdef TIMESTATS - TimeStats(); /* how long did snort run? */ -#endif - - if (ScReadMode() -#ifdef GIDS - || ScAdapterInlineMode() -#endif - ) - { - LogMessage("Snort processed " STDu64 " packets.\n", total); - } - else - { -#ifdef PCAP_CLOSE - if (exiting < 2 && (pcap_handle == NULL)) -#else - if (pcap_handle == NULL) -#endif - { - LogMessage("Snort received 0 packets\n"); - } - else - { -#ifdef PCAP_CLOSE - if (UpdatePcapPktStats(0) != -1) -#else - if (UpdatePcapPktStats() != -1) -#endif - { - pkts_recv = GetPcapPktStatsRecv(); - pkts_drop = GetPcapPktStatsDrop(); - - LogMessage("Packet Wire Totals:\n"); - LogMessage(" Received: " FMTu64("12") "\n", pkts_recv); - LogMessage(" Analyzed: " FMTu64("12") " (%.3f%%)\n", pc.total_from_pcap, - CalcPct(pc.total_from_pcap, pkts_recv)); - LogMessage(" Dropped: " FMTu64("12") " (%.3f%%)\n", pkts_drop, - CalcPct(pkts_drop, pkts_recv)); - LogMessage("Outstanding: " FMTu64("12") " (%.3f%%)\n", - pkts_recv - pkts_drop - pc.total_from_pcap, - CalcPct((pkts_recv - pkts_drop - pc.total_from_pcap), pkts_recv)); - } - else - { - LogMessage("Unable to calculate percentages for stats\n"); - LogMessage("Total number of packets Analyzed: " FMTu64("12") "\n", pc.total_from_pcap); - } - } - } - - LogMessage("================================================" - "===============================\n"); - - LogMessage("Breakdown by protocol (includes rebuilt packets):\n"); - - LogMessage(" ETH: " FMTu64("-10") " (%.3f%%)\n", - pc.eth, CalcPct(pc.eth, total)); - LogMessage(" ETHdisc: " FMTu64("-10") " (%.3f%%)\n", - pc.ethdisc, CalcPct(pc.ethdisc, total)); -#ifdef GIDS -#ifndef IPFW - LogMessage(" IPTables: " FMTu64("-10") " (%.3f%%)\n", - pc.iptables, CalcPct(pc.iptables, total)); -#else - LogMessage(" IPFW: " FMTu64("-10") " (%.3f%%)\n", - pc.ipfw, CalcPct(pc.ipfw, total)); -#endif /* IPFW */ -#endif /* GIDS */ - LogMessage(" VLAN: " FMTu64("-10") " (%.3f%%)\n", - pc.vlan, CalcPct(pc.vlan, total)); - - if (pc.nested_vlan != 0) - LogMessage("Nested VLAN: " FMTu64("-10") " (%.3f%%)\n", - pc.nested_vlan, CalcPct(pc.nested_vlan, total)); - - LogMessage(" IPV6: " FMTu64("-10") " (%.3f%%)\n", - pc.ipv6, CalcPct(pc.ipv6, total)); - LogMessage(" IP6 EXT: " FMTu64("-10") " (%.3f%%)\n", - pc.ip6ext, CalcPct(pc.ip6ext, total)); - LogMessage(" IP6opts: " FMTu64("-10") " (%.3f%%)\n", - pc.ipv6opts, CalcPct(pc.ipv6opts, total)); - LogMessage(" IP6disc: " FMTu64("-10") " (%.3f%%)\n", - pc.ipv6disc, CalcPct(pc.ipv6disc, total)); - - LogMessage(" IP4: " FMTu64("-10") " (%.3f%%)\n", - pc.ip, CalcPct(pc.ip, total)); - LogMessage(" IP4disc: " FMTu64("-10") " (%.3f%%)\n", - pc.ipdisc, CalcPct(pc.ipdisc, total)); - - LogMessage(" TCP 6: " FMTu64("-10") " (%.3f%%)\n", - pc.tcp6, CalcPct(pc.tcp6, total)); - LogMessage(" UDP 6: " FMTu64("-10") " (%.3f%%)\n", - pc.udp6, CalcPct(pc.udp6, total)); - LogMessage(" ICMP6: " FMTu64("-10") " (%.3f%%)\n", - pc.icmp6, CalcPct(pc.icmp6, total)); - LogMessage(" ICMP-IP: " FMTu64("-10") " (%.3f%%)\n", - pc.embdip, CalcPct(pc.embdip, total)); - - LogMessage(" TCP: " FMTu64("-10") " (%.3f%%)\n", - pc.tcp, CalcPct(pc.tcp, total)); - LogMessage(" UDP: " FMTu64("-10") " (%.3f%%)\n", - pc.udp, CalcPct(pc.udp, total)); - LogMessage(" ICMP: " FMTu64("-10") " (%.3f%%)\n", - pc.icmp, CalcPct(pc.icmp, total)); - - LogMessage(" TCPdisc: " FMTu64("-10") " (%.3f%%)\n", - pc.tdisc, CalcPct(pc.tdisc, total)); - LogMessage(" UDPdisc: " FMTu64("-10") " (%.3f%%)\n", - pc.udisc, CalcPct(pc.udisc, total)); - LogMessage(" ICMPdis: " FMTu64("-10") " (%.3f%%)\n", - pc.icmpdisc, CalcPct(pc.icmpdisc, total)); - - LogMessage(" FRAG: " FMTu64("-10") " (%.3f%%)\n", - pc.frags, CalcPct(pc.frags, total)); - LogMessage(" FRAG 6: " FMTu64("-10") " (%.3f%%)\n", - pc.frag6, CalcPct(pc.frag6, total)); - - LogMessage(" ARP: " FMTu64("-10") " (%.3f%%)\n", - pc.arp, CalcPct(pc.arp, total)); -#ifndef NO_NON_ETHER_DECODER - LogMessage(" EAPOL: " FMTu64("-10") " (%.3f%%)\n", - pc.eapol, CalcPct(pc.eapol, total)); -#endif - LogMessage(" ETHLOOP: " FMTu64("-10") " (%.3f%%)\n", - pc.ethloopback, CalcPct(pc.ethloopback, total)); - LogMessage(" IPX: " FMTu64("-10") " (%.3f%%)\n", - pc.ipx, CalcPct(pc.ipx, total)); -#ifdef GRE - LogMessage("IPv4/IPv4: " FMTu64("-10") " (%.3f%%)\n", - pc.ip4ip4, CalcPct(pc.ip4ip4, total)); - LogMessage("IPv4/IPv6: " FMTu64("-10") " (%.3f%%)\n", - pc.ip4ip6, CalcPct(pc.ip4ip6, total)); - LogMessage("IPv6/IPv4: " FMTu64("-10") " (%.3f%%)\n", - pc.ip6ip4, CalcPct(pc.ip6ip4, total)); - LogMessage("IPv6/IPv6: " FMTu64("-10") " (%.3f%%)\n", - pc.ip6ip6, CalcPct(pc.ip6ip6, total)); - LogMessage(" GRE: " FMTu64("-10") " (%.3f%%)\n", - pc.gre, CalcPct(pc.gre, total)); - LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_eth, CalcPct(pc.gre_eth, total)); - LogMessage(" GRE VLAN: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_vlan, CalcPct(pc.gre_vlan, total)); - LogMessage(" GRE IPv4: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_ip, CalcPct(pc.gre_ip, total)); - LogMessage(" GRE IPv6: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_ipv6, CalcPct(pc.gre_ipv6, total)); - LogMessage("GRE IP6 E: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_ipv6ext, CalcPct(pc.gre_ipv6ext, total)); - LogMessage(" GRE PPTP: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_ppp, CalcPct(pc.gre_ppp, total)); - LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_arp, CalcPct(pc.gre_arp, total)); - LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_ipx, CalcPct(pc.gre_ipx, total)); - LogMessage(" GRE LOOP: " FMTu64("-10") " (%.3f%%)\n", - pc.gre_loopback, CalcPct(pc.gre_loopback, total)); -#endif /* GRE */ -#ifdef MPLS - LogMessage(" MPLS: " FMTu64("-10") " (%.3f%%)\n", - pc.mpls, CalcPct(pc.mpls, total)); -#endif - LogMessage(" OTHER: " FMTu64("-10") " (%.3f%%)\n", - pc.other, CalcPct(pc.other, total)); - LogMessage(" DISCARD: " FMTu64("-10") " (%.3f%%)\n", - pc.discards, CalcPct(pc.discards, total)); - LogMessage("InvChkSum: " FMTu64("-10") " (%.3f%%)\n", - pc.invalid_checksums, CalcPct(pc.invalid_checksums, total)); - - LogMessage(" S5 G 1: " FMTu64("-10") " (%.3f%%)\n", - pc.s5tcp1, CalcPct(pc.s5tcp1, total)); - LogMessage(" S5 G 2: " FMTu64("-10") " (%.3f%%)\n", - pc.s5tcp2, CalcPct(pc.s5tcp2, total)); - - LogMessage(" Total: " FMTu64("-10") "\n", total); - - LogMessage("================================================" - "===============================\n"); - - LogMessage("Action Stats:\n"); - LogMessage("ALERTS: " STDu64 "\n", pc.alert_pkts); - LogMessage("LOGGED: " STDu64 "\n", pc.log_pkts); - LogMessage("PASSED: " STDu64 "\n", pc.pass_pkts); - -#ifdef TARGET_BASED - if (ScIdsMode() && IsAdaptiveConfigured(getDefaultPolicy(), 0)) - { - LogMessage("================================================" - "===============================\n"); - LogMessage("Attribute Table Stats:\n"); - LogMessage(" Number Entries: %u\n", SFAT_NumberOfHosts()); - LogMessage(" Table Reloaded: " STDu64 "\n", pc.attribute_table_reloads); - } -#endif /* TARGET_BASED */ - - //mpse_print_qinfo(); - -#ifndef NO_NON_ETHER_DECODER -#ifdef DLT_IEEE802_11 - if(datalink == DLT_IEEE802_11) - { - LogMessage("================================================" - "===============================\n"); - LogMessage("Wireless Stats:\n"); - LogMessage("Breakdown by type:\n"); - LogMessage(" Management Packets: " FMTu64("-10") " (%.3f%%)\n", - pc.wifi_mgmt, CalcPct(pc.wifi_mgmt, total)); - LogMessage(" Control Packets: " FMTu64("-10") " (%.3f%%)\n", - pc.wifi_control, CalcPct(pc.wifi_control, total)); - LogMessage(" Data Packets: " FMTu64("-10") " (%.3f%%)\n", - pc.wifi_data, CalcPct(pc.wifi_data, total)); - } -#endif /* DLT_IEEE802_11 */ -#endif // NO_NON_ETHER_DECODER - - for (idx = preproc_stats_funcs; idx != NULL; idx = idx->next) - { - LogMessage("==============================================" - "=================================\n"); - -#ifdef PCAP_CLOSE - idx->func(exiting ? 1 : 0); -#else - idx->func(exiting); -#endif - } - - LogMessage("==============================================" - "=================================\n"); - - return; -} - -/**************************************************************************** - * - * Function: CleanupProtoNames() - * - * Purpose: Frees the protocol names - * - * Arguments: None. - * - * Returns: void function - * - ****************************************************************************/ -void CleanupProtoNames(void) -{ - int i; - - for(i = 0; i < 256; i++) - { - if( protocol_names[i] != NULL ) - { - free( protocol_names[i] ); - protocol_names[i] = NULL; - } - } -} - -/**************************************************************************** - * - * Function: read_infile(char *) - * - * Purpose: Reads the BPF filters in from a file. Ripped from tcpdump. - * - * Arguments: fname => the name of the file containing the BPF filters - * - * Returns: the processed BPF string - * - ****************************************************************************/ -char *read_infile(char *fname) -{ - register int fd, cc; - register char *cp, *cmt; - struct stat buf; - - fd = open(fname, O_RDONLY); - - if(fd < 0) - FatalError("can't open %s: %s\n", fname, pcap_strerror(errno)); - - if(fstat(fd, &buf) < 0) - FatalError("can't stat %s: %s\n", fname, pcap_strerror(errno)); - - cp = (char *)SnortAlloc(((u_int)buf.st_size + 1) * sizeof(char)); - - cc = read(fd, cp, (int) buf.st_size); - - if(cc < 0) - FatalError("read %s: %s\n", fname, pcap_strerror(errno)); - - if(cc != buf.st_size) - FatalError("short read %s (%d != %d)\n", fname, cc, (int) buf.st_size); - - cp[(int) buf.st_size] = '\0'; - - close(fd); - - /* Treat everything upto the end of the line as a space - * so that we can put comments in our BPF filters - */ - - while((cmt = strchr(cp, '#')) != NULL) - { - while (*cmt != '\r' && *cmt != '\n' && *cmt != '\0') - { - *cmt++ = ' '; - } - } - - /** LogMessage("BPF filter file: %s\n", fname); **/ - - return(cp); -} - - - /**************************************************************************** - * - * Function: CheckLogDir() - * - * Purpose: CyberPsychotic sez: basically we only check if logdir exist and - * writable, since it might screw the whole thing in the middle. Any - * other checks could be performed here as well. - * - * Arguments: None. - * - * Returns: void function - * - ****************************************************************************/ -void CheckLogDir(void) -{ - struct stat st; - - if (snort_conf->log_dir == NULL) - return; - - if (stat(snort_conf->log_dir, &st) == -1) - FatalError("Stat check on log dir failed: %s.\n", strerror(errno)); - - if (!S_ISDIR(st.st_mode) || (access(snort_conf->log_dir, W_OK) == -1)) - { - FatalError("Can not get write access to logging directory \"%s\". " - "(directory doesn't exist or permissions are set incorrectly " - "or it is not a directory at all)\n", - snort_conf->log_dir); - } -} - -/* Signal handler for child process signaling the parent - * that is is ready */ -static int parent_wait = 1; -static void SigChildReadyHandler(int signal) -{ -#ifdef DEBUG - LogMessage("Received Signal from Child\n"); -#endif - parent_wait = 0; -} - -/**************************************************************************** - * - * Function: GoDaemon() - * - * Purpose: Puts the program into daemon mode, nice and quiet like.... - * - * Arguments: None. - * - * Returns: void function - * - ****************************************************************************/ -void GoDaemon(void) -{ -#ifndef WIN32 - int exit_val = 0; - pid_t fs; - - LogMessage("Initializing daemon mode\n"); - - if (ScDaemonRestart()) - return; - - /* Don't daemonize if we've already daemonized and - * received a SIGHUP. */ - if(getppid() != 1) - { - /* Register signal handler that parent can trap signal */ - signal(SIGNAL_SNORT_CHILD_READY, SigChildReadyHandler); - if (errno != 0) errno=0; - - /* now fork the child */ - fs = fork(); - - if(fs > 0) - { - /* Parent */ - - /* Don't exit quite yet. Wait for the child - * to signal that is there and created the PID - * file. - */ - while (parent_wait) - { - /* Continue waiting until receiving signal from child */ - int status; - if (waitpid(fs, &status, WNOHANG) == fs) - { - /* If the child is gone, parent should go away, too */ - if (WIFEXITED(status)) - { - LogMessage("Child exited unexpectedly\n"); - exit_val = -1; - break; - } - - if (WIFSIGNALED(status)) - { - LogMessage("Child terminated unexpectedly\n"); - exit_val = -2; - break; - } - } -#ifdef DEBUG - LogMessage("Parent waiting for child...\n"); -#endif - - sleep(1); - } - - LogMessage("Daemon parent exiting\n"); - - exit(exit_val); /* parent */ - } - - if(fs < 0) - { - /* Daemonizing failed... */ - perror("fork"); - exit(1); - } - - /* Child */ - setsid(); - } - - close(0); - close(1); - close(2); - -#ifdef DEBUG - /* redirect stdin/stdout/stderr to a file */ - open("/tmp/snort.debug", O_CREAT | O_RDWR); /* stdin, fd 0 */ - - /* Change ownership to that which we will drop privileges to */ - if ((snort_conf->user_id != -1) || (snort_conf->group_id != -1)) - { - uid_t user_id = getuid(); - gid_t group_id = getgid(); - - if (snort_conf->user_id != -1) - user_id = snort_conf->user_id; - if (snort_conf->group_id != -1) - group_id = snort_conf->group_id; - - chown("/tmp/snort.debug", user_id, group_id); - } -#else - /* redirect stdin/stdout/stderr to /dev/null */ - (void)open("/dev/null", O_RDWR); /* stdin, fd 0 */ -#endif - - dup(0); /* stdout, fd 0 => fd 1 */ - dup(0); /* stderr, fd 0 => fd 2 */ - - SignalWaitingParent(); - -#endif /* ! WIN32 */ -} - -/* Signal the parent that child is ready */ -void SignalWaitingParent(void) -{ -#ifndef WIN32 - pid_t parentpid = getppid(); -#ifdef DEBUG - LogMessage("Signaling parent %d from child %d\n", parentpid, getpid()); -#endif - - if (kill(parentpid, SIGNAL_SNORT_CHILD_READY)) - { - LogMessage("Daemon initialized, failed to signal parent pid: %d, failure: %d, %s\n", parentpid, errno, strerror(errno)); - } - else - { - LogMessage("Daemon initialized, signaled parent pid: %d\n", parentpid); - } -#endif -} - -/* This function has been moved into mstring.c, since that -* is where the allocation actually occurs. It has been -* renamed to mSplitFree(). -* -void FreeToks(char **toks, int num_toks) -{ - if (toks) - { - if (num_toks > 0) - { - do - { - num_toks--; - free(toks[num_toks]); - } while(num_toks); - } - free(toks); - } -} -*/ - - -/* Self preserving memory allocator */ -void *SPAlloc(unsigned long size, struct _SPMemControl *spmc) -{ - void *tmp; - - spmc->mem_usage += size; - - if(spmc->mem_usage > spmc->memcap) - { - spmc->sp_func(spmc); - } - - tmp = (void *) calloc(size, sizeof(char)); - - if(tmp == NULL) - { - FatalError("Unable to allocate memory! (%lu requested, %lu in use)\n", - size, spmc->mem_usage); - } - - return tmp; -} - -/* Guaranteed to be '\0' terminated even if truncation occurs. - * - * returns SNORT_SNPRINTF_SUCCESS if successful - * returns SNORT_SNPRINTF_TRUNCATION on truncation - * returns SNORT_SNPRINTF_ERROR on error - */ -int SnortSnprintf(char *buf, size_t buf_size, const char *format, ...) -{ - va_list ap; - int ret; - - if (buf == NULL || buf_size <= 0 || format == NULL) - return SNORT_SNPRINTF_ERROR; - - /* zero first byte in case an error occurs with - * vsnprintf, so buffer is null terminated with - * zero length */ - buf[0] = '\0'; - buf[buf_size - 1] = '\0'; - - va_start(ap, format); - - ret = vsnprintf(buf, buf_size, format, ap); - - va_end(ap); - - if (ret < 0) - return SNORT_SNPRINTF_ERROR; - - if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size) - { - /* result was truncated */ - buf[buf_size - 1] = '\0'; - return SNORT_SNPRINTF_TRUNCATION; - } - - return SNORT_SNPRINTF_SUCCESS; -} - -/* Appends to a given string - * Guaranteed to be '\0' terminated even if truncation occurs. - * - * returns SNORT_SNPRINTF_SUCCESS if successful - * returns SNORT_SNPRINTF_TRUNCATION on truncation - * returns SNORT_SNPRINTF_ERROR on error - */ -int SnortSnprintfAppend(char *buf, size_t buf_size, const char *format, ...) -{ - int str_len; - int ret; - va_list ap; - - if (buf == NULL || buf_size <= 0 || format == NULL) - return SNORT_SNPRINTF_ERROR; - - str_len = SnortStrnlen(buf, buf_size); - - /* since we've already checked buf and buf_size an error - * indicates no null termination, so just start at - * beginning of buffer */ - if (str_len == SNORT_STRNLEN_ERROR) - { - buf[0] = '\0'; - str_len = 0; - } - - buf[buf_size - 1] = '\0'; - - va_start(ap, format); - - ret = vsnprintf(buf + str_len, buf_size - (size_t)str_len, format, ap); - - va_end(ap); - - if (ret < 0) - return SNORT_SNPRINTF_ERROR; - - if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size) - { - /* truncation occured */ - buf[buf_size - 1] = '\0'; - return SNORT_SNPRINTF_TRUNCATION; - } - - return SNORT_SNPRINTF_SUCCESS; -} - -/* Guaranteed to be '\0' terminated even if truncation occurs. - * - * Arguments: dst - the string to contain the copy - * src - the string to copy from - * dst_size - the size of the destination buffer - * including the null byte. - * - * returns SNORT_STRNCPY_SUCCESS if successful - * returns SNORT_STRNCPY_TRUNCATION on truncation - * returns SNORT_STRNCPY_ERROR on error - * - * Note: Do not set dst[0] = '\0' on error since it's possible that - * dst and src are the same pointer - it will at least be null - * terminated in any case - */ -int SnortStrncpy(char *dst, const char *src, size_t dst_size) -{ - char *ret = NULL; - - if (dst == NULL || src == NULL || dst_size <= 0) - return SNORT_STRNCPY_ERROR; - - dst[dst_size - 1] = '\0'; - - ret = strncpy(dst, src, dst_size); - - /* Not sure if this ever happens but might as - * well be on the safe side */ - if (ret == NULL) - return SNORT_STRNCPY_ERROR; - - if (dst[dst_size - 1] != '\0') - { - /* result was truncated */ - dst[dst_size - 1] = '\0'; - return SNORT_STRNCPY_TRUNCATION; - } - - return SNORT_STRNCPY_SUCCESS; -} - -char *SnortStrndup(const char *src, size_t dst_size) -{ - char *ret = SnortAlloc(dst_size + 1); - int ret_val; - - ret_val = SnortStrncpy(ret, src, dst_size + 1); - - if(ret_val == SNORT_STRNCPY_ERROR) - { - free(ret); - return NULL; - } - - return ret; -} - -/* Determines whether a buffer is '\0' terminated and returns the - * string length if so - * - * returns the string length if '\0' terminated - * returns SNORT_STRNLEN_ERROR if not '\0' terminated - */ -int SnortStrnlen(const char *buf, int buf_size) -{ - int i = 0; - - if (buf == NULL || buf_size <= 0) - return SNORT_STRNLEN_ERROR; - - for (i = 0; i < buf_size; i++) - { - if (buf[i] == '\0') - break; - } - - if (i == buf_size) - return SNORT_STRNLEN_ERROR; - - return i; -} - -char * SnortStrdup(const char *str) -{ - char *copy = NULL; - - if (!str) - { - FatalError("Unable to duplicate string: NULL!\n"); - } - - copy = strdup(str); - - if (copy == NULL) - { - FatalError("Unable to duplicate string: %s!\n", str); - } - - return copy; -} - -/* - * Find first occurrence of char of accept in s, limited by slen. - * A 'safe' version of strpbrk that won't read past end of buffer s - * in cases that s is not NULL terminated. - * - * This code assumes 'accept' is a static string. - */ -const char *SnortStrnPbrk(const char *s, int slen, const char *accept) -{ - char ch; - const char *s_end; - if (!s || !*s || !accept || slen == 0) - return NULL; - - s_end = s + slen; - while (s < s_end) - { - ch = *s; - if (strchr(accept, ch)) - return s; - s++; - } - return NULL; -} - -/* - * Find first occurrence of searchstr in s, limited by slen. - * A 'safe' version of strstr that won't read past end of buffer s - * in cases that s is not NULL terminated. - */ -const char *SnortStrnStr(const char *s, int slen, const char *searchstr) -{ - char ch, nc; - int len; - if (!s || !*s || !searchstr || slen == 0) - return NULL; - - if ((ch = *searchstr++) != 0) - { - len = strlen(searchstr); - do - { - do - { - if ((nc = *s++) == 0) - { - return NULL; - } - slen--; - if (slen == 0) - return NULL; - } while (nc != ch); - if (slen - len < 0) - return NULL; - } while (memcmp(s, searchstr, len) != 0); - s--; - slen++; - } - return s; -} - -/* - * Find first occurrence of substring in s, ignore case. -*/ -const char *SnortStrcasestr(const char *s, const char *substr) -{ - char ch, nc; - int len; - - if (!s || !*s || !substr) - return NULL; - - if ((ch = *substr++) != 0) - { - ch = tolower((char)ch); - len = strlen(substr); - do - { - do - { - if ((nc = *s++) == 0) - { - return NULL; - } - } while ((char)tolower((uint8_t)nc) != ch); - } while (strncasecmp(s, substr, len) != 0); - s--; - } - return s; -} - -void *SnortAlloc(unsigned long size) -{ - void *tmp; - - tmp = (void *) calloc(size, sizeof(char)); - - if(tmp == NULL) - { - FatalError("Unable to allocate memory! (%lu requested)\n", size); - } - - return tmp; -} - -void * SnortAlloc2(size_t size, const char *format, ...) -{ - void *tmp; - - tmp = (void *)calloc(size, sizeof(char)); - - if(tmp == NULL) - { - va_list ap; - char buf[STD_BUF]; - - buf[STD_BUF - 1] = '\0'; - - va_start(ap, format); - - vsnprintf(buf, STD_BUF - 1, format, ap); - - va_end(ap); - - FatalError("%s", buf); - } - - return tmp; -} - -/** - * Chroot and adjust the snort_conf->log_dir reference - * - * @param directory directory to chroot to - * @param logstore ptr to snort_conf->log_dir which must be dynamically allocated - */ -void SetChroot(char *directory, char **logstore) -{ -#ifdef WIN32 - FatalError("SetChroot() should not be called under Win32!\n"); -#else - char *absdir; - size_t abslen; - char *logdir; - - if(!directory || !logstore) - { - FatalError("Null parameter passed\n"); - } - - logdir = *logstore; - - if(logdir == NULL || *logdir == '\0') - { - FatalError("Null log directory\n"); - } - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n", - CurrentWorkingDir());); - - logdir = GetAbsolutePath(logdir); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n", - CurrentWorkingDir())); - - logdir = SnortStrdup(logdir); - - /* We're going to reset logstore, so free it now */ - free(*logstore); - *logstore = NULL; - - /* change to the directory */ - if(chdir(directory) != 0) - { - FatalError("SetChroot: Can not chdir to \"%s\": %s\n", directory, - strerror(errno)); - } - - /* always returns an absolute pathname */ - absdir = CurrentWorkingDir(); - - if(absdir == NULL) - { - FatalError("NULL Chroot found\n"); - } - - abslen = strlen(absdir); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen);); - - /* make the chroot call */ - if(chroot(absdir) < 0) - { - FatalError("Can not chroot to \"%s\": absolute: %s: %s\n", - directory, absdir, strerror(errno)); - } - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chroot success (%s ->", absdir);); - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"%s)\n ", CurrentWorkingDir());); - - /* change to "/" in the new directory */ - if(chdir("/") < 0) - { - FatalError("Can not chdir to \"/\" after chroot: %s\n", - strerror(errno)); - } - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chdir success (%s)\n", - CurrentWorkingDir());); - - - if(strncmp(absdir, logdir, strlen(absdir))) - { - FatalError("Absdir is not a subset of the logdir"); - } - - if(abslen >= strlen(logdir)) - { - *logstore = SnortStrdup("/"); - } - else - { - *logstore = SnortStrdup(logdir + abslen); - } - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n", - logdir, *logstore)); - - LogMessage("Chroot directory = %s\n", directory); - -#if 0 - /* XXX XXX */ - /* install the I can't do this signal handler */ - signal(SIGHUP, SigCantHupHandler); -#endif -#endif /* !WIN32 */ -} - - -/** - * Return a ptr to the absolute pathname of snort. This memory must - * be copied to another region if you wish to save it for later use. - */ -char *CurrentWorkingDir(void) -{ - static char buf[PATH_MAX_UTIL + 1]; - - if(getcwd((char *) buf, PATH_MAX_UTIL) == NULL) - { - return NULL; - } - - buf[PATH_MAX_UTIL] = '\0'; - - return (char *) buf; -} - -/** - * Given a directory name, return a ptr to a static - */ -char *GetAbsolutePath(char *dir) -{ - char *savedir, *dirp; - static char buf[PATH_MAX_UTIL + 1]; - - if(dir == NULL) - { - return NULL; - } - - savedir = strdup(CurrentWorkingDir()); - - if(savedir == NULL) - { - return NULL; - } - - if(chdir(dir) < 0) - { - LogMessage("Can't change to directory: %s\n", dir); - free(savedir); - return NULL; - } - - dirp = CurrentWorkingDir(); - - if(dirp == NULL) - { - LogMessage("Unable to access current directory\n"); - free(savedir); - return NULL; - } - else - { - strncpy(buf, dirp, PATH_MAX_UTIL); - buf[PATH_MAX_UTIL] = '\0'; - } - - if(chdir(savedir) < 0) - { - LogMessage("Can't change back to directory: %s\n", dir); - free(savedir); - return NULL; - } - - free(savedir); - return (char *) buf; -} - - -#ifndef WIN32 -/* very slow sort - do not use at runtime! */ -SF_LIST * SortDirectory(const char *path) -{ - SF_LIST *dir_entries; - DIR *dir; - struct dirent *direntry; - int ret = 0; - - if (path == NULL) - return NULL; - - dir_entries = sflist_new(); - if (dir_entries == NULL) - { - ErrorMessage("Could not allocate new list for directory entries\n"); - return NULL; - } - - dir = opendir(path); - if (dir == NULL) - { - ErrorMessage("Error opening directory: %s: %s\n", - path, strerror(errno)); - sflist_free_all(dir_entries, free); - return NULL; - } - - /* Reset errno since we'll be checking it unconditionally */ - errno = 0; - - while ((direntry = readdir(dir)) != NULL) - { - char *node_entry_name, *dir_entry_name; - SF_LNODE *node; - - dir_entry_name = SnortStrdup(direntry->d_name); - - for (node = sflist_first_node(dir_entries); - node != NULL; - node = sflist_next_node(dir_entries)) - { - node_entry_name = (char *)node->ndata; - if (strcmp(dir_entry_name, node_entry_name) < 0) - break; - } - - if (node == NULL) - ret = sflist_add_tail(dir_entries, (NODE_DATA)dir_entry_name); - else - ret = sflist_add_before(dir_entries, node, (NODE_DATA)dir_entry_name); - - if (ret == -1) - { - ErrorMessage("Error adding directory entry to list\n"); - sflist_free_all(dir_entries, free); - closedir(dir); - return NULL; - } - } - - if (errno != 0) - { - ErrorMessage("Error reading directory: %s: %s\n", - path, strerror(errno)); - errno = 0; - sflist_free_all(dir_entries, free); - closedir(dir); - return NULL; - } - - closedir(dir); - - return dir_entries; -} - -int GetFilesUnderDir(const char *path, SF_QUEUE *dir_queue, const char *filter) -{ - SF_LIST *dir_entries; - char *direntry; - int ret = 0; - int num_files = 0; - - if ((path == NULL) || (dir_queue == NULL)) - return -1; - - dir_entries = SortDirectory(path); - if (dir_entries == NULL) - { - ErrorMessage("Error sorting entries in directory: %s\n", path); - return -1; - } - - for (direntry = (char *)sflist_first(dir_entries); - direntry != NULL; - direntry = (char *)sflist_next(dir_entries)) - { - char path_buf[PATH_MAX]; - struct stat file_stat; - - /* Don't look at dot files */ - if (strncmp(".", direntry, 1) == 0) - continue; - - ret = SnortSnprintf(path_buf, PATH_MAX, "%s%s%s", - path, path[strlen(path) - 1] == '/' ? "" : "/", direntry); - if (ret == SNORT_SNPRINTF_TRUNCATION) - { - ErrorMessage("Error copying file to buffer: Path too long\n"); - sflist_free_all(dir_entries, free); - return -1; - } - else if (ret != SNORT_SNPRINTF_SUCCESS) - { - ErrorMessage("Error copying file to buffer\n"); - sflist_free_all(dir_entries, free); - return -1; - } - - ret = stat(path_buf, &file_stat); - if (ret == -1) - { - ErrorMessage("Could not stat file: %s: %s\n", - path_buf, strerror(errno)); - sflist_free_all(dir_entries, free); - return -1; - } - - if (file_stat.st_mode & S_IFDIR) - { - ret = GetFilesUnderDir(path_buf, dir_queue, filter); - if (ret == -1) - { - sflist_free_all(dir_entries, free); - return -1; - } - - num_files += ret; - } - else if (file_stat.st_mode & S_IFREG) - { - if ((filter == NULL) || (fnmatch(filter, direntry, 0) == 0)) - { - char *file = SnortStrdup(path_buf); - - ret = sfqueue_add(dir_queue, (NODE_DATA)file); - if (ret == -1) - { - ErrorMessage("Could not append item to list: %s\n", file); - free(file); - sflist_free_all(dir_entries, free); - return -1; - } - - num_files++; - } - } - } - - sflist_free_all(dir_entries, free); - - return num_files; -} -#endif - -/**************************************************************************** - * - * Function: GetUniqueName(char * iface) - * - * Purpose: To return a string that has a high probability of being unique - * for a given sensor. - * - * Arguments: char * iface - The network interface you are sniffing - * - * Returns: A char * -- its a static char * so you should not free it - * - ***************************************************************************/ -char *GetUniqueName(char * iface) -{ - char * rptr; - static char uniq_name[256]; - - if (iface == NULL) LogMessage("Interface is NULL. Name may not be unique for the host\n"); -#ifndef WIN32 - rptr = GetIP(iface); - if(rptr == NULL || !strcmp(rptr, "unknown")) -#endif - { - SnortSnprintf(uniq_name, 255, "%s:%s\n",GetHostname(),iface); - rptr = uniq_name; - } - if (ScLogVerbose()) LogMessage("Node unique name is: %s\n", rptr); - return rptr; -} - -/**************************************************************************** - * - * Function: GetIP(char * iface) - * - * Purpose: To return a string representing the IP address for an interface - * - * Arguments: char * iface - The network interface you want to find an IP - * address for. - * - * Returns: A char * -- make sure you call free on this when you are done - * with it. - * - ***************************************************************************/ -char *GetIP(char * iface) -{ - struct ifreq ifr; - struct sockaddr_in *addr; - int s; -#ifdef SUP_IP6 - sfip_t ret; -#endif - - if(iface) - { - /* Set up a dummy socket just so we can use ioctl to find the - ip address of the interface */ - s = socket(PF_INET, SOCK_DGRAM, 0); - if(s == -1) - { - FatalError("Problem establishing socket to find IP address for interface: %s\n", iface); - } - - SnortStrncpy(ifr.ifr_name, iface, strlen(iface) + 1); - -#ifndef WIN32 - if(ioctl(s, SIOCGIFADDR, &ifr) < 0) return NULL; - else -#endif - { - addr = (struct sockaddr_in *) &ifr.ifr_broadaddr; - } - close(s); - -#ifdef SUP_IP6 -// XXX-IPv6 uses ioctl to populate a sockaddr_in structure ... but what if the interface only has an IPv6 address? - sfip_set_raw(&ret, addr, AF_INET); - return SnortStrdup(sfip_ntoa(&ret)); -#else - return SnortStrdup(inet_ntoa(addr->sin_addr)); -#endif - } - else - { - return "unknown"; - } -} - -/**************************************************************************** - * - * Function: GetHostname() - * - * Purpose: To return a string representing the hostname - * - * Arguments: None - * - * Returns: A static char * representing the hostname. - * - ***************************************************************************/ -char *GetHostname(void) -{ -#ifdef WIN32 - DWORD bufflen = 256; - static char buff[256]; - GetComputerName(buff, &bufflen); - return buff; -#else - char * error = "unknown"; - if(getenv("HOSTNAME")) return getenv("HOSTNAME"); - else if(getenv("HOST")) return getenv("HOST"); - else return error; -#endif -} - -/**************************************************************************** - * - * Function: GetTimestamp(register const struct timeval *tvp, int tz) - * - * Purpose: Get an ISO-8601 formatted timestamp for tvp within the tz - * timezone. - * - * Arguments: tvp is a timeval pointer. tz is a timezone. - * - * Returns: char * -- You must free this char * when you are done with it. - * - ***************************************************************************/ -char *GetTimestamp(register const struct timeval *tvp, int tz) -{ - struct tm *lt; /* localtime */ - char * buf; - int msec; - - buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char)); - - msec = tvp->tv_usec / 1000; - - if (ScOutputUseUtc()) - { - lt = gmtime((time_t *)&tvp->tv_sec); - SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i", - 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, - lt->tm_hour, lt->tm_min, lt->tm_sec, msec); - } - else - { - lt = localtime((time_t *)&tvp->tv_sec); - SnortSnprintf(buf, SMALLBUFFER, - "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i", - 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, - lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tz); - } - - return buf; -} - -/**************************************************************************** - * - * Function: GetLocalTimezone() - * - * Purpose: Find the offset from GMT for current host - * - * Arguments: none - * - * Returns: int representing the offset from GMT - * - ***************************************************************************/ -int GetLocalTimezone(void) -{ - time_t ut; - struct tm * ltm; - long seconds_away_from_utc; - - time(&ut); - ltm = localtime(&ut); - -#if defined(WIN32) || defined(SOLARIS) || defined(AIX) || defined(HPUX) - /* localtime() sets the global timezone variable, - which is defined in */ - seconds_away_from_utc = timezone; -#else - seconds_away_from_utc = ltm->tm_gmtoff; -#endif - - return seconds_away_from_utc/3600; -} - -/**************************************************************************** - * - * Function: GetCurrentTimestamp() - * - * Purpose: Generate an ISO-8601 formatted timestamp for the current time. - * - * Arguments: none - * - * Returns: char * -- You must free this char * when you are done with it. - * - ***************************************************************************/ -char *GetCurrentTimestamp(void) -{ - struct tm *lt; - struct timezone tz; - struct timeval tv; - struct timeval *tvp; - char * buf; - int tzone; - int msec; - - buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char)); - - bzero((char *)&tz,sizeof(tz)); - gettimeofday(&tv,&tz); - tvp = &tv; - - msec = tvp->tv_usec/1000; - - if (ScOutputUseUtc()) - { - lt = gmtime((time_t *)&tvp->tv_sec); - SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i", - 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, - lt->tm_hour, lt->tm_min, lt->tm_sec, msec); - } - else - { - lt = localtime((time_t *)&tvp->tv_sec); - - tzone = GetLocalTimezone(); - - SnortSnprintf(buf, SMALLBUFFER, - "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i", - 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, - lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tzone); - } - - return buf; -} - -/**************************************************************************** - * Function: base64(char * xdata, int length) - * - * Purpose: Insert data into the database - * - * Arguments: xdata => pointer to data to base64 encode - * length => how much data to encode - * - * Make sure you allocate memory for the output before you pass - * the output pointer into this function. You should allocate - * (1.5 * length) bytes to be safe. - * - * Returns: data base64 encoded as a char * - * - ***************************************************************************/ -char * base64(const u_char * xdata, int length) -{ - int count, cols, bits, c, char_count; - unsigned char alpha[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; /* 64 bytes */ - char * payloadptr; - char * output; - char_count = 0; - bits = 0; - cols = 0; - - output = (char *)SnortAlloc( ((unsigned int) (length * 1.5 + 4)) * sizeof(char) ); - - payloadptr = output; - - for(count = 0; count < length; count++) - { - c = xdata[count]; - - if(c > 255) - { - ErrorMessage("plugbase.c->base64(): encountered char > 255 (decimal %d)\n If you see this error message a char is more than one byte on your machine\n This means your base64 results can not be trusted", c); - } - - bits += c; - char_count++; - - if(char_count == 3) - { - *output = alpha[bits >> 18]; output++; - *output = alpha[(bits >> 12) & 0x3f]; output++; - *output = alpha[(bits >> 6) & 0x3f]; output++; - *output = alpha[bits & 0x3f]; output++; - cols += 4; - if(cols == 72) - { - *output = '\n'; output++; - cols = 0; - } - bits = 0; - char_count = 0; - } - else - { - bits <<= 8; - } - } - - if(char_count != 0) - { - bits <<= 16 - (8 * char_count); - *output = alpha[bits >> 18]; output++; - *output = alpha[(bits >> 12) & 0x3f]; output++; - if(char_count == 1) - { - *output = '='; output++; - *output = '='; output++; - } - else - { - *output = alpha[(bits >> 6) & 0x3f]; - output++; *output = '='; - output++; - } - } - *output = '\0'; - return payloadptr; -} - -/**************************************************************************** - * - * Function: ascii(u_char *xdata, int length) - * - * Purpose: This function takes takes a buffer "xdata" and its length then - * returns a string of only the printable ASCII characters. - * - * Arguments: xdata is the buffer, length is the length of the buffer in - * bytes - * - * Returns: char * -- You must free this char * when you are done with it. - * - ***************************************************************************/ -char *ascii(const u_char *xdata, int length) -{ - char *d_ptr, *ret_val; - int i,count = 0; - int size; - - if(xdata == NULL) - { - return NULL; - } - - for(i=0;i') /* > */ - count += 4; - } - - size = length + count + 1; - ret_val = (char *) calloc(1,size); - - if(ret_val == NULL) - { - LogMessage("plugbase.c: ascii(): Out of memory, can't log anything!\n"); - return NULL; - } - - d_ptr = ret_val; - - for(i=0;i 0x1F) && (xdata[i] < 0x7F)) - { - if(xdata[i] == '<') - { - SnortStrncpy(d_ptr, "<", size - (d_ptr - ret_val)); - d_ptr+=4; - } - else if(xdata[i] == '&') - { - SnortStrncpy(d_ptr, "&", size - (d_ptr - ret_val)); - d_ptr += 5; - } - else if(xdata[i] == '>') - { - SnortStrncpy(d_ptr, ">", size - (d_ptr - ret_val)); - d_ptr += 4; - } - else - { - *d_ptr++ = xdata[i]; - } - } - else - { - *d_ptr++ = '.'; - } - } - - *d_ptr++ = '\0'; - - return ret_val; -} - -/**************************************************************************** - * - * Function: hex(u_char *xdata, int length) - * - * Purpose: This function takes takes a buffer "xdata" and its length then - * returns a string of hex with no spaces - * - * Arguments: xdata is the buffer, length is the length of the buffer in - * bytes - * - * Returns: char * -- You must free this char * when you are done with it. - * - ***************************************************************************/ -char *hex(const u_char *xdata, int length) -{ - int x; - char *rval = NULL; - char *buf = NULL; - - if (xdata == NULL) - return NULL; - - buf = (char *)calloc((length * 2) + 1, sizeof(char)); - - if (buf != NULL) - { - rval = buf; - - for (x = 0; x < length; x++) - { - SnortSnprintf(buf, 3, "%02X", xdata[x]); - buf += 2; - } - - rval[length * 2] = '\0'; - } - - return rval; -} - - - -char *fasthex(const u_char *xdata, int length) -{ - char conv[] = "0123456789ABCDEF"; - char *retbuf = NULL; - const u_char *index; - const u_char *end; - char *ridx; - - index = xdata; - end = xdata + length; - retbuf = (char *)SnortAlloc(((length * 2) + 1) * sizeof(char)); - ridx = retbuf; - - while(index < end) - { - *ridx++ = conv[((*index & 0xFF)>>4)]; - *ridx++ = conv[((*index & 0xFF)&0x0F)]; - index++; - } - - return retbuf; -} - -/* - * Fatal Integer Parser - * Ascii to Integer conversion with fatal error support - */ -long int xatol(const char *s , const char *etext) -{ - long int val; - char *endptr; - char *default_error = "xatol() error\n"; - - if (etext == NULL) - etext = default_error; - - if (s == NULL) - FatalError("%s: String is NULL\n", etext); - - while (isspace((int)*s)) - s++; - - if (strlen(s) == 0) - FatalError("%s: String is empty\n", etext); - - - /* - * strtoul - errors on win32 : ERANGE (VS 6.0) - * errors on linux : ERANGE, EINVAL - * (for EINVAL, unsupported base which won't happen here) - */ - val = SnortStrtol(s, &endptr, 0); - - if ((errno == ERANGE) || (*endptr != '\0')) - FatalError("%s: Invalid integer input: %s\n", etext, s); - - return val; -} - -/* - * Fatal Integer Parser - * Ascii to Integer conversion with fatal error support - */ -unsigned long int xatou(const char *s , const char *etext) -{ - unsigned long int val; - char *endptr; - char *default_error = "xatou() error\n"; - - if (etext == NULL) - etext = default_error; - - if (s == NULL) - FatalError("%s: String is NULL\n", etext); - - while (isspace((int)*s)) - s++; - - if (strlen(s) == 0) - FatalError("%s: String is empty\n", etext); - - if (*s == '-') - { - FatalError("%s: Invalid unsigned integer - negative sign found, " - "input: %s\n", etext, s); - } - - - /* - * strtoul - errors on win32 : ERANGE (VS 6.0) - * errors on linux : ERANGE, EINVAL - */ - val = SnortStrtoul(s, &endptr, 0); - - if ((errno == ERANGE) || (*endptr != '\0')) - FatalError("%s: Invalid integer input: %s\n", etext, s); - - return val; -} - -unsigned long int xatoup(const char *s , const char *etext) -{ - unsigned long int val = xatou(s, etext); - if ( !val ) - FatalError("%s: must be > 0\n", etext); - return val; -} - -#ifndef SUP_IP6 -char * ObfuscateIpToText(const struct in_addr ip_addr) -#else -char * ObfuscateIpToText(sfip_t *ip) -#endif -{ - static char ip_buf1[INET6_ADDRSTRLEN]; - static char ip_buf2[INET6_ADDRSTRLEN]; - static int buf_num = 0; - int buf_size = INET6_ADDRSTRLEN; - char *ip_buf; -#ifndef SUP_IP6 - uint32_t ip = ip_addr.s_addr; -#endif - - if (buf_num) - ip_buf = ip_buf2; - else - ip_buf = ip_buf1; - - buf_num ^= 1; - ip_buf[0] = 0; - -#ifndef SUP_IP6 - if (ip == 0) - return ip_buf; - - if (snort_conf->obfuscation_net == 0) - { - /* Fully obfuscate - just use 'x' */ - SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx"); - } - else - { - if (snort_conf->homenet != 0) - { - if ((ip & snort_conf->netmask) == snort_conf->homenet) - ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask); - } - else - { - ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask); - } - - SnortSnprintf(ip_buf, buf_size, "%s", inet_ntoa(*((struct in_addr *)&ip))); - } - -#else - if (ip == NULL) - return ip_buf; - - if (!IS_SET(snort_conf->obfuscation_net)) - { - if (IS_IP6(ip)) - SnortSnprintf(ip_buf, buf_size, "x:x:x:x::x:x:x:x"); - else - SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx"); - } - else - { - sfip_t tmp; - char *tmp_buf; - - IP_COPY_VALUE(tmp, ip); - - if (IS_SET(snort_conf->homenet)) - { - if (sfip_contains(&snort_conf->homenet, &tmp) == SFIP_CONTAINS) - sfip_obfuscate(&snort_conf->obfuscation_net, &tmp); - } - else - { - sfip_obfuscate(&snort_conf->obfuscation_net, &tmp); - } - - tmp_buf = sfip_to_str(&tmp); - SnortSnprintf(ip_buf, buf_size, "%s", tmp_buf); - } -#endif - - return ip_buf; -} - -void PrintPacketData(const uint8_t *data, const uint32_t len) -{ - uint32_t i, j; - uint32_t total_len = 0; - uint8_t hex_buf[16]; - uint8_t char_buf[16]; - char *length_chars = " 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\n" - "------------------------------------------------------\n"; - - LogMessage("%s", length_chars); - - for (i = 0; i <= len; i++) - { - if ((i%16 == 0) && (i != 0)) - { - LogMessage("%04x ", total_len); - total_len += 16; - - for (j = 0; j < 16; j++) - { - LogMessage("%02x ", hex_buf[j]); - if (j == 7) - LogMessage(" "); - } - - LogMessage(" "); - - for (j = 0; j < 16; j++) - { - LogMessage("%c", char_buf[j]); - if (j == 7) - LogMessage(" "); - } - - LogMessage("\n"); - } - - if (i == len) - break; - - hex_buf[i%16] = data[i]; - - if (isprint((int)data[i])) - char_buf[i%16] = data[i]; - else - char_buf[i%16] = '.'; - } - - if ((i-total_len) > 0) - { - LogMessage("%04x ", total_len); - - for (j = 0; j < i-total_len; j++) - { - LogMessage("%02x ", hex_buf[j]); - if (j == 7) - LogMessage(" "); - } - - if (j < 8) - LogMessage(" "); - LogMessage("%*s", (16-j)*3, ""); - LogMessage(" "); - - for (j = 0; j < i-total_len; j++) - { - LogMessage("%c", char_buf[j]); - if (j == 7) - LogMessage(" "); - } - } - - LogMessage("\n"); -} - diff --git a/config/orionids-dev/patches/spoink_patch/spo_pf.c b/config/orionids-dev/patches/spoink_patch/spo_pf.c deleted file mode 100644 index 121920fc..00000000 --- a/config/orionids-dev/patches/spoink_patch/spo_pf.c +++ /dev/null @@ -1,462 +0,0 @@ -/* -* -* Copyright (c) 2006 Antonio Benojar -* Copyright (c) 2005 Antonio Benojar -* -* Copyright (c) 2003, 2004 Armin Wolfermann: -* -* s2c_pf_block and s2c_pf_unblock functions are based -* in Armin's Wolfermann pftabled-1.03 functions. -* -* All rights reserved. -* -* Redistribution and use in source and binary forms, with or without -* modification, are permitted provided that the following conditions -* are met: -* -* 1. Redistributions of source code must retain the above copyright -* notice, this list of conditions and the following disclaimer. -* -* 2. Redistributions in binary form must reproduce the above copyright -* notice, this list of conditions and the following disclaimer in the -* documentation and/or other materials provided with the distribution. -* -* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR -* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. -* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, -* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT -* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - - -/* - TODO - - - num. max ips. - - ipwhitelisting structure - - best ip regex expr -*/ - - -#ifndef LIST_END -#define LIST_END(head) NULL -#endif - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "event.h" -#include "decode.h" -#include "plugbase.h" -#include "spo_plugbase.h" -#include "debug.h" -#include "parser.h" -#include "util.h" -#include "log.h" -#include "mstring.h" - -#include "snort.h" - -#include "spo_pf.h" - -#ifdef HAVE_STRINGS_H -#include -#endif - -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define PFDEVICE "/dev/pf" - -typedef struct _SpoAlertPfData { - FILE *wlfile; - char *pftable; - int fd; - struct wlist_head head; -} SpoAlertPfData; - -void AlertPfInit(u_char *); -SpoAlertPfData *ParseAlertPfArgs(char *); -void AlertPf(Packet *, char *, void *, Event *); -void AlertPfCleanExit(int, void *); -void AlertPfRestart(int, void *); - -int s2c_pf_init(void); -int s2c_pf_block(int, char *, char *, int); -int s2c_pf_intbl(int, char *, int); - -int s2c_parse_line(char *, FILE*); -int s2c_parse_load_wl(FILE*, struct wlist_head*, int); -int s2c_parse_search_wl(char *, struct wlist_head); -int s2c_parse_free_wl(struct wlist_head*); -int s2c_parse_ip(char *, char *, int); - - -void AlertPfSetup(void) -{ - RegisterOutputPlugin("alert_pf", OUTPUT_TYPE_FLAG__ALERT, AlertPfInit); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Output plugin: AlertPf is setup...\n");); -} - -void AlertPfInit(u_char *args) -{ - SpoAlertPfData *data; - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Output: AlertPf Initialized\n");); - - data = ParseAlertPfArgs(args); - - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Linking AlertPf functions to call lists...\n");); - - AddFuncToOutputList(AlertPf, OUTPUT_TYPE_FLAG__ALERT, data); - AddFuncToCleanExitList(AlertPfCleanExit, data); - AddFuncToRestartList(AlertPfRestart, data); -} - - -void AlertPf(Packet *p, char *msg, void *arg, Event *event) -{ - SpoAlertPfData *data = (SpoAlertPfData *)arg; - char *ip; - int ret; - - DEBUG_WRAP(DebugMessage(DEBUG_LOG, "spoink block'n!!\n");); - - ip = inet_ntoa(p->iph->ip_src); - - if (ip == NULL) - FatalError("AlertPf() => inet_ntoa() = NULL\n", strerror(errno)); - - ret = s2c_parse_search_wl(ip, data->head); - - if (ret == 0) - s2c_pf_block(data->fd, data->pftable, inet_ntoa(p->iph->ip_src), 0); - - return; -} - -SpoAlertPfData *ParseAlertPfArgs(char *args) -{ - char **toks; - int num_toks; - SpoAlertPfData *data; - - int res = 0; - - data = (SpoAlertPfData *)SnortAlloc(sizeof(SpoAlertPfData)); - - if(args == NULL) - FatalError("Unable to load pf args\n", strerror(errno)); - - data->fd = s2c_pf_init(); - - if (data->fd == -1) - FatalError("s2c_pf_init() => no pf device\n"); - - DEBUG_WRAP(DebugMessage(DEBUG_LOG,"ParseAlertPfArgs: %s\n", args);); - - toks = mSplit(args, ",", 2, &num_toks, 0); - - if(num_toks <= 1) - FatalError("snort.conf => You must supply TWO arguments for the pf plugin...\n", strerror(errno)); - - if(strstr(toks[0], "..") != NULL) - FatalError("snort.conf => File definition contains \"..\". Do not do that!\n"); - - data->wlfile = fopen(toks[0], "r"); - - if (data->wlfile == NULL) - FatalError("snort.conf => Unable to open whitelist file\n", strerror(errno)); - - if (toks[1] == NULL) - FatalError("snort.conf => No pf table defined\n", strerror(errno)); - else - data->pftable = toks[1]; - - if (s2c_pf_intbl(data->fd, data->pftable, 0) == 0) - FatalError("pf.conf => Table %s don't exists in packet filter\n", data->pftable, strerror(errno)); - - res = s2c_parse_load_wl(data->wlfile, &data->head, 0); - if (res == -1) - FatalError("snort.conf => Unable to load whitelist\n", strerror(errno)); - - return data; -} - -void AlertPfCleanExit(int signal, void *arg) -{ - SpoAlertPfData *data = (SpoAlertPfData *)arg; - DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfCleanExit\n");); - - s2c_parse_free_wl(&data->head); - fclose(data->wlfile); - close(data->fd); - - free(data); -} - -void AlertPfRestart(int signal, void *arg) -{ - SpoAlertPfData *data = (SpoAlertPfData *)arg; - DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfRestart\n");); - - s2c_parse_free_wl(&data->head); - fclose(data->wlfile); - close(data->fd); - - free(data); -} - - -int s2c_pf_init(void) -{ - return(open(PFDEVICE, O_RDWR)); -} - -int s2c_pf_block(int dev, char *tablename, char *ip, int debug) -{ - - struct pfioc_table io; - struct pfr_table table; - struct pfr_addr addr; - struct in_addr *net_addr=NULL; - - memset(&io, 0x00, sizeof(struct pfioc_table)); - memset(&table, 0x00, sizeof(struct pfr_table)); - memset(&addr, 0x00, sizeof(struct pfr_addr)); - - strlcpy(table.pfrt_name, tablename, PF_TABLE_NAME_SIZE); - net_addr=(struct in_addr*)malloc(sizeof(struct in_addr)); - - if (net_addr == NULL ) - FatalError("s2c_pf_block() => malloc()\n", strerror(errno)); - - inet_aton(ip, (struct in_addr *)&net_addr); - memcpy(&addr.pfra_ip4addr.s_addr, &net_addr, sizeof(struct in_addr)); - - addr.pfra_af = AF_INET; - addr.pfra_net = 32; - - io.pfrio_table = table; - io.pfrio_buffer = &addr; - io.pfrio_esize = sizeof(struct pfr_addr); - io.pfrio_size = 1; - - if (ioctl(dev, DIOCRADDADDRS, &io)) - FatalError("s2c_pf_block() => ioctl() DIOCRADDADDRS\n", strerror(errno)); - - return(0); -} - -int s2c_pf_intbl(int dev, char * tablename, int debug) -{ - int i; - struct pfioc_table io; - struct pfr_table *table_aux = NULL; - - memset(&io, 0x00, sizeof(struct pfioc_table)); - - io.pfrio_buffer = table_aux; - io.pfrio_esize = sizeof(struct pfr_table); - io.pfrio_size = 0; - - if(ioctl(dev, DIOCRGETTABLES, &io)) - FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno)); - - table_aux = (struct pfr_table*)malloc(sizeof(struct pfr_table)*io.pfrio_size); - - if (table_aux == NULL) - FatalError("s2c_pf_intbl() => malloc()\n", strerror(errno)); - - io.pfrio_buffer = table_aux; - io.pfrio_esize = sizeof(struct pfr_table); - - if(ioctl(dev, DIOCRGETTABLES, &io)) - FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno)); - - for(i=0; i< io.pfrio_size; i++) { - if (!strcmp(table_aux[i].pfrt_name, tablename)) - return 1; - } - - return 0; - -} - - -int s2c_parse_line(char buf[WLMAX] , FILE* wfile) -{ - static char next_ch = ' '; - int i = 0; - - if (feof(wfile)) { - return (0); - } - do { - next_ch = fgetc(wfile); - if (i < WLMAX) - buf[i++] = next_ch; - } while (!feof(wfile) && !isspace(next_ch)); - if (i >= WLMAX) { - return (-1); - } - - buf[i] = '\0'; - return (1); -} - - -int s2c_parse_load_wl(FILE *wfile, struct wlist_head *head, int debug) -{ - - char cad[WLMAX]; - char ret[WLMAX]; - struct ipwlist *ipw2, *ipw1 = NULL; - struct flock lock; - - if (wfile == NULL) - FatalError("s2c_parse_load_wl() => Unable to open whitelist file\n", strerror(errno)); - - memset(&lock, 0x00, sizeof(struct flock)); - lock.l_type = F_RDLCK; - fcntl(fileno(wfile), F_SETLKW, &lock); - - LIST_INIT(head); - - if (s2c_parse_line(cad, wfile) == 1) { - if (s2c_parse_ip(cad, ret, debug) == 1) { - ipw1 = (struct ipwlist*)malloc(sizeof(struct ipwlist)); - if (ipw1 == NULL) - FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno)); - inet_aton(ret, &ipw1->waddr); - LIST_INSERT_HEAD(head, ipw1, elem); - - } else { - FatalError("s2c_parse_load_wl() => Invalid data in whitelist file\n", strerror(errno)); - } - } - - while(s2c_parse_line(cad, wfile) == 1) { - if (s2c_parse_ip(cad, ret, debug) == 1) { - ipw2 = (struct ipwlist*)malloc(sizeof(struct ipwlist)); - if (ipw2 == NULL) - FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno)); - inet_aton(ret, &ipw2->waddr); - LIST_INSERT_AFTER(ipw1, ipw2, elem); - ipw1 = ipw2; - } else { - break; - } - - } - - lock.l_type = F_UNLCK; - fcntl(fileno(wfile), F_SETLKW, &lock); - - return (0); -} - -/* XXX: optimize */ - -int -s2c_parse_search_wl(char *ip, struct wlist_head wl) -{ - struct ipwlist *aux2; - char *ip_aux, ip1[IPMAX], ip2[IPMAX]; - int ret; - - strlcpy(ip1, ip, sizeof(ip1)); - - for(aux2=wl.lh_first; aux2 !=NULL; aux2=aux2->elem.le_next) { - ip_aux = inet_ntoa(aux2->waddr); - strlcpy(ip2, ip_aux, sizeof(ip2)); - ret = strcmp(ip1, ip2); - - if (ret == 0) - return 1; - } - return (0); -} - - -int s2c_parse_free_wl(struct wlist_head *wl) -{ - struct ipwlist *aux, *aux2; - for(aux = LIST_FIRST(wl); aux != LIST_END(wl); aux = aux2) { - aux2 = LIST_NEXT(aux, elem); - LIST_REMOVE(aux, elem); - free(aux); - } - if (LIST_EMPTY(wl)) { - return (1); - } else { - FatalError("s2c_parse_free_wl() => Unable to free whitelist\n", strerror(errno)); - return (0); - } -} - -/* XXX: too much complex ? */ - -int s2c_parse_ip(char *cad, char ret[WLMAX], int debug) -{ - int len; - unsigned int enc=1; - regex_t *expr; - regmatch_t *resultado; - expr = (regex_t*)malloc(sizeof(regex_t)); - - bzero(ret, WLMAX); - - if (expr == NULL) - FatalError("s2c_parse_ip() => malloc()\n", strerror(errno)); - - resultado = (regmatch_t*)malloc(sizeof(regmatch_t)); - - if (resultado == NULL) - FatalError("s2c_parse_ip() => malloc()\n", strerror(errno)); - - if (regcomp(expr, REG_ADDR, REG_EXTENDED) !=0) - FatalError("s2c_parse_ip() => regcomp()\n", strerror(errno)); - - if (regexec(expr, cad, 1, resultado, 0) !=0) - enc=0; - - if (enc !=0) { - len = resultado->rm_eo - resultado->rm_so; - memcpy(ret, cad + resultado->rm_so, len); - ret[len]='\0'; - } - - free(resultado); - regfree(expr); - - if(enc) - return (1); - else { - errno = EINVAL; - return (0); - } -} diff --git a/config/orionids-dev/patches/spoink_patch/spo_pf.h b/config/orionids-dev/patches/spoink_patch/spo_pf.h deleted file mode 100644 index af07dacd..00000000 --- a/config/orionids-dev/patches/spoink_patch/spo_pf.h +++ /dev/null @@ -1,60 +0,0 @@ -/* -* -* Copyright (c) 2006 Antonio Benojar -* Copyright (c) 2005 Antonio Benojar -* -* All rights reserved. -* -* Redistribution and use in source and binary forms, with or without -* modification, are permitted provided that the following conditions -* are met: -* -* 1. Redistributions of source code must retain the above copyright -* notice, this list of conditions and the following disclaimer. -* -* 2. Redistributions in binary form must reproduce the above copyright -* notice, this list of conditions and the following disclaimer in the -* documentation and/or other materials provided with the distribution. -* -* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR -* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. -* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, -* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT -* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - -#ifndef __SPO_PF_H__ -#define __SPO_PF_H__ - -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#define WLMAX 1024 -#define IPMAX 20 -#define REG_ADDR "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}" - - -struct ipwlist { - struct in_addr waddr; - LIST_ENTRY(ipwlist) elem; -}; - -LIST_HEAD(wlist_head, ipwlist); - -void AlertPfSetup(void); - -#endif - - diff --git a/config/orionids-dev/snortDB b/config/orionids-dev/snortDB deleted file mode 100644 index c685a368..00000000 Binary files a/config/orionids-dev/snortDB and /dev/null differ diff --git a/config/orionids-dev/snortDBrules b/config/orionids-dev/snortDBrules deleted file mode 100644 index 829a589b..00000000 Binary files a/config/orionids-dev/snortDBrules and /dev/null differ diff --git a/config/orionids-dev/snortDBtemp b/config/orionids-dev/snortDBtemp deleted file mode 100644 index 56ab2842..00000000 Binary files a/config/orionids-dev/snortDBtemp and /dev/null differ diff --git a/config/orionids-dev/snort_alerts.php b/config/orionids-dev/snort_alerts.php deleted file mode 100644 index 3cb79c5c..00000000 --- a/config/orionids-dev/snort_alerts.php +++ /dev/null @@ -1,189 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); - -$alertnumber = $generalSettings['alertnumber']; - -$arefresh_on = ($generalSettings['arefresh'] == 'on' ? 'checked' : ''); - - $pgtitle = "Services: Snort: Alerts"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - -
-
-
- -
-
-



Please Wait...

-
-
-

-
-
-
- - - -
- - - -
- -
-
- - - - - - - - -
- -
- -
- -
- - -
- - - - - - - -
Last 255 Alert EntriesLatest Alert Entries Are Listed First
- - - - -
- - - - - - -
Save or Remove Logs -
- - - Save All Log Files. -
- 		-
- - - Warning: all logs will be deleted. -
-
Auto Refresh and Log View -
- - - > - Auto Refresh - Default ON. -
- - Limit entries to view. Default 250. - - - - - - - -
- - - -
-
- - - -
- - - - - - - - diff --git a/config/orionids-dev/snort_barnyard.php b/config/orionids-dev/snort_barnyard.php deleted file mode 100644 index 1cd2113b..00000000 --- a/config/orionids-dev/snort_barnyard.php +++ /dev/null @@ -1,289 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - - if (!is_array($a_list)) - { - $a_list = array(); - } - - - - $pgtitle = "Snort: Interface: Barnyard2 Edit"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - - - - - - -
-
-
- -
-
-



Please Wait...

-
-
-

-
-
-
- - - -
- - - -
- -
-
- - - - - - - - -
- -
- -
- -
- - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
General Barnyard2 Settings
Enable - > - Enable Barnyard2 on this Interface
- This will enable barnyard2 for this interface. You will also have to set the database credentials. -
Interface - -
- Choose which interface this rule applies to.
- Hint: in most cases, you'll want to use WAN here. -
Mysql Settings
Log to a Mysql Database - -
- Example: output database: alert, mysql, dbname=snort user=snort host=localhost password=xyz
- Example: output database: log, mysql, dbname=snort user=snort host=localhost password=xyz -
Advanced Settings
Advanced configuration pass through - -
- Arguments here will be automatically inserted into the running barnyard2 configuration. -
  - - -
  - Note: - Please save your settings befor you click start. -
-
-
-
- - - - - - - - diff --git a/config/orionids-dev/snort_blocked.php b/config/orionids-dev/snort_blocked.php deleted file mode 100644 index fdc12480..00000000 --- a/config/orionids-dev/snort_blocked.php +++ /dev/null @@ -1,193 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - - -$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); - -$blertnumber = $generalSettings['blertnumber']; - -$brefresh_on = ($generalSettings['brefresh'] == 'on' ? 'checked' : ''); - - $pgtitle = "Services: Snort Blocked Hosts"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
-
-
- -
-
-



Please Wait...

-
-
-

-
-
-
- - - -
- - - -
- -
-
- - - - - - - - -
- -
- -
- -
- - -
- - - - - - - -
Last 500 Blocked.This page lists hosts that have been blocked by Snort.  Hosts are removed every hour.
- - - - - -
-
- - - - - - - -
Save or Remove Hosts -
- - - Save All Blocked Hosts -
- 		-
- - - Warning: all hosts will be removed. -
-
Auto Refresh and Log View -
- - - Auto Refresh - > - Default ON. -
- - Limit entries to view. Default 500. - - - - - - - -
- - -
-
- - - -
- - - - - - - - diff --git a/config/orionids-dev/snort_build.inc b/config/orionids-dev/snort_build.inc deleted file mode 100644 index 2c18d3d3..00000000 --- a/config/orionids-dev/snort_build.inc +++ /dev/null @@ -1,1288 +0,0 @@ - \ - cmd_validity STRU < char FRP > \ - cmd_validity ALLO < int [ char R int ] > \ - cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > \ - cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \ - cmd_validity PORT < host_port > - -preprocessor ftp_telnet_protocol: ftp client default \ - max_resp_len 256 \ - bounce yes \ - telnet_cmds yes - -EOD; - - $def_ftp_preprocessor_info_chk = $ifaceSettingsArray['ftp_preprocessor']; - if ($def_ftp_preprocessor_info_chk === 'on') { - $def_ftp_preprocessor_type = $snort_ftp_preprocessor; - }else{ - $def_ftp_preprocessor_type = ""; - } - - /* def smtp_preprocessor */ - $snort_smtp_preprocessor = << diff --git a/config/orionids-dev/snort_define_servers.php b/config/orionids-dev/snort_define_servers.php deleted file mode 100644 index 05e7709e..00000000 --- a/config/orionids-dev/snort_define_servers.php +++ /dev/null @@ -1,450 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - - - $pgtitle = "Snort: Interface Define Servers:"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - -
-
-
- -
-
-



Please Wait...

-
-
-

-
-
-
- - - -
- - - -
- -
-
- - - - - - - - -
- -
- -
- -
- - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  - Note:
- Please save your settings before you click start.
- Please make sure there are no spaces in your definitions. -
Define Servers
Define DNS_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define DNS_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 53. -
Define SMTP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define SMTP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25. -
Define Mail_Ports - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25,143,465,691. -
Define HTTP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define WWW_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define HTTP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 80. -
Define SQL_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define ORACLE_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 1521. -
Define MSSQL_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 1433. -
Define TELNET_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define TELNET_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 23. -
Define SNMP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define SNMP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 161.
Define FTP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define FTP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 21. -
Define SSH_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define SSH_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is Pfsense SSH port. -
Define POP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define POP2_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 109. -
Define POP3_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 110. -
Define IMAP_SERVERS - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define IMAP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 143. -
Define SIP_PROXY_IP - -
- Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. -
Define SIP_PROXY_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 5060:5090,16384:32768. -
Define AUTH_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 113. -
Define FINGER_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 79. -
Define IRC_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 6665,6666,6667,6668,6669,7000. -
Define NNTP_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 119. -
Define RLOGIN_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 513. -
Define RSH_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 514. -
Define SSL_PORTS - -
- Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25,443,465,636,993,995. -
  - - -
  - Note: -
- Please save your settings before you click start. -
-
-
-
- - - - - - - - diff --git a/config/orionids-dev/snort_download_rules.inc b/config/orionids-dev/snort_download_rules.inc deleted file mode 100644 index 8953a65c..00000000 --- a/config/orionids-dev/snort_download_rules.inc +++ /dev/null @@ -1,1036 +0,0 @@ - 0; - "); - - }else{ - - $result = sqlite_query($db, - "SELECT * FROM {$table} where {$type} = '{$id_uuid}'; - "); - } - - if ($type == 'rdbuuid' || $type == 'All') { - $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); - }else{ - $chktable = sqlite_fetch_array($result, SQLITE_ASSOC); - } - - sqlite_close($db); - - return $chktable; - - -} // end func - -function snortSql_updateRuleSetList($type, $value, $file_size, $downloaded, $filename) -{ - - $dbname = 'snortDBtemp'; - $table = 'SnortDownloads'; - $addDate = date(U); - - // do let user pick the DB path - $db = sqlite_open("/var/snort/{$dbname}"); - - if ($type === 'percent2'){ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}', filesize = '{$file_size}', downloaded = '{$downloaded}' where filename = '{$filename}'; - "); - } - - - if ($type === 'percent'){ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}' where filename = '{$filename}'; - "); - } - - if ($type === 'msg1'){ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '1'; - "); - } - - if ($type === 'msg2'){ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '2'; - "); - } - - /* - * INPORTANT: - * Register worker to prevent loops and ghost process - * Needs to be watched, - */ - - if ($type === 'working'){ - - $getmypid = getmypid(); - $getmyfilename = $_SERVER['SCRIPT_NAME']; - - $resultChk = sqlite_query($db, - "SELECT * FROM RegisterWorker WHERE uuid = 'jdjEf!773&h3bhFd6A'; - "); - - $resultChkFinal = sqlite_fetch_all($resultChk, SQLITE_ASSOC); - - if (!empty($resultChkFinal)) { - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE RegisterWorker SET date = '{$addDate}', processid = '{$getmypid}', filename = '{$getmyfilename}', working = '{$value}' where uuid = 'jdjEf!773&h3bhFd6A'; - "); - }else{ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "INSERT INTO RegisterWorker (date, processid, filename, working, uuid) VALUES ('{$addDate}', '{$getmypid}', '{$getmyfilename}', '{$value}', 'jdjEf!773&h3bhFd6A'); - "); - } - } - - - if ($type === 'snortWait'){ - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$table} SET waittime = '{$addDate}' where filename = '{$filename}'; - "); - } - - if (sqlite_changes($db) < 1){ - sqlite_close($db); - return 'Error in query'; - } - - sqlite_close($db); - - -} - -// reapply rule settings -function reapplyRuleSettings_run($sidRule_array) -{ - - $sid_array = snortSql_fetchAllSettings2('snortDBrules', 'SnortruleSigs', 'rdbuuid', $sidRule_array); - - if (!empty($sid_array)) { - foreach ($sid_array as $sid) - { - if (!empty($sid['enable']) && !empty($sid['signatureid']) && !empty($sid['rdbuuid']) && !empty($sid['signaturefilename'])) { - if ($sid['enable'] === 'on') { - exec('/usr/bin/sed -i \'\' \'s/^# \(.*sid:' . "{$sid['signatureid']}" . ';.*\)/\1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); - } - - if ($sid['enable'] === 'off') { - exec('/usr/bin/sed -i \'\' \'s/^\(alert.*sid:' . "{$sid['signatureid']}" . ';.*\)/# \1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); - } - } - } - } - - // NOTES: DO NOT REMOVE BELOW COMMENTS - // returns file pathe of the sid - // $testing = exec("grep -ri 'sid: \?1225; ' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules | tail -n1 | awk -F: '{print $1}'"); - // see if sid is enabled - // $testing2 = exec("sed -n '/^alert.*sid:1225;.*/p' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules"); - // enable a sid - // sed -i '' "s/^# \(.*sid:1225;.*\)/\1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules - // disable a sid - // sed -i '' "s/^\(alert.*sid:1225;.*\)/# \1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules - // grep "^alert.*sid:.*;" rules/emerging-worm.rules | grep -oh "\w*sid:[0-9][^*;]\w*" | awk -F: '{print $2}' - // sed -n '/^320 || .*/{p;q;}' rules/ ../etc/sid-msg.map | awk -F '|' '{print $3}' | sed -e 's/^[ \t]*//' - - -} - -function snortCmpareMD5($type, $path1, $path2, $filename_md5) -{ - update_output_window2('ms2', 'Checking ' . $filename_md5 . ' MD5...'); - - if (file_exists("{$path1}/{$filename_md5}")){ - - if ($type == 'string'){ - $md5_check_new = @file_get_contents("{$path1}/{$filename_md5}"); - $md5_check_old = @file_get_contents("{$path2}/{$filename_md5}"); - if ($md5_check_new !== $md5_check_old){ - update_output_window2('ms2', "$filename_md5 MD5s do not match..."); - return false; - } - } - - if ($type == 'md5'){ - //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' - $md5_check_new2 = exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'"); - $md5_check_old2 = exec("/sbin/md5 {$path2}/{$filename_md5} | /usr/bin/awk '{print $4}'"); - if ($md5_check_new != $md5_check_old){ - update_output_window2('ms2', "$filename_md5 MD5s do not match..."); - return false; - } - } - - if ($type == 'md5FileChk') { - //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' - $md5_check_new = trim(exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'")); - - $md5_check_old = exec("/bin/cat {$path1}/{$filename_md5}.md5"); - - $md5_check_old2 = trim(preg_replace('/"/', '', $md5_check_old)); - - if ($md5_check_new != $md5_check_old2){ - update_output_window2('ms2', "$filename_md5 MD5s do not match..."); - return false; - } - } - - - - } - - update_output_window2('ms2', "$filename_md5 MD5 File Check Passed..."); - return true; -} - - -/* - * update_output_window: update bottom textarea dynamically. - */ -function update_output_window2($type, $text) -{ - if ($type === 'ms1') { - $msg = 1; - } - - if ($type === 'ms2') { - $msg = 2; - } - - if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on'){ - echo - ' - - '; - ob_flush(); - apc_clear_cache(); - - }else{ - echo "\n" . $type . ': ' . $text; - } - -} - -// returns array that matches pattern, option to replace objects in matches -function snortScanDirFilter2($arrayList, $pattmatch, $pattreplace, $pattreplacewith) -{ - foreach ( $arrayList as $val ) - { - if (preg_match($pattmatch, $val, $matches)) { - if ($pattreplace != '') { - $matches2 = preg_replace($pattreplace, $pattreplacewith, $matches[0]); - $filterDirList[] = $matches2; - }else{ - $filterDirList[] = $matches[0]; - } - } - } - return $filterDirList; -} - -// set page vars -$generalSettings = snortSql_fetchAllSettings2('snortDB', 'SnortSettings', 'id', '1'); - -// Setup file names and dir -$tmpfname = '/usr/local/etc/snort/snort_download'; -$snortdir = '/usr/local/etc/snort'; -$snortdir_rules = '/usr/local/etc/snort/snortDBrules/snort_rules'; -$emergingdir_rules = '/usr/local/etc/snort/snortDBrules/emerging_rules'; -$pfsensedir_rules = '/usr/local/etc/snort/snortDBrules/pfsense_rules'; -$customdir_rules = '/usr/local/etc/snort/snortDBrules/custom_rules'; -$snort_filename_md5 = 'snortrules-snapshot-2905.tar.gz.md5'; -$snort_filename = 'snortrules-snapshot-2905.tar.gz'; -$emergingthreats_filename_md5 = 'emerging.rules.tar.gz.md5'; -$emergingthreats_filename = 'emerging.rules.tar.gz'; -$pfsense_rules_filename_md5 = 'pfsense_rules.tar.gz.md5'; -$pfsense_rules_filename = 'pfsense_rules.tar.gz'; - -// START of MAIN function -function sendUpdateSnortLogDownload($console) -{ - - if ($console === 'console'){ - $GLOBALS['tmp']['snort']['downloadupdate']['console'] = 'on'; - } - - if ($console !== 'console') { - - echo - ' - - '; - - } - - - //bring in the global vars - global $generalSettings, $tmpfname, $snortdir, $snortdir_rules, $emergingdir_rules, $pfsensedir_rules, $customdir_rules, $snort_filename_md5, $snort_filename, $emergingthreats_filename_md5, $emergingthreats_filename, $pfsense_rules_filename_md5, $pfsense_rules_filename; - - /* Make shure snortdir exits */ - if (!file_exists("{$snortdir}")) { - exec("/bin/mkdir -p {$snortdir}"); - } - if (!file_exists("{$tmpfname}")) { - exec("/bin/mkdir -p {$tmpfname}"); - } - if (!file_exists("{$snortdir_rules}")) { - exec("/bin/mkdir -p {$snortdir_rules}"); - } - if (!file_exists("{$emergingdir_rules}")) { - exec("/bin/mkdir -p {$emergingdir_rules}"); - } - if (!file_exists("{$pfsensedir_rules}")) { - exec("/bin/mkdir -p {$pfsensedir_rules}"); - } - if (!file_exists("{$customdir_rules}")) { - exec("/bin/mkdir -p {$customdir_rules}"); - } - if (!file_exists("{$snortdir}/signatures")) { - exec("/bin/mkdir -p {$snortdir}/signatures"); - } - if (!file_exists('/usr/local/lib/snort/dynamicrules/')) { - exec('/bin/mkdir -p /usr/local/lib/snort/dynamicrules/'); - } - - - /* Set user agent to Mozilla */ - ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); - ini_set("memory_limit","150M"); - - - // Get file that does not use redirects, mostly for none snort.org downloads - function snort_file_get_contents($tmpfname, $snort_filename, $snort_UrlGet) - { - if (!file_exists("{$tmpfname}/{$snort_filename}") || filesize("{$tmpfname}/{$snort_filename}") <= 0){ - update_output_window2('ms2', 'Downloading ' . $snort_filename. ' MD5...'); - ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); - $file = file_get_contents("$snort_UrlGet/{$snort_filename}"); // use a @ infront of file_get_contents when in production - $f = fopen("{$tmpfname}/{$snort_filename}", 'w'); - fwrite($f, $file); - fclose($f); - update_output_window2('ms2', 'Finnished Downloading ' . $snort_filename. ' MD5...'); - } - } - - function read_header2($ch, $string) { - global $file_size, $fout; - $length = strlen($string); - $regs = ""; - ereg("(Content-Length:) (.*)", $string, $regs); - if($regs[2] <> "") { - $file_size = intval($regs[2]); - } - ob_flush(); - return $length; - } - - function read_body2($ch, $string) { - global $fout, $file_size, $downloaded, $sendto, $static_status, $static_output, $lastseen; - global $pkg_interface; - $length = strlen($string); - $downloaded += intval($length); - if($file_size > 0) { - $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); - $downloadProgress = 100 - $downloadProgress; - } else - $downloadProgress = 0; - if($lastseen <> $downloadProgress and $downloadProgress < 101) { - if($sendto == "status") { - if($pkg_interface == "console") { - if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { - $tostatus = $static_status . $downloadProgress . "%"; - update_status($tostatus); - } - } else { - $tostatus = $static_status . $downloadProgress . "%"; - update_status($tostatus); - } - } else { - if($pkg_interface == "console") { - if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { - $tooutput = $static_output . $downloadProgress . "%"; - update_output_window($tooutput); - } - } else { - $tooutput = $static_output . $downloadProgress . "%"; - update_output_window($tooutput); - } - } - update_progress_bar($downloadProgress); - $lastseen = $downloadProgress; - } - if($fout) - fwrite($fout, $string); - ob_flush(); - return $length; - } - - /* - * update_progress_bar($percent): updates the javascript driven progress bar. - */ - function update_progress_bar2($percent, $file_size, $downloaded) - { - if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on') { - if (!empty($percent)) { - echo - ' - - '; - } - - }else{ - echo "\n" . 'percent: ' . $percent . ' filesize: ' . $file_size . ' downloaded: ' . $downloaded; - } - } - - - function read_body_firmware($ch, $string) - { - global $fout, $file_size, $downloaded, $counter; - $length = strlen($string); - $downloaded += intval($length); - $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); - $downloadProgress = 100 - $downloadProgress; - $counter++; - if($counter > 150) { - update_progress_bar2($downloadProgress, $file_size, $downloaded); - flush(); - $counter = 0; - } - fwrite($fout, $string); - return $length; - } - - function download_file_with_progress_bar2($url_file, $destination, $workingfile, $readbody = 'read_body2') - { - global $ch, $fout, $file_size, $downloaded; - $file_size = 1; - $downloaded = 1; - $destination_file = $destination . '/' . $workingfile; - - /* open destination file */ - $fout = fopen($destination_file, "wb"); - - /* - * Originally by Author: Keyvan Minoukadeh - * Modified by Scott Ullrich to return Content-Length size - */ - - $ch = curl_init(); - curl_setopt($ch, CURLOPT_URL, $url_file); - curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'read_header2'); - curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); - curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); - curl_setopt($ch, CURLOPT_WRITEFUNCTION, $readbody); - curl_setopt($ch, CURLOPT_NOPROGRESS, '1'); - curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, '5'); - curl_setopt($ch, CURLOPT_TIMEOUT, 0); - - curl_exec($ch); - $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); - if($fout) - fclose($fout); - curl_close($ch); - return ($http_code == 200) ? true : $http_code; - } - -// ----------------------------------------------------- Begin Code -------------------------------------------- - - - // rm all tmp filea - @exec("/bin/rm -r $tmpfname/*"); - - // Set all downloads to be false, download by default - - $snort_md5_check_ok = false; - $emerg_md5_check_ok = false; - $pfsense_md5_check_ok = false; - - // define checks - $oinkid = $generalSettings['oinkmastercode']; - - $emergingthreatscode = $generalSettings['emergingthreatscode']; - - // dsable downloads if there settings are off - if ($generalSettings['snortdownload'] === 'off') { - $snort_md5_check_ok = true; - } - - if ($generalSettings['emergingthreatsdownload'] == 'off') { - $emerg_md5_check_ok = true; - } - - if ($oinkid == '' && $generalSettings['snortdownload'] === 'on') { - update_output_window2('ms1', 'Snort Error!'); - update_output_window2('ms2', 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'); - exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'"); - return false; - } - - if ($emergingthreatscode === '' && $generalSettings['snortdownload'] === 'pro') { - update_output_window2('ms1', 'Snort Error!'); - update_output_window2('ms2', 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'); - exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'"); - return false; - } - - if ($generalSettings['snortdownload'] === 'off' && $generalSettings['emergingthreatsdownload'] === 'off') { // note: basic and pro - update_output_window2('ms1', 'Snort Error!'); - update_output_window2('ms2', 'SnortStartup: No rules have been selected to download.'); - exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'No rules have been selected to download.'"); - return false; - } - - /* - * Check MD5s and MARK - * - */ - - update_output_window2('ms1', 'Starting MD5 checks...'); - - // check is we need to wait - update_output_window2('ms2', 'Checking Wait Status for Snort.org...'); - $getSnort_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $snort_filename); - - if (date(U) > $getSnort_filename_Waittime_chk['waittime'] + 900) { - update_output_window2('ms2', 'Snort.org Wait Time Status: OK...'); - }else{ - update_output_window2('ms2', 'Snort.org Wait Time Status: Wait 15 min Please...'); - $snort_md5_check_ok = true; - $snort_wait = true; - } - - // check is we need to wait - update_output_window2('ms2', 'Checking Wait Status for Emergingthreats.net...'); - $getEmergingthreats_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $emergingthreats_filename); - - if (date(U) > $getEmergingthreats_filename_Waittime_chk['waittime'] + 900) { - update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: OK...'); - }else{ - update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: Wait 15 min Please...'); - $emerg_md5_check_ok = true; - $emerg_wait = true; - } - - // if all rules need wait stop - if ($snort_wait === true && $emerg_wait === true) { - return false; - } - - // download snort.org md5 and compare - if ($snort_md5_check_ok === false) { - - snort_file_get_contents($tmpfname, $snort_filename_md5, 'http://www.snort.org/pub-bin/oinkmaster.cgi/' . $oinkid); - snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename_md5); // finsh percent - - // if snort.org md5 do not match - if(snortCmpareMD5('string', $tmpfname, $snortdir_rules, $snort_filename_md5)) { - $snort_md5_check_ok = true; - } - - } - - // download emergingthreats.net md5 and compare - if ($emerg_md5_check_ok === false) { - - snort_file_get_contents($tmpfname, $emergingthreats_filename_md5, 'http://rules.emergingthreats.net/open/snort-2.9.0'); - snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename_md5); // finsh percent - - // if emergingthreats.net md5 do not match - if(snortCmpareMD5('string', $tmpfname, $emergingdir_rules, $emergingthreats_filename_md5)) { - $emerg_md5_check_ok = true; - } - - } - - // download pfsense.org md5 and compare - snort_file_get_contents($tmpfname, $pfsense_rules_filename_md5, 'http://www.pfsense.com/packages/config/snort/pfsense_rules'); - snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename_md5); // finsh percent - - // if pfsense.org md5 do not match - if(snortCmpareMD5('string', $tmpfname, $pfsensedir_rules, $pfsense_rules_filename_md5)) { - $pfsense_md5_check_ok = true; - } - - /* - * If all rule type is not check clean up. - */ - - /* Make Clean Snort Directory emergingthreats not checked */ - if ($snort_md5_check_ok === false && $emergingthreatsdownload === 'off') { - update_output_window2('ms1', 'Cleaning the emergingthreats Directory...'); - exec("/bin/rm {$snortdir}/emerging_rules/*.rules"); - exec("/bin/rm {$snortdir}/version.txt"); - update_output_window2('ms2', 'Done cleaning emrg direcory.'); - } - - /* Make Clean Snort Directory snort.org not checked */ - if ($emerg_md5_check_ok === false && $snortdownload !== 'on') { - update_output_window2('ms1', 'Cleaning the snort Directory...'); - exec("/bin/rm {$snortdir}/snort_rules/*.rules"); - exec("/bin/rm {$snortdir}/snortrules-snapshot-2905.tar.gz.md5"); - update_output_window2('ms2', 'Done cleaning snort direcory.'); - } - - - /* Check if were up to date exits */ - if ($snort_md5_check_ok === true && $emerg_md5_check_ok === true && $pfsense_md5_check_ok === true) { - update_output_window2('ms1', 'Your rules are up to date...'); - return false; - } - - - /* You are Not Up to date, always stop snort when updating rules for low end machines */; - update_output_window2('ms1', 'You are NOT up to date...'); - update_output_window2('ms2', 'Stopping Snort and Barnyard2 service...'); - $chk_if_snort_up = exec('pgrep -x snort'); - $chk_if_barnyad_up = exec('pgrep -x barnyad2'); - if ($chk_if_snort_up != '') { - exec('/usr/bin/touch /tmp/snort_download_halt.pid'); // IMPORTANT: incase of script crash or error, Mabe use DB - exec('/usr/bin/killall snort'); - if ($chk_if_barnyad_up != ''){ - exec('/usr/bin/killall barnyad2'); - } - sleep(2); - } - - - /* download snortrules file */ - if ($snort_md5_check_ok === false) { - - $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $snort_filename; - update_output_window2('ms1', 'Snort.org: Starting Download...'); - update_output_window2('ms2', 'May take a while...'); - download_file_with_progress_bar2("http://www.snort.org/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); - //download_file_with_progress_bar2("http://theseusnetworking.com/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); - update_progress_bar2(100, '', ''); // finsh percent - snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename); // finsh percent, add date time finnished - update_output_window2('ms2', 'Snort.org: Finished Download...'); - - // if md5 does not match then the file is bad or snort.org says wait 15 min - update_output_window2('ms1', 'Snort.org MD5 File Check ...'); - if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $snort_filename)) { - - $snort_filename_wait_ck = exec("/usr/bin/egrep '\bYou must wait 15\b' {$tmpfname}/{$snort_filename}"); - if ($snort_filename_wait_ck != '') { - update_output_window2('ms2', 'Snort.org: You must wait 15 min...'); - } - - // disable snort.org download - $snort_md5_check_ok = true; - $snort_filename_corrupted = true; - - } - } - - /* download emergingthreats file */ - if ($emerg_md5_check_ok === false) { - - $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $emergingthreats_filename; - update_output_window2('ms1', 'Emergingthreats.net: Starting Download...'); - update_output_window2('ms2', 'May take a while...'); - download_file_with_progress_bar2("http://rules.emergingthreats.net/open/snort-2.9.0/{$emergingthreats_filename}", $tmpfname, $emergingthreats_filename, "read_body_firmware"); - update_progress_bar2(100, '', ''); // finsh percent - snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename); // finsh percent - update_output_window2('ms2', 'Emergingthreats.net: Finished Download...'); - - // if md5 does not match then the file is bad or snort.org says wait 15 min - update_output_window2('ms1', 'Emergingthreats MD5 File Check ...'); - if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $emergingthreats_filename)) { - - // disable snort.org download - $emerg_md5_check_ok = true; - $emerg_filename_corrupted = true; - - } - } - - /* download pfsense rule file */ - if ($pfsense_md5_check_ok === false) { - - $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $pfsense_rules_filename; - update_output_window2('ms1', 'pfSense.org: Starting Download...'); - update_output_window2('ms2', 'May take a while...'); - download_file_with_progress_bar2("http://www.pfsense.com/packages/config/snort/pfsense_rules/{$pfsense_rules_filename}", $tmpfname, $pfsense_rules_filename, "read_body_firmware"); - update_progress_bar2(100, '', ''); // finsh percent - snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename); // finsh percent - update_output_window2('ms2', 'pfSense.org: Finished Download...'); - - // if md5 does not match then the file is bad or snort.org says wait 15 min - update_output_window2('ms1', 'pfSense.org MD5 File Check ...'); - if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $pfsense_rules_filename)) { - - // disable snort.org download - $pfsense_md5_check_ok = true; - - } - } - - // if both files are corrupted stop - if ($snort_filename_corrupted === true && $emerg_filename_corrupted === true) { - update_output_window2('ms1', 'Snort.org and Emergingthreats.net files are corrupted.'); - update_output_window2('ms2', 'Stoping Script...'); - return false; - } - - /* - * START: Untar Files - */ - - // Untar snort rules file individually to help people with low system specs - if ($snort_md5_check_ok === false && file_exists("{$tmpfname}/{$snort_filename}")) { - - update_output_window2('ms1', 'Extracting Snort.org rules...'); - update_output_window2('ms2', 'May take a while...'); - - function build_SnortRuleDir() - { - global $tmpfname, $snortdir, $snortdir_rules, $snort_filename; - - // find out if were in 1.2.3-RELEASE - $pfsense_ver_chk = exec('/bin/cat /etc/version'); - if ($pfsense_ver_chk === '1.2.3-RELEASE') { - $pfsense_stable = 'yes'; - }else{ - $pfsense_stable = 'no'; - } - - // get the system arch - $snort_arch_ck = exec('/usr/bin/uname -m'); - if ($snort_arch_ck === 'i386') { - $snort_arch = 'i386'; - }else{ - $snort_arch = 'x86-64'; // amd64 - } - - if ($pfsense_stable === 'yes') { - $freebsd_version_so = 'FreeBSD-7-3'; - }else{ - $freebsd_version_so = 'FreeBSD-8-1'; - } - - // extract snort.org rules and add prefix to all snort.org files - @exec("/bin/rm -r {$snortdir_rules}/rules"); - exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} rules/"); - - $snort_dirList = scandir("{$snortdir_rules}/rules"); // Waning: only in php 5 - $snortrules_filterList = snortscandirfilter2($snort_dirList, '/.*\.rules/', '/\.rules/', ''); - - if (!empty($snortrules_filterList)) { - foreach ($snortrules_filterList as $snort_rule_move) - { - exec("/bin/mv -f {$snortdir_rules}/rules/{$snort_rule_move}.rules {$snortdir_rules}/rules/snort_{$snort_rule_move}.rules"); - } - } - - // extract so rules - exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/"); - exec("/bin/mv -f {$snortdir_rules}/so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/* /usr/local/lib/snort/dynamicrules/"); - - // list so_rules and exclude dir - exec("/usr/bin/tar --exclude='precompiled' --exclude='src' -tf {$tmpfname}/{$snort_filename} so_rules", $so_rules_list); - - $so_rulesPattr = array('/\//', '/\.rules/'); - $so_rulesPattw = array('', ''); - - // build list of so rules - $so_rules_filterList = snortscandirfilter2($so_rules_list, '/\/.*\.rules/', $so_rulesPattr, $so_rulesPattw); - - if (!empty($so_rules_filterList)) { - // cp rule to so tmp dir - foreach ($so_rules_filterList as $so_rule) - { - - exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/{$so_rule}.rules"); - - } - // mv and rename so rules - foreach ($so_rules_filterList as $so_rule_move) - { - exec("/bin/mv -f {$snortdir_rules}/so_rules/{$so_rule_move}.rules {$snortdir_rules}/rules/snort_{$so_rule_move}.so.rules"); - } - } - - exec("/bin/rm -r {$snortdir_rules}/so_rules"); - - // extract base etc files - exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir} etc/"); - - } - build_SnortRuleDir(); - // cp md5 to main snort dir - exec("/bin/cp {$tmpfname}/{$snort_filename_md5} {$snortdir_rules}/{$snort_filename_md5}"); - update_output_window2('ms2', 'Done extracting Snort.org Rules.'); - } - - /* Untar emergingthreats rules to tmp */ - if ($emerg_md5_check_ok === false && file_exists("{$tmpfname}/{$emergingthreats_filename}")) { - if (file_exists("{$tmpfname}/{$emergingthreats_filename}")) { - update_output_window2('ms1', 'Extracting Emergingthreats Rules...'); - update_output_window2('ms2', 'May take a while...'); - @exec("/bin/rm -r {$emergingdir_rules}/rules"); - exec("/usr/bin/tar xzf {$tmpfname}/{$emergingthreats_filename} -C {$emergingdir_rules} rules/"); - exec("/bin/cp {$tmpfname}/{$emergingthreats_filename_md5} {$emergingdir_rules}/{$emergingthreats_filename_md5}"); - update_output_window2('ms2', 'Done extracting Emergingthreats.net Rules.'); - } - } - - /* Untar Pfsense rules to tmp */ - if ($pfsense_md5_check_ok === false && file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { - if (file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { - update_output_window2('ms1', 'Extracting Pfsense rules...'); - update_output_window2('ms1', 'May take a while...'); - @exec("/bin/rm -r {$pfsensedir_rules}/rules"); - exec("/usr/bin/tar xzf {$tmpfname}/{$pfsense_rules_filename} -C {$pfsensedir_rules} rules/"); - exec("/bin/cp {$tmpfname}/{$pfsense_rules_filename_md5} {$pfsensedir_rules}/{$pfsense_rules_filename_md5}"); - update_output_window2('ms2', 'Done extracting pfSense.org Rules.'); - - } - } - - /* double make shure cleanup emerg rules that dont belong */ - if (file_exists("/usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so")) { - exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so"); - exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example\*"); - } - - // make sure default rules are in the right format - update_output_window2('ms1', 'Reformatting Rules To One Standard...'); - update_output_window2('ms2', 'Please Wait...'); - exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$snortdir_rules}/rules/*.rules"); // remove white spaces from begining of line - exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); - - exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$emergingdir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); - - exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$pfsensedir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); - exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); - update_output_window2('ms2', 'Done...'); - - /* create a msg-map for snort */ - update_output_window2('ms1', 'Updating Alert Sid Messages...'); - update_output_window2('ms2', 'Please Wait...'); - exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$snortdir_rules}/rules > /usr/local/etc/snort/etc/sid-msg.map"); - exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$emergingdir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); - exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$pfsensedir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); - update_output_window2('ms2', 'Done...'); - - // create default dir - if (!file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/default/rules'); - } - - // cp new rules to default dir - exec('/bin/rm /usr/local/etc/snort/snortDBrules/DB/default/rules/*.rules'); - exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); - exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); - exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); - - - // reapplay rules from DB cp base rules to dirs - $sidOnOff_array = snortSql_fetchAllSettings2('snortDBrules', 'Snortrules', 'All', ''); - - if (!empty($sidOnOff_array)) { - update_output_window2('ms1', 'Reapplying User Settings...'); - update_output_window2('ms2', 'Please Wait...'); - foreach ($sidOnOff_array as $preSid_Array) - { - if (!file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules")) { - exec("/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); - } - - exec("/bin/rm /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules/*.rules"); - exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); - exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); - exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); - reapplyRuleSettings_run($preSid_Array['uuid']); - update_output_window2('ms2', 'Done...'); - } - } - - // cp snort conf's to Ifaces - $ifaceConfMaps_array = snortSql_fetchAllSettings2('snortDB', 'SnortIfaces', 'All', ''); - - if (!empty($ifaceConfMaps_array)) { - update_output_window2('ms1', 'Reapplying User Settings...'); - update_output_window2('ms2', 'Please Wait...'); - foreach ($ifaceConfMaps_array as $preIfaceConfMaps_array) - { - // create iface dir if missing - if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}")) { - exec("/bin/mkdir -p /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - } - - // create rules dir soft link if setting is default - if ($preIfaceConfMaps_array['ruledbname'] === 'default' || $preIfaceConfMaps_array['ruledbname'] === '') { - if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { - exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/default/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); - } - } - - // create rules dir soft link if setting is not default - if ($preIfaceConfMaps_array['ruledbname'] !== 'default' || $preIfaceConfMaps_array['ruledbname'] != '') { - if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules")) { - exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); - } - } - - exec("/bin/cp {$snortdir}/etc/*.config /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - exec("/bin/cp {$snortdir}/etc/*.conf /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - exec("/bin/cp {$snortdir}/etc/*.map /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - exec("/bin/cp {$snortdir}/etc/generators /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - exec("/bin/cp {$snortdir}/etc/sid /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); - - reapplyRuleSettings_run($preSid_Array['uuid']); - update_output_window2('ms2', 'Done...'); - } - } - - - // remove old $tmpfname files */ - update_output_window2('ms1', 'Removing old files...'); - update_output_window2('ms2', 'Working...'); - if (file_exists('/usr/local/etc/snort/tmp')) { - exec("/bin/rm -r /usr/local/etc/snort/tmp/snort_rules_up"); - exec("/bin/rm -r /usr/local/etc/snort/tmp/rules_bk"); - apc_clear_cache(); - } - update_output_window2('ms2', 'Done...'); - - // php code to flush out cache some people are reportting missing files this might help - apc_clear_cache(); - exec("/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync"); - - // make all dirs snorts - exec("/usr/sbin/chown -R snort:snort /var/log/snort"); - exec("/usr/sbin/chown -R snort:snort /usr/local/etc/snort"); - exec("/usr/sbin/chown -R snort:snort /usr/local/lib/snort"); - exec("/bin/chmod -R 755 /var/log/snort"); - exec("/bin/chmod -R 755 /usr/local/etc/snort"); - exec("/bin/chmod -R 755 /usr/local/lib/snort"); - - - update_output_window2('ms1', 'Finnished Updateing...'); - update_output_window2('ms2', 'Finnished Updateing...'); - - - // if snort is running hard restart, if snort is not running do nothing - - // TODO: Restart Ifaces - -// ----------------------------------------------------- End Code -------------------------------------------- - -} // -------------------- END Main function ------------ - -//$argv[1] = 'console'; - - //$getWorkerStat = snortSql_fetchAllSettings2('snortDBtemp', 'RegisterWorker', 'uuid', 'jdjEf!773&h3bhFd6A'); - - //if ($getWorkerStat['working'] !== 'on') { - //snortSql_updateRuleSetList2('working', 'on', '', '', ''); // Register Worker on - //sendUpdateSnortLogDownload($argv[1]); // start main function - //snortSql_updateRuleSetList2('working', 'off', '', '', ''); // Register Worker off - //} - - - - - -?> \ No newline at end of file diff --git a/config/orionids-dev/snort_download_updates.php b/config/orionids-dev/snort_download_updates.php deleted file mode 100644 index 445671bd..00000000 --- a/config/orionids-dev/snort_download_updates.php +++ /dev/null @@ -1,365 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -// disable csrf for downloads, progressbar did not work because of this -$nocsrf = true; - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); -require_once("/usr/local/pkg/snort/snort_download_rules.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars -if (isset($_GET['updatenow'])) { - $updatenow = $_GET['updatenow']; -} - -header("Cache-Control: no-cache, must-revalidate"); -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); - -// get dates of md5s - -$tmpSettingsSnort = 'N/A'; -$tmpSettingsSnortChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'snortrules-snapshot-2905.tar.gz'); -if (!empty($tmpSettingsSnortChk)) { - $tmpSettingsSnort = date('l jS \of F Y h:i:s A', $tmpSettingsSnortChk[date]); -} - -$tmpSettingsEmerging = 'N/A'; -$tmpSettingsEmergingChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'emerging.rules.tar.gz'); -if (!empty($tmpSettingsEmergingChk)) { - $tmpSettingsEmerging = date('l jS \of F Y h:i:s A', $tmpSettingsEmergingChk[date]); -} - -$tmpSettingsPfsense = 'N/A'; -$tmpSettingsPfsenseChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'pfsense_rules.tar.gz'); -if (!empty($tmpSettingsPfsenseChk)) { - $tmpSettingsPfsense = date('l jS \of F Y h:i:s A', $tmpSettingsPfsenseChk[date]); -} - -// get rule on stats -$generalSettings = snortSql_fetchAllSettings2('snortDB', 'SnortSettings', 'id', '1'); - -$snortMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/snort_rules/snortrules-snapshot-2905.tar.gz.md5'); - -$snortDownlodChkMark = ''; -if ($generalSettings[snortdownload] === 'on') { - $snortDownlodChkMark = 'checked="checked"'; -} - -$snortMd5Current = 'N/A'; -if (!empty($snortMd5CurrentChk)) { - preg_match('/^\".*\"/', $snortMd5CurrentChk, $snortMd5Current); - if (!empty($snortMd5Current[0])) { - $snortMd5Current = preg_replace('/\"/', '', $snortMd5Current[0]); - } -} - -$emergingMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/emerging_rules/emerging.rules.tar.gz.md5'); - -$emerginDownlodChkMark = ''; -if ($generalSettings[emergingthreatsdownload] !== 'off') { - $emerginDownlodChkMark = 'checked="checked"'; -} - -$emergingMd5Current = 'N/A'; -if (!empty($emergingMd5CurrentChk)) { - $emergingMd5Current = $emergingMd5CurrentChk; -} - -$pfsenseMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/pfsense_rules/pfsense_rules.tar.gz.md5'); - -$pfsenseMd5Current = 'N/A'; -if (!empty($pfsenseMd5CurrentChk)) { - preg_match('/^\".*\"/', $pfsenseMd5CurrentChk, $pfsenseMd5Current); - if (!empty($pfsenseMd5Current[0])) { - $pfsenseMd5Current = preg_replace('/\"/', '', $pfsenseMd5Current[0]); - } -} - - $pgtitle = 'Services: Snort: Updates'; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - -
- -
-
-
- -
-
-

-

-
- - -
-
-

-

-
- -
- - - - -
-
- - - - - - - - - - - -
- -
- -
- -
- -
- -
- -
-
- - - - - - - - - -
- Rule databases that are ready to be updated. - -
-
- - - - - - -
SIGNATURE RULESET DATABASES:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- -
OnSignature DB NameMD5 VersionLast Rule DB Date 
- type="checkbox" disabled="disabled" > -SNORT.ORG - -
- type="checkbox" disabled="disabled" > -EMERGINGTHREATS.NET - -
- -PFSENSE.ORG - -
-
- - - - -
- -
-
- - - - -
-
-
- - - -
- -
-
- - - - - -
- - - Note: -   Snort.org and Emergingthreats.net will go down from time to time. Please be patient. -
-
-
- - - - - - jQuery(\'.snortModalTopClose\').append(\'\'); - - '; -} - -?> - - - - - - - - - - diff --git a/config/orionids-dev/snort_gui.inc b/config/orionids-dev/snort_gui.inc deleted file mode 100644 index d0a778ae..00000000 --- a/config/orionids-dev/snort_gui.inc +++ /dev/null @@ -1,83 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -//include_once("/usr/local/pkg/snort/snort.inc"); - -function print_info_box_np2($msg) { - global $config, $g; - - echo "\n"; - echo " \n"; - echo " \n"; - echo "
\n"; - echo "
\n"; - echo " \n"; - echo " "; - if(stristr($msg, "apply") == true) { - echo " "; - } - echo "
\n"; - echo "    \n"; - echo " {$msg}\n"; - echo " "; - echo " \n"; - echo "
\n"; - echo "
\n"; - echo "
\n"; - echo "\n"; - echo "\n
\n"; - - -} - -if ($config['version'] >= 6) { - $helplink = '
  • Help'; -}else{ - $helplink = '
  • Help
    • '; -} - -?> diff --git a/config/orionids-dev/snort_head.inc b/config/orionids-dev/snort_head.inc deleted file mode 100644 index 2d5aadaa..00000000 --- a/config/orionids-dev/snort_head.inc +++ /dev/null @@ -1,148 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -/* - pfSense_MODULE: header -*/ - -/* - * if user has selected a custom template, use it. - * otherwise default to pfsense tempalte - */ -if (($g["disablethemeselection"] === true) && !empty($g["default_theme"]) && (is_dir($g["www_path"].'/themes/'.$g["default_theme"]))) - $g['theme'] = $g["default_theme"]; -elseif($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme']))) - $g['theme'] = $config['theme']; -else - $g['theme'] = "pfsense"; - -/* - * If this device is an apple ipod/iphone - * switch the theme to one that works with it. - */ -$lowres_ua = array("iPhone","iPod", "iPad", "Android"); -foreach($lowres_ua as $useragent) - if(strstr($_SERVER['HTTP_USER_AGENT'], $useragent)) - $g['theme'] = empty($g['theme_lowres']) ? "pfsense" : $g['theme_lowres']; - -$pagetitle = gentitle( $pgtitle ); - -?> - - - - <?php echo($config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pagetitle); ?> - - - - - "; ?> - - - - - - - - - \n"; ?> - - - echo "\n"; - include('/usr/local/pkg/snort/snort_headbase.inc'); - echo "\n"; - // -?> - -\n"; - echo "\t\n"; - } - echo "\t\n"; - echo "\t\n"; - echo "\t\n"; - echo "\t\n"; - if(file_exists("{$g['www_path']}/javascript/global.js")) - echo "\t\n"; - /* - * Find all javascript files that need to be included - * for this page ... from the arrays ... :) - * Coded by: Erik Kristensen - */ - - $dir = trim(basename($_SERVER["SCRIPT_FILENAME"], '.php')); - $path = "{$g['www_path']}/javascript/" . $dir . "/"; - if (is_dir($path)) { - if ($dh = opendir($path)) { - while (($file = readdir($dh)) !== false) { - if (is_dir($file)) - continue; - echo "\t\n"; - } - closedir($dh); - } - } - - -if (!isset($closehead)) - echo ""; - -/* If this page is being remotely managed then do not allow the loading of the contents. */ -if($config['remote_managed_pages']['item']) { - foreach($config['remote_managed_pages']['item'] as $rmp) { - if($rmp == $_SERVER['SCRIPT_NAME']) { - include("fbegin.inc"); - print_info_box_np("This page is currently being managed by a remote machine."); - include("fend.inc"); - exit; - } - } -} - -?> diff --git a/config/orionids-dev/snort_headbase.inc b/config/orionids-dev/snort_headbase.inc deleted file mode 100644 index 33bbd0ee..00000000 --- a/config/orionids-dev/snort_headbase.inc +++ /dev/null @@ -1,73 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ -?> - - - - - - - - - - - - - - - /* makes boxes round */ - /* load at bottom */ - NiftyCheck(); - Rounded("div#mainarea2","bl br tr","#FFF","#dddddd","smooth"); - Rounded("div#mainarea3","bl br tr","#FFF","#dddddd","smooth"); - Rounded("td#tdbggrey","bl br tr","#FFF","#dddddd","smooth"); - Rounded("td#tdbggrey2","bl br tr","#FFF","#dddddd","smooth"); - Rounded("div#mainarea4","all","#FFF","#dddddd","smooth"); - Rounded("div#mainarea6","all","#FFF","#dddddd","smooth"); - Rounded("div#mainarea5","all","#eeeeee","#dddddd","smooth"); - -'; -?> \ No newline at end of file diff --git a/config/orionids-dev/snort_help_info.php b/config/orionids-dev/snort_help_info.php deleted file mode 100644 index 616133ae..00000000 --- a/config/orionids-dev/snort_help_info.php +++ /dev/null @@ -1,353 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - - $pgtitle = 'Snort: Help and Info'; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - - - - - - -
    - -
    -
    - - - - - - - - -
    - -
    - -
    - -
    - - - - -
    - - - -
    - -
    -
    -

    Snort Package

    - -

    - Snort Package is a GUI based front-end for Sourcefire's Snort ® IDS/IPS software. The Snort Package goal is to be - the best open-source GUI to manage multiple snort sensors and multiple rule snapshots. The project other goal is to be a highly competitive GUI for - network monitoring for both private and enterprise use. Lastly, this project software development should bring programmers and users together to create - software. -

    -

    - - What is Snort ? Used by fortune 500 companies and goverments Snort is the most widely deployed IDS/IPS technology worldwide. It features rules based logging and - can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port - scans, CGI attacks, SMB probes, and much more. -

    -

    - Requirements :
    - Minimum requirement 256 mb ram, 500 MHz CPU.
    - Recommended 500 mb ram, 1 Ghz CPU.
    - The more rules you run the more memory you need.
    - - The more interfaces you select the more memory you need.

    - Development is done on a Alix 2D3 system (500 MHz AMD Geode LX800 CPU 256MB DDR DRAM). -

    - -
    - -
    -

    Snort Package

    - -

    Change Log

    - -

    Changes to this package can be viewed by following pfSense packages repository

    - -
    - -
    -

    Snort Package

    - -

    Getting Help

    - -

    -Obtaining Support
    - -We provide several means of obtaining support for pfSense. -

    - -

    -Free Options
    -Our free options include our forum, mailing list , and IRC channel. Before using any of these resources, please review the Project Rules below. -

    - -

    -Commercial Support
    - -Commercial support is available from the company founded by the founders of the pfSense project, BSD Perimeter. Phone and email support is available for support subscribers only. -

    - -

    -Project Rules
    -To keep things orderly, and be fair to everyone, we must enforce these rules. -

    - -

    -Please do not post support questions to the blog comments. The comments are for discussion of the post, and letting people ask questions there would make a mess of the purpose of those comments. Any support questions will not be moderator approved. -

    - -

    -Please do not cross post questions between the forum and mailing list, unless your inquiry has gone unanswered for at least 24 hours. Do not bump your mailing list or forum posts for at least 24 hours. If you have not received a reply after more than 24 hours, you are welcome to bump your thread. -

    - -

    -Please do not email individuals, the coreteam address, or private message people on the forum to ask questions. We provide a wide variety of means for obtaining help in a public forum, where it helps others who have the same questions in the future. We don't have enough time to answer all the questions our users post in the public forums, much less via email and private messages. Since we cannot possibly reply to everyone's email and private messages, to be fair we will not reply to anyone. Individual attention via phone and email support is available for commercial support customers. -

    -
    - -
    -

    Snort Package

    - - -

    Heros

    - -

    Pfsense Snort Package users who have cared enough to donate to this project. I can't thank you enough for all your help. With-out your support I would have stoped long time ago.

    - -

    If your not on this list PM me and I will add you. If you would like to be removed pm me and I will remove you.

    - -

    Names

    - -

    sandro tavella

    -

    João Kemp Filho

    - -

    Julio Fumoso

    -

    Rolland Hart

    -

    DiMarco Technology Solutions Inc.

    -

    Brett Burley

    -

    Tomasz Iskra

    -

    Bruno Buchschacher

    - -

    Marco Pannetto

    -

    Christopher Weakland

    -

    Antonio Riveros

    -

    DigitalJer

    -

    Serialdie

    -

    Dlawley

    - -

    Onhel

    -

    Jerrygoldsmith

    - - -
    -
    -
    - - -
    -
    -
    - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_install.inc b/config/orionids-dev/snort_install.inc deleted file mode 100644 index 59fdd2e6..00000000 --- a/config/orionids-dev/snort_install.inc +++ /dev/null @@ -1,429 +0,0 @@ - advanced features */ - //$bpfbufsize = $config['installedpackages']['snortglobal']['bpfbufsize']; - //$bpfmaxbufsize = $config['installedpackages']['snortglobal']['bpfmaxbufsize']; - //$bpfmaxinsns = $config['installedpackages']['snortglobal']['bpfmaxinsns']; - - // create a few directories and ensure the sample files are in place - if(!file_exists('/usr/local/etc/snort')) { - exec('/bin/mkdir -p /usr/local/etc/snort'); - } - - if(!file_exists('/usr/local/etc/snort/whitelist')) { - exec('/bin/mkdir -p /usr/local/etc/snort/whitelist/'); - } - - if(!file_exists('/var/log/snort/run')) { - exec('/bin/mkdir -p /var/log/snort/run'); - } - - if(!file_exists('/var/log/snort/barnyard2')) { - exec('/bin/mkdir -p /var/log/snort/barnyard2/'); - } - - if(!file_exists('/usr/local/lib/snort/dynamicrules/')) { - exec('/bin/mkdir -p /usr/local/lib/snort/dynamicrules/'); - } - - // for snort2c, remove when snortsam is working - if(!file_exists('/var/db/whitelist')) { - touch('/var/db/whitelist'); - } - - if (!file_exists('/usr/local/etc/snort/etc')) { - exec('/bin/mkdir -p /usr/local/etc/snort/etc'); - } - - if (!file_exists('/usr/local/etc/snort/signatures')) { - exec('/bin/mkdir -p /usr/local/etc/snort/signatures'); - } - - if (!file_exists('/usr/local/etc/snort/snort_download')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snort_download'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/DB')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/custom_rules/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/custom_rules/rules'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/emerging_rules/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/emerging_rules/rules'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/pfsense_rules/rules'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/snort_rules/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/snort_rules/rules'); - } - - if (!file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { - exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/default/rules'); - exec('/usr/bin/touch /usr/local/etc/snort/snortDBrules/DB/default/rules/local.rules'); - } - - // create and cp to tmp db dir - if (!file_exists('/var/snort/')) { - exec('/bin/mkdir -p /var/snort/'); - } - - if (file_exists('/usr/local/pkg/snort/snortDBtemp')) { - exec('/bin/cp /usr/local/pkg/snort/snortDBtemp /var/snort/snortDBtemp'); - } - - // cleanup default files - if(file_exists('/usr/local/etc/snort/snort.conf-sample')) { - exec('/bin/rm /usr/local/etc/snort/classification.config-sample'); - exec('/bin/mv /usr/local/etc/snort/classification.config /usr/local/etc/snort/etc/classification.config'); - exec('/bin/rm /usr/local/etc/snort/gen-msg.map-sample'); - exec('/bin/mv /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/etc/gen-msg.map'); - exec('/bin/rm /usr/local/etc/snort/reference.config-sample'); - exec('/bin/mv /usr/local/etc/snort/reference.config /usr/local/etc/snort/etc/reference.config'); - exec('/bin/rm /usr/local/etc/snort/sid-msg.map-sample'); - exec('/bin/mv /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/etc/sid-msg.map'); - exec('/bin/rm /usr/local/etc/snort/snort.conf-sample'); - exec('/bin/mv /usr/local/etc/snort/snort.conf /usr/local/etc/snort/etc/snort.conf'); - exec('/bin/rm /usr/local/etc/snort/threshold.conf-sample'); - exec('/bin/mv /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/etc/threshold.conf'); - exec('/bin/rm /usr/local/etc/snort/unicode.map-sample'); - exec('/bin/mv /usr/local/etc/snort/unicode.map /usr/local/etc/snort/etc/unicode.map'); - exec('/bin/rm /usr/local/etc/snort/generators-sample'); - exec('/bin/mv /usr/local/etc/snort/generators /usr/local/etc/snort/etc/generators'); - exec('/bin/rm /usr/local/etc/snort/sid'); - exec('/bin/rm /usr/local/etc/rc.d/snort'); - exec('/bin/rm /usr/local/etc/rc.d/bardyard2'); - } - - // remove example files - if(file_exists('/usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so.0')) { - exec('/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example*'); - } - - if(file_exists('/usr/local/lib/snort/dynamicpreprocessor/lib_sfdynamic_preprocessor_example.so')) { - exec('/bin/rm /usr/local/lib/snort/dynamicpreprocessor/lib_sfdynamic_preprocessor_example*'); - } - - - // add snort user and group note: 920 keep the numbers < 2000, above this is reserved in pfSense 2.0 - exec('/usr/sbin/pw groupadd snort -g 920'); - exec('/usr/sbin/pw useradd snort -u 920 -c "Snort User" -d /nonexistent -g snort -s /sbin/nologin'); - - // if users have old log files delete them */ - if(!file_exists('/var/log/snort/alert')) { - touch('/var/log/snort/alert'); - }else{ - exec('/bin/rm -rf /var/log/snort/*'); - touch('/var/log/snort/alert'); - } - - // rm barnyard2 important */ - if(!file_exists('/usr/local/bin/barnyard2')) { - exec('/bin/rm /usr/local/bin/barnyard2'); - } - - /* important */ - exec('/usr/sbin/chown -R snort:snort /var/log/snort'); - exec('/usr/sbin/chown -R snort:snort /usr/local/etc/snort'); - exec('/usr/sbin/chown -R snort:snort /usr/local/lib/snort'); - exec('/usr/sbin/chown -R snort:snort /var/snort'); - exec('/usr/sbin/chown snort:snort /tmp/snort*'); - exec('/usr/sbin/chown snort:snort /var/db/whitelist'); - exec('/bin/chmod 660 /var/log/snort/alert'); - exec('/bin/chmod 660 /var/db/whitelist'); - exec('/bin/chmod -R 660 /usr/local/etc/snort/*'); - exec('/bin/chmod -R 660 /tmp/snort*'); - exec('/bin/chmod -R 660 /var/run/snort*'); - exec('/bin/chmod -R 660 /var/snort/run/*'); - exec('/bin/chmod 770 /usr/local/lib/snort'); - exec('/bin/chmod 770 /usr/local/etc/snort'); - exec('/bin/chmod 770 /usr/local/etc/whitelist'); - exec('/bin/chmod 770 /var/log/snort'); - exec('/bin/chmod 770 /var/log/snort/run'); - exec('/bin/chmod 770 /var/log/snort/barnyard2'); - - /* move files around, make it look clean */ - exec('/bin/mkdir -p /usr/local/www/snort/css'); - exec('/bin/mkdir -p /usr/local/www/snort/images'); - exec('/bin/mkdir -p /usr/local/www/snort/javascript'); - - chdir ("/usr/local/www/snort/css/"); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/css/style_snort2.css'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/css/new_tab_menu.css'); - chdir ("/usr/local/www/snort/images/"); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/alert.jpg'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/arrow_down.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/awesome-overlay-sprite.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/controls.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/down.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/down2.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/footer.jpg'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/footer2.jpg'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/icon-table-sort-asc.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/icon-table-sort-desc.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/icon-table-sort.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/icon_excli.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/loading.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/logo.jpg'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/logo22.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/page_white_text.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/transparent.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/transparentbg.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/up.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/up2.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/close_9x9.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/new_tab_menu.png'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/progress_bar2.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/progressbar.gif'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/images/top_modal_bar_lil.jpg'); - chdir ("/usr/local/www/snort/javascript/"); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/javascript/jquery-1.6.2.min.js'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/javascript/jquery.form.js'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/javascript/snort_globalsend.js'); - exec('/usr/bin/fetch http://www.pfsense.com/packages/config/orionids-dev/javascript/jquery.progressbar.min.js'); - - /* back to default */ - chdir ('/root/'); - - // make sure snort-old is deinstalled - // remove when snort-old is removed - unset($config['installedpackages']['snort']); - unset($config['installedpackages']['snortdefservers']); - unset($config['installedpackages']['snortwhitelist']); - unset($config['installedpackages']['snortthreshold']); - unset($config['installedpackages']['snortadvanced']); - write_config(); - conf_mount_rw(); - - // remake saved settings - // TODO: make sre this works in final release - /* - if($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') { - update_status(gettext("Saved settings detected...")); - update_output_window(gettext("Please wait... rebuilding files...")); - sync_snort_package_empty(); - update_output_window(gettext("Finnished Rebuilding files...")); - } - */ - - conf_mount_ro(); - -} // END of Post Install - -function snort_deinstall() -{ - - global $config, $g; - conf_mount_rw(); - - // remove custom sysctl // - remove_text_from_file("/etc/sysctl.conf", "sysctl net.bpf.bufsize=20480"); - - // decrease bpf buffers back to 4096, from 20480 - exec('/sbin/sysctl net.bpf.bufsize=4096'); - - exec('/usr/usr/bin/killall snort'); - sleep(2); - exec('/usr/usr/bin/killall -9 snort'); - sleep(2); - exec('/usr/usr/bin/killall barnyard2'); - sleep(2); - exec('/usr/usr/bin/killall -9 barnyard2'); - sleep(2); - - exec('/usr/sbin/pw userdel snort'); - exec('/usr/sbin/pw groupdel snort'); - exec('rm -rf /usr/local/etc/snort*'); - exec('rm -rf /usr/local/pkg/snort*'); - exec('rm -rf /usr/local/pkg/pf/snort*'); - - exec("cd /var/db/pkg && pkg_delete `ls | grep snort`"); - exec("cd /var/db/pkg && pkg_delete `ls | grep perl-threaded`"); - exec("cd /var/db/pkg && pkg_delete `ls | grep mysql-client-5.1.50_1`"); - exec('rm -r /usr/local/bin/barnyard2'); - - // TODO: figure out how to detect pfsense packages that use the same freebsd pkckages and not deinstall - //exec("cd /var/db/pkg && pkg_delete `ls | grep perl`"); - //exec("cd /var/db/pkg && pkg_delete `ls | grep barnyard2`"); - //exec("cd /var/db/pkg && pkg_delete `ls | grep pcre`"); // Never remove pcre or pfsense will break - - // Remove snort cron entries Ugly code needs smoothness - // TODO: redo code because its a mess - function snort_rm_blocked_deinstall_cron($should_install) - { - global $config, $g; - conf_mount_rw(); - - $is_installed = false; - - if(!$config['cron']['item']) - return; - - $x=0; - foreach($config['cron']['item'] as $item) - { - if (strstr($item['command'], "snort2c")) - { - $is_installed = true; - break; - } - - $x++; - - } - if($is_installed == true) - { - if($x > 0) - { - unset($config['cron']['item'][$x]); - write_config(); - conf_mount_rw(); - } - - configure_cron(); - - } - conf_mount_ro(); - - } - - function snort_rules_up_deinstall_cron($should_install) - { - global $config, $g; - conf_mount_rw(); - - $is_installed = false; - - if(!$config['cron']['item']) - return; - - $x=0; - foreach($config['cron']['item'] as $item) { - if (strstr($item['command'], "snort_check_for_rule_updates.php")) { - $is_installed = true; - break; - } - $x++; - } - if($is_installed == true) { - if($x > 0) { - unset($config['cron']['item'][$x]); - write_config(); - conf_mount_rw(); - } - configure_cron(); - } - } - - snort_rm_blocked_deinstall_cron(""); - snort_rules_up_deinstall_cron(""); - - - /* Unset snort registers in conf.xml IMPORTANT snort will not start with out this */ - /* Keep this as a last step */ - if($config['installedpackages']['snortglobal']['forcekeepsettings'] != 'on') { - unset($config['installedpackages']['snortglobal']); - } - write_config(); - conf_mount_rw(); - - exec('rm -rf /usr/local/www/snort'); - exec('rm -rf /usr/local/lib/snort/'); - exec('rm -rf /var/log/snort/'); - exec('rm -rf /usr/local/pkg/snort'); - exec('rm -rf /var/snort'); - - conf_mount_ro(); - -} - -// make sure this func on writes to files and does not start snort */ -function sync_snort_package() -{ - global $config, $g; - conf_mount_rw(); - - - - conf_mount_ro(); -} - -?> diff --git a/config/orionids-dev/snort_interfaces.php b/config/orionids-dev/snort_interfaces.php deleted file mode 100644 index beb50f83..00000000 --- a/config/orionids-dev/snort_interfaces.php +++ /dev/null @@ -1,415 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -$new_ruleUUID = genAlphaNumMixFast(7, 8); - -$a_interfaces = snortSql_fetchAllInterfaceRules('SnortIfaces', 'snortDB'); - - - $pgtitle = "Services: Snort 2.9.0.5 pkg v. 2.0"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - -
    - - - - - - - - -
    - -
    - -
    - -
    -
    - - - - - - - -
    SnortSam Status
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -
     SnortSamRolePortPassLogDescription  
    - - DISABLEDMASTER3526ENABLEDDISABLEDMster IPs  - -
    - -
    - - - - - - -
    Interface Status - - - -
    -
    - - - "; - echo ' - - - '; - echo " - - "; - echo ' - -
    {$list['interface']} Interface Status   ({$list['uuid']})
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -
     SnortIfPerformanceBlockLogDescription  
    - '; - echo " - - - {$ifaceStat}{$list['interface']}{$list['performance']}{$blockStat}{$logStat}{$list['descr']} - - "; - echo ' -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -
     Barnyard2IfSensorTypeLogDescription  
    - '; - echo " - - {$barnyard2Stat}{$list['interface']}{$list['uuid']}_{$list['interface']}unified2{$barnyard2Stat}Mster IPs  - - "; - echo ' -
    -
    -
    '; - } // end of foreach main - ?> - - - - - - -
    -
    -
    - - - -
    - -
    -
    - - - - - - - -
       
    - Note:
    - This is the Snort Menu where you can see an over view of all your interface settings. - Please edit the Global Settings tab before adding an interface. -
    -
    - Warning: -
    - New settings will not take effect until interface restart. -
    -
    - - - - - - - - - - - - - - - -
    - Click on the - - icon to add a interface. - - Click on the - - icon to start snort or barnyard2. -
    - Click on the - icon to edit a - interface and settings. - - Click on the - - icon to stop snort or barnyard2. -
    - Click on the - - icon to delete a interface and settings. -
       
    -
    -
    -
    - - - - - -
    - -
    -
    - - - - - - - - - - -
       
    -
    - - - - -
    - SNORT registered ® by Sourcefire, Inc, Barnyard2 registered ® by securixlive.com, Orion registered ® by Robert Zelaya, - Emergingthreats registered ® by emergingthreats.net, Mysql registered ® by Mysql.com -
    -
    -
       
    -
    -
    - - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_edit.php b/config/orionids-dev/snort_interfaces_edit.php deleted file mode 100644 index ade5ade8..00000000 --- a/config/orionids-dev/snort_interfaces_edit.php +++ /dev/null @@ -1,536 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - */ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - - - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - -$a_rules = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'All', ''); - -if (!is_array($a_list)) { - $a_list = array(); -} - -$a_whitelist = snortSql_fetchAllWhitelistTypes('SnortWhitelist', 'SnortWhitelistips'); - -if (!is_array($a_whitelist)) { - $a_whitelist = array(); -} - -$a_suppresslist = snortSql_fetchAllWhitelistTypes('SnortSuppress', ''); - -if (!is_array($a_suppresslist)) { - $a_suppresslist = array(); -} - - - $pgtitle = "Services: Snort: Interface Edit:"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - - - -
    -
    - -
    -
    - - -
    - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    General Settings
    Interface -   - "> -   Enable or Disable -
    Interface - -
    - Choose which interface this rule applies to.
    - Hint: in most cases, you'll want to use WAN here.     -
    Description - -
    - You may enter a description here for your reference (not parsed). -
    Memory Performance - -
    - Lowmem and ac-bnfa are recommended for low end systems, Ac: high memory, best performance, ac-std: moderate - memory,high performance, acs: small memory, moderateperformance, ac-banded: small memory,moderate performance, ac-sparsebands: small memory, high performance. -
    -
    Choose the rule DB snort should use.
    Rule DB - -
    - Choose the rule database to use.  Note: Cahnges to this database are global. -
    - WARNING: Never change this when snort is running.     -
    Choose the networks snort should inspect and whitelist.
    Home net - -
    - Choose the home net you will like this rule to use.  Note: Default homenet adds only local networks. -
    - Hint: Most users add a list offriendly ips that the firewall cant see.     -
    External net - -
    - Choose the external net you will like this rule to use. Note: Default external net, networks that are not home net. -
    - Hint: Most users should leave this setting at default.     -
    Block offenders - > -
    - Checking this option will automatically block hosts that generate a Snort alerts with SnortSam. -
    Suppression and filtering - -
    - Choose the suppression or filtering file you will like this rule to use.  - Note: Default option disables suppression and filtering. -
    Choose the types of logs snort should create.
    Type of Unified Logging - -
    - Snort will log Alerts to a file in the UNIFIED format. Full is a requirement for the snort wigdet. -
    Send alerts to mainSystem logs - > -
    - Snort will send Alerts to the Pfsense system logs. -
    Log to a Tcpdump file - > -
    - Snort will log packets to a tcpdump-formatted file. The file then can be analyzed by an application such as Wireshark which understands pcap file formats. - WARNING: File may become large. -
    Log Alerts to a snort unified2 file - > -
    - Snort will log Alerts to a file in the UNIFIED2 format. This is a requirement for barnyard2. -
    Arguments here will be automatically inserted into the snort configuration.
    Advanced configuration pass through - -
    - - - -
      - Note: - Please save your settings before you click start. -
    - - - -
    -
    - - - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_global.php b/config/orionids-dev/snort_interfaces_global.php deleted file mode 100644 index fd9d27d4..00000000 --- a/config/orionids-dev/snort_interfaces_global.php +++ /dev/null @@ -1,367 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); - -$snortdownload_off = ($generalSettings['snortdownload'] == 'off' ? 'checked' : ''); -$snortdownload_on = ($generalSettings['snortdownload'] == 'on' ? 'checked' : ''); -$oinkmastercode = $generalSettings['oinkmastercode']; - -$emergingthreatsdownload_off = ($generalSettings['emergingthreatsdownload'] == 'off' ? 'checked' : ''); -$emergingthreatsdownload_basic = ($generalSettings['emergingthreatsdownload'] == 'basic' ? 'checked' : ''); -$emergingthreatsdownload_pro = ($generalSettings['emergingthreatsdownload'] == 'pro' ? 'checked' : ''); -$emergingthreatscode = $generalSettings['emergingthreatscode']; - -$updaterules = $generalSettings['updaterules']; - -$rm_blocked = $generalSettings['rm_blocked']; - -$snortloglimit_off = ($generalSettings['snortloglimit'] == 'off' ? 'checked' : ''); -$snortloglimit_on = ($generalSettings['snortloglimit'] == 'on' ? 'checked' : ''); - -$snortloglimitsize = $generalSettings['snortloglimitsize']; - -$snortalertlogtype = $generalSettings['snortalertlogtype']; - -$forcekeepsettings_on = ($generalSettings['forcekeepsettings'] == 'on' ? 'checked' : ''); - -$snortlogCurrentDSKsize = round(exec('df -k /var | grep -v "Filesystem" | awk \'{print $4}\'') / 1024); - - - $pgtitle = "Services: Snort: Global Settings"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - - -
    - - - -
    - -
    -
    - - - - - - - - -
    - -
    - -
    - -
    - - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Please Choose The Type Of Rules You Wish To Download
    Install Snort.org rules - - - - - - - -
    - > - Do NOT Install -
    - > - Install Basic Rules or Premium rules
    -
    - - - - -
    - - Sign Up for a Basic Rule Account -

    - - Sign Up for Sourcefire VRT Certified Premium Rules. This Is Highly Recommended - -
    - - - - - - - -
    Oinkmaster code
    Code -
    - Obtain a snort.org Oinkmaster code and paste here. -
    -
    Install Emergingthreats rules - - - - - - - - - - -
    - > - Do NOT Install -
    - > - Install Basic Rules: No need to register
    -
    - > - Install Pro rules: You need to register
    -
    - - - - -
    - - Sign Up for Emerging Threats Pro Certified Premium Rules. This Is Highly Recommended - -
    - - - - - - - -
    Pro rules code
    Code -
    - Obtain a emergingthreatspro.com Pro rules code and paste here. -
    -
    Update rules automatically -
    - - Please select the update times for rules.
    Hint: in most cases, every 12 hours is a good choice. -     -
    General Settings
    Log Directory SizeLimit
    -




    - Note:
    Available space is MB     -     		- - - - - - - - - - -
    - > - Enable directory size limit (Default) -
    - > - Disable directory size limit

    - Warning: Pfsense Nanobsd should use no more than 10MB of space. -
     
    - - - - -
    Size in MB - - Default is 20% of available space. -
    -
    Remove blocked hosts every -
    - Please select the amount of time you would likehosts to be blocked for.
    Hint: in most cases, 1 hour is a good choice.     -
    Alerts file descriptiontype -
    - Please choose the type of Alert logging you will like see in your alert file.
    Hint: Best pratice is to chose full logging.      - WARNING: On change, alert file will be cleared. -
    Keep snort settings after deinstall - > - Settings will not be removed during deinstall. -
    Save Settings - - -
    - - -  WARNING:
    This will reset all global and interface settings.     -     		- Note:
    - Changing any settings on this page will affect all interfaces. Please, double check if your oink code is correct and the type of snort.org account you hold. -
    -
    -
    -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_rules.php b/config/orionids-dev/snort_interfaces_rules.php deleted file mode 100644 index 12f9cec0..00000000 --- a/config/orionids-dev/snort_interfaces_rules.php +++ /dev/null @@ -1,289 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -$a_rules = array(); -$a_rules = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'All', ''); - - if (!is_array($a_rules)) { - $a_rules = array(); - } - - if ($a_rules == 'Error') { - echo 'Error'; - exit(0); - } - - // list rules in db that are on in a array - $listOnRules = array(); - $listOnRules = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'All', ''); - - $listUsedRules = array(); - foreach ($listOnRules as $listOnRule) - { - - $listUsedRules[] = $listOnRule['ruledbname']; - - } - unset($listOnRules); - - $pgtitle = "Services: Snort: Rules"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - -
    - -
    - -
    - -
    - - -
    - - - -
    - - - - -
    File NameDescription
    - - - - - -
    - - - - - - - - - - - - '; - }else{ - $deleteObject = ''; - } - - if (in_array($list['uuid'], $listUsedRules)) { - $resetObject = ''; - }else{ - $resetObject = ''; - } - - ?> - - - - - - - - - - -
    Default - Default rule database  - - - '; - }else{ - $resetObjectDf = ''; - } - - ?> - - - - - - -
    - - - - - -
    -
    -   - - - - - - - -
    - - - - - -
    -
    - - - - - - - -
     
    - -
    - - -
    - - - - - - - - - -
    -
    - - -
    - - Note: -

    - Here you can create rule databases that can be used on multiple interfaces.

    - - Please note that you must restart a running rule so that changes can take effect.

    - - You may only delete rule databases that are not asigned to an interface.
    -

    -
    -
    - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_rules_edit.php b/config/orionids-dev/snort_interfaces_rules_edit.php deleted file mode 100644 index be6467bc..00000000 --- a/config/orionids-dev/snort_interfaces_rules_edit.php +++ /dev/null @@ -1,282 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -if (isset($_GET['rdbuuid'])) { - $rdbuuid = $_GET['rdbuuid']; -}else{ - $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - $rdbuuid = $ruledbname_pre1['ruledbname']; -} - -if ($rdbuuid !== 'default') { - - $a_list = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'uuid', $rdbuuid); - - // $a_list returns empty use defaults - if ($a_list == '') { - - $a_list = array( - 'id' => '', - 'date' => date(U), - 'uuid' => $rdbuuid, - 'ruledbname' => '', - 'description' => '' - - ); - - } - -} - -if ($rdbuuid === 'default') { - - // $a_list returns empty use defaults - if ($a_list == '') { - - $a_list = array( - 'id' => '1', - 'date' => date(U), - 'uuid' => $rdbuuid, - 'ruledbname' => 'default', - 'description' => 'Default database' - - ); - - } - -} - -if ( !empty($a_list['id']) ) { - $disabled = 'disabled="disabled"'; -}else{ - $disabled = ''; -} - -if ( $rdbuuid === 'default' ) { - $disabled_ckbox = 'disabled="disabled"'; -}else{ - $disabled_ckbox = ''; -} - - - $pgtitle = 'Services: Snort: Rules: Edit: ' . $rdbuuid; - include('/usr/local/pkg/snort/snort_head.inc'); - -?> - - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - - - - - - - -
    -
    - -
    -
    -
    - -
    -
    - - - - - - - - '; - } - ?> - - - - -
    - - - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - -
    Add the name and description of the rule DB
    Name - />
    - The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. -
    Description - />
    - You may enter a description here for your reference (not parsed). -
    - Examples: -
    - NOTE: Rule DB will not be active until snort sensor restart.
    -
    -
    -
    - - - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_suppress.php b/config/orionids-dev/snort_interfaces_suppress.php deleted file mode 100644 index 977dcf2d..00000000 --- a/config/orionids-dev/snort_interfaces_suppress.php +++ /dev/null @@ -1,211 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - - -$a_suppress = snortSql_fetchAllWhitelistTypes('SnortSuppress', ''); - - if (!is_array($a_suppress)) - { - $a_suppress = array(); - } - - - if ($a_suppress == 'Error') - { - echo 'Error'; - exit(0); - } - - $pgtitle = "Services: Snort: Suppression"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - - - - -
    - -
    - -
    - -
    - - - - - - -
    - - - - - - - - - - - - - - - - - - - - -
    File NameDescription
    -   - - - - - - -
    - - - - -
    -
    - - - - - -
     
    -
    -
    -
    - - - - - -
    -
    - - -
    - - Note: -

    - Here you can create event filtering and suppression for your snort package rules.
    - Please note that you must restart a running rule so that changes can take effect.
    -

    -
    -
    - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_suppress_edit.php b/config/orionids-dev/snort_interfaces_suppress_edit.php deleted file mode 100644 index e9f23254..00000000 --- a/config/orionids-dev/snort_interfaces_suppress_edit.php +++ /dev/null @@ -1,231 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortSuppress', 'uuid', $uuid); - - -// $a_list returns empty use defaults -if ($a_list == '') -{ - - $a_list = array( - 'id' => '', - 'date' => date(U), - 'uuid' => $uuid, - 'filename' => '', - 'description' => '', - 'suppresspassthru' => '' - - ); - -} - - - - - $pgtitle = 'Services: Snort: Suppression: Edit'; - include('/usr/local/pkg/snort/snort_head.inc'); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - -
    - - - - - - - - -
    - -
    - -
    - -
    - - - - - - - - -
    - - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - -
    Add the name anddescription of the file.
    Name -
    - The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. -
    Description -
    - You may enter a description here for your reference (not parsed). -
    - Examples: -
    - Example 1; suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
    - Example 2; event_filter gen_id 1, sig_id 1851, type limit,track by_src, count 1, seconds 60
    - Example 3; rate_filter gen_id 135, sig_id 1, track by_src, count 100, seconds 1, new_action log, timeout 10 -
    - - - - - - - -
    - Apply suppression or filters to rules. Valid keywords are 'suppress', 'event_filter' and 'rate_filter'. -
    - -
    -
    - - -
    -
    - - - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_whitelist.php b/config/orionids-dev/snort_interfaces_whitelist.php deleted file mode 100644 index 3167b65f..00000000 --- a/config/orionids-dev/snort_interfaces_whitelist.php +++ /dev/null @@ -1,241 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - - -$a_whitelist = snortSql_fetchAllWhitelistTypes('SnortWhitelist', 'SnortWhitelistips'); - - if (!is_array($a_whitelist)) - { - $a_whitelist = array(); - } - - if ($a_whitelist == 'Error') - { - echo 'Error'; - exit(0); - } - - $pgtitle = "Services: Snort: Whitelist"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - - - - -
    - -
    - -
    - -
    - - - - - - -
    - - - - - - - - - - - - - - - - - - - - - -
    File NameValuesDescription
    - 0 && $a != $countList) - { - echo ',' . ' '; - }else{ - echo ' '; - } - - } // end foreach - - if ($a > 3) - { - echo '...'; - } - ?> - -   - - - - - - -
    - - - - -
    -
    - - - - - -
     
    -
    -
    -
    - - - - - -
    -
    - - -
    - - Note: -

    - Here you can create whitelist files for your snort package rules.
    - Please add all the ips or networks you want to protect against snort block decisions.
    - Remember that the default whitelist only includes local networks.
    - Be careful, it is very easy to get locked out of you system. -

    -
    -
    - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_interfaces_whitelist_edit.php b/config/orionids-dev/snort_interfaces_whitelist_edit.php deleted file mode 100644 index dbdbb649..00000000 --- a/config/orionids-dev/snort_interfaces_whitelist_edit.php +++ /dev/null @@ -1,341 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once('guiconfig.inc'); -require_once('/usr/local/pkg/snort/snort_new.inc'); -require_once('/usr/local/pkg/snort/snort_gui.inc'); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -//$GLOBALS['csrf']['rewrite-js'] = false; - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortWhitelist', 'uuid', $uuid); - -// $a_list returns empty use defaults -if ($a_list == '') -{ - - $a_list = array( - 'id' => '', - 'date' => date(U), - 'uuid' => $uuid, - 'filename' => '', - 'snortlisttype' => 'whitelist', - 'description' => '', - 'wanips' => 'on', - 'wangateips' => 'on', - 'wandnsips' => 'on', - 'vips' => 'on', - 'vpnips' => 'on' - ); - -} - -$listFilename = $a_list['filename']; - -$a_list['list'] = snortSql_fetchAllSettingsList('SnortWhitelistips', $listFilename); - -$wanips_chk = $a_list['wanips']; -$wanips_on = ($wanips_chk == 'on' ? 'checked' : ''); - -$wangateips_chk = $a_list['wangateips']; -$wangateips_on = ($wangateips_chk == 'on' ? 'checked' : ''); - -$wandnsips_chk = $a_list['wandnsips']; -$wandnsips_on = ($wandnsips_chk == 'on' ? 'checked' : ''); - -$vips_chk = $a_list['vips']; -$vips_on = ($vips_chk == 'on' ? 'checked' : ''); - -$vpnips_chk = $a_list['vpnips']; -$vpnips_on = ($vpnips_chk == 'on' ? 'checked' : ''); - - - - $pgtitle = "Services: Snort: Whitelist Edit"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - -
    - - - - - - - - -
    - -
    - -
    - -
    - - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Add the name and description of the file.
    Name -
    - The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. -
    Description -
    - You may enter a description here for your reference (not parsed). -
    List Type -
    - WHITELIST:   This list specifies addresses that Snort Package should not block.

    - NETLIST:   This list is for defining addresses as $HOME_NET or $EXTERNAL_NET in the snort.conf file. -
    - -    Choose the type of list you will like see in your Interface Edit Tab. -
    Add auto generated ips.
    WAN IPs - /> - Add WAN IPs to the list. -
    Wan Gateways - /> - Add WAN Gateways to the list. -
    Wan DNS servers - /> - Add WAN DNS servers to the list. -
    Virtual IP Addresses - /> - Add Virtual IP Addresses to the list. -
    VPNs - /> - Add VPN Addresses to the list. -
    Add your own custom ips.
    -
    IP or CIDR items
    -     		- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -
    - For WHITELIST's enter ONLY IPs not CIDRs. Example: 192.168.4.1

    - For NETLIST's you may enter IPs and CIDRs. Example: 192.168.4.1 or 192.168.4.0/24 -
    -
    -
    IP or CIDR
    -     		-
    Add a Description or leave blank and a date will be added.
    -
    - - - - - -
    - - - -
    -
      - - -
    -
    -
    -
    - - - - - - - - diff --git a/config/orionids-dev/snort_json_get.php b/config/orionids-dev/snort_json_get.php deleted file mode 100644 index 92058a75..00000000 --- a/config/orionids-dev/snort_json_get.php +++ /dev/null @@ -1,137 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// get json blocls sids -if ($_GET['snortsamjson'] == 1) { - - exec('cat /usr/local/etc/snort/sn_6TPXv7a/rules/dbBlockSplit/splitSidblock_' . $_GET['fileid'] . '.block', $output); - echo $output[0]; - -} - - -// upload created log tar to user -if ($_GET['snortGetUpdate'] == 1) { - - $tmpfname = "/usr/local/etc/snort/snort_download"; - $snort_filename = "snortrules-snapshot-2905.tar.gz"; - - - $snortSessionPath = $_SESSION['tmp']['snort']['snort_download_updates']; - - if (!file_exists("{$tmpfname}/{$snort_filename}")) { - - if ($snortSessionPath['download']['working'] != '1') { - unset($_SESSION['tmp']); - $snortSessionPath['download']['working'] = '1'; - sendUpdateSnortLogDownload(); - } - - } - - $time = time(); - while((time() - $time) < 30) - { - - // query memcache, database, etc. for new data - $data = $datasource->getLatest(); - - // if we have new data return it - if(!empty($data)) { - echo json_encode($data); - ob_flush(); - flush(); - break; - } - - usleep(25000); - } - -} // end main if - - - -// upload created log tar to user -if ($_GET['snortlogdownload'] == 1) { - - sendFileSnortLogDownload(); - -} - - -// send Json sid string -if ($_GET['snortGetSidString'] == 1) { - - // unset - unset($_GET['snortGetSidString']); - - // get the SID string from file - sendSidStringRuleEditGUI(); - -} - - - - - - - - - - - - - - - -?> \ No newline at end of file diff --git a/config/orionids-dev/snort_json_post.php b/config/orionids-dev/snort_json_post.php deleted file mode 100644 index 418a90be..00000000 --- a/config/orionids-dev/snort_json_post.php +++ /dev/null @@ -1,568 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_build.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// unset crsf checks -if(isset($_POST['__csrf_magic'])) { - unset($_POST['__csrf_magic']); -} - - -function snortJsonReturnCode($returnStatus) -{ - if ($returnStatus == true) { - echo '{"snortgeneralsettings":"success","snortMiscTabCall":"true"}'; - return true; - }else{ - echo '{"snortgeneralsettings":"fail"}'; - return false; - } -} - -// row from db by uuid -if ($_POST['snortSidRuleEdit'] == 1) { - - function snortSidRuleEditFunc() - { - - unset($_POST['snortSidRuleEdit']); - snortSidStringRuleEditGUI(); - - } snortSidRuleEditFunc(); - -} - - -// row from db by uuid -if ($_POST['snortSaveRuleSets'] == 1) { - - if ($_POST['ifaceTab'] == 'snort_rules') { - function snortSaveRuleSetsRulesFunc() - { - // unset POSTs that are markers not in db - unset($_POST['snortSaveRuleSets']); - unset($_POST['ifaceTab']); - - snortJsonReturnCode(snortSql_updateRuleSigList()); - - } snortSaveRuleSetsRulesFunc(); - } - - if ($_POST['ifaceTab'] === 'snort_rules_ips') { - function snortSamRulesSaveFunc() - { - snortJsonReturnCode(snortSql_updateRulesSigsIps()); - buildSnortSamSidBlockMap($_POST['rdbuuid']); // - - } snortSamRulesSaveFunc(); - } - - - if ($_POST['ifaceTab'] == 'snort_rulesets' || $_POST['ifaceTab'] == 'snort_rulesets_ips') { - - function snortSaveRuleSetsRulesetsFunc() - { - // unset POSTs that are markers not in db - unset($_POST['snortSaveRuleSets']); - unset($_POST['ifaceTab']); - - // save to database - snortJsonReturnCode(snortSql_updateRuleSetList()); - - if (!empty($_POST['rdbuuid'])) { - buildSnortSamSidBlockMap($_POST['rdbuuid']); // - } - - // only build if uuid is valid - if (!empty($_POST['uuid'])) { - build_snort_settings($_POST['uuid']); - } - - } snortSaveRuleSetsRulesetsFunc(); - } - - -} // END of rulesSets - -// row from db by uuid -if ( $_POST['RMlistDelRow'] == 1 || $_POST['RSTlistRow'] == 1 ) { - - - function RMlistDelRowFunc() - { - - $rm_row_list = snortSql_fetchAllSettings($_POST['RMlistDB'], $_POST['RMlistTable'], 'uuid', $_POST['RMlistUuid']); - - // list rules in the default dir - if ($_POST['RMlistTable'] == 'SnortIfaces') { - - $snortRuleDir = '/usr/local/etc/snort/sn_' . $_POST['RMlistUuid']; - - exec('/bin/rm -r ' . $snortRuleDir); - } - - // rm ruledb and files - if ($_POST['RMlistTable'] == 'Snortrules') { - - // remove db tables vals - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSets', 'rdbuuid', $_POST['RMlistUuid']); - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSigs', 'rdbuuid', $_POST['RMlistUuid']); - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSigsIps', 'rdbuuid', $_POST['RMlistUuid']); - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSetsIps', 'rdbuuid', $_POST['RMlistUuid']); - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleGenIps', 'rdbuuid', $_POST['RMlistUuid']); - - // remove dir - $snortRuleDir = "/usr/local/etc/snort/snortDBrules/DB/{$_POST['RMlistUuid']}"; - exec('/bin/rm -r ' . $snortRuleDir); - } - - if ($_POST['RMlistTable'] == 'SnortWhitelist') { - snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortWhitelistips', 'filename', $rm_row_list['filename']); - } - - snortJsonReturnCode(snortSql_updatelistDelete($_POST['RMlistDB'], $_POST['RMlistTable'], 'uuid', $_POST['RMlistUuid'])); - - } if ( $_POST['RMlistDelRow'] == 1 ) { RMlistDelRowFunc(); } - - function RSTlistDelRowFunc() - { - - // rm ruledb and files - if ($_POST['RSTlistTable'] == 'Snortrules') { - - // remove dir - $snortRuleDir = "/usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}"; - exec('/bin/rm -r ' . $snortRuleDir . '/rules/*.rules'); - - // remove db tables vals - snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSets', 'rdbuuid', $_POST['RSTlistUuid']); - snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSigs', 'rdbuuid', $_POST['RSTlistUuid']); - snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSigsIps', 'rdbuuid', $_POST['RSTlistUuid']); - snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSetsIps', 'rdbuuid', $_POST['RSTlistUuid']); - snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleGenIps', 'rdbuuid', $_POST['RSTlistUuid']); - - // NOTE: code only works on php5 - $listSnortRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/snort_rules/rules', '\.rules'); - $listEmergingRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/emerging_rules/rules', '\.rules'); - $listPfsenseRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules', '\.rules'); - - if (!empty($listSnortRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/snort_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); - } - if (!empty($listEmergingRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/emerging_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); - } - if (!empty($listPfsenseRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/pfsense_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); - } - - - } - - } if ( $_POST['RSTlistRow'] == 1 ) { RSTlistDelRowFunc(); } - - -} - - -// general settings save -if ($_POST['snortSaveSettings'] == 1) { - - function snortSaveSettingsFunc() - { - - // Save ruleDB settings - if ($_POST['dbTable'] == 'Snortrules') { - - function saveSnortrules() - { - - unset($_POST['snortSaveSettings']); - unset($_POST['ifaceTab']); - - if (!is_dir("/usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules")) { - - // creat iface dir and ifcae rules dir - exec("/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); - - // create at least one file - if (!file_exists("/usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules/local.rules")) { - exec("/usr/bin/touch /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules/local.rules"); - } - - // NOTE: code only works on php5 - $listSnortRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/snort_rules/rules', '\.rules'); - $listEmergingRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/emerging_rules/rules', '\.rules'); - $listPfsenseRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules', '\.rules'); - - if (!empty($listSnortRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/snort_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); - } - if (!empty($listEmergingRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/emerging_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); - } - if (!empty($listPfsenseRulesDir)) { - exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/pfsense_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); - } - - - } //end of mkdir - - } saveSnortrules(); - - snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); - - } // END if Snortrules - - // Save general settings - if ($_POST['dbTable'] == 'SnortSettings') { - - function saveSnortSettings() - { - - if ($_POST['ifaceTab'] == 'snort_interfaces_global') { - // checkboxes when set to off never get included in POST thus this code - $_POST['forcekeepsettings'] = ($_POST['forcekeepsettings'] == '' ? off : $_POST['forcekeepsettings']); - } - - if ($_POST['ifaceTab'] == 'snort_alerts') { - - if (!isset($_POST['arefresh'])) - $_POST['arefresh'] = ($_POST['arefresh'] == '' ? off : $_POST['arefresh']); - - } - - if ($_POST['ifaceTab'] == 'snort_blocked') { - - if (!isset($_POST['brefresh'])) - $_POST['brefresh'] = ($_POST['brefresh'] == '' ? off : $_POST['brefresh']); - - } - - // unset POSTs that are markers not in db - unset($_POST['snortSaveSettings']); - unset($_POST['ifaceTab']); - - } saveSnortSettings(); - - snortJsonReturnCode(snortSql_updateSettings('id', '1')); - - } // END IF SnortSettings - - // Save rule settings on the interface edit tab - if ($_POST['dbTable'] == 'SnortIfaces') { - - function saveSnortIfaces() - { - - // snort interface edit - if ($_POST['ifaceTab'] == 'snort_interfaces_edit') { - - function SnortIfaces_Snort_Interfaces_edit() - { - if (!isset($_POST['enable'])) - $_POST['enable'] = ($_POST['enable'] == '' ? off : $_POST['enable']); - - if (!isset($_POST['blockoffenders7'])) - $_POST['blockoffenders7'] = ($_POST['blockoffenders7'] == '' ? off : $_POST['blockoffenders7']); - - if (!isset($_POST['alertsystemlog'])) - $_POST['alertsystemlog'] = ($_POST['alertsystemlog'] == '' ? off : $_POST['alertsystemlog']); - - if (!isset($_POST['tcpdumplog'])) - $_POST['tcpdumplog'] = ($_POST['tcpdumplog'] == '' ? off : $_POST['tcpdumplog']); - - if (!isset($_POST['snortunifiedlog'])) - $_POST['snortunifiedlog'] = ($_POST['snortunifiedlog'] == '' ? off : $_POST['snortunifiedlog']); - - // convert textbox to base64 - $_POST['configpassthru'] = base64_encode($_POST['configpassthru']); - - /* - * make dir for the new iface, if iface exists or rule dir has changed redo soft link - * may need to move this as a func to new_snort.inc - */ - $newSnortDir = 'sn_' . $_POST['uuid']; - $pathToSnortDir = '/usr/local/etc/snort'; - - // creat iface dir and ifcae rules dir - if (!is_dir("{$pathToSnortDir}/{$newSnortDir}")) { - createNewIfaceDir($pathToSnortDir, $newSnortDir); - } //end of mkdir - - snortRulesCreateSoftlink(); - - } SnortIfaces_Snort_Interfaces_edit(); - - } // end of snort_interfaces_edit - - // snort preprocessor edit - if ($_POST['ifaceTab'] == 'snort_preprocessors') { - - function SnortIfaces_Snort_PreprocessorsFunc() - { - if (!isset($_POST['dce_rpc_2'])) { - $_POST['dce_rpc_2'] = ($_POST['dce_rpc_2'] == '' ? off : $_POST['dce_rpc_2']); - } - - if (!isset($_POST['dns_preprocessor'])) { - $_POST['dns_preprocessor'] = ($_POST['dns_preprocessor'] == '' ? off : $_POST['dns_preprocessor']); - } - - if (!isset($_POST['ftp_preprocessor'])) { - $_POST['ftp_preprocessor'] = ($_POST['ftp_preprocessor'] == '' ? off : $_POST['ftp_preprocessor']); - } - - if (!isset($_POST['http_inspect'])) { - $_POST['http_inspect'] = ($_POST['http_inspect'] == '' ? off : $_POST['http_inspect']); - } - - if (!isset($_POST['other_preprocs'])) { - $_POST['other_preprocs'] = ($_POST['other_preprocs'] == '' ? off : $_POST['other_preprocs']); - } - - if (!isset($_POST['perform_stat'])) { - $_POST['perform_stat'] = ($_POST['perform_stat'] == '' ? off : $_POST['perform_stat']); - } - - if (!isset($_POST['sf_portscan'])) { - $_POST['sf_portscan'] = ($_POST['sf_portscan'] == '' ? off : $_POST['sf_portscan']); - } - - if (!isset($_POST['smtp_preprocessor'])) { - $_POST['smtp_preprocessor'] = ($_POST['smtp_preprocessor'] == '' ? off : $_POST['smtp_preprocessor']); - } - - } SnortIfaces_Snort_PreprocessorsFunc(); - - } - - // snort barnyard edit - if ($_POST['ifaceTab'] == 'snort_barnyard') { - function SnortIfaces_Snort_Barnyard() - { - // make shure iface is lower case - $_POST['interface'] = strtolower($_POST['interface']); - - if (!isset($_POST['barnyard_enable'])) { - $_POST['barnyard_enable'] = ($_POST['barnyard_enable'] == '' ? off : $_POST['barnyard_enable']); - } - } SnortIfaces_Snort_Barnyard(); - } - - - // unset POSTs that are markers not in db - unset($_POST['snortSaveSettings']); - unset($_POST['ifaceTab']); - - snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); - build_snort_settings($_POST['uuid']); - - } saveSnortIfaces(); - - } // END IF SnortIfaces - - } snortSaveSettingsFunc(); - - -} // STOP General Settings Save - -// Suppress settings save -if ($_POST['snortSaveSuppresslist'] == 1) { - - function snortSaveSuppresslistFunc() - { - - // post for supress_edit - if ($_POST['ifaceTab'] == 'snort_interfaces_suppress_edit') { - - // make sure filename is valid - if (!is_validFileName($_POST['filename'])) { - echo 'Error: FileName'; - return false; - } - - // unset POSTs that are markers not in db - unset($_POST['snortSaveSuppresslist']); - unset($_POST['ifaceTab']); - - // convert textbox to base64 - $_POST['suppresspassthru'] = base64_encode($_POST['suppresspassthru']); - - // Write to database - snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); - - } - - } - snortSaveSuppresslistFunc(); - -} - -// Whitelist settings save -if ($_POST['snortSaveWhitelist'] == 1) { - - function snortSaveWhitelistFunc() - { - - if ($_POST['ifaceTab'] == 'snort_interfaces_whitelist_edit') { - - if (!is_validFileName($_POST['filename'])) { - echo 'Error: FileName'; - return false; - } - - $_POST['wanips'] = ($_POST['wanips'] == '' ? off : $_POST['wanips']); - $_POST['wangateips'] = ($_POST['wangateips'] == '' ? off : $_POST['wangateips']); - $_POST['wandnsips'] = ($_POST['wandnsips'] == '' ? off : $_POST['wandnsips']); - $_POST['vips'] = ($_POST['vips'] == '' ? off : $_POST['vips']); - $_POST['vpnips'] = ($_POST['vpnips'] == '' ? off : $_POST['vpnips']); - - } - - // unset POSTs that are markers not in db - unset($_POST['snortSaveWhitelist']); - unset($_POST['ifaceTab']); - - // Split the POST for 2 arraus - $whitelistIPs = $_POST['list']; - unset($_POST['list']); - - - if (snortSql_updateSettings('uuid', $_POST['uuid']) && snortSql_updateWhitelistIps($whitelistIPs)) { - snortJsonReturnCode(true); - }else{ - snortJsonReturnCode(false); - } - - } - snortSaveWhitelistFunc(); - -} - -// download code for alerts page -if ($_POST['snortlogsdownload'] == 1) { - - function snortlogsdownloadFunc() - { - conf_mount_rw(); - snort_downloadAllLogs(); - conf_mount_ro(); - } - snortlogsdownloadFunc(); - -} - -// download code for alerts page -if ($_POST['snortblockedlogsdownload'] == 1) { - - function snortblockedlogsdownloadFunc() - { - conf_mount_rw(); - snort_downloadBlockedIPs(); - conf_mount_ro(); - } - snortblockedlogsdownloadFunc(); - -} - - -// code neeed to be worked on when finnished rules code -if ($_POST['snortlogsdelete'] == 1) { - - function snortlogsdeleteFunc() - { - conf_mount_rw(); - snortDeleteLogs(); - conf_mount_ro(); - } - snortlogsdeleteFunc(); -} - -// flushes snort2c table -if ($_POST['snortflushpftable'] == 1) { - - function snortflushpftableFunc() - { - conf_mount_rw(); - snortRemoveBlockedIPs(); - conf_mount_ro(); - } - snortflushpftableFunc(); -} - -// reset db reset_snortgeneralsettings -if ($_POST['reset_snortgeneralsettings'] == 1) { - - function reset_snortgeneralsettingsFunc() - { - conf_mount_rw(); - reset_snortgeneralsettings(); - conf_mount_ro(); - } - reset_snortgeneralsettingsFunc(); - -} - - -?> - - - - - - - - - - diff --git a/config/orionids-dev/snort_new.inc b/config/orionids-dev/snort_new.inc deleted file mode 100644 index b9fc2322..00000000 --- a/config/orionids-dev/snort_new.inc +++ /dev/null @@ -1,1368 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -// unset crsf checks -if(isset($_POST['__csrf_magic'])) { - unset($_POST['__csrf_magic']); -} - -//require_once("pfsense-utils.inc"); -require_once("config.inc"); -require_once("functions.inc"); - -// create and cp to tmp db dir -if (!file_exists('/var/snort/')) { - exec('/bin/mkdir -p /var/snort/'); -} - -if (file_exists('/usr/local/pkg/snort/snortDBtemp')) { - exec('/bin/cp /usr/local/pkg/snort/snortDBtemp /var/snort/snortDBtemp'); -} - -// used in snort_rules_ips.php and create sid block map -function snortSearchArray($array, $key, $value) -{ - $results = array(); - - if (is_array($array)) - { - foreach ($array as $subarray) - { - if ($subarray[$key] == $value) { - $results = $subarray; - } - - } - - } - - return $results; -} - -// used in snort_rules_ips.php and create sid block map -function getCurrentIpsRuleArray($output) -{ - - foreach (array_unique($output) as $line) - { - $newOutput = explode(' # ', $line); - $newLine[] = $newOutput; - } - - return $newLine; -} - -/* -* make dir for the new iface, if iface exists or rule dir has changed redo soft link -*/ -function snortRulesCreateSoftlink() -{ - $newSnortDir = 'sn_' . $_POST['uuid']; - $pathToSnortDir = '/usr/local/etc/snort'; - - // change the rule path - if (is_dir("{$pathToSnortDir}/{$newSnortDir}")) { - - $snortCurrentRuleDbName = snortSql_fetchAllSettings('snortDB', 'snortIfaces', 'uuid', $_POST['uuid']); - - if ($_POST['ruledbname'] !== $snortCurrentRuleDbName['ruledbname'] || !file_exists("{$pathToSnortDir}/{$newSnortDir}/rules")) { - - // NOTE: use full paths or link rm will not work, Freebsd love - exec("/bin/rm {$pathToSnortDir}/{$newSnortDir}/rules"); - exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/{$_POST['ruledbname']}/rules {$pathToSnortDir}/{$newSnortDir}/rules"); - - } - - } -} - - -// Wites selected sig to file -function snortSidStringRuleEditGUI() -{ - - $workingFile = '/usr/local/etc/snort/sn_' . $_POST['snortSidRuleIface'] . '/rules/' . $_POST['snortSidRuleFile']; - - $splitcontents = split_rule_file($workingFile); - - if (!empty($splitcontents)) { - $sidLinePosPre = exec('/usr/bin/sed -n /sid:' . $_POST['snortSidNum'] . '\;/= ' . $workingFile); - $sidLinePos = $sidLinePosPre - 1; - - $splitcontents[$sidLinePos] = $_POST['sidstring']; - - - write_rule_file($splitcontents, $workingFile); - - return true; - } - - return false; - -} - -function sendSidStringRuleEditGUI() -{ - - $sidCall = exec('sed -n "/alert.*sid:' . $_GET['sid'] . ';.*/p" /usr/local/etc/snort/sn_' . $_GET['snortIface'] . '/rules/' . $_GET['snortRuleFile']); - $sidCallJsonFilter = escapeJsonString($sidCall); - - echo '{"sidstring":' . '"' . $sidCallJsonFilter . '","sid":' . '"' . $_GET['sid'] . '"}'; - return true; -} - -// create new Ifac dirs and soft links -function createNewIfaceDir($pathToSnortDir, $newSnortDir) { - - exec("/bin/mkdir -p {$pathToSnortDir}/{$newSnortDir}"); - - // create rules dir soft link if setting is default - if ($_POST['ruledbname'] === 'default' || empty($_POST['ruledbname'])) { - if (!file_exists("{$pathToSnortDir}/sn_{$_POST['uuid']}/rules") && file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { - exec("/bin/ln -s {$pathToSnortDir}/snortDBrules/DB/default/rules {$pathToSnortDir}/sn_{$_POST['uuid']}/rules"); - } - } - - // create rules dir soft link if setting is not default - if ($_POST['ruledbname'] !== 'default' || $_POST['ruledbname'] != '') { - if (!file_exists("{$pathToSnortDir}/sn_{$_POST['uuid']}/rules") && file_exists("{$pathToSnortDir}/snortDBrules/DB/{$_POST['ruledbname']}/rules")) { - exec("/bin/ln -s {$pathToSnortDir}/snortDBrules/DB/{$_POST['ruledbname']}/rules {$pathToSnortDir}/sn_{$_POST['uuid']}/rules"); - } - } - - // cp new rules - exec("/bin/cp {$pathToSnortDir}/etc/*.config {$pathToSnortDir}/sn_{$_POST['uuid']}"); - exec("/bin/cp {$pathToSnortDir}/etc/*.conf {$pathToSnortDir}/sn_{$_POST['uuid']}"); - exec("/bin/cp {$pathToSnortDir}/etc/*.map {$pathToSnortDir}/sn_{$_POST['uuid']}"); - exec("/bin/cp {$pathToSnortDir}/etc/generators {$pathToSnortDir}/sn_{$_POST['uuid']}"); - exec("/bin/cp {$pathToSnortDir}/etc/sid {$pathToSnortDir}/sn_{$_POST['uuid']}"); -} // end of func - -function escapeJsonString($escapeString) -{ - // NOTE: foward slash has added spaces on each side ie and chrome were giving issues with - $search = array('\\', '\n', '\r', '\u', '\t', '\f', '\b', '/', '"'); - $replace = array('\\\\', '\\n', '\\r', '\\u', '\\t', '\\f', '\\b', ' \/ ', '\"'); - $encoded_string = str_replace($search, $replace, $escapeString); - - return $encoded_string; - -} - -// limit the length of the given string to $MAX_LENGTH char -function trimLength($s) { - - - $MAX_LENGTH = 13; - $str_to_count = $s; - if (strlen($str_to_count) <= $MAX_LENGTH) { - return $s; - } - - $s2 = substr($str_to_count, 0, $MAX_LENGTH - 3); - $s2 .= "..."; - return $s2; -} - - -// builds base array with sid etc.... -function newFilterRuleSig($baseruleArray) -{ - - function get_middle($source, $beginning, $ending, $init_pos) - { - $beginning_pos = strpos($source, $beginning, $init_pos); - $middle_pos = $beginning_pos + strlen($beginning); - $ending_pos = strpos($source, $ending, $beginning_pos); - $middle = substr($source, $middle_pos, $ending_pos - $middle_pos); - return $middle; - } - - - $i = 0; - $newSigArray[] = array(); - foreach ( $baseruleArray as $value ) - { - if (preg_match('/^# alert/', $value) || preg_match('/^alert/', $value)) { - - // add sid - $newSigArray[$i]['sid'] = get_middle($value, 'sid:', ';', 0); - - // remove whitespaces - $rmWhitespaces = preg_replace('/\s\s+/', ' ', $value); - // remove whitespace betwin # aerrt - $rmAlertWhitespace = preg_replace('/^# alert/', '#alert', $rmWhitespaces); - $splitcontents = explode(' ', $rmAlertWhitespace); - - // enable or disable - if ($splitcontents[0] === '#alert') { - $newSigArray[$i]['enable'] = 'off'; - }else{ - $newSigArray[$i]['enable'] = 'on'; - } - - // proto - $newSigArray[$i]['proto'] = $splitcontents[1]; - - // source - $newSigArray[$i]['src'] = trimLength($splitcontents[2]); - - // source port - $newSigArray[$i]['srcport'] = trimLength($splitcontents[3]); - - // Destination - $newSigArray[$i]['dst'] = trimLength($splitcontents[5]); - - // Destination port - $newSigArray[$i]['dstport'] = trimLength($splitcontents[6]); - - // sig message - $newSigArray[$i]['msg'] = get_middle($value, 'msg:"', '";', 0); - - } - - $i++; - - } - - return $newSigArray; -} - - -function split_rule_file($workingFile) -{ - $filehandle = fopen($workingFile, "r"); - $contents = fread($filehandle, filesize($workingFile)); - - fclose ($filehandle); - - $delimiter = "\n"; - - $splitcontents = explode($delimiter, $contents); - - return $splitcontents; -} - - -// write rule file to disk -function write_rule_file($content_changed, $received_file) -{ - - //read snort file with writing enabled - $filehandle = fopen($received_file, "w"); - - //delimiter for each new rule is a new line - $delimiter = "\n"; - - //implode the array back into a string for writing purposes - $fullfile = implode($delimiter, $content_changed); - - //write data to file - fwrite($filehandle, $fullfile); - - //close file handle - fclose($filehandle); - -} - - -// Save ruleSets settings -function snortSql_updateRuleSigList() -{ - - // selected snort rule file - $workingFile = "/usr/local/etc/snort/snortDBrules/DB/{$_SESSION['snort']['tmp']['snort_rules']['rdbuuid']}/rules/{$_SESSION['snort']['tmp']['snort_rules']['rulefile']}"; - - $splitcontents = split_rule_file($workingFile); - - // open rule file and change enable/disable sids - function read_rule_file($splitcontents, $enableSigsArray, $disableSigsArray) - { - - foreach ($splitcontents as $sigLine) - { - $replaceChars = array('/sid:/', '/;/'); - preg_match('/sid:[0-9]*;/', $sigLine, $matches); - $sidLine = preg_replace($replaceChars, '', $matches[0]); - - - if (empty($sidLine)) { - $tempstring[] = $sigLine; - }else{ - - if (in_array($sidLine, $enableSigsArray)) { - $tempstring[] = str_replace("# alert", "alert", $sigLine); - } - - if (in_array($sidLine, $disableSigsArray)) { - $tempstring[] = str_replace("alert", "# alert", $sigLine); - } - - if (!in_array($sidLine, $enableSigsArray) && !in_array($sidLine, $disableSigsArray)) { - $tempstring[] = $sigLine; - } - } - } - - return $tempstring; - } - - // build user selected enbled and disabled arrays - $enableSigsArray = array(); - $disableSigsArray = array(); - - if (!isset($_POST['filenamcheckbox2'])) { - $_POST['filenamcheckbox2'] = array(); - } - - $newFilterRuleSigArray = newFilterRuleSig($splitcontents); - - foreach ($newFilterRuleSigArray as $sigArray) - { - // enable sig - if(in_array($sigArray['sid'], $_POST['filenamcheckbox2']) && $sigArray['enable'] == 'off') { - $enableSigsArray[] = $sigArray['sid']; - } - - // disable sig - if(!in_array($sigArray['sid'], $_POST['filenamcheckbox2']) && $sigArray['enable'] == 'on') { - $disableSigsArray[] = $sigArray['sid']; - } - } - - // read rule file change disable/enable then write to file if arrays are not empty - if (!empty($enableSigsArray) || !empty($disableSigsArray)) { - write_rule_file(read_rule_file($splitcontents, $enableSigsArray, $disableSigsArray), $workingFile); - } - - // Insert into the DB for oinkmaster - - function sql_EnableDisabeSid($SigArray, $OnOff) - { - - $dbname = $_SESSION['snort']['tmp']['snort_rules']['dbName']; - $table = $_SESSION['snort']['tmp']['snort_rules']['dbTable']; - $rdbuuid = $_SESSION['snort']['tmp']['snort_rules']['rdbuuid']; - $rulefile = $_SESSION['snort']['tmp']['snort_rules']['rulefile']; - $addDate = date(U); - - // dont let user pick the DB path - $db = sqlite_open("/usr/local/pkg/snort/{$dbname}"); - - foreach ($SigArray as $mDEanbled) - { - - $resultid = sqlite_query($db, - "SELECT id FROM {$table} WHERE signatureid = '{$mDEanbled}' AND signaturefilename = '{$rulefile}'; - "); - - $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); - - if (empty($chktable)) { - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "INSERT INTO {$table} (date, rdbuuid, signatureid, signaturefilename, enable) VALUES ('{$addDate}', '{$rdbuuid}', '{$mDEanbled}', '{$rulefile}', '{$OnOff}'); - "); - - }else{ - if ($chktable[0]['enable'] != $OnOff) { - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$table} SET date = {$addDate}, enable = '{$OnOff}' WHERE signatureid = '{$mDEanbled}' AND signaturefilename = '{$rulefile}'; - "); - } - - - } - - - } - - sqlite_close($db); - - } // snd of function - - sql_EnableDisabeSid($enableSigsArray, 'on'); - sql_EnableDisabeSid($disableSigsArray, 'off'); - - - return true; - - -} // END Save ruleSets settings - - -// Save rulessigs settings for snort_rules_ips -function snortSql_updateRulesSigsIps() -{ - - // dont let user pick the DB path - $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); - - function insertUpdateDB($db) - { - - // get default settings - $listGenRules = array(); - $listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $_POST['rdbuuid']); - - // if $listGenRules empty list defaults - if (empty($listGenRules)) { - $listGenRules[0] = array( - 'id' => 1, - 'rdbuuid' => $_POST['rdbuuid'], - 'enable' => 'on', - 'who' => 'src', - 'timeamount' => 15, - 'timetype' => 'minutes' - ); - } - - $addDate = date(U); - - // checkbox off catch - $listGenRulesEnable = $listGenRules[0]['enable']; - if ( empty($listGenRules[0]['enable']) || $listGenRules[0]['enable'] === 'off' ) { - - $listGenRulesEnable = 'off'; - } - - // TODO: inprove this foreach so we only interact with db once - foreach ($_POST['snortsam']['db'] as $singleSig) - { - - $resultid = sqlite_query($db, - "SELECT id FROM {$_POST['dbTable']} WHERE siguuid = '{$singleSig['siguuid']}' and rdbuuid = '{$_POST['rdbuuid']}'; - "); - - $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); - - // checkbox off catch - $singleSigEnable = $singleSig['enable']; - if ( empty($singleSig['enable']) ) { - - $singleSigEnable = 'off'; - } - - // only do this if something change from defauts settings, note: timeamount Not equal - $somthingChanged = FALSE; - if ( $singleSigEnable !== $listGenRulesEnable || $singleSig['who'] !== $listGenRules[0]['who'] || $singleSig['timeamount'] != $listGenRules[0]['timeamount'] || $singleSig['timetype'] !== $listGenRules[0]['timetype'] ) { - $somthingChanged = TRUE; - } - - if ( empty($chktable) && $somthingChanged ) { - - $rulesetUuid = genAlphaNumMixFast(11, 14); - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "INSERT INTO {$_POST['dbTable']} (date, uuid, rdbuuid, enable, siguuid, sigfilename, who, timeamount, timetype) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$singleSigEnable}', '{$singleSig['siguuid']}', '{$singleSig['sigfilename']}', '{$singleSig['who']}', '{$singleSig['timeamount']}', '{$singleSig['timetype']}'); - "); - - } - - if ( !empty($chktable) && $somthingChanged ) { - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$_POST['dbTable']} SET date ='{$addDate}', enable = '{$singleSigEnable}', who = '{$singleSig['who']}', timeamount = '{$singleSig['timeamount']}', timetype = '{$singleSig['timetype']}' WHERE rdbuuid = '{$_POST['rdbuuid']}' and sigfilename = '{$singleSig['sigfilename']}'; - "); - - } - - } // END foreach - - } insertUpdateDB($db); - - function cleanupDB($db) - { - // clean database of old names and turn rulesets off - $listDir = snortScanDirFilter("/usr/local/etc/snort/snortDBrules/DB/{$_POST['rdbuuid']}/rules/", '\.rules'); - - $resultAllRulesetname = sqlite_query($db, - "SELECT sigfilename FROM {$_POST['dbTable']} WHERE rdbuuid = '{$_POST['rdbuuid']}'; - "); - - $chktable2 = sqlite_fetch_all($resultAllRulesetname, SQLITE_ASSOC); - - if (!empty($chktable2)) { - foreach ($chktable2 as $value) - { - - if(!in_array($value['sigfilename'], $listDir)) { - $deleteMissingRuleset = sqlite_query($db, // @ supress warnings use only in production - "DELETE FROM {$_POST['dbTable']} WHERE sigfilename = '{$value['sigfilename']}' and rdbuuid = '{$_POST['rdbuuid']}'; - "); - } - - } - } - } cleanupDB($db); - - sqlite_close($db); - return true; - -} - - - -// Save ruleSets settings -function snortSql_updateRuleSetList() -{ - - function createUpdateRulesetTable() - { - - $addDate = date(U); - - // dont let user pick the DB path - $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); - - if (empty($_POST['filenamcheckbox'])) { - $ruleSetfilenames = array(); - } - - // foreach selected rulesets do this - if (!empty($_POST['filenamcheckbox'])) { - foreach ($_POST['filenamcheckbox'] as $ruleSetfilename) - { - - $resultid = sqlite_query($db, - "SELECT id, enable FROM {$_POST['dbTable']} WHERE rulesetname = '{$ruleSetfilename}' and rdbuuid = '{$_POST['rdbuuid']}'; - "); - - $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); - - if (empty($chktable)) { - - $rulesetUuid = genAlphaNumMixFast(11, 14); - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "INSERT INTO {$_POST['dbTable']} (date, uuid, rdbuuid, rulesetname, enable) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$ruleSetfilename}', 'on'); - "); - - }else{ - if ($chktable[0]['enable'] == 'off') { - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$_POST['dbTable']} SET enable = 'on' WHERE id = '{$chktable[0]['id']}'; - "); - } - } - } - } // end foreach if - - - // clean database of old names and turn rulesets off - $listDir = snortScanDirFilter("/usr/local/etc/snort/snortDBrules/DB/{$_POST['rdbuuid']}/rules/", '\.rules'); - - $resultAllRulesetname = sqlite_query($db, - "SELECT rulesetname FROM {$_POST['dbTable']} WHERE rdbuuid = '{$_POST['rdbuuid']}'; - "); - - $chktable2 = sqlite_fetch_all($resultAllRulesetname, SQLITE_ASSOC); - - - if (!empty($chktable2)) { - foreach ($chktable2 as $value) - { - - if(!in_array($value['rulesetname'], $listDir)) { - $deleteMissingRuleset = sqlite_query($db, // @ supress warnings use only in production - "DELETE FROM {$_POST['dbTable']} WHERE rulesetname = '{$value['rulesetname']}' and rdbuuid = '{$_POST['rdbuuid']}'; - "); - } - - if(!in_array($value['rulesetname'], $_POST['filenamcheckbox'])) { - $ruleSetisOff = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$_POST['dbTable']} SET enable = 'off' WHERE rulesetname = '{$value['rulesetname']}' and rdbuuid = '{$_POST['rdbuuid']}'; - "); - } - } - } - sqlite_close($db); - } // END createUpdateRulesetTable func - createUpdateRulesetTable(); - - // save gen setting only if on ips tab - if ($_POST['dbTable'] === 'SnortruleSetsIps') { - - function createUpdateRulesetGenTable() - { - $table = 'SnortruleGenIps'; - $rulesetUuid = genAlphaNumMixFast(11, 14); - $addDate = date(U); - - // if enable is empty then set to off - if (empty($_POST['snortsam']['db']['gensettings']['enable'])) { - - $_POST['snortsam']['db']['gensettings']['enable'] = 'off'; - } - - // dont let user pick the DB path - $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); - - $resultid = sqlite_query($db, - "SELECT id FROM {$table} WHERE rdbuuid = '{$_POST['rdbuuid']}'; - "); - - $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); - - if (!empty($chktable)) { - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "UPDATE {$table} SET enable = '{$_POST['snortsam']['db']['gensettings']['enable']}', who = '{$_POST['snortsam']['db']['gensettings']['who']}', timeamount = '{$_POST['snortsam']['db']['gensettings']['timeamount']}', timetype = '{$_POST['snortsam']['db']['gensettings']['timetype']}' WHERE rdbuuid = '{$_POST['rdbuuid']}'; - "); - - }else{ - - $query_ck = sqlite_query($db, // @ supress warnings usonly in production - "INSERT INTO {$table} (date, uuid, rdbuuid, enable, who, timeamount, timetype) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$_POST['snortsam']['db']['gensettings']['enable']}', '{$_POST['snortsam']['db']['gensettings']['who']}', '{$_POST['snortsam']['db']['gensettings']['timeamount']}', '{$_POST['snortsam']['db']['gensettings']['timetype']}'); - "); - } - - sqlite_close($db); - } // END createUpdateRulesetGenTable - createUpdateRulesetGenTable(); - - } - return true; - -} // END Save ruleSets settings - - -function snortSql_fetchAllInterfaceRules($table, $dbname) -{ - // do let user pick the DB path - $db = sqlite_open("/usr/local/pkg/snort/{$dbname}"); - - $result = sqlite_query($db, - "SELECT * FROM {$table} WHERE id > 0; - "); - - $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); - - sqlite_close($db); - - return $chktable; - -} - - -// fetch db Settings NONE Json -function snortSql_fetchAllSettings($dbname, $table, $type, $id_uuid) -{ - - if (empty($dbname) || empty($table) || empty($type)) { - return false; - } - - $db = sqlite_open("/usr/local/pkg/snort/$dbname"); - - if ($type == 'All') { - - $result = sqlite_query($db, - "SELECT * FROM {$table} WHERE id > 0; - "); - - }else{ - - $result = sqlite_query($db, - "SELECT * FROM {$table} where {$type} = '{$id_uuid}'; - "); - - } - - if ($type == 'id' || $type == 'uuid') { - $chktable = sqlite_fetch_array($result, SQLITE_ASSOC); - } - - if ($type == 'All' || $type == 'ifaceuuid' || $type == 'ruledbname' || $type == 'rdbuuid' || $type == 'filename') { - $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); - } - - sqlite_close($db); - - return $chktable; - - -} // end func - -// fetch db list settings NONE Json -function snortSql_fetchAllSettingsList($table, $listFilename) -{ - - $db = sqlite_open('/usr/local/pkg/snort/snortDB'); - - $result = sqlite_query($db, - "SELECT * FROM {$table} WHERE filename = \"{$listFilename}\"; - "); - - $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); - - sqlite_close($db); - - return $chktable; - -} - -// Update settings to database -function snortSql_updateSettings($type, $id_uuid) -{ - $dbname = $_POST['dbName']; - $settings = $_POST; - - // update date on every save - $_POST['date'] = date(U); - - $db = "/usr/local/pkg/snort/$dbname"; - $mydb = sqlite_open("$db"); - $table = $settings['dbTable']; - - // unset POSTs that are markers not in db - unset($settings['dbName']); - unset($settings['dbTable']); - - // START add new row if not set - if ($type == 'uuid') { - - $query_ck = sqlite_query($mydb, // @ supress warnings usonly in production - "SELECT * FROM {$table} WHERE uuid = '{$id_uuid}'; - "); - - $query_ckFinal = sqlite_fetch_all($query_ck, SQLITE_ASSOC); - - if (empty($query_ckFinal)) { - - $query_ck = sqlite_query($mydb, // @ supress warnings usonly in production - "INSERT INTO {$table} (date, uuid) VALUES ('{$settings['date']}', '{$settings['uuid']}'); - "); - - if (sqlite_changes($mydb) < 1) { - sqlite_close($mydb); - return 'Error in query'; - } - - } - - } - - // START add values to row - $kv = array(); - foreach ($settings as $key => $value) - { - $kv[] = $key; - $val[] = $value; - } - - $countKv = count($kv); - - $i = -1; - while ($i < $countKv) - { - - $i++; - - if (!empty($kv[$i])) - { - - if ($type == 'id') - { - $query = sqlite_query($mydb, // @ supress warnings usonly in production - "UPDATE {$table} SET {$kv[$i]} = '{$val[$i]}' WHERE id = '{$id_uuid}'; - "); - } - - if ($type == 'uuid') - { - $query = sqlite_query($mydb, // @ supress warnings usonly in production - "UPDATE {$table} SET {$kv[$i]} = '{$val[$i]}' WHERE uuid = '{$id_uuid}'; - "); - } - - if (sqlite_changes($mydb) < 1) - { - sqlite_close($mydb); - return 'Error in query'; - } - - } - } // end while - - sqlite_close($mydb); - return true; - -} - - -// fetch for snort_interfaces_whitelist.php NONE Json -// use sqlite_fetch_array for single and sqlite_fetch_all for lists -function snortSql_fetchAllWhitelistTypes($table, $table2) -{ - - if (empty($table)) { - return false; - } - - $db = sqlite_open('/usr/local/pkg/snort/snortDB'); - - - $result = sqlite_query($db, - "SELECT * FROM {$table} where id > 0; - "); - - $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); - - if (empty($chktable)) { - return false; - } - - if ($table2 != '') - { - foreach ($chktable as $value) - { - - $filename2 = $value['filename']; - - $result2 = sqlite_query($db, - "SELECT ip FROM {$table2} WHERE filename = \"{$filename2}\" LIMIT 4; - "); - - $chktable2 = sqlite_fetch_all($result2, SQLITE_ASSOC); - - $final2 = array('id' => $value['id']); - $final2['date'] = $value['date']; - $final2['uuid'] = $value['uuid']; - $final2['filename'] = $value['filename']; - $final2['description'] = $value['description']; - $final2['snortlisttype'] = $value['snortlisttype']; - - - $final2['list'] = $chktable2; - - $final[] = $final2; - - } // end foreach - }else{ - $final = $chktable; - } - sqlite_close($db); - - return $final; - - -} // end func - - -// Save Whitelistips Settings -function snortSql_updateWhitelistIps($newPostListips) -{ - - if(empty($newPostListips)) - { - return true; - } - - $table = $_POST['dbTable']; - $filename = $_POST['filename']; - - $db = '/usr/local/pkg/snort/snortDB'; - $mydb = sqlite_open("$db"); - $tableips = $table . 'ips'; - $date = date(U); - - // remove list array that has nul ip - foreach ($newPostListips as $ipsListEmpty) - { - if (!empty($ipsListEmpty['ip'])) - { - $genList[] = $ipsListEmpty; - } - } - unset($newPostListips); - - // remove everything if nothing is in the post - if (empty($genList)) - { - - $query = sqlite_query($mydb, // @ supress warnings use only in production - "DELETE FROM {$tableips} WHERE filename = '{$filename}'; - "); - - sqlite_close($mydb); - return true; - - } - - // START Remove entries from DB - $resultUuid = sqlite_query($mydb, - "SELECT uuid FROM {$tableips} WHERE filename = '{$filename}'; - "); - - $resultUuidFinal = sqlite_fetch_all($resultUuid, SQLITE_ASSOC); - - if (!empty($genList) && !empty($resultUuidFinal)) - { - - foreach ($resultUuidFinal as $list3) - { - $uuidListDB[] = $list3['uuid']; - } - - foreach ($genList as $list2) - { - $uuidListPOST[] = $list2['uuid']; - } - - // create diff array - $uuidDiff = array_diff($uuidListDB, $uuidListPOST); - - // delet diff list objs - if ($uuidDiff != '') - { - foreach ($uuidDiff as $list4) - { - - // remove everything - $query = sqlite_query($mydb, // @ supress warnings use only in production - "DELETE FROM {$tableips} WHERE uuid = '{$list4}'; - "); - - } // end foreach - } - } - - // START add entries/updates to DB - foreach ($genList as $list) - { - - if ($list['uuid'] == 'EmptyUUID') - { - - $uuid = genAlphaNumMixFast(28, 28); - $list['uuid'] = $uuid; - - $query = sqlite_query($mydb, // @ supress warnings use only in production - "INSERT INTO {$tableips} (date, uuid, filename) VALUES ('{$date}', '{$uuid}', '{$filename}'); - "); - - if (sqlite_changes($mydb) < 1) - { - sqlite_close($mydb); - return 'Error in query'; - } - - foreach ($list as $key => $value) - { - - if ($key != '') - { - - $query = sqlite_query($mydb, // @ supress warnings usonly in production - "UPDATE {$tableips} SET {$key} ='{$value}' WHERE uuid = '{$uuid}'; - "); - - if (sqlite_changes($mydb) < 1) - { - sqlite_close($mydb); - return 'Error in query'; - } - - } - - } // end foreach - - }else{ - - $uuid = $list['uuid']; - - foreach ($list as $key => $value) - { - - $query = sqlite_query($mydb, // @ supress warnings usonly in production - "UPDATE {$tableips} SET {$key} ='{$value}', date = '{$date}' WHERE uuid = '{$uuid}'; - "); - - if (sqlite_changes($mydb) < 1) - { - sqlite_close($mydb); - return 'Error in query'; - } - - } // end foreach - - } // end main if - - } // end Main foreach - - sqlite_close($mydb); - return true; - -} // end of func - -// RMlist Delete -function snortSql_updatelistDelete($databse, $table, $type, $uuid_filename) -{ - - $db = "/usr/local/pkg/snort/{$databse}"; - - $mydb = sqlite_open("$db"); - - if (!empty($type)) { - - $query = sqlite_query($mydb, // @ supress warnings usonly in production - "DELETE FROM {$table} WHERE {$type} = '{$uuid_filename}'; - "); - - if (sqlite_changes($mydb) < 1) { - sqlite_close($mydb); - return 'Error in query'; - } - - } - - sqlite_close($mydb); - return true; - -} // END main func - -// create dropdown list -function snortDropDownList($list, $setting) { - foreach ($list as $iday => $iday2) { - - echo "\n" . "' . "\r"; - - } -} - -// downlod all snort logs -function snort_downloadAllLogs() { - - $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); - $file_name = "snort_logs_{$save_date}.tar.gz"; - - exec('/bin/rm /tmp/snort_logs_*.gz'); // remove old file - exec('/bin/rm /tmp/snort_blocked_*.gz'); // remove old file - exec('/bin/rm /tmp/snort_block.pf'); // remove old file - exec('/bin/rm -r /tmp/snort_blocked'); // remove old file - exec("/usr/bin/tar cfz /tmp/snort_logs_{$save_date}.tar.gz /var/log/snort"); - - if (file_exists("/tmp/snort_logs_{$save_date}.tar.gz")) { - echo " - { - \"snortdownload\": \"success\", - \"downloadfilename\": \"{$save_date}\" - } - "; - return true; - }else{ - return false; - } -} - -// send log files to browser GET function -function sendFileSnortLogDownload() { - //ob_start(); //importanr or other post will fail - $file_name_date = $_GET['snortlogfilename']; - - $file_name1 = "/tmp/snort_logs_{$file_name_date}.tar.gz"; - $file_name2 = "/tmp/snort_blocked_{$file_name_date}.tar.gz"; - - if (file_exists($file_name1)) { - $file_name = "snort_logs_{$file_name_date}.tar.gz"; - } - - if (file_exists($file_name2)) { - $file_name = "snort_blocked_{$file_name_date}.tar.gz"; - } - - if (empty($file_name)) { - echo 'Error no saved file.'; - return false; - } - - if(file_exists("/tmp/{$file_name}")) - { - $file = "/tmp/{$file_name}"; - header("Expires: Mon, 26 Jul 1997 05:00:00 GMT\n"); - header("Pragma: private"); // needed for IE - header("Cache-Control: private, must-revalidate"); // needed for IE - header('Content-type: application/force-download'); - header('Content-Transfer-Encoding: Binary'); - header("Content-length: ".filesize($file)); - header("Content-disposition: attachment; filename = {$file_name}"); - readfile("$file"); - exec("/bin/rm /tmp/{$file_name}"); - //od_end_clean(); //importanr or other post will fail - }else{ - echo 'Error no saved file.'; - return false; - } -} - -// Warning code not finnish untill rule code is DONE ! -// Delete Snort logs -function snortDeleteLogs() { - if(file_exists('/var/log/snort/alert')) - { - exec('/bin/echo "" > /var/log/snort/alert'); - //post_delete_logs(); - exec('/usr/sbin/chown snort:snort /var/log/snort/*'); - exec('/bin/chmod 660 /var/log/snort/*'); - sleep(2); - exec('/usr/bin/killall -HUP snort'); - } - - echo ' - { - "snortdelete": "success" - } - '; - return true; - -} - -// Warning code not finnish untill rule code is DONE ! -// code neeed to be worked on when finnished rules code -function post_delete_logs() -{ - global $config, $g; - - - $snort_log_dir = '/var/log/snort'; - - /* do not start config build if rules is empty */ - if (!empty($config['installedpackages']['snortglobal']['rule'])) - { - - - $rule_array = $config['installedpackages']['snortglobal']['rule']; - $id = -1; - foreach ($rule_array as $value) - { - - if (empty($id)) { - $id = 0; - } - - $id += 1; - - $result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; - $snort_uuid = $config['installedpackages']['snortglobal']['rule'][$id]['uuid']; - - if ($snort_uuid != '') - { - if ($config['installedpackages']['snortglobal']['rule'][$id]['snortunifiedlog'] == 'on') - { - $snort_log_file_u2 = "{$snort_uuid}.u2."; - $snort_list_u2 = snort_file_list($snort_log_dir, $snort_log_file_u2); - if (is_array($snort_list_u2)) { - usort($snort_list_u2, "snort_file_sort"); - $snort_u2_rm_list = snort_build_order($snort_list_u2); - snort_remove_files($snort_u2_rm_list, $snort_u2_rm_list[0]); - } - }else{ - exec("/bin/rm $snort_log_dir/snort_{$snort_uuid}.u2*"); - } - - if ($config['installedpackages']['snortglobal']['rule'][$id]['tcpdumplog'] == 'on') - { - $snort_log_file_tcpd = "{$snort_uuid}.tcpdump."; - $snort_list_tcpd = snort_file_list($snort_log_dir, $snort_log_file_tcpd); - if (is_array($snort_list_tcpd)) { - usort($snort_list_tcpd, "snort_file_sort"); - $snort_tcpd_rm_list = snort_build_order($snort_list_tcpd); - snort_remove_files($snort_tcpd_rm_list, $snort_tcpd_rm_list[0]); - } - }else{ - exec("/bin/rm $snort_log_dir/snort_{$snort_uuid}.tcpdump*"); - } - - /* create barnyard2 configuration file */ - //if ($config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable'] == 'on') - //create_barnyard2_conf($id, $if_real, $snort_uuid); - - if ($config['installedpackages']['snortglobal']['rule'][$id]['perform_stat'] == on) - { - exec("/bin/echo '' > /var/log/snort/snort_{$snort_uuid}.stats"); - } - } - } - } -} - -// END General Functions - -// downlod all blocked ips to log -function snort_downloadBlockedIPs() { - - exec('/bin/rm /tmp/snort_logs_*.gz'); // remove old file - exec('/bin/rm /tmp/snort_blocked_*.gz'); // remove old file - exec('/bin/rm /tmp/snort_block.pf'); // remove old file - exec('/bin/rm -r /tmp/snort_blocked'); // remove old file - $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); - $file_name = "snort_blocked_{$save_date}.tar.gz"; - exec('/bin/mkdir /tmp/snort_blocked'); - exec('/sbin/pfctl -t snort2c -T show > /tmp/snort_block.pf'); - - $blocked_ips_array_save = str_replace(' ', '', array_filter(explode("\n", file_get_contents('/tmp/snort_block.pf')))); - - if ($blocked_ips_array_save[0] != '') - { - /* build the list */ - $counter = 0; - foreach($blocked_ips_array_save as $fileline3) - { - $counter++; - exec("/bin/echo $fileline3 >> /tmp/snort_blocked/snort_block.pf"); - } - } - - exec("/usr/bin/tar cfz /tmp/snort_blocked_{$save_date}.tar.gz /tmp/snort_blocked"); - - if (file_exists("/tmp/snort_blocked_{$save_date}.tar.gz")) { - echo " - { - \"snortdownload\": \"success\", - \"downloadfilename\": \"{$save_date}\" - } - "; - return true; - }else{ - return false; - } - -} - -// flush all ips from snort2c table -function snortRemoveBlockedIPs() { - - exec("/sbin/pfctl -t snort2c -T flush"); - - echo ' - { - "snortdelete": "success" - } - '; - return true; - -} - -/* returns true if $name is a valid name for a whitelist file name or ip */ -function is_validFileName($name) { - - if (empty($name)) { - return false; - } - - if (!is_string($name)) { - return false; - } - - if (preg_match("/\s+/", $name)) { - return false; - } - - if (!preg_match("/[^a-zA-Z0-9\-_]/", $name)) { - return true; - } - - return false; -} - -/* gen Alpha Num Mix for uuids or anything random, NEVER USE rand() */ -/* mt_rand/mt_srand is insecure way to gen random nums and strings, when posible use /dev/random or /dev/urandom */ -function genAlphaNumMixFast($min = 14, $max = 28) -{ - - // gen random lenth - mt_srand(crc32(microtime())); - $num = mt_rand($min, $max); - // reseed - mt_srand(); - - // Gen random string - $num = $num > 36 ? 30 : $num; - - $pool = array_merge(range('A', 'Z'), range(0, 9), range('a', 'z')); - - $rand_keys = array_rand($pool, $num); - - $randAlpaNum = ''; - - if (is_array($rand_keys)) { - foreach ($rand_keys as $key) - { - $randAlpaNum .= $pool[$key]; - } - }else{ - $randAlpaNum .= $pool[$rand_keys]; - } - - return str_shuffle($randAlpaNum); - -} - -// scan a dir, build array with filetr -function snortScanDirFilter($path, $filtername) -{ - // list rules in the default dir - $listDir = array(); - $listDir = scandir("{$path}"); - - if (empty($filtername)) { - - return $listDir; - - }else{ - - $pattern = "/{$filtername}/"; - foreach ( $listDir as $val ) - { - if (preg_match($pattern, $val)) { - $filterDirList[] = $val; - } - } - unset($listDir); - } - return $filterDirList; -} - -?> - diff --git a/config/orionids-dev/snort_preprocessors.php b/config/orionids-dev/snort_preprocessors.php deleted file mode 100644 index d99f7f75..00000000 --- a/config/orionids-dev/snort_preprocessors.php +++ /dev/null @@ -1,337 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -$uuid = $_GET['uuid']; -if (isset($_POST['uuid'])) -$uuid = $_POST['uuid']; - -if ($uuid == '') { - echo 'error: no uuid'; - exit(0); -} - - -$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - - $pgtitle = "Snort: Interface Preprocessors and Flow"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    - - - -
    - -
    -
    - - - - - - - - -
    - -
    - -
    - -
    - - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      - Note: -
    - Rules may be dependent on preprocessors!
    - Defaults will be used when there is no user input.
    -
    Performance Statistics
    Enable - > - Performance Statistics for this interface. -
    HTTP Inspect Settings
    Enable - > - Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies. -
    HTTP server flow depth - - - - -
    - - -1 to 1460 (-1 disables HTTP inspect, 0 enables all HTTP inspect) -
    - Amount of HTTP server response payload to inspect. Snort's performance may increase by adjusting this value. -
    - Setting this value too low may cause false negatives. Values above 0 are specified in bytes. Default value is 0     -
    -
    Stream5 Settings
    Max Queued Bytes - - - - -
    - - Minimum is 1024, Maximum is 1073741824 ( default value is 1048576, 0means Maximum ) -
    - The number of bytes to be queued for reassembly for TCP sessions in memory. Default value is 1048576 -
    -
    Max Queued Segs - - - - -
    - - Minimum is 2, Maximum is 1073741824 ( default value is 2621, 0 means Maximum ) -
    - The number of segments to be queued for reassembly for TCP sessions in memory. Default value is 2621 -
    -
    General Preprocessor Settings
    - Enable
    - RPC Decode and Back Orifice detector -     		- > -
    - Normalize/Decode RPC traffic and detects Back Orifice traffic on the network. -
    - Enable -
    - FTP and Telnet Normalizer -     		- > -
    - Normalize/Decode FTP and Telnet traffic and protocol anomalies. -
    - Enable -
    - SMTP Normalizer -     		- > -
    - Normalize/Decode SMTP protocol for enforcement and buffer overflows. -
    - Enable -
    - Portscan Detection -     		- > -
    - Detects various types of portscans and portsweeps. -
    - Enable -
    - DCE/RPC2 Detection -     		- > -
    - The DCE/RPC preprocessor detects and decodes SMB and DCE/RPC traffic. -
    - Enable -
    - DNS Detection -     		- > -
    - The DNS preprocessor decodes DNS Response traffic and detects some vulnerabilities. -
    Define SSL_IGNORE - -
    - Encrypted traffic should be ignored by Snort for both performance reasons and to reduce false positives. -
    - Default: "443 465 563 636 989 990 992 993 994 995". Please use spaces and not commas.     -
      - - -
      - Note: Please save your settings before you click Start. -
    -
    -
    -
    - - - - - - - - diff --git a/config/orionids-dev/snort_rules.php b/config/orionids-dev/snort_rules.php deleted file mode 100644 index fd102538..00000000 --- a/config/orionids-dev/snort_rules.php +++ /dev/null @@ -1,600 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { - echo 'Error: more than one uuid'; - exit(0); -} - -if (isset($_GET['uuid'])) { - $uuid = $_GET['uuid']; -} - -if (isset($_GET['rdbuuid'])) { - $rdbuuid = $_GET['rdbuuid']; -}else{ - $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - $rdbuuid = $ruledbname_pre1['ruledbname']; -} - -// unset Session tmp on page load -unset($_SESSION['snort']['tmp']); - -// list rules in the default dir -$a_list = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'uuid', $rdbuuid); - -$snortRuleDir = '/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid; - - // list rules in the default dir - $filterDirList = array(); - $filterDirList = snortScanDirFilter($snortRuleDir . '/rules', '\.rules'); - - // START read rule file - if ($_GET['openruleset']) { - $rulefile = $_GET['openruleset']; - }else{ - $rulefile = $filterDirList[0]; - } - - // path of rule file - $workingFile = $snortRuleDir . '/rules/' . $rulefile; - -function load_rule_file($incoming_file, $splitcontents) -{ - $pattern = '/(^alert |^# alert )/'; - foreach ( $splitcontents as $val ) - { - // remove whitespaces - $rmWhitespaces = preg_replace('/\s\s+/', ' ', $val); - - // filter none alerts - if (preg_match($pattern, $rmWhitespaces)) - { - $splitcontents2[] = $val; - } - - } - unset($splitcontents); - - return $splitcontents2; - -} - - // Load the rule file - // split the contents of the string file into an array using the delimiter - // used by rule gui edit and table build code - if (filesize($workingFile) > 0) { - $splitcontents = split_rule_file($workingFile); - - $splitcontents2 = load_rule_file($workingFile, $splitcontents); - - $countSig = count($splitcontents2); - - if ($countSig > 0) { - $newFilterRuleSigArray = newFilterRuleSig($splitcontents2); - } - } - - /* - * SET GLOBAL ARRAY $_SESSION['snort'] - * Use SESSION instead POST for security because were writing to files. - */ - - $_SESSION['snort']['tmp']['snort_rules']['dbName'] = 'snortDBrules'; - $_SESSION['snort']['tmp']['snort_rules']['dbTable'] = 'SnortruleSigs'; - $_SESSION['snort']['tmp']['snort_rules']['rdbuuid'] = $rdbuuid; - $_SESSION['snort']['tmp']['snort_rules']['rulefile'] = $rulefile; - - -// find ./ -name test.txt | xargs grep "^disablesid 127 " - - $pgtitle = "Snort: Category: rule: $rulefile"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - -
    - -
    -
    - - - - - - - - - - - - - - -
    - - -
    - -
    - -
    - - - - -
    - - -
    -
    -
    - - -
    - - - -
    -
    - - - - - - '; - }else{ - echo ' - - - - - - - '; - } - ?> - - - -
    -
    - -
    -
    -
    - -
    -
    -
    - -
    -
    -
    - - - - - - - - - -
    - Category: - - There are rules in this category. - - - - -
    -
    - - - - - - -
    - - -
    - -
    - - - - -
    - - - - - - - -
    Snort Signatures:
    - - - - - - - - - - - - - - - - - - - - - - - - -
    OnSidProtoSrcPortDstPortMessage 
    -
    - - - - -
    - - -
    -
    -
    - - - - -
    -
    - -
    - - - -
    - -
    -
    - - - - - - - -
       
    - Note:
    - This is the Snort Rule Signature Viewer. - Please make sure not to add a whitespace before alert or #alert. -
    -
    - Warning: -
    - New settings will not take effect until interface restart. -

    -
    -
    -
    - - - - - - - - - - - - - diff --git a/config/orionids-dev/snort_rules_ips.php b/config/orionids-dev/snort_rules_ips.php deleted file mode 100644 index d026b566..00000000 --- a/config/orionids-dev/snort_rules_ips.php +++ /dev/null @@ -1,471 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -// set page vars - -if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { - echo 'Error: more than one uuid'; - exit(0); -} - -// set page vars -if (isset($_GET['uuid'])) { - $uuid = $_GET['uuid']; -} - -if (isset($_GET['rdbuuid'])) { - $rdbuuid = $_GET['rdbuuid']; -}else{ - $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - $rdbuuid = $ruledbname_pre1['ruledbname']; -} - -if (empty($rdbuuid)) { - echo 'ERROR: Missing RDBUUID'; - exit; -} - -if (isset($_GET['rulefilename'])) { - $rulefilename = $_GET['rulefilename']; -}else{ - echo 'ERROR: Missing rulefilename'; - exit; -} - - - - -// get default settings -$listGenRules = array(); -$listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $rdbuuid); - -// get sigs in db -$listSigRules = array(); -$listSigRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleSigsIps', 'rdbuuid', $rdbuuid); - -// if $listGenRules empty list defaults -if (empty($listGenRules)) { - $listGenRules[0] = array( - 'id' => 1, - 'rdbuuid' => $_POST['rdbuuid'], - 'enable' => 'on', - 'who' => 'src', - 'timeamount' => 15, - 'timetype' => 'minutes' - ); -} - - $pgtitle = "Services: Snort: Ruleset Ips:"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - -
    -


    Please Wait...

    -
    - - - -
    - - - -
    - -
    -
    - - - - - - '; - }else{ - echo ' - - - - - - - '; - } - ?> - - - -
    -
    - -
    -
    -
    - -
    -
    -
    - -
    -
    - - -
    - - - -
    - - - - -
    - - - -
    - -
    -
    - - - - - - - - - - - - -
    Rule File Ips Settings
    - - - - - - - - - - - -
       On   Sid   Source   Amount   DurationMessage
    -
    - - - - -
    - - -
    -
    - - - - -
    -
    - - - -
    - - - - - - - - - - diff --git a/config/orionids-dev/snort_rulesets.php b/config/orionids-dev/snort_rulesets.php deleted file mode 100644 index a2e4f7f3..00000000 --- a/config/orionids-dev/snort_rulesets.php +++ /dev/null @@ -1,347 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { - echo 'Error: more than one uuid'; - exit(0); -} - -// set page vars -if (isset($_GET['uuid'])) { - $uuid = $_GET['uuid']; -} - -if (isset($_GET['rdbuuid'])) { - $rdbuuid = $_GET['rdbuuid']; -}else{ - $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - $rdbuuid = $ruledbname_pre1['ruledbname']; -} - -//$a_list = snortSql_fetchAllSettings('snortDBrules', 'SnortIfaces', 'uuid', $uuid); - - // list rules in the default dir - $filterDirList = array(); - $filterDirList = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid . '/rules', '\.rules'); - - // list rules in db that are on in a array - $listOnRules = array(); - $listOnRules = snortSql_fetchAllSettings('snortDBrules', 'SnortRuleSets', 'rdbuuid', $rdbuuid); - - if (!empty($listOnRules)) { - foreach ( $listOnRules as $val2 ) - { - if ($val2['enable'] == 'on') { - $rulesetOn[] = $val2['rulesetname']; - } - } - unset($listOnRules); - } - - $pgtitle = "Snort: Interface Rule Categories"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    -
    transgif
    - - - - - - '; - }else{ - echo ' - - - - - - - '; - } - ?> - -
    -
    - -
    -
    -
    - -
    -
    -
    - -
    -
    - - - - - - - - - -
    - - - - - -
    - - - - -
    - - - -
    - -
    -
    - - - - - - - - - - - - - -
    EnabledRuleset: Rules that end with "so.rules" are shared object rules.
    - - - - - -
    - - - - -
    Check the rulesets that you would like Snort to load at startup.
    -
    - - -
    - Note: - Please save your settings before you click start. -
    - - - - -
    - - - - - - -
    - - - - - - - - diff --git a/config/orionids-dev/snort_rulesets_ips.php b/config/orionids-dev/snort_rulesets_ips.php deleted file mode 100644 index abac2b6b..00000000 --- a/config/orionids-dev/snort_rulesets_ips.php +++ /dev/null @@ -1,411 +0,0 @@ -. - All rights reserved. - - Pfsense Old snort GUI - Copyright (C) 2006 Scott Ullrich. - - Pfsense snort GUI - Copyright (C) 2008-2012 Robert Zelaya. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - 3. Neither the name of the pfSense nor the names of its contributors - may be used to endorse or promote products derived from this software without - specific prior written permission. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ - -require_once("guiconfig.inc"); -require_once("/usr/local/pkg/snort/snort_new.inc"); -require_once("/usr/local/pkg/snort/snort_gui.inc"); - -//Set no caching -header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); -header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); -header("Cache-Control: no-store, no-cache, must-revalidate"); -header("Cache-Control: post-check=0, pre-check=0", false); -header("Pragma: no-cache"); - -if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { - echo 'Error: more than one uuid'; - exit(0); -} - -// set page vars -if (isset($_GET['uuid'])) { - $uuid = $_GET['uuid']; -} - -if (isset($_GET['rdbuuid'])) { - $rdbuuid = $_GET['rdbuuid']; -}else{ - $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); - $rdbuuid = $ruledbname_pre1['ruledbname']; -} - -//$a_list = snortSql_fetchAllSettings('snortDBrules', 'SnortIfaces', 'uuid', $uuid); - - // list rules in the default dir - $filterDirList = array(); - $filterDirList = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid . '/rules', '\.rules'); - - // list rules in db that are on in a array - $listOnRules = array(); - $listOnRules = snortSql_fetchAllSettings('snortDBrules', 'SnortRuleSetsIps', 'rdbuuid', $rdbuuid); - - // list rules in db that are on in a array - $listGenRules = array(); - $listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $rdbuuid); - - if (!empty($listOnRules)) { - foreach ( $listOnRules as $val2 ) - { - if ($val2['enable'] == 'on') { - $rulesetOn[] = $val2['rulesetname']; - } - } - unset($listOnRules); - } - - $pgtitle = "Services: Snort: Ruleset Ips"; - include("/usr/local/pkg/snort/snort_head.inc"); - -?> - - - - - - - - - -
    -
    -
    - -
    -
    -



    Please Wait...

    -
    -
    -

    -
    -
    -
    - - - -
    -
    transgif
    - - - - - - '; - }else{ - echo ' - - - - - - - '; - } - ?> - -
    -
    - -
    -
    -
    - -
    -
    -
    - -
    -
    - - - - - - - - - -
    - - - -
    - - - - -
    - - - -
    - -
    -
    - - - - - - - - - - - -
    General Settings
    - - - - - -
    - - - - - - - - - - - - - - - - - -
       On   Source   Amount   Duration
    Default settings for all block rules - - type="checkbox"> - - - - - - - -
    -
    - - - - - - - - -
    EnabledSelect The Rulesets To Eable IPS On
    - - - - - -
    - - - - -
    Check the rulesets that you would like Snort to load at startup.
    -
    - - -
    - Note: - Please save your settings before you click start. -
    - - - - -
    - - - - - - -
    - - - - - - - - diff --git a/config/snort-dev/css/new_tab_menu.css b/config/snort-dev/css/new_tab_menu.css new file mode 100644 index 00000000..1592be9f --- /dev/null +++ b/config/snort-dev/css/new_tab_menu.css @@ -0,0 +1,110 @@ +/* + new_tab_menu.css + part of pfSense + Copyright (C) 2010-2011 Robert Zelaya + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + + Replace your old tab menu with the following code. To add a second tab menu line just cut and paste again. + The following code is dependent on new_tab_menu.css and images/new_tab_menu.png. + + + + + + + +*/ + + +.spannewtab { + font-size: 0.9em; +} + +.newtabmenu ul, li{ + border:0; + margin:0; padding:0; + list-style:none; +} + +.newtabmenu li{float:left; margin-right:2px; text-align: center;} +.newtabmenu a:link, .newtabmenu a:visited{ + background:url(/snort/images/new_tab_menu.png) right 45px; + color:#ffffff; /* noactive font */ + display:block; + /* fix for IE6 */ + display: inline-block; + /* END */ + font-weight:bold; + font-size:.9em; + height:20px; + line-height:20px; + text-decoration:none; +} +.newtabmenu a span{ + background:url(/snort/images/new_tab_menu.png) left 45px; + display:block; + /* fix for IE6 */ + display: inline-block; + /* END */ + height:20px; + margin-right:7px; + padding-left:7px; +} +.newtabmenu a:hover{ + background:url(/snort/images/new_tab_menu.png) right 23px; + display:block; + /* fix for IE6 */ + display: inline-block; + /* END */ + color:#ffffff; /* hover over font */ +} +.newtabmenu a:hover span{ + background:url(/snort/images/new_tab_menu.png) left 23px; + display:block; + /* fix for IE6 */ + display: inline-block; + /* END */ +} + +/* -------------------------------- */ +/* ACTIVE ELEMENTS */ +.newtabmenu_active a:link, .newtabmenu_active a:visited, .newtabmenu_active a:visited, .newtabmenu_active a:hover{ + color:#000000; /* active font */ + background:url(/snort/images/new_tab_menu.png) right 0 no-repeat; +} +.newtabmenu_active a span, .newtabmenu_active a:hover span{ + background:url(/snort/images/new_tab_menu.png) left 0 no-repeat; +} diff --git a/config/snort-dev/css/style_snort2.css b/config/snort-dev/css/style_snort2.css new file mode 100644 index 00000000..16b2e327 --- /dev/null +++ b/config/snort-dev/css/style_snort2.css @@ -0,0 +1,571 @@ +@charset "utf-8"; + + +/* ips tab css */ + +#infotext_ips { + + vertical-align: middle; + +} + +.nextClickList { + margin-bottom: 5px; +} + +.nextClickListColorEven { + padding-top: 2px; + padding-bottom: 2px; + padding-left: 10px; + padding-right: 10px; + background-color: #ffffff; + font-size: 11px; + border-bottom-color: #999999; + border-bottom-width: 1px; + border-bottom-style: solid; + border-right-color: #999999; + border-right-width: 1px; + border-right-style: solid; +} + +.nextClickListColorOdd { + padding-top: 2px; + padding-bottom: 2px; + padding-left: 10px; + padding-right: 10px; + background-color: #eeeeee; + font-size: 11px; + border-bottom-color: #999999; + border-bottom-width: 1px; + border-bottom-style: solid; + border-right-color: #999999; + border-right-width: 1px; + border-right-style: solid; +} + + +#right { + + position: relative; + top: -10px; + left: 0px; + width: 800px; + margin-top: 0px; + margin-left: 0px; + margin-right: 5px; + padding-top: 20px; + padding-left: 0px; + padding-right: 0px; + padding-bottom: 90px; + min-height: 400px; + +} + +.odd_ruleset2 { + text-align: center; + background-color: #ffffff; + border-left: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 11px; + padding-right: 2px; + padding-left: 2px; + padding-top: 4px; + padding-bottom: 4px; +} + +.even_ruleset2 { + text-align: center; + background-color: #eeeeee; + border-left: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 11px; + padding-right: 2px; + padding-left: 2px; + padding-top: 4px; + padding-bottom: 4px; +} + +.odd_ruleset { + + background-color: #ffffff; + border-left: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 14px; + padding-right: 2px; + padding-left: 20px; + padding-top: 2px; + padding-bottom: 2px; + +} + +.even_ruleset { + + background-color: #eeeeee; + border-left: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 14px; + padding-right: 2px; + padding-left: 20px; + padding-top: 2px; + padding-bottom: 2px; + +} + +.rulesetbkg { + background-color: #eeeeee; + padding-right: 0px; + padding-left: 0px; + border-bottom: 1px solid #999999; + font-size: 15px; +} + + +.hiddendownloadlink { + visibility:hidden; +} + +#loadingWaiting, #loadingRuleEditGUI, #loadingRuleUpadteGUI{ + display:none; + position:fixed; + left:0; + top:0; + width:100%; + height:100%; + background-image:url("/snort/images/transparentbg.png"); + z-index: 9998; + color: #ffffff; +} + +.loadingWaitingMessage{ + + text-align: center; + margin-top:40px; + +} + +.snortModal { + width:500px; + height:300px; + position:absolute; + z-index:999; + background-color:#000; +} + +.snortModalTop { + width:500px; + height:25px; + background-image:url( '/snort/images/top_modal_bar_lil.jpg' ); + background-repeat:repeat-x; + margin-bottom:1px; +} + +.snortModalTitle { + text-align: center; +} + +.snortModalTopClose { + width:9px; + height:9px; + float:right; + margin-right:10px; + margin-top:8px; +} + +.snortModalUpdate { + width: 700px; + height: 200px; + z-index:999; + background-color:#000000; +} + +.snortModalTopUpdate { + width: 700px; + height: 25px; + background-image:url( '/snort/images/top_modal_bar_lil.jpg' ); + background-repeat:repeat-x; + margin-bottom:1px; +} + +.snortModalTitleUpdate { + position:absolute; + left: 50px; + width: 600px; + margin-top: 0px; + margin-bottom: 0px; +} + +.snortModalTitleUpdateMsg1 { + top: 50px; + font-weight: bold; + font-size: 24px; +} + +.snortModalTitleUpdateBar { + top: 90px; +} + +.snortModalTitleUpdateMsg2 { + top: 145px; +} + +.listhdrr2 { + background-color: #BBBBBB; + padding-right: 1px; + padding-left: 1px; + font-weight: bold; + border-right: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 11px; + padding-top: 5px; + padding-bottom: 5px; +} + +.listtopic2 { + border-bottom: 1px solid #999999; + font-size: 11px; + background-color: #eeeeee; + padding-right: 16px; + padding-left: 6px; + color: #000000; + font-weight: bold; + padding-top: 5px; + padding-bottom: 5px; +} + +.listtopic3 { + border-bottom: 1px solid #999999; + font-size: 11px; + background-color: #eeeeee; + padding-right: 6px; + padding-left: 16px; + color: #000000; + font-weight: bold; +} + +#footer2 { + background-color: transparent; + background-image: url("/snort/images/logo22.png"); + width: 720px; + height: 60px; + text-align: center; + font-size: 0.8em; +} + +.alert { + position:absolute; + top:10px; + left:-25px; + width:100%; + height:90%; + z-index:999; + background:#FCE9C0; + background-position: 15px; + border-top:2px solid #DBAC48; + border-bottom:2px solid #DBAC48; + padding: 15px 10px 85% 50px; +} + +.formpre { + font-family:arial; + font-size: 1.1em; +} + +#download_rules { + font-family: arial; + font-size: 13px; + font-weight: bold; + text-align: center; +} + +#download_rules_td { + font-family: arial; + font-size: 13px; + font-weight: bold; + text-align: center; +} + +/* hack fix the hard coded fbegin link */ +#header-left2 { + position: absolute; + background-position: center center; + height: 67px; + width: 147px; + top: -77px; + left: 8px; + float: left; + z-index:999; +} +#header-left2 #status-link2 { + position: relative; + top: 3px; + left: 2px; +} +/* end of fbegin hack */ + +.body2 { + font-family:arial; + font-size:12px; +} + +.tabcont { + background-color: #dddddd; + padding-right: 12px; + padding-left: 12px; + padding-top: 12px; + padding-bottom: 12px; +} + +.tabcont2 { + background-color: #eeeeee; + padding-right: 12px; + padding-left: 12px; + padding-top: 12px; + padding-bottom: 12px; +} + +.vncell2 { + background-color: #eeeeee; + padding-right: 5px; + padding-left: 5px; + border-bottom: 1px solid #999999; + font-size: 11px; +} + +.vncelltextbox { + background-color: #eeeeee; + padding-top: 8px; + padding-bottom: 8px; + padding-right: 8px; + padding-left: 8px; + border-bottom-width: 1px; + border-bottom-style: solid; + border-bottom-color: #999999; + font-size: 11px; +} + +/* global tab, white lil box */ +.vncell3 { + width: 50px; + background-color: #eeeeee; + padding-right: 2px; + padding-left: 2px; + border-bottom-width: 1px; + border-bottom-style: solid; + border-bottom-color: #999999; + font-size: 11px; +} + +.vncellreq2 { +background-color: #eeeeee; +padding-right: 20px; +padding-left: 8px; +font-weight: bold; +border-bottom-width: 1px; +border-bottom-style: solid; +border-bottom-color: #999999; +font-size: 11px; +} + +/* Start of main css Pfsense */ +/* Start of main css Pfsense */ + +.textstyle { + font-family: "Arial", "Helvetica", "sans-serif"; + font-size: 12px; + font-style: normal; + background-color: #666; + color: #CCC; +} +.textstyle p2 a { + font-family: Arial, Helvetica, sans-serif; + font-size: 12px; + font-style: normal; + color: #CCC; +} + +.textstyle p { + font-family: Arial, Helvetica, sans-serif; + font-size: 24px; + font-weight: bold; + color: #FFF; + text-decoration: underline; +} +.textstyle p2 { + font-family: Arial, Helvetica, sans-serif; + font-size: 12px; + color: #CCC; +} + +/* Start of main css for table sort */ +/* Start of main css for table sort */ + +table { + margin: 0; + padding: 0; + border: 0; + font-weight: inherit; + font-style: inherit; + font-family: Arial, Helvetica, sans-serif; + vertical-align: baseline; +} + +/* Tables still need 'cellspacing="0"' in the markup. */ +table { border-collapse: separate; border-spacing: 0; } +caption, th, td { text-align: left; font-weight:400; } + +/* Remove possible quote marks (") from ,
    . */ +blockquote:before, blockquote:after, q:before, q:after { content: ""; } +blockquote, q { quotes: "" ""; } + +#container { + width: auto; + margin: 0px; + padding-top: 10px; + padding-bottom: 10px; +} + + + +/************************************************************** + + Sortable Table + v 1.4 + +**************************************************************/ + + + +th { + background-color: #eee; + background: #eee url(/snort/images/icon-table-sort.png) no-repeat 2px 8px; + padding: 4px 4px 4px 14px; +} + +.allRow { + background-color: #eee; + padding: 4px; +} + +tr.altRow { + background-color: #fff; +} + +.leftAlign { + text-align: left; +} + +.centerAlign { + text-align: center; +} + +.rightAlign { + text-align: right; +} + +.sortedASC { + background: url(/snort/images/icon-table-sort-asc.png) no-repeat 2px 4px #eee; +} + +.sortedDESC { + background: url(/snort/images/icon-table-sort-desc.png) no-repeat 2px 10px #eee; +} + +.tableHeaderOver { + cursor: pointer; + color: #354158; +} + + +tr.selected { + background-color: #9999ff; + color: #000000; +} + +tr.over { + background-color: #993333; + color: #fff; + cursor: pointer; +} + +tr.hide { + display: none; +} +/***************************/ + +.mainTableFilter { + position: absolute; + top: 0; + left: -10px; + width: auto; +} + +.tableFilter { + border: 1px solid #ccc; + padding: 2px; + margin: 5px 0 10px 0; +} + +.tableFilter input { + border: 1px solid #ccc; +} + +.tableFilter select { + border: 1px solid #ccc; +} + +.listbg2 { + border-right: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 11px; + background-color: #090; + color: #000; + padding-right: 16px; + padding-left: 6px; + padding-top: 4px; + padding-bottom: 4px; +} + +.listbg3 { + border-right: 1px solid #999999; + border-bottom: 1px solid #999999; + font-size: 11px; + background-color: #777777; + color: #000; + padding-right: 16px; + padding-left: 6px; + padding-top: 4px; + padding-bottom: 4px; +} + +#tdbggrey { + +background-color: #ddd; + +} + +.formfld2 +{ +padding-left: 8px; +font-size: small; +} + +/*********Input Highlight*****************/ + +.formfld2 { + outline:none; + transition: all 0.25s ease-in-out; + -webkit-transition: all 0.25s ease-in-out; + -moz-transition: all 0.25s ease-in-out; + border-radius:1px; + -webkit-border-radius:1px; + -moz-border-radius:1px; + border:1px solid rgba(0,0,0, 0.2); +} + +.formfld2:focus { + box-shadow: 0 0 2px rgba(156, 156, 156, 1); + -webkit-box-shadow: 0 0 2px rgba(156, 156, 156, 1); + -moz-box-shadow: 0 0 2px rgba(156, 156, 156, 1); + border:1px solid rgba(156,156,156, 0.8); +} + diff --git a/config/snort-dev/images/alert.jpg b/config/snort-dev/images/alert.jpg new file mode 100644 index 00000000..96c24e35 Binary files /dev/null and b/config/snort-dev/images/alert.jpg differ diff --git a/config/snort-dev/images/arrow_down.png b/config/snort-dev/images/arrow_down.png new file mode 100644 index 00000000..2c4e2793 Binary files /dev/null and b/config/snort-dev/images/arrow_down.png differ diff --git a/config/snort-dev/images/awesome-overlay-sprite.png b/config/snort-dev/images/awesome-overlay-sprite.png new file mode 100644 index 00000000..c3af7dd9 Binary files /dev/null and b/config/snort-dev/images/awesome-overlay-sprite.png differ diff --git a/config/snort-dev/images/close_9x9.gif b/config/snort-dev/images/close_9x9.gif new file mode 100644 index 00000000..326f5fa5 Binary files /dev/null and b/config/snort-dev/images/close_9x9.gif differ diff --git a/config/snort-dev/images/controls.png b/config/snort-dev/images/controls.png new file mode 100644 index 00000000..e1e97982 Binary files /dev/null and b/config/snort-dev/images/controls.png differ diff --git a/config/snort-dev/images/down.gif b/config/snort-dev/images/down.gif new file mode 100644 index 00000000..2b3c99fc Binary files /dev/null and b/config/snort-dev/images/down.gif differ diff --git a/config/snort-dev/images/down2.gif b/config/snort-dev/images/down2.gif new file mode 100644 index 00000000..71bf92eb Binary files /dev/null and b/config/snort-dev/images/down2.gif differ diff --git a/config/snort-dev/images/footer.jpg b/config/snort-dev/images/footer.jpg new file mode 100644 index 00000000..4af05707 Binary files /dev/null and b/config/snort-dev/images/footer.jpg differ diff --git a/config/snort-dev/images/footer2.jpg b/config/snort-dev/images/footer2.jpg new file mode 100644 index 00000000..3332e085 Binary files /dev/null and b/config/snort-dev/images/footer2.jpg differ diff --git a/config/snort-dev/images/icon-table-sort-asc.png b/config/snort-dev/images/icon-table-sort-asc.png new file mode 100644 index 00000000..0c127919 Binary files /dev/null and b/config/snort-dev/images/icon-table-sort-asc.png differ diff --git a/config/snort-dev/images/icon-table-sort-desc.png b/config/snort-dev/images/icon-table-sort-desc.png new file mode 100644 index 00000000..5c52f2d0 Binary files /dev/null and b/config/snort-dev/images/icon-table-sort-desc.png differ diff --git a/config/snort-dev/images/icon-table-sort.png b/config/snort-dev/images/icon-table-sort.png new file mode 100644 index 00000000..3cae604b Binary files /dev/null and b/config/snort-dev/images/icon-table-sort.png differ diff --git a/config/snort-dev/images/icon_excli.png b/config/snort-dev/images/icon_excli.png new file mode 100644 index 00000000..4b54fa31 Binary files /dev/null and b/config/snort-dev/images/icon_excli.png differ diff --git a/config/snort-dev/images/loading.gif b/config/snort-dev/images/loading.gif new file mode 100644 index 00000000..cbc00f09 Binary files /dev/null and b/config/snort-dev/images/loading.gif differ diff --git a/config/snort-dev/images/logo.jpg b/config/snort-dev/images/logo.jpg new file mode 100644 index 00000000..fa01d818 Binary files /dev/null and b/config/snort-dev/images/logo.jpg differ diff --git a/config/snort-dev/images/logo22.png b/config/snort-dev/images/logo22.png new file mode 100644 index 00000000..64ed9d75 Binary files /dev/null and b/config/snort-dev/images/logo22.png differ diff --git a/config/snort-dev/images/new_tab_menu.png b/config/snort-dev/images/new_tab_menu.png new file mode 100644 index 00000000..f0e4cbeb Binary files /dev/null and b/config/snort-dev/images/new_tab_menu.png differ diff --git a/config/snort-dev/images/page_white_text.png b/config/snort-dev/images/page_white_text.png new file mode 100644 index 00000000..813f712f Binary files /dev/null and b/config/snort-dev/images/page_white_text.png differ diff --git a/config/snort-dev/images/progress_bar2.gif b/config/snort-dev/images/progress_bar2.gif new file mode 100644 index 00000000..81766a93 Binary files /dev/null and b/config/snort-dev/images/progress_bar2.gif differ diff --git a/config/snort-dev/images/progressbar.gif b/config/snort-dev/images/progressbar.gif new file mode 100644 index 00000000..6d167f5b Binary files /dev/null and b/config/snort-dev/images/progressbar.gif differ diff --git a/config/snort-dev/images/top_modal_bar_lil.jpg b/config/snort-dev/images/top_modal_bar_lil.jpg new file mode 100644 index 00000000..f0049de8 Binary files /dev/null and b/config/snort-dev/images/top_modal_bar_lil.jpg differ diff --git a/config/snort-dev/images/transparent.gif b/config/snort-dev/images/transparent.gif new file mode 100644 index 00000000..e7ccd741 Binary files /dev/null and b/config/snort-dev/images/transparent.gif differ diff --git a/config/snort-dev/images/transparentbg.png b/config/snort-dev/images/transparentbg.png new file mode 100644 index 00000000..86918930 Binary files /dev/null and b/config/snort-dev/images/transparentbg.png differ diff --git a/config/snort-dev/images/up.gif b/config/snort-dev/images/up.gif new file mode 100644 index 00000000..89596771 Binary files /dev/null and b/config/snort-dev/images/up.gif differ diff --git a/config/snort-dev/images/up2.gif b/config/snort-dev/images/up2.gif new file mode 100644 index 00000000..21c5a254 Binary files /dev/null and b/config/snort-dev/images/up2.gif differ diff --git a/config/snort-dev/javascript/jquery-1.6.2.min.js b/config/snort-dev/javascript/jquery-1.6.2.min.js new file mode 100644 index 00000000..48590ecb --- /dev/null +++ b/config/snort-dev/javascript/jquery-1.6.2.min.js @@ -0,0 +1,18 @@ +/*! + * jQuery JavaScript Library v1.6.2 + * http://jquery.com/ + * + * Copyright 2011, John Resig + * Dual licensed under the MIT or GPL Version 2 licenses. + * http://jquery.org/license + * + * Includes Sizzle.js + * http://sizzlejs.com/ + * Copyright 2011, The Dojo Foundation + * Released under the MIT, BSD, and GPL Licenses. + * + * Date: Thu Jun 30 14:16:56 2011 -0400 + */ +(function(a,b){function cv(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cs(a){if(!cg[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){ch||(ch=c.createElement("iframe"),ch.frameBorder=ch.width=ch.height=0),b.appendChild(ch);if(!ci||!ch.createElement)ci=(ch.contentWindow||ch.contentDocument).document,ci.write((c.compatMode==="CSS1Compat"?"":"")+""),ci.close();d=ci.createElement(a),ci.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ch)}cg[a]=e}return cg[a]}function cr(a,b){var c={};f.each(cm.concat.apply([],cm.slice(0,b)),function(){c[this]=a});return c}function cq(){cn=b}function cp(){setTimeout(cq,0);return cn=f.now()}function cf(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ce(){try{return new a.XMLHttpRequest}catch(b){}}function b$(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g0){c!=="border"&&f.each(e,function(){c||(d-=parseFloat(f.css(a,"padding"+this))||0),c==="margin"?d+=parseFloat(f.css(a,c+this))||0:d-=parseFloat(f.css(a,"border"+this+"Width"))||0});return d+"px"}d=bx(a,b,b);if(d<0||d==null)d=a.style[b]||0;d=parseFloat(d)||0,c&&f.each(e,function(){d+=parseFloat(f.css(a,"padding"+this))||0,c!=="padding"&&(d+=parseFloat(f.css(a,"border"+this+"Width"))||0),c==="margin"&&(d+=parseFloat(f.css(a,c+this))||0)});return d+"px"}function bm(a,b){b.src?f.ajax({url:b.src,async:!1,dataType:"script"}):f.globalEval((b.text||b.textContent||b.innerHTML||"").replace(be,"/*$0*/")),b.parentNode&&b.parentNode.removeChild(b)}function bl(a){f.nodeName(a,"input")?bk(a):"getElementsByTagName"in a&&f.grep(a.getElementsByTagName("input"),bk)}function bk(a){if(a.type==="checkbox"||a.type==="radio")a.defaultChecked=a.checked}function bj(a){return"getElementsByTagName"in a?a.getElementsByTagName("*"):"querySelectorAll"in a?a.querySelectorAll("*"):[]}function bi(a,b){var c;if(b.nodeType===1){b.clearAttributes&&b.clearAttributes(),b.mergeAttributes&&b.mergeAttributes(a),c=b.nodeName.toLowerCase();if(c==="object")b.outerHTML=a.outerHTML;else if(c!=="input"||a.type!=="checkbox"&&a.type!=="radio"){if(c==="option")b.selected=a.defaultSelected;else if(c==="input"||c==="textarea")b.defaultValue=a.defaultValue}else a.checked&&(b.defaultChecked=b.checked=a.checked),b.value!==a.value&&(b.value=a.value);b.removeAttribute(f.expando)}}function bh(a,b){if(b.nodeType===1&&!!f.hasData(a)){var c=f.expando,d=f.data(a),e=f.data(b,d);if(d=d[c]){var g=d.events;e=e[c]=f.extend({},d);if(g){delete e.handle,e.events={};for(var h in g)for(var i=0,j=g[h].length;i=0===c})}function V(a){return!a||!a.parentNode||a.parentNode.nodeType===11}function N(a,b){return(a&&a!=="*"?a+".":"")+b.replace(z,"`").replace(A,"&")}function M(a){var b,c,d,e,g,h,i,j,k,l,m,n,o,p=[],q=[],r=f._data(this,"events");if(!(a.liveFired===this||!r||!r.live||a.target.disabled||a.button&&a.type==="click")){a.namespace&&(n=new RegExp("(^|\\.)"+a.namespace.split(".").join("\\.(?:.*\\.)?")+"(\\.|$)")),a.liveFired=this;var s=r.live.slice(0);for(i=0;ic)break;a.currentTarget=e.elem,a.data=e.handleObj.data,a.handleObj=e.handleObj,o=e.handleObj.origHandler.apply(e.elem,arguments);if(o===!1||a.isPropagationStopped()){c=e.level,o===!1&&(b=!1);if(a.isImmediatePropagationStopped())break}}return b}}function K(a,c,d){var e=f.extend({},d[0]);e.type=a,e.originalEvent={},e.liveFired=b,f.event.handle.call(c,e),e.isDefaultPrevented()&&d[0].preventDefault()}function E(){return!0}function D(){return!1}function m(a,c,d){var e=c+"defer",g=c+"queue",h=c+"mark",i=f.data(a,e,b,!0);i&&(d==="queue"||!f.data(a,g,b,!0))&&(d==="mark"||!f.data(a,h,b,!0))&&setTimeout(function(){!f.data(a,g,b,!0)&&!f.data(a,h,b,!0)&&(f.removeData(a,e,!0),i.resolve())},0)}function l(a){for(var b in a)if(b!=="toJSON")return!1;return!0}function k(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(j,"$1-$2").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:f.isNaN(d)?i.test(d)?f.parseJSON(d):d:parseFloat(d)}catch(g){}f.data(a,c,d)}else d=b}return d}var c=a.document,d=a.navigator,e=a.location,f=function(){function J(){if(!e.isReady){try{c.documentElement.doScroll("left")}catch(a){setTimeout(J,1);return}e.ready()}}var e=function(a,b){return new e.fn.init(a,b,h)},f=a.jQuery,g=a.$,h,i=/^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,j=/\S/,k=/^\s+/,l=/\s+$/,m=/\d/,n=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,o=/^[\],:{}\s]*$/,p=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,q=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,r=/(?:^|:|,)(?:\s*\[)+/g,s=/(webkit)[ \/]([\w.]+)/,t=/(opera)(?:.*version)?[ \/]([\w.]+)/,u=/(msie) ([\w.]+)/,v=/(mozilla)(?:.*? rv:([\w.]+))?/,w=/-([a-z])/ig,x=function(a,b){return b.toUpperCase()},y=d.userAgent,z,A,B,C=Object.prototype.toString,D=Object.prototype.hasOwnProperty,E=Array.prototype.push,F=Array.prototype.slice,G=String.prototype.trim,H=Array.prototype.indexOf,I={};e.fn=e.prototype={constructor:e,init:function(a,d,f){var g,h,j,k;if(!a)return this;if(a.nodeType){this.context=this[0]=a,this.length=1;return this}if(a==="body"&&!d&&c.body){this.context=c,this[0]=c.body,this.selector=a,this.length=1;return this}if(typeof a=="string"){a.charAt(0)!=="<"||a.charAt(a.length-1)!==">"||a.length<3?g=i.exec(a):g=[null,a,null];if(g&&(g[1]||!d)){if(g[1]){d=d instanceof e?d[0]:d,k=d?d.ownerDocument||d:c,j=n.exec(a),j?e.isPlainObject(d)?(a=[c.createElement(j[1])],e.fn.attr.call(a,d,!0)):a=[k.createElement(j[1])]:(j=e.buildFragment([g[1]],[k]),a=(j.cacheable?e.clone(j.fragment):j.fragment).childNodes);return e.merge(this,a)}h=c.getElementById(g[2]);if(h&&h.parentNode){if(h.id!==g[2])return f.find(a);this.length=1,this[0]=h}this.context=c,this.selector=a;return this}return!d||d.jquery?(d||f).find(a):this.constructor(d).find(a)}if(e.isFunction(a))return f.ready(a);a.selector!==b&&(this.selector=a.selector,this.context=a.context);return e.makeArray(a,this)},selector:"",jquery:"1.6.2",length:0,size:function(){return this.length},toArray:function(){return F.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this[this.length+a]:this[a]},pushStack:function(a,b,c){var d=this.constructor();e.isArray(a)?E.apply(d,a):e.merge(d,a),d.prevObject=this,d.context=this.context,b==="find"?d.selector=this.selector+(this.selector?" ":"")+c:b&&(d.selector=this.selector+"."+b+"("+c+")");return d},each:function(a,b){return e.each(this,a,b)},ready:function(a){e.bindReady(),A.done(a);return this},eq:function(a){return a===-1?this.slice(a):this.slice(a,+a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(F.apply(this,arguments),"slice",F.call(arguments).join(","))},map:function(a){return this.pushStack(e.map(this,function(b,c){return a.call(b,c,b)}))},end:function(){return this.prevObject||this.constructor(null)},push:E,sort:[].sort,splice:[].splice},e.fn.init.prototype=e.fn,e.extend=e.fn.extend=function(){var a,c,d,f,g,h,i=arguments[0]||{},j=1,k=arguments.length,l=!1;typeof i=="boolean"&&(l=i,i=arguments[1]||{},j=2),typeof i!="object"&&!e.isFunction(i)&&(i={}),k===j&&(i=this,--j);for(;j0)return;A.resolveWith(c,[e]),e.fn.trigger&&e(c).trigger("ready").unbind("ready")}},bindReady:function(){if(!A){A=e._Deferred();if(c.readyState==="complete")return setTimeout(e.ready,1);if(c.addEventListener)c.addEventListener("DOMContentLoaded",B,!1),a.addEventListener("load",e.ready,!1);else if(c.attachEvent){c.attachEvent("onreadystatechange",B),a.attachEvent("onload",e.ready);var b=!1;try{b=a.frameElement==null}catch(d){}c.documentElement.doScroll&&b&&J()}}},isFunction:function(a){return e.type(a)==="function"},isArray:Array.isArray||function(a){return e.type(a)==="array"},isWindow:function(a){return a&&typeof a=="object"&&"setInterval"in a},isNaN:function(a){return a==null||!m.test(a)||isNaN(a)},type:function(a){return a==null?String(a):I[C.call(a)]||"object"},isPlainObject:function(a){if(!a||e.type(a)!=="object"||a.nodeType||e.isWindow(a))return!1;if(a.constructor&&!D.call(a,"constructor")&&!D.call(a.constructor.prototype,"isPrototypeOf"))return!1;var c;for(c in a);return c===b||D.call(a,c)},isEmptyObject:function(a){for(var b in a)return!1;return!0},error:function(a){throw a},parseJSON:function(b){if(typeof b!="string"||!b)return null;b=e.trim(b);if(a.JSON&&a.JSON.parse)return a.JSON.parse(b);if(o.test(b.replace(p,"@").replace(q,"]").replace(r,"")))return(new Function("return "+b))();e.error("Invalid JSON: "+b)},parseXML:function(b,c,d){a.DOMParser?(d=new DOMParser,c=d.parseFromString(b,"text/xml")):(c=new ActiveXObject("Microsoft.XMLDOM"),c.async="false",c.loadXML(b)),d=c.documentElement,(!d||!d.nodeName||d.nodeName==="parsererror")&&e.error("Invalid XML: "+b);return c},noop:function(){},globalEval:function(b){b&&j.test(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(w,x)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,c,d){var f,g=0,h=a.length,i=h===b||e.isFunction(a);if(d){if(i){for(f in a)if(c.apply(a[f],d)===!1)break}else for(;g0&&a[0]&&a[j-1]||j===0||e.isArray(a));if(k)for(;i1?h.call(arguments,0):c,--e||g.resolveWith(g,h.call(b,0))}}var b=arguments,c=0,d=b.length,e=d,g=d<=1&&a&&f.isFunction(a.promise)?a:f.Deferred();if(d>1){for(;c
    a",d=a.getElementsByTagName("*"),e=a.getElementsByTagName("a")[0];if(!d||!d.length||!e)return{};g=c.createElement("select"),h=g.appendChild(c.createElement("option")),i=a.getElementsByTagName("input")[0],k={leadingWhitespace:a.firstChild.nodeType===3,tbody:!a.getElementsByTagName("tbody").length,htmlSerialize:!!a.getElementsByTagName("link").length,style:/top/.test(e.getAttribute("style")),hrefNormalized:e.getAttribute("href")==="/a",opacity:/^0.55$/.test(e.style.opacity),cssFloat:!!e.style.cssFloat,checkOn:i.value==="on",optSelected:h.selected,getSetAttribute:a.className!=="t",submitBubbles:!0,changeBubbles:!0,focusinBubbles:!1,deleteExpando:!0,noCloneEvent:!0,inlineBlockNeedsLayout:!1,shrinkWrapBlocks:!1,reliableMarginRight:!0},i.checked=!0,k.noCloneChecked=i.cloneNode(!0).checked,g.disabled=!0,k.optDisabled=!h.disabled;try{delete a.test}catch(v){k.deleteExpando=!1}!a.addEventListener&&a.attachEvent&&a.fireEvent&&(a.attachEvent("onclick",function(){k.noCloneEvent=!1}),a.cloneNode(!0).fireEvent("onclick")),i=c.createElement("input"),i.value="t",i.setAttribute("type","radio"),k.radioValue=i.value==="t",i.setAttribute("checked","checked"),a.appendChild(i),l=c.createDocumentFragment(),l.appendChild(a.firstChild),k.checkClone=l.cloneNode(!0).cloneNode(!0).lastChild.checked,a.innerHTML="",a.style.width=a.style.paddingLeft="1px",m=c.getElementsByTagName("body")[0],o=c.createElement(m?"div":"body"),p={visibility:"hidden",width:0,height:0,border:0,margin:0},m&&f.extend(p,{position:"absolute",left:-1e3,top:-1e3});for(t in p)o.style[t]=p[t];o.appendChild(a),n=m||b,n.insertBefore(o,n.firstChild),k.appendChecked=i.checked,k.boxModel=a.offsetWidth===2,"zoom"in a.style&&(a.style.display="inline",a.style.zoom=1,k.inlineBlockNeedsLayout=a.offsetWidth===2,a.style.display="",a.innerHTML="
    ",k.shrinkWrapBlocks=a.offsetWidth!==2),a.innerHTML="
    t
    ",q=a.getElementsByTagName("td"),u=q[0].offsetHeight===0,q[0].style.display="",q[1].style.display="none",k.reliableHiddenOffsets=u&&q[0].offsetHeight===0,a.innerHTML="",c.defaultView&&c.defaultView.getComputedStyle&&(j=c.createElement("div"),j.style.width="0",j.style.marginRight="0",a.appendChild(j),k.reliableMarginRight=(parseInt((c.defaultView.getComputedStyle(j,null)||{marginRight:0}).marginRight,10)||0)===0),o.innerHTML="",n.removeChild(o);if(a.attachEvent)for(t in{submit:1,change:1,focusin:1})s="on"+t,u=s in a,u||(a.setAttribute(s,"return;"),u=typeof a[s]=="function"),k[t+"Bubbles"]=u;o=l=g=h=m=j=a=i=null;return k}(),f.boxModel=f.support.boxModel;var i=/^(?:\{.*\}|\[.*\])$/,j=/([a-z])([A-Z])/g;f.extend({cache:{},uuid:0,expando:"jQuery"+(f.fn.jquery+Math.random()).replace(/\D/g,""),noData:{embed:!0,object:"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000",applet:!0},hasData:function(a){a=a.nodeType?f.cache[a[f.expando]]:a[f.expando];return!!a&&!l(a)},data:function(a,c,d,e){if(!!f.acceptData(a)){var g=f.expando,h=typeof c=="string",i,j=a.nodeType,k=j?f.cache:a,l=j?a[f.expando]:a[f.expando]&&f.expando;if((!l||e&&l&&!k[l][g])&&h&&d===b)return;l||(j?a[f.expando]=l=++f.uuid:l=f.expando),k[l]||(k[l]={},j||(k[l].toJSON=f.noop));if(typeof c=="object"||typeof c=="function")e?k[l][g]=f.extend(k[l][g],c):k[l]=f.extend(k[l],c);i=k[l],e&&(i[g]||(i[g]={}),i=i[g]),d!==b&&(i[f.camelCase(c)]=d);if(c==="events"&&!i[c])return i[g]&&i[g].events;return h?i[f.camelCase(c)]||i[c]:i}},removeData:function(b,c,d){if(!!f.acceptData(b)){var e=f.expando,g=b.nodeType,h=g?f.cache:b,i=g?b[f.expando]:f.expando;if(!h[i])return;if(c){var j=d?h[i][e]:h[i];if(j){delete j[c];if(!l(j))return}}if(d){delete h[i][e];if(!l(h[i]))return}var k=h[i][e];f.support.deleteExpando||h!=a?delete h[i]:h[i]=null,k?(h[i]={},g||(h[i].toJSON=f.noop),h[i][e]=k):g&&(f.support.deleteExpando?delete b[f.expando]:b.removeAttribute?b.removeAttribute(f.expando):b[f.expando]=null)}},_data:function(a,b,c){return f.data(a,b,c,!0)},acceptData:function(a){if(a.nodeName){var b=f.noData[a.nodeName.toLowerCase()];if(b)return b!==!0&&a.getAttribute("classid")===b}return!0}}),f.fn.extend({data:function(a,c){var d=null;if(typeof a=="undefined"){if(this.length){d=f.data(this[0]);if(this[0].nodeType===1){var e=this[0].attributes,g;for(var h=0,i=e.length;h-1)return!0;return!1},val:function(a){var c,d,e=this[0];if(!arguments.length){if(e){c=f.valHooks[e.nodeName.toLowerCase()]||f.valHooks[e.type];if(c&&"get"in c&&(d=c.get(e,"value"))!==b)return d;d=e.value;return typeof d=="string"?d.replace(p,""):d==null?"":d}return b}var g=f.isFunction(a);return this.each(function(d){var e=f(this),h;if(this.nodeType===1){g?h=a.call(this,d,e.val()):h=a,h==null?h="":typeof h=="number"?h+="":f.isArray(h)&&(h=f.map(h,function(a){return a==null?"":a+""})),c=f.valHooks[this.nodeName.toLowerCase()]||f.valHooks[this.type];if(!c||!("set"in c)||c.set(this,h,"value")===b)this.value=h}})}}),f.extend({valHooks:{option:{get:function(a){var b=a.attributes.value;return!b||b.specified?a.value:a.text}},select:{get:function(a){var b,c=a.selectedIndex,d=[],e=a.options,g=a.type==="select-one";if(c<0)return null;for(var h=g?c:0,i=g?c+1:e.length;h=0}),c.length||(a.selectedIndex=-1);return c}}},attrFn:{val:!0,css:!0,html:!0,text:!0,data:!0,width:!0,height:!0,offset:!0},attrFix:{tabindex:"tabIndex"},attr:function(a,c,d,e){var g=a.nodeType;if(!a||g===3||g===8||g===2)return b;if(e&&c in f.attrFn)return f(a)[c](d);if(!("getAttribute"in a))return f.prop(a,c,d);var h,i,j=g!==1||!f.isXMLDoc(a);j&&(c=f.attrFix[c]||c,i=f.attrHooks[c],i||(t.test(c)?i=w:v&&c!=="className"&&(f.nodeName(a,"form")||u.test(c))&&(i=v)));if(d!==b){if(d===null){f.removeAttr(a,c);return b}if(i&&"set"in i&&j&&(h=i.set(a,d,c))!==b)return h;a.setAttribute(c,""+d);return d}if(i&&"get"in i&&j&&(h=i.get(a,c))!==null)return h;h=a.getAttribute(c);return h===null?b:h},removeAttr:function(a,b){var c;a.nodeType===1&&(b=f.attrFix[b]||b,f.support.getSetAttribute?a.removeAttribute(b):(f.attr(a,b,""),a.removeAttributeNode(a.getAttributeNode(b))),t.test(b)&&(c=f.propFix[b]||b)in a&&(a[c]=!1))},attrHooks:{type:{set:function(a,b){if(q.test(a.nodeName)&&a.parentNode)f.error("type property can't be changed");else if(!f.support.radioValue&&b==="radio"&&f.nodeName(a,"input")){var c=a.value;a.setAttribute("type",b),c&&(a.value=c);return b}}},tabIndex:{get:function(a){var c=a.getAttributeNode("tabIndex");return c&&c.specified?parseInt(c.value,10):r.test(a.nodeName)||s.test(a.nodeName)&&a.href?0:b}},value:{get:function(a,b){if(v&&f.nodeName(a,"button"))return v.get(a,b);return b in a?a.value:null},set:function(a,b,c){if(v&&f.nodeName(a,"button"))return v.set(a,b,c);a.value=b}}},propFix:{tabindex:"tabIndex",readonly:"readOnly","for":"htmlFor","class":"className",maxlength:"maxLength",cellspacing:"cellSpacing",cellpadding:"cellPadding",rowspan:"rowSpan",colspan:"colSpan",usemap:"useMap",frameborder:"frameBorder",contenteditable:"contentEditable"},prop:function(a,c,d){var e=a.nodeType;if(!a||e===3||e===8||e===2)return b;var g,h,i=e!==1||!f.isXMLDoc(a);i&&(c=f.propFix[c]||c,h=f.propHooks[c]);return d!==b?h&&"set"in h&&(g=h.set(a,d,c))!==b?g:a[c]=d:h&&"get"in h&&(g=h.get(a,c))!==b?g:a[c]},propHooks:{}}),w={get:function(a,c){return f.prop(a,c)?c.toLowerCase():b},set:function(a,b,c){var d;b===!1?f.removeAttr(a,c):(d=f.propFix[c]||c,d in a&&(a[d]=!0),a.setAttribute(c,c.toLowerCase()));return c}},f.support.getSetAttribute||(f.attrFix=f.propFix,v=f.attrHooks.name=f.attrHooks.title=f.valHooks.button={get:function(a,c){var d;d=a.getAttributeNode(c);return d&&d.nodeValue!==""?d.nodeValue:b},set:function(a,b,c){var d=a.getAttributeNode(c);if(d){d.nodeValue=b;return b}}},f.each(["width","height"],function(a,b){f.attrHooks[b]=f.extend(f.attrHooks[b],{set:function(a,c){if(c===""){a.setAttribute(b,"auto");return c}}})})),f.support.hrefNormalized||f.each(["href","src","width","height"],function(a,c){f.attrHooks[c]=f.extend(f.attrHooks[c],{get:function(a){var d=a.getAttribute(c,2);return d===null?b:d}})}),f.support.style||(f.attrHooks.style={get:function(a){return a.style.cssText.toLowerCase()||b},set:function(a,b){return a.style.cssText=""+b}}),f.support.optSelected||(f.propHooks.selected=f.extend(f.propHooks.selected,{get:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}})),f.support.checkOn||f.each(["radio","checkbox"],function(){f.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}),f.each(["radio","checkbox"],function(){f.valHooks[this]=f.extend(f.valHooks[this],{set:function(a,b){if(f.isArray(b))return a.checked=f.inArray(f(a).val(),b)>=0}})});var x=/\.(.*)$/,y=/^(?:textarea|input|select)$/i,z=/\./g,A=/ /g,B=/[^\w\s.|`]/g,C=function(a){return a.replace(B,"\\$&")};f.event={add:function(a,c,d,e){if(a.nodeType!==3&&a.nodeType!==8){if(d===!1)d=D;else if(!d)return;var g,h;d.handler&&(g=d,d=g.handler),d.guid||(d.guid=f.guid++);var i=f._data(a);if(!i)return;var j=i.events,k=i.handle;j||(i.events=j={}),k||(i.handle=k=function(a){return typeof f!="undefined"&&(!a||f.event.triggered!==a.type)?f.event.handle.apply(k.elem,arguments):b}),k.elem=a,c=c.split(" ");var l,m=0,n;while(l=c[m++]){h=g?f.extend({},g):{handler:d,data:e},l.indexOf(".")>-1?(n=l.split("."),l=n.shift(),h.namespace=n.slice(0).sort().join(".")):(n=[],h.namespace=""),h.type=l,h.guid||(h.guid=d.guid);var o=j[l],p=f.event.special[l]||{};if(!o){o=j[l]=[];if(!p.setup||p.setup.call(a,e,n,k)===!1)a.addEventListener?a.addEventListener(l,k,!1):a.attachEvent&&a.attachEvent("on"+l,k)}p.add&&(p.add.call(a,h),h.handler.guid||(h.handler.guid=d.guid)),o.push(h),f.event.global[l]=!0}a=null}},global:{},remove:function(a,c,d,e){if(a.nodeType!==3&&a.nodeType!==8){d===!1&&(d=D);var g,h,i,j,k=0,l,m,n,o,p,q,r,s=f.hasData(a)&&f._data(a),t=s&&s.events;if(!s||!t)return;c&&c.type&&(d=c.handler,c=c.type);if(!c||typeof c=="string"&&c.charAt(0)==="."){c=c||"";for(h in t)f.event.remove(a,h+c);return}c=c.split(" ");while(h=c[k++]){r=h,q=null,l=h.indexOf(".")<0,m=[],l||(m=h.split("."),h=m.shift(),n=new RegExp("(^|\\.)"+f.map(m.slice(0).sort(),C).join("\\.(?:.*\\.)?")+"(\\.|$)")),p=t[h];if(!p)continue;if(!d){for(j=0;j=0&&(h=h.slice(0,-1),j=!0),h.indexOf(".")>=0&&(i=h.split("."),h=i. +shift(),i.sort());if(!!e&&!f.event.customEvent[h]||!!f.event.global[h]){c=typeof c=="object"?c[f.expando]?c:new f.Event(h,c):new f.Event(h),c.type=h,c.exclusive=j,c.namespace=i.join("."),c.namespace_re=new RegExp("(^|\\.)"+i.join("\\.(?:.*\\.)?")+"(\\.|$)");if(g||!e)c.preventDefault(),c.stopPropagation();if(!e){f.each(f.cache,function(){var a=f.expando,b=this[a];b&&b.events&&b.events[h]&&f.event.trigger(c,d,b.handle.elem)});return}if(e.nodeType===3||e.nodeType===8)return;c.result=b,c.target=e,d=d!=null?f.makeArray(d):[],d.unshift(c);var k=e,l=h.indexOf(":")<0?"on"+h:"";do{var m=f._data(k,"handle");c.currentTarget=k,m&&m.apply(k,d),l&&f.acceptData(k)&&k[l]&&k[l].apply(k,d)===!1&&(c.result=!1,c.preventDefault()),k=k.parentNode||k.ownerDocument||k===c.target.ownerDocument&&a}while(k&&!c.isPropagationStopped());if(!c.isDefaultPrevented()){var n,o=f.event.special[h]||{};if((!o._default||o._default.call(e.ownerDocument,c)===!1)&&(h!=="click"||!f.nodeName(e,"a"))&&f.acceptData(e)){try{l&&e[h]&&(n=e[l],n&&(e[l]=null),f.event.triggered=h,e[h]())}catch(p){}n&&(e[l]=n),f.event.triggered=b}}return c.result}},handle:function(c){c=f.event.fix(c||a.event);var d=((f._data(this,"events")||{})[c.type]||[]).slice(0),e=!c.exclusive&&!c.namespace,g=Array.prototype.slice.call(arguments,0);g[0]=c,c.currentTarget=this;for(var h=0,i=d.length;h-1?f.map(a.options,function(a){return a.selected}).join("-"):"":f.nodeName(a,"select")&&(c=a.selectedIndex);return c},J=function(c){var d=c.target,e,g;if(!!y.test(d.nodeName)&&!d.readOnly){e=f._data(d,"_change_data"),g=I(d),(c.type!=="focusout"||d.type!=="radio")&&f._data(d,"_change_data",g);if(e===b||g===e)return;if(e!=null||g)c.type="change",c.liveFired=b,f.event.trigger(c,arguments[1],d)}};f.event.special.change={filters:{focusout:J,beforedeactivate:J,click:function(a){var b=a.target,c=f.nodeName(b,"input")?b.type:"";(c==="radio"||c==="checkbox"||f.nodeName(b,"select"))&&J.call(this,a)},keydown:function(a){var b=a.target,c=f.nodeName(b,"input")?b.type:"";(a.keyCode===13&&!f.nodeName(b,"textarea")||a.keyCode===32&&(c==="checkbox"||c==="radio")||c==="select-multiple")&&J.call(this,a)},beforeactivate:function(a){var b=a.target;f._data(b,"_change_data",I(b))}},setup:function(a,b){if(this.type==="file")return!1;for(var c in H)f.event.add(this,c+".specialChange",H[c]);return y.test(this.nodeName)},teardown:function(a){f.event.remove(this,".specialChange");return y.test(this.nodeName)}},H=f.event.special.change.filters,H.focus=H.beforeactivate}f.support.focusinBubbles||f.each({focus:"focusin",blur:"focusout"},function(a,b){function e(a){var c=f.event.fix(a);c.type=b,c.originalEvent={},f.event.trigger(c,null,c.target),c.isDefaultPrevented()&&a.preventDefault()}var d=0;f.event.special[b]={setup:function(){d++===0&&c.addEventListener(a,e,!0)},teardown:function(){--d===0&&c.removeEventListener(a,e,!0)}}}),f.each(["bind","one"],function(a,c){f.fn[c]=function(a,d,e){var g;if(typeof a=="object"){for(var h in a)this[c](h,d,a[h],e);return this}if(arguments.length===2||d===!1)e=d,d=b;c==="one"?(g=function(a){f(this).unbind(a,g);return e.apply(this,arguments)},g.guid=e.guid||f.guid++):g=e;if(a==="unload"&&c!=="one")this.one(a,d,e);else for(var i=0,j=this.length;i0?this.bind(b,a,c):this.trigger(b)},f.attrFn&&(f.attrFn[b]=!0)}),function(){function u(a,b,c,d,e,f){for(var g=0,h=d.length;g0){j=i;break}}i=i[a]}d[g]=j}}}function t(a,b,c,d,e,f){for(var g=0,h=d.length;g+~,(\[\\]+)+|[>+~])(\s*,\s*)?((?:.|\r|\n)*)/g,d=0,e=Object.prototype.toString,g=!1,h=!0,i=/\\/g,j=/\W/;[0,0].sort(function(){h=!1;return 0});var k=function(b,d,f,g){f=f||[],d=d||c;var h=d;if(d.nodeType!==1&&d.nodeType!==9)return[];if(!b||typeof b!="string")return f;var i,j,n,o,q,r,s,t,u=!0,w=k.isXML(d),x=[],y=b;do{a.exec(""),i=a.exec(y);if(i){y=i[3],x.push(i[1]);if(i[2]){o=i[3];break}}}while(i);if(x.length>1&&m.exec(b))if(x.length===2&&l.relative[x[0]])j=v(x[0]+x[1],d);else{j=l.relative[x[0]]?[d]:k(x.shift(),d);while(x.length)b=x.shift(),l.relative[b]&&(b+=x.shift()),j=v(b,j)}else{!g&&x.length>1&&d.nodeType===9&&!w&&l.match.ID.test(x[0])&&!l.match.ID.test(x[x.length-1])&&(q=k.find(x.shift(),d,w),d=q.expr?k.filter(q.expr,q.set)[0]:q.set[0]);if(d){q=g?{expr:x.pop(),set:p(g)}:k.find(x.pop(),x.length===1&&(x[0]==="~"||x[0]==="+")&&d.parentNode?d.parentNode:d,w),j=q.expr?k.filter(q.expr,q.set):q.set,x.length>0?n=p(j):u=!1;while(x.length)r=x.pop(),s=r,l.relative[r]?s=x.pop():r="",s==null&&(s=d),l.relative[r](n,s,w)}else n=x=[]}n||(n=j),n||k.error(r||b);if(e.call(n)==="[object Array]")if(!u)f.push.apply(f,n);else if(d&&d.nodeType===1)for(t=0;n[t]!=null;t++)n[t]&&(n[t]===!0||n[t].nodeType===1&&k.contains(d,n[t]))&&f.push(j[t]);else for(t=0;n[t]!=null;t++)n[t]&&n[t].nodeType===1&&f.push(j[t]);else p(n,f);o&&(k(o,h,f,g),k.uniqueSort(f));return f};k.uniqueSort=function(a){if(r){g=h,a.sort(r);if(g)for(var b=1;b0},k.find=function(a,b,c){var d;if(!a)return[];for(var e=0,f=l.order.length;e":function(a,b){var c,d=typeof b=="string",e=0,f=a.length;if(d&&!j.test(b)){b=b.toLowerCase();for(;e=0)?c||d.push(h):c&&(b[g]=!1));return!1},ID:function(a){return a[1].replace(i,"")},TAG:function(a,b){return a[1].replace(i,"").toLowerCase()},CHILD:function(a){if(a[1]==="nth"){a[2]||k.error(a[0]),a[2]=a[2].replace(/^\+|\s*/g,"");var b=/(-?)(\d*)(?:n([+\-]?\d*))?/.exec(a[2]==="even"&&"2n"||a[2]==="odd"&&"2n+1"||!/\D/.test(a[2])&&"0n+"+a[2]||a[2]);a[2]=b[1]+(b[2]||1)-0,a[3]=b[3]-0}else a[2]&&k.error(a[0]);a[0]=d++;return a},ATTR:function(a,b,c,d,e,f){var g=a[1]=a[1].replace(i,"");!f&&l.attrMap[g]&&(a[1]=l.attrMap[g]),a[4]=(a[4]||a[5]||"").replace(i,""),a[2]==="~="&&(a[4]=" "+a[4]+" ");return a},PSEUDO:function(b,c,d,e,f){if(b[1]==="not")if((a.exec(b[3])||"").length>1||/^\w/.test(b[3]))b[3]=k(b[3],null,null,c);else{var g=k.filter(b[3],c,d,!0^f);d||e.push.apply(e,g);return!1}else if(l.match.POS.test(b[0])||l.match.CHILD.test(b[0]))return!0;return b},POS:function(a){a.unshift(!0);return a}},filters:{enabled:function(a){return a.disabled===!1&&a.type!=="hidden"},disabled:function(a){return a.disabled===!0},checked:function(a){return a.checked===!0},selected:function(a){a.parentNode&&a.parentNode.selectedIndex;return a.selected===!0},parent:function(a){return!!a.firstChild},empty:function(a){return!a.firstChild},has:function(a,b,c){return!!k(c[3],a).length},header:function(a){return/h\d/i.test(a.nodeName)},text:function(a){var b=a.getAttribute("type"),c=a.type;return a.nodeName.toLowerCase()==="input"&&"text"===c&&(b===c||b===null)},radio:function(a){return a.nodeName.toLowerCase()==="input"&&"radio"===a.type},checkbox:function(a){return a.nodeName.toLowerCase()==="input"&&"checkbox"===a.type},file:function(a){return a.nodeName.toLowerCase()==="input"&&"file"===a.type},password:function(a){return a.nodeName.toLowerCase()==="input"&&"password"===a.type},submit:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"submit"===a.type},image:function(a){return a.nodeName.toLowerCase()==="input"&&"image"===a.type},reset:function(a){var b=a.nodeName.toLowerCase();return(b==="input"||b==="button")&&"reset"===a.type},button:function(a){var b=a.nodeName.toLowerCase();return b==="input"&&"button"===a.type||b==="button"},input:function(a){return/input|select|textarea|button/i.test(a.nodeName)},focus:function(a){return a===a.ownerDocument.activeElement}},setFilters:{first:function(a,b){return b===0},last:function(a,b,c,d){return b===d.length-1},even:function(a,b){return b%2===0},odd:function(a,b){return b%2===1},lt:function(a,b,c){return bc[3]-0},nth:function(a,b,c){return c[3]-0===b},eq:function(a,b,c){return c[3]-0===b}},filter:{PSEUDO:function(a,b,c,d){var e=b[1],f=l.filters[e];if(f)return f(a,c,b,d);if(e==="contains")return(a.textContent||a.innerText||k.getText([a])||"").indexOf(b[3])>=0;if(e==="not"){var g=b[3];for(var h=0,i=g.length;h=0}},ID:function(a,b){return a.nodeType===1&&a.getAttribute("id")===b},TAG:function(a,b){return b==="*"&&a.nodeType===1||a.nodeName.toLowerCase()===b},CLASS:function(a,b){return(" "+(a.className||a.getAttribute("class"))+" ").indexOf(b)>-1},ATTR:function(a,b){var c=b[1],d=l.attrHandle[c]?l.attrHandle[c](a):a[c]!=null?a[c]:a.getAttribute(c),e=d+"",f=b[2],g=b[4];return d==null?f==="!=":f==="="?e===g:f==="*="?e.indexOf(g)>=0:f==="~="?(" "+e+" ").indexOf(g)>=0:g?f==="!="?e!==g:f==="^="?e.indexOf(g)===0:f==="$="?e.substr(e.length-g.length)===g:f==="|="?e===g||e.substr(0,g.length+1)===g+"-":!1:e&&d!==!1},POS:function(a,b,c,d){var e=b[2],f=l.setFilters[e];if(f)return f(a,c,b,d)}}},m=l.match.POS,n=function(a,b){return"\\"+(b-0+1)};for(var o in l.match)l.match[o]=new RegExp(l.match[o].source+/(?![^\[]*\])(?![^\(]*\))/.source),l.leftMatch[o]=new RegExp(/(^(?:.|\r|\n)*?)/.source+l.match[o].source.replace(/\\(\d+)/g,n));var p=function(a,b){a=Array.prototype.slice.call(a,0);if(b){b.push.apply(b,a);return b}return a};try{Array.prototype.slice.call(c.documentElement.childNodes,0)[0].nodeType}catch(q){p=function(a,b){var c=0,d=b||[];if(e.call(a)==="[object Array]")Array.prototype.push.apply(d,a);else if(typeof a.length=="number")for(var f=a.length;c",e.insertBefore(a,e.firstChild),c.getElementById(d)&&(l.find.ID=function(a,c,d){if(typeof c.getElementById!="undefined"&&!d){var e=c.getElementById(a[1]);return e?e.id===a[1]||typeof e.getAttributeNode!="undefined"&&e.getAttributeNode("id").nodeValue===a[1]?[e]:b:[]}},l.filter.ID=function(a,b){var c=typeof a.getAttributeNode!="undefined"&&a.getAttributeNode("id");return a.nodeType===1&&c&&c.nodeValue===b}),e.removeChild(a),e=a=null}(),function(){var a=c.createElement("div");a.appendChild(c.createComment("")),a.getElementsByTagName("*").length>0&&(l.find.TAG=function(a,b){var c=b.getElementsByTagName(a[1]);if(a[1]==="*"){var d=[];for(var e=0;c[e];e++)c[e].nodeType===1&&d.push(c[e]);c=d}return c}),a.innerHTML="",a.firstChild&&typeof a.firstChild.getAttribute!="undefined"&&a.firstChild.getAttribute("href")!=="#"&&(l.attrHandle.href=function(a){return a.getAttribute("href",2)}),a=null}(),c.querySelectorAll&&function(){var a=k,b=c.createElement("div"),d="__sizzle__";b.innerHTML="

    ";if(!b.querySelectorAll||b.querySelectorAll(".TEST").length!==0){k=function(b,e,f,g){e=e||c;if(!g&&!k.isXML(e)){var h=/^(\w+$)|^\.([\w\-]+$)|^#([\w\-]+$)/.exec(b);if(h&&(e.nodeType===1||e.nodeType===9)){if(h[1])return p(e.getElementsByTagName(b),f);if(h[2]&&l.find.CLASS&&e.getElementsByClassName)return p(e.getElementsByClassName(h[2]),f)}if(e.nodeType===9){if(b==="body"&&e.body)return p([e.body],f);if(h&&h[3]){var i=e.getElementById(h[3]);if(!i||!i.parentNode)return p([],f);if(i.id===h[3])return p([i],f)}try{return p(e.querySelectorAll(b),f)}catch(j){}}else if(e.nodeType===1&&e.nodeName.toLowerCase()!=="object"){var m=e,n=e.getAttribute("id"),o=n||d,q=e.parentNode,r=/^\s*[+~]/.test(b);n?o=o.replace(/'/g,"\\$&"):e.setAttribute("id",o),r&&q&&(e=e.parentNode);try{if(!r||q)return p(e.querySelectorAll("[id='"+o+"'] "+b),f)}catch(s){}finally{n||m.removeAttribute("id")}}}return a(b,e,f,g)};for(var e in a)k[e]=a[e];b=null}}(),function(){var a=c.documentElement,b=a.matchesSelector||a.mozMatchesSelector||a.webkitMatchesSelector||a.msMatchesSelector;if(b){var d=!b.call(c.createElement("div"),"div"),e=!1;try{b.call(c.documentElement,"[test!='']:sizzle")}catch(f){e=!0}k.matchesSelector=function(a,c){c=c.replace(/\=\s*([^'"\]]*)\s*\]/g,"='$1']");if(!k.isXML(a))try{if(e||!l.match.PSEUDO.test(c)&&!/!=/.test(c)){var f=b.call(a,c);if(f||!d||a.document&&a.document.nodeType!==11)return f}}catch(g){}return k(c,null,null,[a]).length>0}}}(),function(){var a=c.createElement("div");a.innerHTML="
    ";if(!!a.getElementsByClassName&&a.getElementsByClassName("e").length!==0){a.lastChild.className="e";if(a.getElementsByClassName("e").length===1)return;l.order.splice(1,0,"CLASS"),l.find.CLASS=function(a,b,c){if(typeof b.getElementsByClassName!="undefined"&&!c)return b.getElementsByClassName(a[1])},a=null}}(),c.documentElement.contains?k.contains=function(a,b){return a!==b&&(a.contains?a.contains(b):!0)}:c.documentElement.compareDocumentPosition?k.contains=function(a,b){return!!(a.compareDocumentPosition(b)&16)}:k.contains=function(){return!1},k.isXML=function(a){var b=(a?a.ownerDocument||a:0).documentElement;return b?b.nodeName!=="HTML":!1};var v=function(a,b){var c,d=[],e="",f=b.nodeType?[b]:b;while(c=l.match.PSEUDO.exec(a))e+=c[0],a=a.replace(l.match.PSEUDO,"");a=l.relative[a]?a+"*":a;for(var g=0,h=f.length;g0)for(h=g;h0:this.filter(a).length>0)},closest:function(a,b){var c=[],d,e,g=this[0];if(f.isArray(a)){var h,i,j={},k=1;if(g&&a.length){for(d=0,e=a.length;d-1:f(g).is(h))&&c.push({selector:i,elem:g,level:k});g=g.parentNode,k++}}return c}var l=T.test(a)||typeof a!="string"?f(a,b||this.context):0;for(d=0,e=this.length;d-1:f.find.matchesSelector(g,a)){c.push(g);break}g=g.parentNode;if(!g||!g.ownerDocument||g===b||g.nodeType===11)break}}c=c.length>1?f.unique(c):c;return this.pushStack(c,"closest",a)},index:function(a){if(!a||typeof a=="string")return f.inArray(this[0],a?f(a):this.parent().children());return f.inArray(a.jquery?a[0]:a,this)},add:function(a,b){var c=typeof a=="string"?f(a,b):f.makeArray(a&&a.nodeType?[a]:a),d=f.merge(this.get(),c);return this.pushStack(V(c[0])||V(d[0])?d:f.unique(d))},andSelf:function(){return this.add(this.prevObject)}}),f.each({parent:function(a){var b=a.parentNode;return b&&b.nodeType!==11?b:null},parents:function(a){return f.dir(a,"parentNode")},parentsUntil:function(a,b,c){return f.dir(a,"parentNode",c)},next:function(a){return f.nth(a,2,"nextSibling")},prev:function(a){return f.nth(a,2,"previousSibling")},nextAll:function(a){return f.dir(a,"nextSibling")},prevAll:function(a){return f.dir(a,"previousSibling")},nextUntil:function(a,b,c){return f.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return f.dir(a,"previousSibling",c)},siblings:function(a){return f.sibling(a.parentNode.firstChild,a)},children:function(a){return f.sibling(a.firstChild)},contents:function(a){return f.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:f.makeArray(a.childNodes)}},function(a,b){f.fn[a]=function(c,d){var e=f.map(this,b,c),g=S.call(arguments);O.test(a)||(d=c),d&&typeof d=="string"&&(e=f.filter(d,e)),e=this.length>1&&!U[a]?f.unique(e):e,(this.length>1||Q.test(d))&&P.test(a)&&(e=e.reverse());return this.pushStack(e,a,g.join(","))}}),f.extend({filter:function(a,b,c){c&&(a=":not("+a+")");return b.length===1?f.find.matchesSelector(b[0],a)?[b[0]]:[]:f.find.matches(a,b)},dir:function(a,c,d){var e=[],g=a[c];while(g&&g.nodeType!==9&&(d===b||g.nodeType!==1||!f(g).is(d)))g.nodeType===1&&e.push(g),g=g[c];return e},nth:function(a,b,c,d){b=b||1;var e=0;for(;a;a=a[c])if(a.nodeType===1&&++e===b)break;return a},sibling:function(a,b){var c=[];for(;a;a=a.nextSibling)a.nodeType===1&&a!==b&&c.push(a);return c}});var X=/ jQuery\d+="(?:\d+|null)"/g,Y=/^\s+/,Z=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,$=/<([\w:]+)/,_=/",""],legend:[1,"
    ","
    "],thead:[1,"","
    "],tr:[2,"","
    "],td:[3,"","
    "],col:[2,"","
    "],area:[1,"",""],_default:[0,"",""]};bf.optgroup=bf.option,bf.tbody=bf.tfoot=bf.colgroup=bf.caption=bf.thead,bf.th=bf.td,f.support.htmlSerialize||(bf._default=[1,"div
    ","
    "]),f.fn.extend({text:function(a){if(f.isFunction(a))return this.each(function(b){var c=f(this);c.text(a.call(this,b,c.text()))});if(typeof a!="object"&&a!==b)return this.empty().append((this[0]&&this[0].ownerDocument||c).createTextNode(a));return f.text(this)},wrapAll:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapAll(a.call(this,b))});if(this[0]){var b=f(a,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstChild&&a.firstChild.nodeType===1)a=a.firstChild;return a}).append(this)}return this},wrapInner:function(a){if(f.isFunction(a))return this.each(function(b){f(this).wrapInner(a.call(this,b))});return this.each(function(){var b=f(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){return this.each(function(){f(this).wrapAll(a)})},unwrap:function(){return this.parent().each(function(){f.nodeName(this,"body")||f(this).replaceWith(this.childNodes)}).end()},append:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.appendChild(a)})},prepend:function(){return this.domManip(arguments,!0,function(a){this.nodeType===1&&this.insertBefore(a,this.firstChild)})},before:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this)});if(arguments.length){var a=f(arguments[0]);a.push.apply(a,this.toArray());return this.pushStack(a,"before",arguments)}},after:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,!1,function(a){this.parentNode.insertBefore(a,this.nextSibling)});if(arguments.length){var a=this.pushStack(this,"after",arguments);a.push.apply(a,f(arguments[0]).toArray());return a}},remove:function(a,b){for(var c=0,d;(d=this[c])!=null;c++)if(!a||f.filter(a,[d]).length)!b&&d.nodeType===1&&(f.cleanData(d.getElementsByTagName("*")),f.cleanData([d])),d.parentNode&&d.parentNode.removeChild(d);return this},empty:function(){for(var a=0,b;(b=this[a])!=null;a++){b.nodeType===1&&f.cleanData(b.getElementsByTagName("*"));while(b.firstChild)b.removeChild(b.firstChild)}return this},clone:function(a,b){a=a==null?!1:a,b=b==null?a:b;return this.map(function(){return f.clone(this,a,b)})},html:function(a){if(a===b)return this[0]&&this[0].nodeType===1?this[0].innerHTML.replace(X,""):null;if(typeof a=="string"&&!bb.test(a)&&(f.support.leadingWhitespace||!Y.test(a))&&!bf[($.exec(a)||["",""])[1].toLowerCase()]){a=a.replace(Z,"<$1>");try{for(var c=0,d=this.length;c1&&l0?this.clone(!0):this).get();f(e[h])[b](j),d=d.concat(j +)}return this.pushStack(d,a,e.selector)}}),f.extend({clone:function(a,b,c){var d=a.cloneNode(!0),e,g,h;if((!f.support.noCloneEvent||!f.support.noCloneChecked)&&(a.nodeType===1||a.nodeType===11)&&!f.isXMLDoc(a)){bi(a,d),e=bj(a),g=bj(d);for(h=0;e[h];++h)bi(e[h],g[h])}if(b){bh(a,d);if(c){e=bj(a),g=bj(d);for(h=0;e[h];++h)bh(e[h],g[h])}}e=g=null;return d},clean:function(a,b,d,e){var g;b=b||c,typeof b.createElement=="undefined"&&(b=b.ownerDocument||b[0]&&b[0].ownerDocument||c);var h=[],i;for(var j=0,k;(k=a[j])!=null;j++){typeof k=="number"&&(k+="");if(!k)continue;if(typeof k=="string")if(!ba.test(k))k=b.createTextNode(k);else{k=k.replace(Z,"<$1>");var l=($.exec(k)||["",""])[1].toLowerCase(),m=bf[l]||bf._default,n=m[0],o=b.createElement("div");o.innerHTML=m[1]+k+m[2];while(n--)o=o.lastChild;if(!f.support.tbody){var p=_.test(k),q=l==="table"&&!p?o.firstChild&&o.firstChild.childNodes:m[1]===""&&!p?o.childNodes:[];for(i=q.length-1;i>=0;--i)f.nodeName(q[i],"tbody")&&!q[i].childNodes.length&&q[i].parentNode.removeChild(q[i])}!f.support.leadingWhitespace&&Y.test(k)&&o.insertBefore(b.createTextNode(Y.exec(k)[0]),o.firstChild),k=o.childNodes}var r;if(!f.support.appendChecked)if(k[0]&&typeof (r=k.length)=="number")for(i=0;i=0)return b+"px"}}}),f.support.opacity||(f.cssHooks.opacity={get:function(a,b){return bo.test((b&&a.currentStyle?a.currentStyle.filter:a.style.filter)||"")?parseFloat(RegExp.$1)/100+"":b?"1":""},set:function(a,b){var c=a.style,d=a.currentStyle;c.zoom=1;var e=f.isNaN(b)?"":"alpha(opacity="+b*100+")",g=d&&d.filter||c.filter||"";c.filter=bn.test(g)?g.replace(bn,e):g+" "+e}}),f(function(){f.support.reliableMarginRight||(f.cssHooks.marginRight={get:function(a,b){var c;f.swap(a,{display:"inline-block"},function(){b?c=bx(a,"margin-right","marginRight"):c=a.style.marginRight});return c}})}),c.defaultView&&c.defaultView.getComputedStyle&&(by=function(a,c){var d,e,g;c=c.replace(bp,"-$1").toLowerCase();if(!(e=a.ownerDocument.defaultView))return b;if(g=e.getComputedStyle(a,null))d=g.getPropertyValue(c),d===""&&!f.contains(a.ownerDocument.documentElement,a)&&(d=f.style(a,c));return d}),c.documentElement.currentStyle&&(bz=function(a,b){var c,d=a.currentStyle&&a.currentStyle[b],e=a.runtimeStyle&&a.runtimeStyle[b],f=a.style;!bq.test(d)&&br.test(d)&&(c=f.left,e&&(a.runtimeStyle.left=a.currentStyle.left),f.left=b==="fontSize"?"1em":d||0,d=f.pixelLeft+"px",f.left=c,e&&(a.runtimeStyle.left=e));return d===""?"auto":d}),bx=by||bz,f.expr&&f.expr.filters&&(f.expr.filters.hidden=function(a){var b=a.offsetWidth,c=a.offsetHeight;return b===0&&c===0||!f.support.reliableHiddenOffsets&&(a.style.display||f.css(a,"display"))==="none"},f.expr.filters.visible=function(a){return!f.expr.filters.hidden(a)});var bB=/%20/g,bC=/\[\]$/,bD=/\r?\n/g,bE=/#.*$/,bF=/^(.*?):[ \t]*([^\r\n]*)\r?$/mg,bG=/^(?:color|date|datetime|email|hidden|month|number|password|range|search|tel|text|time|url|week)$/i,bH=/^(?:about|app|app\-storage|.+\-extension|file|widget):$/,bI=/^(?:GET|HEAD)$/,bJ=/^\/\//,bK=/\?/,bL=/)<[^<]*)*<\/script>/gi,bM=/^(?:select|textarea)/i,bN=/\s+/,bO=/([?&])_=[^&]*/,bP=/^([\w\+\.\-]+:)(?:\/\/([^\/?#:]*)(?::(\d+))?)?/,bQ=f.fn.load,bR={},bS={},bT,bU;try{bT=e.href}catch(bV){bT=c.createElement("a"),bT.href="",bT=bT.href}bU=bP.exec(bT.toLowerCase())||[],f.fn.extend({load:function(a,c,d){if(typeof a!="string"&&bQ)return bQ.apply(this,arguments);if(!this.length)return this;var e=a.indexOf(" ");if(e>=0){var g=a.slice(e,a.length);a=a.slice(0,e)}var h="GET";c&&(f.isFunction(c)?(d=c,c=b):typeof c=="object"&&(c=f.param(c,f.ajaxSettings.traditional),h="POST"));var i=this;f.ajax({url:a,type:h,dataType:"html",data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?f("
    ").append(c.replace(bL,"")).find(g):c)),d&&i.each(d,[c,b,a])}});return this},serialize:function(){return f.param(this.serializeArray())},serializeArray:function(){return this.map(function(){return this.elements?f.makeArray(this.elements):this}).filter(function(){return this.name&&!this.disabled&&(this.checked||bM.test(this.nodeName)||bG.test(this.type))}).map(function(a,b){var c=f(this).val();return c==null?null:f.isArray(c)?f.map(c,function(a,c){return{name:b.name,value:a.replace(bD,"\r\n")}}):{name:b.name,value:c.replace(bD,"\r\n")}}).get()}}),f.each("ajaxStart ajaxStop ajaxComplete ajaxError ajaxSuccess ajaxSend".split(" "),function(a,b){f.fn[b]=function(a){return this.bind(b,a)}}),f.each(["get","post"],function(a,c){f[c]=function(a,d,e,g){f.isFunction(d)&&(g=g||e,e=d,d=b);return f.ajax({type:c,url:a,data:d,success:e,dataType:g})}}),f.extend({getScript:function(a,c){return f.get(a,b,c,"script")},getJSON:function(a,b,c){return f.get(a,b,c,"json")},ajaxSetup:function(a,b){b?f.extend(!0,a,f.ajaxSettings,b):(b=a,a=f.extend(!0,f.ajaxSettings,b));for(var c in{context:1,url:1})c in b?a[c]=b[c]:c in f.ajaxSettings&&(a[c]=f.ajaxSettings[c]);return a},ajaxSettings:{url:bT,isLocal:bH.test(bU[1]),global:!0,type:"GET",contentType:"application/x-www-form-urlencoded",processData:!0,async:!0,accepts:{xml:"application/xml, text/xml",html:"text/html",text:"text/plain",json:"application/json, text/javascript","*":"*/*"},contents:{xml:/xml/,html:/html/,json:/json/},responseFields:{xml:"responseXML",text:"responseText"},converters:{"* text":a.String,"text html":!0,"text json":f.parseJSON,"text xml":f.parseXML}},ajaxPrefilter:bW(bR),ajaxTransport:bW(bS),ajax:function(a,c){function w(a,c,l,m){if(s!==2){s=2,q&&clearTimeout(q),p=b,n=m||"",v.readyState=a?4:0;var o,r,u,w=l?bZ(d,v,l):b,x,y;if(a>=200&&a<300||a===304){if(d.ifModified){if(x=v.getResponseHeader("Last-Modified"))f.lastModified[k]=x;if(y=v.getResponseHeader("Etag"))f.etag[k]=y}if(a===304)c="notmodified",o=!0;else try{r=b$(d,w),c="success",o=!0}catch(z){c="parsererror",u=z}}else{u=c;if(!c||a)c="error",a<0&&(a=0)}v.status=a,v.statusText=c,o?h.resolveWith(e,[r,c,v]):h.rejectWith(e,[v,c,u]),v.statusCode(j),j=b,t&&g.trigger("ajax"+(o?"Success":"Error"),[v,d,o?r:u]),i.resolveWith(e,[v,c]),t&&(g.trigger("ajaxComplete",[v,d]),--f.active||f.event.trigger("ajaxStop"))}}typeof a=="object"&&(c=a,a=b),c=c||{};var d=f.ajaxSetup({},c),e=d.context||d,g=e!==d&&(e.nodeType||e instanceof f)?f(e):f.event,h=f.Deferred(),i=f._Deferred(),j=d.statusCode||{},k,l={},m={},n,o,p,q,r,s=0,t,u,v={readyState:0,setRequestHeader:function(a,b){if(!s){var c=a.toLowerCase();a=m[c]=m[c]||a,l[a]=b}return this},getAllResponseHeaders:function(){return s===2?n:null},getResponseHeader:function(a){var c;if(s===2){if(!o){o={};while(c=bF.exec(n))o[c[1].toLowerCase()]=c[2]}c=o[a.toLowerCase()]}return c===b?null:c},overrideMimeType:function(a){s||(d.mimeType=a);return this},abort:function(a){a=a||"abort",p&&p.abort(a),w(0,a);return this}};h.promise(v),v.success=v.done,v.error=v.fail,v.complete=i.done,v.statusCode=function(a){if(a){var b;if(s<2)for(b in a)j[b]=[j[b],a[b]];else b=a[v.status],v.then(b,b)}return this},d.url=((a||d.url)+"").replace(bE,"").replace(bJ,bU[1]+"//"),d.dataTypes=f.trim(d.dataType||"*").toLowerCase().split(bN),d.crossDomain==null&&(r=bP.exec(d.url.toLowerCase()),d.crossDomain=!(!r||r[1]==bU[1]&&r[2]==bU[2]&&(r[3]||(r[1]==="http:"?80:443))==(bU[3]||(bU[1]==="http:"?80:443)))),d.data&&d.processData&&typeof d.data!="string"&&(d.data=f.param(d.data,d.traditional)),bX(bR,d,c,v);if(s===2)return!1;t=d.global,d.type=d.type.toUpperCase(),d.hasContent=!bI.test(d.type),t&&f.active++===0&&f.event.trigger("ajaxStart");if(!d.hasContent){d.data&&(d.url+=(bK.test(d.url)?"&":"?")+d.data),k=d.url;if(d.cache===!1){var x=f.now(),y=d.url.replace(bO,"$1_="+x);d.url=y+(y===d.url?(bK.test(d.url)?"&":"?")+"_="+x:"")}}(d.data&&d.hasContent&&d.contentType!==!1||c.contentType)&&v.setRequestHeader("Content-Type",d.contentType),d.ifModified&&(k=k||d.url,f.lastModified[k]&&v.setRequestHeader("If-Modified-Since",f.lastModified[k]),f.etag[k]&&v.setRequestHeader("If-None-Match",f.etag[k])),v.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+(d.dataTypes[0]!=="*"?", */*; q=0.01":""):d.accepts["*"]);for(u in d.headers)v.setRequestHeader(u,d.headers[u]);if(d.beforeSend&&(d.beforeSend.call(e,v,d)===!1||s===2)){v.abort();return!1}for(u in{success:1,error:1,complete:1})v[u](d[u]);p=bX(bS,d,c,v);if(!p)w(-1,"No Transport");else{v.readyState=1,t&&g.trigger("ajaxSend",[v,d]),d.async&&d.timeout>0&&(q=setTimeout(function(){v.abort("timeout")},d.timeout));try{s=1,p.send(l,w)}catch(z){status<2?w(-1,z):f.error(z)}}return v},param:function(a,c){var d=[],e=function(a,b){b=f.isFunction(b)?b():b,d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(b)};c===b&&(c=f.ajaxSettings.traditional);if(f.isArray(a)||a.jquery&&!f.isPlainObject(a))f.each(a,function(){e(this.name,this.value)});else for(var g in a)bY(g,a[g],c,e);return d.join("&").replace(bB,"+")}}),f.extend({active:0,lastModified:{},etag:{}});var b_=f.now(),ca=/(\=)\?(&|$)|\?\?/i;f.ajaxSetup({jsonp:"callback",jsonpCallback:function(){return f.expando+"_"+b_++}}),f.ajaxPrefilter("json jsonp",function(b,c,d){var e=b.contentType==="application/x-www-form-urlencoded"&&typeof b.data=="string";if(b.dataTypes[0]==="jsonp"||b.jsonp!==!1&&(ca.test(b.url)||e&&ca.test(b.data))){var g,h=b.jsonpCallback=f.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,i=a[h],j=b.url,k=b.data,l="$1"+h+"$2";b.jsonp!==!1&&(j=j.replace(ca,l),b.url===j&&(e&&(k=k.replace(ca,l)),b.data===k&&(j+=(/\?/.test(j)?"&":"?")+b.jsonp+"="+h))),b.url=j,b.data=k,a[h]=function(a){g=[a]},d.always(function(){a[h]=i,g&&f.isFunction(i)&&a[h](g[0])}),b.converters["script json"]=function(){g||f.error(h+" was not called");return g[0]},b.dataTypes[0]="json";return"script"}}),f.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/javascript|ecmascript/},converters:{"text script":function(a){f.globalEval(a);return a}}}),f.ajaxPrefilter("script",function(a){a.cache===b&&(a.cache=!1),a.crossDomain&&(a.type="GET",a.global=!1)}),f.ajaxTransport("script",function(a){if(a.crossDomain){var d,e=c.head||c.getElementsByTagName("head")[0]||c.documentElement;return{send:function(f,g){d=c.createElement("script"),d.async="async",a.scriptCharset&&(d.charset=a.scriptCharset),d.src=a.url,d.onload=d.onreadystatechange=function(a,c){if(c||!d.readyState||/loaded|complete/.test(d.readyState))d.onload=d.onreadystatechange=null,e&&d.parentNode&&e.removeChild(d),d=b,c||g(200,"success")},e.insertBefore(d,e.firstChild)},abort:function(){d&&d.onload(0,1)}}}});var cb=a.ActiveXObject?function(){for(var a in cd)cd[a](0,1)}:!1,cc=0,cd;f.ajaxSettings.xhr=a.ActiveXObject?function(){return!this.isLocal&&ce()||cf()}:ce,function(a){f.extend(f.support,{ajax:!!a,cors:!!a&&"withCredentials"in a})}(f.ajaxSettings.xhr()),f.support.ajax&&f.ajaxTransport(function(c){if(!c.crossDomain||f.support.cors){var d;return{send:function(e,g){var h=c.xhr(),i,j;c.username?h.open(c.type,c.url,c.async,c.username,c.password):h.open(c.type,c.url,c.async);if(c.xhrFields)for(j in c.xhrFields)h[j]=c.xhrFields[j];c.mimeType&&h.overrideMimeType&&h.overrideMimeType(c.mimeType),!c.crossDomain&&!e["X-Requested-With"]&&(e["X-Requested-With"]="XMLHttpRequest");try{for(j in e)h.setRequestHeader(j,e[j])}catch(k){}h.send(c.hasContent&&c.data||null),d=function(a,e){var j,k,l,m,n;try{if(d&&(e||h.readyState===4)){d=b,i&&(h.onreadystatechange=f.noop,cb&&delete cd[i]);if(e)h.readyState!==4&&h.abort();else{j=h.status,l=h.getAllResponseHeaders(),m={},n=h.responseXML,n&&n.documentElement&&(m.xml=n),m.text=h.responseText;try{k=h.statusText}catch(o){k=""}!j&&c.isLocal&&!c.crossDomain?j=m.text?200:404:j===1223&&(j=204)}}}catch(p){e||g(-1,p)}m&&g(j,k,m,l)},!c.async||h.readyState===4?d():(i=++cc,cb&&(cd||(cd={},f(a).unload(cb)),cd[i]=d),h.onreadystatechange=d)},abort:function(){d&&d(0,1)}}}});var cg={},ch,ci,cj=/^(?:toggle|show|hide)$/,ck=/^([+\-]=)?([\d+.\-]+)([a-z%]*)$/i,cl,cm=[["height","marginTop","marginBottom","paddingTop","paddingBottom"],["width","marginLeft","marginRight","paddingLeft","paddingRight"],["opacity"]],cn,co=a.webkitRequestAnimationFrame||a.mozRequestAnimationFrame||a.oRequestAnimationFrame;f.fn.extend({show:function(a,b,c){var d,e;if(a||a===0)return this.animate(cr("show",3),a,b,c);for(var g=0,h=this.length;g=e.duration+this.startTime){this.now=this.end,this.pos=this.state=1,this.update(),e.animatedProperties[this.prop]=!0;for(g in e.animatedProperties)e.animatedProperties[g]!==!0&&(c=!1);if(c){e.overflow!=null&&!f.support.shrinkWrapBlocks&&f.each(["","X","Y"],function(a,b){d.style["overflow"+b]=e.overflow[a]}),e.hide&&f(d).hide();if(e.hide||e.show)for(var i in e.animatedProperties)f.style(d,i,e.orig[i]);e.complete.call(d)}return!1}e.duration==Infinity?this.now=b:(h=b-this.startTime,this.state=h/e.duration,this.pos=f.easing[e.animatedProperties[this.prop]](this.state,h,0,1,e.duration),this.now=this.start+(this.end-this.start)*this.pos),this.update();return!0}},f.extend(f.fx,{tick:function(){for(var a=f.timers,b=0;b
    ";f.extend(b.style,{position:"absolute",top:0,left:0,margin:0,border:0,width:"1px",height:"1px",visibility:"hidden"}),b.innerHTML=j,a.insertBefore(b,a.firstChild),d=b.firstChild,e=d.firstChild,h=d.nextSibling.firstChild.firstChild,this.doesNotAddBorder=e.offsetTop!==5,this.doesAddBorderForTableAndCells=h.offsetTop===5,e.style.position="fixed",e.style.top="20px",this.supportsFixedPosition=e.offsetTop===20||e.offsetTop===15,e.style.position=e.style.top="",d.style.overflow="hidden",d.style.position="relative",this.subtractsBorderForOverflowNotVisible=e.offsetTop===-5,this.doesNotIncludeMarginInBodyOffset=a.offsetTop!==i,a.removeChild(b),f.offset.initialize=f.noop},bodyOffset:function(a){var b=a.offsetTop,c=a.offsetLeft;f.offset.initialize(),f.offset.doesNotIncludeMarginInBodyOffset&&(b+=parseFloat(f.css(a,"marginTop"))||0,c+=parseFloat(f.css(a,"marginLeft"))||0);return{top:b,left:c}},setOffset:function(a,b,c){var d=f.css(a,"position");d==="static"&&(a.style.position="relative");var e=f(a),g=e.offset(),h=f.css(a,"top"),i=f.css(a,"left"),j=(d==="absolute"||d==="fixed")&&f.inArray("auto",[h,i])>-1,k={},l={},m,n;j?(l=e.position(),m=l.top,n=l.left):(m=parseFloat(h)||0,n=parseFloat(i)||0),f.isFunction(b)&&(b=b.call(a,c,g)),b.top!=null&&(k.top=b.top-g.top+m),b.left!=null&&(k.left=b.left-g.left+n),"using"in b?b.using.call(a,k):e.css(k)}},f.fn.extend({position:function(){if(!this[0])return null;var a=this[0],b=this.offsetParent(),c=this.offset(),d=cu.test(b[0].nodeName)?{top:0,left:0}:b.offset();c.top-=parseFloat(f.css(a,"marginTop"))||0,c.left-=parseFloat(f.css(a,"marginLeft"))||0,d.top+=parseFloat(f.css(b[0],"borderTopWidth"))||0,d.left+=parseFloat(f.css(b[0],"borderLeftWidth"))||0;return{top:c.top-d.top,left:c.left-d.left}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||c.body;while(a&&!cu.test(a.nodeName)&&f.css(a,"position")==="static")a=a.offsetParent;return a})}}),f.each(["Left","Top"],function(a,c){var d="scroll"+c;f.fn[d]=function(c){var e,g;if(c===b){e=this[0];if(!e)return null;g=cv(e);return g?"pageXOffset"in g?g[a?"pageYOffset":"pageXOffset"]:f.support.boxModel&&g.document.documentElement[d]||g.document.body[d]:e[d]}return this.each(function(){g=cv(this),g?g.scrollTo(a?f(g).scrollLeft():c,a?c:f(g).scrollTop()):this[d]=c})}}),f.each(["Height","Width"],function(a,c){var d=c.toLowerCase();f.fn["inner"+c]=function(){var a=this[0];return a&&a.style?parseFloat(f.css(a,d,"padding")):null},f.fn["outer"+c]=function(a){var b=this[0];return b&&b.style?parseFloat(f.css(b,d,a?"margin":"border")):null},f.fn[d]=function(a){var e=this[0];if(!e)return a==null?null:this;if(f.isFunction(a))return this.each(function(b){var c=f(this);c[d](a.call(this,b,c[d]()))});if(f.isWindow(e)){var g=e.document.documentElement["client"+c];return e.document.compatMode==="CSS1Compat"&&g||e.document.body["client"+c]||g}if(e.nodeType===9)return Math.max(e.documentElement["client"+c],e.body["scroll"+c],e.documentElement["scroll"+c],e.body["offset"+c],e.documentElement["offset"+c]);if(a===b){var h=f.css(e,d),i=parseFloat(h);return f.isNaN(i)?h:i}return this.css(d,typeof a=="string"?a:a+"px")}}),a.jQuery=a.$=f})(window); \ No newline at end of file diff --git a/config/snort-dev/javascript/jquery.form.js b/config/snort-dev/javascript/jquery.form.js new file mode 100644 index 00000000..2b853df4 --- /dev/null +++ b/config/snort-dev/javascript/jquery.form.js @@ -0,0 +1,785 @@ +/*! + * jQuery Form Plugin + * version: 2.49 (18-OCT-2010) + * @requires jQuery v1.3.2 or later + * + * Examples and documentation at: http://malsup.com/jquery/form/ + * Dual licensed under the MIT and GPL licenses: + * http://www.opensource.org/licenses/mit-license.php + * http://www.gnu.org/licenses/gpl.html + */ +;(function($) { + +/* + Usage Note: + ----------- + Do not use both ajaxSubmit and ajaxForm on the same form. These + functions are intended to be exclusive. Use ajaxSubmit if you want + to bind your own submit handler to the form. For example, + + $(document).ready(function() { + $('#myForm').bind('submit', function(e) { + e.preventDefault(); // <-- important + $(this).ajaxSubmit({ + target: '#output' + }); + }); + }); + + Use ajaxForm when you want the plugin to manage all the event binding + for you. For example, + + $(document).ready(function() { + $('#myForm').ajaxForm({ + target: '#output' + }); + }); + + When using ajaxForm, the ajaxSubmit function will be invoked for you + at the appropriate time. +*/ + +/** + * ajaxSubmit() provides a mechanism for immediately submitting + * an HTML form using AJAX. + */ +$.fn.ajaxSubmit = function(options) { + // fast fail if nothing selected (http://dev.jquery.com/ticket/2752) + if (!this.length) { + log('ajaxSubmit: skipping submit process - no element selected'); + return this; + } + + if (typeof options == 'function') { + options = { success: options }; + } + + var url = $.trim(this.attr('action')); + if (url) { + // clean url (don't include hash vaue) + url = (url.match(/^([^#]+)/)||[])[1]; + } + url = url || window.location.href || ''; + + options = $.extend(true, { + url: url, + type: this.attr('method') || 'GET', + iframeSrc: /^https/i.test(window.location.href || '') ? 'javascript:false' : 'about:blank' + }, options); + + // hook for manipulating the form data before it is extracted; + // convenient for use with rich editors like tinyMCE or FCKEditor + var veto = {}; + this.trigger('form-pre-serialize', [this, options, veto]); + if (veto.veto) { + log('ajaxSubmit: submit vetoed via form-pre-serialize trigger'); + return this; + } + + // provide opportunity to alter form data before it is serialized + if (options.beforeSerialize && options.beforeSerialize(this, options) === false) { + log('ajaxSubmit: submit aborted via beforeSerialize callback'); + return this; + } + + var n,v,a = this.formToArray(options.semantic); + if (options.data) { + options.extraData = options.data; + for (n in options.data) { + if(options.data[n] instanceof Array) { + for (var k in options.data[n]) { + a.push( { name: n, value: options.data[n][k] } ); + } + } + else { + v = options.data[n]; + v = $.isFunction(v) ? v() : v; // if value is fn, invoke it + a.push( { name: n, value: v } ); + } + } + } + + // give pre-submit callback an opportunity to abort the submit + if (options.beforeSubmit && options.beforeSubmit(a, this, options) === false) { + log('ajaxSubmit: submit aborted via beforeSubmit callback'); + return this; + } + + // fire vetoable 'validate' event + this.trigger('form-submit-validate', [a, this, options, veto]); + if (veto.veto) { + log('ajaxSubmit: submit vetoed via form-submit-validate trigger'); + return this; + } + + var q = $.param(a); + + if (options.type.toUpperCase() == 'GET') { + options.url += (options.url.indexOf('?') >= 0 ? '&' : '?') + q; + options.data = null; // data is null for 'get' + } + else { + options.data = q; // data is the query string for 'post' + } + + var $form = this, callbacks = []; + if (options.resetForm) { + callbacks.push(function() { $form.resetForm(); }); + } + if (options.clearForm) { + callbacks.push(function() { $form.clearForm(); }); + } + + // perform a load on the target only if dataType is not provided + if (!options.dataType && options.target) { + var oldSuccess = options.success || function(){}; + callbacks.push(function(data) { + var fn = options.replaceTarget ? 'replaceWith' : 'html'; + $(options.target)[fn](data).each(oldSuccess, arguments); + }); + } + else if (options.success) { + callbacks.push(options.success); + } + + options.success = function(data, status, xhr) { // jQuery 1.4+ passes xhr as 3rd arg + var context = options.context || options; // jQuery 1.4+ supports scope context + for (var i=0, max=callbacks.length; i < max; i++) { + callbacks[i].apply(context, [data, status, xhr || $form, $form]); + } + }; + + // are there files to upload? + var fileInputs = $('input:file', this).length > 0; + var mp = 'multipart/form-data'; + var multipart = ($form.attr('enctype') == mp || $form.attr('encoding') == mp); + + // options.iframe allows user to force iframe mode + // 06-NOV-09: now defaulting to iframe mode if file input is detected + if (options.iframe !== false && (fileInputs || options.iframe || multipart)) { + // hack to fix Safari hang (thanks to Tim Molendijk for this) + // see: http://groups.google.com/group/jquery-dev/browse_thread/thread/36395b7ab510dd5d + if (options.closeKeepAlive) { + $.get(options.closeKeepAlive, fileUpload); + } + else { + fileUpload(); + } + } + else { + $.ajax(options); + } + + // fire 'notify' event + this.trigger('form-submit-notify', [this, options]); + return this; + + + // private function for handling file uploads (hat tip to YAHOO!) + function fileUpload() { + var form = $form[0]; + + if ($(':input[name=submit],:input[id=submit]', form).length) { + // if there is an input with a name or id of 'submit' then we won't be + // able to invoke the submit fn on the form (at least not x-browser) + alert('Error: Form elements must not have name or id of "submit".'); + return; + } + + var s = $.extend(true, {}, $.ajaxSettings, options); + s.context = s.context || s; + var id = 'jqFormIO' + (new Date().getTime()), fn = '_'+id; + window[fn] = function() { + var f = $io.data('form-plugin-onload'); + if (f) { + f(); + window[fn] = undefined; + try { delete window[fn]; } catch(e){} + } + } + var $io = $(''); + + var appendElem = jQuery('
    success...'); + appendElem.appendTo('.loadingWaitingMessage'); + setTimeout(hideLoading('#loadingWaiting'), 3000); + } + + // After Save Calls display + var appendElem = jQuery('
    success...'); + function finnish(){ + // hold msg for a min + setTimeout(function(){ + hideLoading('#loadingWaiting'); + appendElem.remove(); + updatestarted = 1; + }, 1200 ); + } + + function showResponse(data, responseText, statusText, xhr, $form){ + + // START of fill call to user + if (responseText === 'success') { + + // snort logs download success + if (data.downloadfilename !== '' && data.snortdownload === 'success'){ + downloadsnortlogs(data); + } + + // succsess display + if (data.snortgeneralsettings === 'success' || data.snortdelete === 'success' || data.snortreset === 'success'){ + // sucsses msg + appendElem.appendTo('.loadingWaitingMessage'); + + // Clean up Waiting code + finnish(); + + if (data.snortMiscTabCall === 'true'){ + jQuery.fn.miscTabCall(); // call tab misc functions + } + + if (data.snortreset) {location.reload();} // hard refresh + + } + + // END of fill call to user + }else{ + // On FAIL get some info back + //alert('responseText: \n' + data.responseText + 'FAIL'); + } + } + // END iform code + + // declare variable for iform + var options = { + beforeSubmit: showRequest, + dataType: 'json', + success: showResponse, + type: 'POST', + url: './snort_json_post.php' + }; + +}); // end of document ready + diff --git a/config/snort-dev/patches/SnortSam/TODAO.txt b/config/snort-dev/patches/SnortSam/TODAO.txt new file mode 100644 index 00000000..3abf0303 --- /dev/null +++ b/config/snort-dev/patches/SnortSam/TODAO.txt @@ -0,0 +1 @@ +Patch current snort 2.9 \ No newline at end of file diff --git a/config/snort-dev/patches/SnortSam/snortsam-2.8.6.1.diff b/config/snort-dev/patches/SnortSam/snortsam-2.8.6.1.diff new file mode 100644 index 00000000..983165e1 --- /dev/null +++ b/config/snort-dev/patches/SnortSam/snortsam-2.8.6.1.diff @@ -0,0 +1,3021 @@ +Index: snort-2.8.6.1/src/twofish.c +=================================================================== +--- snort-2.8.6.1/src/twofish.c (Revision 0) ++++ snort-2.8.6.1/src/twofish.c (Revision 3) +@@ -0,0 +1,971 @@ ++/* $Id: twofish.c,v 2.1 2008/12/15 20:36:05 fknobbe Exp $ ++ * ++ * ++ * Copyright (C) 1997-2000 The Cryptix Foundation Limited. ++ * Copyright (C) 2000 Farm9. ++ * Copyright (C) 2001 Frank Knobbe. ++ * All rights reserved. ++ * ++ * For Cryptix code: ++ * Use, modification, copying and distribution of this software is subject ++ * the terms and conditions of the Cryptix General Licence. You should have ++ * received a copy of the Cryptix General Licence along with this library; ++ * if not, you can download a copy from http://www.cryptix.org/ . ++ * ++ * For Farm9: ++ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and ++ * ciphertext stealing technique, added AsciiTwofish class for easy encryption ++ * decryption of text strings ++ * ++ * Frank Knobbe : ++ * --- April 2001, converted from C++ to C, prefixed global variables ++ * with TwoFish, substituted some defines, changed functions to make use of ++ * variables supplied in a struct, modified and added routines for modular calls. ++ * Cleaned up the code so that defines are used instead of fixed 16's and 32's. ++ * Created two general purpose crypt routines for one block and multiple block ++ * encryption using Joh's CBC code. ++ * Added crypt routines that use a header (with a magic and data length). ++ * (Basically a major rewrite). ++ * ++ * Note: Routines labeled _TwoFish are private and should not be used ++ * (or with extreme caution). ++ * ++ */ ++ ++#ifndef __TWOFISH_LIBRARY_SOURCE__ ++#define __TWOFISH_LIBRARY_SOURCE__ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#ifdef WIN32 ++ ++#ifndef u_long ++typedef unsigned long u_long; ++#endif ++#ifndef u_int32_t ++typedef unsigned long u_int32_t; ++#endif ++#ifndef u_word ++typedef unsigned short u_word; ++#endif ++#ifndef u_int16_t ++typedef unsigned short u_int16_t; ++#endif ++#ifndef u_char ++typedef unsigned char u_char; ++#endif ++#ifndef u_int8_t ++typedef unsigned char u_int8_t; ++#endif ++ ++#endif /* WIN32 */ ++ ++#include "twofish.h" ++ ++ ++bool TwoFish_srand=TRUE; /* if TRUE, first call of TwoFishInit will seed rand(); */ ++ /* of TwoFishInit */ ++ ++/* Fixed 8x8 permutation S-boxes */ ++static const u_int8_t TwoFish_P[2][256] = ++{ ++ { /* p0 */ ++ 0xA9, 0x67, 0xB3, 0xE8, 0x04, 0xFD, 0xA3, 0x76, 0x9A, 0x92, 0x80, 0x78, ++ 0xE4, 0xDD, 0xD1, 0x38, 0x0D, 0xC6, 0x35, 0x98, 0x18, 0xF7, 0xEC, 0x6C, ++ 0x43, 0x75, 0x37, 0x26, 0xFA, 0x13, 0x94, 0x48, 0xF2, 0xD0, 0x8B, 0x30, ++ 0x84, 0x54, 0xDF, 0x23, 0x19, 0x5B, 0x3D, 0x59, 0xF3, 0xAE, 0xA2, 0x82, ++ 0x63, 0x01, 0x83, 0x2E, 0xD9, 0x51, 0x9B, 0x7C, 0xA6, 0xEB, 0xA5, 0xBE, ++ 0x16, 0x0C, 0xE3, 0x61, 0xC0, 0x8C, 0x3A, 0xF5, 0x73, 0x2C, 0x25, 0x0B, ++ 0xBB, 0x4E, 0x89, 0x6B, 0x53, 0x6A, 0xB4, 0xF1, 0xE1, 0xE6, 0xBD, 0x45, ++ 0xE2, 0xF4, 0xB6, 0x66, 0xCC, 0x95, 0x03, 0x56, 0xD4, 0x1C, 0x1E, 0xD7, ++ 0xFB, 0xC3, 0x8E, 0xB5, 0xE9, 0xCF, 0xBF, 0xBA, 0xEA, 0x77, 0x39, 0xAF, ++ 0x33, 0xC9, 0x62, 0x71, 0x81, 0x79, 0x09, 0xAD, 0x24, 0xCD, 0xF9, 0xD8, ++ 0xE5, 0xC5, 0xB9, 0x4D, 0x44, 0x08, 0x86, 0xE7, 0xA1, 0x1D, 0xAA, 0xED, ++ 0x06, 0x70, 0xB2, 0xD2, 0x41, 0x7B, 0xA0, 0x11, 0x31, 0xC2, 0x27, 0x90, ++ 0x20, 0xF6, 0x60, 0xFF, 0x96, 0x5C, 0xB1, 0xAB, 0x9E, 0x9C, 0x52, 0x1B, ++ 0x5F, 0x93, 0x0A, 0xEF, 0x91, 0x85, 0x49, 0xEE, 0x2D, 0x4F, 0x8F, 0x3B, ++ 0x47, 0x87, 0x6D, 0x46, 0xD6, 0x3E, 0x69, 0x64, 0x2A, 0xCE, 0xCB, 0x2F, ++ 0xFC, 0x97, 0x05, 0x7A, 0xAC, 0x7F, 0xD5, 0x1A, 0x4B, 0x0E, 0xA7, 0x5A, ++ 0x28, 0x14, 0x3F, 0x29, 0x88, 0x3C, 0x4C, 0x02, 0xB8, 0xDA, 0xB0, 0x17, ++ 0x55, 0x1F, 0x8A, 0x7D, 0x57, 0xC7, 0x8D, 0x74, 0xB7, 0xC4, 0x9F, 0x72, ++ 0x7E, 0x15, 0x22, 0x12, 0x58, 0x07, 0x99, 0x34, 0x6E, 0x50, 0xDE, 0x68, ++ 0x65, 0xBC, 0xDB, 0xF8, 0xC8, 0xA8, 0x2B, 0x40, 0xDC, 0xFE, 0x32, 0xA4, ++ 0xCA, 0x10, 0x21, 0xF0, 0xD3, 0x5D, 0x0F, 0x00, 0x6F, 0x9D, 0x36, 0x42, ++ 0x4A, 0x5E, 0xC1, 0xE0 ++ }, ++ { /* p1 */ ++ 0x75, 0xF3, 0xC6, 0xF4, 0xDB, 0x7B, 0xFB, 0xC8, 0x4A, 0xD3, 0xE6, 0x6B, ++ 0x45, 0x7D, 0xE8, 0x4B, 0xD6, 0x32, 0xD8, 0xFD, 0x37, 0x71, 0xF1, 0xE1, ++ 0x30, 0x0F, 0xF8, 0x1B, 0x87, 0xFA, 0x06, 0x3F, 0x5E, 0xBA, 0xAE, 0x5B, ++ 0x8A, 0x00, 0xBC, 0x9D, 0x6D, 0xC1, 0xB1, 0x0E, 0x80, 0x5D, 0xD2, 0xD5, ++ 0xA0, 0x84, 0x07, 0x14, 0xB5, 0x90, 0x2C, 0xA3, 0xB2, 0x73, 0x4C, 0x54, ++ 0x92, 0x74, 0x36, 0x51, 0x38, 0xB0, 0xBD, 0x5A, 0xFC, 0x60, 0x62, 0x96, ++ 0x6C, 0x42, 0xF7, 0x10, 0x7C, 0x28, 0x27, 0x8C, 0x13, 0x95, 0x9C, 0xC7, ++ 0x24, 0x46, 0x3B, 0x70, 0xCA, 0xE3, 0x85, 0xCB, 0x11, 0xD0, 0x93, 0xB8, ++ 0xA6, 0x83, 0x20, 0xFF, 0x9F, 0x77, 0xC3, 0xCC, 0x03, 0x6F, 0x08, 0xBF, ++ 0x40, 0xE7, 0x2B, 0xE2, 0x79, 0x0C, 0xAA, 0x82, 0x41, 0x3A, 0xEA, 0xB9, ++ 0xE4, 0x9A, 0xA4, 0x97, 0x7E, 0xDA, 0x7A, 0x17, 0x66, 0x94, 0xA1, 0x1D, ++ 0x3D, 0xF0, 0xDE, 0xB3, 0x0B, 0x72, 0xA7, 0x1C, 0xEF, 0xD1, 0x53, 0x3E, ++ 0x8F, 0x33, 0x26, 0x5F, 0xEC, 0x76, 0x2A, 0x49, 0x81, 0x88, 0xEE, 0x21, ++ 0xC4, 0x1A, 0xEB, 0xD9, 0xC5, 0x39, 0x99, 0xCD, 0xAD, 0x31, 0x8B, 0x01, ++ 0x18, 0x23, 0xDD, 0x1F, 0x4E, 0x2D, 0xF9, 0x48, 0x4F, 0xF2, 0x65, 0x8E, ++ 0x78, 0x5C, 0x58, 0x19, 0x8D, 0xE5, 0x98, 0x57, 0x67, 0x7F, 0x05, 0x64, ++ 0xAF, 0x63, 0xB6, 0xFE, 0xF5, 0xB7, 0x3C, 0xA5, 0xCE, 0xE9, 0x68, 0x44, ++ 0xE0, 0x4D, 0x43, 0x69, 0x29, 0x2E, 0xAC, 0x15, 0x59, 0xA8, 0x0A, 0x9E, ++ 0x6E, 0x47, 0xDF, 0x34, 0x35, 0x6A, 0xCF, 0xDC, 0x22, 0xC9, 0xC0, 0x9B, ++ 0x89, 0xD4, 0xED, 0xAB, 0x12, 0xA2, 0x0D, 0x52, 0xBB, 0x02, 0x2F, 0xA9, ++ 0xD7, 0x61, 0x1E, 0xB4, 0x50, 0x04, 0xF6, 0xC2, 0x16, 0x25, 0x86, 0x56, ++ 0x55, 0x09, 0xBE, 0x91 ++ } ++}; ++ ++static bool TwoFish_MDSready=FALSE; ++static u_int32_t TwoFish_MDS[4][256]; /* TwoFish_MDS matrix */ ++ ++ ++#define TwoFish_LFSR1(x) (((x)>>1)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/2:0)) ++#define TwoFish_LFSR2(x) (((x)>>2)^(((x)&0x02)?TwoFish_MDS_GF_FDBK/2:0)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/4:0)) ++ ++#define TwoFish_Mx_1(x) ((u_int32_t)(x)) /* force result to dword so << will work */ ++#define TwoFish_Mx_X(x) ((u_int32_t)((x)^TwoFish_LFSR2(x))) /* 5B */ ++#define TwoFish_Mx_Y(x) ((u_int32_t)((x)^TwoFish_LFSR1(x)^TwoFish_LFSR2(x))) /* EF */ ++#define TwoFish_RS_rem(x) { u_int8_t b=(u_int8_t)(x>>24); u_int32_t g2=((b<<1)^((b&0x80)?TwoFish_RS_GF_FDBK:0))&0xFF; u_int32_t g3=((b>>1)&0x7F)^((b&1)?TwoFish_RS_GF_FDBK>>1:0)^g2; x=(x<<8)^(g3<<24)^(g2<<16)^(g3<<8)^b; } ++ ++/*#define TwoFish__b(x,N) (((u_int8_t *)&x)[((N)&3)^TwoFish_ADDR_XOR])*/ /* pick bytes out of a dword */ ++ ++#define TwoFish_b0(x) TwoFish__b(x,0) /* extract LSB of u_int32_t */ ++#define TwoFish_b1(x) TwoFish__b(x,1) ++#define TwoFish_b2(x) TwoFish__b(x,2) ++#define TwoFish_b3(x) TwoFish__b(x,3) /* extract MSB of u_int32_t */ ++ ++u_int8_t TwoFish__b(u_int32_t x,int n) ++{ n&=3; ++ while(n-->0) ++ x>>=8; ++ return (u_int8_t)x; ++} ++ ++ ++/* TwoFish Initialization ++ * ++ * This routine generates a global data structure for use with TwoFish, ++ * initializes important values (such as subkeys, sBoxes), generates subkeys ++ * and precomputes the MDS matrix if not already done. ++ * ++ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!') ++ * ++ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data. ++ * This pointer is used with all other crypt functions. ++ */ ++ ++TWOFISH *TwoFishInit(char *userkey) ++{ TWOFISH *tfdata; ++ int i,x,m; ++ char tkey[TwoFish_KEY_LENGTH+40]; ++ ++ tfdata=malloc(sizeof(TWOFISH)); /* allocate the TwoFish structure */ ++ if(tfdata!=NULL) ++ { if(*userkey) ++ { strncpy(tkey,userkey,TwoFish_KEY_LENGTH); /* use first 32 chars of user supplied password */ ++ tkey[TwoFish_KEY_LENGTH]=0; /* make sure it wasn't more */ ++ } ++ else ++ strcpy(tkey,TwoFish_DEFAULT_PW); /* if no key defined, use default password */ ++ for(i=0,x=0,m=strlen(tkey);ikey[i]=tkey[x++]; /* fill the whole keyspace with repeating key. */ ++ if(x==m) ++ x=0; ++ } ++ ++ if(!TwoFish_MDSready) ++ _TwoFish_PrecomputeMDSmatrix(); /* "Wake Up, Neo" */ ++ _TwoFish_MakeSubKeys(tfdata); /* generate subkeys */ ++ _TwoFish_ResetCBC(tfdata); /* reset the CBC */ ++ tfdata->output=NULL; /* nothing to output yet */ ++ tfdata->dontflush=FALSE; /* reset decrypt skip block flag */ ++ if(TwoFish_srand) ++ { TwoFish_srand=FALSE; ++ srand(time(NULL)); ++ } ++ } ++ return tfdata; /* return the data pointer */ ++} ++ ++ ++void TwoFishDestroy(TWOFISH *tfdata) ++{ if(tfdata!=NULL) ++ free(tfdata); ++} ++ ++ ++/* en/decryption with CBC mode */ ++unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) ++{ unsigned long rl; ++ ++ rl=len; /* remember how much data to crypt. */ ++ while(len>TwoFish_BLOCK_SIZE) /* and now we process block by block. */ ++ { _TwoFish_BlockCrypt(in,out,TwoFish_BLOCK_SIZE,decrypt,tfdata); /* de/encrypt it. */ ++ in+=TwoFish_BLOCK_SIZE; /* adjust pointers. */ ++ out+=TwoFish_BLOCK_SIZE; ++ len-=TwoFish_BLOCK_SIZE; ++ } ++ if(len>0) /* if we have less than a block left... */ ++ _TwoFish_BlockCrypt(in,out,len,decrypt,tfdata); /* ...then we de/encrypt that too. */ ++ if(tfdata->qBlockDefined && !tfdata->dontflush) /* in case len was exactly one block... */ ++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); /* ...we need to write the... */ ++ /* ...remaining bytes of the buffer */ ++ return rl; ++} ++ ++/* en/decryption on one block only */ ++unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) ++{ /* qBlockPlain already zero'ed through ResetCBC */ ++ memcpy(tfdata->qBlockPlain,in,len); /* toss the data into it. */ ++ _TwoFish_BlockCrypt16(tfdata->qBlockPlain,tfdata->qBlockCrypt,decrypt,tfdata); /* encrypt just that block without CBC. */ ++ memcpy(out,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE); /* and return what we got */ ++ return TwoFish_BLOCK_SIZE; ++} ++ ++/* en/decryption without reset of CBC and output assignment */ ++unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata) ++{ ++ if(in!=NULL && out!=NULL && len>0 && tfdata!=NULL) /* if we have valid data, then... */ ++ { if(len>TwoFish_BLOCK_SIZE) /* ...check if we have more than one block. */ ++ return _TwoFish_CryptRawCBC(in,out,len,decrypt,tfdata); /* if so, use the CBC routines... */ ++ else ++ return _TwoFish_CryptRaw16(in,out,len,decrypt,tfdata); /* ...otherwise just do one block. */ ++ } ++ return 0; ++} ++ ++ ++/* TwoFish Raw Encryption ++ * ++ * Does not use header, but does use CBC (if more than one block has to be encrypted). ++ * ++ * Input: Pointer to the buffer of the plaintext to be encrypted. ++ * Pointer to the buffer receiving the ciphertext. ++ * The length of the plaintext buffer. ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes encrypted if successful, otherwise 0. ++ */ ++ ++unsigned long TwoFishEncryptRaw(char *in, ++ char *out, ++ unsigned long len, ++ TWOFISH *tfdata) ++{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */ ++ tfdata->output=out; /* output straight into output buffer. */ ++ return _TwoFish_CryptRaw(in,out,len,FALSE,tfdata); /* and go for it. */ ++} ++ ++/* TwoFish Raw Decryption ++ * ++ * Does not use header, but does use CBC (if more than one block has to be decrypted). ++ * ++ * Input: Pointer to the buffer of the ciphertext to be decrypted. ++ * Pointer to the buffer receiving the plaintext. ++ * The length of the ciphertext buffer (at least one cipher block). ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes decrypted if successful, otherwise 0. ++ */ ++ ++unsigned long TwoFishDecryptRaw(char *in, ++ char *out, ++ unsigned long len, ++ TWOFISH *tfdata) ++{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */ ++ tfdata->output=out; /* output straight into output buffer. */ ++ return _TwoFish_CryptRaw(in,out,len,TRUE,tfdata); /* and go for it. */ ++} ++ ++/* TwoFish Free ++ * ++ * Free's the allocated buffer. ++ * ++ * Input: Pointer to the TwoFish structure ++ * ++ * Output: (none) ++ */ ++ ++void TwoFishFree(TWOFISH *tfdata) ++{ if(tfdata->output!=NULL) /* if a valid buffer is present... */ ++ { free(tfdata->output); /* ...then we free it for you... */ ++ tfdata->output=NULL; /* ...and mark as such. */ ++ } ++} ++ ++/* TwoFish Set Output ++ * ++ * If you want to allocate the output buffer yourself, ++ * then you can set it with this function. ++ * ++ * Input: Pointer to your output buffer ++ * Pointer to the TwoFish structure ++ * ++ * Output: (none) ++ */ ++ ++void TwoFishSetOutput(char *outp,TWOFISH *tfdata) ++{ tfdata->output=outp; /* (do we really need a function for this?) */ ++} ++ ++/* TwoFish Alloc ++ * ++ * Allocates enough memory for the output buffer that would be required ++ * ++ * Input: Length of the plaintext. ++ * Boolean flag for BinHex Output. ++ * Pointer to the TwoFish structure. ++ * ++ * Output: Returns a pointer to the memory allocated. ++ */ ++ ++void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata) ++{ ++/* TwoFishFree(tfdata); */ /* (don't for now) discard whatever was allocated earlier. */ ++ if(decrypt) /* if decrypting... */ ++ { if(binhex) /* ...and input is binhex encoded... */ ++ len/=2; /* ...use half as much for output. */ ++ len-=TwoFish_BLOCK_SIZE; /* Also, subtract the size of the header. */ ++ } ++ else ++ { len+=TwoFish_BLOCK_SIZE; /* the size is just increased by the header... */ ++ if(binhex) ++ len*=2; /* ...and doubled if output is to be binhexed. */ ++ } ++ tfdata->output=malloc(len+TwoFish_BLOCK_SIZE);/* grab some memory...plus some extra (it's running over somewhere, crashes without extra padding) */ ++ ++ return tfdata->output; /* ...and return to caller. */ ++} ++ ++/* bin2hex and hex2bin conversion */ ++void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex) ++{ u_int8_t *pi,*po,c; ++ ++ if(bintohex) ++ { for(pi=buf+len-1,po=buf+(2*len)-1;len>0;pi--,po--,len--) /* let's start from the end of the bin block. */ ++ { c=*pi; /* grab value. */ ++ c&=15; /* use lower 4 bits. */ ++ if(c>9) /* convert to ascii. */ ++ c+=('a'-10); ++ else ++ c+='0'; ++ *po--=c; /* set the lower nibble. */ ++ c=*pi; /* grab value again. */ ++ c>>=4; /* right shift 4 bits. */ ++ c&=15; /* make sure we only have 4 bits. */ ++ if(c>9) /* convert to ascii. */ ++ c+=('a'-10); ++ else ++ c+='0'; ++ *po=c; /* set the higher nibble. */ ++ } /* and keep going. */ ++ } ++ else ++ { for(pi=buf,po=buf;len>0;pi++,po++,len-=2) /* let's start from the beginning of the hex block. */ ++ { c=tolower(*pi++)-'0'; /* grab higher nibble. */ ++ if(c>9) /* convert to value. */ ++ c-=('0'-9); ++ *po=c<<4; /* left shit 4 bits. */ ++ c=tolower(*pi)-'0'; /* grab lower nibble. */ ++ if(c>9) /* convert to value. */ ++ c-=('0'-9); ++ *po|=c; /* and add to value. */ ++ } ++ } ++} ++ ++ ++/* TwoFish Encryption ++ * ++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, ++ * this routine will alloc the memory. In addition, it will include a small 'header' ++ * containing the magic and some salt. That way the decrypt routine can check if the ++ * packet got decrypted successfully, and return 0 instead of garbage. ++ * ++ * Input: Pointer to the buffer of the plaintext to be encrypted. ++ * Pointer to the pointer to the buffer receiving the ciphertext. ++ * The pointer either points to user allocated output buffer space, or to NULL, in which case ++ * this routine will set the pointer to the buffer allocated through the struct. ++ * The length of the plaintext buffer. ++ * Can be -1 if the input is a null terminated string, in which case we'll count for you. ++ * Boolean flag for BinHex Output (if used, output will be twice as large as input). ++ * Note: BinHex conversion overwrites (converts) input buffer! ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes encrypted if successful, otherwise 0. ++ */ ++ ++unsigned long TwoFishEncrypt(char *in, ++ char **out, ++ signed long len, ++ bool binhex, ++ TWOFISH *tfdata) ++{ unsigned long ilen,olen; ++ ++ ++ if(len== -1) /* if we got -1 for len, we'll assume IN is a... */ ++ ilen=strlen(in); /* ...\0 terminated string and figure len out ourselves... */ ++ else ++ ilen=len; /* ...otherwise we trust you supply a correct length. */ ++ ++ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */ ++ { if(*out==NULL) /* if OUT points to a NULL pointer... */ ++ *out=TwoFishAlloc(ilen,binhex,FALSE,tfdata); /* ...we'll (re-)allocate buffer space. */ ++ if(*out!=NULL) ++ { tfdata->output=*out; /* set output buffer. */ ++ tfdata->header.salt=rand()*65536+rand(); /* toss in some salt. */ ++ tfdata->header.length[0]= (u_int8_t)(ilen); ++ tfdata->header.length[1]= (u_int8_t)(ilen>>8); ++ tfdata->header.length[2]= (u_int8_t)(ilen>>16); ++ tfdata->header.length[3]= (u_int8_t)(ilen>>24); ++ memcpy(tfdata->header.magic,TwoFish_MAGIC,TwoFish_MAGIC_LEN); /* set the magic. */ ++ olen=TwoFish_BLOCK_SIZE; /* set output counter. */ ++ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag */ ++ _TwoFish_BlockCrypt((u_int8_t *)&(tfdata->header),*out,olen,FALSE,tfdata); /* encrypt first block (without flush on 16 byte boundary). */ ++ olen+=_TwoFish_CryptRawCBC(in,*out+TwoFish_BLOCK_SIZE,ilen,FALSE,tfdata); /* and encrypt the rest (we do not reset the CBC flag). */ ++ if(binhex) /* if binhex... */ ++ { _TwoFish_BinHex(*out,olen,TRUE); /* ...convert output to binhex... */ ++ olen*=2; /* ...and size twice as large. */ ++ } ++ tfdata->output=*out; ++ return olen; ++ } ++ } ++ return 0; ++} ++ ++/* TwoFish Decryption ++ * ++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, ++ * this routine will alloc the memory. In addition, it will check the small 'header' ++ * containing the magic. If magic does not match we return 0. Otherwise we return the ++ * amount of bytes decrypted (should be the same as the length in the header). ++ * ++ * Input: Pointer to the buffer of the ciphertext to be decrypted. ++ * Pointer to the pointer to the buffer receiving the plaintext. ++ * The pointer either points to user allocated output buffer space, or to NULL, in which case ++ * this routine will set the pointer to the buffer allocated through the struct. ++ * The length of the ciphertext buffer. ++ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you. ++ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input). ++ * Note: BinHex conversion overwrites (converts) input buffer! ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes decrypted if successful, otherwise 0. ++ */ ++ ++unsigned long TwoFishDecrypt(char *in, ++ char **out, ++ signed long len, ++ bool binhex, ++ TWOFISH *tfdata) ++{ unsigned long ilen,elen,olen; ++ const u_int8_t cmagic[TwoFish_MAGIC_LEN]=TwoFish_MAGIC; ++ u_int8_t *tbuf; ++ ++ ++ ++ if(len== -1) /* if we got -1 for len, we'll assume IN is... */ ++ ilen=strlen(in); /* ...\0 terminated binhex and figure len out ourselves... */ ++ else ++ ilen=len; /* ...otherwise we trust you supply a correct length. */ ++ ++ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */ ++ { if(*out==NULL) /* if OUT points to a NULL pointer... */ ++ *out=TwoFishAlloc(ilen,binhex,TRUE,tfdata); /* ...we'll (re-)allocate buffer space. */ ++ if(*out!=NULL) ++ { if(binhex) /* if binhex... */ ++ { _TwoFish_BinHex(in,ilen,FALSE); /* ...convert input to values... */ ++ ilen/=2; /* ...and size half as much. */ ++ } ++ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag. */ ++ ++ tbuf=(u_int8_t *)malloc(ilen+TwoFish_BLOCK_SIZE); /* get memory for data and header. */ ++ if(tbuf==NULL) ++ return 0; ++ tfdata->output=tbuf; /* set output to temp buffer. */ ++ ++ olen=_TwoFish_CryptRawCBC(in,tbuf,ilen,TRUE,tfdata)-TwoFish_BLOCK_SIZE; /* decrypt the whole thing. */ ++ memcpy(&(tfdata->header),tbuf,TwoFish_BLOCK_SIZE); /* copy first block into header. */ ++ tfdata->output=*out; ++ for(elen=0;elenheader.magic[elen]!=cmagic[elen]) ++ break; ++ if(elen==TwoFish_MAGIC_LEN) /* if magic matches then... */ ++ { elen=(tfdata->header.length[0]) | ++ (tfdata->header.length[1])<<8 | ++ (tfdata->header.length[2])<<16 | ++ (tfdata->header.length[3])<<24; /* .. we know how much to expect. */ ++ if(elen>olen) /* adjust if necessary. */ ++ elen=olen; ++ memcpy(*out,tbuf+TwoFish_BLOCK_SIZE,elen); /* copy data into intended output. */ ++ free(tbuf); ++ return elen; ++ } ++ free(tbuf); ++ } ++ } ++ return 0; ++} ++ ++void _TwoFish_PrecomputeMDSmatrix(void) /* precompute the TwoFish_MDS matrix */ ++{ u_int32_t m1[2]; ++ u_int32_t mX[2]; ++ u_int32_t mY[2]; ++ u_int32_t i, j; ++ ++ for (i = 0; i < 256; i++) ++ { j = TwoFish_P[0][i] & 0xFF; /* compute all the matrix elements */ ++ m1[0] = j; ++ mX[0] = TwoFish_Mx_X( j ) & 0xFF; ++ mY[0] = TwoFish_Mx_Y( j ) & 0xFF; ++ ++ j = TwoFish_P[1][i] & 0xFF; ++ m1[1] = j; ++ mX[1] = TwoFish_Mx_X( j ) & 0xFF; ++ mY[1] = TwoFish_Mx_Y( j ) & 0xFF; ++ ++ TwoFish_MDS[0][i] = m1[TwoFish_P_00] | /* fill matrix w/ above elements */ ++ mX[TwoFish_P_00] << 8 | ++ mY[TwoFish_P_00] << 16 | ++ mY[TwoFish_P_00] << 24; ++ TwoFish_MDS[1][i] = mY[TwoFish_P_10] | ++ mY[TwoFish_P_10] << 8 | ++ mX[TwoFish_P_10] << 16 | ++ m1[TwoFish_P_10] << 24; ++ TwoFish_MDS[2][i] = mX[TwoFish_P_20] | ++ mY[TwoFish_P_20] << 8 | ++ m1[TwoFish_P_20] << 16 | ++ mY[TwoFish_P_20] << 24; ++ TwoFish_MDS[3][i] = mX[TwoFish_P_30] | ++ m1[TwoFish_P_30] << 8 | ++ mY[TwoFish_P_30] << 16 | ++ mX[TwoFish_P_30] << 24; ++ } ++ TwoFish_MDSready=TRUE; ++} ++ ++ ++void _TwoFish_MakeSubKeys(TWOFISH *tfdata) /* Expand a user-supplied key material into a session key. */ ++{ u_int32_t k64Cnt = TwoFish_KEY_LENGTH / 8; ++ u_int32_t k32e[4]; /* even 32-bit entities */ ++ u_int32_t k32o[4]; /* odd 32-bit entities */ ++ u_int32_t sBoxKey[4]; ++ u_int32_t offset,i,j; ++ u_int32_t A, B, q=0; ++ u_int32_t k0,k1,k2,k3; ++ u_int32_t b0,b1,b2,b3; ++ ++ /* split user key material into even and odd 32-bit entities and */ ++ /* compute S-box keys using (12, 8) Reed-Solomon code over GF(256) */ ++ ++ ++ for (offset=0,i=0,j=k64Cnt-1;i<4 && offsetkey[offset++]; ++ k32e[i]|= tfdata->key[offset++]<<8; ++ k32e[i]|= tfdata->key[offset++]<<16; ++ k32e[i]|= tfdata->key[offset++]<<24; ++ k32o[i] = tfdata->key[offset++]; ++ k32o[i]|= tfdata->key[offset++]<<8; ++ k32o[i]|= tfdata->key[offset++]<<16; ++ k32o[i]|= tfdata->key[offset++]<<24; ++ sBoxKey[j] = _TwoFish_RS_MDS_Encode( k32e[i], k32o[i] ); /* reverse order */ ++ } ++ ++ /* compute the round decryption subkeys for PHT. these same subkeys */ ++ /* will be used in encryption but will be applied in reverse order. */ ++ i=0; ++ while(i < TwoFish_TOTAL_SUBKEYS) ++ { A = _TwoFish_F32( k64Cnt, q, k32e ); /* A uses even key entities */ ++ q += TwoFish_SK_BUMP; ++ ++ B = _TwoFish_F32( k64Cnt, q, k32o ); /* B uses odd key entities */ ++ q += TwoFish_SK_BUMP; ++ ++ B = B << 8 | B >> 24; ++ ++ A += B; ++ tfdata->subKeys[i++] = A; /* combine with a PHT */ ++ ++ A += B; ++ tfdata->subKeys[i++] = A << TwoFish_SK_ROTL | A >> (32-TwoFish_SK_ROTL); ++ } ++ ++ /* fully expand the table for speed */ ++ k0 = sBoxKey[0]; ++ k1 = sBoxKey[1]; ++ k2 = sBoxKey[2]; ++ k3 = sBoxKey[3]; ++ ++ for (i = 0; i < 256; i++) ++ { b0 = b1 = b2 = b3 = i; ++ switch (k64Cnt & 3) ++ { case 1: /* 64-bit keys */ ++ tfdata->sBox[ 2*i ] = TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0]) ^ TwoFish_b0(k0)]; ++ tfdata->sBox[ 2*i+1] = TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1]) ^ TwoFish_b1(k0)]; ++ tfdata->sBox[0x200+2*i ] = TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2]) ^ TwoFish_b2(k0)]; ++ tfdata->sBox[0x200+2*i+1] = TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3]) ^ TwoFish_b3(k0)]; ++ break; ++ case 0: /* 256-bit keys (same as 4) */ ++ b0 = (TwoFish_P[TwoFish_P_04][b0]) ^ TwoFish_b0(k3); ++ b1 = (TwoFish_P[TwoFish_P_14][b1]) ^ TwoFish_b1(k3); ++ b2 = (TwoFish_P[TwoFish_P_24][b2]) ^ TwoFish_b2(k3); ++ b3 = (TwoFish_P[TwoFish_P_34][b3]) ^ TwoFish_b3(k3); ++ case 3: /* 192-bit keys */ ++ b0 = (TwoFish_P[TwoFish_P_03][b0]) ^ TwoFish_b0(k2); ++ b1 = (TwoFish_P[TwoFish_P_13][b1]) ^ TwoFish_b1(k2); ++ b2 = (TwoFish_P[TwoFish_P_23][b2]) ^ TwoFish_b2(k2); ++ b3 = (TwoFish_P[TwoFish_P_33][b3]) ^ TwoFish_b3(k2); ++ case 2: /* 128-bit keys */ ++ tfdata->sBox[ 2*i ]= ++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0]) ^ ++ TwoFish_b0(k1)]) ^ TwoFish_b0(k0)]; ++ ++ tfdata->sBox[ 2*i+1]= ++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1]) ^ ++ TwoFish_b1(k1)]) ^ TwoFish_b1(k0)]; ++ ++ tfdata->sBox[0x200+2*i ]= ++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2]) ^ ++ TwoFish_b2(k1)]) ^ TwoFish_b2(k0)]; ++ ++ tfdata->sBox[0x200+2*i+1]= ++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3]) ^ ++ TwoFish_b3(k1)]) ^ TwoFish_b3(k0)]; ++ } ++ } ++} ++ ++ ++/** ++ * Encrypt or decrypt exactly one block of plaintext in CBC mode. ++ * Use "ciphertext stealing" technique described on pg. 196 ++ * of "Applied Cryptography" to encrypt the final partial ++ * (i.e. <16 byte) block if necessary. ++ * ++ * jojo: the "ciphertext stealing" requires we read ahead and have ++ * special handling for the last two blocks. Because of this, the ++ * output from the TwoFish algorithm is handled internally here. ++ * It would be better to have a higher level handle this as well as ++ * CBC mode. Unfortunately, I've mixed the two together, which is ++ * pretty crappy... The Java version separates these out correctly. ++ * ++ * fknobbe: I have reduced the CBC mode to work on memory buffer only. ++ * Higher routines should use an intermediate buffer and handle ++ * their output seperately (mainly so the data can be flushed ++ * in one chunk, not seperate 16 byte blocks...) ++ * ++ * @param in The plaintext. ++ * @param out The ciphertext ++ * @param size how much to encrypt ++ * @param tfdata: Pointer to the global data structure containing session keys. ++ * @return none ++ */ ++void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata) ++{ u_int8_t PnMinusOne[TwoFish_BLOCK_SIZE]; ++ u_int8_t CnMinusOne[TwoFish_BLOCK_SIZE]; ++ u_int8_t CBCplusCprime[TwoFish_BLOCK_SIZE]; ++ u_int8_t Pn[TwoFish_BLOCK_SIZE]; ++ u_int8_t *p,*pout; ++ unsigned long i; ++ ++ /* here is where we implement CBC mode and cipher block stealing */ ++ if(size==TwoFish_BLOCK_SIZE) ++ { /* if we are encrypting, CBC means we XOR the plain text block with the */ ++ /* previous cipher text block before encrypting */ ++ if(!decrypt && tfdata->qBlockDefined) ++ { for(p=in,i=0;iqBlockCrypt[i]; /* FK: I'm copying the xor'ed input into Pn... */ ++ } ++ else ++ memcpy(Pn,in,TwoFish_BLOCK_SIZE); /* FK: same here. we work of Pn all the time. */ ++ ++ /* TwoFish block level encryption or decryption */ ++ _TwoFish_BlockCrypt16(Pn,out,decrypt,tfdata); ++ ++ /* if we are decrypting, CBC means we XOR the result of the decryption */ ++ /* with the previous cipher text block to get the resulting plain text */ ++ if(decrypt && tfdata->qBlockDefined) ++ { for (p=out,i=0;iqBlockPlain[i]; ++ } ++ ++ /* save the input and output blocks, since CBC needs these for XOR */ ++ /* operations */ ++ _TwoFish_qBlockPush(Pn,out,tfdata); ++ } ++ else ++ { /* cipher block stealing, we are at Pn, */ ++ /* but since Cn-1 must now be replaced with CnC' */ ++ /* we pop it off, and recalculate Cn-1 */ ++ ++ if(decrypt) ++ { /* We are on an odd block, and had to do cipher block stealing, */ ++ /* so the PnMinusOne has to be derived differently. */ ++ ++ /* First we decrypt it into CBC and C' */ ++ _TwoFish_qBlockPop(CnMinusOne,PnMinusOne,tfdata); ++ _TwoFish_BlockCrypt16(CnMinusOne,CBCplusCprime,decrypt,tfdata); ++ ++ /* we then xor the first few bytes with the "in" bytes (Cn) */ ++ /* to recover Pn, which we put in out */ ++ for(p=in,pout=out,i=0;iprevCipher[i]; ++ ++ /* So at this point, out has PnMinusOne */ ++ _TwoFish_qBlockPush(CnMinusOne,PnMinusOne,tfdata); ++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); ++ _TwoFish_FlushOutput(out,size,tfdata); ++ } ++ else ++ { _TwoFish_qBlockPop(PnMinusOne,CnMinusOne,tfdata); ++ memset(Pn,0,TwoFish_BLOCK_SIZE); ++ memcpy(Pn,in,size); ++ for(i=0;iqBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); ++ _TwoFish_FlushOutput(CnMinusOne,size,tfdata); /* old Cn-1 becomes new partial Cn */ ++ } ++ tfdata->qBlockDefined=FALSE; ++ } ++} ++ ++void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata) ++{ if(tfdata->qBlockDefined) ++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); ++ memcpy(tfdata->prevCipher,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE); ++ memcpy(tfdata->qBlockPlain,p,TwoFish_BLOCK_SIZE); ++ memcpy(tfdata->qBlockCrypt,c,TwoFish_BLOCK_SIZE); ++ tfdata->qBlockDefined=TRUE; ++} ++ ++void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata) ++{ memcpy(p,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE ); ++ memcpy(c,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE ); ++ tfdata->qBlockDefined=FALSE; ++} ++ ++/* Reset's the CBC flag and zero's PrevCipher (through qBlockPlain) (important) */ ++void _TwoFish_ResetCBC(TWOFISH *tfdata) ++{ tfdata->qBlockDefined=FALSE; ++ memset(tfdata->qBlockPlain,0,TwoFish_BLOCK_SIZE); ++} ++ ++void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata) ++{ unsigned long i; ++ ++ for(i=0;idontflush;i++) ++ *tfdata->output++ = *b++; ++ tfdata->dontflush=FALSE; ++} ++ ++void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata) ++{ u_int32_t x0,x1,x2,x3; ++ u_int32_t k,t0,t1,R; ++ ++ ++ x0=*in++; ++ x0|=(*in++ << 8 ); ++ x0|=(*in++ << 16); ++ x0|=(*in++ << 24); ++ x1=*in++; ++ x1|=(*in++ << 8 ); ++ x1|=(*in++ << 16); ++ x1|=(*in++ << 24); ++ x2=*in++; ++ x2|=(*in++ << 8 ); ++ x2|=(*in++ << 16); ++ x2|=(*in++ << 24); ++ x3=*in++; ++ x3|=(*in++ << 8 ); ++ x3|=(*in++ << 16); ++ x3|=(*in++ << 24); ++ ++ if(decrypt) ++ { x0 ^= tfdata->subKeys[4]; /* swap input and output whitening keys when decrypting */ ++ x1 ^= tfdata->subKeys[5]; ++ x2 ^= tfdata->subKeys[6]; ++ x3 ^= tfdata->subKeys[7]; ++ ++ k = 7+(TwoFish_ROUNDS*2); ++ for (R = 0; R < TwoFish_ROUNDS; R += 2) ++ { t0 = _TwoFish_Fe320( tfdata->sBox, x0); ++ t1 = _TwoFish_Fe323( tfdata->sBox, x1); ++ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k--]; ++ x3 = x3 >> 1 | x3 << 31; ++ x2 = x2 << 1 | x2 >> 31; ++ x2 ^= t0 + t1 + tfdata->subKeys[k--]; ++ ++ t0 = _TwoFish_Fe320( tfdata->sBox, x2); ++ t1 = _TwoFish_Fe323( tfdata->sBox, x3); ++ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k--]; ++ x1 = x1 >> 1 | x1 << 31; ++ x0 = x0 << 1 | x0 >> 31; ++ x0 ^= t0 + t1 + tfdata->subKeys[k--]; ++ } ++ ++ x2 ^= tfdata->subKeys[0]; ++ x3 ^= tfdata->subKeys[1]; ++ x0 ^= tfdata->subKeys[2]; ++ x1 ^= tfdata->subKeys[3]; ++ } ++ else ++ { x0 ^= tfdata->subKeys[0]; ++ x1 ^= tfdata->subKeys[1]; ++ x2 ^= tfdata->subKeys[2]; ++ x3 ^= tfdata->subKeys[3]; ++ ++ k = 8; ++ for (R = 0; R < TwoFish_ROUNDS; R += 2) ++ { t0 = _TwoFish_Fe320( tfdata->sBox, x0); ++ t1 = _TwoFish_Fe323( tfdata->sBox, x1); ++ x2 ^= t0 + t1 + tfdata->subKeys[k++]; ++ x2 = x2 >> 1 | x2 << 31; ++ x3 = x3 << 1 | x3 >> 31; ++ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k++]; ++ ++ t0 = _TwoFish_Fe320( tfdata->sBox, x2); ++ t1 = _TwoFish_Fe323( tfdata->sBox, x3); ++ x0 ^= t0 + t1 + tfdata->subKeys[k++]; ++ x0 = x0 >> 1 | x0 << 31; ++ x1 = x1 << 1 | x1 >> 31; ++ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k++]; ++ } ++ ++ x2 ^= tfdata->subKeys[4]; ++ x3 ^= tfdata->subKeys[5]; ++ x0 ^= tfdata->subKeys[6]; ++ x1 ^= tfdata->subKeys[7]; ++ } ++ ++ *out++ = (u_int8_t)(x2 ); ++ *out++ = (u_int8_t)(x2 >> 8); ++ *out++ = (u_int8_t)(x2 >> 16); ++ *out++ = (u_int8_t)(x2 >> 24); ++ ++ *out++ = (u_int8_t)(x3 ); ++ *out++ = (u_int8_t)(x3 >> 8); ++ *out++ = (u_int8_t)(x3 >> 16); ++ *out++ = (u_int8_t)(x3 >> 24); ++ ++ *out++ = (u_int8_t)(x0 ); ++ *out++ = (u_int8_t)(x0 >> 8); ++ *out++ = (u_int8_t)(x0 >> 16); ++ *out++ = (u_int8_t)(x0 >> 24); ++ ++ *out++ = (u_int8_t)(x1 ); ++ *out++ = (u_int8_t)(x1 >> 8); ++ *out++ = (u_int8_t)(x1 >> 16); ++ *out++ = (u_int8_t)(x1 >> 24); ++} ++ ++/** ++ * Use (12, 8) Reed-Solomon code over GF(256) to produce a key S-box ++ * 32-bit entity from two key material 32-bit entities. ++ * ++ * @param k0 1st 32-bit entity. ++ * @param k1 2nd 32-bit entity. ++ * @return Remainder polynomial generated using RS code ++ */ ++u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1) ++{ u_int32_t i,r; ++ ++ for(r=k1,i=0;i<4;i++) /* shift 1 byte at a time */ ++ TwoFish_RS_rem(r); ++ r ^= k0; ++ for(i=0;i<4;i++) ++ TwoFish_RS_rem(r); ++ ++ return r; ++} ++ ++u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32) ++{ u_int8_t b0,b1,b2,b3; ++ u_int32_t k0,k1,k2,k3,result = 0; ++ ++ b0=TwoFish_b0(x); ++ b1=TwoFish_b1(x); ++ b2=TwoFish_b2(x); ++ b3=TwoFish_b3(x); ++ k0=k32[0]; ++ k1=k32[1]; ++ k2=k32[2]; ++ k3=k32[3]; ++ ++ switch (k64Cnt & 3) ++ { case 1: /* 64-bit keys */ ++ result = ++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0] & 0xFF) ^ TwoFish_b0(k0)] ^ ++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1] & 0xFF) ^ TwoFish_b1(k0)] ^ ++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2] & 0xFF) ^ TwoFish_b2(k0)] ^ ++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3] & 0xFF) ^ TwoFish_b3(k0)]; ++ break; ++ case 0: /* 256-bit keys (same as 4) */ ++ b0 = (TwoFish_P[TwoFish_P_04][b0] & 0xFF) ^ TwoFish_b0(k3); ++ b1 = (TwoFish_P[TwoFish_P_14][b1] & 0xFF) ^ TwoFish_b1(k3); ++ b2 = (TwoFish_P[TwoFish_P_24][b2] & 0xFF) ^ TwoFish_b2(k3); ++ b3 = (TwoFish_P[TwoFish_P_34][b3] & 0xFF) ^ TwoFish_b3(k3); ++ ++ case 3: /* 192-bit keys */ ++ b0 = (TwoFish_P[TwoFish_P_03][b0] & 0xFF) ^ TwoFish_b0(k2); ++ b1 = (TwoFish_P[TwoFish_P_13][b1] & 0xFF) ^ TwoFish_b1(k2); ++ b2 = (TwoFish_P[TwoFish_P_23][b2] & 0xFF) ^ TwoFish_b2(k2); ++ b3 = (TwoFish_P[TwoFish_P_33][b3] & 0xFF) ^ TwoFish_b3(k2); ++ case 2: /* 128-bit keys (optimize for this case) */ ++ result = ++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0] & 0xFF) ^ TwoFish_b0(k1)] & 0xFF) ^ TwoFish_b0(k0)] ^ ++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1] & 0xFF) ^ TwoFish_b1(k1)] & 0xFF) ^ TwoFish_b1(k0)] ^ ++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2] & 0xFF) ^ TwoFish_b2(k1)] & 0xFF) ^ TwoFish_b2(k0)] ^ ++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3] & 0xFF) ^ TwoFish_b3(k1)] & 0xFF) ^ TwoFish_b3(k0)]; ++ break; ++ } ++ return result; ++} ++ ++u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x) ++{ return lsBox[ TwoFish_b0(x)<<1 ]^ ++ lsBox[ ((TwoFish_b1(x)<<1)|1)]^ ++ lsBox[0x200+ (TwoFish_b2(x)<<1) ]^ ++ lsBox[0x200+((TwoFish_b3(x)<<1)|1)]; ++} ++ ++u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x) ++{ return lsBox[ (TwoFish_b3(x)<<1) ]^ ++ lsBox[ ((TwoFish_b0(x)<<1)|1)]^ ++ lsBox[0x200+ (TwoFish_b1(x)<<1) ]^ ++ lsBox[0x200+((TwoFish_b2(x)<<1)|1)]; ++} ++ ++u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R) ++{ return lsBox[ 2*TwoFish__b(x,R ) ]^ ++ lsBox[ 2*TwoFish__b(x,R+1)+1]^ ++ lsBox[0x200+2*TwoFish__b(x,R+2) ]^ ++ lsBox[0x200+2*TwoFish__b(x,R+3)+1]; ++} ++ ++ ++#endif + +Index: snort-2.8.6.1/src/twofish.h +=================================================================== +--- snort-2.8.6.1/src/twofish.h (Revision 0) ++++ snort-2.8.6.1/src/twofish.h (Revision 3) +@@ -0,0 +1,276 @@ ++/* $Id: twofish.h,v 2.1 2008/12/15 20:36:05 fknobbe Exp $ ++ * ++ * ++ * Copyright (C) 1997-2000 The Cryptix Foundation Limited. ++ * Copyright (C) 2000 Farm9. ++ * Copyright (C) 2001 Frank Knobbe. ++ * All rights reserved. ++ * ++ * For Cryptix code: ++ * Use, modification, copying and distribution of this software is subject ++ * the terms and conditions of the Cryptix General Licence. You should have ++ * received a copy of the Cryptix General Licence along with this library; ++ * if not, you can download a copy from http://www.cryptix.org/ . ++ * ++ * For Farm9: ++ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and ++ * ciphertext stealing technique, added AsciiTwofish class for easy encryption ++ * decryption of text strings ++ * ++ * Frank Knobbe : ++ * --- April 2001, converted from C++ to C, prefixed global variables ++ * with TwoFish, substituted some defines, changed functions to make use of ++ * variables supplied in a struct, modified and added routines for modular calls. ++ * Cleaned up the code so that defines are used instead of fixed 16's and 32's. ++ * Created two general purpose crypt routines for one block and multiple block ++ * encryption using Joh's CBC code. ++ * Added crypt routines that use a header (with a magic and data length). ++ * (Basically a major rewrite). ++ * ++ * Note: Routines labeled _TwoFish are private and should not be used ++ * (or with extreme caution). ++ * ++ */ ++ ++#ifndef __TWOFISH_LIBRARY_HEADER__ ++#define __TWOFISH_LIBRARY_HEADER__ ++ ++#ifndef FALSE ++#define FALSE 0 ++#endif ++#ifndef TRUE ++#define TRUE !FALSE ++#endif ++#ifndef bool ++#define bool int ++#endif ++ ++ ++/* Constants */ ++ ++#define TwoFish_DEFAULT_PW "SnortHas2FishEncryptionRoutines!" /* default password (not more than 32 chars) */ ++#define TwoFish_MAGIC "TwoFish" /* to indentify a successful decryption */ ++ ++enum ++{ TwoFish_KEY_SIZE = 256, /* Valid values: 64, 128, 192, 256 */ ++ /* User 256, other key sizes have not been tested. */ ++ /* (But should work. I substituted as much as */ ++ /* I could with this define.) */ ++ TwoFish_ROUNDS = 16, ++ TwoFish_BLOCK_SIZE = 16, /* bytes in a data-block */ ++ TwoFish_KEY_LENGTH = TwoFish_KEY_SIZE/8, /* 32= 256-bit key */ ++ TwoFish_TOTAL_SUBKEYS = 4+4+2*TwoFish_ROUNDS, ++ TwoFish_MAGIC_LEN = TwoFish_BLOCK_SIZE-8, ++ TwoFish_SK_BUMP = 0x01010101, ++ TwoFish_SK_ROTL = 9, ++ TwoFish_P_00 = 1, ++ TwoFish_P_01 = 0, ++ TwoFish_P_02 = 0, ++ TwoFish_P_03 = TwoFish_P_01 ^ 1, ++ TwoFish_P_04 = 1, ++ TwoFish_P_10 = 0, ++ TwoFish_P_11 = 0, ++ TwoFish_P_12 = 1, ++ TwoFish_P_13 = TwoFish_P_11 ^ 1, ++ TwoFish_P_14 = 0, ++ TwoFish_P_20 = 1, ++ TwoFish_P_21 = 1, ++ TwoFish_P_22 = 0, ++ TwoFish_P_23 = TwoFish_P_21 ^ 1, ++ TwoFish_P_24 = 0, ++ TwoFish_P_30 = 0, ++ TwoFish_P_31 = 1, ++ TwoFish_P_32 = 1, ++ TwoFish_P_33 = TwoFish_P_31 ^ 1, ++ TwoFish_P_34 = 1, ++ TwoFish_GF256_FDBK = 0x169, ++ TwoFish_GF256_FDBK_2 = 0x169 / 2, ++ TwoFish_GF256_FDBK_4 = 0x169 / 4, ++ TwoFish_RS_GF_FDBK = 0x14D, /* field generator */ ++ TwoFish_MDS_GF_FDBK = 0x169 /* primitive polynomial for GF(256) */ ++}; ++ ++ ++/* Global data structure for callers */ ++ ++typedef struct ++{ u_int32_t sBox[4 * 256]; /* Key dependent S-box */ ++ u_int32_t subKeys[TwoFish_TOTAL_SUBKEYS]; /* Subkeys */ ++ u_int8_t key[TwoFish_KEY_LENGTH]; /* Encryption Key */ ++ u_int8_t *output; /* Pointer to output buffer */ ++ u_int8_t qBlockPlain[TwoFish_BLOCK_SIZE]; /* Used by CBC */ ++ u_int8_t qBlockCrypt[TwoFish_BLOCK_SIZE]; ++ u_int8_t prevCipher[TwoFish_BLOCK_SIZE]; ++ struct /* Header for crypt functions. Has to be at least one block long. */ ++ { u_int32_t salt; /* Random salt in first block (will salt the rest through CBC) */ ++ u_int8_t length[4]; /* The amount of data following the header */ ++ u_int8_t magic[TwoFish_MAGIC_LEN]; /* Magic to identify successful decryption */ ++ } header; ++ bool qBlockDefined; ++ bool dontflush; ++} TWOFISH; ++ ++#ifndef __TWOFISH_LIBRARY_SOURCE__ ++ ++extern bool TwoFish_srand; /* if set to TRUE (default), first call of TwoFishInit will seed rand(); */ ++ /* call of TwoFishInit */ ++#endif ++ ++ ++/**** Public Functions ****/ ++ ++/* TwoFish Initialization ++ * ++ * This routine generates a global data structure for use with TwoFish, ++ * initializes important values (such as subkeys, sBoxes), generates subkeys ++ * and precomputes the MDS matrix if not already done. ++ * ++ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!') ++ * ++ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data. ++ * This pointer is used with all other crypt functions. ++ */ ++TWOFISH *TwoFishInit(char *userkey); ++ ++ ++/* TwoFish Destroy ++ * ++ * Nothing else but a free... ++ * ++ * Input: Pointer to the TwoFish structure. ++ * ++ */ ++void TwoFishDestroy(TWOFISH *tfdata); ++ ++ ++/* TwoFish Alloc ++ * ++ * Allocates enough memory for the output buffer as required. ++ * ++ * Input: Length of the plaintext. ++ * Boolean flag for BinHex Output. ++ * Pointer to the TwoFish structure. ++ * ++ * Output: Returns a pointer to the memory allocated. ++ */ ++void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata); ++ ++ ++/* TwoFish Free ++ * ++ * Free's the allocated buffer. ++ * ++ * Input: Pointer to the TwoFish structure ++ * ++ * Output: (none) ++ */ ++void TwoFishFree(TWOFISH *tfdata); ++ ++ ++/* TwoFish Set Output ++ * ++ * If you want to allocate the output buffer yourself, ++ * then you can set it with this function. ++ * ++ * Input: Pointer to your output buffer ++ * Pointer to the TwoFish structure ++ * ++ * Output: (none) ++ */ ++void TwoFishSetOutput(char *outp,TWOFISH *tfdata); ++ ++ ++/* TwoFish Raw Encryption ++ * ++ * Does not use header, but does use CBC (if more than one block has to be encrypted). ++ * ++ * Input: Pointer to the buffer of the plaintext to be encrypted. ++ * Pointer to the buffer receiving the ciphertext. ++ * The length of the plaintext buffer. ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes encrypted if successful, otherwise 0. ++ */ ++unsigned long TwoFishEncryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata); ++ ++/* TwoFish Raw Decryption ++ * ++ * Does not use header, but does use CBC (if more than one block has to be decrypted). ++ * ++ * Input: Pointer to the buffer of the ciphertext to be decrypted. ++ * Pointer to the buffer receiving the plaintext. ++ * The length of the ciphertext buffer (at least one cipher block). ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes decrypted if successful, otherwise 0. ++ */ ++unsigned long TwoFishDecryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata); ++ ++ ++/* TwoFish Encryption ++ * ++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, ++ * this routine will alloc the memory. In addition, it will include a small 'header' ++ * containing the magic and some salt. That way the decrypt routine can check if the ++ * packet got decrypted successfully, and return 0 instead of garbage. ++ * ++ * Input: Pointer to the buffer of the plaintext to be encrypted. ++ * Pointer to the pointer to the buffer receiving the ciphertext. ++ * The pointer either points to user allocated output buffer space, or to NULL, in which case ++ * this routine will set the pointer to the buffer allocated through the struct. ++ * The length of the plaintext buffer. ++ * Can be -1 if the input is a null terminated string, in which case we'll count for you. ++ * Boolean flag for BinHex Output (if used, output will be twice as large as input). ++ * Note: BinHex conversion overwrites (converts) input buffer! ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes encrypted if successful, otherwise 0. ++ */ ++unsigned long TwoFishEncrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata); ++ ++ ++/* TwoFish Decryption ++ * ++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc, ++ * this routine will alloc the memory. In addition, it will check the small 'header' ++ * containing the magic. If magic does not match we return 0. Otherwise we return the ++ * amount of bytes decrypted (should be the same as the length in the header). ++ * ++ * Input: Pointer to the buffer of the ciphertext to be decrypted. ++ * Pointer to the pointer to the buffer receiving the plaintext. ++ * The pointer either points to user allocated output buffer space, or to NULL, in which case ++ * this routine will set the pointer to the buffer allocated through the struct. ++ * The length of the ciphertext buffer. ++ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you. ++ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input). ++ * Note: BinHex conversion overwrites (converts) input buffer! ++ * The TwoFish structure. ++ * ++ * Output: The amount of bytes decrypted if successful, otherwise 0. ++ */ ++unsigned long TwoFishDecrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata); ++ ++ ++/**** Private Functions ****/ ++ ++u_int8_t TwoFish__b(u_int32_t x,int n); ++void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex); ++unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); ++unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); ++unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata); ++void _TwoFish_PrecomputeMDSmatrix(void); ++void _TwoFish_MakeSubKeys(TWOFISH *tfdata); ++void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata); ++void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata); ++void _TwoFish_ResetCBC(TWOFISH *tfdata); ++void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata); ++void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata); ++void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata); ++u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1); ++u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32); ++u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x); ++u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x); ++u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R); ++ ++ ++#endif + +Index: snort-2.8.6.1/src/plugin_enum.h +=================================================================== +--- snort-2.8.6.1/src/plugin_enum.h (Revision 1) ++++ snort-2.8.6.1/src/plugin_enum.h (Revision 3) +@@ -60,6 +60,7 @@ + PLUGIN_URILEN_CHECK, + PLUGIN_DYNAMIC, + PLUGIN_FLOWBIT, ++ PLUGIN_FWSAM, + PLUGIN_MAX /* sentinel value */ + }; + +Index: snort-2.8.6.1/src/fatal.h +=================================================================== +--- snort-2.8.6.1/src/fatal.h (Revision 0) ++++ snort-2.8.6.1/src/fatal.h (Revision 3) +@@ -0,0 +1,40 @@ ++/* $Id$ */ ++/* ++** Copyright (C) 2002-2008 Sourcefire, Inc. ++** Copyright (C) 1998-2002 Martin Roesch ++** ++** This program is free software; you can redistribute it and/or modify ++** it under the terms of the GNU General Public License Version 2 as ++** published by the Free Software Foundation. You may not use, modify or ++** distribute this program under any other version of the GNU General ++** Public License. ++** ++** This program is distributed in the hope that it will be useful, ++** but WITHOUT ANY WARRANTY; without even the implied warranty of ++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++** GNU General Public License for more details. ++** ++** You should have received a copy of the GNU General Public License ++** along with this program; if not, write to the Free Software ++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++*/ ++ ++#ifndef __FATAL_H__ ++#define __FATAL_H__ ++ ++ ++/* ++ * in debugging mode print out the filename and the line number where the ++ * failure have occured ++ */ ++ ++ ++#ifdef DEBUG ++ #define FATAL(msg) { printf("%s:%d: ", __FILE__, __LINE__); FatalError( (char *) msg); } ++#else ++ #define FATAL(msg) FatalError( (char *) msg) ++#endif ++ ++ ++ ++#endif /* __FATAL_H__ */ + +Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c +=================================================================== +--- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 0) ++++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 3) +@@ -0,0 +1,1380 @@ ++/* $id: snortpatchb,v 1.2 2002/10/26 03:32:35 fknobbe Exp $ ++** ++** spo_alert_fwsam.c ++** ++** Copyright (c) 2001-2004 Frank Knobbe ++** ++** This program is free software; you can redistribute it and/or modify ++** it under the terms of the GNU General Public License as published by ++** the Free Software Foundation; either version 2 of the License, or ++** (at your option) any later version. ++** ++** This program is distributed in the hope that it will be useful, ++** but WITHOUT ANY WARRANTY; without even the implied warranty of ++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++** GNU General Public License for more details. ++** ++** You should have received a copy of the GNU General Public License ++** along with this program; if not, write to the Free Software ++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++*/ ++ ++/* ++ * Purpose: ++ * ++ * This module sends alerts to a remote service on a host running SnortSam ++ * (the agent) which will block the intruding IP address on a variety of ++ * host and network firewalls. ++ * ++ * SnortSam also performs checks against a white-list of never-to-be-blocked IP addresses, ++ * can override block durations (for example for known proxies), and can detect attack conditions ++ * where too many blocks are received within a defined interval. If an attack is detected ++ * it will unblock the last x blocks and wait for the attack to end. ++ * ++ * See the SnortSam documentation for more information. ++ * ++ * ++ * Output Plugin Parameters: ++ *************************** ++ * ++ * output alert_fwsam: :/ ++ * ++ * : The IP address or host name of the host running SnortSam. ++ * : The port the remote SnortSam service listens on (default 898). ++ * : The key used for authentication (encryption really) ++ * of the communication to the remote service. ++ * ++ * Examples: ++ * ++ * output alert_fwsam: snortsambox/idspassword ++ * output alert_fwsam: fw1.domain.tld:898/mykey ++ * output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw ++ * ++ * ++ * Rule Options: ++ *************** ++ * ++ * fwsam: who[how],time; ++ * ++ * who: src, source, dst, dest, destination ++ * IP address to be blocked according to snort rule (some rules ++ * are reversed, i.e. homenet -> any [and you want to block any]). ++ * src denotes IP to the left of -> and dst denotes IP to the right ++ * ++ * how: Optional. In, out, src, dest, either, both, this, conn, connection ++ * Tells FW-1 to block packets INcoming from host, OUTgoing to host, ++ * EITHERway, or only THIS connection (IP/Service pair). ++ * See 'fw sam' for more information. May be ignored by other plugins. ++ * ++ * time: Duration of block in seconds. (Accepts 'days', 'months', 'weeks', ++ * 'years', 'minutes', 'seconds', 'hours'. Alternatively, a value of ++ * 0, or the keyword PERManent, INFinite, or ALWAYS, will block the ++ * host permanently. Be careful with this! ++ * Tells FW-1 (and others) how long to inhibit packets from the host. ++ * ++ * Examples: ++ * ++ * fwsam: src[either],15min; ++ * or dst[in], 2 days 4 hours ++ * or src, 1 hour ++ * ++ * (default: src[either],5min) ++ * ++ * ++ * Effect: ++ * ++ * Alerts are sent to the remote SnortSam services on Firewall-1 Management Stations ++ * or other hosts running SnortSam (as required for Cisco Routers and PIX). ++ * The remote services will invoke the SAM configuration via the fw sam ++ * command line, or by sending a packet to the SAM port 18183, or by using the official ++ * OPSEC API calls, or by telnetting into Cisco routers or PIX firewalls. ++ * The communication over the network is encrypted using two-fish. ++ * (Implementation ripped from CryptCat by Farm9 with permission.) ++ * ++ * Future Plans: ++ * ++ * - Custom alert trigger per rule (x alerts in y secs) --> Seems to exist in Snort 1.9 now. ++ * - Enable/Allow tagged fwsam: arguments to provide different values to ++ * different stations. --> Seems to be accomplished with custom rule-types ++ * ++ * ++ * Comments: ++ * ++ * It seem that above wishes can be implemented with todays setup. Feedback concerning ++ * these is greatly appreciated. ++ * ++*/ ++ ++ ++#include "spo_alert_fwsam.h" ++#include "twofish.h" ++/* external globals from rules.c */ ++extern char *file_name; ++extern int file_line; ++extern OptTreeNode *otn_tmp; ++extern char *snort_conf_dir; /* extern PV pv; */ ++ ++ ++/* my globals */ ++ ++FWsamList *FWsamStationList=NULL; /* Global (for all alert-types) list of snortsam stations */ ++FWsamOptions *FWsamOptionField=NULL; ++unsigned long FWsamMaxOptions=0; ++ ++ ++/* ++ * Function: AlertFWsamSetup() ++ * ++ * Purpose: Registers the output plugin keyword and initialization ++ * function into the output plugin list. This is the function that ++ * gets called from InitOutputPlugins() in plugbase.c. ++ * It also registers itself as a plugin in order to parse every rule ++ * and to set the appropiate flags from fwsam: option. ++ * ++ * Arguments: None. ++ * ++ * Returns: void function ++ * ++*/ ++void AlertFWsamSetup(void) ++{ ++ /* link the preprocessor keyword to the init function in ++ the preproc list */ ++ RegisterOutputPlugin("alert_fwsam", OUTPUT_TYPE_FLAG__ALERT, AlertFWsamInit); ++ RegisterRuleOption("fwsam", AlertFWsamOptionInit, NULL, OPT_TYPE_ACTION, NULL); ++ ++#ifdef FWSAMDEBUG /* This allows debugging of fwsam only */ ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Output plugin is plugged in...\n"); ++#endif ++} ++ ++ ++/* This function checks if a given snortsam station is already in ++ * a given list. ++*/ ++int FWsamStationExists(FWsamStation *who,FWsamList *list) ++{ ++ while(list) ++ { ++ if(list->station) { ++// if( who->stationip.s_addr==list->station->stationip.s_addr && ++ if(IP_EQUALITY(&who->stationip, &list->station->stationip) && ++ who->stationport==list->station->stationport) ++ return TRUE; ++ } ++ list=list->next; ++ } ++ return FALSE; ++} ++ ++/* ++ * Function: AlertFWsamInit(char *args) ++ * ++ * Purpose: Calls the argument parsing function, performs final setup on data ++ * structs, links the preproc function into the function list. ++ * ++ * Arguments: args => ptr to argument string ++ * ++ * Returns: void function ++ * ++*/ ++void AlertFWsamInit(char *args) ++{ char *ap; ++ unsigned long statip,cnt,again,i; ++ char *stathost,*statport,*statpass; ++ FWsamStation *station; ++ FWsamList *fwsamlist=NULL; /* alert-type dependent list of snortsam stations */ ++ FWsamList *listp,*newlistp; ++ struct hostent *hoste; ++ char buf[1024]=""; ++ FILE *fp; ++ FWsamOptions tempopt; ++ ++#ifdef FWSAMDEBUG ++ unsigned long hostcnt=0; ++ ++ ++ ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Output plugin initializing...\n"); ++#endif ++ ++ /* pv.alert_plugin_active = 1; */ ++ ++ /* parse the argument list from the rules file */ ++ ++ if(args == NULL) ++ FatalError("ERROR %s (%d) => [Alert_FWsam](AlertFWsamInit) No arguments to alert_fwsam preprocessor!\n", file_name, file_line); ++ ++ if(!FWsamOptionField && !FWsamMaxOptions) ++ { strncpy(buf,snort_conf_dir,sizeof(buf)-1); ++ strncpy(buf+strlen(buf),SID_MAPFILE,sizeof(buf)-strlen(buf)-1); ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Using file: %s\n",buf); ++#endif ++ fp=fopen(buf,"rt"); ++ if(!fp) ++ { strncpy(buf,snort_conf_dir,sizeof(buf)-1); ++ strncpy(buf+strlen(buf),SID_ALT_MAPFILE,sizeof(buf)-strlen(buf)-1); ++ fp=fopen(buf,"rt"); ++ } ++ if(fp) /* Check for presence of map file and read those in, sorted. */ ++ { LogMessage("INFO => [Alert_FWsam](AlertFWsamSetup) Using sid-map file: %s\n",buf); ++ ++ while(FWsamReadLine(buf,sizeof(buf),fp)) ++ if(*buf) ++ FWsamMaxOptions++; ++ if(FWsamMaxOptions) ++ { if((FWsamOptionField=(FWsamOptions *)malloc(sizeof(FWsamOptions)*FWsamMaxOptions))==NULL) ++ FatalError("ERROR => [Alert_FWsam](AlertFWsamSetup) malloc failed for OptionField!\n"); ++ fseek(fp,0,SEEK_SET); ++ for(cnt=0;cnt1) ++ { for(again=TRUE,cnt=FWsamMaxOptions-1;cnt>=1 && again;cnt--) ++ { for(again=FALSE,i=0;iFWsamOptionField[i+1].sid) ++ { memcpy(&tempopt,&(FWsamOptionField[i]),sizeof(FWsamOptions)); ++ memcpy(&(FWsamOptionField[i]),&(FWsamOptionField[i+1]),sizeof(FWsamOptions)); ++ memcpy(&(FWsamOptionField[i+1]),&tempopt,sizeof(FWsamOptions)); ++ again=TRUE; ++ } ++ } ++ } ++ } ++ } ++ else ++ FWsamMaxOptions=1; ++ fclose(fp); ++ } ++ else ++ FWsamMaxOptions=1; ++ } ++ ++ ++ ap=args; /* start at the beginning of the argument */ ++ while(*ap && isspace(*ap)) ap++; ++ while(*ap) ++ { stathost=ap; /* first argument should be host */ ++ statport=NULL; ++ statpass=NULL; ++ while(*ap && *ap!=':' && *ap!='/' && !isspace(*ap)) ap++; /* find token */ ++ switch(*ap) ++ { case ':': *ap++=0; /* grab the port */ ++ statport=ap; ++ while(*ap && *ap!='/' && !isspace(*ap)) ap++; ++ if(*ap!='/') ++ break; ++ case '/': *ap++=0; /* grab the key */ ++ statpass=ap; ++ while(*ap && !isspace(*ap)) ap++; ++ default: break; ++ } ++ if(*ap) ++ { *ap++=0; ++ while(isspace(*ap)) ap++; ++ } ++ /* now we have the first host with port and password (key) */ ++ /* next we check for valid/blank password/port */ ++ if(statpass!=NULL) ++ if(!*statpass) ++ statpass=NULL; ++ if(statport!=NULL) ++ if(!*statport) ++ statport=NULL; ++ statip=0; ++ /* now we check if a valid host was specified */ ++ if(inet_addr(stathost)==INADDR_NONE) ++ { hoste=gethostbyname(stathost); ++ if (!hoste) ++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Unable to resolve host '%s'!\n",file_name,file_line,stathost); ++ else ++ statip=*(unsigned long *)hoste->h_addr; ++ } ++ else ++ { statip=inet_addr(stathost); ++ if(!statip) ++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Invalid host address '%s'!\n",file_name,file_line,stathost); ++ } ++ if(statip) ++ { /* groovie, a valid host. Let's alloc and assemble the structure for it. */ ++ if((station=(FWsamStation *)malloc(sizeof(FWsamStation)))==NULL) ++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for station!\n"); ++ ++// station->stationip.s_addr=statip; /* the IP address */ ++ station->stationip.ip32[0] = statip; /* the IP address */ ++ if(statport!=NULL && atoi(statport)>0) /* if the user specified one */ ++ station->stationport=atoi(statport); /* use users setting */ ++ else ++ station->stationport=FWSAM_DEFAULTPORT; /* set the default port */ ++ ++ if(statpass!=NULL) /* if specified by user */ ++ strncpy(station->stationkey,statpass,TwoFish_KEY_LENGTH); /* use defined key */ ++ else ++ station->stationkey[0]=0; ++ station->stationkey[TwoFish_KEY_LENGTH]=0; /* make sure it's terminated. (damn strncpy...) */ ++ ++ strcpy(station->initialkey,station->stationkey); ++ station->stationfish=TwoFishInit(station->stationkey); ++ ++ station->localsocketaddr.sin_port=htons(0); /* let's use dynamic ports for now */ ++ station->localsocketaddr.sin_addr.s_addr=0; ++ station->localsocketaddr.sin_family=AF_INET; ++ station->stationsocketaddr.sin_port=htons(station->stationport); ++ //station->stationsocketaddr.sin_addr=station->stationip; ++ station->stationsocketaddr.sin_addr.s_addr=station->stationip.ip32[0]; ++ station->stationsocketaddr.sin_family=AF_INET; /* load all socket crap and keep for later */ ++ ++ do ++ station->myseqno=rand(); /* the seqno this host will use */ ++ while(station->myseqno<20 || station->myseqno>65500); ++ station->mykeymod[0]=rand(); ++ station->mykeymod[1]=rand(); ++ station->mykeymod[2]=rand(); ++ station->mykeymod[3]=rand(); ++ station->stationseqno=0; /* peer hasn't answered yet. */ ++ ++ ++ if(!FWsamStationExists(station,FWsamStationList)) /* If we don't have the station already in global list....*/ ++ { if(FWsamCheckIn(station)) /* ...and we can talk to the agent... */ ++ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL) ++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for global newlistp!\n"); ++ newlistp->station=station; ++ newlistp->next=NULL; ++ ++ if(!FWsamStationList) /* ... add it to the global list/ */ ++ FWsamStationList=newlistp; ++ else ++ { listp=FWsamStationList; ++ while(listp->next) ++ listp=listp->next; ++ listp->next=newlistp; ++ } ++ } ++ else ++ { TwoFishDestroy(station->stationfish); /* if not, we trash it. */ ++ free(station); ++ station=NULL; ++ } ++ } ++#ifdef FWSAMDEBUG ++ else ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in global list, skipping CheckIn.\n", sfip_ntoa(&station->stationip),station->stationport); ++#endif ++ ++ if(station) ++ { if(!FWsamStationExists(station,fwsamlist)) /* If we don't have the station already in local list....*/ ++ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL) ++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for local newlistp!\n"); ++ newlistp->station=station; ++ newlistp->next=NULL; ++ ++ if(!fwsamlist) /* ... add it to the local list/ */ ++ fwsamlist=newlistp; ++ else ++ { listp=fwsamlist; ++ while(listp->next) ++ listp=listp->next; ++ listp->next=newlistp; ++ } ++ } ++ ++#ifdef FWSAMDEBUG ++ else ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in local list, skipping.\n",sfip_ntoa(&station->stationip),station->stationport); ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) #%i: Host %s [%s] port %i password %s\n",++hostcnt,stathost,sfip_ntoa(&station->stationip),station->stationport,station->stationkey); ++#endif ++ } ++ ++ } ++ } /* next one */ ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Linking fwsam alert function to call list...\n"); ++#endif ++ ++ /* Set the preprocessor function into the function list */ ++ AddFuncToOutputList(AlertFWsam, OUTPUT_TYPE_FLAG__ALERT, fwsamlist); ++ AddFuncToCleanExitList(AlertFWsamCleanExitFunc, fwsamlist); ++ AddFuncToRestartList(AlertFWsamRestartFunc, fwsamlist); ++} ++ ++ ++/* This routine reads in a str from a file, snips white-spaces ++ * off the front and back, removes comments, and pretties the ++ * string. Returns true or false if a line was read or not. ++*/ ++int FWsamReadLine(char *buf,unsigned long bufsize,FILE *fp) ++{ char *p; ++ ++ if(fgets(buf,bufsize-1,fp)) ++ { buf[bufsize-1]=0; ++ ++#ifdef FWSAMDEBUG_off ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamReadLine) Line: %s\n",buf); ++#endif ++ ++ p=buf; ++ while(isspace(*p)) ++ p++; ++ if(p>buf); ++ strcpy(buf,p); ++ if(*buf) ++ { p=buf+strlen(buf)-1; /* remove leading and trailing spaces */ ++ while(isspace(*p)) ++ *p-- =0; ++ } ++ p=buf; ++ if(*p=='#' || *p==';') ++ *p=0; ++ else ++ p++; ++ while(*p) /* remove inline comments (except escaped #'s and ;'s) */ ++ { if(*p=='#' || *p==';') ++ { if(*(p-1)=='\\') ++ strcpy(p-1,p); ++ else ++ *p=0; ++ } ++ else ++ p++; ++ } ++ return TRUE; ++ } ++ return FALSE; ++} ++ ++ ++/* Parses the duration of the argument, recognizing minutes, hours, etc.. ++*/ ++unsigned long FWsamParseDuration(char *p) ++{ unsigned long dur=0,tdu; ++ char *tok,c1,c2; ++ ++ while(*p) ++ { tok=p; ++ while(*p && isdigit(*p)) ++ p++; ++ if(*p) ++ { c1=tolower(*p); ++ *p=0; ++ p++; ++ if(*p && !isdigit(*p)) ++ { c2=tolower(*p++); ++ while(*p && !isdigit(*p)) ++ p++; ++ } ++ else ++ c2=0; ++ tdu=atol(tok); ++ switch(c1) ++ { case 'm': if(c2=='o') /* month */ ++ tdu*=(60*60*24*30); /* use 30 days */ ++ else ++ tdu*=60; /* minutes */ ++ case 's': break; /* seconds */ ++ case 'h': tdu*=(60*60); /* hours */ ++ break; ++ case 'd': tdu*=(60*60*24); /* days */ ++ break; ++ case 'w': tdu*=(60*60*24*7); /* week */ ++ break; ++ case 'y': tdu*=(60*60*24*365); /* year */ ++ break; ++ } ++ dur+=tdu; ++ } ++ else ++ dur+=atol(tok); ++ } ++ ++ return dur; ++} ++ ++ ++/* This routine parses an option line. It is called by FWsamParseLine, ++ * which parses the sid-block.map file, and also by AlertFWsamOptionInit, ++ * which is called by Snort when processing fwsam: options in rules. ++ * It returns TRUE it there is a possible option problem, otherwise FALSE. ++*/ ++int FWsamParseOption(FWsamOptions *optp,char *ap) ++{ int possprob=FALSE; ++ ++ /* set defaults */ ++ ++ optp->duration=300; /* default of 5 minute block */ ++ optp->how=FWSAM_HOW_INOUT; /* inbound and outbound block */ ++ optp->who=FWSAM_WHO_SRC; /* the source */ ++ optp->loglevel=FWSAM_LOG_LONGALERT; /* the log level default */ ++ /* parse the fwsam keywords */ ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) Parse Options Args: %s\n",ap); ++#endif ++ ++ if(*ap) /* should be dst/src (the WHO) or duration */ ++ { if(isdigit(*ap)) ++ optp->duration=FWsamParseDuration(ap); ++ else ++ { switch(*ap) /* yeah, we're lazy and check only the first character */ ++ { case 'p': ; /* permanent, perm */ ++ case 'f': ; /* forever */ ++ case 'i': optp->duration=0; /* infinite, inf */ ++ break; ++ case 'd': optp->who=FWSAM_WHO_DST; /* destination, dest, dst */ ++ break; ++ case 's': optp->who=FWSAM_WHO_SRC; /* source, src */ ++ break; ++ default: possprob=TRUE; ++ } ++ while(*ap && *ap!=',' && *ap!='[') ++ ap++; ++ if(*ap=='[') ++ { ap++; /* now we have the HOW */ ++ switch(*ap) ++ { case 'i': ; /* in */ ++ case 's': optp->how=FWSAM_HOW_IN; /* source, src */ ++ break; ++ case 'o': ; /* out */ ++ case 'd': optp->how=FWSAM_HOW_OUT; /* destination, dest, dst */ ++ break; ++ case 'b': ; /* both */ ++ case 'e': optp->how=FWSAM_HOW_INOUT; /* either */ ++ break; ++ case 't': ; /* this */ ++ case 'c': optp->how=FWSAM_HOW_THIS; /* connection, conn */ ++ break; ++ default: possprob=TRUE; ++ } ++ while(*ap && *ap!=',') ++ ap++; ++ } ++ if(*ap==',') ++ { ap++; ++ if(isdigit(*ap)) /* and figure out how long to block */ ++ optp->duration=FWsamParseDuration(ap); ++ else if(*ap=='p' || *ap=='f' || *ap=='i') ++ optp->duration=0; ++ else ++ possprob=TRUE; ++ } ++ else if(!*ap) ++ possprob=TRUE; ++ } ++ } ++ else ++ possprob=TRUE; ++ ++ return possprob; ++} ++ ++ ++/* This goes through the lines of sid-block.map and sets the ++ * options for fwsam if the file is being used. ++*/ ++void FWsamParseLine(FWsamOptions *optp,char *buf) ++{ char *ap; ++ ++ ap=buf; /* start at the beginning of the argument */ ++ ++ while(*ap) ++ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */ ++ *ap=' '; ++ if(isupper(*ap)) /* and set to lower case */ ++ *ap=tolower(*ap); ++ ap++; ++ } ++ while((ap=strrchr(buf,' '))!=NULL) /* remove spaces */ ++ strcpy(ap,ap+1); ++ ++ ap=buf; ++ if(*ap) ++ { while(*ap && *ap!=':' && *ap!='|') ++ ap++; ++ *ap++ =0; ++ while(*ap && (*ap==':' || *ap=='|')) ++ ap++; ++ ++ optp->sid=(unsigned long)atol(buf); ++ ++ if(FWsamParseOption(optp,ap)) ++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); ++ } ++ else ++ optp->sid=0; ++} ++ ++ ++ ++/* ++ * Function: AlertFWsamOptionInit(char *data, OptTreeNode *otn, int protocol) ++ * ++ * Purpose: Parses each rule and sets the option flags in the tree. ++ * ++ * Arguments: args => ptr to argument string ++ * ++ * Returns: void function ++ * ++*/ ++void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol) ++{ ++ FWsamOptions *optp; ++ char *ap; ++ ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) FWsamOptionInit is parsing...\n"); ++#endif ++ ++ if((optp=(FWsamOptions *)malloc(sizeof(FWsamOptions)))==NULL) ++ FatalError("ERROR => [Alert_FWsam](AlertFWamOptionInit) malloc failed for opt!\n"); ++ ++ ++ ap=args; /* start at the beginning of the argument */ ++ ++ while(*ap) ++ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */ ++ *ap=' '; ++ if(isupper(*ap)) /* and set to lower case */ ++ *ap=tolower(*ap); ++ ap++; ++ } ++ while((ap=strrchr(args,' '))!=NULL) /* remove spaces */ ++ strcpy(ap,ap+1); ++ ++ ++ if(FWsamParseOption(optp,args)) ++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); ++ ++ otn->ds_list[PLUGIN_FWSAM]=(FWsamOptions *)optp; ++} ++ ++ ++/* Generates a new encryption key for TwoFish based on seq numbers and a random that ++ * the SnortSam agents send on checkin (in protocol) ++*/ ++void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet) ++{ ++ //unsigned char newkey[TwoFish_KEY_LENGTH+2]; ++ char newkey[TwoFish_KEY_LENGTH+2]; ++ int i; ++ ++ newkey[0]=packet->snortseqno[0]; /* current snort seq # (which both know) */ ++ newkey[1]=packet->snortseqno[1]; ++ newkey[2]=packet->fwseqno[0]; /* current SnortSam seq # (which both know) */ ++ newkey[3]=packet->fwseqno[1]; ++ newkey[4]=packet->protocol[0]; /* the random SnortSam chose */ ++ newkey[5]=packet->protocol[1]; ++ ++ strncpy(newkey+6,station->stationkey,TwoFish_KEY_LENGTH-6); /* append old key */ ++ newkey[TwoFish_KEY_LENGTH]=0; ++ ++ newkey[0]^=station->mykeymod[0]; /* modify key with key modifiers which were */ ++ newkey[1]^=station->mykeymod[1]; /* exchanged during the check-in handshake. */ ++ newkey[2]^=station->mykeymod[2]; ++ newkey[3]^=station->mykeymod[3]; ++ newkey[4]^=station->fwkeymod[0]; ++ newkey[5]^=station->fwkeymod[1]; ++ newkey[6]^=station->fwkeymod[2]; ++ newkey[7]^=station->fwkeymod[3]; ++ ++ for(i=0;i<=7;i++) ++ if(newkey[i]==0) ++ newkey[i]++; ++ ++ strcpy(station->stationkey,newkey); ++ TwoFishDestroy(station->stationfish); ++ station->stationfish=TwoFishInit(newkey); ++} ++ ++ ++/* This routine will search the option list as defined ++ * by the sid-block.map file and return a pointer ++ * to the matching record. ++*/ ++FWsamOptions *FWsamGetOption(unsigned long sid) ++{ signed long i,step,diff,o,o2; ++ ++#ifdef FWSAM_FANCYFETCH /* Fancy-fetch jumps in decreasing n/2 steps and takes much less lookups */ ++ o=o2= -1; ++ i=step=FWsamMaxOptions>>1; ++ while(i>=0 && i1) ++ step=step>>1; ++ o2=o; ++ o=i; ++ if(diff>0) ++ i+=step; ++ else ++ i-=step; ++ } ++#else /* This is just a sequential list lookup */ ++ for(i=0;i pointer to the packet data struct ++ * msg => the message to print in the alert ++ * ++ * Returns: void function ++ * ++ ***************************************************************************/ ++void AlertFWsam(Packet *p, char *msg, void *arg, Event *event) ++{ FWsamOptions *optp; ++ FWsamPacket sampacket; ++ FWsamStation *station=NULL; ++ FWsamList *fwsamlist; ++ SOCKET stationsocket; ++ int i,len,deletestation,stationtry=0; ++ //unsigned char *encbuf,*decbuf; ++ char *encbuf,*decbuf; ++ static unsigned long lastbsip[FWSAM_REPET_BLOCKS],lastbdip[FWSAM_REPET_BLOCKS], ++ lastbduration[FWSAM_REPET_BLOCKS],lastbtime[FWSAM_REPET_BLOCKS]; ++ static unsigned short lastbsp[FWSAM_REPET_BLOCKS],lastbdp[FWSAM_REPET_BLOCKS], ++ lastbproto[FWSAM_REPET_BLOCKS],lastbpointer; ++ static unsigned char lastbmode[FWSAM_REPET_BLOCKS]; ++ static unsigned long btime=0; ++ ++ ++ if(otn_tmp==NULL) ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] NULL otn_tmp!\n"); ++#endif ++ return; ++ } ++ if(p == NULL) ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] NULL packet!\n"); ++#endif ++ return; ++ } ++ if(arg == NULL) ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] NULL arg!\n"); ++#endif ++ return; ++ } ++ ++ /* SnortSam does no IPv6 */ ++ if (!IS_IP4(p)) { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] not acting on non-IP4 packet!\n"); ++#endif ++ return; ++ } ++ ++ optp=NULL; ++ ++ if(FWsamOptionField) /* If using the file (field present), let's use that */ ++ optp=FWsamGetOption(event->sig_id); ++ ++ if(!optp) /* If file not present, check if an fwsam option was defined on the triggering rule */ ++ optp=otn_tmp->ds_list[PLUGIN_FWSAM]; ++ ++ if(optp) /* if options specified for this rule */ ++ { if(!btime) /* if this is the first time this function is */ ++ { for(i=0;i [Alert_FWsam] Alert -> Msg=\"%s\"\n",msg); ++ ++ LogMessage("DEBUG => [Alert_FWsam] Alert -> Option: %s[%s],%lu.\n",(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration); ++#endif ++ ++ len=TRUE; ++ btime=(unsigned long)time(NULL); /* get current time */ ++ /* This is a cheap check to see if the blocking request matches any of the previous requests. */ ++ for(i=0;ihow==FWSAM_HOW_THIS)? /* if blocking mode SERVICE, check for src and dst */ ++ ( lastbsip[i]==p->iph->ip_src.s_addr && lastbdip[i]==p->iph->ip_dst.s_addr &&lastbproto[i]==p->iph->ip_proto && ++ ((p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP)? /* check port only of TCP or UDP */ ++/* ((optp->who==FWSAM_WHO_SRC)?(lastbsp[i]==p->sp):(lastbdp[i]==p->dp)):TRUE) ): */ ++ lastbdp[i]==p->dp:TRUE) ): ++ ((optp->who==FWSAM_WHO_SRC)?(lastbsip[i]==p->iph->ip_src.s_addr):(lastbdip[i]==p->iph->ip_dst.s_addr))) && /* otherwise if we block source, only compare source. Same for dest. */ ++ lastbduration[i]==optp->duration && ++ (lastbmode[i]&(FWSAM_HOW|FWSAM_WHO))==(optp->how|optp->who) && ++ (btime-lastbtime[i]<((optp->duration>FWSAM_REPET_TIME)?FWSAM_REPET_TIME:optp->duration))) ++ { len=FALSE; /* If so, we don't need to block again. */ ++ } ++ } ++ if(len) ++ { if(++lastbpointer>=FWSAM_REPET_BLOCKS) /* increase repetitive check pointer */ ++ lastbpointer=0; ++ lastbsip[lastbpointer]=p->iph->ip_src.s_addr; /* and note packet details */ ++ lastbdip[lastbpointer]=p->iph->ip_dst.s_addr; ++ lastbduration[lastbpointer]=optp->duration; ++ lastbmode[lastbpointer]=optp->how|optp->who|optp->loglevel; ++ lastbproto[lastbpointer]=p->iph->ip_proto; ++ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP) ++ { lastbsp[lastbpointer]=p->sp; /* set ports if TCP or UDP */ ++ lastbdp[lastbpointer]=p->dp; ++ } ++ lastbtime[lastbpointer]=btime; ++ ++ ++ while(fwsamlist!=NULL) ++ { station=fwsamlist->station; ++ //if(station->stationip.s_addr) ++ if(station->stationip.ip32[0]) ++ { deletestation=FALSE; ++ stationtry++; /* first try */ ++ /* create a socket for the station */ ++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); ++ if(stationsocket==INVALID_SOCKET) ++ FatalError("ERROR => [Alert_FWsam] Funky socket error (socket)!\n"); ++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) ++ FatalError("ERROR => [Alert_FWsam] Could not bind socket!\n"); ++ ++ /* let's connect to the agent */ ++ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) ++ { ++ LogMessage("WARNING => [Alert_FWsam] Could not send block to host %s. Will try later.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ stationtry=0; ++ } ++ else ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Connected to host %s.\n",sfip_ntoa(&station->stationip)); ++#endif ++ /* now build the packet */ ++ station->myseqno+=station->stationseqno; /* increase my seqno by adding agent seq no */ ++ sampacket.endiancheck=1; /* This is an endian indicator for Snortsam */ ++ sampacket.snortseqno[0]=(char)station->myseqno; ++ sampacket.snortseqno[1]=(char)(station->myseqno>>8); ++ sampacket.fwseqno[0]=(char)station->stationseqno;/* fill station seqno */ ++ sampacket.fwseqno[1]=(char)(station->stationseqno>>8); ++ sampacket.status=FWSAM_STATUS_BLOCK; /* set block mode */ ++ sampacket.version=FWSAM_PACKETVERSION; /* set packet version */ ++ sampacket.duration[0]=(char)optp->duration; /* set duration */ ++ sampacket.duration[1]=(char)(optp->duration>>8); ++ sampacket.duration[2]=(char)(optp->duration>>16); ++ sampacket.duration[3]=(char)(optp->duration>>24); ++ sampacket.fwmode=optp->how|optp->who|optp->loglevel; /* set the mode */ ++ sampacket.dstip[0]=(char)p->iph->ip_dst.s_addr; /* destination IP */ ++ sampacket.dstip[1]=(char)(p->iph->ip_dst.s_addr>>8); ++ sampacket.dstip[2]=(char)(p->iph->ip_dst.s_addr>>16); ++ sampacket.dstip[3]=(char)(p->iph->ip_dst.s_addr>>24); ++ sampacket.srcip[0]=(char)p->iph->ip_src.s_addr; /* source IP */ ++ sampacket.srcip[1]=(char)(p->iph->ip_src.s_addr>>8); ++ sampacket.srcip[2]=(char)(p->iph->ip_src.s_addr>>16); ++ sampacket.srcip[3]=(char)(p->iph->ip_src.s_addr>>24); ++ sampacket.protocol[0]=(char)p->iph->ip_proto; /* protocol */ ++ sampacket.protocol[1]=(char)(p->iph->ip_proto>>8);/* protocol */ ++ ++ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP) ++ { sampacket.srcport[0]=(char)p->sp; /* set ports */ ++ sampacket.srcport[1]=(char)(p->sp>>8); ++ sampacket.dstport[0]=(char)p->dp; ++ sampacket.dstport[1]=(char)(p->dp>>8); ++ } ++ else ++ sampacket.srcport[0]=sampacket.srcport[1]=sampacket.dstport[0]=sampacket.dstport[1]=0; ++ ++ sampacket.sig_id[0]=(char)event->sig_id; /* set signature ID */ ++ sampacket.sig_id[1]=(char)(event->sig_id>>8); ++ sampacket.sig_id[2]=(char)(event->sig_id>>16); ++ sampacket.sig_id[3]=(char)(event->sig_id>>24); ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Sending BLOCK\n"); ++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",station->myseqno); ++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); ++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",FWSAM_STATUS_BLOCK); ++ LogMessage("DEBUG => [Alert_FWsam] Mode : %i\n",optp->how|optp->who|optp->loglevel); ++ LogMessage("DEBUG => [Alert_FWsam] Duration : %li\n",optp->duration); ++ LogMessage("DEBUG => [Alert_FWsam] Protocol : %i\n",GET_IPH_PROTO(p)); ++#ifdef SUP_IP6 ++ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",sfip_ntoa(GET_SRC_IP(p))); ++ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",sfip_ntoa(GET_DST_IP(p))); ++#else ++ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",inet_ntoa(p->iph->ip_src)); ++ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",inet_ntoa(p->iph->ip_dst)); ++#endif ++ LogMessage("DEBUG => [Alert_FWsam] Src Port : %i\n",p->sp); ++ LogMessage("DEBUG => [Alert_FWsam] Dest Port : %i\n",p->dp); ++ LogMessage("DEBUG => [Alert_FWsam] Sig_ID : %lu\n",event->sig_id); ++ ++#endif ++ ++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get the encryption buffer */ ++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt the packet with current key */ ++ ++ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */ ++ { LogMessage("WARNING => [Alert_FWsam] Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ stationtry=0; ++ } ++ else ++ { i=FWSAM_NETWAIT; ++#ifdef WIN32 ++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#else ++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#endif ++ while(i-- >1) /* the response packet */ ++ { waitms(10); /* wait for response (default maximum 3 secs */ ++ if(recv(stationsocket,encbuf,len,0)==len) ++ i=0; /* if we received packet we set the counter to 0. */ ++ /* by the time we check with if, it's already dec'ed to -1 */ ++ } ++ if(!i) /* id we timed out (i was one, then dec'ed)... */ ++ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ stationtry=0; ++ } ++ else /* got a packet */ ++ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */ ++ ++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ ++ { strcpy(station->stationkey,station->initialkey); /* try the intial key */ ++ TwoFishDestroy(station->stationfish); ++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */ ++ LogMessage("INFO => [Alert_FWsam] Had to use initial key!\n"); ++ } ++ if(len==sizeof(FWsamPacket)) /* valid decryption */ ++ { if(sampacket.version==FWSAM_PACKETVERSION)/* master speaks my language */ ++ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY ++ || sampacket.status==FWSAM_STATUS_RESYNC || sampacket.status==FWSAM_STATUS_HOLD) ++ { station->stationseqno=sampacket.fwseqno[0] | (sampacket.fwseqno[1]<<8); /* get stations seqno */ ++ station->lastcontact=(unsigned long)time(NULL); /* set the last contact time (not used yet) */ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": ++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": ++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": ++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); ++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); ++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); ++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status); ++ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version); ++#endif ++ if(sampacket.status==FWSAM_STATUS_HOLD) ++ { i=FWSAM_NETHOLD; /* Stay on hold for a maximum of 60 secs (default) */ ++ while(i-- >1) /* the response packet */ ++ { waitms(10); /* wait for response */ ++ if(recv(stationsocket,encbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,0)==sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE) ++ i=0; /* if we received packet we set the counter to 0. */ ++ } ++ if(!i) /* id we timed out (i was one, then dec'ed)... */ ++ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); ++ stationtry=0; ++ sampacket.status=FWSAM_STATUS_ERROR; ++ } ++ else /* got a packet */ ++ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */ ++ ++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ ++ { strcpy(station->stationkey,station->initialkey); /* try the intial key */ ++ TwoFishDestroy(station->stationfish); ++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */ ++ LogMessage("INFO => [Alert_FWsam] Had to use initial key again!\n"); ++ } ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": ++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": ++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": ++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); ++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); ++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno); ++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status); ++ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version); ++#endif ++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ ++ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ deletestation=TRUE; ++ sampacket.status=FWSAM_STATUS_ERROR; ++ } ++ else if(sampacket.version!=FWSAM_PACKETVERSION) /* invalid protocol version */ ++ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ deletestation=TRUE; ++ sampacket.status=FWSAM_STATUS_ERROR; ++ } ++ else if(sampacket.status!=FWSAM_STATUS_OK && sampacket.status!=FWSAM_STATUS_NEWKEY && sampacket.status!=FWSAM_STATUS_RESYNC) ++ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ deletestation=TRUE; ++ sampacket.status=FWSAM_STATUS_ERROR; ++ } ++ } ++ } ++ if(sampacket.status==FWSAM_STATUS_RESYNC) /* if station want's to resync... */ ++ { strcpy(station->stationkey,station->initialkey); /* ...we use the intial key... */ ++ memcpy(station->fwkeymod,sampacket.duration,4); /* and note the random key modifier */ ++ } ++ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) ++ { ++ FWsamNewStationKey(station,&sampacket); /* generate new TwoFish keys */ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Generated new encryption key...\n"); ++#endif ++ } ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ stationtry=0; ++ } ++ else if(sampacket.status==FWSAM_STATUS_ERROR) /* if SnortSam reports an error on second try, */ ++ { ++#ifdef WIN32 ++ closesocket(stationsocket); /* something is messed up and ... */ ++#else ++ close(stationsocket); ++#endif ++ if(stationtry>1) /* we ignore that station. */ ++ { deletestation=TRUE; /* flag for deletion */ ++ ErrorMessage("ERROR => [Alert_FWsam] Could not renegotiate key! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ } ++ else /* if we get an error on the first try, */ ++ { if(!FWsamCheckIn(station)) /* we first try to check in again. */ ++ { deletestation=TRUE; ++ ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ } ++ } ++ } ++ else /* an unknown status means trouble... */ ++ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ deletestation=TRUE; ++ } ++ } ++ else /* if the SnortSam agent uses a different packet version, we have no choice but to ignore it. */ ++ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ deletestation=TRUE; ++ } ++ } ++ else /* if the intial key failed to decrypt as well, the keys are not configured the same, and we ignore that SnortSam station. */ ++ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ deletestation=TRUE; ++ } ++ } ++ } ++ free(encbuf); /* release of the TwoFishAlloc'ed encryption buffer */ ++ } ++ if(stationtry==0 || deletestation) /* if everything went real well, or real bad... */ ++ { if(deletestation){ /* If it went bad, we remove the station from the list by marking the IP */ ++// station->stationip.s_addr=0; ++ station->stationip.ip32[0]=0; ++ } ++ fwsamlist=fwsamlist->next; ++ } ++ } ++ else ++ fwsamlist=fwsamlist->next; ++ } ++ } ++ else ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam] Skipping repetitive block.\n"); ++#endif ++ } ++ } ++} ++ ++/* FWsamCheckOut will be called when Snort exists. It de-registeres this snort sensor ++ * from the list of sensor that the SnortSam agent keeps. ++ */ ++void FWsamCheckOut(FWsamStation *station) ++{ FWsamPacket sampacket; ++ SOCKET stationsocket; ++ int i,len; ++ char *encbuf,*decbuf; ++ //unsigned char *encbuf,*decbuf; ++ ++ ++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); ++ if(stationsocket==INVALID_SOCKET) ++ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Funky socket error (socket)!\n"); ++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) ++ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Could not bind socket!\n"); ++ ++ /* let's connect to the agent */ ++ if(!connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) ++ { LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Disconnecting from host %s.\n",sfip_ntoa(&station->stationip)); ++ /* now build the packet */ ++ station->myseqno+=station->stationseqno; /* increase my seqno */ ++ sampacket.endiancheck=1; ++ sampacket.snortseqno[0]=(char)station->myseqno; ++ sampacket.snortseqno[1]=(char)(station->myseqno>>8); ++ sampacket.fwseqno[0]=(char)station->stationseqno; /* fill station seqno */ ++ sampacket.fwseqno[1]=(char)(station->stationseqno>>8); ++ sampacket.status=FWSAM_STATUS_CHECKOUT; /* checking out... */ ++ sampacket.version=FWSAM_PACKETVERSION; ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Sending CHECKOUT\n"); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Snort SeqNo: %x\n",station->myseqno); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Mgmt SeqNo : %x\n",station->stationseqno); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Status : %i\n",sampacket.status); ++ ++#endif ++ ++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get encryption buffer */ ++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt packet with current key */ ++ ++ if(send(stationsocket,encbuf,len,0)==len) ++ { i=FWSAM_NETWAIT; ++#ifdef WIN32 ++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#else ++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#endif ++ while(i-- >1) ++ { waitms(10); /* ...wait a maximum of 3 secs for response... */ ++ if(recv(stationsocket,encbuf,len,0)==len) /* ... for the status packet */ ++ i=0; ++ } ++ if(i) /* if we got the packet */ ++ { decbuf=(char *)&sampacket; ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); ++ ++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */ ++ { strcpy(station->stationkey,station->initialkey); /* try initial key */ ++ TwoFishDestroy(station->stationfish); /* toss this fish */ ++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialze TwoFish with initial key */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* and try to decrypt again */ ++ LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Had to use initial key!\n"); ++ } ++ if(len==sizeof(FWsamPacket)) /* valid decryption */ ++ { if(sampacket.version!=FWSAM_PACKETVERSION) /* but don't really care since we are on the way out */ ++ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Protocol version error! What the hell, we're quitting anyway! :)\n"); ++ } ++ else ++ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Password mismatch! What the hell, we're quitting anyway! :)\n"); ++ } ++ } ++ free(encbuf); /* release TwoFishAlloc'ed buffer */ ++ } ++ else ++ LogMessage("WARNING => [Alert_FWsam] Could not connect to host %s for CheckOut. What the hell, we're quitting anyway! :)\n",sfip_ntoa(&station->stationip)); ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++} ++ ++ ++/* FWSamFree: Disconnects all FW-1 management stations, ++ * closes sockets, and frees the structures. ++ */ ++void FWsamFree(FWsamList *list) ++{ ++ FWsamList *next; ++ ++ while(list) /* Free pointer list for rule type */ ++ { ++ next=list->next; ++ free(list); ++ list=next; ++ } ++ list=FWsamStationList; ++ ++ while(list) /* Free global pointer list and stations */ ++ { ++ next=list->next; ++ if (list->station) ++ { ++ if(list->station->stationip.ip32[0]) ++ //if(list->station->stationip.s_addr) ++ FWsamCheckOut(list->station); /* Send a Check-Out to SnortSam, */ ++ ++ TwoFishDestroy(list->station->stationfish); /* toss the fish, */ ++ free(list->station); /* free station, */ ++ } ++ free(list); /* free pointer, */ ++ list=next; /* and move to next. */ ++ } ++ FWsamStationList=NULL; ++ if(FWsamOptionField) ++ free(FWsamOptionField); ++} ++ ++void AlertFWsamCleanExitFunc(int signal, void *arg) ++{ FWsamList *fwsamlist; ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamCleanExitFunc) Exiting...\n"); ++#endif ++ ++ fwsamlist=(FWsamList *)arg; ++ FWsamFree(fwsamlist); /* Free all elements */ ++} ++ ++void AlertFWsamRestartFunc(int signal, void *arg) ++{ FWsamList *fwsamlist; ++ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamRestartFunc) Restarting...\n"); ++#endif ++ ++ fwsamlist=(FWsamList *)arg; ++ FWsamFree(fwsamlist); /* Free all elements */ ++} ++ ++/* This routine registers this Snort sensor with SnortSam. ++ * It will also change the encryption key based on some variables. ++ */ ++int FWsamCheckIn(FWsamStation *station) ++{ int i,len,stationok=TRUE; ++ FWsamPacket sampacket; ++ char *encbuf,*decbuf; ++ //unsigned char *encbuf,*decbuf; ++ SOCKET stationsocket; ++ ++ ++ /* create a socket for the station */ ++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); ++ if(stationsocket==INVALID_SOCKET) ++ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Funky socket error (socket)!\n"); ++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr))) ++ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Could not bind socket!\n"); ++ ++ i=TRUE; ++ /* let's connect to the agent */ ++ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr))) ++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not connect to host %s. Will try later.\n",sfip_ntoa(&station->stationip)); ++ else ++ { LogMessage("INFO => [Alert_FWsam](FWsamCheckIn) Connected to host %s.\n",sfip_ntoa(&station->stationip)); ++ /* now build the packet */ ++ sampacket.endiancheck=1; ++ sampacket.snortseqno[0]=(char)station->myseqno; /* fill my sequence number number */ ++ sampacket.snortseqno[1]=(char)(station->myseqno>>8); /* fill my sequence number number */ ++ sampacket.status=FWSAM_STATUS_CHECKIN; /* let's check in */ ++ sampacket.version=FWSAM_PACKETVERSION; /* set the packet version */ ++ memcpy(sampacket.duration,station->mykeymod,4); /* we'll send SnortSam our key modifier in the duration slot */ ++ /* (the checkin packet is just the plain initial key) */ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Sending CheckIn\n"); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",station->myseqno); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mode : %i\n",sampacket.status); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version); ++#endif ++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get buffer for encryption */ ++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt with initial key */ ++ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */ ++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); ++ else ++ { i=FWSAM_NETWAIT; ++#ifdef WIN32 ++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#else ++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */ ++#endif ++ while(i-- >1) ++ { waitms(10); /* wait a maximum of 3 secs for response */ ++ if(recv(stationsocket,encbuf,len,0)==len) ++ i=0; ++ } ++ if(!i) /* time up? */ ++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip)); ++ else ++ { decbuf=(char *)&sampacket; /* got status packet */ ++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt with initial key */ ++ if(len==sizeof(FWsamPacket)) /* valid decryption */ ++ { ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK": ++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY": ++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC": ++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR"); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8)); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mgmt SeqNo : %x\n",sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8)); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Status : %i\n",sampacket.status); ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version); ++#endif ++ if(sampacket.version==FWSAM_PACKETVERSION) /* master speaks my language */ ++ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) ++ { station->stationseqno=sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8); /* get stations seqno */ ++ station->lastcontact=(unsigned long)time(NULL); ++ ++ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) /* generate new keys */ ++ { memcpy(station->fwkeymod,sampacket.duration,4); /* note the key modifier */ ++ FWsamNewStationKey(station,&sampacket); /* and generate new TwoFish keys (with key modifiers) */ ++#ifdef FWSAMDEBUG ++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Generated new encryption key...\n"); ++#endif ++ } ++ } ++ else /* weird, got a strange status back */ ++ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ stationok=FALSE; ++ } ++ } ++ else /* packet version does not match */ ++ { ErrorMessage("ERROR =>[Alert_FWsam](FWsamCheckIn) Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ stationok=FALSE; ++ } ++ } ++ else /* key does not match */ ++ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip)); ++ stationok=FALSE; ++ } ++ } ++ } ++ free(encbuf); /* release TwoFishAlloc'ed buffer */ ++ } ++#ifdef WIN32 ++ closesocket(stationsocket); ++#else ++ close(stationsocket); ++#endif ++ return stationok; ++} ++#undef FWSAMDEBUG ++ + +Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h +=================================================================== +--- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 0) ++++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 3) +@@ -0,0 +1,216 @@ ++/* $Id: snortpatchb,v 1.5 2005/10/06 08:50:39 fknobbe Exp $ ++** ++** spo_alert_fwsam.h ++** ++** Copyright (c) 2001-2004 Frank Knobbe ++** ++** This program is free software; you can redistribute it and/or modify ++** it under the terms of the GNU General Public License as published by ++** the Free Software Foundation; either version 2 of the License, or ++** (at your option) any later version. ++** ++** This program is distributed in the hope that it will be useful, ++** but WITHOUT ANY WARRANTY; without even the implied warranty of ++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++** GNU General Public License for more details. ++** ++** You should have received a copy of the GNU General Public License ++** along with this program; if not, write to the Free Software ++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++*/ ++ ++/* This file gets included in plugbase.c when it is integrated into the rest ++ * of the program. ++ * ++ * For more info, see the beginning of spo_alert_fwsam.c ++ * ++ */ ++ ++#ifndef __SPO_FWSAM_H__ ++#define __SPO_FWSAM_H__ ++ ++#include "snort.h" ++#include "rules.h" ++#include "plugbase.h" ++#include "plugin_enum.h" ++#include "fatal.h" ++#include "util.h" ++#include "twofish.h" ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++ ++/* just some compatibility stuff */ ++#ifdef WIN32 ++#if !defined(_WINSOCKAPI_) && !defined(_WINSOCK2API_) ++#include ++#endif ++#define waitms(x) Sleep(x) ++ ++#else ++ ++#include ++#include ++#include ++#include ++#include ++ ++#ifdef SOLARIS ++#include ++#endif ++ ++typedef int SOCKET; ++ ++#ifndef INVALID_SOCKET ++#define INVALID_SOCKET -1 ++#endif ++ ++#define waitms(x) usleep((x)*1000) ++ ++#endif ++ ++#ifndef FALSE ++#define FALSE 0 ++#endif ++#ifndef TRUE ++#define TRUE !FALSE ++#endif ++#ifndef bool ++#define bool int ++#endif ++ ++ ++#if defined(_DEBUG) || defined(DEBUG) ++#ifndef FWSAMDEBUG ++#define FWSAMDEBUG ++#endif ++#else ++#endif ++ ++ ++/* Official Snort PlugIn Number has been moved into plugin_enum.h */ ++ ++ ++/* fixed defines */ ++ ++#define FWSAM_DEFAULTPORT 898 /* Default port if user does not specify one in snort.conf */ ++ /* (Was unused last time I checked...) */ ++#define FWSAM_PACKETVERSION 14 /* version of the packet. Will increase with enhancements. */ ++ ++#define FWSAM_STATUS_CHECKIN 1 /* snort to fw */ ++#define FWSAM_STATUS_CHECKOUT 2 ++#define FWSAM_STATUS_BLOCK 3 ++#define FWSAM_STATUS_UNBLOCK 9 ++ ++#define FWSAM_STATUS_OK 4 /* fw to snort */ ++#define FWSAM_STATUS_ERROR 5 ++#define FWSAM_STATUS_NEWKEY 6 ++#define FWSAM_STATUS_RESYNC 7 ++#define FWSAM_STATUS_HOLD 8 ++ ++#define FWSAM_LOG_NONE 0 ++#define FWSAM_LOG_SHORTLOG 1 ++#define FWSAM_LOG_SHORTALERT 2 ++#define FWSAM_LOG_LONGLOG 3 ++#define FWSAM_LOG_LONGALERT 4 ++#define FWSAM_LOG (FWSAM_LOG_SHORTLOG|FWSAM_LOG_SHORTALERT|FWSAM_LOG_LONGLOG|FWSAM_LOG_LONGALERT) ++#define FWSAM_WHO_DST 8 ++#define FWSAM_WHO_SRC 16 ++#define FWSAM_WHO (FWSAM_WHO_DST|FWSAM_WHO_SRC) ++#define FWSAM_HOW_IN 32 ++#define FWSAM_HOW_OUT 64 ++#define FWSAM_HOW_INOUT (FWSAM_HOW_IN|FWSAM_HOW_OUT) ++#define FWSAM_HOW_THIS 128 ++#define FWSAM_HOW (FWSAM_HOW_IN|FWSAM_HOW_OUT|FWSAM_HOW_THIS) ++ ++ ++/* user adjustable defines */ ++ ++#define FWSAM_REPET_BLOCKS 10 /* Snort remembers this amount of last blocks and... */ ++#define FWSAM_REPET_TIME 20 /* ...checks if they fall within this time. If so,... */ ++ /* ...the blocking request is not send. */ ++ ++#define FWSAM_NETWAIT 300 /* 100th of a second. 3 sec timeout for network connections */ ++#define FWSAM_NETHOLD 6000 /* 100th of a second. 60 sec timeout for holding */ ++ ++#define SID_MAPFILE "sid-block.map" ++#define SID_ALT_MAPFILE "sid-fwsam.map" ++ ++#define FWSAM_FANCYFETCH /* This will invoke a fast sid lookup routine */ ++ ++ ++/* vars */ ++ ++typedef struct _FWsamstation /* structure of a mgmt station */ ++{ unsigned short myseqno; ++ unsigned short stationseqno; ++ unsigned char mykeymod[4]; ++ unsigned char fwkeymod[4]; ++ unsigned short stationport; ++ //struct in_addr stationip; ++ sfip_t stationip; ++ struct sockaddr_in localsocketaddr; ++ struct sockaddr_in stationsocketaddr; ++ TWOFISH *stationfish; ++ char initialkey[TwoFish_KEY_LENGTH+2]; ++ char stationkey[TwoFish_KEY_LENGTH+2]; ++ time_t lastcontact; ++/* time_t sleepstart; */ ++} FWsamStation; ++ ++typedef struct _FWsampacket /* 2 blocks (3rd block is header from TwoFish) */ ++{ unsigned short endiancheck; /* 0 */ ++ unsigned char srcip[4]; /* 2 */ ++ unsigned char dstip[4]; /* 6 */ ++ unsigned char duration[4]; /* 10 */ ++ unsigned char snortseqno[2]; /* 14 */ ++ unsigned char fwseqno[2]; /* 16 */ ++ unsigned char srcport[2]; /* 18 */ ++ unsigned char dstport[2]; /* 20 */ ++ unsigned char protocol[2]; /* 22 */ ++ unsigned char fwmode; /* 24 */ ++ unsigned char version; /* 25 */ ++ unsigned char status; /* 26 */ ++ unsigned char sig_id[4]; /* 27 */ ++ unsigned char fluff; /* 31 */ ++} FWsamPacket; /* 32 bytes in size */ ++ ++typedef struct _FWsamoptions /* snort rule options */ ++{ unsigned long sid; ++ unsigned long duration; ++ unsigned char who; ++ unsigned char how; ++ unsigned char loglevel; ++} FWsamOptions; ++ ++typedef struct _FWsamlistpointer ++{ FWsamStation *station; ++ struct _FWsamlistpointer *next; ++} FWsamList; ++ ++ ++/* functions */ ++void AlertFWsamSetup(void); ++void AlertFWsamInit(char *args); ++void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol); ++void AlertFWsamCleanExitFunc(int signal, void *arg); ++void AlertFWsamRestartFunc(int signal, void *arg); ++void AlertFWsam(Packet *p, char *msg, void *arg, Event *event); ++int FWsamCheckIn(FWsamStation *station); ++void FWsamCheckOut(FWsamStation *station); ++void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet); ++void FWsamFixPacketEndian(FWsamPacket *p); ++unsigned long FWsamParseDuration(char *p); ++void FWsamFree(FWsamList *fwsamlist); ++int FWsamStationExists(FWsamStation *who,FWsamList *list); ++int FWsamReadLine(char *,unsigned long,FILE *); ++void FWsamParseLine(FWsamOptions *,char *); ++FWsamOptions *FWsamGetOption(unsigned long); ++int FWsamParseOption(FWsamOptions *,char *); ++ ++#endif /* __SPO_FWSAM_H__ */ + +Index: snort-2.8.6.1/src/output-plugins/Makefile.am +=================================================================== +--- snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 1) ++++ snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 3) +@@ -11,6 +11,7 @@ + spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ + spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ + spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ ++spo_alert_fwsam.c spo_alert_fwsam.h \ + spo_alert_test.c spo_alert_test.h + + INCLUDES = @INCLUDES@ +Index: snort-2.8.6.1/src/plugbase.c +=================================================================== +--- snort-2.8.6.1/src/plugbase.c (Revision 1) ++++ snort-2.8.6.1/src/plugbase.c (Revision 3) +@@ -125,6 +125,7 @@ + #endif + + #include "output-plugins/spo_alert_test.h" ++#include "output-plugins/spo_alert_fwsam.h" + + extern ListHead *head_tmp; + extern PreprocConfigFuncNode *preproc_config_funcs; +@@ -1240,6 +1241,7 @@ + #endif + + AlertTestSetup(); ++ AlertFWsamSetup(); + } + + /**************************************************************************** +Index: snort-2.8.6.1/src/Makefile.am +=================================================================== +--- snort-2.8.6.1/src/Makefile.am (Revision 1) ++++ snort-2.8.6.1/src/Makefile.am (Revision 3) +@@ -52,7 +52,8 @@ + detection_filter.c detection_filter.h \ + rate_filter.c rate_filter.h \ + obfuscation.c obfuscation.h \ +-rule_option_types.h ++rule_option_types.h \ ++twofish.c twofish.h + + snort_LDADD = output-plugins/libspo.a \ + detection-plugins/libspd.a \ +Index: snort-2.8.6.1/autojunk.sh +=================================================================== +--- snort-2.8.6.1/autojunk.sh (Revision 0) ++++ snort-2.8.6.1/autojunk.sh (Revision 3) +@@ -0,0 +1,7 @@ ++#!/bin/sh ++# the list of commands that need to run before we do a compile ++libtoolize --automake --copy ++aclocal -I m4 ++autoheader ++automake --add-missing --copy ++autoconf + +Index: snort-2.8.6.1/etc/snort.conf +=================================================================== +--- snort-2.8.6.1/etc/snort.conf (Revision 1) ++++ snort-2.8.6.1/etc/snort.conf (Revision 3) +@@ -277,6 +277,32 @@ + # prelude + # output alert_prelude + ++# snortsam ++# In order to cause Snort to send a blocking request to the SnortSam agent, ++# that agent has to be listed, including the port it listens on, ++# and the encryption key it is using. The statement for that is: ++# ++# output alert_fwsam: {SnortSam Station}:{port}/{password} ++# ++# {SnortSam Station}: IP address or host name of the host where SnortSam is running. ++# {port}: The port the remote SnortSam agent listens on. ++# {password}: The password, or key, used for encryption of the ++# communication to the remote agent. ++# ++# At the very least, the IP address or host name of the host running SnortSam ++# needs to be specified. If the port is omitted, it defaults to TCP port 898. ++# If the password is omitted, it defaults to a preset password. ++# (In which case it needs to be omitted on the SnortSam agent as well) ++# ++# More than one host can be specified, but has to be done on the same line. ++# Just separate them with one or more spaces. ++# ++# Examples: ++# ++# output alert_fwsam: firewall/idspassword ++# output alert_fwsam: fw1.domain.tld:898/mykey ++# output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw ++ + # metadata reference data. do not modify these lines + include classification.config + include reference.config diff --git a/config/snort-dev/patches/inlinemode_options_flags.txt b/config/snort-dev/patches/inlinemode_options_flags.txt new file mode 100644 index 00000000..e69de29b diff --git a/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.am b/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.am new file mode 100644 index 00000000..0879c6e3 --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.am @@ -0,0 +1,17 @@ +## $Id +AUTOMAKE_OPTIONS=foreign no-dependencies + +noinst_LIBRARIES = libspo.a + +libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \ +spo_alert_full.c spo_alert_full.h \ +spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \ +spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \ +spo_log_null.c spo_log_null.h spo_log_tcpdump.c \ +spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ +spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ +spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ +spo_alert_test.c spo_alert_test.h \ +spo_pf.h spo_pf.c + +INCLUDES = @INCLUDES@ diff --git a/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.in b/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.in new file mode 100644 index 00000000..3f06cc31 --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/2.8.6/Makefile.in @@ -0,0 +1,445 @@ +# Makefile.in generated by automake 1.9.6 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005 Free Software Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +srcdir = @srcdir@ +top_srcdir = @top_srcdir@ +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +top_builddir = ../.. +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +INSTALL = @INSTALL@ +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +subdir = src/output-plugins +DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \ + $(top_srcdir)/configure.in +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +LIBRARIES = $(noinst_LIBRARIES) +ARFLAGS = cru +libspo_a_AR = $(AR) $(ARFLAGS) +libspo_a_LIBADD = +am_libspo_a_OBJECTS = spo_alert_fast.$(OBJEXT) \ + spo_alert_full.$(OBJEXT) spo_alert_syslog.$(OBJEXT) \ + spo_alert_unixsock.$(OBJEXT) spo_csv.$(OBJEXT) \ + spo_database.$(OBJEXT) spo_log_null.$(OBJEXT) \ + spo_log_tcpdump.$(OBJEXT) spo_unified.$(OBJEXT) \ + spo_unified2.$(OBJEXT) spo_log_ascii.$(OBJEXT) \ + spo_alert_sf_socket.$(OBJEXT) spo_alert_prelude.$(OBJEXT) \ + spo_alert_arubaaction.$(OBJEXT) spo_alert_test.$(OBJEXT) \ + spo_pf.$(OBJEXT) +libspo_a_OBJECTS = $(am_libspo_a_OBJECTS) +DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir) +depcomp = +am__depfiles_maybe = +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +CCLD = $(CC) +LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +SOURCES = $(libspo_a_SOURCES) +DIST_SOURCES = $(libspo_a_SOURCES) +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +AMDEP_FALSE = @AMDEP_FALSE@ +AMDEP_TRUE = @AMDEP_TRUE@ +AMTAR = @AMTAR@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BUILD_DYNAMIC_EXAMPLES_FALSE = @BUILD_DYNAMIC_EXAMPLES_FALSE@ +BUILD_DYNAMIC_EXAMPLES_TRUE = @BUILD_DYNAMIC_EXAMPLES_TRUE@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CXX = @CXX@ +CXXCPP = @CXXCPP@ +CXXDEPMODE = @CXXDEPMODE@ +CXXFLAGS = @CXXFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +ECHO = @ECHO@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +F77 = @F77@ +FFLAGS = @FFLAGS@ +HAVE_DYNAMIC_PLUGINS_FALSE = @HAVE_DYNAMIC_PLUGINS_FALSE@ +HAVE_DYNAMIC_PLUGINS_TRUE = @HAVE_DYNAMIC_PLUGINS_TRUE@ +HAVE_SUP_IP6_FALSE = @HAVE_SUP_IP6_FALSE@ +HAVE_SUP_IP6_TRUE = @HAVE_SUP_IP6_TRUE@ +HAVE_TARGET_BASED_FALSE = @HAVE_TARGET_BASED_FALSE@ +HAVE_TARGET_BASED_TRUE = @HAVE_TARGET_BASED_TRUE@ +HAVE_ZLIB_FALSE = @HAVE_ZLIB_FALSE@ +HAVE_ZLIB_TRUE = @HAVE_ZLIB_TRUE@ +INCLUDES = @INCLUDES@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LDFLAGS = @LDFLAGS@ +LEX = @LEX@ +LIBOBJS = @LIBOBJS@ +LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@ +LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@ +LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@ +LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@ +LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@ +LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@ +LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAINT = @MAINT@ +MAINTAINER_MODE_FALSE = @MAINTAINER_MODE_FALSE@ +MAINTAINER_MODE_TRUE = @MAINTAINER_MODE_TRUE@ +MAKEINFO = @MAKEINFO@ +OBJEXT = @OBJEXT@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +RANLIB = @RANLIB@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +STRIP = @STRIP@ +VERSION = @VERSION@ +YACC = @YACC@ +ac_ct_AR = @ac_ct_AR@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_CXX = @ac_ct_CXX@ +ac_ct_F77 = @ac_ct_F77@ +ac_ct_RANLIB = @ac_ct_RANLIB@ +ac_ct_STRIP = @ac_ct_STRIP@ +am__fastdepCC_FALSE = @am__fastdepCC_FALSE@ +am__fastdepCC_TRUE = @am__fastdepCC_TRUE@ +am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@ +am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +datadir = @datadir@ +exec_prefix = @exec_prefix@ +extra_incl = @extra_incl@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +AUTOMAKE_OPTIONS = foreign no-dependencies +noinst_LIBRARIES = libspo.a +libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \ +spo_alert_full.c spo_alert_full.h \ +spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \ +spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \ +spo_log_null.c spo_log_null.h spo_log_tcpdump.c \ +spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \ +spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \ +spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \ +spo_alert_test.c spo_alert_test.h \ +spo_pf.h spo_pf.c + +all: all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ + && exit 0; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/output-plugins/Makefile'; \ + cd $(top_srcdir) && \ + $(AUTOMAKE) --foreign src/output-plugins/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +clean-noinstLIBRARIES: + -test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES) +libspo.a: $(libspo_a_OBJECTS) $(libspo_a_DEPENDENCIES) + -rm -f libspo.a + $(libspo_a_AR) libspo.a $(libspo_a_OBJECTS) $(libspo_a_LIBADD) + $(RANLIB) libspo.a + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +.c.o: + $(COMPILE) -c $< + +.c.obj: + $(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: + $(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs + +distclean-libtool: + -rm -f libtool +uninstall-info-am: + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$tags $$unique; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + tags=; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) ' { files[$$0] = 1; } \ + END { for (i in files) print i; }'`; \ + test -z "$(CTAGS_ARGS)$$tags$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$tags $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && cd $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) $$here + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \ + list='$(DISTFILES)'; for file in $$list; do \ + case $$file in \ + $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \ + $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \ + esac; \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test "$$dir" != "$$file" && test "$$dir" != "."; then \ + dir="/$$dir"; \ + $(mkdir_p) "$(distdir)$$dir"; \ + else \ + dir=''; \ + fi; \ + if test -d $$d/$$file; then \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \ + fi; \ + cp -pR $$d/$$file $(distdir)$$dir || exit 1; \ + else \ + test -f $(distdir)/$$file \ + || cp -p $$d/$$file $(distdir)/$$file \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(LIBRARIES) +installdirs: +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install +mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-libtool clean-noinstLIBRARIES \ + mostlyclean-am + +distclean: distclean-am + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-libtool distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +info: info-am + +info-am: + +install-data-am: + +install-exec-am: + +install-info: install-info-am + +install-man: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-info-am + +.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \ + clean-libtool clean-noinstLIBRARIES ctags distclean \ + distclean-compile distclean-generic distclean-libtool \ + distclean-tags distdir dvi dvi-am html html-am info info-am \ + install install-am install-data install-data-am install-exec \ + install-exec-am install-info install-info-am install-man \ + install-strip installcheck installcheck-am installdirs \ + maintainer-clean maintainer-clean-generic mostlyclean \ + mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ + pdf pdf-am ps ps-am tags uninstall uninstall-am \ + uninstall-info-am + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/config/snort-dev/patches/spoink_patch/2.8.6/plugbase.c b/config/snort-dev/patches/spoink_patch/2.8.6/plugbase.c new file mode 100644 index 00000000..31f381a8 --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/2.8.6/plugbase.c @@ -0,0 +1,1544 @@ +/* $Id$ */ +/* +** Copyright (C) 2002-2010 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +*/ + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include +#include +#include +#include + +#ifdef HAVE_STRINGS_H +#include +#endif + +#ifndef WIN32 +#include +#include +#include +#endif /* !WIN32 */ +#include +#include + +#include "sf_types.h" +#include "plugbase.h" +#include "spo_plugbase.h" +#include "snort.h" +#include "debug.h" +#include "util.h" +#include "log.h" +#include "detect.h" + +/* built-in preprocessors */ +#include "preprocessors/spp_rpc_decode.h" +#include "preprocessors/spp_bo.h" +#include "preprocessors/spp_stream5.h" +#include "preprocessors/spp_arpspoof.h" +#include "preprocessors/spp_perfmonitor.h" +#include "preprocessors/spp_httpinspect.h" +#include "preprocessors/spp_sfportscan.h" +#include "preprocessors/spp_frag3.h" + +/* built-in detection plugins */ +#include "detection-plugins/sp_pattern_match.h" +#include "detection-plugins/sp_tcp_flag_check.h" +#include "detection-plugins/sp_icmp_type_check.h" +#include "detection-plugins/sp_icmp_code_check.h" +#include "detection-plugins/sp_ttl_check.h" +#include "detection-plugins/sp_ip_id_check.h" +#include "detection-plugins/sp_tcp_ack_check.h" +#include "detection-plugins/sp_tcp_seq_check.h" +#include "detection-plugins/sp_dsize_check.h" +#include "detection-plugins/sp_ipoption_check.h" +#include "detection-plugins/sp_rpc_check.h" +#include "detection-plugins/sp_icmp_id_check.h" +#include "detection-plugins/sp_icmp_seq_check.h" +#include "detection-plugins/sp_session.h" +#include "detection-plugins/sp_ip_tos_check.h" +#include "detection-plugins/sp_ip_fragbits.h" +#include "detection-plugins/sp_tcp_win_check.h" +#include "detection-plugins/sp_ip_same_check.h" +#include "detection-plugins/sp_ip_proto.h" +#include "detection-plugins/sp_ip_same_check.h" +#include "detection-plugins/sp_clientserver.h" +#include "detection-plugins/sp_byte_check.h" +#include "detection-plugins/sp_byte_jump.h" +#include "detection-plugins/sp_isdataat.h" +#include "detection-plugins/sp_pcre.h" +#include "detection-plugins/sp_flowbits.h" +#include "detection-plugins/sp_file_data.h" +#include "detection-plugins/sp_asn1.h" +#ifdef ENABLE_REACT +#include "detection-plugins/sp_react.h" +#endif +#ifdef ENABLE_RESPOND +#include "detection-plugins/sp_respond.h" +#endif +#include "detection-plugins/sp_ftpbounce.h" +#include "detection-plugins/sp_urilen_check.h" +#include "detection-plugins/sp_cvs.h" + +/* built-in output plugins */ +#include "output-plugins/spo_alert_syslog.h" +#include "output-plugins/spo_log_tcpdump.h" +#include "output-plugins/spo_database.h" +#include "output-plugins/spo_alert_fast.h" +#include "output-plugins/spo_alert_full.h" +#include "output-plugins/spo_alert_unixsock.h" +#include "output-plugins/spo_csv.h" +#include "output-plugins/spo_unified.h" +#include "output-plugins/spo_log_null.h" +#include "output-plugins/spo_log_ascii.h" +#include "output-plugins/spo_unified2.h" +#include "output-plugins/spo_pf.h" + +#ifdef ARUBA +#include "output-plugins/spo_alert_arubaaction.h" +#endif + +#ifdef HAVE_LIBPRELUDE +#include "output-plugins/spo_alert_prelude.h" +#endif + +#ifdef LINUX +#include "output-plugins/spo_alert_sf_socket.h" +#endif + +#include "output-plugins/spo_alert_test.h" + +extern ListHead *head_tmp; +extern PreprocConfigFuncNode *preproc_config_funcs; +extern OutputConfigFuncNode *output_config_funcs; +extern RuleOptConfigFuncNode *rule_opt_config_funcs; +extern RuleOptOverrideInitFuncNode *rule_opt_override_init_funcs; +extern RuleOptParseCleanupNode *rule_opt_parse_cleanup_list; +extern PreprocSignalFuncNode *preproc_restart_funcs; +extern PreprocSignalFuncNode *preproc_clean_exit_funcs; +extern PreprocSignalFuncNode *preproc_shutdown_funcs; +extern PreprocSignalFuncNode *preproc_reset_funcs; +extern PreprocSignalFuncNode *preproc_reset_stats_funcs; +extern PreprocStatsFuncNode *preproc_stats_funcs; +extern PluginSignalFuncNode *plugin_shutdown_funcs; +extern PluginSignalFuncNode *plugin_clean_exit_funcs; +extern PluginSignalFuncNode *plugin_restart_funcs; +extern OutputFuncNode *AlertList; +extern OutputFuncNode *LogList; + + +/**************************** Detection Plugin API ****************************/ +/* For translation from enum to char* */ +#ifdef DEBUG +static const char *optTypeMap[OPT_TYPE_MAX] = +{ + "action", + "logging", + "detection" +}; + +#define ENUM2STR(num, map) \ + ((num < sizeof(map)/sizeof(map[0])) ? map[num] : "undefined") +#endif + + +void RegisterRuleOptions(void) +{ + LogMessage("Initializing Plug-ins!\n"); + + SetupPatternMatch(); + SetupTCPFlagCheck(); + SetupIcmpTypeCheck(); + SetupIcmpCodeCheck(); + SetupTtlCheck(); + SetupIpIdCheck(); + SetupTcpAckCheck(); + SetupTcpSeqCheck(); + SetupDsizeCheck(); + SetupIpOptionCheck(); + SetupRpcCheck(); + SetupIcmpIdCheck(); + SetupIcmpSeqCheck(); + SetupSession(); + SetupIpTosCheck(); + SetupFragBits(); + SetupFragOffset(); + SetupTcpWinCheck(); + SetupIpProto(); + SetupIpSameCheck(); + SetupClientServer(); + SetupByteTest(); + SetupByteJump(); + SetupIsDataAt(); + SetupFileData(); + SetupPcre(); + SetupFlowBits(); + SetupAsn1(); +#ifdef ENABLE_REACT + SetupReact(); +#endif +#ifdef ENABLE_RESPOND + SetupRespond(); +#endif + SetupFTPBounce(); + SetupUriLenCheck(); + SetupCvs(); +} + +/**************************************************************************** + * + * Function: RegisterRuleOption(char *, void (*func)(), enum OptionType) + * + * Purpose: Associates a rule option keyword with an option setup/linking + * function. + * + * Arguments: keyword => The option keyword to associate with the option + * handler + * *func => function pointer to the handler + * type => used to determine where keyword is allowed + * + * Returns: void function + * + ***************************************************************************/ +void RegisterRuleOption(char *opt_name, RuleOptConfigFunc config_func, + RuleOptOverrideInitFunc override_init_func, + RuleOptType opt_type, + RuleOptOtnHandler otn_handler) +{ + RuleOptConfigFuncNode *node; + + DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Registering keyword:func => %s/%s:%p\n", + ENUM2STR(opt_type, optTypeMap), opt_name, config_func);); + + node = (RuleOptConfigFuncNode *)SnortAlloc(sizeof(RuleOptConfigFuncNode)); + + if (rule_opt_config_funcs == NULL) + { + rule_opt_config_funcs = node; + } + else + { + RuleOptConfigFuncNode *tmp = rule_opt_config_funcs; + RuleOptConfigFuncNode *last; + + do + { + if (strcasecmp(tmp->keyword, opt_name) == 0) + { + free(node); + FatalError("Duplicate detection plugin keyword: %s.\n", + file_line, opt_name); + } + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + last->next = node; + } + + node->keyword = SnortStrdup(opt_name); + node->type = opt_type; + node->func = config_func; + node->otn_handler = otn_handler; + + if (override_init_func != NULL) + { + RuleOptOverrideInitFuncNode *node_override = + (RuleOptOverrideInitFuncNode *)SnortAlloc(sizeof(RuleOptOverrideInitFuncNode)); + + if (rule_opt_override_init_funcs == NULL) + { + rule_opt_override_init_funcs = node_override; + } + else + { + RuleOptOverrideInitFuncNode *tmp = rule_opt_override_init_funcs; + RuleOptOverrideInitFuncNode *last; + + do + { + if (strcasecmp(tmp->keyword, opt_name) == 0) + { + free(node_override); + FatalError("RegisterRuleOption: Duplicate detection plugin keyword:" + " (%s) (%s)!\n", tmp->keyword, opt_name); + } + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + last->next = node_override; + } + + node_override->keyword = SnortStrdup(opt_name); + node_override->type = opt_type; + node_override->func = override_init_func; + node_override->otn_handler = otn_handler; + } +} + +void RegisterOverrideKeyword(char *keyword, char *option, RuleOptOverrideFunc func) +{ + RuleOptOverrideInitFuncNode *node = rule_opt_override_init_funcs; + + while (node != NULL) + { + if (strcasecmp(node->keyword, keyword) == 0) + { + node->func(keyword, option, func); + break; + } + + node = node->next; + } +} + +/**************************************************************************** + * + * Function: DumpPlugIns() + * + * Purpose: Prints the keyword->function list + * + * Arguments: None. + * + * Returns: void function + * + ***************************************************************************/ +void DumpRuleOptions(void) +{ + RuleOptConfigFuncNode *node; + + node = rule_opt_config_funcs; + + LogMessage("-------------------------------------------------\n"); + LogMessage(" Keyword | Plugin Registered @\n"); + LogMessage("-------------------------------------------------\n"); + + while (node != NULL) + { + LogMessage("%-13s: %p\n", node->keyword, node->func); + node = node->next; + } + + LogMessage("-------------------------------------------------\n"); + LogMessage("\n"); +} + + +/**************************************************************************** + * + * Function: AddOptFuncToList(int (*func)(), OptTreeNode *) + * + * Purpose: Links the option detection module to the OTN + * + * Arguments: (*func)() => function pointer to the detection module + * otn => pointer to the current OptTreeNode + * + * Returns: void function + * + ***************************************************************************/ +OptFpList * AddOptFuncToList(RuleOptEvalFunc func, OptTreeNode *otn) +{ + OptFpList *ofp = (OptFpList *)SnortAlloc(sizeof(OptFpList)); + + DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n");); + + /* if there are no nodes on the function list... */ + if (otn->opt_func == NULL) + { + otn->opt_func = ofp; + } + else + { + OptFpList *tmp = otn->opt_func; + + /* walk to the end of the list */ + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = ofp; + } + + DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", func);); + + ofp->OptTestFunc = func; + + return ofp; +} + +/**************************************************************************** + * + * Function: AddRspFuncToList(int (*func)(), OptTreeNode *) + * + * Purpose: Adds Response function to OTN + * + * Arguments: (*func)() => function pointer to the response module + * otn => pointer to the current OptTreeNode + * + * Returns: void function + * + ***************************************************************************/ +void AddRspFuncToList(ResponseFunc func, OptTreeNode *otn, void *params) +{ + RspFpList *rsp = (RspFpList *)SnortAlloc(sizeof(RspFpList)); + + DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding response to list\n");); + + /* if there are no nodes on the function list... */ + if (otn->rsp_func == NULL) + { + otn->rsp_func = rsp; + } + else + { + RspFpList *tmp = otn->rsp_func; + + /* walk to the end of the list */ + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = rsp; + } + + DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set ResponseFunc to %p\n", func);); + + rsp->func = func; + rsp->params = params; +} + +void PostConfigInitPlugins(PluginSignalFuncNode *post_config_funcs) +{ + while (post_config_funcs != NULL) + { + post_config_funcs->func(0, post_config_funcs->arg); + post_config_funcs = post_config_funcs->next; + } +} + +void FreeRuleOptConfigFuncs(RuleOptConfigFuncNode *head) +{ + + while (head != NULL) + { + RuleOptConfigFuncNode *tmp = head; + + head = head->next; + + if (tmp->keyword != NULL) + free(tmp->keyword); + + free(tmp); + } +} + +void FreeRuleOptOverrideInitFuncs(RuleOptOverrideInitFuncNode *head) +{ + + while (head != NULL) + { + RuleOptOverrideInitFuncNode *tmp = head; + + head = head->next; + + if (tmp->keyword != NULL) + free(tmp->keyword); + + free(tmp); + } +} + +void FreePluginSigFuncs(PluginSignalFuncNode *head) +{ + while (head != NULL) + { + PluginSignalFuncNode *tmp = head; + + head = head->next; + + /* don't free sig->arg, that's free'd by the CleanExit/Restart func */ + free(tmp); + } +} + + +/************************** Preprocessor Plugin API ***************************/ +static void AddFuncToPreprocSignalList(PreprocSignalFunc, void *, + PreprocSignalFuncNode **, uint16_t, uint32_t); + + +void RegisterPreprocessors(void) +{ + LogMessage("Initializing Preprocessors!\n"); + + SetupARPspoof(); + SetupFrag3(); + SetupStream5(); + SetupRpcDecode(); + SetupBo(); + SetupHttpInspect(); + SetupPerfMonitor(); + SetupSfPortscan(); +} + +/**************************************************************************** + * + * Function: RegisterPreprocessor(char *, void (*)(char *)) + * + * Purpose: Associates a preprocessor statement with its function. + * + * Arguments: keyword => The option keyword to associate with the + * preprocessor + * *func => function pointer to the handler + * + * Returns: void function + * + ***************************************************************************/ +#ifndef SNORT_RELOAD +void RegisterPreprocessor(char *keyword, PreprocConfigFunc func) +#else +void RegisterPreprocessor(char *keyword, PreprocConfigFunc func, + PreprocReloadFunc rfunc, PreprocReloadSwapFunc sfunc, + PreprocReloadSwapFreeFunc ffunc) +#endif +{ + PreprocConfigFuncNode *node = + (PreprocConfigFuncNode *)SnortAlloc(sizeof(PreprocConfigFuncNode)); + + DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:preproc => %s:%p\n", keyword, func);); + + if (preproc_config_funcs == NULL) + { + preproc_config_funcs = node; + } + else + { + PreprocConfigFuncNode *tmp = preproc_config_funcs; + PreprocConfigFuncNode *last; + + do + { + if (strcasecmp(tmp->keyword, keyword) == 0) + { + free(node); + FatalError("Duplicate preprocessor keyword: %s.\n", keyword); + } + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + last->next = node; + } + + node->keyword = SnortStrdup(keyword); + node->config_func = func; + +#ifdef SNORT_RELOAD + node->reload_func = rfunc; + node->reload_swap_func = sfunc; + node->reload_swap_free_func = ffunc; +#endif +} + +PreprocConfigFuncNode * GetPreprocConfig(char *keyword) +{ + PreprocConfigFuncNode *head = preproc_config_funcs; + + if (keyword == NULL) + return NULL; + + while (head != NULL) + { + if (strcasecmp(head->keyword, keyword) == 0) + return head; + + head = head->next; + } + + return NULL; +} + +PreprocConfigFunc GetPreprocConfigFunc(char *keyword) +{ + PreprocConfigFuncNode *head = preproc_config_funcs; + + if (keyword == NULL) + return NULL; + + while (head != NULL) + { + if (strcasecmp(head->keyword, keyword) == 0) + return head->config_func; + + head = head->next; + } + + return NULL; +} + +/**************************************************************************** + * + * Function: RegisterPreprocStats(char *keyword, void (*func)(int)) + * + * Purpose: Registers a function for printing preprocessor final stats + * (or other if it has a use for printing final stats) + * + * Arguments: keyword => keyword (preprocessor) whose stats will print + * func => function pointer to the handler + * + * Returns: void function + * + ***************************************************************************/ +void RegisterPreprocStats(char *keyword, PreprocStatsFunc func) +{ + PreprocStatsFuncNode *node; + + DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering final stats function: " + "preproc => %s:%p\n", keyword, func);); + + node = (PreprocStatsFuncNode *)SnortAlloc(sizeof(PreprocStatsFuncNode)); + + if (preproc_stats_funcs == NULL) + { + preproc_stats_funcs = node; + } + else + { + PreprocStatsFuncNode *tmp = preproc_stats_funcs; + PreprocStatsFuncNode *last; + + do + { + if (strcasecmp(tmp->keyword, keyword) == 0) + { + free(node); + FatalError("Duplicate preprocessor keyword: %s.\n", keyword); + } + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + last->next = node; + } + + node->keyword = SnortStrdup(keyword); + node->func = func; +} + +/**************************************************************************** + * + * Function: DumpPreprocessors() + * + * Purpose: Prints the keyword->preprocess list + * + * Arguments: None. + * + * Returns: void function + * + ***************************************************************************/ +void DumpPreprocessors(void) +{ + PreprocConfigFuncNode *node = preproc_config_funcs; + + LogMessage("-------------------------------------------------\n"); + LogMessage(" Keyword | Preprocessor @ \n"); + LogMessage("-------------------------------------------------\n"); + + while (node != NULL) + { + LogMessage("%-13s: %p\n", node->keyword, node->config_func); + node = node->next; + } + + LogMessage("-------------------------------------------------\n\n"); +} + +int IsPreprocEnabled(uint32_t preproc_id) +{ + PreprocEvalFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + tSfPolicyId policy_id = getParserPolicy(); + SnortPolicy *p; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + p = sc->targeted_policies[policy_id]; + if (p == NULL) + return 0; + + for (node = p->preproc_eval_funcs; node != NULL; node = node->next) + { + if (node->preproc_id == preproc_id) + return 1; + } + + return 0; +} + +PreprocEvalFuncNode * AddFuncToPreprocList(PreprocEvalFunc func, uint16_t priority, + uint32_t preproc_id, uint32_t proto_mask) +{ + PreprocEvalFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + tSfPolicyId policy_id = getParserPolicy(); + SnortPolicy *p; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + p = sc->targeted_policies[policy_id]; + if (p == NULL) + return NULL; + + DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, + "Adding preprocessor function ID %d/bit %d/pri %d to list\n", + preproc_id, p->num_preprocs, priority);); + + node = (PreprocEvalFuncNode *)SnortAlloc(sizeof(PreprocEvalFuncNode)); + + if (p->preproc_eval_funcs == NULL) + { + p->preproc_eval_funcs = node; + } + else + { + PreprocEvalFuncNode *tmp = p->preproc_eval_funcs; + PreprocEvalFuncNode *last = NULL; + + do + { + if (tmp->preproc_id == preproc_id) + { + free(node); + FatalError("Preprocessor already registered with ID %d\n", + preproc_id); + } + + /* Insert higher priority preprocessors first. Lower priority + * number means higher priority */ + if (priority < tmp->priority) + break; + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + /* Priority higher than first item in list */ + if (last == NULL) + { + node->next = tmp; + p->preproc_eval_funcs = node; + } + else + { + node->next = tmp; + last->next = node; + } + } + + node->func = func; + node->priority = priority; + node->preproc_id = preproc_id; + node->preproc_bit = (1 << preproc_id); + node->proto_mask = proto_mask; + + p->num_preprocs++; + p->preproc_proto_mask |= proto_mask; + p->preproc_bit_mask |= node->preproc_bit; + + return node; +} + +void AddFuncToPreprocPostConfigList(PreprocPostConfigFunc func, void *data) +{ + PreprocPostConfigFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + node = (PreprocPostConfigFuncNode *)SnortAlloc(sizeof(PreprocPostConfigFuncNode)); + + if (sc->preproc_post_config_funcs == NULL) + { + sc->preproc_post_config_funcs = node; + } + else + { + PreprocPostConfigFuncNode *tmp = sc->preproc_post_config_funcs; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->data = data; + node->func = func; +} + +void PostConfigPreprocessors(SnortConfig *sc) +{ + PreprocPostConfigFuncNode *list; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config is NULL.\n", + __FILE__, __LINE__); + } + + snort_conf_for_parsing = sc; + + list = sc->preproc_post_config_funcs; + + for (; list != NULL; list = list->next) + { + if (list->func != NULL) + list->func(list->data); + } + + snort_conf_for_parsing = NULL; +} + +#ifdef SNORT_RELOAD +void SwapPreprocConfigurations(void) +{ + PreprocConfigFuncNode *node = preproc_config_funcs; + + for (; node != NULL; node = node->next) + { + if (node->reload_swap_func != NULL) + node->swap_free_data = node->reload_swap_func(); + } +} + +void FreeSwappedPreprocConfigurations(void) +{ + PreprocConfigFuncNode *node = preproc_config_funcs; + + for (; node != NULL; node = node->next) + { + if ((node->reload_swap_free_func != NULL) && + (node->swap_free_data != NULL)) + { + node->reload_swap_free_func(node->swap_free_data); + node->swap_free_data = NULL; + } + } +} + +void AddFuncToPreprocReloadVerifyList(PreprocReloadVerifyFunc func) +{ + PreprocReloadVerifyFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + node = (PreprocReloadVerifyFuncNode *)SnortAlloc(sizeof(PreprocReloadVerifyFuncNode)); + + if (sc->preproc_reload_verify_funcs == NULL) + { + sc->preproc_reload_verify_funcs = node; + } + else + { + PreprocReloadVerifyFuncNode *tmp = sc->preproc_reload_verify_funcs; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->func = func; +} + +void FreePreprocReloadVerifyFuncList(PreprocReloadVerifyFuncNode *head) +{ + while (head != NULL) + { + PreprocReloadVerifyFuncNode *tmp = head; + + head = head->next; + free(tmp); + } +} +#endif + +void AddFuncToConfigCheckList(PreprocCheckConfigFunc func) +{ + PreprocCheckConfigFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + node = (PreprocCheckConfigFuncNode *)SnortAlloc(sizeof(PreprocCheckConfigFuncNode)); + + if (sc->preproc_config_check_funcs == NULL) + { + sc->preproc_config_check_funcs = node; + } + else + { + PreprocCheckConfigFuncNode *tmp = sc->preproc_config_check_funcs; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->func = func; +} + +/* functions to aid in cleaning up after plugins */ +void AddFuncToPreprocRestartList(PreprocSignalFunc func, void *arg, + uint16_t priority, uint32_t preproc_id) +{ + AddFuncToPreprocSignalList(func, arg, &preproc_restart_funcs, priority, preproc_id); +} + +void AddFuncToPreprocCleanExitList(PreprocSignalFunc func, void *arg, + uint16_t priority, uint32_t preproc_id) +{ + AddFuncToPreprocSignalList(func, arg, &preproc_clean_exit_funcs, priority, preproc_id); +} + +void AddFuncToPreprocShutdownList(PreprocSignalFunc func, void *arg, + uint16_t priority, uint32_t preproc_id) +{ + AddFuncToPreprocSignalList(func, arg, &preproc_shutdown_funcs, priority, preproc_id); +} + +void AddFuncToPreprocResetList(PreprocSignalFunc func, void *arg, + uint16_t priority, uint32_t preproc_id) +{ + AddFuncToPreprocSignalList(func, arg, &preproc_reset_funcs, priority, preproc_id); +} + +void AddFuncToPreprocResetStatsList(PreprocSignalFunc func, void *arg, + uint16_t priority, uint32_t preproc_id) +{ + AddFuncToPreprocSignalList(func, arg, &preproc_reset_stats_funcs, priority, preproc_id); +} + +static void AddFuncToPreprocSignalList(PreprocSignalFunc func, void *arg, + PreprocSignalFuncNode **list, + uint16_t priority, uint32_t preproc_id) +{ + PreprocSignalFuncNode *node; + + if (list == NULL) + return; + + node = (PreprocSignalFuncNode *)SnortAlloc(sizeof(PreprocSignalFuncNode)); + + if (*list == NULL) + { + *list = node; + } + else + { + PreprocSignalFuncNode *tmp = *list; + PreprocSignalFuncNode *last = NULL; + + do + { + /* Insert higher priority stuff first. Lower priority + * number means higher priority */ + if (priority < tmp->priority) + break; + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + /* Priority higher than first item in list */ + if (last == NULL) + { + node->next = tmp; + *list = node; + } + else + { + node->next = tmp; + last->next = node; + } + } + + node->func = func; + node->arg = arg; + node->preproc_id = preproc_id; + node->priority = priority; +} + +void AddFuncToPreprocReassemblyPktList(PreprocReassemblyPktFunc func, uint32_t preproc_id) +{ + PreprocReassemblyPktFuncNode *node; + SnortConfig *sc = snort_conf_for_parsing; + tSfPolicyId policy_id = getParserPolicy(); + SnortPolicy *p; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + p = sc->targeted_policies[policy_id]; + if (p == NULL) + return; + + node = (PreprocReassemblyPktFuncNode *)SnortAlloc(sizeof(PreprocReassemblyPktFuncNode)); + + if (p->preproc_reassembly_pkt_funcs == NULL) + { + p->preproc_reassembly_pkt_funcs = node; + } + else + { + PreprocReassemblyPktFuncNode *tmp = p->preproc_reassembly_pkt_funcs; + + /* just insert at front of list */ + p->preproc_reassembly_pkt_funcs = node; + node->next = tmp; + } + + node->func = func; + node->preproc_id = preproc_id; +} + +void FreePreprocConfigFuncs(void) +{ + PreprocConfigFuncNode *head = preproc_config_funcs; + PreprocConfigFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + if (head->keyword != NULL) + free(head->keyword); + free(head); + head = tmp; + } +} + +void FreePreprocCheckConfigFuncs(PreprocCheckConfigFuncNode *head) +{ + PreprocCheckConfigFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + free(head); + head = tmp; + } +} + +void FreePreprocPostConfigFuncs(PreprocPostConfigFuncNode *head) +{ + PreprocPostConfigFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + free(head); + head = tmp; + } +} + +void FreePreprocStatsFuncs(PreprocStatsFuncNode *head) +{ + PreprocStatsFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + if (head->keyword != NULL) + free(head->keyword); + free(head); + head = tmp; + } +} + +void FreePreprocEvalFuncs(PreprocEvalFuncNode *head) +{ + PreprocEvalFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + //if (head->context) + // free(head->context); + free(head); + head = tmp; + } +} + +void FreePreprocReassemblyPktFuncs(PreprocReassemblyPktFuncNode *head) +{ + PreprocReassemblyPktFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + free(head); + head = tmp; + } +} + +void FreePreprocSigFuncs(PreprocSignalFuncNode *head) +{ + PreprocSignalFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + /* don't free sig->arg, that's free'd by the CleanExit/Restart func */ + free(head); + head = tmp; + } +} + +void CheckPreprocessorsConfig(SnortConfig *sc) +{ + PreprocCheckConfigFuncNode *idx; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config is NULL.\n", + __FILE__, __LINE__); + } + + snort_conf_for_parsing = sc; + + idx = sc->preproc_config_check_funcs; + + LogMessage("Verifying Preprocessor Configurations!\n"); + + while(idx != NULL) + { + idx->func(); + idx = idx->next; + } + + snort_conf_for_parsing = NULL; +} + +#ifdef SNORT_RELOAD +int VerifyReloadedPreprocessors(SnortConfig *sc) +{ + PreprocReloadVerifyFuncNode *node; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config is NULL.\n", + __FILE__, __LINE__); + } + + snort_conf_for_parsing = sc; + + node = sc->preproc_reload_verify_funcs; + while (node != NULL) + { + if (node->func != NULL) + { + if (node->func() == -1) + return -1; + } + + node = node->next; + } + + snort_conf_for_parsing = NULL; + + return 0; +} +#endif + + +/***************************** Output Plugin API *****************************/ +extern OutputConfigFuncNode *output_config_funcs; + +static void AppendOutputFuncList(OutputFunc, void *, OutputFuncNode **); + +void RegisterOutputPlugins(void) +{ + LogMessage("Initializing Output Plugins!\n"); + + AlertSyslogSetup(); + LogTcpdumpSetup(); + DatabaseSetup(); + AlertFastSetup(); + AlertFullSetup(); + AlertPfSetup(); +#ifndef WIN32 + /* Win32 doesn't support AF_UNIX sockets */ + AlertUnixSockSetup(); +#endif /* !WIN32 */ + AlertCSVSetup(); + LogNullSetup(); + UnifiedSetup(); + Unified2Setup(); + LogAsciiSetup(); + +#ifdef ARUBA + AlertArubaActionSetup(); +#endif + +#ifdef LINUX + /* This uses linux only capabilities */ + AlertSFSocket_Setup(); +#endif + +#ifdef HAVE_LIBPRELUDE + AlertPreludeSetup(); +#endif + + AlertTestSetup(); +} + +/**************************************************************************** + * + * Function: RegisterOutputPlugin(char *, void (*func)(Packet *, u_char *)) + * + * Purpose: Associates an output statement with its function. + * + * Arguments: keyword => The output keyword to associate with the + * output processor + * type => alert or log types + * *func => function pointer to the handler + * + * Returns: void function + * + ***************************************************************************/ +void RegisterOutputPlugin(char *keyword, int type_flags, OutputConfigFunc func) +{ + OutputConfigFuncNode *node = (OutputConfigFuncNode *)SnortAlloc(sizeof(OutputConfigFuncNode)); + + DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:output => %s:%p\n", + keyword, func);); + + if (output_config_funcs == NULL) + { + output_config_funcs = node; + } + else + { + OutputConfigFuncNode *tmp = output_config_funcs; + OutputConfigFuncNode *last; + + do + { + if (strcasecmp(tmp->keyword, keyword) == 0) + { + free(node); + FatalError("Duplicate output keyword: %s\n", keyword); + } + + last = tmp; + tmp = tmp->next; + + } while (tmp != NULL); + + last->next = node; + } + + node->keyword = SnortStrdup(keyword); + node->func = func; + node->output_type_flags = type_flags; +} + +OutputConfigFunc GetOutputConfigFunc(char *keyword) +{ + OutputConfigFuncNode *head = output_config_funcs; + + if (keyword == NULL) + return NULL; + + while (head != NULL) + { + if (strcasecmp(head->keyword, keyword) == 0) + return head->func; + + head = head->next; + } + + return NULL; +} + +int GetOutputTypeFlags(char *keyword) +{ + OutputConfigFuncNode *head = output_config_funcs; + + if (keyword == NULL) + return 0; + + while (head != NULL) + { + if (strcasecmp(head->keyword, keyword) == 0) + return head->output_type_flags; + + head = head->next; + } + + return 0; +} + +void FreeOutputConfigFuncs(void) +{ + OutputConfigFuncNode *head = output_config_funcs; + OutputConfigFuncNode *tmp; + + while (head != NULL) + { + tmp = head->next; + if (head->keyword != NULL) + free(head->keyword); + free(head); + head = tmp; + } +} + +void FreeOutputList(OutputFuncNode *list) +{ + while (list != NULL) + { + OutputFuncNode *tmp = list; + + list = list->next; + free(tmp); + } +} + +/**************************************************************************** + * + * Function: DumpOutputPlugins() + * + * Purpose: Prints the keyword->preprocess list + * + * Arguments: None. + * + * Returns: void function + * + ***************************************************************************/ +void DumpOutputPlugins(void) +{ + OutputConfigFuncNode *idx = output_config_funcs; + + LogMessage("-------------------------------------------------\n"); + LogMessage(" Keyword | Output @ \n"); + LogMessage("-------------------------------------------------\n"); + while(idx != NULL) + { + LogMessage("%-13s: %p\n", idx->keyword, idx->func); + idx = idx->next; + } + LogMessage("-------------------------------------------------\n\n"); +} + +void AddFuncToOutputList(OutputFunc func, OutputType type, void *arg) +{ + switch (type) + { + case OUTPUT_TYPE__ALERT: + if (head_tmp != NULL) + AppendOutputFuncList(func, arg, &head_tmp->AlertList); + else + AppendOutputFuncList(func, arg, &AlertList); + + break; + + case OUTPUT_TYPE__LOG: + if (head_tmp != NULL) + AppendOutputFuncList(func, arg, &head_tmp->LogList); + else + AppendOutputFuncList(func, arg, &LogList); + + break; + + default: + /* just to be error-prone */ + FatalError("Unknown output type: %i. Possible bug, please " + "report.\n", type); + } +} + +void AppendOutputFuncList(OutputFunc func, void *arg, OutputFuncNode **list) +{ + OutputFuncNode *node; + + if (list == NULL) + return; + + node = (OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode)); + + if (*list == NULL) + { + *list = node; + } + else + { + OutputFuncNode *tmp = *list; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->func = func; + node->arg = arg; +} + + +/************************** Miscellaneous Functions **************************/ + +/* functions to aid in cleaning up after plugins + * Used for both rule options and output. Preprocessors have their own */ +void AddFuncToRestartList(PluginSignalFunc func, void *arg) +{ + AddFuncToSignalList(func, arg, &plugin_restart_funcs); +} + +void AddFuncToCleanExitList(PluginSignalFunc func, void *arg) +{ + AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs); +} + +void AddFuncToShutdownList(PluginSignalFunc func, void *arg) +{ + AddFuncToSignalList(func, arg, &plugin_shutdown_funcs); +} + +void AddFuncToPostConfigList(PluginSignalFunc func, void *arg) +{ + SnortConfig *sc = snort_conf_for_parsing; + + if (sc == NULL) + { + FatalError("%s(%d) Snort config for parsing is NULL.\n", + __FILE__, __LINE__); + } + + AddFuncToSignalList(func, arg, &sc->plugin_post_config_funcs); +} + +void AddFuncToSignalList(PluginSignalFunc func, void *arg, PluginSignalFuncNode **list) +{ + PluginSignalFuncNode *node; + + if (list == NULL) + return; + + node = (PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode)); + + if (*list == NULL) + { + *list = node; + } + else + { + PluginSignalFuncNode *tmp = *list; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->func = func; + node->arg = arg; +} + +void AddFuncToRuleOptParseCleanupList(RuleOptParseCleanupFunc func) +{ + RuleOptParseCleanupNode *node = + (RuleOptParseCleanupNode *)SnortAlloc(sizeof(RuleOptParseCleanupNode)); + + if (rule_opt_parse_cleanup_list == NULL) + { + rule_opt_parse_cleanup_list = node; + } + else + { + RuleOptParseCleanupNode *tmp = rule_opt_parse_cleanup_list; + + while (tmp->next != NULL) + tmp = tmp->next; + + tmp->next = node; + } + + node->func = func; +} + +void RuleOptParseCleanup(void) +{ + RuleOptParseCleanupNode *list = rule_opt_parse_cleanup_list; + + for (; list != NULL; list = list->next) + { + if (list->func != NULL) + list->func(); + } +} + +void FreeRuleOptParseCleanupList(RuleOptParseCleanupNode *head) +{ + while (head != NULL) + { + RuleOptParseCleanupNode *tmp = head; + + head = head->next; + free(tmp); + } +} + + diff --git a/config/snort-dev/patches/spoink_patch/2.8.6/util.c b/config/snort-dev/patches/spoink_patch/2.8.6/util.c new file mode 100644 index 00000000..b2d3b38b --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/2.8.6/util.c @@ -0,0 +1,3233 @@ +/* $Id$ */ +/* +** Copyright (C) 2002-2010 Sourcefire, Inc. +** Copyright (C) 2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +*/ + + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include + +#ifndef WIN32 +#include +#include +#include +#include +#include +#include +#endif /* !WIN32 */ + +#include +#include +#include +#include +#include +#include +#include + +#ifndef WIN32 +#include +#include +#include +#include +#endif /* !WIN32 */ + +#include + +#ifdef HAVE_STRINGS_H +#include +#endif + +#ifdef ZLIB +#include +#endif + +#include "snort.h" +#include "mstring.h" +#include "debug.h" +#include "util.h" +#include "parser.h" +#include "inline.h" +#include "build.h" +#include "plugbase.h" +#include "sf_types.h" +#include "sflsq.h" +#include "ipv6_port.h" + +#include "pcre.h" + +#include "mpse.h" + +#include "ppm.h" + +#ifdef TARGET_BASED +#include "sftarget_reader.h" +#endif + +#ifdef WIN32 +#include "win32/WIN32-Code/name.h" +#endif + +#include "stream5_common.h" + +#ifdef PATH_MAX +#define PATH_MAX_UTIL PATH_MAX +#else +#define PATH_MAX_UTIL 1024 +#endif /* PATH_MAX */ + +extern Stream5Stats s5stats; +extern int datalink; +extern pcap_t *pcap_handle; +extern PreprocStatsFuncNode *preproc_stats_funcs; + +static PcapPktStats pkt_stats; + +/* + * you may need to adjust this on the systems which don't have standard + * paths defined + */ +#ifndef _PATH_VARRUN +static char _PATH_VARRUN[STD_BUF]; +#endif + + +#ifdef NAME_MAX +#define NAME_MAX_UTIL NAME_MAX +#else +#define NAME_MAX_UTIL 256 +#endif /* NAME_MAX */ + +#define FILE_MAX_UTIL (PATH_MAX_UTIL + NAME_MAX_UTIL) + +/**************************************************************************** + * + * Function: CalcPct(uint64_t, uint64_t) + * + * Purpose: Calculate the percentage of a value compared to a total + * + * Arguments: cnt => the numerator in the equation + * total => the denominator in the calculation + * + * Returns: pct -> the percentage of cnt to value + * + ****************************************************************************/ +double CalcPct(uint64_t cnt, uint64_t total) +{ + double pct = 0.0; + + if (total == 0.0) + { + pct = (double)cnt; + } + else + { + pct = (double)cnt / (double)total; + } + + pct *= 100.0; + + return pct; +} + + +/**************************************************************************** + * + * Function: DisplayBanner() + * + * Purpose: Show valuable proggie info + * + * Arguments: None. + * + * Returns: 0 all the time + * + ****************************************************************************/ +int DisplayBanner(void) +{ + const char * info; + const char * pcre_ver; +#ifdef ZLIB + const char * zlib_ver; +#endif + + info = getenv("HOSTTYPE"); + if( !info ) + { + info=""; + } + + pcre_ver = pcre_version(); +#ifdef ZLIB + zlib_ver = zlib_version; +#endif + + LogMessage("\n"); + LogMessage(" ,,_ -*> Snort! <*-\n"); + LogMessage(" o\" )~ Version %s%s%s (Build %s) %s %s\n", + VERSION, +#ifdef SUP_IP6 + " IPv6", +#else + "", +#endif +#ifdef GRE + " GRE", +#else + "", +#endif + BUILD, +#ifdef GIDS + "inline", +#else + "", +#endif + info); + LogMessage(" '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team\n"); + LogMessage(" Copyright (C) 1998-2010 Sourcefire, Inc., et al.\n"); + LogMessage(" Using PCRE version: %s\n", pcre_ver); +#ifdef ZLIB + LogMessage(" Using ZLIB version: %s\n", zlib_ver); +#endif + LogMessage("\n"); + LogMessage(" ___ Built Date for Snort on Pfsense 2.0 is May 25 2010.\n"); + LogMessage(" ___/ f \\ Orion IPS Output Code Copyright (C) 2009-2010 Robert Zelaya.\n"); + LogMessage("/ p \\___/Sense\n"); + LogMessage("\\___/ \\\n"); + LogMessage(" \\___/ Using Snort.org dynamic plugins and Orion IPS source.\n"); + LogMessage("\n"); + + return 0; +} + + + +/**************************************************************************** + * + * Function: ts_print(register const struct, char *) + * + * Purpose: Generate a time stamp and stuff it in a buffer. This one has + * millisecond precision. Oh yeah, I ripped this code off from + * TCPdump, props to those guys. + * + * Arguments: timeval => clock struct coming out of libpcap + * timebuf => buffer to stuff timestamp into + * + * Returns: void function + * + ****************************************************************************/ +void ts_print(register const struct timeval *tvp, char *timebuf) +{ + register int s; + int localzone; + time_t Time; + struct timeval tv; + struct timezone tz; + struct tm *lt; /* place to stick the adjusted clock data */ + + /* if null was passed, we use current time */ + if(!tvp) + { + /* manual page (for linux) says tz is never used, so.. */ + bzero((char *) &tz, sizeof(tz)); + gettimeofday(&tv, &tz); + tvp = &tv; + } + + localzone = snort_conf->thiszone; + + /* + ** If we're doing UTC, then make sure that the timezone is correct. + */ + if (ScOutputUseUtc()) + localzone = 0; + + s = (tvp->tv_sec + localzone) % 86400; + Time = (tvp->tv_sec + localzone) - s; + + lt = gmtime(&Time); + + if (ScOutputIncludeYear()) + { + (void) SnortSnprintf(timebuf, TIMEBUF_SIZE, + "%02d/%02d/%02d-%02d:%02d:%02d.%06u ", + lt->tm_mon + 1, lt->tm_mday, lt->tm_year - 100, + s / 3600, (s % 3600) / 60, s % 60, + (u_int) tvp->tv_usec); + } + else + { + (void) SnortSnprintf(timebuf, TIMEBUF_SIZE, + "%02d/%02d-%02d:%02d:%02d.%06u ", lt->tm_mon + 1, + lt->tm_mday, s / 3600, (s % 3600) / 60, s % 60, + (u_int) tvp->tv_usec); + } +} + + + +/**************************************************************************** + * + * Function: gmt2local(time_t) + * + * Purpose: Figures out how to adjust the current clock reading based on the + * timezone you're in. Ripped off from TCPdump. + * + * Arguments: time_t => offset from GMT + * + * Returns: offset seconds from GMT + * + ****************************************************************************/ +int gmt2local(time_t t) +{ + register int dt, dir; + register struct tm *gmt, *loc; + struct tm sgmt; + + if(t == 0) + t = time(NULL); + + gmt = &sgmt; + *gmt = *gmtime(&t); + loc = localtime(&t); + + dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 + + (loc->tm_min - gmt->tm_min) * 60; + + dir = loc->tm_year - gmt->tm_year; + + if(dir == 0) + dir = loc->tm_yday - gmt->tm_yday; + + dt += dir * 24 * 60 * 60; + + return(dt); +} + + + + +/**************************************************************************** + * + * Function: copy_argv(u_char **) + * + * Purpose: Copies a 2D array (like argv) into a flat string. Stolen from + * TCPDump. + * + * Arguments: argv => 2D array to flatten + * + * Returns: Pointer to the flat string + * + ****************************************************************************/ +char *copy_argv(char **argv) +{ + char **p; + u_int len = 0; + char *buf; + char *src, *dst; + //void ftlerr(char *,...); + + p = argv; + if(*p == 0) + return 0; + + while(*p) + len += strlen(*p++) + 1; + + buf = (char *) calloc(1,len); + + if(buf == NULL) + { + FatalError("calloc() failed: %s\n", strerror(errno)); + } + p = argv; + dst = buf; + + while((src = *p++) != NULL) + { + while((*dst++ = *src++) != '\0'); + dst[-1] = ' '; + } + + dst[-1] = '\0'; + + /* Check for an empty string */ + dst = buf; + while (isspace((int)*dst)) + dst++; + + if (strlen(dst) == 0) + { + free(buf); + buf = NULL; + } + + return buf; +} + + +/**************************************************************************** + * + * Function: strip(char *) + * + * Purpose: Strips a data buffer of CR/LF/TABs. Replaces CR/LF's with + * NULL and TABs with spaces. + * + * Arguments: data => ptr to the data buf to be stripped + * + * Returns: void + * + * 3/7/07 - changed to return void - use strlen to get size of string + * + * Note that this function will turn all '\n' and '\r' into null chars + * so, e.g. 'Hello\nWorld\n' => 'Hello\x00World\x00' + * note that the string is now just 'Hello' and the length is shortened + * by more than just an ending '\n' or '\r' + ****************************************************************************/ +void strip(char *data) +{ + int size; + char *end; + char *idx; + + idx = data; + end = data + strlen(data); + size = end - idx; + + while(idx != end) + { + if((*idx == '\n') || + (*idx == '\r')) + { + *idx = 0; + size--; + } + if(*idx == '\t') + { + *idx = ' '; + } + idx++; + } +} + +/* + * Function: ErrorMessage(const char *, ...) + * + * Purpose: Print a message to stderr. + * + * Arguments: format => the formatted error string to print out + * ... => format commands/fillers + * + * Returns: void function + */ +void ErrorMessage(const char *format,...) +{ + char buf[STD_BUF+1]; + va_list ap; + + if (snort_conf == NULL) + return; + + va_start(ap, format); + + if (ScDaemonMode() || ScLogSyslog()) + { + vsnprintf(buf, STD_BUF, format, ap); + buf[STD_BUF] = '\0'; + syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "%s", buf); + } + else + { + vfprintf(stderr, format, ap); + } + va_end(ap); +} + +/* + * Function: LogMessage(const char *, ...) + * + * Purpose: Print a message to stderr or with logfacility. + * + * Arguments: format => the formatted error string to print out + * ... => format commands/fillers + * + * Returns: void function + */ +void LogMessage(const char *format,...) +{ + char buf[STD_BUF+1]; + va_list ap; + + if (snort_conf == NULL) + return; + + if (ScLogQuiet() && !ScDaemonMode() && !ScLogSyslog()) + return; + + va_start(ap, format); + + if (ScDaemonMode() || ScLogSyslog()) + { + vsnprintf(buf, STD_BUF, format, ap); + buf[STD_BUF] = '\0'; + syslog(LOG_DAEMON | LOG_NOTICE, "%s", buf); + } + else + { + vfprintf(stderr, format, ap); + } + + va_end(ap); +} + +/* + * Function: CreateApplicationEventLogEntry(const char *) + * + * Purpose: Add an entry to the Win32 "Application" EventLog + * + * Arguments: szMessage => the formatted error string to print out + * + * Returns: void function + */ +#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE) +void CreateApplicationEventLogEntry(const char *msg) +{ + HANDLE hEventLog; + char* pEventSourceName = "SnortService"; + + /* prepare to write to Application log on local host + * with Event Source of SnortService + */ + AddEventSource(pEventSourceName); + hEventLog = RegisterEventSource(NULL, pEventSourceName); + if (hEventLog == NULL) + { + /* Could not register the event source. */ + return; + } + + if (!ReportEvent(hEventLog, /* event log handle */ + EVENTLOG_ERROR_TYPE, /* event type */ + 0, /* category zero */ + EVMSG_SIMPLE, /* event identifier */ + NULL, /* no user security identifier */ + 1, /* one substitution string */ + 0, /* no data */ + &msg, /* pointer to array of strings */ + NULL)) /* pointer to data */ + { + /* Could not report the event. */ + } + + DeregisterEventSource(hEventLog); +} +#endif /* WIN32 && ENABLE_WIN32_SERVICE */ + + +/* + * Function: FatalError(const char *, ...) + * + * Purpose: When a fatal error occurs, this function prints the error message + * and cleanly shuts down the program + * + * Arguments: format => the formatted error string to print out + * ... => format commands/fillers + * + * Returns: void function + */ +NORETURN void FatalError(const char *format,...) +{ + char buf[STD_BUF+1]; + va_list ap; + + va_start(ap, format); + vsnprintf(buf, STD_BUF, format, ap); + va_end(ap); + + buf[STD_BUF] = '\0'; + + if ((snort_conf != NULL) && (ScDaemonMode() || ScLogSyslog())) + { + syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "FATAL ERROR: %s", buf); + } + else + { + fprintf(stderr, "ERROR: %s", buf); + fprintf(stderr,"Fatal Error, Quitting..\n"); +#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE) + CreateApplicationEventLogEntry(buf); +#endif + } + + exit(1); +} + + +/**************************************************************************** + * + * Function: CreatePidFile(char *) + * + * Purpose: Creates a PID file + * + * Arguments: Interface opened. + * + * Returns: void function + * + ****************************************************************************/ +static FILE *pid_lockfile = NULL; +static FILE *pid_file = NULL; +void CreatePidFile(char *intf) +{ + struct stat pt; + int pid = (int) getpid(); +#ifdef WIN32 + char dir[STD_BUF + 1]; +#endif + + if (!ScReadMode()) + { + LogMessage("Checking PID path...\n"); + + if (strlen(snort_conf->pid_path) != 0) + { + if((stat(snort_conf->pid_path, &pt) == -1) || + !S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1) + { +#ifndef WIN32 + /* Save this just in case it's reset with LogMessage call */ + int err = errno; + + LogMessage("WARNING: %s is invalid, trying " + "/var/run...\n", snort_conf->pid_path); + if (err) + { + LogMessage("Previous Error, errno=%d, (%s)\n", + err, strerror(err) == NULL ? "Unknown error" : strerror(err)); + } +#endif + memset(snort_conf->pid_path, 0, sizeof(snort_conf->pid_path)); + } + else + { + LogMessage("PID path stat checked out ok, " + "PID path set to %s\n", snort_conf->pid_path); + } + } + + if (strlen(snort_conf->pid_path) == 0) + { +#ifndef _PATH_VARRUN +# ifndef WIN32 + SnortStrncpy(_PATH_VARRUN, "/var/run/", sizeof(_PATH_VARRUN)); +# else + if (GetCurrentDirectory(sizeof(dir) - 1, dir)) + SnortStrncpy(_PATH_VARRUN, dir, sizeof(_PATH_VARRUN)); +# endif /* WIN32 */ +#else + LogMessage("PATH_VARRUN is set to %s on this operating " + "system\n", _PATH_VARRUN); +#endif /* _PATH_VARRUN */ + + stat(_PATH_VARRUN, &pt); + + if(!S_ISDIR(pt.st_mode) || access(_PATH_VARRUN, W_OK) == -1) + { + LogMessage("WARNING: _PATH_VARRUN is invalid, trying " + "/var/log...\n"); + SnortStrncpy(snort_conf->pid_path, "/var/log/", sizeof(snort_conf->pid_path)); + stat(snort_conf->pid_path, &pt); + + if(!S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1) + { + LogMessage("WARNING: %s is invalid, logging Snort " + "PID path to log directory (%s)\n", snort_conf->pid_path, + snort_conf->log_dir); + CheckLogDir(); + SnortSnprintf(snort_conf->pid_path, sizeof(snort_conf->pid_path), + "%s/", snort_conf->log_dir); + } + } + else + { + LogMessage("PID path stat checked out ok, " + "PID path set to %s\n", _PATH_VARRUN); + SnortStrncpy(snort_conf->pid_path, _PATH_VARRUN, sizeof(snort_conf->pid_path)); + } + } + } + + if(intf == NULL || strlen(snort_conf->pid_path) == 0) + { + /* snort_conf->pid_path should have some value by now + * so let us just be sane. */ + FatalError("CreatePidFile() failed to lookup interface or pid_path is unknown!\n"); + } + + SnortSnprintf(snort_conf->pid_filename, sizeof(snort_conf->pid_filename), + "%s/snort_%s%s.pid", snort_conf->pid_path, intf, snort_conf->pidfile_suffix); + +#ifndef WIN32 + if (!ScNoLockPidFile()) + { + char pid_lockfilename[STD_BUF+1]; + int lock_fd; + + /* First, lock the PID file */ + SnortSnprintf(pid_lockfilename, STD_BUF, "%s.lck", snort_conf->pid_filename); + pid_lockfile = fopen(pid_lockfilename, "w"); + + if (pid_lockfile) + { + struct flock lock; + lock_fd = fileno(pid_lockfile); + + lock.l_type = F_WRLCK; + lock.l_whence = SEEK_SET; + lock.l_start = 0; + lock.l_len = 0; + + if (fcntl(lock_fd, F_SETLK, &lock) == -1) + { + ClosePidFile(); + FatalError("Failed to Lock PID File \"%s\" for PID \"%d\"\n", snort_conf->pid_filename, pid); + } + } + } +#endif + + /* Okay, were able to lock PID file, now open and write PID */ + pid_file = fopen(snort_conf->pid_filename, "w"); + if(pid_file) + { + LogMessage("Writing PID \"%d\" to file \"%s\"\n", pid, snort_conf->pid_filename); + fprintf(pid_file, "%d\n", pid); + fflush(pid_file); + } + else + { + ErrorMessage("Failed to create pid file %s", snort_conf->pid_filename); + snort_conf->pid_filename[0] = 0; + } +} + +/**************************************************************************** + * + * Function: ClosePidFile(char *) + * + * Purpose: Releases lock on a PID file + * + * Arguments: None + * + * Returns: void function + * + ****************************************************************************/ +void ClosePidFile(void) +{ + if (pid_file) + { + fclose(pid_file); + pid_file = NULL; + } + if (pid_lockfile) + { + fclose(pid_lockfile); + pid_lockfile = NULL; + } +} + +/**************************************************************************** + * + * Function: SetUidGid() + * + * Purpose: Sets safe UserID and GroupID if needed + * + * Arguments: none + * + * Returns: void function + * + ****************************************************************************/ +void SetUidGid(int user_id, int group_id) +{ +#ifndef WIN32 + + if ((group_id != -1) && (getgid() != (gid_t)group_id)) + { + if (!InlineModeSetPrivsAllowed()) + { + ErrorMessage("Cannot set uid and gid when running Snort in " + "inline mode.\n"); + return; + } + + if (setgid(group_id) < 0) + FatalError("Cannot set gid: %d\n", group_id); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set gid to %d\n", group_id);); + } + + if ((user_id != -1) && (getuid() != (uid_t)user_id)) + { + struct passwd *pw = getpwuid(user_id); + + if (!InlineModeSetPrivsAllowed()) + { + ErrorMessage("Cannot set uid and gid when running Snort in " + "inline mode.\n"); + return; + } + + if (pw != NULL) + { + /* getpwuid and initgroups may use the same static buffers */ + char *username = SnortStrdup(pw->pw_name); + + if ((getuid() == 0) && (initgroups(username, group_id) < 0)) + { + free(username); + FatalError("Can not initgroups(%s,%d)", + username, group_id); + } + + free(username); + } + + /** just to be on a safe side... **/ + endgrent(); + endpwent(); + + if (setuid(user_id) < 0) + FatalError("Can not set uid: %d\n", user_id); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set uid to %d\n", user_id);); + } +#endif /* WIN32 */ +} + +#ifdef TIMESTATS + +static IntervalStats istats = {0}; +time_t start_time; + +void InitTimeStats(void) +{ + start_time = time(NULL); +} + +void ResetTimeStats(void) +{ + memset(&istats, 0, sizeof(istats)); +} + +/* This function prints out stats based on a configurable time + * interval. It is an indication on how well snort is */ +/* processing packets, including types, drops, etc */ +void DropStatsPerTimeInterval(void) +{ + double per_sec, per_minute, per_hour; + uint64_t recv, drop; + uint64_t total = 0; + uint32_t timestats_interval = ScTimestatsInterval(); + +#ifdef PCAP_CLOSE + if (UpdatePcapPktStats(0) != -1) +#else + if (UpdatePcapPktStats() != -1) +#endif + { + recv = GetPcapPktStatsRecv(); + drop = GetPcapPktStatsDrop(); + + istats.recv = recv - istats.recv_total; + istats.recv_total = recv; + + istats.drop = drop - istats.drop_total; + istats.drop_total = drop; + + /* calculate received packets by type */ + istats.tcp = pc.tcp - istats.tcp_total; + istats.tcp_total = pc.tcp; + + istats.udp = pc.udp - istats.udp_total; + istats.udp_total = pc.udp; + + istats.icmp = pc.icmp - istats.icmp_total; + istats.icmp_total = pc.icmp; + + istats.arp = pc.arp - istats.arp_total; + istats.arp_total = pc.arp; + +#ifdef GRE + istats.ip4ip4 = pc.ip4ip4 - istats.ip4ip4_total; + istats.ip4ip4_total = pc.ip4ip4; + + istats.ip4ip6 = pc.ip4ip6 - istats.ip4ip6_total; + istats.ip4ip6_total = pc.ip4ip6; + + istats.ip6ip4 = pc.ip6ip4 - istats.ip6ip4_total; + istats.ip6ip4_total = pc.ip6ip4; + + istats.ip6ip6 = pc.ip6ip6 - istats.ip6ip6_total; + istats.ip6ip6_total = pc.ip6ip6; + + istats.gre = pc.gre - istats.gre_total; + istats.gre_total = pc.gre; + + istats.gre_ip = pc.gre_ip - istats.gre_ip_total; + istats.gre_ip_total = pc.gre_ip; + + istats.gre_eth = pc.gre_eth - istats.gre_eth_total; + istats.gre_eth_total = pc.gre_eth; + + istats.gre_arp = pc.gre_arp - istats.gre_arp_total; + istats.gre_arp_total = pc.gre_arp; + + istats.gre_ipv6 = pc.gre_ipv6 - istats.gre_ipv6_total; + istats.gre_ipv6_total = pc.gre_ipv6; + + istats.gre_ipx = pc.gre_ipx - istats.gre_ipx_total; + istats.gre_ipx_total = pc.gre_ipx; + + istats.gre_loopback = pc.gre_loopback - istats.gre_loopback_total; + istats.gre_loopback_total = pc.gre_loopback; + + istats.gre_vlan = pc.gre_vlan - istats.gre_vlan_total; + istats.gre_vlan_total = pc.gre_vlan; + + istats.gre_ppp = pc.gre_ppp - istats.gre_ppp_total; + istats.gre_ppp_total = pc.gre_ppp; +#endif + +#ifdef DLT_IEEE802_11 /* if we are tracking wireless, add this to output */ + istats.wifi_mgmt = pc.wifi_mgmt - istats.wifi_mgmt_total; + istats.wifi_mgmt_total = pc.wifi_mgmt; + + istats.wifi_control = pc.wifi_control - istats.wifi_control_total; + istats.wifi_control_total = pc.wifi_control; + + istats.wifi_data = pc.wifi_data - istats.wifi_data_total; + istats.wifi_data_total = pc.wifi_data; +#endif + + istats.ipx = pc.ipx - istats.ipx_total; + istats.ipx_total = pc.ipx; + + istats.eapol = pc.eapol - istats.eapol_total; + istats.eapol_total = pc.eapol; + + istats.ipv6 = pc.ipv6 - istats.ipv6_total; + istats.ipv6_total = pc.ipv6; + + istats.ethloopback = pc.ethloopback - istats.ethloopback_total; + istats.ethloopback_total = pc.ethloopback; + + istats.other = pc.other - istats.other_total; + istats.other_total = pc.other; + + istats.discards = pc.discards - istats.discards_total; + istats.discards_total = pc.discards; + + if (pc.frags > 0) /* do we have any fragmented packets being seen? */ + { + istats.frags = pc.frags - istats.frags_total; + istats.frags_total = pc.frags; + + istats.frag_trackers = pc.frag_trackers - istats.frag_trackers_total; + istats.frag_trackers_total = pc.frag_trackers; + + istats.frag_rebuilt = pc.rebuilt_frags - istats.frag_rebuilt_total; + istats.frag_rebuilt_total = pc.rebuilt_frags; + + istats.frag_element = pc.rebuild_element - istats.frag_element_total; + istats.frag_element_total = pc.rebuild_element; + + istats.frag_incomp = pc.frag_incomp - istats.frag_incomp_total; + istats.frag_incomp_total = pc.frag_incomp; + + istats.frag_timeout = pc.frag_timeout - istats.frag_timeout_total; + istats.frag_timeout_total = pc.frag_timeout; + + istats.frag_mem_faults = pc.frag_mem_faults - istats.frag_mem_faults_total; + istats.frag_mem_faults_total = pc.frag_mem_faults; + } + + if (pc.tcp_stream_pkts > 0) /* do we have TCP stream re-assembly going on? */ + { + istats.tcp_str_packets = pc.tcp_stream_pkts - istats.tcp_str_packets_total; + istats.tcp_str_packets_total = pc.tcp_stream_pkts; + + istats.tcp_str_trackers = pc.tcp_streams - istats.tcp_str_trackers_total; + istats.tcp_str_trackers_total = pc.tcp_streams; + + istats.tcp_str_flushes = pc.rebuilt_tcp - istats.tcp_str_flushes_total; + istats.tcp_str_flushes_total = pc.rebuilt_tcp; + + istats.tcp_str_segs_used = pc.rebuilt_segs - istats.tcp_str_segs_used_total; + istats.tcp_str_segs_used_total = pc.rebuilt_segs; + + istats.tcp_str_segs_queued = pc.queued_segs - istats.tcp_str_segs_queued_total; + istats.tcp_str_segs_queued_total = pc.queued_segs; + + istats.tcp_str_mem_faults = pc.str_mem_faults - istats.tcp_str_mem_faults_total; + istats.tcp_str_mem_faults_total = pc.str_mem_faults; + } + + istats.processed = pc.total_processed - istats.processed_total; + istats.processed_total = pc.total_processed; + total = istats.processed; + + /* prepare packet type per time interval routine */ + LogMessage("================================================" + "===============================\n"); + + LogMessage("\n"); + LogMessage("Statistics Report (last %d seconds)\n", timestats_interval); + LogMessage("\n"); + + per_sec = (double)istats.recv / (double)timestats_interval; + + LogMessage("Packet Wire Totals:\n"); + LogMessage("Packets received: " FMTu64("13") "\n", istats.recv); + + if (timestats_interval >= SECONDS_PER_HOUR) + { + per_hour = (double)(istats.recv * SECONDS_PER_HOUR) / (double)timestats_interval; + LogMessage(" per hour: %13.2f\n", per_hour); + } + if (timestats_interval >= SECONDS_PER_MIN) + { + per_minute = (double)(istats.recv * SECONDS_PER_MIN) / (double)timestats_interval; + LogMessage(" per minute: %13.2f\n", per_minute); + } + LogMessage(" per second: %13.2f\n", per_sec); + LogMessage(" Packets dropped: " FMTu64("13") "\n", istats.drop); + LogMessage("\n"); + LogMessage("Packet Breakdown by Protocol (includes rebuilt packets):\n"); + + LogMessage(" TCP: " FMTu64("10") " (%.3f%%)\n", + istats.tcp, CalcPct(istats.tcp, total)); + LogMessage(" UDP: " FMTu64("10") " (%.3f%%)\n", + istats.udp, CalcPct(istats.udp, total)); + LogMessage(" ICMP: " FMTu64("10") " (%.3f%%)\n", + istats.icmp, CalcPct(istats.icmp, total)); + LogMessage(" ARP: " FMTu64("10") " (%.3f%%)\n", + istats.arp, CalcPct(istats.arp, total)); +#ifndef NO_NON_ETHER_DECODER + LogMessage(" EAPOL: " FMTu64("10") " (%.3f%%)\n", + istats.eapol, CalcPct(istats.eapol, total)); +#endif + LogMessage(" IPv6: " FMTu64("10") " (%.3f%%)\n", + istats.ipv6, CalcPct(istats.ipv6, total)); + LogMessage(" ETHLOOP: " FMTu64("10") " (%.3f%%)\n", + istats.ethloopback, CalcPct(istats.ethloopback, total)); + LogMessage(" IPX: " FMTu64("10") " (%.3f%%)\n", + istats.ipx, CalcPct(istats.ipx, total)); + +#ifdef GRE + LogMessage(" IP4/IP4: " FMTu64("-10") " (%.3f%%)\n", + istats.ip4ip4, CalcPct(istats.ip4ip4, total)); + LogMessage(" IP4/IP6: " FMTu64("-10") " (%.3f%%)\n", + istats.ip4ip6, CalcPct(istats.ip4ip6, total)); + LogMessage(" IP6/IP4: " FMTu64("-10") " (%.3f%%)\n", + istats.ip6ip4, CalcPct(istats.ip6ip4, total)); + LogMessage(" IP6/IP6: " FMTu64("-10") " (%.3f%%)\n", + istats.ip6ip6, CalcPct(istats.ip6ip6, total)); + LogMessage(" GRE: " FMTu64("10") " (%.3f%%)\n", + istats.gre, CalcPct(istats.gre, total)); + LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_eth, CalcPct(istats.gre_eth, total)); + LogMessage("GRE VLAN: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_vlan, CalcPct(istats.gre_vlan, total)); + LogMessage(" GRE IP: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_ip, CalcPct(istats.gre_ip, total)); + LogMessage("GRE IPv6: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_ipv6, CalcPct(istats.gre_ipv6, total)); + LogMessage("GRE PPTP: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_ppp, CalcPct(istats.gre_ppp, total)); + LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_arp, CalcPct(istats.gre_arp, total)); + LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_ipx, CalcPct(istats.gre_ipx, total)); + LogMessage("GRE LOOP: " FMTu64("-10") " (%.3f%%)\n", + istats.gre_loopback, CalcPct(istats.gre_loopback, total)); +#endif + + LogMessage(" FRAG: " FMTu64("10") " (%.3f%%)\n", + istats.frags, CalcPct(istats.frags, total)); + LogMessage(" OTHER: " FMTu64("10") " (%.3f%%)\n", + istats.other, CalcPct(istats.other, total)); + LogMessage(" DISCARD: " FMTu64("10") " (%.3f%%)\n", + istats.discards, CalcPct(istats.discards, total)); + LogMessage(" Total: " FMTu64("10") "\n", total); + + LogMessage("\n"); + + + /* handle case where wireless is enabled... */ + +#ifndef NO_NON_ETHER_DECODER +#ifdef DLT_IEEE802_11 + if (datalink == DLT_IEEE802_11) + { + LogMessage("\n"); + LogMessage("Wireless Stats:\n\n"); + LogMessage("Management Packets: " FMTu64("10") " (%.3f%%)\n", + istats.wifi_mgmt, CalcPct(istats.wifi_mgmt, total)); + LogMessage(" Control Packets: " FMTu64("10") " (%.3f%%)\n", + istats.wifi_control, CalcPct(istats.wifi_control, total)); + LogMessage(" Data Packets: " FMTu64("10") " (%.3f%%)\n", + istats.wifi_data, CalcPct(istats.wifi_data, total)); + LogMessage("\n"); + } + +#endif /* if wireless is enabled... */ +#endif // NO_NON_ETHER_DECODER + + /* handle case where we have snort seeing fragmented packets */ + + if (pc.frags > 0) /* begin if (pc.frags > 0) */ + { + LogMessage("\n"); + LogMessage("Fragmentation Stats:\n\n"); + LogMessage("Fragmented IP Packets: " FMTu64("10") "\n", istats.frags); + LogMessage(" Fragment Trackers: " FMTu64("10") "\n", istats.frag_trackers); + LogMessage(" Rebuilt IP Packets: " FMTu64("10") "\n", istats.frag_rebuilt); + LogMessage(" Frag Elements Used: " FMTu64("10") "\n", istats.frag_element); + LogMessage("Discarded(incomplete): " FMTu64("10") "\n", istats.frag_incomp); + LogMessage(" Discarded(timeout): " FMTu64("10") "\n", istats.frag_timeout); + LogMessage(" Frag2 memory faults: " FMTu64("10") "\n", istats.frag_mem_faults); + LogMessage("\n"); + } /* end if (pc.frags > 0) */ + + /* handle TCP stream re-assy stuff here */ + + if (pc.tcp_stream_pkts > 0) + { + LogMessage("\n"); + LogMessage("TCP Stream Reassembly Stats:\n\n"); + LogMessage(" TCP Packets Used: " FMTu64("10") "\n", istats.tcp_str_packets); + LogMessage(" Stream Trackers: " FMTu64("10") "\n", istats.tcp_str_trackers); + LogMessage(" Stream Flushes: " FMTu64("10") "\n", istats.tcp_str_flushes); + LogMessage(" Stream Segments Used: " FMTu64("10") "\n", istats.tcp_str_segs_used); + LogMessage("Stream Segments Queued: " FMTu64("10") "\n", istats.tcp_str_segs_queued); + LogMessage(" Stream4 Memory Faults: " FMTu64("10") "\n", istats.tcp_str_mem_faults); + LogMessage("\n"); + } + + //mpse_print_qinfo(); + + } /* end if pcap_stats(ps, &ps) */ + + alarm(timestats_interval); /* reset the alarm to go off again */ +} + +/* print out stats on how long snort ran */ +void TimeStats(void) +{ + +/* + * variable definitions for improved statistics handling + * + * end_time = time which snort finished running (unix epoch) + * total_secs = total amount of time snort ran + * int_total_secs = used to eliminate casts from this function (temp. var) + * days = number of days snort ran + * hrs = number of hrs snort ran + * mins = number of minutes snort ran + * secs = number of seconds snort ran + * + * ival = temp. variable for integer/modulus math + * ppd = packets per day processed + * pph = packets per hour processed + * ppm = packets per minute processed + * pps = packets per second processed + * + * hflag = used to flag when hrs = zero, but days > 0 + * mflag = used to flag when min = zero, but hrs > 0 + * + */ + + time_t end_time, total_secs; + uint32_t days = 0, hrs = 0, mins = 0, secs = 0, tmp = 0; + uint64_t pps = 0, ppm = 0, pph = 0, ppd = 0; + uint32_t int_total_secs = 0; + char hflag = 0, mflag = 0; + + + end_time = time(NULL); /* grab epoch for end time value (in seconds) */ + total_secs = end_time - start_time; /* total_secs is how many seconds snort ran for */ + + tmp = (uint32_t)total_secs; + int_total_secs = tmp; /* used for cast elimination */ + + days = tmp / SECONDS_PER_DAY; /* 86400 is number of seconds in a day */ + tmp = tmp % SECONDS_PER_DAY; /* grab remainder to process hours */ + hrs = tmp / SECONDS_PER_HOUR; /* 3600 is number of seconds in a(n) hour */ + tmp = tmp % SECONDS_PER_HOUR; /* grab remainder to process minutes */ + mins = tmp / SECONDS_PER_MIN; /* 60 is number of seconds in a minute */ + secs = tmp % SECONDS_PER_MIN; /* grab remainder to process seconds */ + + if (total_secs) + pps = (pc.total_from_pcap / int_total_secs); + else + pps = pc.total_from_pcap; /* guard against division by zero */ + + /* Use ErrorMessage because this is logged whether + * or not logging quietly */ + ErrorMessage("Snort ran for %u Days %u Hours %u Minutes %u Seconds\n", + days, hrs, mins, secs); + + if (days > 0) + { + ppd = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_DAY)); + ErrorMessage("Snort Analyzed " STDu64 " Packets Per Day\n", ppd); + hflag = 1; + } + + if (hrs > 0 || hflag == 1) + { + pph = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_HOUR)); + ErrorMessage("Snort Analyzed " STDu64 " Packets Per Hour\n", pph); + mflag = 1; + } + + if (mins > 0 || mflag == 1) + { + ppm = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_MIN)); + ErrorMessage("Snort Analyzed " STDu64 " Packets Per Minute\n", ppm); + } + + ErrorMessage("Snort Analyzed " STDu64 " Packets Per Second\n", pps); + ErrorMessage("\n"); +} +#endif /* TIMESTATS */ + + +#ifdef PCAP_CLOSE +int UpdatePcapPktStats(int cacheReturn) +#else +int UpdatePcapPktStats(void) +#endif +{ + struct pcap_stat ps; + uint32_t recv, drop; + static char not_initialized = 1; + +#ifdef PCAP_CLOSE + static int priorReturn = 0; + static int returnWasCached = 0; + + if ( !cacheReturn && returnWasCached ) + { + returnWasCached = 0; + return priorReturn; + } + priorReturn = -1; + returnWasCached = cacheReturn; +#endif + + if (not_initialized) + { + memset(&pkt_stats, 0, sizeof(PcapPktStats)); + not_initialized = 0; + } + + if ((pcap_handle == NULL) || ScReadMode()) + return -1; + + if (pcap_stats(pcap_handle, &ps) == -1) + { + pcap_perror(pcap_handle, "pcap_stats"); + return -1; + } + + recv = (uint32_t)ps.ps_recv; + drop = (uint32_t)ps.ps_drop; + +#ifdef LINUX_LIBPCAP_DOUBLES_STATS + recv /= 2; + drop /= 2; +#endif + +#ifdef LIBPCAP_ACCUMULATES + /* pcap recv wrapped */ + if (recv < pkt_stats.wrap_recv) + pkt_stats.recv += (uint64_t)UINT32_MAX; + + /* pcap drop wrapped */ + if (drop < pkt_stats.wrap_drop) + pkt_stats.drop += (uint64_t)UINT32_MAX; + + pkt_stats.wrap_recv = recv; + pkt_stats.wrap_drop = drop; +#else + pkt_stats.recv += (uint64_t)recv; + pkt_stats.drop += (uint64_t)drop; +#endif /* LIBPCAP_ACCUMULATES */ + +#ifdef PCAP_CLOSE + priorReturn = 0; +#endif + return 0; +} + +uint64_t GetPcapPktStatsRecv(void) +{ + return pkt_stats.recv + (uint64_t)pkt_stats.wrap_recv; +} + +uint64_t GetPcapPktStatsDrop(void) +{ + return pkt_stats.drop + (uint64_t)pkt_stats.wrap_drop; +} + + +#ifdef PCAP_CLOSE +/* exiting should be 0 for if not exiting, 1 if restarting, and 2 if exiting */ +#else +/* exiting should be 0 for if not exiting and 1 if exiting */ +#endif +void DropStats(int exiting) +{ + PreprocStatsFuncNode *idx; + uint64_t total = 0; + uint64_t pkts_recv; + uint64_t pkts_drop; + + total = pc.total_processed; + +#ifdef PPM_MGR + PPM_PRINT_SUMMARY(&snort_conf->ppm_cfg); +#endif + + LogMessage("================================================" + "===============================\n"); + +#ifdef TIMESTATS + TimeStats(); /* how long did snort run? */ +#endif + + if (ScReadMode() +#ifdef GIDS + || ScAdapterInlineMode() +#endif + ) + { + LogMessage("Snort processed " STDu64 " packets.\n", total); + } + else + { +#ifdef PCAP_CLOSE + if (exiting < 2 && (pcap_handle == NULL)) +#else + if (pcap_handle == NULL) +#endif + { + LogMessage("Snort received 0 packets\n"); + } + else + { +#ifdef PCAP_CLOSE + if (UpdatePcapPktStats(0) != -1) +#else + if (UpdatePcapPktStats() != -1) +#endif + { + pkts_recv = GetPcapPktStatsRecv(); + pkts_drop = GetPcapPktStatsDrop(); + + LogMessage("Packet Wire Totals:\n"); + LogMessage(" Received: " FMTu64("12") "\n", pkts_recv); + LogMessage(" Analyzed: " FMTu64("12") " (%.3f%%)\n", pc.total_from_pcap, + CalcPct(pc.total_from_pcap, pkts_recv)); + LogMessage(" Dropped: " FMTu64("12") " (%.3f%%)\n", pkts_drop, + CalcPct(pkts_drop, pkts_recv)); + LogMessage("Outstanding: " FMTu64("12") " (%.3f%%)\n", + pkts_recv - pkts_drop - pc.total_from_pcap, + CalcPct((pkts_recv - pkts_drop - pc.total_from_pcap), pkts_recv)); + } + else + { + LogMessage("Unable to calculate percentages for stats\n"); + LogMessage("Total number of packets Analyzed: " FMTu64("12") "\n", pc.total_from_pcap); + } + } + } + + LogMessage("================================================" + "===============================\n"); + + LogMessage("Breakdown by protocol (includes rebuilt packets):\n"); + + LogMessage(" ETH: " FMTu64("-10") " (%.3f%%)\n", + pc.eth, CalcPct(pc.eth, total)); + LogMessage(" ETHdisc: " FMTu64("-10") " (%.3f%%)\n", + pc.ethdisc, CalcPct(pc.ethdisc, total)); +#ifdef GIDS +#ifndef IPFW + LogMessage(" IPTables: " FMTu64("-10") " (%.3f%%)\n", + pc.iptables, CalcPct(pc.iptables, total)); +#else + LogMessage(" IPFW: " FMTu64("-10") " (%.3f%%)\n", + pc.ipfw, CalcPct(pc.ipfw, total)); +#endif /* IPFW */ +#endif /* GIDS */ + LogMessage(" VLAN: " FMTu64("-10") " (%.3f%%)\n", + pc.vlan, CalcPct(pc.vlan, total)); + + if (pc.nested_vlan != 0) + LogMessage("Nested VLAN: " FMTu64("-10") " (%.3f%%)\n", + pc.nested_vlan, CalcPct(pc.nested_vlan, total)); + + LogMessage(" IPV6: " FMTu64("-10") " (%.3f%%)\n", + pc.ipv6, CalcPct(pc.ipv6, total)); + LogMessage(" IP6 EXT: " FMTu64("-10") " (%.3f%%)\n", + pc.ip6ext, CalcPct(pc.ip6ext, total)); + LogMessage(" IP6opts: " FMTu64("-10") " (%.3f%%)\n", + pc.ipv6opts, CalcPct(pc.ipv6opts, total)); + LogMessage(" IP6disc: " FMTu64("-10") " (%.3f%%)\n", + pc.ipv6disc, CalcPct(pc.ipv6disc, total)); + + LogMessage(" IP4: " FMTu64("-10") " (%.3f%%)\n", + pc.ip, CalcPct(pc.ip, total)); + LogMessage(" IP4disc: " FMTu64("-10") " (%.3f%%)\n", + pc.ipdisc, CalcPct(pc.ipdisc, total)); + + LogMessage(" TCP 6: " FMTu64("-10") " (%.3f%%)\n", + pc.tcp6, CalcPct(pc.tcp6, total)); + LogMessage(" UDP 6: " FMTu64("-10") " (%.3f%%)\n", + pc.udp6, CalcPct(pc.udp6, total)); + LogMessage(" ICMP6: " FMTu64("-10") " (%.3f%%)\n", + pc.icmp6, CalcPct(pc.icmp6, total)); + LogMessage(" ICMP-IP: " FMTu64("-10") " (%.3f%%)\n", + pc.embdip, CalcPct(pc.embdip, total)); + + LogMessage(" TCP: " FMTu64("-10") " (%.3f%%)\n", + pc.tcp, CalcPct(pc.tcp, total)); + LogMessage(" UDP: " FMTu64("-10") " (%.3f%%)\n", + pc.udp, CalcPct(pc.udp, total)); + LogMessage(" ICMP: " FMTu64("-10") " (%.3f%%)\n", + pc.icmp, CalcPct(pc.icmp, total)); + + LogMessage(" TCPdisc: " FMTu64("-10") " (%.3f%%)\n", + pc.tdisc, CalcPct(pc.tdisc, total)); + LogMessage(" UDPdisc: " FMTu64("-10") " (%.3f%%)\n", + pc.udisc, CalcPct(pc.udisc, total)); + LogMessage(" ICMPdis: " FMTu64("-10") " (%.3f%%)\n", + pc.icmpdisc, CalcPct(pc.icmpdisc, total)); + + LogMessage(" FRAG: " FMTu64("-10") " (%.3f%%)\n", + pc.frags, CalcPct(pc.frags, total)); + LogMessage(" FRAG 6: " FMTu64("-10") " (%.3f%%)\n", + pc.frag6, CalcPct(pc.frag6, total)); + + LogMessage(" ARP: " FMTu64("-10") " (%.3f%%)\n", + pc.arp, CalcPct(pc.arp, total)); +#ifndef NO_NON_ETHER_DECODER + LogMessage(" EAPOL: " FMTu64("-10") " (%.3f%%)\n", + pc.eapol, CalcPct(pc.eapol, total)); +#endif + LogMessage(" ETHLOOP: " FMTu64("-10") " (%.3f%%)\n", + pc.ethloopback, CalcPct(pc.ethloopback, total)); + LogMessage(" IPX: " FMTu64("-10") " (%.3f%%)\n", + pc.ipx, CalcPct(pc.ipx, total)); +#ifdef GRE + LogMessage("IPv4/IPv4: " FMTu64("-10") " (%.3f%%)\n", + pc.ip4ip4, CalcPct(pc.ip4ip4, total)); + LogMessage("IPv4/IPv6: " FMTu64("-10") " (%.3f%%)\n", + pc.ip4ip6, CalcPct(pc.ip4ip6, total)); + LogMessage("IPv6/IPv4: " FMTu64("-10") " (%.3f%%)\n", + pc.ip6ip4, CalcPct(pc.ip6ip4, total)); + LogMessage("IPv6/IPv6: " FMTu64("-10") " (%.3f%%)\n", + pc.ip6ip6, CalcPct(pc.ip6ip6, total)); + LogMessage(" GRE: " FMTu64("-10") " (%.3f%%)\n", + pc.gre, CalcPct(pc.gre, total)); + LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_eth, CalcPct(pc.gre_eth, total)); + LogMessage(" GRE VLAN: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_vlan, CalcPct(pc.gre_vlan, total)); + LogMessage(" GRE IPv4: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_ip, CalcPct(pc.gre_ip, total)); + LogMessage(" GRE IPv6: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_ipv6, CalcPct(pc.gre_ipv6, total)); + LogMessage("GRE IP6 E: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_ipv6ext, CalcPct(pc.gre_ipv6ext, total)); + LogMessage(" GRE PPTP: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_ppp, CalcPct(pc.gre_ppp, total)); + LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_arp, CalcPct(pc.gre_arp, total)); + LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_ipx, CalcPct(pc.gre_ipx, total)); + LogMessage(" GRE LOOP: " FMTu64("-10") " (%.3f%%)\n", + pc.gre_loopback, CalcPct(pc.gre_loopback, total)); +#endif /* GRE */ +#ifdef MPLS + LogMessage(" MPLS: " FMTu64("-10") " (%.3f%%)\n", + pc.mpls, CalcPct(pc.mpls, total)); +#endif + LogMessage(" OTHER: " FMTu64("-10") " (%.3f%%)\n", + pc.other, CalcPct(pc.other, total)); + LogMessage(" DISCARD: " FMTu64("-10") " (%.3f%%)\n", + pc.discards, CalcPct(pc.discards, total)); + LogMessage("InvChkSum: " FMTu64("-10") " (%.3f%%)\n", + pc.invalid_checksums, CalcPct(pc.invalid_checksums, total)); + + LogMessage(" S5 G 1: " FMTu64("-10") " (%.3f%%)\n", + pc.s5tcp1, CalcPct(pc.s5tcp1, total)); + LogMessage(" S5 G 2: " FMTu64("-10") " (%.3f%%)\n", + pc.s5tcp2, CalcPct(pc.s5tcp2, total)); + + LogMessage(" Total: " FMTu64("-10") "\n", total); + + LogMessage("================================================" + "===============================\n"); + + LogMessage("Action Stats:\n"); + LogMessage("ALERTS: " STDu64 "\n", pc.alert_pkts); + LogMessage("LOGGED: " STDu64 "\n", pc.log_pkts); + LogMessage("PASSED: " STDu64 "\n", pc.pass_pkts); + +#ifdef TARGET_BASED + if (ScIdsMode() && IsAdaptiveConfigured(getDefaultPolicy(), 0)) + { + LogMessage("================================================" + "===============================\n"); + LogMessage("Attribute Table Stats:\n"); + LogMessage(" Number Entries: %u\n", SFAT_NumberOfHosts()); + LogMessage(" Table Reloaded: " STDu64 "\n", pc.attribute_table_reloads); + } +#endif /* TARGET_BASED */ + + //mpse_print_qinfo(); + +#ifndef NO_NON_ETHER_DECODER +#ifdef DLT_IEEE802_11 + if(datalink == DLT_IEEE802_11) + { + LogMessage("================================================" + "===============================\n"); + LogMessage("Wireless Stats:\n"); + LogMessage("Breakdown by type:\n"); + LogMessage(" Management Packets: " FMTu64("-10") " (%.3f%%)\n", + pc.wifi_mgmt, CalcPct(pc.wifi_mgmt, total)); + LogMessage(" Control Packets: " FMTu64("-10") " (%.3f%%)\n", + pc.wifi_control, CalcPct(pc.wifi_control, total)); + LogMessage(" Data Packets: " FMTu64("-10") " (%.3f%%)\n", + pc.wifi_data, CalcPct(pc.wifi_data, total)); + } +#endif /* DLT_IEEE802_11 */ +#endif // NO_NON_ETHER_DECODER + + for (idx = preproc_stats_funcs; idx != NULL; idx = idx->next) + { + LogMessage("==============================================" + "=================================\n"); + +#ifdef PCAP_CLOSE + idx->func(exiting ? 1 : 0); +#else + idx->func(exiting); +#endif + } + + LogMessage("==============================================" + "=================================\n"); + + return; +} + +/**************************************************************************** + * + * Function: CleanupProtoNames() + * + * Purpose: Frees the protocol names + * + * Arguments: None. + * + * Returns: void function + * + ****************************************************************************/ +void CleanupProtoNames(void) +{ + int i; + + for(i = 0; i < 256; i++) + { + if( protocol_names[i] != NULL ) + { + free( protocol_names[i] ); + protocol_names[i] = NULL; + } + } +} + +/**************************************************************************** + * + * Function: read_infile(char *) + * + * Purpose: Reads the BPF filters in from a file. Ripped from tcpdump. + * + * Arguments: fname => the name of the file containing the BPF filters + * + * Returns: the processed BPF string + * + ****************************************************************************/ +char *read_infile(char *fname) +{ + register int fd, cc; + register char *cp, *cmt; + struct stat buf; + + fd = open(fname, O_RDONLY); + + if(fd < 0) + FatalError("can't open %s: %s\n", fname, pcap_strerror(errno)); + + if(fstat(fd, &buf) < 0) + FatalError("can't stat %s: %s\n", fname, pcap_strerror(errno)); + + cp = (char *)SnortAlloc(((u_int)buf.st_size + 1) * sizeof(char)); + + cc = read(fd, cp, (int) buf.st_size); + + if(cc < 0) + FatalError("read %s: %s\n", fname, pcap_strerror(errno)); + + if(cc != buf.st_size) + FatalError("short read %s (%d != %d)\n", fname, cc, (int) buf.st_size); + + cp[(int) buf.st_size] = '\0'; + + close(fd); + + /* Treat everything upto the end of the line as a space + * so that we can put comments in our BPF filters + */ + + while((cmt = strchr(cp, '#')) != NULL) + { + while (*cmt != '\r' && *cmt != '\n' && *cmt != '\0') + { + *cmt++ = ' '; + } + } + + /** LogMessage("BPF filter file: %s\n", fname); **/ + + return(cp); +} + + + /**************************************************************************** + * + * Function: CheckLogDir() + * + * Purpose: CyberPsychotic sez: basically we only check if logdir exist and + * writable, since it might screw the whole thing in the middle. Any + * other checks could be performed here as well. + * + * Arguments: None. + * + * Returns: void function + * + ****************************************************************************/ +void CheckLogDir(void) +{ + struct stat st; + + if (snort_conf->log_dir == NULL) + return; + + if (stat(snort_conf->log_dir, &st) == -1) + FatalError("Stat check on log dir failed: %s.\n", strerror(errno)); + + if (!S_ISDIR(st.st_mode) || (access(snort_conf->log_dir, W_OK) == -1)) + { + FatalError("Can not get write access to logging directory \"%s\". " + "(directory doesn't exist or permissions are set incorrectly " + "or it is not a directory at all)\n", + snort_conf->log_dir); + } +} + +/* Signal handler for child process signaling the parent + * that is is ready */ +static int parent_wait = 1; +static void SigChildReadyHandler(int signal) +{ +#ifdef DEBUG + LogMessage("Received Signal from Child\n"); +#endif + parent_wait = 0; +} + +/**************************************************************************** + * + * Function: GoDaemon() + * + * Purpose: Puts the program into daemon mode, nice and quiet like.... + * + * Arguments: None. + * + * Returns: void function + * + ****************************************************************************/ +void GoDaemon(void) +{ +#ifndef WIN32 + int exit_val = 0; + pid_t fs; + + LogMessage("Initializing daemon mode\n"); + + if (ScDaemonRestart()) + return; + + /* Don't daemonize if we've already daemonized and + * received a SIGHUP. */ + if(getppid() != 1) + { + /* Register signal handler that parent can trap signal */ + signal(SIGNAL_SNORT_CHILD_READY, SigChildReadyHandler); + if (errno != 0) errno=0; + + /* now fork the child */ + fs = fork(); + + if(fs > 0) + { + /* Parent */ + + /* Don't exit quite yet. Wait for the child + * to signal that is there and created the PID + * file. + */ + while (parent_wait) + { + /* Continue waiting until receiving signal from child */ + int status; + if (waitpid(fs, &status, WNOHANG) == fs) + { + /* If the child is gone, parent should go away, too */ + if (WIFEXITED(status)) + { + LogMessage("Child exited unexpectedly\n"); + exit_val = -1; + break; + } + + if (WIFSIGNALED(status)) + { + LogMessage("Child terminated unexpectedly\n"); + exit_val = -2; + break; + } + } +#ifdef DEBUG + LogMessage("Parent waiting for child...\n"); +#endif + + sleep(1); + } + + LogMessage("Daemon parent exiting\n"); + + exit(exit_val); /* parent */ + } + + if(fs < 0) + { + /* Daemonizing failed... */ + perror("fork"); + exit(1); + } + + /* Child */ + setsid(); + } + + close(0); + close(1); + close(2); + +#ifdef DEBUG + /* redirect stdin/stdout/stderr to a file */ + open("/tmp/snort.debug", O_CREAT | O_RDWR); /* stdin, fd 0 */ + + /* Change ownership to that which we will drop privileges to */ + if ((snort_conf->user_id != -1) || (snort_conf->group_id != -1)) + { + uid_t user_id = getuid(); + gid_t group_id = getgid(); + + if (snort_conf->user_id != -1) + user_id = snort_conf->user_id; + if (snort_conf->group_id != -1) + group_id = snort_conf->group_id; + + chown("/tmp/snort.debug", user_id, group_id); + } +#else + /* redirect stdin/stdout/stderr to /dev/null */ + (void)open("/dev/null", O_RDWR); /* stdin, fd 0 */ +#endif + + dup(0); /* stdout, fd 0 => fd 1 */ + dup(0); /* stderr, fd 0 => fd 2 */ + + SignalWaitingParent(); + +#endif /* ! WIN32 */ +} + +/* Signal the parent that child is ready */ +void SignalWaitingParent(void) +{ +#ifndef WIN32 + pid_t parentpid = getppid(); +#ifdef DEBUG + LogMessage("Signaling parent %d from child %d\n", parentpid, getpid()); +#endif + + if (kill(parentpid, SIGNAL_SNORT_CHILD_READY)) + { + LogMessage("Daemon initialized, failed to signal parent pid: %d, failure: %d, %s\n", parentpid, errno, strerror(errno)); + } + else + { + LogMessage("Daemon initialized, signaled parent pid: %d\n", parentpid); + } +#endif +} + +/* This function has been moved into mstring.c, since that +* is where the allocation actually occurs. It has been +* renamed to mSplitFree(). +* +void FreeToks(char **toks, int num_toks) +{ + if (toks) + { + if (num_toks > 0) + { + do + { + num_toks--; + free(toks[num_toks]); + } while(num_toks); + } + free(toks); + } +} +*/ + + +/* Self preserving memory allocator */ +void *SPAlloc(unsigned long size, struct _SPMemControl *spmc) +{ + void *tmp; + + spmc->mem_usage += size; + + if(spmc->mem_usage > spmc->memcap) + { + spmc->sp_func(spmc); + } + + tmp = (void *) calloc(size, sizeof(char)); + + if(tmp == NULL) + { + FatalError("Unable to allocate memory! (%lu requested, %lu in use)\n", + size, spmc->mem_usage); + } + + return tmp; +} + +/* Guaranteed to be '\0' terminated even if truncation occurs. + * + * returns SNORT_SNPRINTF_SUCCESS if successful + * returns SNORT_SNPRINTF_TRUNCATION on truncation + * returns SNORT_SNPRINTF_ERROR on error + */ +int SnortSnprintf(char *buf, size_t buf_size, const char *format, ...) +{ + va_list ap; + int ret; + + if (buf == NULL || buf_size <= 0 || format == NULL) + return SNORT_SNPRINTF_ERROR; + + /* zero first byte in case an error occurs with + * vsnprintf, so buffer is null terminated with + * zero length */ + buf[0] = '\0'; + buf[buf_size - 1] = '\0'; + + va_start(ap, format); + + ret = vsnprintf(buf, buf_size, format, ap); + + va_end(ap); + + if (ret < 0) + return SNORT_SNPRINTF_ERROR; + + if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size) + { + /* result was truncated */ + buf[buf_size - 1] = '\0'; + return SNORT_SNPRINTF_TRUNCATION; + } + + return SNORT_SNPRINTF_SUCCESS; +} + +/* Appends to a given string + * Guaranteed to be '\0' terminated even if truncation occurs. + * + * returns SNORT_SNPRINTF_SUCCESS if successful + * returns SNORT_SNPRINTF_TRUNCATION on truncation + * returns SNORT_SNPRINTF_ERROR on error + */ +int SnortSnprintfAppend(char *buf, size_t buf_size, const char *format, ...) +{ + int str_len; + int ret; + va_list ap; + + if (buf == NULL || buf_size <= 0 || format == NULL) + return SNORT_SNPRINTF_ERROR; + + str_len = SnortStrnlen(buf, buf_size); + + /* since we've already checked buf and buf_size an error + * indicates no null termination, so just start at + * beginning of buffer */ + if (str_len == SNORT_STRNLEN_ERROR) + { + buf[0] = '\0'; + str_len = 0; + } + + buf[buf_size - 1] = '\0'; + + va_start(ap, format); + + ret = vsnprintf(buf + str_len, buf_size - (size_t)str_len, format, ap); + + va_end(ap); + + if (ret < 0) + return SNORT_SNPRINTF_ERROR; + + if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size) + { + /* truncation occured */ + buf[buf_size - 1] = '\0'; + return SNORT_SNPRINTF_TRUNCATION; + } + + return SNORT_SNPRINTF_SUCCESS; +} + +/* Guaranteed to be '\0' terminated even if truncation occurs. + * + * Arguments: dst - the string to contain the copy + * src - the string to copy from + * dst_size - the size of the destination buffer + * including the null byte. + * + * returns SNORT_STRNCPY_SUCCESS if successful + * returns SNORT_STRNCPY_TRUNCATION on truncation + * returns SNORT_STRNCPY_ERROR on error + * + * Note: Do not set dst[0] = '\0' on error since it's possible that + * dst and src are the same pointer - it will at least be null + * terminated in any case + */ +int SnortStrncpy(char *dst, const char *src, size_t dst_size) +{ + char *ret = NULL; + + if (dst == NULL || src == NULL || dst_size <= 0) + return SNORT_STRNCPY_ERROR; + + dst[dst_size - 1] = '\0'; + + ret = strncpy(dst, src, dst_size); + + /* Not sure if this ever happens but might as + * well be on the safe side */ + if (ret == NULL) + return SNORT_STRNCPY_ERROR; + + if (dst[dst_size - 1] != '\0') + { + /* result was truncated */ + dst[dst_size - 1] = '\0'; + return SNORT_STRNCPY_TRUNCATION; + } + + return SNORT_STRNCPY_SUCCESS; +} + +char *SnortStrndup(const char *src, size_t dst_size) +{ + char *ret = SnortAlloc(dst_size + 1); + int ret_val; + + ret_val = SnortStrncpy(ret, src, dst_size + 1); + + if(ret_val == SNORT_STRNCPY_ERROR) + { + free(ret); + return NULL; + } + + return ret; +} + +/* Determines whether a buffer is '\0' terminated and returns the + * string length if so + * + * returns the string length if '\0' terminated + * returns SNORT_STRNLEN_ERROR if not '\0' terminated + */ +int SnortStrnlen(const char *buf, int buf_size) +{ + int i = 0; + + if (buf == NULL || buf_size <= 0) + return SNORT_STRNLEN_ERROR; + + for (i = 0; i < buf_size; i++) + { + if (buf[i] == '\0') + break; + } + + if (i == buf_size) + return SNORT_STRNLEN_ERROR; + + return i; +} + +char * SnortStrdup(const char *str) +{ + char *copy = NULL; + + if (!str) + { + FatalError("Unable to duplicate string: NULL!\n"); + } + + copy = strdup(str); + + if (copy == NULL) + { + FatalError("Unable to duplicate string: %s!\n", str); + } + + return copy; +} + +/* + * Find first occurrence of char of accept in s, limited by slen. + * A 'safe' version of strpbrk that won't read past end of buffer s + * in cases that s is not NULL terminated. + * + * This code assumes 'accept' is a static string. + */ +const char *SnortStrnPbrk(const char *s, int slen, const char *accept) +{ + char ch; + const char *s_end; + if (!s || !*s || !accept || slen == 0) + return NULL; + + s_end = s + slen; + while (s < s_end) + { + ch = *s; + if (strchr(accept, ch)) + return s; + s++; + } + return NULL; +} + +/* + * Find first occurrence of searchstr in s, limited by slen. + * A 'safe' version of strstr that won't read past end of buffer s + * in cases that s is not NULL terminated. + */ +const char *SnortStrnStr(const char *s, int slen, const char *searchstr) +{ + char ch, nc; + int len; + if (!s || !*s || !searchstr || slen == 0) + return NULL; + + if ((ch = *searchstr++) != 0) + { + len = strlen(searchstr); + do + { + do + { + if ((nc = *s++) == 0) + { + return NULL; + } + slen--; + if (slen == 0) + return NULL; + } while (nc != ch); + if (slen - len < 0) + return NULL; + } while (memcmp(s, searchstr, len) != 0); + s--; + slen++; + } + return s; +} + +/* + * Find first occurrence of substring in s, ignore case. +*/ +const char *SnortStrcasestr(const char *s, const char *substr) +{ + char ch, nc; + int len; + + if (!s || !*s || !substr) + return NULL; + + if ((ch = *substr++) != 0) + { + ch = tolower((char)ch); + len = strlen(substr); + do + { + do + { + if ((nc = *s++) == 0) + { + return NULL; + } + } while ((char)tolower((uint8_t)nc) != ch); + } while (strncasecmp(s, substr, len) != 0); + s--; + } + return s; +} + +void *SnortAlloc(unsigned long size) +{ + void *tmp; + + tmp = (void *) calloc(size, sizeof(char)); + + if(tmp == NULL) + { + FatalError("Unable to allocate memory! (%lu requested)\n", size); + } + + return tmp; +} + +void * SnortAlloc2(size_t size, const char *format, ...) +{ + void *tmp; + + tmp = (void *)calloc(size, sizeof(char)); + + if(tmp == NULL) + { + va_list ap; + char buf[STD_BUF]; + + buf[STD_BUF - 1] = '\0'; + + va_start(ap, format); + + vsnprintf(buf, STD_BUF - 1, format, ap); + + va_end(ap); + + FatalError("%s", buf); + } + + return tmp; +} + +/** + * Chroot and adjust the snort_conf->log_dir reference + * + * @param directory directory to chroot to + * @param logstore ptr to snort_conf->log_dir which must be dynamically allocated + */ +void SetChroot(char *directory, char **logstore) +{ +#ifdef WIN32 + FatalError("SetChroot() should not be called under Win32!\n"); +#else + char *absdir; + size_t abslen; + char *logdir; + + if(!directory || !logstore) + { + FatalError("Null parameter passed\n"); + } + + logdir = *logstore; + + if(logdir == NULL || *logdir == '\0') + { + FatalError("Null log directory\n"); + } + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n", + CurrentWorkingDir());); + + logdir = GetAbsolutePath(logdir); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n", + CurrentWorkingDir())); + + logdir = SnortStrdup(logdir); + + /* We're going to reset logstore, so free it now */ + free(*logstore); + *logstore = NULL; + + /* change to the directory */ + if(chdir(directory) != 0) + { + FatalError("SetChroot: Can not chdir to \"%s\": %s\n", directory, + strerror(errno)); + } + + /* always returns an absolute pathname */ + absdir = CurrentWorkingDir(); + + if(absdir == NULL) + { + FatalError("NULL Chroot found\n"); + } + + abslen = strlen(absdir); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen);); + + /* make the chroot call */ + if(chroot(absdir) < 0) + { + FatalError("Can not chroot to \"%s\": absolute: %s: %s\n", + directory, absdir, strerror(errno)); + } + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chroot success (%s ->", absdir);); + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"%s)\n ", CurrentWorkingDir());); + + /* change to "/" in the new directory */ + if(chdir("/") < 0) + { + FatalError("Can not chdir to \"/\" after chroot: %s\n", + strerror(errno)); + } + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chdir success (%s)\n", + CurrentWorkingDir());); + + + if(strncmp(absdir, logdir, strlen(absdir))) + { + FatalError("Absdir is not a subset of the logdir"); + } + + if(abslen >= strlen(logdir)) + { + *logstore = SnortStrdup("/"); + } + else + { + *logstore = SnortStrdup(logdir + abslen); + } + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n", + logdir, *logstore)); + + LogMessage("Chroot directory = %s\n", directory); + +#if 0 + /* XXX XXX */ + /* install the I can't do this signal handler */ + signal(SIGHUP, SigCantHupHandler); +#endif +#endif /* !WIN32 */ +} + + +/** + * Return a ptr to the absolute pathname of snort. This memory must + * be copied to another region if you wish to save it for later use. + */ +char *CurrentWorkingDir(void) +{ + static char buf[PATH_MAX_UTIL + 1]; + + if(getcwd((char *) buf, PATH_MAX_UTIL) == NULL) + { + return NULL; + } + + buf[PATH_MAX_UTIL] = '\0'; + + return (char *) buf; +} + +/** + * Given a directory name, return a ptr to a static + */ +char *GetAbsolutePath(char *dir) +{ + char *savedir, *dirp; + static char buf[PATH_MAX_UTIL + 1]; + + if(dir == NULL) + { + return NULL; + } + + savedir = strdup(CurrentWorkingDir()); + + if(savedir == NULL) + { + return NULL; + } + + if(chdir(dir) < 0) + { + LogMessage("Can't change to directory: %s\n", dir); + free(savedir); + return NULL; + } + + dirp = CurrentWorkingDir(); + + if(dirp == NULL) + { + LogMessage("Unable to access current directory\n"); + free(savedir); + return NULL; + } + else + { + strncpy(buf, dirp, PATH_MAX_UTIL); + buf[PATH_MAX_UTIL] = '\0'; + } + + if(chdir(savedir) < 0) + { + LogMessage("Can't change back to directory: %s\n", dir); + free(savedir); + return NULL; + } + + free(savedir); + return (char *) buf; +} + + +#ifndef WIN32 +/* very slow sort - do not use at runtime! */ +SF_LIST * SortDirectory(const char *path) +{ + SF_LIST *dir_entries; + DIR *dir; + struct dirent *direntry; + int ret = 0; + + if (path == NULL) + return NULL; + + dir_entries = sflist_new(); + if (dir_entries == NULL) + { + ErrorMessage("Could not allocate new list for directory entries\n"); + return NULL; + } + + dir = opendir(path); + if (dir == NULL) + { + ErrorMessage("Error opening directory: %s: %s\n", + path, strerror(errno)); + sflist_free_all(dir_entries, free); + return NULL; + } + + /* Reset errno since we'll be checking it unconditionally */ + errno = 0; + + while ((direntry = readdir(dir)) != NULL) + { + char *node_entry_name, *dir_entry_name; + SF_LNODE *node; + + dir_entry_name = SnortStrdup(direntry->d_name); + + for (node = sflist_first_node(dir_entries); + node != NULL; + node = sflist_next_node(dir_entries)) + { + node_entry_name = (char *)node->ndata; + if (strcmp(dir_entry_name, node_entry_name) < 0) + break; + } + + if (node == NULL) + ret = sflist_add_tail(dir_entries, (NODE_DATA)dir_entry_name); + else + ret = sflist_add_before(dir_entries, node, (NODE_DATA)dir_entry_name); + + if (ret == -1) + { + ErrorMessage("Error adding directory entry to list\n"); + sflist_free_all(dir_entries, free); + closedir(dir); + return NULL; + } + } + + if (errno != 0) + { + ErrorMessage("Error reading directory: %s: %s\n", + path, strerror(errno)); + errno = 0; + sflist_free_all(dir_entries, free); + closedir(dir); + return NULL; + } + + closedir(dir); + + return dir_entries; +} + +int GetFilesUnderDir(const char *path, SF_QUEUE *dir_queue, const char *filter) +{ + SF_LIST *dir_entries; + char *direntry; + int ret = 0; + int num_files = 0; + + if ((path == NULL) || (dir_queue == NULL)) + return -1; + + dir_entries = SortDirectory(path); + if (dir_entries == NULL) + { + ErrorMessage("Error sorting entries in directory: %s\n", path); + return -1; + } + + for (direntry = (char *)sflist_first(dir_entries); + direntry != NULL; + direntry = (char *)sflist_next(dir_entries)) + { + char path_buf[PATH_MAX]; + struct stat file_stat; + + /* Don't look at dot files */ + if (strncmp(".", direntry, 1) == 0) + continue; + + ret = SnortSnprintf(path_buf, PATH_MAX, "%s%s%s", + path, path[strlen(path) - 1] == '/' ? "" : "/", direntry); + if (ret == SNORT_SNPRINTF_TRUNCATION) + { + ErrorMessage("Error copying file to buffer: Path too long\n"); + sflist_free_all(dir_entries, free); + return -1; + } + else if (ret != SNORT_SNPRINTF_SUCCESS) + { + ErrorMessage("Error copying file to buffer\n"); + sflist_free_all(dir_entries, free); + return -1; + } + + ret = stat(path_buf, &file_stat); + if (ret == -1) + { + ErrorMessage("Could not stat file: %s: %s\n", + path_buf, strerror(errno)); + sflist_free_all(dir_entries, free); + return -1; + } + + if (file_stat.st_mode & S_IFDIR) + { + ret = GetFilesUnderDir(path_buf, dir_queue, filter); + if (ret == -1) + { + sflist_free_all(dir_entries, free); + return -1; + } + + num_files += ret; + } + else if (file_stat.st_mode & S_IFREG) + { + if ((filter == NULL) || (fnmatch(filter, direntry, 0) == 0)) + { + char *file = SnortStrdup(path_buf); + + ret = sfqueue_add(dir_queue, (NODE_DATA)file); + if (ret == -1) + { + ErrorMessage("Could not append item to list: %s\n", file); + free(file); + sflist_free_all(dir_entries, free); + return -1; + } + + num_files++; + } + } + } + + sflist_free_all(dir_entries, free); + + return num_files; +} +#endif + +/**************************************************************************** + * + * Function: GetUniqueName(char * iface) + * + * Purpose: To return a string that has a high probability of being unique + * for a given sensor. + * + * Arguments: char * iface - The network interface you are sniffing + * + * Returns: A char * -- its a static char * so you should not free it + * + ***************************************************************************/ +char *GetUniqueName(char * iface) +{ + char * rptr; + static char uniq_name[256]; + + if (iface == NULL) LogMessage("Interface is NULL. Name may not be unique for the host\n"); +#ifndef WIN32 + rptr = GetIP(iface); + if(rptr == NULL || !strcmp(rptr, "unknown")) +#endif + { + SnortSnprintf(uniq_name, 255, "%s:%s\n",GetHostname(),iface); + rptr = uniq_name; + } + if (ScLogVerbose()) LogMessage("Node unique name is: %s\n", rptr); + return rptr; +} + +/**************************************************************************** + * + * Function: GetIP(char * iface) + * + * Purpose: To return a string representing the IP address for an interface + * + * Arguments: char * iface - The network interface you want to find an IP + * address for. + * + * Returns: A char * -- make sure you call free on this when you are done + * with it. + * + ***************************************************************************/ +char *GetIP(char * iface) +{ + struct ifreq ifr; + struct sockaddr_in *addr; + int s; +#ifdef SUP_IP6 + sfip_t ret; +#endif + + if(iface) + { + /* Set up a dummy socket just so we can use ioctl to find the + ip address of the interface */ + s = socket(PF_INET, SOCK_DGRAM, 0); + if(s == -1) + { + FatalError("Problem establishing socket to find IP address for interface: %s\n", iface); + } + + SnortStrncpy(ifr.ifr_name, iface, strlen(iface) + 1); + +#ifndef WIN32 + if(ioctl(s, SIOCGIFADDR, &ifr) < 0) return NULL; + else +#endif + { + addr = (struct sockaddr_in *) &ifr.ifr_broadaddr; + } + close(s); + +#ifdef SUP_IP6 +// XXX-IPv6 uses ioctl to populate a sockaddr_in structure ... but what if the interface only has an IPv6 address? + sfip_set_raw(&ret, addr, AF_INET); + return SnortStrdup(sfip_ntoa(&ret)); +#else + return SnortStrdup(inet_ntoa(addr->sin_addr)); +#endif + } + else + { + return "unknown"; + } +} + +/**************************************************************************** + * + * Function: GetHostname() + * + * Purpose: To return a string representing the hostname + * + * Arguments: None + * + * Returns: A static char * representing the hostname. + * + ***************************************************************************/ +char *GetHostname(void) +{ +#ifdef WIN32 + DWORD bufflen = 256; + static char buff[256]; + GetComputerName(buff, &bufflen); + return buff; +#else + char * error = "unknown"; + if(getenv("HOSTNAME")) return getenv("HOSTNAME"); + else if(getenv("HOST")) return getenv("HOST"); + else return error; +#endif +} + +/**************************************************************************** + * + * Function: GetTimestamp(register const struct timeval *tvp, int tz) + * + * Purpose: Get an ISO-8601 formatted timestamp for tvp within the tz + * timezone. + * + * Arguments: tvp is a timeval pointer. tz is a timezone. + * + * Returns: char * -- You must free this char * when you are done with it. + * + ***************************************************************************/ +char *GetTimestamp(register const struct timeval *tvp, int tz) +{ + struct tm *lt; /* localtime */ + char * buf; + int msec; + + buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char)); + + msec = tvp->tv_usec / 1000; + + if (ScOutputUseUtc()) + { + lt = gmtime((time_t *)&tvp->tv_sec); + SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i", + 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, + lt->tm_hour, lt->tm_min, lt->tm_sec, msec); + } + else + { + lt = localtime((time_t *)&tvp->tv_sec); + SnortSnprintf(buf, SMALLBUFFER, + "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i", + 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, + lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tz); + } + + return buf; +} + +/**************************************************************************** + * + * Function: GetLocalTimezone() + * + * Purpose: Find the offset from GMT for current host + * + * Arguments: none + * + * Returns: int representing the offset from GMT + * + ***************************************************************************/ +int GetLocalTimezone(void) +{ + time_t ut; + struct tm * ltm; + long seconds_away_from_utc; + + time(&ut); + ltm = localtime(&ut); + +#if defined(WIN32) || defined(SOLARIS) || defined(AIX) || defined(HPUX) + /* localtime() sets the global timezone variable, + which is defined in */ + seconds_away_from_utc = timezone; +#else + seconds_away_from_utc = ltm->tm_gmtoff; +#endif + + return seconds_away_from_utc/3600; +} + +/**************************************************************************** + * + * Function: GetCurrentTimestamp() + * + * Purpose: Generate an ISO-8601 formatted timestamp for the current time. + * + * Arguments: none + * + * Returns: char * -- You must free this char * when you are done with it. + * + ***************************************************************************/ +char *GetCurrentTimestamp(void) +{ + struct tm *lt; + struct timezone tz; + struct timeval tv; + struct timeval *tvp; + char * buf; + int tzone; + int msec; + + buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char)); + + bzero((char *)&tz,sizeof(tz)); + gettimeofday(&tv,&tz); + tvp = &tv; + + msec = tvp->tv_usec/1000; + + if (ScOutputUseUtc()) + { + lt = gmtime((time_t *)&tvp->tv_sec); + SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i", + 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, + lt->tm_hour, lt->tm_min, lt->tm_sec, msec); + } + else + { + lt = localtime((time_t *)&tvp->tv_sec); + + tzone = GetLocalTimezone(); + + SnortSnprintf(buf, SMALLBUFFER, + "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i", + 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday, + lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tzone); + } + + return buf; +} + +/**************************************************************************** + * Function: base64(char * xdata, int length) + * + * Purpose: Insert data into the database + * + * Arguments: xdata => pointer to data to base64 encode + * length => how much data to encode + * + * Make sure you allocate memory for the output before you pass + * the output pointer into this function. You should allocate + * (1.5 * length) bytes to be safe. + * + * Returns: data base64 encoded as a char * + * + ***************************************************************************/ +char * base64(const u_char * xdata, int length) +{ + int count, cols, bits, c, char_count; + unsigned char alpha[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; /* 64 bytes */ + char * payloadptr; + char * output; + char_count = 0; + bits = 0; + cols = 0; + + output = (char *)SnortAlloc( ((unsigned int) (length * 1.5 + 4)) * sizeof(char) ); + + payloadptr = output; + + for(count = 0; count < length; count++) + { + c = xdata[count]; + + if(c > 255) + { + ErrorMessage("plugbase.c->base64(): encountered char > 255 (decimal %d)\n If you see this error message a char is more than one byte on your machine\n This means your base64 results can not be trusted", c); + } + + bits += c; + char_count++; + + if(char_count == 3) + { + *output = alpha[bits >> 18]; output++; + *output = alpha[(bits >> 12) & 0x3f]; output++; + *output = alpha[(bits >> 6) & 0x3f]; output++; + *output = alpha[bits & 0x3f]; output++; + cols += 4; + if(cols == 72) + { + *output = '\n'; output++; + cols = 0; + } + bits = 0; + char_count = 0; + } + else + { + bits <<= 8; + } + } + + if(char_count != 0) + { + bits <<= 16 - (8 * char_count); + *output = alpha[bits >> 18]; output++; + *output = alpha[(bits >> 12) & 0x3f]; output++; + if(char_count == 1) + { + *output = '='; output++; + *output = '='; output++; + } + else + { + *output = alpha[(bits >> 6) & 0x3f]; + output++; *output = '='; + output++; + } + } + *output = '\0'; + return payloadptr; +} + +/**************************************************************************** + * + * Function: ascii(u_char *xdata, int length) + * + * Purpose: This function takes takes a buffer "xdata" and its length then + * returns a string of only the printable ASCII characters. + * + * Arguments: xdata is the buffer, length is the length of the buffer in + * bytes + * + * Returns: char * -- You must free this char * when you are done with it. + * + ***************************************************************************/ +char *ascii(const u_char *xdata, int length) +{ + char *d_ptr, *ret_val; + int i,count = 0; + int size; + + if(xdata == NULL) + { + return NULL; + } + + for(i=0;i') /* > */ + count += 4; + } + + size = length + count + 1; + ret_val = (char *) calloc(1,size); + + if(ret_val == NULL) + { + LogMessage("plugbase.c: ascii(): Out of memory, can't log anything!\n"); + return NULL; + } + + d_ptr = ret_val; + + for(i=0;i 0x1F) && (xdata[i] < 0x7F)) + { + if(xdata[i] == '<') + { + SnortStrncpy(d_ptr, "<", size - (d_ptr - ret_val)); + d_ptr+=4; + } + else if(xdata[i] == '&') + { + SnortStrncpy(d_ptr, "&", size - (d_ptr - ret_val)); + d_ptr += 5; + } + else if(xdata[i] == '>') + { + SnortStrncpy(d_ptr, ">", size - (d_ptr - ret_val)); + d_ptr += 4; + } + else + { + *d_ptr++ = xdata[i]; + } + } + else + { + *d_ptr++ = '.'; + } + } + + *d_ptr++ = '\0'; + + return ret_val; +} + +/**************************************************************************** + * + * Function: hex(u_char *xdata, int length) + * + * Purpose: This function takes takes a buffer "xdata" and its length then + * returns a string of hex with no spaces + * + * Arguments: xdata is the buffer, length is the length of the buffer in + * bytes + * + * Returns: char * -- You must free this char * when you are done with it. + * + ***************************************************************************/ +char *hex(const u_char *xdata, int length) +{ + int x; + char *rval = NULL; + char *buf = NULL; + + if (xdata == NULL) + return NULL; + + buf = (char *)calloc((length * 2) + 1, sizeof(char)); + + if (buf != NULL) + { + rval = buf; + + for (x = 0; x < length; x++) + { + SnortSnprintf(buf, 3, "%02X", xdata[x]); + buf += 2; + } + + rval[length * 2] = '\0'; + } + + return rval; +} + + + +char *fasthex(const u_char *xdata, int length) +{ + char conv[] = "0123456789ABCDEF"; + char *retbuf = NULL; + const u_char *index; + const u_char *end; + char *ridx; + + index = xdata; + end = xdata + length; + retbuf = (char *)SnortAlloc(((length * 2) + 1) * sizeof(char)); + ridx = retbuf; + + while(index < end) + { + *ridx++ = conv[((*index & 0xFF)>>4)]; + *ridx++ = conv[((*index & 0xFF)&0x0F)]; + index++; + } + + return retbuf; +} + +/* + * Fatal Integer Parser + * Ascii to Integer conversion with fatal error support + */ +long int xatol(const char *s , const char *etext) +{ + long int val; + char *endptr; + char *default_error = "xatol() error\n"; + + if (etext == NULL) + etext = default_error; + + if (s == NULL) + FatalError("%s: String is NULL\n", etext); + + while (isspace((int)*s)) + s++; + + if (strlen(s) == 0) + FatalError("%s: String is empty\n", etext); + + + /* + * strtoul - errors on win32 : ERANGE (VS 6.0) + * errors on linux : ERANGE, EINVAL + * (for EINVAL, unsupported base which won't happen here) + */ + val = SnortStrtol(s, &endptr, 0); + + if ((errno == ERANGE) || (*endptr != '\0')) + FatalError("%s: Invalid integer input: %s\n", etext, s); + + return val; +} + +/* + * Fatal Integer Parser + * Ascii to Integer conversion with fatal error support + */ +unsigned long int xatou(const char *s , const char *etext) +{ + unsigned long int val; + char *endptr; + char *default_error = "xatou() error\n"; + + if (etext == NULL) + etext = default_error; + + if (s == NULL) + FatalError("%s: String is NULL\n", etext); + + while (isspace((int)*s)) + s++; + + if (strlen(s) == 0) + FatalError("%s: String is empty\n", etext); + + if (*s == '-') + { + FatalError("%s: Invalid unsigned integer - negative sign found, " + "input: %s\n", etext, s); + } + + + /* + * strtoul - errors on win32 : ERANGE (VS 6.0) + * errors on linux : ERANGE, EINVAL + */ + val = SnortStrtoul(s, &endptr, 0); + + if ((errno == ERANGE) || (*endptr != '\0')) + FatalError("%s: Invalid integer input: %s\n", etext, s); + + return val; +} + +unsigned long int xatoup(const char *s , const char *etext) +{ + unsigned long int val = xatou(s, etext); + if ( !val ) + FatalError("%s: must be > 0\n", etext); + return val; +} + +#ifndef SUP_IP6 +char * ObfuscateIpToText(const struct in_addr ip_addr) +#else +char * ObfuscateIpToText(sfip_t *ip) +#endif +{ + static char ip_buf1[INET6_ADDRSTRLEN]; + static char ip_buf2[INET6_ADDRSTRLEN]; + static int buf_num = 0; + int buf_size = INET6_ADDRSTRLEN; + char *ip_buf; +#ifndef SUP_IP6 + uint32_t ip = ip_addr.s_addr; +#endif + + if (buf_num) + ip_buf = ip_buf2; + else + ip_buf = ip_buf1; + + buf_num ^= 1; + ip_buf[0] = 0; + +#ifndef SUP_IP6 + if (ip == 0) + return ip_buf; + + if (snort_conf->obfuscation_net == 0) + { + /* Fully obfuscate - just use 'x' */ + SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx"); + } + else + { + if (snort_conf->homenet != 0) + { + if ((ip & snort_conf->netmask) == snort_conf->homenet) + ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask); + } + else + { + ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask); + } + + SnortSnprintf(ip_buf, buf_size, "%s", inet_ntoa(*((struct in_addr *)&ip))); + } + +#else + if (ip == NULL) + return ip_buf; + + if (!IS_SET(snort_conf->obfuscation_net)) + { + if (IS_IP6(ip)) + SnortSnprintf(ip_buf, buf_size, "x:x:x:x::x:x:x:x"); + else + SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx"); + } + else + { + sfip_t tmp; + char *tmp_buf; + + IP_COPY_VALUE(tmp, ip); + + if (IS_SET(snort_conf->homenet)) + { + if (sfip_contains(&snort_conf->homenet, &tmp) == SFIP_CONTAINS) + sfip_obfuscate(&snort_conf->obfuscation_net, &tmp); + } + else + { + sfip_obfuscate(&snort_conf->obfuscation_net, &tmp); + } + + tmp_buf = sfip_to_str(&tmp); + SnortSnprintf(ip_buf, buf_size, "%s", tmp_buf); + } +#endif + + return ip_buf; +} + +void PrintPacketData(const uint8_t *data, const uint32_t len) +{ + uint32_t i, j; + uint32_t total_len = 0; + uint8_t hex_buf[16]; + uint8_t char_buf[16]; + char *length_chars = " 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\n" + "------------------------------------------------------\n"; + + LogMessage("%s", length_chars); + + for (i = 0; i <= len; i++) + { + if ((i%16 == 0) && (i != 0)) + { + LogMessage("%04x ", total_len); + total_len += 16; + + for (j = 0; j < 16; j++) + { + LogMessage("%02x ", hex_buf[j]); + if (j == 7) + LogMessage(" "); + } + + LogMessage(" "); + + for (j = 0; j < 16; j++) + { + LogMessage("%c", char_buf[j]); + if (j == 7) + LogMessage(" "); + } + + LogMessage("\n"); + } + + if (i == len) + break; + + hex_buf[i%16] = data[i]; + + if (isprint((int)data[i])) + char_buf[i%16] = data[i]; + else + char_buf[i%16] = '.'; + } + + if ((i-total_len) > 0) + { + LogMessage("%04x ", total_len); + + for (j = 0; j < i-total_len; j++) + { + LogMessage("%02x ", hex_buf[j]); + if (j == 7) + LogMessage(" "); + } + + if (j < 8) + LogMessage(" "); + LogMessage("%*s", (16-j)*3, ""); + LogMessage(" "); + + for (j = 0; j < i-total_len; j++) + { + LogMessage("%c", char_buf[j]); + if (j == 7) + LogMessage(" "); + } + } + + LogMessage("\n"); +} + diff --git a/config/snort-dev/patches/spoink_patch/spo_pf.c b/config/snort-dev/patches/spoink_patch/spo_pf.c new file mode 100644 index 00000000..121920fc --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/spo_pf.c @@ -0,0 +1,462 @@ +/* +* +* Copyright (c) 2006 Antonio Benojar +* Copyright (c) 2005 Antonio Benojar +* +* Copyright (c) 2003, 2004 Armin Wolfermann: +* +* s2c_pf_block and s2c_pf_unblock functions are based +* in Armin's Wolfermann pftabled-1.03 functions. +* +* All rights reserved. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* 1. Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* +* 2. Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in the +* documentation and/or other materials provided with the distribution. +* +* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR +* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, +* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ + + +/* + TODO + + - num. max ips. + - ipwhitelisting structure + - best ip regex expr +*/ + + +#ifndef LIST_END +#define LIST_END(head) NULL +#endif + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "event.h" +#include "decode.h" +#include "plugbase.h" +#include "spo_plugbase.h" +#include "debug.h" +#include "parser.h" +#include "util.h" +#include "log.h" +#include "mstring.h" + +#include "snort.h" + +#include "spo_pf.h" + +#ifdef HAVE_STRINGS_H +#include +#endif + +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define PFDEVICE "/dev/pf" + +typedef struct _SpoAlertPfData { + FILE *wlfile; + char *pftable; + int fd; + struct wlist_head head; +} SpoAlertPfData; + +void AlertPfInit(u_char *); +SpoAlertPfData *ParseAlertPfArgs(char *); +void AlertPf(Packet *, char *, void *, Event *); +void AlertPfCleanExit(int, void *); +void AlertPfRestart(int, void *); + +int s2c_pf_init(void); +int s2c_pf_block(int, char *, char *, int); +int s2c_pf_intbl(int, char *, int); + +int s2c_parse_line(char *, FILE*); +int s2c_parse_load_wl(FILE*, struct wlist_head*, int); +int s2c_parse_search_wl(char *, struct wlist_head); +int s2c_parse_free_wl(struct wlist_head*); +int s2c_parse_ip(char *, char *, int); + + +void AlertPfSetup(void) +{ + RegisterOutputPlugin("alert_pf", OUTPUT_TYPE_FLAG__ALERT, AlertPfInit); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Output plugin: AlertPf is setup...\n");); +} + +void AlertPfInit(u_char *args) +{ + SpoAlertPfData *data; + DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Output: AlertPf Initialized\n");); + + data = ParseAlertPfArgs(args); + + DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Linking AlertPf functions to call lists...\n");); + + AddFuncToOutputList(AlertPf, OUTPUT_TYPE_FLAG__ALERT, data); + AddFuncToCleanExitList(AlertPfCleanExit, data); + AddFuncToRestartList(AlertPfRestart, data); +} + + +void AlertPf(Packet *p, char *msg, void *arg, Event *event) +{ + SpoAlertPfData *data = (SpoAlertPfData *)arg; + char *ip; + int ret; + + DEBUG_WRAP(DebugMessage(DEBUG_LOG, "spoink block'n!!\n");); + + ip = inet_ntoa(p->iph->ip_src); + + if (ip == NULL) + FatalError("AlertPf() => inet_ntoa() = NULL\n", strerror(errno)); + + ret = s2c_parse_search_wl(ip, data->head); + + if (ret == 0) + s2c_pf_block(data->fd, data->pftable, inet_ntoa(p->iph->ip_src), 0); + + return; +} + +SpoAlertPfData *ParseAlertPfArgs(char *args) +{ + char **toks; + int num_toks; + SpoAlertPfData *data; + + int res = 0; + + data = (SpoAlertPfData *)SnortAlloc(sizeof(SpoAlertPfData)); + + if(args == NULL) + FatalError("Unable to load pf args\n", strerror(errno)); + + data->fd = s2c_pf_init(); + + if (data->fd == -1) + FatalError("s2c_pf_init() => no pf device\n"); + + DEBUG_WRAP(DebugMessage(DEBUG_LOG,"ParseAlertPfArgs: %s\n", args);); + + toks = mSplit(args, ",", 2, &num_toks, 0); + + if(num_toks <= 1) + FatalError("snort.conf => You must supply TWO arguments for the pf plugin...\n", strerror(errno)); + + if(strstr(toks[0], "..") != NULL) + FatalError("snort.conf => File definition contains \"..\". Do not do that!\n"); + + data->wlfile = fopen(toks[0], "r"); + + if (data->wlfile == NULL) + FatalError("snort.conf => Unable to open whitelist file\n", strerror(errno)); + + if (toks[1] == NULL) + FatalError("snort.conf => No pf table defined\n", strerror(errno)); + else + data->pftable = toks[1]; + + if (s2c_pf_intbl(data->fd, data->pftable, 0) == 0) + FatalError("pf.conf => Table %s don't exists in packet filter\n", data->pftable, strerror(errno)); + + res = s2c_parse_load_wl(data->wlfile, &data->head, 0); + if (res == -1) + FatalError("snort.conf => Unable to load whitelist\n", strerror(errno)); + + return data; +} + +void AlertPfCleanExit(int signal, void *arg) +{ + SpoAlertPfData *data = (SpoAlertPfData *)arg; + DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfCleanExit\n");); + + s2c_parse_free_wl(&data->head); + fclose(data->wlfile); + close(data->fd); + + free(data); +} + +void AlertPfRestart(int signal, void *arg) +{ + SpoAlertPfData *data = (SpoAlertPfData *)arg; + DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfRestart\n");); + + s2c_parse_free_wl(&data->head); + fclose(data->wlfile); + close(data->fd); + + free(data); +} + + +int s2c_pf_init(void) +{ + return(open(PFDEVICE, O_RDWR)); +} + +int s2c_pf_block(int dev, char *tablename, char *ip, int debug) +{ + + struct pfioc_table io; + struct pfr_table table; + struct pfr_addr addr; + struct in_addr *net_addr=NULL; + + memset(&io, 0x00, sizeof(struct pfioc_table)); + memset(&table, 0x00, sizeof(struct pfr_table)); + memset(&addr, 0x00, sizeof(struct pfr_addr)); + + strlcpy(table.pfrt_name, tablename, PF_TABLE_NAME_SIZE); + net_addr=(struct in_addr*)malloc(sizeof(struct in_addr)); + + if (net_addr == NULL ) + FatalError("s2c_pf_block() => malloc()\n", strerror(errno)); + + inet_aton(ip, (struct in_addr *)&net_addr); + memcpy(&addr.pfra_ip4addr.s_addr, &net_addr, sizeof(struct in_addr)); + + addr.pfra_af = AF_INET; + addr.pfra_net = 32; + + io.pfrio_table = table; + io.pfrio_buffer = &addr; + io.pfrio_esize = sizeof(struct pfr_addr); + io.pfrio_size = 1; + + if (ioctl(dev, DIOCRADDADDRS, &io)) + FatalError("s2c_pf_block() => ioctl() DIOCRADDADDRS\n", strerror(errno)); + + return(0); +} + +int s2c_pf_intbl(int dev, char * tablename, int debug) +{ + int i; + struct pfioc_table io; + struct pfr_table *table_aux = NULL; + + memset(&io, 0x00, sizeof(struct pfioc_table)); + + io.pfrio_buffer = table_aux; + io.pfrio_esize = sizeof(struct pfr_table); + io.pfrio_size = 0; + + if(ioctl(dev, DIOCRGETTABLES, &io)) + FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno)); + + table_aux = (struct pfr_table*)malloc(sizeof(struct pfr_table)*io.pfrio_size); + + if (table_aux == NULL) + FatalError("s2c_pf_intbl() => malloc()\n", strerror(errno)); + + io.pfrio_buffer = table_aux; + io.pfrio_esize = sizeof(struct pfr_table); + + if(ioctl(dev, DIOCRGETTABLES, &io)) + FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno)); + + for(i=0; i< io.pfrio_size; i++) { + if (!strcmp(table_aux[i].pfrt_name, tablename)) + return 1; + } + + return 0; + +} + + +int s2c_parse_line(char buf[WLMAX] , FILE* wfile) +{ + static char next_ch = ' '; + int i = 0; + + if (feof(wfile)) { + return (0); + } + do { + next_ch = fgetc(wfile); + if (i < WLMAX) + buf[i++] = next_ch; + } while (!feof(wfile) && !isspace(next_ch)); + if (i >= WLMAX) { + return (-1); + } + + buf[i] = '\0'; + return (1); +} + + +int s2c_parse_load_wl(FILE *wfile, struct wlist_head *head, int debug) +{ + + char cad[WLMAX]; + char ret[WLMAX]; + struct ipwlist *ipw2, *ipw1 = NULL; + struct flock lock; + + if (wfile == NULL) + FatalError("s2c_parse_load_wl() => Unable to open whitelist file\n", strerror(errno)); + + memset(&lock, 0x00, sizeof(struct flock)); + lock.l_type = F_RDLCK; + fcntl(fileno(wfile), F_SETLKW, &lock); + + LIST_INIT(head); + + if (s2c_parse_line(cad, wfile) == 1) { + if (s2c_parse_ip(cad, ret, debug) == 1) { + ipw1 = (struct ipwlist*)malloc(sizeof(struct ipwlist)); + if (ipw1 == NULL) + FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno)); + inet_aton(ret, &ipw1->waddr); + LIST_INSERT_HEAD(head, ipw1, elem); + + } else { + FatalError("s2c_parse_load_wl() => Invalid data in whitelist file\n", strerror(errno)); + } + } + + while(s2c_parse_line(cad, wfile) == 1) { + if (s2c_parse_ip(cad, ret, debug) == 1) { + ipw2 = (struct ipwlist*)malloc(sizeof(struct ipwlist)); + if (ipw2 == NULL) + FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno)); + inet_aton(ret, &ipw2->waddr); + LIST_INSERT_AFTER(ipw1, ipw2, elem); + ipw1 = ipw2; + } else { + break; + } + + } + + lock.l_type = F_UNLCK; + fcntl(fileno(wfile), F_SETLKW, &lock); + + return (0); +} + +/* XXX: optimize */ + +int +s2c_parse_search_wl(char *ip, struct wlist_head wl) +{ + struct ipwlist *aux2; + char *ip_aux, ip1[IPMAX], ip2[IPMAX]; + int ret; + + strlcpy(ip1, ip, sizeof(ip1)); + + for(aux2=wl.lh_first; aux2 !=NULL; aux2=aux2->elem.le_next) { + ip_aux = inet_ntoa(aux2->waddr); + strlcpy(ip2, ip_aux, sizeof(ip2)); + ret = strcmp(ip1, ip2); + + if (ret == 0) + return 1; + } + return (0); +} + + +int s2c_parse_free_wl(struct wlist_head *wl) +{ + struct ipwlist *aux, *aux2; + for(aux = LIST_FIRST(wl); aux != LIST_END(wl); aux = aux2) { + aux2 = LIST_NEXT(aux, elem); + LIST_REMOVE(aux, elem); + free(aux); + } + if (LIST_EMPTY(wl)) { + return (1); + } else { + FatalError("s2c_parse_free_wl() => Unable to free whitelist\n", strerror(errno)); + return (0); + } +} + +/* XXX: too much complex ? */ + +int s2c_parse_ip(char *cad, char ret[WLMAX], int debug) +{ + int len; + unsigned int enc=1; + regex_t *expr; + regmatch_t *resultado; + expr = (regex_t*)malloc(sizeof(regex_t)); + + bzero(ret, WLMAX); + + if (expr == NULL) + FatalError("s2c_parse_ip() => malloc()\n", strerror(errno)); + + resultado = (regmatch_t*)malloc(sizeof(regmatch_t)); + + if (resultado == NULL) + FatalError("s2c_parse_ip() => malloc()\n", strerror(errno)); + + if (regcomp(expr, REG_ADDR, REG_EXTENDED) !=0) + FatalError("s2c_parse_ip() => regcomp()\n", strerror(errno)); + + if (regexec(expr, cad, 1, resultado, 0) !=0) + enc=0; + + if (enc !=0) { + len = resultado->rm_eo - resultado->rm_so; + memcpy(ret, cad + resultado->rm_so, len); + ret[len]='\0'; + } + + free(resultado); + regfree(expr); + + if(enc) + return (1); + else { + errno = EINVAL; + return (0); + } +} diff --git a/config/snort-dev/patches/spoink_patch/spo_pf.h b/config/snort-dev/patches/spoink_patch/spo_pf.h new file mode 100644 index 00000000..af07dacd --- /dev/null +++ b/config/snort-dev/patches/spoink_patch/spo_pf.h @@ -0,0 +1,60 @@ +/* +* +* Copyright (c) 2006 Antonio Benojar +* Copyright (c) 2005 Antonio Benojar +* +* All rights reserved. +* +* Redistribution and use in source and binary forms, with or without +* modification, are permitted provided that the following conditions +* are met: +* +* 1. Redistributions of source code must retain the above copyright +* notice, this list of conditions and the following disclaimer. +* +* 2. Redistributions in binary form must reproduce the above copyright +* notice, this list of conditions and the following disclaimer in the +* documentation and/or other materials provided with the distribution. +* +* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR +* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, +* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ + +#ifndef __SPO_PF_H__ +#define __SPO_PF_H__ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define WLMAX 1024 +#define IPMAX 20 +#define REG_ADDR "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}" + + +struct ipwlist { + struct in_addr waddr; + LIST_ENTRY(ipwlist) elem; +}; + +LIST_HEAD(wlist_head, ipwlist); + +void AlertPfSetup(void); + +#endif + + diff --git a/config/snort-dev/snort.xml b/config/snort-dev/snort.xml new file mode 100644 index 00000000..207fae8b --- /dev/null +++ b/config/snort-dev/snort.xml @@ -0,0 +1,272 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + Orion + 2.9.1 + Services:2.9.1 pkg v. 2.0 + /usr/local/pkg/snort/snort_install.inc + + Orion + Setup snort specific settings +
    Services
    + /snort/snort_interfaces.php +     + + snort + snort.sh + snort + Snort is the most widely deployed IDS/IPS technology worldwide. + + + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort.xml + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snortDB + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snortDBrules + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snortDBtemp + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_build.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_download_rules.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_gui.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_head.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_headbase.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_install.inc + + + /usr/local/pkg/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_new.inc + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_alerts.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_barnyard.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_blocked.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_define_servers.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_download_updates.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_help_info.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_edit.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_global.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_rules.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_rules_edit.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_suppress.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_suppress_edit.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_whitelist.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_interfaces_whitelist_edit.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_json_get.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_json_post.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_preprocessors.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_rules.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_rulesets.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_rules_ips.php + + + /usr/local/www/snort/ + 077 + http://www.pfsense.com/packages/config/snort-dev/snort_rulesets_ips.php + + + /usr/local/bin/ + 077 + http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/create-sidmap.pl + + + /usr/local/bin/ + 077 + http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/make_snortsam_map.pl + + + /usr/local/bin/ + 077 + http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/oinkmaster.pl + + + /usr/local/bin/ + 077 + http://www.pfsense.com/packages/config/snort/bin/oinkmaster_contrib/snort_rename.pl + + + + + + + sync_snort_package(); + + + snort_postinstall(); + + + snort_deinstall(); + +     diff --git a/config/snort-dev/snortDB b/config/snort-dev/snortDB new file mode 100644 index 00000000..c685a368 Binary files /dev/null and b/config/snort-dev/snortDB differ diff --git a/config/snort-dev/snortDBrules b/config/snort-dev/snortDBrules new file mode 100644 index 00000000..829a589b Binary files /dev/null and b/config/snort-dev/snortDBrules differ diff --git a/config/snort-dev/snortDBtemp b/config/snort-dev/snortDBtemp new file mode 100644 index 00000000..56ab2842 Binary files /dev/null and b/config/snort-dev/snortDBtemp differ diff --git a/config/snort-dev/snort_alerts.php b/config/snort-dev/snort_alerts.php new file mode 100644 index 00000000..3cb79c5c --- /dev/null +++ b/config/snort-dev/snort_alerts.php @@ -0,0 +1,189 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); + +$alertnumber = $generalSettings['alertnumber']; + +$arefresh_on = ($generalSettings['arefresh'] == 'on' ? 'checked' : ''); + + $pgtitle = "Services: Snort: Alerts"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + +
    + + + + + + + +
    Last 255 Alert EntriesLatest Alert Entries Are Listed First
    + + + + +
    + + + + + + +
    Save or Remove Logs +
    + + + Save All Log Files. +
    +     		+
    + + + Warning: all logs will be deleted. +
    +
    Auto Refresh and Log View +
    + + + > + Auto Refresh + Default ON. +
    		+ + Limit entries to view. Default 250. + + + + + + + +
    + + + +
    +
    + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_barnyard.php b/config/snort-dev/snort_barnyard.php new file mode 100644 index 00000000..1cd2113b --- /dev/null +++ b/config/snort-dev/snort_barnyard.php @@ -0,0 +1,289 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + + if (!is_array($a_list)) + { + $a_list = array(); + } + + + + $pgtitle = "Snort: Interface: Barnyard2 Edit"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    General Barnyard2 Settings
    Enable + > + Enable Barnyard2 on this Interface
    + This will enable barnyard2 for this interface. You will also have to set the database credentials.     +
    Interface + +
    + Choose which interface this rule applies to.
    + Hint: in most cases, you'll want to use WAN here.     +
    Mysql Settings
    Log to a Mysql Database + +
    + Example: output database: alert, mysql, dbname=snort user=snort host=localhost password=xyz
    + Example: output database: log, mysql, dbname=snort user=snort host=localhost password=xyz     +
    Advanced Settings
    Advanced configuration pass through + +
    + Arguments here will be automatically inserted into the running barnyard2 configuration. +
      + + +
      + Note: + Please save your settings befor you click start. +
    +
    +
    +
    + + + + + + + + diff --git a/config/snort-dev/snort_blocked.php b/config/snort-dev/snort_blocked.php new file mode 100644 index 00000000..fdc12480 --- /dev/null +++ b/config/snort-dev/snort_blocked.php @@ -0,0 +1,193 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + + +$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); + +$blertnumber = $generalSettings['blertnumber']; + +$brefresh_on = ($generalSettings['brefresh'] == 'on' ? 'checked' : ''); + + $pgtitle = "Services: Snort Blocked Hosts"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + +
    + + + + + + + +
    Last 500 Blocked.This page lists hosts that have been blocked by Snort.  Hosts are removed every hour.
    + + + + + +
    +
    + + + + + + + +
    Save or Remove Hosts +
    + + + Save All Blocked Hosts +
    +     		+
    + + + Warning: all hosts will be removed. +
    +
    Auto Refresh and Log View +
    + + + Auto Refresh + > + Default ON. +
    		+ + Limit entries to view. Default 500. + + + + + + + +
    + + +
    +
    + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_build.inc b/config/snort-dev/snort_build.inc new file mode 100644 index 00000000..2c18d3d3 --- /dev/null +++ b/config/snort-dev/snort_build.inc @@ -0,0 +1,1288 @@ + \ + cmd_validity STRU < char FRP > \ + cmd_validity ALLO < int [ char R int ] > \ + cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > \ + cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \ + cmd_validity PORT < host_port > + +preprocessor ftp_telnet_protocol: ftp client default \ + max_resp_len 256 \ + bounce yes \ + telnet_cmds yes + +EOD; + + $def_ftp_preprocessor_info_chk = $ifaceSettingsArray['ftp_preprocessor']; + if ($def_ftp_preprocessor_info_chk === 'on') { + $def_ftp_preprocessor_type = $snort_ftp_preprocessor; + }else{ + $def_ftp_preprocessor_type = ""; + } + + /* def smtp_preprocessor */ + $snort_smtp_preprocessor = << diff --git a/config/snort-dev/snort_define_servers.php b/config/snort-dev/snort_define_servers.php new file mode 100644 index 00000000..05e7709e --- /dev/null +++ b/config/snort-dev/snort_define_servers.php @@ -0,0 +1,450 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + + + $pgtitle = "Snort: Interface Define Servers:"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      + Note:
    + Please save your settings before you click start.
    + Please make sure there are no spaces in your definitions. +
    Define Servers
    Define DNS_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define DNS_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 53. +
    Define SMTP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define SMTP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25. +
    Define Mail_Ports + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25,143,465,691. +
    Define HTTP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define WWW_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define HTTP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 80. +
    Define SQL_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define ORACLE_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 1521. +
    Define MSSQL_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 1433. +
    Define TELNET_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define TELNET_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 23. +
    Define SNMP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define SNMP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 161.
    Define FTP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define FTP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 21. +
    Define SSH_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define SSH_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is Pfsense SSH port. +
    Define POP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define POP2_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 109. +
    Define POP3_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 110. +
    Define IMAP_SERVERS + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define IMAP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 143. +
    Define SIP_PROXY_IP + +
    + Example: "192.168.1.3/24,192.168.1.4/24". Leave blank to scan all networks. +
    Define SIP_PROXY_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 5060:5090,16384:32768. +
    Define AUTH_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 113. +
    Define FINGER_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 79. +
    Define IRC_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 6665,6666,6667,6668,6669,7000. +
    Define NNTP_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 119. +
    Define RLOGIN_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 513. +
    Define RSH_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 514. +
    Define SSL_PORTS + +
    + Example: Specific ports "25,443" or All ports betwen "5060:5090 . Default is 25,443,465,636,993,995. +
      + + +
      + Note: +
    + Please save your settings before you click start.     +
    +
    +
    +
    + + + + + + + + diff --git a/config/snort-dev/snort_download_rules.inc b/config/snort-dev/snort_download_rules.inc new file mode 100644 index 00000000..8953a65c --- /dev/null +++ b/config/snort-dev/snort_download_rules.inc @@ -0,0 +1,1036 @@ + 0; + "); + + }else{ + + $result = sqlite_query($db, + "SELECT * FROM {$table} where {$type} = '{$id_uuid}'; + "); + } + + if ($type == 'rdbuuid' || $type == 'All') { + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + }else{ + $chktable = sqlite_fetch_array($result, SQLITE_ASSOC); + } + + sqlite_close($db); + + return $chktable; + + +} // end func + +function snortSql_updateRuleSetList($type, $value, $file_size, $downloaded, $filename) +{ + + $dbname = 'snortDBtemp'; + $table = 'SnortDownloads'; + $addDate = date(U); + + // do let user pick the DB path + $db = sqlite_open("/var/snort/{$dbname}"); + + if ($type === 'percent2'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}', filesize = '{$file_size}', downloaded = '{$downloaded}' where filename = '{$filename}'; + "); + } + + + if ($type === 'percent'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET date = '{$addDate}', percent = '{$value}' where filename = '{$filename}'; + "); + } + + if ($type === 'msg1'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '1'; + "); + } + + if ($type === 'msg2'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE SnortDownloadsMsg SET date = '{$addDate}', msg = '{$value}' where id = '2'; + "); + } + + /* + * INPORTANT: + * Register worker to prevent loops and ghost process + * Needs to be watched, + */ + + if ($type === 'working'){ + + $getmypid = getmypid(); + $getmyfilename = $_SERVER['SCRIPT_NAME']; + + $resultChk = sqlite_query($db, + "SELECT * FROM RegisterWorker WHERE uuid = 'jdjEf!773&h3bhFd6A'; + "); + + $resultChkFinal = sqlite_fetch_all($resultChk, SQLITE_ASSOC); + + if (!empty($resultChkFinal)) { + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE RegisterWorker SET date = '{$addDate}', processid = '{$getmypid}', filename = '{$getmyfilename}', working = '{$value}' where uuid = 'jdjEf!773&h3bhFd6A'; + "); + }else{ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO RegisterWorker (date, processid, filename, working, uuid) VALUES ('{$addDate}', '{$getmypid}', '{$getmyfilename}', '{$value}', 'jdjEf!773&h3bhFd6A'); + "); + } + } + + + if ($type === 'snortWait'){ + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET waittime = '{$addDate}' where filename = '{$filename}'; + "); + } + + if (sqlite_changes($db) < 1){ + sqlite_close($db); + return 'Error in query'; + } + + sqlite_close($db); + + +} + +// reapply rule settings +function reapplyRuleSettings_run($sidRule_array) +{ + + $sid_array = snortSql_fetchAllSettings2('snortDBrules', 'SnortruleSigs', 'rdbuuid', $sidRule_array); + + if (!empty($sid_array)) { + foreach ($sid_array as $sid) + { + if (!empty($sid['enable']) && !empty($sid['signatureid']) && !empty($sid['rdbuuid']) && !empty($sid['signaturefilename'])) { + if ($sid['enable'] === 'on') { + exec('/usr/bin/sed -i \'\' \'s/^# \(.*sid:' . "{$sid['signatureid']}" . ';.*\)/\1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); + } + + if ($sid['enable'] === 'off') { + exec('/usr/bin/sed -i \'\' \'s/^\(alert.*sid:' . "{$sid['signatureid']}" . ';.*\)/# \1/\' /usr/local/etc/snort/snortDBrules/DB/' . "{$sid['rdbuuid']}" . '/rules/' . "{$sid['signaturefilename']}"); + } + } + } + } + + // NOTES: DO NOT REMOVE BELOW COMMENTS + // returns file pathe of the sid + // $testing = exec("grep -ri 'sid: \?1225; ' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules | tail -n1 | awk -F: '{print $1}'"); + // see if sid is enabled + // $testing2 = exec("sed -n '/^alert.*sid:1225;.*/p' /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules"); + // enable a sid + // sed -i '' "s/^# \(.*sid:1225;.*\)/\1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules + // disable a sid + // sed -i '' "s/^\(alert.*sid:1225;.*\)/# \1/" /usr/local/etc/snort/snortDBrules/DB/RAjFYOrC04D6/rules/snort_x11.rules + // grep "^alert.*sid:.*;" rules/emerging-worm.rules | grep -oh "\w*sid:[0-9][^*;]\w*" | awk -F: '{print $2}' + // sed -n '/^320 || .*/{p;q;}' rules/ ../etc/sid-msg.map | awk -F '|' '{print $3}' | sed -e 's/^[ \t]*//' + + +} + +function snortCmpareMD5($type, $path1, $path2, $filename_md5) +{ + update_output_window2('ms2', 'Checking ' . $filename_md5 . ' MD5...'); + + if (file_exists("{$path1}/{$filename_md5}")){ + + if ($type == 'string'){ + $md5_check_new = @file_get_contents("{$path1}/{$filename_md5}"); + $md5_check_old = @file_get_contents("{$path2}/{$filename_md5}"); + if ($md5_check_new !== $md5_check_old){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + if ($type == 'md5'){ + //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' + $md5_check_new2 = exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'"); + $md5_check_old2 = exec("/sbin/md5 {$path2}/{$filename_md5} | /usr/bin/awk '{print $4}'"); + if ($md5_check_new != $md5_check_old){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + if ($type == 'md5FileChk') { + //md5 snortrules-snapshot-2905.tar.gz | awk '{print $4}' + $md5_check_new = trim(exec("/sbin/md5 {$path1}/{$filename_md5} | /usr/bin/awk '{print $4}'")); + + $md5_check_old = exec("/bin/cat {$path1}/{$filename_md5}.md5"); + + $md5_check_old2 = trim(preg_replace('/"/', '', $md5_check_old)); + + if ($md5_check_new != $md5_check_old2){ + update_output_window2('ms2', "$filename_md5 MD5s do not match..."); + return false; + } + } + + + + } + + update_output_window2('ms2', "$filename_md5 MD5 File Check Passed..."); + return true; +} + + +/* + * update_output_window: update bottom textarea dynamically. + */ +function update_output_window2($type, $text) +{ + if ($type === 'ms1') { + $msg = 1; + } + + if ($type === 'ms2') { + $msg = 2; + } + + if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on'){ + echo + ' + + '; + ob_flush(); + apc_clear_cache(); + + }else{ + echo "\n" . $type . ': ' . $text; + } + +} + +// returns array that matches pattern, option to replace objects in matches +function snortScanDirFilter2($arrayList, $pattmatch, $pattreplace, $pattreplacewith) +{ + foreach ( $arrayList as $val ) + { + if (preg_match($pattmatch, $val, $matches)) { + if ($pattreplace != '') { + $matches2 = preg_replace($pattreplace, $pattreplacewith, $matches[0]); + $filterDirList[] = $matches2; + }else{ + $filterDirList[] = $matches[0]; + } + } + } + return $filterDirList; +} + +// set page vars +$generalSettings = snortSql_fetchAllSettings2('snortDB', 'SnortSettings', 'id', '1'); + +// Setup file names and dir +$tmpfname = '/usr/local/etc/snort/snort_download'; +$snortdir = '/usr/local/etc/snort'; +$snortdir_rules = '/usr/local/etc/snort/snortDBrules/snort_rules'; +$emergingdir_rules = '/usr/local/etc/snort/snortDBrules/emerging_rules'; +$pfsensedir_rules = '/usr/local/etc/snort/snortDBrules/pfsense_rules'; +$customdir_rules = '/usr/local/etc/snort/snortDBrules/custom_rules'; +$snort_filename_md5 = 'snortrules-snapshot-2905.tar.gz.md5'; +$snort_filename = 'snortrules-snapshot-2905.tar.gz'; +$emergingthreats_filename_md5 = 'emerging.rules.tar.gz.md5'; +$emergingthreats_filename = 'emerging.rules.tar.gz'; +$pfsense_rules_filename_md5 = 'pfsense_rules.tar.gz.md5'; +$pfsense_rules_filename = 'pfsense_rules.tar.gz'; + +// START of MAIN function +function sendUpdateSnortLogDownload($console) +{ + + if ($console === 'console'){ + $GLOBALS['tmp']['snort']['downloadupdate']['console'] = 'on'; + } + + if ($console !== 'console') { + + echo + ' + + '; + + } + + + //bring in the global vars + global $generalSettings, $tmpfname, $snortdir, $snortdir_rules, $emergingdir_rules, $pfsensedir_rules, $customdir_rules, $snort_filename_md5, $snort_filename, $emergingthreats_filename_md5, $emergingthreats_filename, $pfsense_rules_filename_md5, $pfsense_rules_filename; + + /* Make shure snortdir exits */ + if (!file_exists("{$snortdir}")) { + exec("/bin/mkdir -p {$snortdir}"); + } + if (!file_exists("{$tmpfname}")) { + exec("/bin/mkdir -p {$tmpfname}"); + } + if (!file_exists("{$snortdir_rules}")) { + exec("/bin/mkdir -p {$snortdir_rules}"); + } + if (!file_exists("{$emergingdir_rules}")) { + exec("/bin/mkdir -p {$emergingdir_rules}"); + } + if (!file_exists("{$pfsensedir_rules}")) { + exec("/bin/mkdir -p {$pfsensedir_rules}"); + } + if (!file_exists("{$customdir_rules}")) { + exec("/bin/mkdir -p {$customdir_rules}"); + } + if (!file_exists("{$snortdir}/signatures")) { + exec("/bin/mkdir -p {$snortdir}/signatures"); + } + if (!file_exists('/usr/local/lib/snort/dynamicrules/')) { + exec('/bin/mkdir -p /usr/local/lib/snort/dynamicrules/'); + } + + + /* Set user agent to Mozilla */ + ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); + ini_set("memory_limit","150M"); + + + // Get file that does not use redirects, mostly for none snort.org downloads + function snort_file_get_contents($tmpfname, $snort_filename, $snort_UrlGet) + { + if (!file_exists("{$tmpfname}/{$snort_filename}") || filesize("{$tmpfname}/{$snort_filename}") <= 0){ + update_output_window2('ms2', 'Downloading ' . $snort_filename. ' MD5...'); + ini_set('user_agent','Mozilla/4.0 (compatible; MSIE 6.0)'); + $file = file_get_contents("$snort_UrlGet/{$snort_filename}"); // use a @ infront of file_get_contents when in production + $f = fopen("{$tmpfname}/{$snort_filename}", 'w'); + fwrite($f, $file); + fclose($f); + update_output_window2('ms2', 'Finnished Downloading ' . $snort_filename. ' MD5...'); + } + } + + function read_header2($ch, $string) { + global $file_size, $fout; + $length = strlen($string); + $regs = ""; + ereg("(Content-Length:) (.*)", $string, $regs); + if($regs[2] <> "") { + $file_size = intval($regs[2]); + } + ob_flush(); + return $length; + } + + function read_body2($ch, $string) { + global $fout, $file_size, $downloaded, $sendto, $static_status, $static_output, $lastseen; + global $pkg_interface; + $length = strlen($string); + $downloaded += intval($length); + if($file_size > 0) { + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + } else + $downloadProgress = 0; + if($lastseen <> $downloadProgress and $downloadProgress < 101) { + if($sendto == "status") { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + $tostatus = $static_status . $downloadProgress . "%"; + update_status($tostatus); + } + } else { + if($pkg_interface == "console") { + if(substr($downloadProgress,2,1) == "0" || count($downloadProgress) < 2) { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } else { + $tooutput = $static_output . $downloadProgress . "%"; + update_output_window($tooutput); + } + } + update_progress_bar($downloadProgress); + $lastseen = $downloadProgress; + } + if($fout) + fwrite($fout, $string); + ob_flush(); + return $length; + } + + /* + * update_progress_bar($percent): updates the javascript driven progress bar. + */ + function update_progress_bar2($percent, $file_size, $downloaded) + { + if ($GLOBALS['tmp']['snort']['downloadupdate']['console'] != 'on') { + if (!empty($percent)) { + echo + ' + + '; + } + + }else{ + echo "\n" . 'percent: ' . $percent . ' filesize: ' . $file_size . ' downloaded: ' . $downloaded; + } + } + + + function read_body_firmware($ch, $string) + { + global $fout, $file_size, $downloaded, $counter; + $length = strlen($string); + $downloaded += intval($length); + $downloadProgress = round(100 * (1 - $downloaded / $file_size), 0); + $downloadProgress = 100 - $downloadProgress; + $counter++; + if($counter > 150) { + update_progress_bar2($downloadProgress, $file_size, $downloaded); + flush(); + $counter = 0; + } + fwrite($fout, $string); + return $length; + } + + function download_file_with_progress_bar2($url_file, $destination, $workingfile, $readbody = 'read_body2') + { + global $ch, $fout, $file_size, $downloaded; + $file_size = 1; + $downloaded = 1; + $destination_file = $destination . '/' . $workingfile; + + /* open destination file */ + $fout = fopen($destination_file, "wb"); + + /* + * Originally by Author: Keyvan Minoukadeh + * Modified by Scott Ullrich to return Content-Length size + */ + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url_file); + curl_setopt($ch, CURLOPT_HEADERFUNCTION, 'read_header2'); + curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($ch, CURLOPT_WRITEFUNCTION, $readbody); + curl_setopt($ch, CURLOPT_NOPROGRESS, '1'); + curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, '5'); + curl_setopt($ch, CURLOPT_TIMEOUT, 0); + + curl_exec($ch); + $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); + if($fout) + fclose($fout); + curl_close($ch); + return ($http_code == 200) ? true : $http_code; + } + +// ----------------------------------------------------- Begin Code -------------------------------------------- + + + // rm all tmp filea + @exec("/bin/rm -r $tmpfname/*"); + + // Set all downloads to be false, download by default + + $snort_md5_check_ok = false; + $emerg_md5_check_ok = false; + $pfsense_md5_check_ok = false; + + // define checks + $oinkid = $generalSettings['oinkmastercode']; + + $emergingthreatscode = $generalSettings['emergingthreatscode']; + + // dsable downloads if there settings are off + if ($generalSettings['snortdownload'] === 'off') { + $snort_md5_check_ok = true; + } + + if ($generalSettings['emergingthreatsdownload'] == 'off') { + $emerg_md5_check_ok = true; + } + + if ($oinkid == '' && $generalSettings['snortdownload'] === 'on') { + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an oinkid from snort.org and set its value in the Snort settings tab.'"); + return false; + } + + if ($emergingthreatscode === '' && $generalSettings['snortdownload'] === 'pro') { + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'You must obtain an emergingthreat pro id from emergingthreatspro.com and set its value in the Snort settings tab.'"); + return false; + } + + if ($generalSettings['snortdownload'] === 'off' && $generalSettings['emergingthreatsdownload'] === 'off') { // note: basic and pro + update_output_window2('ms1', 'Snort Error!'); + update_output_window2('ms2', 'SnortStartup: No rules have been selected to download.'); + exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'No rules have been selected to download.'"); + return false; + } + + /* + * Check MD5s and MARK + * + */ + + update_output_window2('ms1', 'Starting MD5 checks...'); + + // check is we need to wait + update_output_window2('ms2', 'Checking Wait Status for Snort.org...'); + $getSnort_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $snort_filename); + + if (date(U) > $getSnort_filename_Waittime_chk['waittime'] + 900) { + update_output_window2('ms2', 'Snort.org Wait Time Status: OK...'); + }else{ + update_output_window2('ms2', 'Snort.org Wait Time Status: Wait 15 min Please...'); + $snort_md5_check_ok = true; + $snort_wait = true; + } + + // check is we need to wait + update_output_window2('ms2', 'Checking Wait Status for Emergingthreats.net...'); + $getEmergingthreats_filename_Waittime_chk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', $emergingthreats_filename); + + if (date(U) > $getEmergingthreats_filename_Waittime_chk['waittime'] + 900) { + update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: OK...'); + }else{ + update_output_window2('ms2', 'Emergingthreats.net Wait Time Status: Wait 15 min Please...'); + $emerg_md5_check_ok = true; + $emerg_wait = true; + } + + // if all rules need wait stop + if ($snort_wait === true && $emerg_wait === true) { + return false; + } + + // download snort.org md5 and compare + if ($snort_md5_check_ok === false) { + + snort_file_get_contents($tmpfname, $snort_filename_md5, 'http://www.snort.org/pub-bin/oinkmaster.cgi/' . $oinkid); + snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename_md5); // finsh percent + + // if snort.org md5 do not match + if(snortCmpareMD5('string', $tmpfname, $snortdir_rules, $snort_filename_md5)) { + $snort_md5_check_ok = true; + } + + } + + // download emergingthreats.net md5 and compare + if ($emerg_md5_check_ok === false) { + + snort_file_get_contents($tmpfname, $emergingthreats_filename_md5, 'http://rules.emergingthreats.net/open/snort-2.9.0'); + snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename_md5); // finsh percent + + // if emergingthreats.net md5 do not match + if(snortCmpareMD5('string', $tmpfname, $emergingdir_rules, $emergingthreats_filename_md5)) { + $emerg_md5_check_ok = true; + } + + } + + // download pfsense.org md5 and compare + snort_file_get_contents($tmpfname, $pfsense_rules_filename_md5, 'http://www.pfsense.com/packages/config/snort/pfsense_rules'); + snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename_md5); // finsh percent + + // if pfsense.org md5 do not match + if(snortCmpareMD5('string', $tmpfname, $pfsensedir_rules, $pfsense_rules_filename_md5)) { + $pfsense_md5_check_ok = true; + } + + /* + * If all rule type is not check clean up. + */ + + /* Make Clean Snort Directory emergingthreats not checked */ + if ($snort_md5_check_ok === false && $emergingthreatsdownload === 'off') { + update_output_window2('ms1', 'Cleaning the emergingthreats Directory...'); + exec("/bin/rm {$snortdir}/emerging_rules/*.rules"); + exec("/bin/rm {$snortdir}/version.txt"); + update_output_window2('ms2', 'Done cleaning emrg direcory.'); + } + + /* Make Clean Snort Directory snort.org not checked */ + if ($emerg_md5_check_ok === false && $snortdownload !== 'on') { + update_output_window2('ms1', 'Cleaning the snort Directory...'); + exec("/bin/rm {$snortdir}/snort_rules/*.rules"); + exec("/bin/rm {$snortdir}/snortrules-snapshot-2905.tar.gz.md5"); + update_output_window2('ms2', 'Done cleaning snort direcory.'); + } + + + /* Check if were up to date exits */ + if ($snort_md5_check_ok === true && $emerg_md5_check_ok === true && $pfsense_md5_check_ok === true) { + update_output_window2('ms1', 'Your rules are up to date...'); + return false; + } + + + /* You are Not Up to date, always stop snort when updating rules for low end machines */; + update_output_window2('ms1', 'You are NOT up to date...'); + update_output_window2('ms2', 'Stopping Snort and Barnyard2 service...'); + $chk_if_snort_up = exec('pgrep -x snort'); + $chk_if_barnyad_up = exec('pgrep -x barnyad2'); + if ($chk_if_snort_up != '') { + exec('/usr/bin/touch /tmp/snort_download_halt.pid'); // IMPORTANT: incase of script crash or error, Mabe use DB + exec('/usr/bin/killall snort'); + if ($chk_if_barnyad_up != ''){ + exec('/usr/bin/killall barnyad2'); + } + sleep(2); + } + + + /* download snortrules file */ + if ($snort_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $snort_filename; + update_output_window2('ms1', 'Snort.org: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://www.snort.org/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); + //download_file_with_progress_bar2("http://theseusnetworking.com/pub-bin/oinkmaster.cgi/{$oinkid}/{$snort_filename}", $tmpfname, $snort_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $snort_filename); // finsh percent, add date time finnished + update_output_window2('ms2', 'Snort.org: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'Snort.org MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $snort_filename)) { + + $snort_filename_wait_ck = exec("/usr/bin/egrep '\bYou must wait 15\b' {$tmpfname}/{$snort_filename}"); + if ($snort_filename_wait_ck != '') { + update_output_window2('ms2', 'Snort.org: You must wait 15 min...'); + } + + // disable snort.org download + $snort_md5_check_ok = true; + $snort_filename_corrupted = true; + + } + } + + /* download emergingthreats file */ + if ($emerg_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $emergingthreats_filename; + update_output_window2('ms1', 'Emergingthreats.net: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://rules.emergingthreats.net/open/snort-2.9.0/{$emergingthreats_filename}", $tmpfname, $emergingthreats_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $emergingthreats_filename); // finsh percent + update_output_window2('ms2', 'Emergingthreats.net: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'Emergingthreats MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $emergingthreats_filename)) { + + // disable snort.org download + $emerg_md5_check_ok = true; + $emerg_filename_corrupted = true; + + } + } + + /* download pfsense rule file */ + if ($pfsense_md5_check_ok === false) { + + $GLOBALS['tmp']['snort']['downloadupdate']['workingfile'] = $pfsense_rules_filename; + update_output_window2('ms1', 'pfSense.org: Starting Download...'); + update_output_window2('ms2', 'May take a while...'); + download_file_with_progress_bar2("http://www.pfsense.com/packages/config/snort/pfsense_rules/{$pfsense_rules_filename}", $tmpfname, $pfsense_rules_filename, "read_body_firmware"); + update_progress_bar2(100, '', ''); // finsh percent + snortSql_updateRuleSetList('percent', '100', '', '', $pfsense_rules_filename); // finsh percent + update_output_window2('ms2', 'pfSense.org: Finished Download...'); + + // if md5 does not match then the file is bad or snort.org says wait 15 min + update_output_window2('ms1', 'pfSense.org MD5 File Check ...'); + if (!snortCmpareMD5('md5FileChk', $tmpfname, '', $pfsense_rules_filename)) { + + // disable snort.org download + $pfsense_md5_check_ok = true; + + } + } + + // if both files are corrupted stop + if ($snort_filename_corrupted === true && $emerg_filename_corrupted === true) { + update_output_window2('ms1', 'Snort.org and Emergingthreats.net files are corrupted.'); + update_output_window2('ms2', 'Stoping Script...'); + return false; + } + + /* + * START: Untar Files + */ + + // Untar snort rules file individually to help people with low system specs + if ($snort_md5_check_ok === false && file_exists("{$tmpfname}/{$snort_filename}")) { + + update_output_window2('ms1', 'Extracting Snort.org rules...'); + update_output_window2('ms2', 'May take a while...'); + + function build_SnortRuleDir() + { + global $tmpfname, $snortdir, $snortdir_rules, $snort_filename; + + // find out if were in 1.2.3-RELEASE + $pfsense_ver_chk = exec('/bin/cat /etc/version'); + if ($pfsense_ver_chk === '1.2.3-RELEASE') { + $pfsense_stable = 'yes'; + }else{ + $pfsense_stable = 'no'; + } + + // get the system arch + $snort_arch_ck = exec('/usr/bin/uname -m'); + if ($snort_arch_ck === 'i386') { + $snort_arch = 'i386'; + }else{ + $snort_arch = 'x86-64'; // amd64 + } + + if ($pfsense_stable === 'yes') { + $freebsd_version_so = 'FreeBSD-7-3'; + }else{ + $freebsd_version_so = 'FreeBSD-8-1'; + } + + // extract snort.org rules and add prefix to all snort.org files + @exec("/bin/rm -r {$snortdir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} rules/"); + + $snort_dirList = scandir("{$snortdir_rules}/rules"); // Waning: only in php 5 + $snortrules_filterList = snortscandirfilter2($snort_dirList, '/.*\.rules/', '/\.rules/', ''); + + if (!empty($snortrules_filterList)) { + foreach ($snortrules_filterList as $snort_rule_move) + { + exec("/bin/mv -f {$snortdir_rules}/rules/{$snort_rule_move}.rules {$snortdir_rules}/rules/snort_{$snort_rule_move}.rules"); + } + } + + // extract so rules + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/"); + exec("/bin/mv -f {$snortdir_rules}/so_rules/precompiled/$freebsd_version_so/$snort_arch/2.9.0.5/* /usr/local/lib/snort/dynamicrules/"); + + // list so_rules and exclude dir + exec("/usr/bin/tar --exclude='precompiled' --exclude='src' -tf {$tmpfname}/{$snort_filename} so_rules", $so_rules_list); + + $so_rulesPattr = array('/\//', '/\.rules/'); + $so_rulesPattw = array('', ''); + + // build list of so rules + $so_rules_filterList = snortscandirfilter2($so_rules_list, '/\/.*\.rules/', $so_rulesPattr, $so_rulesPattw); + + if (!empty($so_rules_filterList)) { + // cp rule to so tmp dir + foreach ($so_rules_filterList as $so_rule) + { + + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir_rules} so_rules/{$so_rule}.rules"); + + } + // mv and rename so rules + foreach ($so_rules_filterList as $so_rule_move) + { + exec("/bin/mv -f {$snortdir_rules}/so_rules/{$so_rule_move}.rules {$snortdir_rules}/rules/snort_{$so_rule_move}.so.rules"); + } + } + + exec("/bin/rm -r {$snortdir_rules}/so_rules"); + + // extract base etc files + exec("/usr/bin/tar xzf {$tmpfname}/{$snort_filename} -C {$snortdir} etc/"); + + } + build_SnortRuleDir(); + // cp md5 to main snort dir + exec("/bin/cp {$tmpfname}/{$snort_filename_md5} {$snortdir_rules}/{$snort_filename_md5}"); + update_output_window2('ms2', 'Done extracting Snort.org Rules.'); + } + + /* Untar emergingthreats rules to tmp */ + if ($emerg_md5_check_ok === false && file_exists("{$tmpfname}/{$emergingthreats_filename}")) { + if (file_exists("{$tmpfname}/{$emergingthreats_filename}")) { + update_output_window2('ms1', 'Extracting Emergingthreats Rules...'); + update_output_window2('ms2', 'May take a while...'); + @exec("/bin/rm -r {$emergingdir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$emergingthreats_filename} -C {$emergingdir_rules} rules/"); + exec("/bin/cp {$tmpfname}/{$emergingthreats_filename_md5} {$emergingdir_rules}/{$emergingthreats_filename_md5}"); + update_output_window2('ms2', 'Done extracting Emergingthreats.net Rules.'); + } + } + + /* Untar Pfsense rules to tmp */ + if ($pfsense_md5_check_ok === false && file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { + if (file_exists("{$tmpfname}/{$pfsense_rules_filename}")) { + update_output_window2('ms1', 'Extracting Pfsense rules...'); + update_output_window2('ms1', 'May take a while...'); + @exec("/bin/rm -r {$pfsensedir_rules}/rules"); + exec("/usr/bin/tar xzf {$tmpfname}/{$pfsense_rules_filename} -C {$pfsensedir_rules} rules/"); + exec("/bin/cp {$tmpfname}/{$pfsense_rules_filename_md5} {$pfsensedir_rules}/{$pfsense_rules_filename_md5}"); + update_output_window2('ms2', 'Done extracting pfSense.org Rules.'); + + } + } + + /* double make shure cleanup emerg rules that dont belong */ + if (file_exists("/usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so")) { + exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so"); + exec("/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example\*"); + } + + // make sure default rules are in the right format + update_output_window2('ms1', 'Reformatting Rules To One Standard...'); + update_output_window2('ms2', 'Please Wait...'); + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$snortdir_rules}/rules/*.rules"); // remove white spaces from begining of line + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$snortdir_rules}/rules/*.rules"); + + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$emergingdir_rules}/rules/*.rules"); + + exec("/usr/bin/sed -i '' 's/^[ \t]*//' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^#alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^##alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + exec("/usr/bin/sed -i '' 's/^## alert*/\# alert/' {$pfsensedir_rules}/rules/*.rules"); + update_output_window2('ms2', 'Done...'); + + /* create a msg-map for snort */ + update_output_window2('ms1', 'Updating Alert Sid Messages...'); + update_output_window2('ms2', 'Please Wait...'); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$snortdir_rules}/rules > /usr/local/etc/snort/etc/sid-msg.map"); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$emergingdir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); + exec("/usr/local/bin/perl /usr/local/bin/create-sidmap.pl {$pfsensedir_rules}/rules >> /usr/local/etc/snort/etc/sid-msg.map"); + update_output_window2('ms2', 'Done...'); + + // create default dir + if (!file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/default/rules'); + } + + // cp new rules to default dir + exec('/bin/rm /usr/local/etc/snort/snortDBrules/DB/default/rules/*.rules'); + exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/default/rules"); + + + // reapplay rules from DB cp base rules to dirs + $sidOnOff_array = snortSql_fetchAllSettings2('snortDBrules', 'Snortrules', 'All', ''); + + if (!empty($sidOnOff_array)) { + update_output_window2('ms1', 'Reapplying User Settings...'); + update_output_window2('ms2', 'Please Wait...'); + foreach ($sidOnOff_array as $preSid_Array) + { + if (!file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules")) { + exec("/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + } + + exec("/bin/rm /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules/*.rules"); + exec("/bin/cp {$snortdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + exec("/bin/cp {$emergingdir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + exec("/bin/cp {$pfsensedir_rules}/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$preSid_Array['uuid']}/rules"); + reapplyRuleSettings_run($preSid_Array['uuid']); + update_output_window2('ms2', 'Done...'); + } + } + + // cp snort conf's to Ifaces + $ifaceConfMaps_array = snortSql_fetchAllSettings2('snortDB', 'SnortIfaces', 'All', ''); + + if (!empty($ifaceConfMaps_array)) { + update_output_window2('ms1', 'Reapplying User Settings...'); + update_output_window2('ms2', 'Please Wait...'); + foreach ($ifaceConfMaps_array as $preIfaceConfMaps_array) + { + // create iface dir if missing + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}")) { + exec("/bin/mkdir -p /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + } + + // create rules dir soft link if setting is default + if ($preIfaceConfMaps_array['ruledbname'] === 'default' || $preIfaceConfMaps_array['ruledbname'] === '') { + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/default/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); + } + } + + // create rules dir soft link if setting is not default + if ($preIfaceConfMaps_array['ruledbname'] !== 'default' || $preIfaceConfMaps_array['ruledbname'] != '') { + if (!file_exists("/usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules") && file_exists("/usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules")) { + exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/{$preIfaceConfMaps_array['ruledbname']}/rules /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}/rules"); + } + } + + exec("/bin/cp {$snortdir}/etc/*.config /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/*.conf /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/*.map /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/generators /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + exec("/bin/cp {$snortdir}/etc/sid /usr/local/etc/snort/sn_{$preIfaceConfMaps_array['uuid']}"); + + reapplyRuleSettings_run($preSid_Array['uuid']); + update_output_window2('ms2', 'Done...'); + } + } + + + // remove old $tmpfname files */ + update_output_window2('ms1', 'Removing old files...'); + update_output_window2('ms2', 'Working...'); + if (file_exists('/usr/local/etc/snort/tmp')) { + exec("/bin/rm -r /usr/local/etc/snort/tmp/snort_rules_up"); + exec("/bin/rm -r /usr/local/etc/snort/tmp/rules_bk"); + apc_clear_cache(); + } + update_output_window2('ms2', 'Done...'); + + // php code to flush out cache some people are reportting missing files this might help + apc_clear_cache(); + exec("/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync ;/bin/sync"); + + // make all dirs snorts + exec("/usr/sbin/chown -R snort:snort /var/log/snort"); + exec("/usr/sbin/chown -R snort:snort /usr/local/etc/snort"); + exec("/usr/sbin/chown -R snort:snort /usr/local/lib/snort"); + exec("/bin/chmod -R 755 /var/log/snort"); + exec("/bin/chmod -R 755 /usr/local/etc/snort"); + exec("/bin/chmod -R 755 /usr/local/lib/snort"); + + + update_output_window2('ms1', 'Finnished Updateing...'); + update_output_window2('ms2', 'Finnished Updateing...'); + + + // if snort is running hard restart, if snort is not running do nothing + + // TODO: Restart Ifaces + +// ----------------------------------------------------- End Code -------------------------------------------- + +} // -------------------- END Main function ------------ + +//$argv[1] = 'console'; + + //$getWorkerStat = snortSql_fetchAllSettings2('snortDBtemp', 'RegisterWorker', 'uuid', 'jdjEf!773&h3bhFd6A'); + + //if ($getWorkerStat['working'] !== 'on') { + //snortSql_updateRuleSetList2('working', 'on', '', '', ''); // Register Worker on + //sendUpdateSnortLogDownload($argv[1]); // start main function + //snortSql_updateRuleSetList2('working', 'off', '', '', ''); // Register Worker off + //} + + + + + +?> \ No newline at end of file diff --git a/config/snort-dev/snort_download_updates.php b/config/snort-dev/snort_download_updates.php new file mode 100644 index 00000000..445671bd --- /dev/null +++ b/config/snort-dev/snort_download_updates.php @@ -0,0 +1,365 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +// disable csrf for downloads, progressbar did not work because of this +$nocsrf = true; + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); +require_once("/usr/local/pkg/snort/snort_download_rules.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars +if (isset($_GET['updatenow'])) { + $updatenow = $_GET['updatenow']; +} + +header("Cache-Control: no-cache, must-revalidate"); +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); + +// get dates of md5s + +$tmpSettingsSnort = 'N/A'; +$tmpSettingsSnortChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'snortrules-snapshot-2905.tar.gz'); +if (!empty($tmpSettingsSnortChk)) { + $tmpSettingsSnort = date('l jS \of F Y h:i:s A', $tmpSettingsSnortChk[date]); +} + +$tmpSettingsEmerging = 'N/A'; +$tmpSettingsEmergingChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'emerging.rules.tar.gz'); +if (!empty($tmpSettingsEmergingChk)) { + $tmpSettingsEmerging = date('l jS \of F Y h:i:s A', $tmpSettingsEmergingChk[date]); +} + +$tmpSettingsPfsense = 'N/A'; +$tmpSettingsPfsenseChk = snortSql_fetchAllSettings2('snortDBtemp', 'SnortDownloads', 'filename', 'pfsense_rules.tar.gz'); +if (!empty($tmpSettingsPfsenseChk)) { + $tmpSettingsPfsense = date('l jS \of F Y h:i:s A', $tmpSettingsPfsenseChk[date]); +} + +// get rule on stats +$generalSettings = snortSql_fetchAllSettings2('snortDB', 'SnortSettings', 'id', '1'); + +$snortMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/snort_rules/snortrules-snapshot-2905.tar.gz.md5'); + +$snortDownlodChkMark = ''; +if ($generalSettings[snortdownload] === 'on') { + $snortDownlodChkMark = 'checked="checked"'; +} + +$snortMd5Current = 'N/A'; +if (!empty($snortMd5CurrentChk)) { + preg_match('/^\".*\"/', $snortMd5CurrentChk, $snortMd5Current); + if (!empty($snortMd5Current[0])) { + $snortMd5Current = preg_replace('/\"/', '', $snortMd5Current[0]); + } +} + +$emergingMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/emerging_rules/emerging.rules.tar.gz.md5'); + +$emerginDownlodChkMark = ''; +if ($generalSettings[emergingthreatsdownload] !== 'off') { + $emerginDownlodChkMark = 'checked="checked"'; +} + +$emergingMd5Current = 'N/A'; +if (!empty($emergingMd5CurrentChk)) { + $emergingMd5Current = $emergingMd5CurrentChk; +} + +$pfsenseMd5CurrentChk = @file_get_contents('/usr/local/etc/snort/snortDBrules/pfsense_rules/pfsense_rules.tar.gz.md5'); + +$pfsenseMd5Current = 'N/A'; +if (!empty($pfsenseMd5CurrentChk)) { + preg_match('/^\".*\"/', $pfsenseMd5CurrentChk, $pfsenseMd5Current); + if (!empty($pfsenseMd5Current[0])) { + $pfsenseMd5Current = preg_replace('/\"/', '', $pfsenseMd5Current[0]); + } +} + + $pgtitle = 'Services: Snort: Updates'; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + +
    + +
    +
    +
    + +
    +
    +

    +

    +
    + + +
    +
    +

    +

    +
    + +
    + + + + +
    +
    + + + + + + + + + + + +
    + +
    + +
    + +
    + +
    + +
    + +
    +
    + + + + + + + + + +
    + Rule databases that are ready to be updated. + +
    +
    + + + + + + +
    SIGNATURE RULESET DATABASES:
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + +
    OnSignature DB NameMD5 VersionLast Rule DB Date 
    + type="checkbox" disabled="disabled" > +SNORT.ORG + +
    + type="checkbox" disabled="disabled" > +EMERGINGTHREATS.NET + +
    + +PFSENSE.ORG + +
    +
    + + + + +
    + +
    +
    + + + + +
    +
    +
    + + + +
    + +
    +
    + + + + + +
    + + + Note: +   Snort.org and Emergingthreats.net will go down from time to time. Please be patient. +
    +
    +
    + + + + + + jQuery(\'.snortModalTopClose\').append(\'\'); + + '; +} + +?> + + + + + + + + + + diff --git a/config/snort-dev/snort_gui.inc b/config/snort-dev/snort_gui.inc new file mode 100644 index 00000000..d0a778ae --- /dev/null +++ b/config/snort-dev/snort_gui.inc @@ -0,0 +1,83 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +//include_once("/usr/local/pkg/snort/snort.inc"); + +function print_info_box_np2($msg) { + global $config, $g; + + echo "\n"; + echo " \n"; + echo " \n"; + echo "
    \n"; + echo "
    \n"; + echo " \n"; + echo " "; + if(stristr($msg, "apply") == true) { + echo " "; + } + echo "
    \n"; + echo "    \n"; + echo " {$msg}\n"; + echo " "; + echo " \n"; + echo "
    \n"; + echo "
    \n"; + echo "
    \n"; + echo "\n"; + echo "\n
    \n"; + + +} + +if ($config['version'] >= 6) { + $helplink = '
  • Help'; +}else{ + $helplink = '
  • Help
    • '; +} + +?> diff --git a/config/snort-dev/snort_head.inc b/config/snort-dev/snort_head.inc new file mode 100644 index 00000000..2d5aadaa --- /dev/null +++ b/config/snort-dev/snort_head.inc @@ -0,0 +1,148 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +/* + pfSense_MODULE: header +*/ + +/* + * if user has selected a custom template, use it. + * otherwise default to pfsense tempalte + */ +if (($g["disablethemeselection"] === true) && !empty($g["default_theme"]) && (is_dir($g["www_path"].'/themes/'.$g["default_theme"]))) + $g['theme'] = $g["default_theme"]; +elseif($config['theme'] <> "" && (is_dir($g["www_path"].'/themes/'.$config['theme']))) + $g['theme'] = $config['theme']; +else + $g['theme'] = "pfsense"; + +/* + * If this device is an apple ipod/iphone + * switch the theme to one that works with it. + */ +$lowres_ua = array("iPhone","iPod", "iPad", "Android"); +foreach($lowres_ua as $useragent) + if(strstr($_SERVER['HTTP_USER_AGENT'], $useragent)) + $g['theme'] = empty($g['theme_lowres']) ? "pfsense" : $g['theme_lowres']; + +$pagetitle = gentitle( $pgtitle ); + +?> + + + + <?php echo($config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pagetitle); ?> + + + + + "; ?> + + + + + + + + + \n"; ?> + + + echo "\n"; + include('/usr/local/pkg/snort/snort_headbase.inc'); + echo "\n"; + // +?> + +\n"; + echo "\t\n"; + } + echo "\t\n"; + echo "\t\n"; + echo "\t\n"; + echo "\t\n"; + if(file_exists("{$g['www_path']}/javascript/global.js")) + echo "\t\n"; + /* + * Find all javascript files that need to be included + * for this page ... from the arrays ... :) + * Coded by: Erik Kristensen + */ + + $dir = trim(basename($_SERVER["SCRIPT_FILENAME"], '.php')); + $path = "{$g['www_path']}/javascript/" . $dir . "/"; + if (is_dir($path)) { + if ($dh = opendir($path)) { + while (($file = readdir($dh)) !== false) { + if (is_dir($file)) + continue; + echo "\t\n"; + } + closedir($dh); + } + } + + +if (!isset($closehead)) + echo ""; + +/* If this page is being remotely managed then do not allow the loading of the contents. */ +if($config['remote_managed_pages']['item']) { + foreach($config['remote_managed_pages']['item'] as $rmp) { + if($rmp == $_SERVER['SCRIPT_NAME']) { + include("fbegin.inc"); + print_info_box_np("This page is currently being managed by a remote machine."); + include("fend.inc"); + exit; + } + } +} + +?> diff --git a/config/snort-dev/snort_headbase.inc b/config/snort-dev/snort_headbase.inc new file mode 100644 index 00000000..33bbd0ee --- /dev/null +++ b/config/snort-dev/snort_headbase.inc @@ -0,0 +1,73 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ +?> + + + + + + + + + + + + + + + /* makes boxes round */ + /* load at bottom */ + NiftyCheck(); + Rounded("div#mainarea2","bl br tr","#FFF","#dddddd","smooth"); + Rounded("div#mainarea3","bl br tr","#FFF","#dddddd","smooth"); + Rounded("td#tdbggrey","bl br tr","#FFF","#dddddd","smooth"); + Rounded("td#tdbggrey2","bl br tr","#FFF","#dddddd","smooth"); + Rounded("div#mainarea4","all","#FFF","#dddddd","smooth"); + Rounded("div#mainarea6","all","#FFF","#dddddd","smooth"); + Rounded("div#mainarea5","all","#eeeeee","#dddddd","smooth"); + +'; +?> \ No newline at end of file diff --git a/config/snort-dev/snort_help_info.php b/config/snort-dev/snort_help_info.php new file mode 100644 index 00000000..616133ae --- /dev/null +++ b/config/snort-dev/snort_help_info.php @@ -0,0 +1,353 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + + $pgtitle = 'Snort: Help and Info'; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + + + + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + +
    + +
    +
    +

    Snort Package

    + +

    + Snort Package is a GUI based front-end for Sourcefire's Snort ® IDS/IPS software. The Snort Package goal is to be + the best open-source GUI to manage multiple snort sensors and multiple rule snapshots. The project other goal is to be a highly competitive GUI for + network monitoring for both private and enterprise use. Lastly, this project software development should bring programmers and users together to create + software. +

    +

    + + What is Snort ? Used by fortune 500 companies and goverments Snort is the most widely deployed IDS/IPS technology worldwide. It features rules based logging and + can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port + scans, CGI attacks, SMB probes, and much more. +

    +

    + Requirements :
    + Minimum requirement 256 mb ram, 500 MHz CPU.
    + Recommended 500 mb ram, 1 Ghz CPU.
    + The more rules you run the more memory you need.
    + + The more interfaces you select the more memory you need.

    + Development is done on a Alix 2D3 system (500 MHz AMD Geode LX800 CPU 256MB DDR DRAM). +

    + +
    + +
    +

    Snort Package

    + +

    Change Log

    + +

    Changes to this package can be viewed by following pfSense packages repository

    + +
    + +
    +

    Snort Package

    + +

    Getting Help

    + +

    +Obtaining Support
    + +We provide several means of obtaining support for pfSense. +

    + +

    +Free Options
    +Our free options include our forum, mailing list , and IRC channel. Before using any of these resources, please review the Project Rules below. +

    + +

    +Commercial Support
    + +Commercial support is available from the company founded by the founders of the pfSense project, BSD Perimeter. Phone and email support is available for support subscribers only. +

    + +

    +Project Rules
    +To keep things orderly, and be fair to everyone, we must enforce these rules. +

    + +

    +Please do not post support questions to the blog comments. The comments are for discussion of the post, and letting people ask questions there would make a mess of the purpose of those comments. Any support questions will not be moderator approved. +

    + +

    +Please do not cross post questions between the forum and mailing list, unless your inquiry has gone unanswered for at least 24 hours. Do not bump your mailing list or forum posts for at least 24 hours. If you have not received a reply after more than 24 hours, you are welcome to bump your thread. +

    + +

    +Please do not email individuals, the coreteam address, or private message people on the forum to ask questions. We provide a wide variety of means for obtaining help in a public forum, where it helps others who have the same questions in the future. We don't have enough time to answer all the questions our users post in the public forums, much less via email and private messages. Since we cannot possibly reply to everyone's email and private messages, to be fair we will not reply to anyone. Individual attention via phone and email support is available for commercial support customers. +

    +
    + +
    +

    Snort Package

    + + +

    Heros

    + +

    Pfsense Snort Package users who have cared enough to donate to this project. I can't thank you enough for all your help. With-out your support I would have stoped long time ago.

    + +

    If your not on this list PM me and I will add you. If you would like to be removed pm me and I will remove you.

    + +

    Names

    + +

    sandro tavella

    +

    João Kemp Filho

    + +

    Julio Fumoso

    +

    Rolland Hart

    +

    DiMarco Technology Solutions Inc.

    +

    Brett Burley

    +

    Tomasz Iskra

    +

    Bruno Buchschacher

    + +

    Marco Pannetto

    +

    Christopher Weakland

    +

    Antonio Riveros

    +

    DigitalJer

    +

    Serialdie

    +

    Dlawley

    + +

    Onhel

    +

    Jerrygoldsmith

    + + +
    +
    +
    + + +
    +
    +
    + +
    + + + + + + + + diff --git a/config/snort-dev/snort_install.inc b/config/snort-dev/snort_install.inc new file mode 100644 index 00000000..b227b347 --- /dev/null +++ b/config/snort-dev/snort_install.inc @@ -0,0 +1,429 @@ + advanced features */ + //$bpfbufsize = $config['installedpackages']['snortglobal']['bpfbufsize']; + //$bpfmaxbufsize = $config['installedpackages']['snortglobal']['bpfmaxbufsize']; + //$bpfmaxinsns = $config['installedpackages']['snortglobal']['bpfmaxinsns']; + + // create a few directories and ensure the sample files are in place + if(!file_exists('/usr/local/etc/snort')) { + exec('/bin/mkdir -p /usr/local/etc/snort'); + } + + if(!file_exists('/usr/local/etc/snort/whitelist')) { + exec('/bin/mkdir -p /usr/local/etc/snort/whitelist/'); + } + + if(!file_exists('/var/log/snort/run')) { + exec('/bin/mkdir -p /var/log/snort/run'); + } + + if(!file_exists('/var/log/snort/barnyard2')) { + exec('/bin/mkdir -p /var/log/snort/barnyard2/'); + } + + if(!file_exists('/usr/local/lib/snort/dynamicrules/')) { + exec('/bin/mkdir -p /usr/local/lib/snort/dynamicrules/'); + } + + // for snort2c, remove when snortsam is working + if(!file_exists('/var/db/whitelist')) { + touch('/var/db/whitelist'); + } + + if (!file_exists('/usr/local/etc/snort/etc')) { + exec('/bin/mkdir -p /usr/local/etc/snort/etc'); + } + + if (!file_exists('/usr/local/etc/snort/signatures')) { + exec('/bin/mkdir -p /usr/local/etc/snort/signatures'); + } + + if (!file_exists('/usr/local/etc/snort/snort_download')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snort_download'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/DB')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/custom_rules/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/custom_rules/rules'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/emerging_rules/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/emerging_rules/rules'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/pfsense_rules/rules'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/snort_rules/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/snort_rules/rules'); + } + + if (!file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec('/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/default/rules'); + exec('/usr/bin/touch /usr/local/etc/snort/snortDBrules/DB/default/rules/local.rules'); + } + + // create and cp to tmp db dir + if (!file_exists('/var/snort/')) { + exec('/bin/mkdir -p /var/snort/'); + } + + if (file_exists('/usr/local/pkg/snort/snortDBtemp')) { + exec('/bin/cp /usr/local/pkg/snort/snortDBtemp /var/snort/snortDBtemp'); + } + + // cleanup default files + if(file_exists('/usr/local/etc/snort/snort.conf-sample')) { + exec('/bin/rm /usr/local/etc/snort/classification.config-sample'); + exec('/bin/mv /usr/local/etc/snort/classification.config /usr/local/etc/snort/etc/classification.config'); + exec('/bin/rm /usr/local/etc/snort/gen-msg.map-sample'); + exec('/bin/mv /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/etc/gen-msg.map'); + exec('/bin/rm /usr/local/etc/snort/reference.config-sample'); + exec('/bin/mv /usr/local/etc/snort/reference.config /usr/local/etc/snort/etc/reference.config'); + exec('/bin/rm /usr/local/etc/snort/sid-msg.map-sample'); + exec('/bin/mv /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/etc/sid-msg.map'); + exec('/bin/rm /usr/local/etc/snort/snort.conf-sample'); + exec('/bin/mv /usr/local/etc/snort/snort.conf /usr/local/etc/snort/etc/snort.conf'); + exec('/bin/rm /usr/local/etc/snort/threshold.conf-sample'); + exec('/bin/mv /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/etc/threshold.conf'); + exec('/bin/rm /usr/local/etc/snort/unicode.map-sample'); + exec('/bin/mv /usr/local/etc/snort/unicode.map /usr/local/etc/snort/etc/unicode.map'); + exec('/bin/rm /usr/local/etc/snort/generators-sample'); + exec('/bin/mv /usr/local/etc/snort/generators /usr/local/etc/snort/etc/generators'); + exec('/bin/rm /usr/local/etc/snort/sid'); + exec('/bin/rm /usr/local/etc/rc.d/snort'); + exec('/bin/rm /usr/local/etc/rc.d/bardyard2'); + } + + // remove example files + if(file_exists('/usr/local/lib/snort/dynamicrules/lib_sfdynamic_example_rule.so.0')) { + exec('/bin/rm /usr/local/lib/snort/dynamicrules/lib_sfdynamic_example*'); + } + + if(file_exists('/usr/local/lib/snort/dynamicpreprocessor/lib_sfdynamic_preprocessor_example.so')) { + exec('/bin/rm /usr/local/lib/snort/dynamicpreprocessor/lib_sfdynamic_preprocessor_example*'); + } + + + // add snort user and group note: 920 keep the numbers < 2000, above this is reserved in pfSense 2.0 + exec('/usr/sbin/pw groupadd snort -g 920'); + exec('/usr/sbin/pw useradd snort -u 920 -c "Snort User" -d /nonexistent -g snort -s /sbin/nologin'); + + // if users have old log files delete them */ + if(!file_exists('/var/log/snort/alert')) { + touch('/var/log/snort/alert'); + }else{ + exec('/bin/rm -rf /var/log/snort/*'); + touch('/var/log/snort/alert'); + } + + // rm barnyard2 important */ + if(!file_exists('/usr/local/bin/barnyard2')) { + exec('/bin/rm /usr/local/bin/barnyard2'); + } + + /* important */ + exec('/usr/sbin/chown -R snort:snort /var/log/snort'); + exec('/usr/sbin/chown -R snort:snort /usr/local/etc/snort'); + exec('/usr/sbin/chown -R snort:snort /usr/local/lib/snort'); + exec('/usr/sbin/chown -R snort:snort /var/snort'); + exec('/usr/sbin/chown snort:snort /tmp/snort*'); + exec('/usr/sbin/chown snort:snort /var/db/whitelist'); + exec('/bin/chmod 660 /var/log/snort/alert'); + exec('/bin/chmod 660 /var/db/whitelist'); + exec('/bin/chmod -R 660 /usr/local/etc/snort/*'); + exec('/bin/chmod -R 660 /tmp/snort*'); + exec('/bin/chmod -R 660 /var/run/snort*'); + exec('/bin/chmod -R 660 /var/snort/run/*'); + exec('/bin/chmod 770 /usr/local/lib/snort'); + exec('/bin/chmod 770 /usr/local/etc/snort'); + exec('/bin/chmod 770 /usr/local/etc/whitelist'); + exec('/bin/chmod 770 /var/log/snort'); + exec('/bin/chmod 770 /var/log/snort/run'); + exec('/bin/chmod 770 /var/log/snort/barnyard2'); + + /* move files around, make it look clean */ + exec('/bin/mkdir -p /usr/local/www/snort/css'); + exec('/bin/mkdir -p /usr/local/www/snort/images'); + exec('/bin/mkdir -p /usr/local/www/snort/javascript'); + + chdir ("/usr/local/www/snort/css/"); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/css/style_snort2.css'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/css/new_tab_menu.css'); + chdir ("/usr/local/www/snort/images/"); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/alert.jpg'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/arrow_down.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/awesome-overlay-sprite.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/controls.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/down.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/down2.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/footer.jpg'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/footer2.jpg'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/icon-table-sort-asc.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/icon-table-sort-desc.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/icon-table-sort.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/icon_excli.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/loading.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/logo.jpg'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/logo22.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/page_white_text.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/transparent.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/transparentbg.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/up.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/up2.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/close_9x9.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/new_tab_menu.png'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/progress_bar2.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/progressbar.gif'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/images/top_modal_bar_lil.jpg'); + chdir ("/usr/local/www/snort/javascript/"); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/javascript/jquery-1.6.2.min.js'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/javascript/jquery.form.js'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/javascript/snort_globalsend.js'); + exec('/usr/bin/fetch http://www.pfsense.com/packages/config/snort-dev/javascript/jquery.progressbar.min.js'); + + /* back to default */ + chdir ('/root/'); + + // make sure snort-old is deinstalled + // remove when snort-old is removed + unset($config['installedpackages']['snort']); + unset($config['installedpackages']['snortdefservers']); + unset($config['installedpackages']['snortwhitelist']); + unset($config['installedpackages']['snortthreshold']); + unset($config['installedpackages']['snortadvanced']); + write_config(); + conf_mount_rw(); + + // remake saved settings + // TODO: make sre this works in final release + /* + if($config['installedpackages']['snortglobal']['forcekeepsettings'] == 'on') { + update_status(gettext("Saved settings detected...")); + update_output_window(gettext("Please wait... rebuilding files...")); + sync_snort_package_empty(); + update_output_window(gettext("Finnished Rebuilding files...")); + } + */ + + conf_mount_ro(); + +} // END of Post Install + +function snort_deinstall() +{ + + global $config, $g; + conf_mount_rw(); + + // remove custom sysctl // + remove_text_from_file("/etc/sysctl.conf", "sysctl net.bpf.bufsize=20480"); + + // decrease bpf buffers back to 4096, from 20480 + exec('/sbin/sysctl net.bpf.bufsize=4096'); + + exec('/usr/usr/bin/killall snort'); + sleep(2); + exec('/usr/usr/bin/killall -9 snort'); + sleep(2); + exec('/usr/usr/bin/killall barnyard2'); + sleep(2); + exec('/usr/usr/bin/killall -9 barnyard2'); + sleep(2); + + exec('/usr/sbin/pw userdel snort'); + exec('/usr/sbin/pw groupdel snort'); + exec('rm -rf /usr/local/etc/snort*'); + exec('rm -rf /usr/local/pkg/snort*'); + exec('rm -rf /usr/local/pkg/pf/snort*'); + + exec("cd /var/db/pkg && pkg_delete `ls | grep snort`"); + exec("cd /var/db/pkg && pkg_delete `ls | grep perl-threaded`"); + exec("cd /var/db/pkg && pkg_delete `ls | grep mysql-client-5.1.50_1`"); + exec('rm -r /usr/local/bin/barnyard2'); + + // TODO: figure out how to detect pfsense packages that use the same freebsd pkckages and not deinstall + //exec("cd /var/db/pkg && pkg_delete `ls | grep perl`"); + //exec("cd /var/db/pkg && pkg_delete `ls | grep barnyard2`"); + //exec("cd /var/db/pkg && pkg_delete `ls | grep pcre`"); // Never remove pcre or pfsense will break + + // Remove snort cron entries Ugly code needs smoothness + // TODO: redo code because its a mess + function snort_rm_blocked_deinstall_cron($should_install) + { + global $config, $g; + conf_mount_rw(); + + $is_installed = false; + + if(!$config['cron']['item']) + return; + + $x=0; + foreach($config['cron']['item'] as $item) + { + if (strstr($item['command'], "snort2c")) + { + $is_installed = true; + break; + } + + $x++; + + } + if($is_installed == true) + { + if($x > 0) + { + unset($config['cron']['item'][$x]); + write_config(); + conf_mount_rw(); + } + + configure_cron(); + + } + conf_mount_ro(); + + } + + function snort_rules_up_deinstall_cron($should_install) + { + global $config, $g; + conf_mount_rw(); + + $is_installed = false; + + if(!$config['cron']['item']) + return; + + $x=0; + foreach($config['cron']['item'] as $item) { + if (strstr($item['command'], "snort_check_for_rule_updates.php")) { + $is_installed = true; + break; + } + $x++; + } + if($is_installed == true) { + if($x > 0) { + unset($config['cron']['item'][$x]); + write_config(); + conf_mount_rw(); + } + configure_cron(); + } + } + + snort_rm_blocked_deinstall_cron(""); + snort_rules_up_deinstall_cron(""); + + + /* Unset snort registers in conf.xml IMPORTANT snort will not start with out this */ + /* Keep this as a last step */ + if($config['installedpackages']['snortglobal']['forcekeepsettings'] != 'on') { + unset($config['installedpackages']['snortglobal']); + } + write_config(); + conf_mount_rw(); + + exec('rm -rf /usr/local/www/snort'); + exec('rm -rf /usr/local/lib/snort/'); + exec('rm -rf /var/log/snort/'); + exec('rm -rf /usr/local/pkg/snort'); + exec('rm -rf /var/snort'); + + conf_mount_ro(); + +} + +// make sure this func on writes to files and does not start snort */ +function sync_snort_package() +{ + global $config, $g; + conf_mount_rw(); + + + + conf_mount_ro(); +} + +?> diff --git a/config/snort-dev/snort_interfaces.php b/config/snort-dev/snort_interfaces.php new file mode 100644 index 00000000..beb50f83 --- /dev/null +++ b/config/snort-dev/snort_interfaces.php @@ -0,0 +1,415 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +$new_ruleUUID = genAlphaNumMixFast(7, 8); + +$a_interfaces = snortSql_fetchAllInterfaceRules('SnortIfaces', 'snortDB'); + + + $pgtitle = "Services: Snort 2.9.0.5 pkg v. 2.0"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + +
    + + + + + + + + +
    + +
    + +
    + +
    +
    + + + + + + + +
    SnortSam Status
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + +
     SnortSamRolePortPassLogDescription  
    + + DISABLEDMASTER3526ENABLEDDISABLEDMster IPs  + +
    + +
    + + + + + + +
    Interface Status + + + +
    +
    + + + "; + echo ' + + + '; + echo " + + "; + echo ' + +
    {$list['interface']} Interface Status   ({$list['uuid']})
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + +
     SnortIfPerformanceBlockLogDescription  
    + '; + echo " + + + {$ifaceStat}{$list['interface']}{$list['performance']}{$blockStat}{$logStat}{$list['descr']} + + "; + echo ' +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + +
     Barnyard2IfSensorTypeLogDescription  
    + '; + echo " + + {$barnyard2Stat}{$list['interface']}{$list['uuid']}_{$list['interface']}unified2{$barnyard2Stat}Mster IPs  + + "; + echo ' +
    +
    +
    '; + } // end of foreach main + ?> + + + + + + +
    +
    +
    + + + +
    + +
    +
    + + + + + + + +
       
    + Note:
    + This is the Snort Menu where you can see an over view of all your interface settings. + Please edit the Global Settings tab before adding an interface. +
    +
    + Warning: +
    + New settings will not take effect until interface restart. +
    +
    + + + + + + + + + + + + + + + +
    + Click on the + + icon to add a interface. + + Click on the + + icon to start snort or barnyard2. +
    + Click on the + icon to edit a + interface and settings. + + Click on the + + icon to stop snort or barnyard2. +
    + Click on the + + icon to delete a interface and settings. +
       
    +
    +
    +
    + + + + + +
    + +
    +
    + + + + + + + + + + +
       
    +
    + + + + +
    + SNORT registered ® by Sourcefire, Inc, Barnyard2 registered ® by securixlive.com, Orion registered ® by Robert Zelaya, + Emergingthreats registered ® by emergingthreats.net, Mysql registered ® by Mysql.com +
    +
    +
       
    +
    +
    + + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_edit.php b/config/snort-dev/snort_interfaces_edit.php new file mode 100644 index 00000000..ade5ade8 --- /dev/null +++ b/config/snort-dev/snort_interfaces_edit.php @@ -0,0 +1,536 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + */ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + + + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + +$a_rules = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'All', ''); + +if (!is_array($a_list)) { + $a_list = array(); +} + +$a_whitelist = snortSql_fetchAllWhitelistTypes('SnortWhitelist', 'SnortWhitelistips'); + +if (!is_array($a_whitelist)) { + $a_whitelist = array(); +} + +$a_suppresslist = snortSql_fetchAllWhitelistTypes('SnortSuppress', ''); + +if (!is_array($a_suppresslist)) { + $a_suppresslist = array(); +} + + + $pgtitle = "Services: Snort: Interface Edit:"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    +
    + +
    +
    + + +
    + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    General Settings
    Interface +   + "> +   Enable or Disable +
    Interface + +
    + Choose which interface this rule applies to.
    + Hint: in most cases, you'll want to use WAN here.     +
    Description + +
    + You may enter a description here for your reference (not parsed). +
    Memory Performance + +
    + Lowmem and ac-bnfa are recommended for low end systems, Ac: high memory, best performance, ac-std: moderate + memory,high performance, acs: small memory, moderateperformance, ac-banded: small memory,moderate performance, ac-sparsebands: small memory, high performance. +
    +
    Choose the rule DB snort should use.
    Rule DB + +
    + Choose the rule database to use.  Note: Cahnges to this database are global. +
    + WARNING: Never change this when snort is running.     +
    Choose the networks snort should inspect and whitelist.
    Home net + +
    + Choose the home net you will like this rule to use.  Note: Default homenet adds only local networks. +
    + Hint: Most users add a list offriendly ips that the firewall cant see.     +
    External net + +
    + Choose the external net you will like this rule to use. Note: Default external net, networks that are not home net. +
    + Hint: Most users should leave this setting at default.     +
    Block offenders + > +
    + Checking this option will automatically block hosts that generate a Snort alerts with SnortSam. +
    Suppression and filtering + +
    + Choose the suppression or filtering file you will like this rule to use.  + Note: Default option disables suppression and filtering. +
    Choose the types of logs snort should create.
    Type of Unified Logging + +
    + Snort will log Alerts to a file in the UNIFIED format. Full is a requirement for the snort wigdet. +
    Send alerts to mainSystem logs + > +
    + Snort will send Alerts to the Pfsense system logs. +
    Log to a Tcpdump file + > +
    + Snort will log packets to a tcpdump-formatted file. The file then can be analyzed by an application such as Wireshark which understands pcap file formats. + WARNING: File may become large. +
    Log Alerts to a snort unified2 file + > +
    + Snort will log Alerts to a file in the UNIFIED2 format. This is a requirement for barnyard2. +
    Arguments here will be automatically inserted into the snort configuration.
    Advanced configuration pass through + +
    + + + +
      + Note: + Please save your settings before you click start. +
    + + + +
    +
    + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_global.php b/config/snort-dev/snort_interfaces_global.php new file mode 100644 index 00000000..fd9d27d4 --- /dev/null +++ b/config/snort-dev/snort_interfaces_global.php @@ -0,0 +1,367 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$generalSettings = snortSql_fetchAllSettings('snortDB', 'SnortSettings', 'id', '1'); + +$snortdownload_off = ($generalSettings['snortdownload'] == 'off' ? 'checked' : ''); +$snortdownload_on = ($generalSettings['snortdownload'] == 'on' ? 'checked' : ''); +$oinkmastercode = $generalSettings['oinkmastercode']; + +$emergingthreatsdownload_off = ($generalSettings['emergingthreatsdownload'] == 'off' ? 'checked' : ''); +$emergingthreatsdownload_basic = ($generalSettings['emergingthreatsdownload'] == 'basic' ? 'checked' : ''); +$emergingthreatsdownload_pro = ($generalSettings['emergingthreatsdownload'] == 'pro' ? 'checked' : ''); +$emergingthreatscode = $generalSettings['emergingthreatscode']; + +$updaterules = $generalSettings['updaterules']; + +$rm_blocked = $generalSettings['rm_blocked']; + +$snortloglimit_off = ($generalSettings['snortloglimit'] == 'off' ? 'checked' : ''); +$snortloglimit_on = ($generalSettings['snortloglimit'] == 'on' ? 'checked' : ''); + +$snortloglimitsize = $generalSettings['snortloglimitsize']; + +$snortalertlogtype = $generalSettings['snortalertlogtype']; + +$forcekeepsettings_on = ($generalSettings['forcekeepsettings'] == 'on' ? 'checked' : ''); + +$snortlogCurrentDSKsize = round(exec('df -k /var | grep -v "Filesystem" | awk \'{print $4}\'') / 1024); + + + $pgtitle = "Services: Snort: Global Settings"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Please Choose The Type Of Rules You Wish To Download
    Install Snort.org rules + + + + + + + +
    + > + Do NOT Install +
    + > + Install Basic Rules or Premium rules
    +
    + + + + +
    + + Sign Up for a Basic Rule Account +

    + + Sign Up for Sourcefire VRT Certified Premium Rules. This Is Highly Recommended + +
    + + + + + + + +
    Oinkmaster code
    Code +
    + Obtain a snort.org Oinkmaster code and paste here. +
    +
    Install Emergingthreats rules + + + + + + + + + + +
    + > + Do NOT Install +
    + > + Install Basic Rules: No need to register
    +
    + > + Install Pro rules: You need to register
    +
    + + + + +
    + + Sign Up for Emerging Threats Pro Certified Premium Rules. This Is Highly Recommended + +
    + + + + + + + +
    Pro rules code
    Code +
    + Obtain a emergingthreatspro.com Pro rules code and paste here. +
    +
    Update rules automatically +
    + + Please select the update times for rules.
    Hint: in most cases, every 12 hours is a good choice. +     +
    General Settings
    Log Directory SizeLimit
    +




    + Note:
    Available space is MB     +     		+ + + + + + + + + + +
    + > + Enable directory size limit (Default) +
    + > + Disable directory size limit

    + Warning: Pfsense Nanobsd should use no more than 10MB of space. +
     
    + + + + +
    Size in MB + + Default is 20% of available space. +
    +
    Remove blocked hosts every +
    + Please select the amount of time you would likehosts to be blocked for.
    Hint: in most cases, 1 hour is a good choice.     +
    Alerts file descriptiontype +
    + Please choose the type of Alert logging you will like see in your alert file.
    Hint: Best pratice is to chose full logging.      + WARNING: On change, alert file will be cleared. +
    Keep snort settings after deinstall + > + Settings will not be removed during deinstall. +
    Save Settings + + +
    + + +  WARNING:
    This will reset all global and interface settings.     +     		+ Note:
    + Changing any settings on this page will affect all interfaces. Please, double check if your oink code is correct and the type of snort.org account you hold. +
    +
    +
    +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_rules.php b/config/snort-dev/snort_interfaces_rules.php new file mode 100644 index 00000000..12f9cec0 --- /dev/null +++ b/config/snort-dev/snort_interfaces_rules.php @@ -0,0 +1,289 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +$a_rules = array(); +$a_rules = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'All', ''); + + if (!is_array($a_rules)) { + $a_rules = array(); + } + + if ($a_rules == 'Error') { + echo 'Error'; + exit(0); + } + + // list rules in db that are on in a array + $listOnRules = array(); + $listOnRules = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'All', ''); + + $listUsedRules = array(); + foreach ($listOnRules as $listOnRule) + { + + $listUsedRules[] = $listOnRule['ruledbname']; + + } + unset($listOnRules); + + $pgtitle = "Services: Snort: Rules"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + +
    + +
    + +
    + +
    + + +
    + + + +
    + + + + +
    File NameDescription
    + + + + + +
    + + + + + + + + + + + + '; + }else{ + $deleteObject = ''; + } + + if (in_array($list['uuid'], $listUsedRules)) { + $resetObject = ''; + }else{ + $resetObject = ''; + } + + ?> + + + + + + + + + + +
    Default + Default rule database  + + + '; + }else{ + $resetObjectDf = ''; + } + + ?> + + + + + + +
    + + + + + +
    +
    +   + + + + + + + +
    + + + + + +
    +
    + + + + + + + +
     
    + +
    + + +
    + + + + + + + + + +
    +
    + + +
    + + Note: +

    + Here you can create rule databases that can be used on multiple interfaces.

    + + Please note that you must restart a running rule so that changes can take effect.

    + + You may only delete rule databases that are not asigned to an interface.
    +

    +
    +
    + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_rules_edit.php b/config/snort-dev/snort_interfaces_rules_edit.php new file mode 100644 index 00000000..be6467bc --- /dev/null +++ b/config/snort-dev/snort_interfaces_rules_edit.php @@ -0,0 +1,282 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +if (isset($_GET['rdbuuid'])) { + $rdbuuid = $_GET['rdbuuid']; +}else{ + $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + $rdbuuid = $ruledbname_pre1['ruledbname']; +} + +if ($rdbuuid !== 'default') { + + $a_list = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'uuid', $rdbuuid); + + // $a_list returns empty use defaults + if ($a_list == '') { + + $a_list = array( + 'id' => '', + 'date' => date(U), + 'uuid' => $rdbuuid, + 'ruledbname' => '', + 'description' => '' + + ); + + } + +} + +if ($rdbuuid === 'default') { + + // $a_list returns empty use defaults + if ($a_list == '') { + + $a_list = array( + 'id' => '1', + 'date' => date(U), + 'uuid' => $rdbuuid, + 'ruledbname' => 'default', + 'description' => 'Default database' + + ); + + } + +} + +if ( !empty($a_list['id']) ) { + $disabled = 'disabled="disabled"'; +}else{ + $disabled = ''; +} + +if ( $rdbuuid === 'default' ) { + $disabled_ckbox = 'disabled="disabled"'; +}else{ + $disabled_ckbox = ''; +} + + + $pgtitle = 'Services: Snort: Rules: Edit: ' . $rdbuuid; + include('/usr/local/pkg/snort/snort_head.inc'); + +?> + + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + + + + + +
    +
    + +
    +
    +
    + +
    +
    + + + + + + + + '; + } + ?> + + + + +
    + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + +
    Add the name and description of the rule DB
    Name + />
    + The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. +
    Description + />
    + You may enter a description here for your reference (not parsed). +
    + Examples: +
    + NOTE: Rule DB will not be active until snort sensor restart.
    +
    +
    +
    + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_suppress.php b/config/snort-dev/snort_interfaces_suppress.php new file mode 100644 index 00000000..977dcf2d --- /dev/null +++ b/config/snort-dev/snort_interfaces_suppress.php @@ -0,0 +1,211 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + + +$a_suppress = snortSql_fetchAllWhitelistTypes('SnortSuppress', ''); + + if (!is_array($a_suppress)) + { + $a_suppress = array(); + } + + + if ($a_suppress == 'Error') + { + echo 'Error'; + exit(0); + } + + $pgtitle = "Services: Snort: Suppression"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + + +
    + +
    + +
    + +
    + + + + + + +
    + + + + + + + + + + + + + + + + + + + + +
    File NameDescription
    +   + + + + + + +
    + + + + +
    +
    + + + + + +
     
    +
    +
    +
    + + + + + +
    +
    + + +
    + + Note: +

    + Here you can create event filtering and suppression for your snort package rules.
    + Please note that you must restart a running rule so that changes can take effect.
    +

    +
    +
    + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_suppress_edit.php b/config/snort-dev/snort_interfaces_suppress_edit.php new file mode 100644 index 00000000..e9f23254 --- /dev/null +++ b/config/snort-dev/snort_interfaces_suppress_edit.php @@ -0,0 +1,231 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortSuppress', 'uuid', $uuid); + + +// $a_list returns empty use defaults +if ($a_list == '') +{ + + $a_list = array( + 'id' => '', + 'date' => date(U), + 'uuid' => $uuid, + 'filename' => '', + 'description' => '', + 'suppresspassthru' => '' + + ); + +} + + + + + $pgtitle = 'Services: Snort: Suppression: Edit'; + include('/usr/local/pkg/snort/snort_head.inc'); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + + + + + +
    + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + +
    Add the name anddescription of the file.
    Name +
    + The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. +
    Description +
    + You may enter a description here for your reference (not parsed). +
    + Examples: +
    + Example 1; suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
    + Example 2; event_filter gen_id 1, sig_id 1851, type limit,track by_src, count 1, seconds 60
    + Example 3; rate_filter gen_id 135, sig_id 1, track by_src, count 100, seconds 1, new_action log, timeout 10 +
    + + + + + + + +
    + Apply suppression or filters to rules. Valid keywords are 'suppress', 'event_filter' and 'rate_filter'. +
    + +
    +
    + + +
    +
    + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_whitelist.php b/config/snort-dev/snort_interfaces_whitelist.php new file mode 100644 index 00000000..3167b65f --- /dev/null +++ b/config/snort-dev/snort_interfaces_whitelist.php @@ -0,0 +1,241 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + + +$a_whitelist = snortSql_fetchAllWhitelistTypes('SnortWhitelist', 'SnortWhitelistips'); + + if (!is_array($a_whitelist)) + { + $a_whitelist = array(); + } + + if ($a_whitelist == 'Error') + { + echo 'Error'; + exit(0); + } + + $pgtitle = "Services: Snort: Whitelist"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + + +
    + +
    + +
    + +
    + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + +
    File NameValuesDescription
    + 0 && $a != $countList) + { + echo ',' . ' '; + }else{ + echo ' '; + } + + } // end foreach + + if ($a > 3) + { + echo '...'; + } + ?> + +   + + + + + + +
    + + + + +
    +
    + + + + + +
     
    +
    +
    +
    + + + + + +
    +
    + + +
    + + Note: +

    + Here you can create whitelist files for your snort package rules.
    + Please add all the ips or networks you want to protect against snort block decisions.
    + Remember that the default whitelist only includes local networks.
    + Be careful, it is very easy to get locked out of you system. +

    +
    +
    + +
    + + + + + + + + diff --git a/config/snort-dev/snort_interfaces_whitelist_edit.php b/config/snort-dev/snort_interfaces_whitelist_edit.php new file mode 100644 index 00000000..dbdbb649 --- /dev/null +++ b/config/snort-dev/snort_interfaces_whitelist_edit.php @@ -0,0 +1,341 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once('guiconfig.inc'); +require_once('/usr/local/pkg/snort/snort_new.inc'); +require_once('/usr/local/pkg/snort/snort_gui.inc'); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +//$GLOBALS['csrf']['rewrite-js'] = false; + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortWhitelist', 'uuid', $uuid); + +// $a_list returns empty use defaults +if ($a_list == '') +{ + + $a_list = array( + 'id' => '', + 'date' => date(U), + 'uuid' => $uuid, + 'filename' => '', + 'snortlisttype' => 'whitelist', + 'description' => '', + 'wanips' => 'on', + 'wangateips' => 'on', + 'wandnsips' => 'on', + 'vips' => 'on', + 'vpnips' => 'on' + ); + +} + +$listFilename = $a_list['filename']; + +$a_list['list'] = snortSql_fetchAllSettingsList('SnortWhitelistips', $listFilename); + +$wanips_chk = $a_list['wanips']; +$wanips_on = ($wanips_chk == 'on' ? 'checked' : ''); + +$wangateips_chk = $a_list['wangateips']; +$wangateips_on = ($wangateips_chk == 'on' ? 'checked' : ''); + +$wandnsips_chk = $a_list['wandnsips']; +$wandnsips_on = ($wandnsips_chk == 'on' ? 'checked' : ''); + +$vips_chk = $a_list['vips']; +$vips_on = ($vips_chk == 'on' ? 'checked' : ''); + +$vpnips_chk = $a_list['vpnips']; +$vpnips_on = ($vpnips_chk == 'on' ? 'checked' : ''); + + + + $pgtitle = "Services: Snort: Whitelist Edit"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Add the name and description of the file.
    Name +
    + The list name may only consist of the characters a-z, A-Z and 0-9. Note: No Spaces. +
    Description +
    + You may enter a description here for your reference (not parsed). +
    List Type +
    + WHITELIST:   This list specifies addresses that Snort Package should not block.

    + NETLIST:   This list is for defining addresses as $HOME_NET or $EXTERNAL_NET in the snort.conf file. +
    + +    Choose the type of list you will like see in your Interface Edit Tab. +
    Add auto generated ips.
    WAN IPs + /> + Add WAN IPs to the list. +
    Wan Gateways + /> + Add WAN Gateways to the list. +
    Wan DNS servers + /> + Add WAN DNS servers to the list. +
    Virtual IP Addresses + /> + Add Virtual IP Addresses to the list. +
    VPNs + /> + Add VPN Addresses to the list. +
    Add your own custom ips.
    +
    IP or CIDR items
    +     		+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    + For WHITELIST's enter ONLY IPs not CIDRs. Example: 192.168.4.1

    + For NETLIST's you may enter IPs and CIDRs. Example: 192.168.4.1 or 192.168.4.0/24 +
    +
    +
    IP or CIDR
    +     		+
    Add a Description or leave blank and a date will be added.
    +
    + + + + + +
    + + + +
    +
      + + +
    +
    +
    +
    + + + + + + + + diff --git a/config/snort-dev/snort_json_get.php b/config/snort-dev/snort_json_get.php new file mode 100644 index 00000000..92058a75 --- /dev/null +++ b/config/snort-dev/snort_json_get.php @@ -0,0 +1,137 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// get json blocls sids +if ($_GET['snortsamjson'] == 1) { + + exec('cat /usr/local/etc/snort/sn_6TPXv7a/rules/dbBlockSplit/splitSidblock_' . $_GET['fileid'] . '.block', $output); + echo $output[0]; + +} + + +// upload created log tar to user +if ($_GET['snortGetUpdate'] == 1) { + + $tmpfname = "/usr/local/etc/snort/snort_download"; + $snort_filename = "snortrules-snapshot-2905.tar.gz"; + + + $snortSessionPath = $_SESSION['tmp']['snort']['snort_download_updates']; + + if (!file_exists("{$tmpfname}/{$snort_filename}")) { + + if ($snortSessionPath['download']['working'] != '1') { + unset($_SESSION['tmp']); + $snortSessionPath['download']['working'] = '1'; + sendUpdateSnortLogDownload(); + } + + } + + $time = time(); + while((time() - $time) < 30) + { + + // query memcache, database, etc. for new data + $data = $datasource->getLatest(); + + // if we have new data return it + if(!empty($data)) { + echo json_encode($data); + ob_flush(); + flush(); + break; + } + + usleep(25000); + } + +} // end main if + + + +// upload created log tar to user +if ($_GET['snortlogdownload'] == 1) { + + sendFileSnortLogDownload(); + +} + + +// send Json sid string +if ($_GET['snortGetSidString'] == 1) { + + // unset + unset($_GET['snortGetSidString']); + + // get the SID string from file + sendSidStringRuleEditGUI(); + +} + + + + + + + + + + + + + + + +?> \ No newline at end of file diff --git a/config/snort-dev/snort_json_post.php b/config/snort-dev/snort_json_post.php new file mode 100644 index 00000000..418a90be --- /dev/null +++ b/config/snort-dev/snort_json_post.php @@ -0,0 +1,568 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_build.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// unset crsf checks +if(isset($_POST['__csrf_magic'])) { + unset($_POST['__csrf_magic']); +} + + +function snortJsonReturnCode($returnStatus) +{ + if ($returnStatus == true) { + echo '{"snortgeneralsettings":"success","snortMiscTabCall":"true"}'; + return true; + }else{ + echo '{"snortgeneralsettings":"fail"}'; + return false; + } +} + +// row from db by uuid +if ($_POST['snortSidRuleEdit'] == 1) { + + function snortSidRuleEditFunc() + { + + unset($_POST['snortSidRuleEdit']); + snortSidStringRuleEditGUI(); + + } snortSidRuleEditFunc(); + +} + + +// row from db by uuid +if ($_POST['snortSaveRuleSets'] == 1) { + + if ($_POST['ifaceTab'] == 'snort_rules') { + function snortSaveRuleSetsRulesFunc() + { + // unset POSTs that are markers not in db + unset($_POST['snortSaveRuleSets']); + unset($_POST['ifaceTab']); + + snortJsonReturnCode(snortSql_updateRuleSigList()); + + } snortSaveRuleSetsRulesFunc(); + } + + if ($_POST['ifaceTab'] === 'snort_rules_ips') { + function snortSamRulesSaveFunc() + { + snortJsonReturnCode(snortSql_updateRulesSigsIps()); + buildSnortSamSidBlockMap($_POST['rdbuuid']); // + + } snortSamRulesSaveFunc(); + } + + + if ($_POST['ifaceTab'] == 'snort_rulesets' || $_POST['ifaceTab'] == 'snort_rulesets_ips') { + + function snortSaveRuleSetsRulesetsFunc() + { + // unset POSTs that are markers not in db + unset($_POST['snortSaveRuleSets']); + unset($_POST['ifaceTab']); + + // save to database + snortJsonReturnCode(snortSql_updateRuleSetList()); + + if (!empty($_POST['rdbuuid'])) { + buildSnortSamSidBlockMap($_POST['rdbuuid']); // + } + + // only build if uuid is valid + if (!empty($_POST['uuid'])) { + build_snort_settings($_POST['uuid']); + } + + } snortSaveRuleSetsRulesetsFunc(); + } + + +} // END of rulesSets + +// row from db by uuid +if ( $_POST['RMlistDelRow'] == 1 || $_POST['RSTlistRow'] == 1 ) { + + + function RMlistDelRowFunc() + { + + $rm_row_list = snortSql_fetchAllSettings($_POST['RMlistDB'], $_POST['RMlistTable'], 'uuid', $_POST['RMlistUuid']); + + // list rules in the default dir + if ($_POST['RMlistTable'] == 'SnortIfaces') { + + $snortRuleDir = '/usr/local/etc/snort/sn_' . $_POST['RMlistUuid']; + + exec('/bin/rm -r ' . $snortRuleDir); + } + + // rm ruledb and files + if ($_POST['RMlistTable'] == 'Snortrules') { + + // remove db tables vals + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSets', 'rdbuuid', $_POST['RMlistUuid']); + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSigs', 'rdbuuid', $_POST['RMlistUuid']); + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSigsIps', 'rdbuuid', $_POST['RMlistUuid']); + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleSetsIps', 'rdbuuid', $_POST['RMlistUuid']); + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortruleGenIps', 'rdbuuid', $_POST['RMlistUuid']); + + // remove dir + $snortRuleDir = "/usr/local/etc/snort/snortDBrules/DB/{$_POST['RMlistUuid']}"; + exec('/bin/rm -r ' . $snortRuleDir); + } + + if ($_POST['RMlistTable'] == 'SnortWhitelist') { + snortSql_updatelistDelete($_POST['RMlistDB'], 'SnortWhitelistips', 'filename', $rm_row_list['filename']); + } + + snortJsonReturnCode(snortSql_updatelistDelete($_POST['RMlistDB'], $_POST['RMlistTable'], 'uuid', $_POST['RMlistUuid'])); + + } if ( $_POST['RMlistDelRow'] == 1 ) { RMlistDelRowFunc(); } + + function RSTlistDelRowFunc() + { + + // rm ruledb and files + if ($_POST['RSTlistTable'] == 'Snortrules') { + + // remove dir + $snortRuleDir = "/usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}"; + exec('/bin/rm -r ' . $snortRuleDir . '/rules/*.rules'); + + // remove db tables vals + snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSets', 'rdbuuid', $_POST['RSTlistUuid']); + snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSigs', 'rdbuuid', $_POST['RSTlistUuid']); + snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSigsIps', 'rdbuuid', $_POST['RSTlistUuid']); + snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleSetsIps', 'rdbuuid', $_POST['RSTlistUuid']); + snortSql_updatelistDelete($_POST['RSTlistDB'], 'SnortruleGenIps', 'rdbuuid', $_POST['RSTlistUuid']); + + // NOTE: code only works on php5 + $listSnortRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/snort_rules/rules', '\.rules'); + $listEmergingRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/emerging_rules/rules', '\.rules'); + $listPfsenseRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules', '\.rules'); + + if (!empty($listSnortRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/snort_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); + } + if (!empty($listEmergingRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/emerging_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); + } + if (!empty($listPfsenseRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/pfsense_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['RSTlistUuid']}/rules"); + } + + + } + + } if ( $_POST['RSTlistRow'] == 1 ) { RSTlistDelRowFunc(); } + + +} + + +// general settings save +if ($_POST['snortSaveSettings'] == 1) { + + function snortSaveSettingsFunc() + { + + // Save ruleDB settings + if ($_POST['dbTable'] == 'Snortrules') { + + function saveSnortrules() + { + + unset($_POST['snortSaveSettings']); + unset($_POST['ifaceTab']); + + if (!is_dir("/usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules")) { + + // creat iface dir and ifcae rules dir + exec("/bin/mkdir -p /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); + + // create at least one file + if (!file_exists("/usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules/local.rules")) { + exec("/usr/bin/touch /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules/local.rules"); + } + + // NOTE: code only works on php5 + $listSnortRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/snort_rules/rules', '\.rules'); + $listEmergingRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/emerging_rules/rules', '\.rules'); + $listPfsenseRulesDir = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/pfsense_rules/rules', '\.rules'); + + if (!empty($listSnortRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/snort_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); + } + if (!empty($listEmergingRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/emerging_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); + } + if (!empty($listPfsenseRulesDir)) { + exec("/bin/cp -R /usr/local/etc/snort/snortDBrules/pfsense_rules/rules/*.rules /usr/local/etc/snort/snortDBrules/DB/{$_POST['uuid']}/rules"); + } + + + } //end of mkdir + + } saveSnortrules(); + + snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); + + } // END if Snortrules + + // Save general settings + if ($_POST['dbTable'] == 'SnortSettings') { + + function saveSnortSettings() + { + + if ($_POST['ifaceTab'] == 'snort_interfaces_global') { + // checkboxes when set to off never get included in POST thus this code + $_POST['forcekeepsettings'] = ($_POST['forcekeepsettings'] == '' ? off : $_POST['forcekeepsettings']); + } + + if ($_POST['ifaceTab'] == 'snort_alerts') { + + if (!isset($_POST['arefresh'])) + $_POST['arefresh'] = ($_POST['arefresh'] == '' ? off : $_POST['arefresh']); + + } + + if ($_POST['ifaceTab'] == 'snort_blocked') { + + if (!isset($_POST['brefresh'])) + $_POST['brefresh'] = ($_POST['brefresh'] == '' ? off : $_POST['brefresh']); + + } + + // unset POSTs that are markers not in db + unset($_POST['snortSaveSettings']); + unset($_POST['ifaceTab']); + + } saveSnortSettings(); + + snortJsonReturnCode(snortSql_updateSettings('id', '1')); + + } // END IF SnortSettings + + // Save rule settings on the interface edit tab + if ($_POST['dbTable'] == 'SnortIfaces') { + + function saveSnortIfaces() + { + + // snort interface edit + if ($_POST['ifaceTab'] == 'snort_interfaces_edit') { + + function SnortIfaces_Snort_Interfaces_edit() + { + if (!isset($_POST['enable'])) + $_POST['enable'] = ($_POST['enable'] == '' ? off : $_POST['enable']); + + if (!isset($_POST['blockoffenders7'])) + $_POST['blockoffenders7'] = ($_POST['blockoffenders7'] == '' ? off : $_POST['blockoffenders7']); + + if (!isset($_POST['alertsystemlog'])) + $_POST['alertsystemlog'] = ($_POST['alertsystemlog'] == '' ? off : $_POST['alertsystemlog']); + + if (!isset($_POST['tcpdumplog'])) + $_POST['tcpdumplog'] = ($_POST['tcpdumplog'] == '' ? off : $_POST['tcpdumplog']); + + if (!isset($_POST['snortunifiedlog'])) + $_POST['snortunifiedlog'] = ($_POST['snortunifiedlog'] == '' ? off : $_POST['snortunifiedlog']); + + // convert textbox to base64 + $_POST['configpassthru'] = base64_encode($_POST['configpassthru']); + + /* + * make dir for the new iface, if iface exists or rule dir has changed redo soft link + * may need to move this as a func to new_snort.inc + */ + $newSnortDir = 'sn_' . $_POST['uuid']; + $pathToSnortDir = '/usr/local/etc/snort'; + + // creat iface dir and ifcae rules dir + if (!is_dir("{$pathToSnortDir}/{$newSnortDir}")) { + createNewIfaceDir($pathToSnortDir, $newSnortDir); + } //end of mkdir + + snortRulesCreateSoftlink(); + + } SnortIfaces_Snort_Interfaces_edit(); + + } // end of snort_interfaces_edit + + // snort preprocessor edit + if ($_POST['ifaceTab'] == 'snort_preprocessors') { + + function SnortIfaces_Snort_PreprocessorsFunc() + { + if (!isset($_POST['dce_rpc_2'])) { + $_POST['dce_rpc_2'] = ($_POST['dce_rpc_2'] == '' ? off : $_POST['dce_rpc_2']); + } + + if (!isset($_POST['dns_preprocessor'])) { + $_POST['dns_preprocessor'] = ($_POST['dns_preprocessor'] == '' ? off : $_POST['dns_preprocessor']); + } + + if (!isset($_POST['ftp_preprocessor'])) { + $_POST['ftp_preprocessor'] = ($_POST['ftp_preprocessor'] == '' ? off : $_POST['ftp_preprocessor']); + } + + if (!isset($_POST['http_inspect'])) { + $_POST['http_inspect'] = ($_POST['http_inspect'] == '' ? off : $_POST['http_inspect']); + } + + if (!isset($_POST['other_preprocs'])) { + $_POST['other_preprocs'] = ($_POST['other_preprocs'] == '' ? off : $_POST['other_preprocs']); + } + + if (!isset($_POST['perform_stat'])) { + $_POST['perform_stat'] = ($_POST['perform_stat'] == '' ? off : $_POST['perform_stat']); + } + + if (!isset($_POST['sf_portscan'])) { + $_POST['sf_portscan'] = ($_POST['sf_portscan'] == '' ? off : $_POST['sf_portscan']); + } + + if (!isset($_POST['smtp_preprocessor'])) { + $_POST['smtp_preprocessor'] = ($_POST['smtp_preprocessor'] == '' ? off : $_POST['smtp_preprocessor']); + } + + } SnortIfaces_Snort_PreprocessorsFunc(); + + } + + // snort barnyard edit + if ($_POST['ifaceTab'] == 'snort_barnyard') { + function SnortIfaces_Snort_Barnyard() + { + // make shure iface is lower case + $_POST['interface'] = strtolower($_POST['interface']); + + if (!isset($_POST['barnyard_enable'])) { + $_POST['barnyard_enable'] = ($_POST['barnyard_enable'] == '' ? off : $_POST['barnyard_enable']); + } + } SnortIfaces_Snort_Barnyard(); + } + + + // unset POSTs that are markers not in db + unset($_POST['snortSaveSettings']); + unset($_POST['ifaceTab']); + + snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); + build_snort_settings($_POST['uuid']); + + } saveSnortIfaces(); + + } // END IF SnortIfaces + + } snortSaveSettingsFunc(); + + +} // STOP General Settings Save + +// Suppress settings save +if ($_POST['snortSaveSuppresslist'] == 1) { + + function snortSaveSuppresslistFunc() + { + + // post for supress_edit + if ($_POST['ifaceTab'] == 'snort_interfaces_suppress_edit') { + + // make sure filename is valid + if (!is_validFileName($_POST['filename'])) { + echo 'Error: FileName'; + return false; + } + + // unset POSTs that are markers not in db + unset($_POST['snortSaveSuppresslist']); + unset($_POST['ifaceTab']); + + // convert textbox to base64 + $_POST['suppresspassthru'] = base64_encode($_POST['suppresspassthru']); + + // Write to database + snortJsonReturnCode(snortSql_updateSettings('uuid', $_POST['uuid'])); + + } + + } + snortSaveSuppresslistFunc(); + +} + +// Whitelist settings save +if ($_POST['snortSaveWhitelist'] == 1) { + + function snortSaveWhitelistFunc() + { + + if ($_POST['ifaceTab'] == 'snort_interfaces_whitelist_edit') { + + if (!is_validFileName($_POST['filename'])) { + echo 'Error: FileName'; + return false; + } + + $_POST['wanips'] = ($_POST['wanips'] == '' ? off : $_POST['wanips']); + $_POST['wangateips'] = ($_POST['wangateips'] == '' ? off : $_POST['wangateips']); + $_POST['wandnsips'] = ($_POST['wandnsips'] == '' ? off : $_POST['wandnsips']); + $_POST['vips'] = ($_POST['vips'] == '' ? off : $_POST['vips']); + $_POST['vpnips'] = ($_POST['vpnips'] == '' ? off : $_POST['vpnips']); + + } + + // unset POSTs that are markers not in db + unset($_POST['snortSaveWhitelist']); + unset($_POST['ifaceTab']); + + // Split the POST for 2 arraus + $whitelistIPs = $_POST['list']; + unset($_POST['list']); + + + if (snortSql_updateSettings('uuid', $_POST['uuid']) && snortSql_updateWhitelistIps($whitelistIPs)) { + snortJsonReturnCode(true); + }else{ + snortJsonReturnCode(false); + } + + } + snortSaveWhitelistFunc(); + +} + +// download code for alerts page +if ($_POST['snortlogsdownload'] == 1) { + + function snortlogsdownloadFunc() + { + conf_mount_rw(); + snort_downloadAllLogs(); + conf_mount_ro(); + } + snortlogsdownloadFunc(); + +} + +// download code for alerts page +if ($_POST['snortblockedlogsdownload'] == 1) { + + function snortblockedlogsdownloadFunc() + { + conf_mount_rw(); + snort_downloadBlockedIPs(); + conf_mount_ro(); + } + snortblockedlogsdownloadFunc(); + +} + + +// code neeed to be worked on when finnished rules code +if ($_POST['snortlogsdelete'] == 1) { + + function snortlogsdeleteFunc() + { + conf_mount_rw(); + snortDeleteLogs(); + conf_mount_ro(); + } + snortlogsdeleteFunc(); +} + +// flushes snort2c table +if ($_POST['snortflushpftable'] == 1) { + + function snortflushpftableFunc() + { + conf_mount_rw(); + snortRemoveBlockedIPs(); + conf_mount_ro(); + } + snortflushpftableFunc(); +} + +// reset db reset_snortgeneralsettings +if ($_POST['reset_snortgeneralsettings'] == 1) { + + function reset_snortgeneralsettingsFunc() + { + conf_mount_rw(); + reset_snortgeneralsettings(); + conf_mount_ro(); + } + reset_snortgeneralsettingsFunc(); + +} + + +?> + + + + + + + + + + diff --git a/config/snort-dev/snort_new.inc b/config/snort-dev/snort_new.inc new file mode 100644 index 00000000..b9fc2322 --- /dev/null +++ b/config/snort-dev/snort_new.inc @@ -0,0 +1,1368 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +// unset crsf checks +if(isset($_POST['__csrf_magic'])) { + unset($_POST['__csrf_magic']); +} + +//require_once("pfsense-utils.inc"); +require_once("config.inc"); +require_once("functions.inc"); + +// create and cp to tmp db dir +if (!file_exists('/var/snort/')) { + exec('/bin/mkdir -p /var/snort/'); +} + +if (file_exists('/usr/local/pkg/snort/snortDBtemp')) { + exec('/bin/cp /usr/local/pkg/snort/snortDBtemp /var/snort/snortDBtemp'); +} + +// used in snort_rules_ips.php and create sid block map +function snortSearchArray($array, $key, $value) +{ + $results = array(); + + if (is_array($array)) + { + foreach ($array as $subarray) + { + if ($subarray[$key] == $value) { + $results = $subarray; + } + + } + + } + + return $results; +} + +// used in snort_rules_ips.php and create sid block map +function getCurrentIpsRuleArray($output) +{ + + foreach (array_unique($output) as $line) + { + $newOutput = explode(' # ', $line); + $newLine[] = $newOutput; + } + + return $newLine; +} + +/* +* make dir for the new iface, if iface exists or rule dir has changed redo soft link +*/ +function snortRulesCreateSoftlink() +{ + $newSnortDir = 'sn_' . $_POST['uuid']; + $pathToSnortDir = '/usr/local/etc/snort'; + + // change the rule path + if (is_dir("{$pathToSnortDir}/{$newSnortDir}")) { + + $snortCurrentRuleDbName = snortSql_fetchAllSettings('snortDB', 'snortIfaces', 'uuid', $_POST['uuid']); + + if ($_POST['ruledbname'] !== $snortCurrentRuleDbName['ruledbname'] || !file_exists("{$pathToSnortDir}/{$newSnortDir}/rules")) { + + // NOTE: use full paths or link rm will not work, Freebsd love + exec("/bin/rm {$pathToSnortDir}/{$newSnortDir}/rules"); + exec("/bin/ln -s /usr/local/etc/snort/snortDBrules/DB/{$_POST['ruledbname']}/rules {$pathToSnortDir}/{$newSnortDir}/rules"); + + } + + } +} + + +// Wites selected sig to file +function snortSidStringRuleEditGUI() +{ + + $workingFile = '/usr/local/etc/snort/sn_' . $_POST['snortSidRuleIface'] . '/rules/' . $_POST['snortSidRuleFile']; + + $splitcontents = split_rule_file($workingFile); + + if (!empty($splitcontents)) { + $sidLinePosPre = exec('/usr/bin/sed -n /sid:' . $_POST['snortSidNum'] . '\;/= ' . $workingFile); + $sidLinePos = $sidLinePosPre - 1; + + $splitcontents[$sidLinePos] = $_POST['sidstring']; + + + write_rule_file($splitcontents, $workingFile); + + return true; + } + + return false; + +} + +function sendSidStringRuleEditGUI() +{ + + $sidCall = exec('sed -n "/alert.*sid:' . $_GET['sid'] . ';.*/p" /usr/local/etc/snort/sn_' . $_GET['snortIface'] . '/rules/' . $_GET['snortRuleFile']); + $sidCallJsonFilter = escapeJsonString($sidCall); + + echo '{"sidstring":' . '"' . $sidCallJsonFilter . '","sid":' . '"' . $_GET['sid'] . '"}'; + return true; +} + +// create new Ifac dirs and soft links +function createNewIfaceDir($pathToSnortDir, $newSnortDir) { + + exec("/bin/mkdir -p {$pathToSnortDir}/{$newSnortDir}"); + + // create rules dir soft link if setting is default + if ($_POST['ruledbname'] === 'default' || empty($_POST['ruledbname'])) { + if (!file_exists("{$pathToSnortDir}/sn_{$_POST['uuid']}/rules") && file_exists('/usr/local/etc/snort/snortDBrules/DB/default/rules')) { + exec("/bin/ln -s {$pathToSnortDir}/snortDBrules/DB/default/rules {$pathToSnortDir}/sn_{$_POST['uuid']}/rules"); + } + } + + // create rules dir soft link if setting is not default + if ($_POST['ruledbname'] !== 'default' || $_POST['ruledbname'] != '') { + if (!file_exists("{$pathToSnortDir}/sn_{$_POST['uuid']}/rules") && file_exists("{$pathToSnortDir}/snortDBrules/DB/{$_POST['ruledbname']}/rules")) { + exec("/bin/ln -s {$pathToSnortDir}/snortDBrules/DB/{$_POST['ruledbname']}/rules {$pathToSnortDir}/sn_{$_POST['uuid']}/rules"); + } + } + + // cp new rules + exec("/bin/cp {$pathToSnortDir}/etc/*.config {$pathToSnortDir}/sn_{$_POST['uuid']}"); + exec("/bin/cp {$pathToSnortDir}/etc/*.conf {$pathToSnortDir}/sn_{$_POST['uuid']}"); + exec("/bin/cp {$pathToSnortDir}/etc/*.map {$pathToSnortDir}/sn_{$_POST['uuid']}"); + exec("/bin/cp {$pathToSnortDir}/etc/generators {$pathToSnortDir}/sn_{$_POST['uuid']}"); + exec("/bin/cp {$pathToSnortDir}/etc/sid {$pathToSnortDir}/sn_{$_POST['uuid']}"); +} // end of func + +function escapeJsonString($escapeString) +{ + // NOTE: foward slash has added spaces on each side ie and chrome were giving issues with + $search = array('\\', '\n', '\r', '\u', '\t', '\f', '\b', '/', '"'); + $replace = array('\\\\', '\\n', '\\r', '\\u', '\\t', '\\f', '\\b', ' \/ ', '\"'); + $encoded_string = str_replace($search, $replace, $escapeString); + + return $encoded_string; + +} + +// limit the length of the given string to $MAX_LENGTH char +function trimLength($s) { + + + $MAX_LENGTH = 13; + $str_to_count = $s; + if (strlen($str_to_count) <= $MAX_LENGTH) { + return $s; + } + + $s2 = substr($str_to_count, 0, $MAX_LENGTH - 3); + $s2 .= "..."; + return $s2; +} + + +// builds base array with sid etc.... +function newFilterRuleSig($baseruleArray) +{ + + function get_middle($source, $beginning, $ending, $init_pos) + { + $beginning_pos = strpos($source, $beginning, $init_pos); + $middle_pos = $beginning_pos + strlen($beginning); + $ending_pos = strpos($source, $ending, $beginning_pos); + $middle = substr($source, $middle_pos, $ending_pos - $middle_pos); + return $middle; + } + + + $i = 0; + $newSigArray[] = array(); + foreach ( $baseruleArray as $value ) + { + if (preg_match('/^# alert/', $value) || preg_match('/^alert/', $value)) { + + // add sid + $newSigArray[$i]['sid'] = get_middle($value, 'sid:', ';', 0); + + // remove whitespaces + $rmWhitespaces = preg_replace('/\s\s+/', ' ', $value); + // remove whitespace betwin # aerrt + $rmAlertWhitespace = preg_replace('/^# alert/', '#alert', $rmWhitespaces); + $splitcontents = explode(' ', $rmAlertWhitespace); + + // enable or disable + if ($splitcontents[0] === '#alert') { + $newSigArray[$i]['enable'] = 'off'; + }else{ + $newSigArray[$i]['enable'] = 'on'; + } + + // proto + $newSigArray[$i]['proto'] = $splitcontents[1]; + + // source + $newSigArray[$i]['src'] = trimLength($splitcontents[2]); + + // source port + $newSigArray[$i]['srcport'] = trimLength($splitcontents[3]); + + // Destination + $newSigArray[$i]['dst'] = trimLength($splitcontents[5]); + + // Destination port + $newSigArray[$i]['dstport'] = trimLength($splitcontents[6]); + + // sig message + $newSigArray[$i]['msg'] = get_middle($value, 'msg:"', '";', 0); + + } + + $i++; + + } + + return $newSigArray; +} + + +function split_rule_file($workingFile) +{ + $filehandle = fopen($workingFile, "r"); + $contents = fread($filehandle, filesize($workingFile)); + + fclose ($filehandle); + + $delimiter = "\n"; + + $splitcontents = explode($delimiter, $contents); + + return $splitcontents; +} + + +// write rule file to disk +function write_rule_file($content_changed, $received_file) +{ + + //read snort file with writing enabled + $filehandle = fopen($received_file, "w"); + + //delimiter for each new rule is a new line + $delimiter = "\n"; + + //implode the array back into a string for writing purposes + $fullfile = implode($delimiter, $content_changed); + + //write data to file + fwrite($filehandle, $fullfile); + + //close file handle + fclose($filehandle); + +} + + +// Save ruleSets settings +function snortSql_updateRuleSigList() +{ + + // selected snort rule file + $workingFile = "/usr/local/etc/snort/snortDBrules/DB/{$_SESSION['snort']['tmp']['snort_rules']['rdbuuid']}/rules/{$_SESSION['snort']['tmp']['snort_rules']['rulefile']}"; + + $splitcontents = split_rule_file($workingFile); + + // open rule file and change enable/disable sids + function read_rule_file($splitcontents, $enableSigsArray, $disableSigsArray) + { + + foreach ($splitcontents as $sigLine) + { + $replaceChars = array('/sid:/', '/;/'); + preg_match('/sid:[0-9]*;/', $sigLine, $matches); + $sidLine = preg_replace($replaceChars, '', $matches[0]); + + + if (empty($sidLine)) { + $tempstring[] = $sigLine; + }else{ + + if (in_array($sidLine, $enableSigsArray)) { + $tempstring[] = str_replace("# alert", "alert", $sigLine); + } + + if (in_array($sidLine, $disableSigsArray)) { + $tempstring[] = str_replace("alert", "# alert", $sigLine); + } + + if (!in_array($sidLine, $enableSigsArray) && !in_array($sidLine, $disableSigsArray)) { + $tempstring[] = $sigLine; + } + } + } + + return $tempstring; + } + + // build user selected enbled and disabled arrays + $enableSigsArray = array(); + $disableSigsArray = array(); + + if (!isset($_POST['filenamcheckbox2'])) { + $_POST['filenamcheckbox2'] = array(); + } + + $newFilterRuleSigArray = newFilterRuleSig($splitcontents); + + foreach ($newFilterRuleSigArray as $sigArray) + { + // enable sig + if(in_array($sigArray['sid'], $_POST['filenamcheckbox2']) && $sigArray['enable'] == 'off') { + $enableSigsArray[] = $sigArray['sid']; + } + + // disable sig + if(!in_array($sigArray['sid'], $_POST['filenamcheckbox2']) && $sigArray['enable'] == 'on') { + $disableSigsArray[] = $sigArray['sid']; + } + } + + // read rule file change disable/enable then write to file if arrays are not empty + if (!empty($enableSigsArray) || !empty($disableSigsArray)) { + write_rule_file(read_rule_file($splitcontents, $enableSigsArray, $disableSigsArray), $workingFile); + } + + // Insert into the DB for oinkmaster + + function sql_EnableDisabeSid($SigArray, $OnOff) + { + + $dbname = $_SESSION['snort']['tmp']['snort_rules']['dbName']; + $table = $_SESSION['snort']['tmp']['snort_rules']['dbTable']; + $rdbuuid = $_SESSION['snort']['tmp']['snort_rules']['rdbuuid']; + $rulefile = $_SESSION['snort']['tmp']['snort_rules']['rulefile']; + $addDate = date(U); + + // dont let user pick the DB path + $db = sqlite_open("/usr/local/pkg/snort/{$dbname}"); + + foreach ($SigArray as $mDEanbled) + { + + $resultid = sqlite_query($db, + "SELECT id FROM {$table} WHERE signatureid = '{$mDEanbled}' AND signaturefilename = '{$rulefile}'; + "); + + $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); + + if (empty($chktable)) { + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO {$table} (date, rdbuuid, signatureid, signaturefilename, enable) VALUES ('{$addDate}', '{$rdbuuid}', '{$mDEanbled}', '{$rulefile}', '{$OnOff}'); + "); + + }else{ + if ($chktable[0]['enable'] != $OnOff) { + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET date = {$addDate}, enable = '{$OnOff}' WHERE signatureid = '{$mDEanbled}' AND signaturefilename = '{$rulefile}'; + "); + } + + + } + + + } + + sqlite_close($db); + + } // snd of function + + sql_EnableDisabeSid($enableSigsArray, 'on'); + sql_EnableDisabeSid($disableSigsArray, 'off'); + + + return true; + + +} // END Save ruleSets settings + + +// Save rulessigs settings for snort_rules_ips +function snortSql_updateRulesSigsIps() +{ + + // dont let user pick the DB path + $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); + + function insertUpdateDB($db) + { + + // get default settings + $listGenRules = array(); + $listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $_POST['rdbuuid']); + + // if $listGenRules empty list defaults + if (empty($listGenRules)) { + $listGenRules[0] = array( + 'id' => 1, + 'rdbuuid' => $_POST['rdbuuid'], + 'enable' => 'on', + 'who' => 'src', + 'timeamount' => 15, + 'timetype' => 'minutes' + ); + } + + $addDate = date(U); + + // checkbox off catch + $listGenRulesEnable = $listGenRules[0]['enable']; + if ( empty($listGenRules[0]['enable']) || $listGenRules[0]['enable'] === 'off' ) { + + $listGenRulesEnable = 'off'; + } + + // TODO: inprove this foreach so we only interact with db once + foreach ($_POST['snortsam']['db'] as $singleSig) + { + + $resultid = sqlite_query($db, + "SELECT id FROM {$_POST['dbTable']} WHERE siguuid = '{$singleSig['siguuid']}' and rdbuuid = '{$_POST['rdbuuid']}'; + "); + + $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); + + // checkbox off catch + $singleSigEnable = $singleSig['enable']; + if ( empty($singleSig['enable']) ) { + + $singleSigEnable = 'off'; + } + + // only do this if something change from defauts settings, note: timeamount Not equal + $somthingChanged = FALSE; + if ( $singleSigEnable !== $listGenRulesEnable || $singleSig['who'] !== $listGenRules[0]['who'] || $singleSig['timeamount'] != $listGenRules[0]['timeamount'] || $singleSig['timetype'] !== $listGenRules[0]['timetype'] ) { + $somthingChanged = TRUE; + } + + if ( empty($chktable) && $somthingChanged ) { + + $rulesetUuid = genAlphaNumMixFast(11, 14); + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO {$_POST['dbTable']} (date, uuid, rdbuuid, enable, siguuid, sigfilename, who, timeamount, timetype) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$singleSigEnable}', '{$singleSig['siguuid']}', '{$singleSig['sigfilename']}', '{$singleSig['who']}', '{$singleSig['timeamount']}', '{$singleSig['timetype']}'); + "); + + } + + if ( !empty($chktable) && $somthingChanged ) { + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$_POST['dbTable']} SET date ='{$addDate}', enable = '{$singleSigEnable}', who = '{$singleSig['who']}', timeamount = '{$singleSig['timeamount']}', timetype = '{$singleSig['timetype']}' WHERE rdbuuid = '{$_POST['rdbuuid']}' and sigfilename = '{$singleSig['sigfilename']}'; + "); + + } + + } // END foreach + + } insertUpdateDB($db); + + function cleanupDB($db) + { + // clean database of old names and turn rulesets off + $listDir = snortScanDirFilter("/usr/local/etc/snort/snortDBrules/DB/{$_POST['rdbuuid']}/rules/", '\.rules'); + + $resultAllRulesetname = sqlite_query($db, + "SELECT sigfilename FROM {$_POST['dbTable']} WHERE rdbuuid = '{$_POST['rdbuuid']}'; + "); + + $chktable2 = sqlite_fetch_all($resultAllRulesetname, SQLITE_ASSOC); + + if (!empty($chktable2)) { + foreach ($chktable2 as $value) + { + + if(!in_array($value['sigfilename'], $listDir)) { + $deleteMissingRuleset = sqlite_query($db, // @ supress warnings use only in production + "DELETE FROM {$_POST['dbTable']} WHERE sigfilename = '{$value['sigfilename']}' and rdbuuid = '{$_POST['rdbuuid']}'; + "); + } + + } + } + } cleanupDB($db); + + sqlite_close($db); + return true; + +} + + + +// Save ruleSets settings +function snortSql_updateRuleSetList() +{ + + function createUpdateRulesetTable() + { + + $addDate = date(U); + + // dont let user pick the DB path + $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); + + if (empty($_POST['filenamcheckbox'])) { + $ruleSetfilenames = array(); + } + + // foreach selected rulesets do this + if (!empty($_POST['filenamcheckbox'])) { + foreach ($_POST['filenamcheckbox'] as $ruleSetfilename) + { + + $resultid = sqlite_query($db, + "SELECT id, enable FROM {$_POST['dbTable']} WHERE rulesetname = '{$ruleSetfilename}' and rdbuuid = '{$_POST['rdbuuid']}'; + "); + + $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); + + if (empty($chktable)) { + + $rulesetUuid = genAlphaNumMixFast(11, 14); + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO {$_POST['dbTable']} (date, uuid, rdbuuid, rulesetname, enable) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$ruleSetfilename}', 'on'); + "); + + }else{ + if ($chktable[0]['enable'] == 'off') { + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$_POST['dbTable']} SET enable = 'on' WHERE id = '{$chktable[0]['id']}'; + "); + } + } + } + } // end foreach if + + + // clean database of old names and turn rulesets off + $listDir = snortScanDirFilter("/usr/local/etc/snort/snortDBrules/DB/{$_POST['rdbuuid']}/rules/", '\.rules'); + + $resultAllRulesetname = sqlite_query($db, + "SELECT rulesetname FROM {$_POST['dbTable']} WHERE rdbuuid = '{$_POST['rdbuuid']}'; + "); + + $chktable2 = sqlite_fetch_all($resultAllRulesetname, SQLITE_ASSOC); + + + if (!empty($chktable2)) { + foreach ($chktable2 as $value) + { + + if(!in_array($value['rulesetname'], $listDir)) { + $deleteMissingRuleset = sqlite_query($db, // @ supress warnings use only in production + "DELETE FROM {$_POST['dbTable']} WHERE rulesetname = '{$value['rulesetname']}' and rdbuuid = '{$_POST['rdbuuid']}'; + "); + } + + if(!in_array($value['rulesetname'], $_POST['filenamcheckbox'])) { + $ruleSetisOff = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$_POST['dbTable']} SET enable = 'off' WHERE rulesetname = '{$value['rulesetname']}' and rdbuuid = '{$_POST['rdbuuid']}'; + "); + } + } + } + sqlite_close($db); + } // END createUpdateRulesetTable func + createUpdateRulesetTable(); + + // save gen setting only if on ips tab + if ($_POST['dbTable'] === 'SnortruleSetsIps') { + + function createUpdateRulesetGenTable() + { + $table = 'SnortruleGenIps'; + $rulesetUuid = genAlphaNumMixFast(11, 14); + $addDate = date(U); + + // if enable is empty then set to off + if (empty($_POST['snortsam']['db']['gensettings']['enable'])) { + + $_POST['snortsam']['db']['gensettings']['enable'] = 'off'; + } + + // dont let user pick the DB path + $db = sqlite_open("/usr/local/pkg/snort/{$_POST['dbName']}"); + + $resultid = sqlite_query($db, + "SELECT id FROM {$table} WHERE rdbuuid = '{$_POST['rdbuuid']}'; + "); + + $chktable = sqlite_fetch_all($resultid, SQLITE_ASSOC); + + if (!empty($chktable)) { + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "UPDATE {$table} SET enable = '{$_POST['snortsam']['db']['gensettings']['enable']}', who = '{$_POST['snortsam']['db']['gensettings']['who']}', timeamount = '{$_POST['snortsam']['db']['gensettings']['timeamount']}', timetype = '{$_POST['snortsam']['db']['gensettings']['timetype']}' WHERE rdbuuid = '{$_POST['rdbuuid']}'; + "); + + }else{ + + $query_ck = sqlite_query($db, // @ supress warnings usonly in production + "INSERT INTO {$table} (date, uuid, rdbuuid, enable, who, timeamount, timetype) VALUES ('{$addDate}', '{$rulesetUuid}', '{$_POST['rdbuuid']}', '{$_POST['snortsam']['db']['gensettings']['enable']}', '{$_POST['snortsam']['db']['gensettings']['who']}', '{$_POST['snortsam']['db']['gensettings']['timeamount']}', '{$_POST['snortsam']['db']['gensettings']['timetype']}'); + "); + } + + sqlite_close($db); + } // END createUpdateRulesetGenTable + createUpdateRulesetGenTable(); + + } + return true; + +} // END Save ruleSets settings + + +function snortSql_fetchAllInterfaceRules($table, $dbname) +{ + // do let user pick the DB path + $db = sqlite_open("/usr/local/pkg/snort/{$dbname}"); + + $result = sqlite_query($db, + "SELECT * FROM {$table} WHERE id > 0; + "); + + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + + sqlite_close($db); + + return $chktable; + +} + + +// fetch db Settings NONE Json +function snortSql_fetchAllSettings($dbname, $table, $type, $id_uuid) +{ + + if (empty($dbname) || empty($table) || empty($type)) { + return false; + } + + $db = sqlite_open("/usr/local/pkg/snort/$dbname"); + + if ($type == 'All') { + + $result = sqlite_query($db, + "SELECT * FROM {$table} WHERE id > 0; + "); + + }else{ + + $result = sqlite_query($db, + "SELECT * FROM {$table} where {$type} = '{$id_uuid}'; + "); + + } + + if ($type == 'id' || $type == 'uuid') { + $chktable = sqlite_fetch_array($result, SQLITE_ASSOC); + } + + if ($type == 'All' || $type == 'ifaceuuid' || $type == 'ruledbname' || $type == 'rdbuuid' || $type == 'filename') { + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + } + + sqlite_close($db); + + return $chktable; + + +} // end func + +// fetch db list settings NONE Json +function snortSql_fetchAllSettingsList($table, $listFilename) +{ + + $db = sqlite_open('/usr/local/pkg/snort/snortDB'); + + $result = sqlite_query($db, + "SELECT * FROM {$table} WHERE filename = \"{$listFilename}\"; + "); + + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + + sqlite_close($db); + + return $chktable; + +} + +// Update settings to database +function snortSql_updateSettings($type, $id_uuid) +{ + $dbname = $_POST['dbName']; + $settings = $_POST; + + // update date on every save + $_POST['date'] = date(U); + + $db = "/usr/local/pkg/snort/$dbname"; + $mydb = sqlite_open("$db"); + $table = $settings['dbTable']; + + // unset POSTs that are markers not in db + unset($settings['dbName']); + unset($settings['dbTable']); + + // START add new row if not set + if ($type == 'uuid') { + + $query_ck = sqlite_query($mydb, // @ supress warnings usonly in production + "SELECT * FROM {$table} WHERE uuid = '{$id_uuid}'; + "); + + $query_ckFinal = sqlite_fetch_all($query_ck, SQLITE_ASSOC); + + if (empty($query_ckFinal)) { + + $query_ck = sqlite_query($mydb, // @ supress warnings usonly in production + "INSERT INTO {$table} (date, uuid) VALUES ('{$settings['date']}', '{$settings['uuid']}'); + "); + + if (sqlite_changes($mydb) < 1) { + sqlite_close($mydb); + return 'Error in query'; + } + + } + + } + + // START add values to row + $kv = array(); + foreach ($settings as $key => $value) + { + $kv[] = $key; + $val[] = $value; + } + + $countKv = count($kv); + + $i = -1; + while ($i < $countKv) + { + + $i++; + + if (!empty($kv[$i])) + { + + if ($type == 'id') + { + $query = sqlite_query($mydb, // @ supress warnings usonly in production + "UPDATE {$table} SET {$kv[$i]} = '{$val[$i]}' WHERE id = '{$id_uuid}'; + "); + } + + if ($type == 'uuid') + { + $query = sqlite_query($mydb, // @ supress warnings usonly in production + "UPDATE {$table} SET {$kv[$i]} = '{$val[$i]}' WHERE uuid = '{$id_uuid}'; + "); + } + + if (sqlite_changes($mydb) < 1) + { + sqlite_close($mydb); + return 'Error in query'; + } + + } + } // end while + + sqlite_close($mydb); + return true; + +} + + +// fetch for snort_interfaces_whitelist.php NONE Json +// use sqlite_fetch_array for single and sqlite_fetch_all for lists +function snortSql_fetchAllWhitelistTypes($table, $table2) +{ + + if (empty($table)) { + return false; + } + + $db = sqlite_open('/usr/local/pkg/snort/snortDB'); + + + $result = sqlite_query($db, + "SELECT * FROM {$table} where id > 0; + "); + + $chktable = sqlite_fetch_all($result, SQLITE_ASSOC); + + if (empty($chktable)) { + return false; + } + + if ($table2 != '') + { + foreach ($chktable as $value) + { + + $filename2 = $value['filename']; + + $result2 = sqlite_query($db, + "SELECT ip FROM {$table2} WHERE filename = \"{$filename2}\" LIMIT 4; + "); + + $chktable2 = sqlite_fetch_all($result2, SQLITE_ASSOC); + + $final2 = array('id' => $value['id']); + $final2['date'] = $value['date']; + $final2['uuid'] = $value['uuid']; + $final2['filename'] = $value['filename']; + $final2['description'] = $value['description']; + $final2['snortlisttype'] = $value['snortlisttype']; + + + $final2['list'] = $chktable2; + + $final[] = $final2; + + } // end foreach + }else{ + $final = $chktable; + } + sqlite_close($db); + + return $final; + + +} // end func + + +// Save Whitelistips Settings +function snortSql_updateWhitelistIps($newPostListips) +{ + + if(empty($newPostListips)) + { + return true; + } + + $table = $_POST['dbTable']; + $filename = $_POST['filename']; + + $db = '/usr/local/pkg/snort/snortDB'; + $mydb = sqlite_open("$db"); + $tableips = $table . 'ips'; + $date = date(U); + + // remove list array that has nul ip + foreach ($newPostListips as $ipsListEmpty) + { + if (!empty($ipsListEmpty['ip'])) + { + $genList[] = $ipsListEmpty; + } + } + unset($newPostListips); + + // remove everything if nothing is in the post + if (empty($genList)) + { + + $query = sqlite_query($mydb, // @ supress warnings use only in production + "DELETE FROM {$tableips} WHERE filename = '{$filename}'; + "); + + sqlite_close($mydb); + return true; + + } + + // START Remove entries from DB + $resultUuid = sqlite_query($mydb, + "SELECT uuid FROM {$tableips} WHERE filename = '{$filename}'; + "); + + $resultUuidFinal = sqlite_fetch_all($resultUuid, SQLITE_ASSOC); + + if (!empty($genList) && !empty($resultUuidFinal)) + { + + foreach ($resultUuidFinal as $list3) + { + $uuidListDB[] = $list3['uuid']; + } + + foreach ($genList as $list2) + { + $uuidListPOST[] = $list2['uuid']; + } + + // create diff array + $uuidDiff = array_diff($uuidListDB, $uuidListPOST); + + // delet diff list objs + if ($uuidDiff != '') + { + foreach ($uuidDiff as $list4) + { + + // remove everything + $query = sqlite_query($mydb, // @ supress warnings use only in production + "DELETE FROM {$tableips} WHERE uuid = '{$list4}'; + "); + + } // end foreach + } + } + + // START add entries/updates to DB + foreach ($genList as $list) + { + + if ($list['uuid'] == 'EmptyUUID') + { + + $uuid = genAlphaNumMixFast(28, 28); + $list['uuid'] = $uuid; + + $query = sqlite_query($mydb, // @ supress warnings use only in production + "INSERT INTO {$tableips} (date, uuid, filename) VALUES ('{$date}', '{$uuid}', '{$filename}'); + "); + + if (sqlite_changes($mydb) < 1) + { + sqlite_close($mydb); + return 'Error in query'; + } + + foreach ($list as $key => $value) + { + + if ($key != '') + { + + $query = sqlite_query($mydb, // @ supress warnings usonly in production + "UPDATE {$tableips} SET {$key} ='{$value}' WHERE uuid = '{$uuid}'; + "); + + if (sqlite_changes($mydb) < 1) + { + sqlite_close($mydb); + return 'Error in query'; + } + + } + + } // end foreach + + }else{ + + $uuid = $list['uuid']; + + foreach ($list as $key => $value) + { + + $query = sqlite_query($mydb, // @ supress warnings usonly in production + "UPDATE {$tableips} SET {$key} ='{$value}', date = '{$date}' WHERE uuid = '{$uuid}'; + "); + + if (sqlite_changes($mydb) < 1) + { + sqlite_close($mydb); + return 'Error in query'; + } + + } // end foreach + + } // end main if + + } // end Main foreach + + sqlite_close($mydb); + return true; + +} // end of func + +// RMlist Delete +function snortSql_updatelistDelete($databse, $table, $type, $uuid_filename) +{ + + $db = "/usr/local/pkg/snort/{$databse}"; + + $mydb = sqlite_open("$db"); + + if (!empty($type)) { + + $query = sqlite_query($mydb, // @ supress warnings usonly in production + "DELETE FROM {$table} WHERE {$type} = '{$uuid_filename}'; + "); + + if (sqlite_changes($mydb) < 1) { + sqlite_close($mydb); + return 'Error in query'; + } + + } + + sqlite_close($mydb); + return true; + +} // END main func + +// create dropdown list +function snortDropDownList($list, $setting) { + foreach ($list as $iday => $iday2) { + + echo "\n" . "' . "\r"; + + } +} + +// downlod all snort logs +function snort_downloadAllLogs() { + + $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); + $file_name = "snort_logs_{$save_date}.tar.gz"; + + exec('/bin/rm /tmp/snort_logs_*.gz'); // remove old file + exec('/bin/rm /tmp/snort_blocked_*.gz'); // remove old file + exec('/bin/rm /tmp/snort_block.pf'); // remove old file + exec('/bin/rm -r /tmp/snort_blocked'); // remove old file + exec("/usr/bin/tar cfz /tmp/snort_logs_{$save_date}.tar.gz /var/log/snort"); + + if (file_exists("/tmp/snort_logs_{$save_date}.tar.gz")) { + echo " + { + \"snortdownload\": \"success\", + \"downloadfilename\": \"{$save_date}\" + } + "; + return true; + }else{ + return false; + } +} + +// send log files to browser GET function +function sendFileSnortLogDownload() { + //ob_start(); //importanr or other post will fail + $file_name_date = $_GET['snortlogfilename']; + + $file_name1 = "/tmp/snort_logs_{$file_name_date}.tar.gz"; + $file_name2 = "/tmp/snort_blocked_{$file_name_date}.tar.gz"; + + if (file_exists($file_name1)) { + $file_name = "snort_logs_{$file_name_date}.tar.gz"; + } + + if (file_exists($file_name2)) { + $file_name = "snort_blocked_{$file_name_date}.tar.gz"; + } + + if (empty($file_name)) { + echo 'Error no saved file.'; + return false; + } + + if(file_exists("/tmp/{$file_name}")) + { + $file = "/tmp/{$file_name}"; + header("Expires: Mon, 26 Jul 1997 05:00:00 GMT\n"); + header("Pragma: private"); // needed for IE + header("Cache-Control: private, must-revalidate"); // needed for IE + header('Content-type: application/force-download'); + header('Content-Transfer-Encoding: Binary'); + header("Content-length: ".filesize($file)); + header("Content-disposition: attachment; filename = {$file_name}"); + readfile("$file"); + exec("/bin/rm /tmp/{$file_name}"); + //od_end_clean(); //importanr or other post will fail + }else{ + echo 'Error no saved file.'; + return false; + } +} + +// Warning code not finnish untill rule code is DONE ! +// Delete Snort logs +function snortDeleteLogs() { + if(file_exists('/var/log/snort/alert')) + { + exec('/bin/echo "" > /var/log/snort/alert'); + //post_delete_logs(); + exec('/usr/sbin/chown snort:snort /var/log/snort/*'); + exec('/bin/chmod 660 /var/log/snort/*'); + sleep(2); + exec('/usr/bin/killall -HUP snort'); + } + + echo ' + { + "snortdelete": "success" + } + '; + return true; + +} + +// Warning code not finnish untill rule code is DONE ! +// code neeed to be worked on when finnished rules code +function post_delete_logs() +{ + global $config, $g; + + + $snort_log_dir = '/var/log/snort'; + + /* do not start config build if rules is empty */ + if (!empty($config['installedpackages']['snortglobal']['rule'])) + { + + + $rule_array = $config['installedpackages']['snortglobal']['rule']; + $id = -1; + foreach ($rule_array as $value) + { + + if (empty($id)) { + $id = 0; + } + + $id += 1; + + $result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; + $snort_uuid = $config['installedpackages']['snortglobal']['rule'][$id]['uuid']; + + if ($snort_uuid != '') + { + if ($config['installedpackages']['snortglobal']['rule'][$id]['snortunifiedlog'] == 'on') + { + $snort_log_file_u2 = "{$snort_uuid}.u2."; + $snort_list_u2 = snort_file_list($snort_log_dir, $snort_log_file_u2); + if (is_array($snort_list_u2)) { + usort($snort_list_u2, "snort_file_sort"); + $snort_u2_rm_list = snort_build_order($snort_list_u2); + snort_remove_files($snort_u2_rm_list, $snort_u2_rm_list[0]); + } + }else{ + exec("/bin/rm $snort_log_dir/snort_{$snort_uuid}.u2*"); + } + + if ($config['installedpackages']['snortglobal']['rule'][$id]['tcpdumplog'] == 'on') + { + $snort_log_file_tcpd = "{$snort_uuid}.tcpdump."; + $snort_list_tcpd = snort_file_list($snort_log_dir, $snort_log_file_tcpd); + if (is_array($snort_list_tcpd)) { + usort($snort_list_tcpd, "snort_file_sort"); + $snort_tcpd_rm_list = snort_build_order($snort_list_tcpd); + snort_remove_files($snort_tcpd_rm_list, $snort_tcpd_rm_list[0]); + } + }else{ + exec("/bin/rm $snort_log_dir/snort_{$snort_uuid}.tcpdump*"); + } + + /* create barnyard2 configuration file */ + //if ($config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable'] == 'on') + //create_barnyard2_conf($id, $if_real, $snort_uuid); + + if ($config['installedpackages']['snortglobal']['rule'][$id]['perform_stat'] == on) + { + exec("/bin/echo '' > /var/log/snort/snort_{$snort_uuid}.stats"); + } + } + } + } +} + +// END General Functions + +// downlod all blocked ips to log +function snort_downloadBlockedIPs() { + + exec('/bin/rm /tmp/snort_logs_*.gz'); // remove old file + exec('/bin/rm /tmp/snort_blocked_*.gz'); // remove old file + exec('/bin/rm /tmp/snort_block.pf'); // remove old file + exec('/bin/rm -r /tmp/snort_blocked'); // remove old file + $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); + $file_name = "snort_blocked_{$save_date}.tar.gz"; + exec('/bin/mkdir /tmp/snort_blocked'); + exec('/sbin/pfctl -t snort2c -T show > /tmp/snort_block.pf'); + + $blocked_ips_array_save = str_replace(' ', '', array_filter(explode("\n", file_get_contents('/tmp/snort_block.pf')))); + + if ($blocked_ips_array_save[0] != '') + { + /* build the list */ + $counter = 0; + foreach($blocked_ips_array_save as $fileline3) + { + $counter++; + exec("/bin/echo $fileline3 >> /tmp/snort_blocked/snort_block.pf"); + } + } + + exec("/usr/bin/tar cfz /tmp/snort_blocked_{$save_date}.tar.gz /tmp/snort_blocked"); + + if (file_exists("/tmp/snort_blocked_{$save_date}.tar.gz")) { + echo " + { + \"snortdownload\": \"success\", + \"downloadfilename\": \"{$save_date}\" + } + "; + return true; + }else{ + return false; + } + +} + +// flush all ips from snort2c table +function snortRemoveBlockedIPs() { + + exec("/sbin/pfctl -t snort2c -T flush"); + + echo ' + { + "snortdelete": "success" + } + '; + return true; + +} + +/* returns true if $name is a valid name for a whitelist file name or ip */ +function is_validFileName($name) { + + if (empty($name)) { + return false; + } + + if (!is_string($name)) { + return false; + } + + if (preg_match("/\s+/", $name)) { + return false; + } + + if (!preg_match("/[^a-zA-Z0-9\-_]/", $name)) { + return true; + } + + return false; +} + +/* gen Alpha Num Mix for uuids or anything random, NEVER USE rand() */ +/* mt_rand/mt_srand is insecure way to gen random nums and strings, when posible use /dev/random or /dev/urandom */ +function genAlphaNumMixFast($min = 14, $max = 28) +{ + + // gen random lenth + mt_srand(crc32(microtime())); + $num = mt_rand($min, $max); + // reseed + mt_srand(); + + // Gen random string + $num = $num > 36 ? 30 : $num; + + $pool = array_merge(range('A', 'Z'), range(0, 9), range('a', 'z')); + + $rand_keys = array_rand($pool, $num); + + $randAlpaNum = ''; + + if (is_array($rand_keys)) { + foreach ($rand_keys as $key) + { + $randAlpaNum .= $pool[$key]; + } + }else{ + $randAlpaNum .= $pool[$rand_keys]; + } + + return str_shuffle($randAlpaNum); + +} + +// scan a dir, build array with filetr +function snortScanDirFilter($path, $filtername) +{ + // list rules in the default dir + $listDir = array(); + $listDir = scandir("{$path}"); + + if (empty($filtername)) { + + return $listDir; + + }else{ + + $pattern = "/{$filtername}/"; + foreach ( $listDir as $val ) + { + if (preg_match($pattern, $val)) { + $filterDirList[] = $val; + } + } + unset($listDir); + } + return $filterDirList; +} + +?> + diff --git a/config/snort-dev/snort_preprocessors.php b/config/snort-dev/snort_preprocessors.php new file mode 100644 index 00000000..d99f7f75 --- /dev/null +++ b/config/snort-dev/snort_preprocessors.php @@ -0,0 +1,337 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +$uuid = $_GET['uuid']; +if (isset($_POST['uuid'])) +$uuid = $_POST['uuid']; + +if ($uuid == '') { + echo 'error: no uuid'; + exit(0); +} + + +$a_list = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + + $pgtitle = "Snort: Interface Preprocessors and Flow"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    + + + +
    + +
    +
    + + + + + + + + +
    + +
    + +
    + +
    + + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      + Note: +
    + Rules may be dependent on preprocessors!
    + Defaults will be used when there is no user input.
    +
    Performance Statistics
    Enable + > + Performance Statistics for this interface. +
    HTTP Inspect Settings
    Enable + > + Use HTTP Inspect to Normalize/Decode and detect HTTP traffic and protocol anomalies. +
    HTTP server flow depth + + + + +
    + + -1 to 1460 (-1 disables HTTP inspect, 0 enables all HTTP inspect) +
    + Amount of HTTP server response payload to inspect. Snort's performance may increase by adjusting this value. +
    + Setting this value too low may cause false negatives. Values above 0 are specified in bytes. Default value is 0     +
    +
    Stream5 Settings
    Max Queued Bytes + + + + +
    + + Minimum is 1024, Maximum is 1073741824 ( default value is 1048576, 0means Maximum ) +
    + The number of bytes to be queued for reassembly for TCP sessions in memory. Default value is 1048576 +
    +
    Max Queued Segs + + + + +
    + + Minimum is 2, Maximum is 1073741824 ( default value is 2621, 0 means Maximum ) +
    + The number of segments to be queued for reassembly for TCP sessions in memory. Default value is 2621 +
    +
    General Preprocessor Settings
    + Enable
    + RPC Decode and Back Orifice detector +     		+ > +
    + Normalize/Decode RPC traffic and detects Back Orifice traffic on the network. +
    + Enable +
    + FTP and Telnet Normalizer +     		+ > +
    + Normalize/Decode FTP and Telnet traffic and protocol anomalies. +
    + Enable +
    + SMTP Normalizer +     		+ > +
    + Normalize/Decode SMTP protocol for enforcement and buffer overflows. +
    + Enable +
    + Portscan Detection +     		+ > +
    + Detects various types of portscans and portsweeps. +
    + Enable +
    + DCE/RPC2 Detection +     		+ > +
    + The DCE/RPC preprocessor detects and decodes SMB and DCE/RPC traffic. +
    + Enable +
    + DNS Detection +     		+ > +
    + The DNS preprocessor decodes DNS Response traffic and detects some vulnerabilities. +
    Define SSL_IGNORE + +
    + Encrypted traffic should be ignored by Snort for both performance reasons and to reduce false positives. +
    + Default: "443 465 563 636 989 990 992 993 994 995". Please use spaces and not commas.     +
      + + +
      + Note: Please save your settings before you click Start. +
    +
    +
    +
    + + + + + + + + diff --git a/config/snort-dev/snort_rules.php b/config/snort-dev/snort_rules.php new file mode 100644 index 00000000..fd102538 --- /dev/null +++ b/config/snort-dev/snort_rules.php @@ -0,0 +1,600 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { + echo 'Error: more than one uuid'; + exit(0); +} + +if (isset($_GET['uuid'])) { + $uuid = $_GET['uuid']; +} + +if (isset($_GET['rdbuuid'])) { + $rdbuuid = $_GET['rdbuuid']; +}else{ + $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + $rdbuuid = $ruledbname_pre1['ruledbname']; +} + +// unset Session tmp on page load +unset($_SESSION['snort']['tmp']); + +// list rules in the default dir +$a_list = snortSql_fetchAllSettings('snortDBrules', 'Snortrules', 'uuid', $rdbuuid); + +$snortRuleDir = '/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid; + + // list rules in the default dir + $filterDirList = array(); + $filterDirList = snortScanDirFilter($snortRuleDir . '/rules', '\.rules'); + + // START read rule file + if ($_GET['openruleset']) { + $rulefile = $_GET['openruleset']; + }else{ + $rulefile = $filterDirList[0]; + } + + // path of rule file + $workingFile = $snortRuleDir . '/rules/' . $rulefile; + +function load_rule_file($incoming_file, $splitcontents) +{ + $pattern = '/(^alert |^# alert )/'; + foreach ( $splitcontents as $val ) + { + // remove whitespaces + $rmWhitespaces = preg_replace('/\s\s+/', ' ', $val); + + // filter none alerts + if (preg_match($pattern, $rmWhitespaces)) + { + $splitcontents2[] = $val; + } + + } + unset($splitcontents); + + return $splitcontents2; + +} + + // Load the rule file + // split the contents of the string file into an array using the delimiter + // used by rule gui edit and table build code + if (filesize($workingFile) > 0) { + $splitcontents = split_rule_file($workingFile); + + $splitcontents2 = load_rule_file($workingFile, $splitcontents); + + $countSig = count($splitcontents2); + + if ($countSig > 0) { + $newFilterRuleSigArray = newFilterRuleSig($splitcontents2); + } + } + + /* + * SET GLOBAL ARRAY $_SESSION['snort'] + * Use SESSION instead POST for security because were writing to files. + */ + + $_SESSION['snort']['tmp']['snort_rules']['dbName'] = 'snortDBrules'; + $_SESSION['snort']['tmp']['snort_rules']['dbTable'] = 'SnortruleSigs'; + $_SESSION['snort']['tmp']['snort_rules']['rdbuuid'] = $rdbuuid; + $_SESSION['snort']['tmp']['snort_rules']['rulefile'] = $rulefile; + + +// find ./ -name test.txt | xargs grep "^disablesid 127 " + + $pgtitle = "Snort: Category: rule: $rulefile"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + +
    + +
    +
    + + + + + + + + + + + + + + +
    + + +
    + +
    + +
    + + + + +
    + + +
    +
    +
    + + +
    + + + +
    +
    + + + + + + '; + }else{ + echo ' + + + + + + + '; + } + ?> + + + +
    +
    + +
    +
    +
    + +
    +
    +
    + +
    +
    +
    + + + + + + + + + +
    + Category: + + There are rules in this category. + + + + +
    +
    + + + + + + +
    + + +
    + +
    + + + + +
    + + + + + + + +
    Snort Signatures:
    + + + + + + + + + + + + + + + + + + + + + + + + +
    OnSidProtoSrcPortDstPortMessage 
    +
    + + + + +
    + + +
    +
    +
    + + + + +
    +
    + +
    + + + +
    + +
    +
    + + + + + + + +
       
    + Note:
    + This is the Snort Rule Signature Viewer. + Please make sure not to add a whitespace before alert or #alert. +
    +
    + Warning: +
    + New settings will not take effect until interface restart. +

    +
    +
    +
    + + + + + + + + + + + + + diff --git a/config/snort-dev/snort_rules_ips.php b/config/snort-dev/snort_rules_ips.php new file mode 100644 index 00000000..d026b566 --- /dev/null +++ b/config/snort-dev/snort_rules_ips.php @@ -0,0 +1,471 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +// set page vars + +if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { + echo 'Error: more than one uuid'; + exit(0); +} + +// set page vars +if (isset($_GET['uuid'])) { + $uuid = $_GET['uuid']; +} + +if (isset($_GET['rdbuuid'])) { + $rdbuuid = $_GET['rdbuuid']; +}else{ + $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + $rdbuuid = $ruledbname_pre1['ruledbname']; +} + +if (empty($rdbuuid)) { + echo 'ERROR: Missing RDBUUID'; + exit; +} + +if (isset($_GET['rulefilename'])) { + $rulefilename = $_GET['rulefilename']; +}else{ + echo 'ERROR: Missing rulefilename'; + exit; +} + + + + +// get default settings +$listGenRules = array(); +$listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $rdbuuid); + +// get sigs in db +$listSigRules = array(); +$listSigRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleSigsIps', 'rdbuuid', $rdbuuid); + +// if $listGenRules empty list defaults +if (empty($listGenRules)) { + $listGenRules[0] = array( + 'id' => 1, + 'rdbuuid' => $_POST['rdbuuid'], + 'enable' => 'on', + 'who' => 'src', + 'timeamount' => 15, + 'timetype' => 'minutes' + ); +} + + $pgtitle = "Services: Snort: Ruleset Ips:"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + +
    +


    Please Wait...

    +
    + + + +
    + + + +
    + +
    +
    + + + + + + '; + }else{ + echo ' + + + + + + + '; + } + ?> + + + +
    +
    + +
    +
    +
    + +
    +
    +
    + +
    +
    + + +
    + + + +
    + + + + +
    + + + +
    + +
    +
    + + + + + + + + + + + + +
    Rule File Ips Settings
    + + + + + + + + + + + +
       On   Sid   Source   Amount   DurationMessage
    +
    + + + + +
    + + +
    +
    + + + + +
    +
    + + + +
    + + + + + + + + + + diff --git a/config/snort-dev/snort_rulesets.php b/config/snort-dev/snort_rulesets.php new file mode 100644 index 00000000..a2e4f7f3 --- /dev/null +++ b/config/snort-dev/snort_rulesets.php @@ -0,0 +1,347 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { + echo 'Error: more than one uuid'; + exit(0); +} + +// set page vars +if (isset($_GET['uuid'])) { + $uuid = $_GET['uuid']; +} + +if (isset($_GET['rdbuuid'])) { + $rdbuuid = $_GET['rdbuuid']; +}else{ + $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + $rdbuuid = $ruledbname_pre1['ruledbname']; +} + +//$a_list = snortSql_fetchAllSettings('snortDBrules', 'SnortIfaces', 'uuid', $uuid); + + // list rules in the default dir + $filterDirList = array(); + $filterDirList = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid . '/rules', '\.rules'); + + // list rules in db that are on in a array + $listOnRules = array(); + $listOnRules = snortSql_fetchAllSettings('snortDBrules', 'SnortRuleSets', 'rdbuuid', $rdbuuid); + + if (!empty($listOnRules)) { + foreach ( $listOnRules as $val2 ) + { + if ($val2['enable'] == 'on') { + $rulesetOn[] = $val2['rulesetname']; + } + } + unset($listOnRules); + } + + $pgtitle = "Snort: Interface Rule Categories"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    +
    transgif
    + + + + + + '; + }else{ + echo ' + + + + + + + '; + } + ?> + +
    +
    + +
    +
    +
    + +
    +
    +
    + +
    +
    + + + + + + + + + +
    + + + + + +
    + + + + +
    + + + +
    + +
    +
    + + + + + + + + + + + + + +
    EnabledRuleset: Rules that end with "so.rules" are shared object rules.
    + + + + + +
    + + + + +
    Check the rulesets that you would like Snort to load at startup.
    +
    + + +
    + Note: + Please save your settings before you click start. +
    + + + + +
    + + + + + + +
    + + + + + + + + diff --git a/config/snort-dev/snort_rulesets_ips.php b/config/snort-dev/snort_rulesets_ips.php new file mode 100644 index 00000000..abac2b6b --- /dev/null +++ b/config/snort-dev/snort_rulesets_ips.php @@ -0,0 +1,411 @@ +. + All rights reserved. + + Pfsense Old snort GUI + Copyright (C) 2006 Scott Ullrich. + + Pfsense snort GUI + Copyright (C) 2008-2012 Robert Zelaya. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. Neither the name of the pfSense nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + +*/ + +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort_new.inc"); +require_once("/usr/local/pkg/snort/snort_gui.inc"); + +//Set no caching +header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); +header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); +header("Cache-Control: no-store, no-cache, must-revalidate"); +header("Cache-Control: post-check=0, pre-check=0", false); +header("Pragma: no-cache"); + +if (isset($_GET['uuid']) && isset($_GET['rdbuuid'])) { + echo 'Error: more than one uuid'; + exit(0); +} + +// set page vars +if (isset($_GET['uuid'])) { + $uuid = $_GET['uuid']; +} + +if (isset($_GET['rdbuuid'])) { + $rdbuuid = $_GET['rdbuuid']; +}else{ + $ruledbname_pre1 = snortSql_fetchAllSettings('snortDB', 'SnortIfaces', 'uuid', $uuid); + $rdbuuid = $ruledbname_pre1['ruledbname']; +} + +//$a_list = snortSql_fetchAllSettings('snortDBrules', 'SnortIfaces', 'uuid', $uuid); + + // list rules in the default dir + $filterDirList = array(); + $filterDirList = snortScanDirFilter('/usr/local/etc/snort/snortDBrules/DB/' . $rdbuuid . '/rules', '\.rules'); + + // list rules in db that are on in a array + $listOnRules = array(); + $listOnRules = snortSql_fetchAllSettings('snortDBrules', 'SnortRuleSetsIps', 'rdbuuid', $rdbuuid); + + // list rules in db that are on in a array + $listGenRules = array(); + $listGenRules = snortSql_fetchAllSettings('snortDBrules', 'SnortruleGenIps', 'rdbuuid', $rdbuuid); + + if (!empty($listOnRules)) { + foreach ( $listOnRules as $val2 ) + { + if ($val2['enable'] == 'on') { + $rulesetOn[] = $val2['rulesetname']; + } + } + unset($listOnRules); + } + + $pgtitle = "Services: Snort: Ruleset Ips"; + include("/usr/local/pkg/snort/snort_head.inc"); + +?> + + + + + + + + + +
    +
    +
    + +
    +
    +



    Please Wait...

    +
    +
    +

    +
    +
    +
    + + + +
    +
    transgif
    + + + + + + '; + }else{ + echo ' + + + + + + + '; + } + ?> + +
    +
    + +
    +
    +
    + +
    +
    +
    + +
    +
    + + + + + + + + + +
    + + + +
    + + + + +
    + + + +
    + +
    +
    + + + + + + + + + + + +
    General Settings
    + + + + + +
    + + + + + + + + + + + + + + + + + +
       On   Source   Amount   Duration
    Default settings for all block rules + + type="checkbox"> + + + + + + + +
    +
    + + + + + + + + +
    EnabledSelect The Rulesets To Eable IPS On
    + + + + + +
    + + + + +
    Check the rulesets that you would like Snort to load at startup.
    +
    + + +
    + Note: + Please save your settings before you click start. +
    + + + + +
    + + + + + + +
    + + + + + + + + -- cgit v1.2.3