From ba505e58d599c400029815ea765ad0876bb5f5d7 Mon Sep 17 00:00:00 2001 From: robiscool Date: Tue, 16 Mar 2010 19:49:43 -0700 Subject: snort-dev, rewrote the major parts to be file independent, added uuid code, added, added new startup code --- config/snort-dev/NOTES.txt | 58 +---- config/snort-dev/snort.inc | 391 +++++++++++++++++------------ config/snort-dev/snort_barnyard.php | 2 + config/snort-dev/snort_define_servers.php | 2 + config/snort-dev/snort_gui.inc | 59 ++--- config/snort-dev/snort_interfaces.php | 140 +++++------ config/snort-dev/snort_interfaces_edit.php | 160 +++++++----- config/snort-dev/snort_preprocessors.php | 2 + 8 files changed, 422 insertions(+), 392 deletions(-) (limited to 'config') diff --git a/config/snort-dev/NOTES.txt b/config/snort-dev/NOTES.txt index b6c49926..88c80cb2 100644 --- a/config/snort-dev/NOTES.txt +++ b/config/snort-dev/NOTES.txt @@ -1,59 +1,19 @@ -November 18 2009 +March 16 2019 +Snort-dev 2.8.5.3 pk v. 12 Beta -Snort_inline due date is by Dec 1st. (Why ? Scott said so.) +Snort is Stoping/Starting with new UUID. Files are independent of rule order now. Ya me....... -Gui is almost done. just odds and ends left. +TODO: +The snort.sh code needs to be looked at and made sure there is a new file at every enabe/disbale save, +reboot, rule delete. -If you work on this package just comment on every-thing you change or add. +The snort_interfaces.php needs speed inprovments. !inportant. -==================== -Goals -==================== +Make sure I ad a reset button someware the removes all of snort-devs addd to config.xml -Release the New snort GUI as a package for 1.2.3 so that we can work out bugs. +Pierre POMES code needs to be added. -Move the Snort GUI to base of Pfsense. The divert options should be added to firewall_nat.php or firewall_rules.php. -Ask Ermal to add divert out to Pfsense again though, he has kept divert in. - -================================= -Any Devs that would like to help please work on snort_rules_edit.php and snort_rules.php. They work but need cleaning up. -================================= - -To get snort_rules_edit.php and snort_rules.php working - - * Update the rules. - * Add at least on rule to snort_interfaces.php. - -snort_rules_edit.php -Make sure all snort sig options that are in the GUI are written to file. - -snort_rules.php -Change the way the rules get disabled, by removing the x icon image and replacing it with check boxes. -This should improve the users experience. Moreover, check boxes could be added to blocked.php tab to improve performance. -Users always complain that the way were deleting options is slow. - -=========================================== -Misc. -=========================================== - -All further development will be in Freebsd 8. - -ALL further snort and barnyard builds will be mmx sse. - -All further snort builds will have snort_inline code. - -All further builds will have "did I start on a pfsense system" code, if not, exit. - -Adding extra options to the new snort gui for snort_inline should be easy. - -Snort_inline binaries with custom c++ code ready to go. - -Snort_inline works with only one Wan and Lan. Add a Opt onterface and the TCP flow goes into a loop. -This should be easy to fix by the firewall guru by modifying the divert rule I am using. - - - Done. \ No newline at end of file diff --git a/config/snort-dev/snort.inc b/config/snort-dev/snort.inc index 513fc626..b773b231 100644 --- a/config/snort-dev/snort.inc +++ b/config/snort-dev/snort.inc @@ -44,14 +44,40 @@ if ($pfsense_ver_chk == '1.2.3-RELEASE') $pfsense_stable = 'no'; } -/* Get id and realinterfaces */ +/* check if uniq snort proc is running */ +function uniq_snort_proc($id, $if_real) +{ + global $config, $g, $id, $if_real; + +$snort_uuid = $config['installedpackages']['snortglobal']['rule'][$id]['uuid']; +$snort_up_ck = exec("/bin/ps -auwx | /usr/bin/grep -v grep | /usr/bin/grep snort | /usr/bin/awk '{print \$2;}' | sed 1q"); + + if ($snort_up_ck == '') + { + $snort_up == 'false'; + } + + if ($snort_up_ck == '') + { + $snort_up = 'false'; + } + + if ($snort_up_ck != '') + { + $snort_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$snort_uuid}_{$if_real}\" | awk '{print \$1;}'"); -$id = $_GET['id']; -if (isset($_POST['id'])) - $id = $_POST['id']; + $snort_up_s = exec("/usr/bin/top -U snort -u | grep snort | grep {$snort_up_pre} | /usr/bin/awk '{print \$1;}'"); + $snort_up_r = exec("/usr/bin/top -U root -u | grep snort | grep {$snort_up_pre} | /usr/bin/awk '{print \$1;}'"); -$interface_fake = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; -$if_real = convert_friendly_interface_to_real_interface_name($interface_fake); + if ($snort_up_s != '' || $snort_up_r != '') + { + $snort_up = 'true'; + }else{ + $snort_up = 'false'; + } + return $snort_up; + } +} /* get the real iface name of wan */ function convert_friendly_interface_to_real_interface_name2($interface) @@ -420,6 +446,55 @@ function snort_rules_up_install_cron($should_install) { } } +function sync_snort_package_remove_old() +{ + + global $config, $g; + +$snort_dir_scan = '/usr/local/etc/snort'; + +// scan dirm might have to make this into a funtion +$dh_scan = opendir($snort_dir_scan); +while (false !== ($dir_filename = readdir($dh_scan))) { + $list_dir_files[] = $dir_filename; +} + +// find patern in a array, very cool code +class array_ereg { + function array_ereg($pattern) { $this->pattern = $pattern; } + function ereg($string) { + return ereg($this->pattern, $string); + } +} + + $rule_array2 = $config['installedpackages']['snortglobal']['rule']; + $id2 = -1; + foreach ($rule_array2 as $value) + { + + $id += 1; + + $result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; + $if_real = convert_friendly_interface_to_real_interface_name($result_lan); + + $snort_rules_list[] = "snort_$id$if_real"; + + } + + +$snort_dir_filter = array_filter($list_dir_files, array(new array_ereg("snort_"), 'ereg')); +$snort_dir_filter_search_result = array_diff($snort_dir_filter, $snort_rules_list); + + foreach ($snort_dir_filter_search_result as $value) + { + exec("rm -r /usr/local/etc/snort/$value"); + exec("echo \"rm -r /usr/local/etc/snort/$value\" >> /root/test.log"); + } + + exec("echo \"Function remove ....\" >> /root/test.log"); + +} + /* make sure this func on writes to files and does not start snort */ function sync_snort_package() { @@ -439,7 +514,9 @@ function sync_snort_package() exec("/usr/sbin/chown -R snort:snort /usr/local/lib/snort"); exec("/bin/chmod -R 755 /var/log/snort"); exec("/bin/chmod -R 755 /usr/local/etc/snort"); - exec("/bin/chmod -R 755 /usr/local/lib/snort"); + exec("/bin/chmod -R 755 /usr/local/lib/snort"); + + exec("echo \"Funtion sync package....\" >> /root/test.log"); conf_mount_ro(); } @@ -447,10 +524,7 @@ function sync_snort_package() /* make sure this func on writes to files and does not start snort */ function sync_snort_package_all() { - global $config, $g, $id, $if_real, $interface_fake; - conf_mount_rw(); - - + global $config, $g, $id, $if_real, $snort_uuid, $interface_fake; /* RedDevil suggested code */ /* TODO: more testing needs to be done */ @@ -459,112 +533,37 @@ exec("/sbin/sysctl net.bpf.maxbufsize=4194304"); exec("/sbin/sysctl net.bpf.maxinsns=512"); exec("/sbin/sysctl net.inet.tcp.rfc1323=1"); -if ($id != '' && $if_real != '') +# Error checking +if ($id != '' && $if_real != '') //new { - /* do not start config build if rules is empty */ if (!empty($config['installedpackages']['snortglobal']['rule'])) { - if ($id == "") - { - $rule_array = $config['installedpackages']['snortglobal']['rule']; - $id = -1; - foreach ($rule_array as $value) - { - - $id += 1; + conf_mount_rw(); + $snort_uuid = $config['installedpackages']['snortglobal']['rule'][$id]['uuid']; $result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; $if_real = convert_friendly_interface_to_real_interface_name($result_lan); /* create snort configuration file */ - create_snort_conf(); - - /* create snort bootup file snort.sh */ - create_snort_sh(); + create_snort_conf($id, $if_real, $snort_uuid); /* if rules exist cp rules to each iface */ - create_rules_iface(); + create_rules_iface($id, $if_real, $snort_uuid); /* create barnyard2 configuration file */ $snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable']; if ($snortbarnyardlog_info_chk == 'on') - create_barnyard2_conf(); - - } - - }else{ + create_barnyard2_conf($id, $if_real, $snort_uuid); - /* create snort configuration file */ - create_snort_conf(); - - /* create snort bootup file snort.sh */ - create_snort_sh(); - - /* if rules exist cp rules to each iface */ - create_rules_iface(); - - /* create barnyard2 configuration file */ - $snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable']; - if ($snortbarnyardlog_info_chk == on) - { - create_barnyard2_conf(); - } + exec("echo \"Funtion sync all $id $if_real $snort_uuid....\" >> /root/test.log"); + conf_mount_ro(); } } - - /* all new files are for the user snort nologin */ - if(!file_exists("/var/log/snort")) - { - exec("/bin/mkdir -p /var/log/snort"); - } - - exec("/usr/sbin/chown -R snort:snort /var/log/snort"); - exec("/usr/sbin/chown -R snort:snort /usr/local/etc/snort"); - exec("/usr/sbin/chown -R snort:snort /usr/local/lib/snort"); - exec("/bin/chmod -R 755 /var/log/snort"); - exec("/bin/chmod -R 755 /usr/local/etc/snort"); - exec("/bin/chmod -R 755 /usr/local/lib/snort"); - - /* Generate the snort instance list */ - $rc_snort = ""; - $i = 0; - $rules = &$config['installedpackages']['snortglobal']['rule']; - foreach($rules as $snort) { - $name = "${i}${if_real}"; - $if_real = convert_friendly_interface_to_real_interface_name($snort['interface']); - $rc_snort .= "snort_list=\"\${snort_list} ${name}\"\n"; - $rc_snort .= "snort_${name}_conf=\"/usr/local/etc/snort/snort_${name}/snort.conf\"\n"; - $rc_snort .= "snort_${name}_name=\"${name}\"\n"; - $rc_snort .= "snort_${name}_id=\"${i}\"\n"; - $rc_snort .= "snort_${name}_interface=\"${if_real}\"\n"; - - $snortenable_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['enable']; - if ($snortenable_info_chk == 'on') - $rc_snort .= "snort_${name}_enable=\"YES\"\n"; - else - $rc_snort .= "snort_${name}_enable=\"NO\"\n"; - - $snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable']; - if ($snortbarnyardlog_info_chk == 'on') - $rc_snort .= "snort_${name}_barnyard=\"YES\"\n"; - $i++; - } - $rcconf = fopen("/var/etc/rc.snort", "w"); - if(!$rcconf) { - log_error("Could not open /var/etc/rc.snort for writing."); - exit; - } - fwrite($rcconf, $rc_snort); - fclose($rcconf); - - - conf_mount_ro(); - -} } + /* Start of main config files */ /* Start of main config files */ @@ -576,15 +575,17 @@ function create_snort_sh() { # Don not add $id or this will break - global $config, $g, $if_real, $if_real_wan; + global $config, $g; conf_mount_rw(); +exec("echo \"Craete snort.sh $snort_uuid $if_real $id....\" >> /root/test.log"); + $snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_enable']; /* define snortbarnyardlog_chk */ if ($snortbarnyardlog_info_chk == on) { - $start_barnyard2 = "sleep 4/n/usr/local/bin/barnyard2 -u snort -g snort -c /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf -d /var/log/snort -f snort.u2_$id$if_real -w /usr/local/etc/snort/snort_$id$if_real/barnyard2.waldo -D -q"; + $start_barnyard2 = "sleep 4/n/usr/local/bin/barnyard2 -u snort -g snort -c /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf -d /var/log/snort -f snort.u2_{$snort_uuid}_{$if_real} -w /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.waldo -D -q"; } @@ -600,7 +601,8 @@ function create_snort_sh() { $id += 1; - + + $snort_uuid = $config['installedpackages']['snortglobal']['rule'][$id]['uuid']; $result_lan = $config['installedpackages']['snortglobal']['rule'][$id]['interface']; $if_real = convert_friendly_interface_to_real_interface_name($result_lan); @@ -610,18 +612,18 @@ $snort_sh_text2[] = << /tmp/snort.sh.pid # Start snort and barnyard2 - /bin/rm /var/run/snort_$if_real$id$if_real.pid - /bin/rm /var/run/snort_$if_real$id$if_real.pid.lck + /bin/rm /var/run/snort_{$snort_uuid}_{$if_real}.pid + /bin/rm /var/run/snort_{$snort_uuid}_{$if_real}.pid.lck - /usr/local/bin/snort -u snort -g snort -R $id$if_real -D -q -l /var/log/snort -G $id -c /usr/local/etc/snort/snort_$id$if_real/snort.conf -i $if_real + /usr/local/bin/snort -u snort -g snort -R {$snort_uuid}_{$if_real} -D -q -l /var/log/snort -G {$snort_uuid} -c /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real} $start_barnyard2 - /usr/bin/logger -p daemon.info -i -t SnortStartup "Snort HARD Reload For $id$if_real..." + /usr/bin/logger -p daemon.info -i -t SnortStartup "Snort HARD Reload For {$snort_uuid}_{$if_real}..." fi EOD; @@ -632,9 +634,9 @@ $snort_sh_text3[] = << /tmp/snort.sh.pid - /usr/bin/logger -p daemon.info -i -t SnortStartup "Snort HARD STOP For $id$if_real..." + /usr/bin/logger -p daemon.info -i -t SnortStartup "Snort HARD STOP For {$snort_uuid}_{$if_real}..." /bin/kill \${pid_s} sleep 3 /bin/kill \${pid_b} - /bin/rm /var/run/snort_$if_real$id$if_real.pid.lck - /bin/rm /var/run/snort_$if_real$id$if_real.pid + /bin/rm /var/run/snort_{$snort_uuid}_{$if_real}.pid.lck + /bin/rm /var/run/snort_{$snort_uuid}_{$if_real}.pid fi @@ -674,6 +676,7 @@ EOF; } } + $start_snort_iface_start = implode("\n\n", $snort_sh_text2); $start_snort_iface_restart = implode("\n\n", $snort_sh_text3); @@ -707,7 +710,7 @@ $start_snort_iface_restart /bin/rm /tmp/snort.sh.pid #### If on Fake start snort is NOT running DO a real start. - if [ "`/bin/ps -auwx | grep -v grep | grep "R $id$if_real" | awk '{print $2;}'`" = "" ]; then + if [ "`/bin/ps -auwx | grep -v grep | grep "R {$snort_uuid}_{$if_real}" | awk '{print $2;}'`" = "" ]; then rc_start_real @@ -777,26 +780,27 @@ EOD; ///////////////////////// >>>>>>>>>>>> /* if rules exist copy to new interfaces */ -function create_rules_iface() +function create_rules_iface($id, $if_real, $snort_uuid) { - global $config, $g, $id, $if_real; + global $config, $g; conf_mount_rw(); + +exec("echo \"Create rules $snort_uuid $if_real $id ....\" >> /root/test.log"); - if ($id != '' || $if_real != '') - { - $if_rule_dir = "/usr/local/etc/snort/snort_$id$if_real/rules"; + + $if_rule_dir = "/usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/rules"; $folder_chk = (count(glob("$if_rule_dir/*")) === 0) ? 'empty' : 'full'; if ($folder_chk == "empty") { - exec("/bin/cp -R /usr/local/etc/snort/rules /usr/local/etc/snort/snort_$id$if_real"); - if (file_exists("/usr/local/etc/snort/custom_rules/local_$id$if_real.rules")) + exec("/bin/cp -R /usr/local/etc/snort/rules /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}"); + if (file_exists("/usr/local/etc/snort/custom_rules/local_{$snort_uuid}_{$if_real}.rules")) { - exec("/bin/cp /usr/local/etc/snort/custom_rules/local_$id$if_real.rules /usr/local/etc/snort/snort_$id$if_real/rules/local_$id$if_real.rules"); + exec("/bin/cp /usr/local/etc/snort/custom_rules/local_{$snort_uuid}_{$if_real}.rules /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/rules/local_{$snort_uuid}_{$if_real}.rules"); } } - } + } /* open barnyard2.conf for writing */ @@ -804,15 +808,17 @@ function create_barnyard2_conf() { global $bconfig, $bg, $id, $if_real; /* write out barnyard2_conf */ - if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/barnyard2.conf")) +exec("echo \"Create barnyard.conf $if_real $id....\" >> /root/test.log"); + + if(!file_exists("/usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf")) { - exec("/bin//usr/bin/touch /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf"); + exec("/bin//usr/bin/touch /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf"); } $barnyard2_conf_text = generate_barnyard2_conf(); - $bconf = fopen("/usr/local/etc/snort/snort_$id$if_real/barnyard2.conf", "w"); + $bconf = fopen("/usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf", "w"); if(!$bconf) { - log_error("Could not open /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf for writing."); + log_error("Could not open /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf for writing."); exit; } fwrite($bconf, $barnyard2_conf_text); @@ -831,8 +837,6 @@ function generate_barnyard2_conf() { $snortbarnyardlog_database_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['barnyard_mysql']; $snortbarnyardlog_hostname_info_chk = exec("/bin/hostname"); -$snortbarnyardlog_interface_info_chk = $if_real; - $barnyard2_conf_text = <<> /root/test.log"); + + $snort_conf_text = generate_snort_conf($id, $if_real, $snort_uuid); conf_mount_rw(); - $conf = fopen("/usr/local/etc/snort/snort_$id$if_real/snort.conf", "w"); + $conf = fopen("/usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/snort.conf", "w"); if(!$conf) { - log_error("Could not open /usr/local/etc/snort/$id$if_real/snort.conf for writing."); + log_error("Could not open /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/snort.conf for writing."); exit; } fwrite($conf, $snort_conf_text); fclose($conf); conf_mount_ro(); + + } function snort_deinstall() @@ -905,6 +915,8 @@ function snort_deinstall() global $config, $g, $id, $if_real; conf_mount_rw(); +exec("echo \"Snort Deinstall $if_real $id....\" >> /root/test.log"); + /* remove custom sysctl */ remove_text_from_file("/etc/sysctl.conf", "sysctl net.bpf.bufsize=20480"); /* decrease bpf buffers back to 4096, from 20480 */ @@ -924,12 +936,15 @@ function snort_deinstall() exec("cd /var/db/pkg && pkg_delete `ls | grep snort`"); /* Remove snort cron entries Ugly code needs smoothness*/ - +} + function snort_rm_blocked_deinstall_cron($should_install) { global $config, $g; conf_mount_rw(); +exec("echo \"Deinstall cron block....\" >> /root/test.log"); + $is_installed = false; if(!$config['cron']['item']) @@ -963,10 +978,13 @@ function snort_rm_blocked_deinstall_cron($should_install) } - function snort_rules_up_deinstall_cron($should_install) { + function snort_rules_up_deinstall_cron($should_install) +{ global $config, $g; conf_mount_rw(); +exec("echo \"Deinstall rules up ....\" >> /root/test.log"); + $is_installed = false; if(!$config['cron']['item']) @@ -988,7 +1006,6 @@ function snort_rm_blocked_deinstall_cron($should_install) } configure_cron(); } - } snort_rm_blocked_deinstall_cron(""); snort_rules_up_deinstall_cron(""); @@ -1008,14 +1025,13 @@ snort_rules_up_deinstall_cron(""); } -function generate_snort_conf() +function generate_snort_conf($id, $if_real, $snort_uuid) { - global $config, $g, $if_real, $id; + global $config, $g, $id, $if_real, $snort_uuid; conf_mount_rw(); -if ($id != '' && $if_real != '') -{ +exec("echo \"Generate snort.conf $snort_uuid $if_real $id....\" >> /root/test.log"); /* obtain external interface */ /* XXX: make multi wan friendly */ @@ -1024,25 +1040,24 @@ if ($id != '' && $if_real != '') // $snort_config_pass_thru = $config['installedpackages']['snortglobal']['rule'][$id]['configpassthru']; /* create basic files */ - if(!file_exists("/usr/local/etc/snort/snort/snort_$id$if_real")) + if(!file_exists("/usr/local/etc/snort/snort/snort_{$snort_uuid}_{$if_real}")) { - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/"); - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); + exec("/bin/mkdir -p /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/"); + exec("/bin/mkdir -p /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/rules"); - if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/gen-msg.map")) + if(!file_exists("/usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/gen-msg.map")) { - exec("/bin/cp /usr/local/etc/snort/classification.config /usr/local/etc/snort/snort_$id$if_real/classification.config"); - exec("/bin/cp /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/snort_$id$if_real/gen-msg.map"); - exec("/bin/cp /usr/local/etc/snort/reference.config /usr/local/etc/snort/snort_$id$if_real/reference.config"); - exec("/bin/cp /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/snort_$id$if_real/sid-msg.map"); - exec("/bin/cp /usr/local/etc/snort/unicode.map /usr/local/etc/snort/snort_$id$if_real/unicode.map"); - exec("/bin/cp /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/snort_$id$if_real/threshold.conf"); - exec("/bin/cp /usr/local/etc/snort/snort.conf /usr/local/etc/snort/snort_$id$if_real/snort.conf"); - exec("/bin//usr/bin/touch /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf"); - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); + exec("/bin/cp /usr/local/etc/snort/classification.config /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/classification.config"); + exec("/bin/cp /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/gen-msg.map"); + exec("/bin/cp /usr/local/etc/snort/reference.config /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/reference.config"); + exec("/bin/cp /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/sid-msg.map"); + exec("/bin/cp /usr/local/etc/snort/unicode.map /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/unicode.map"); + exec("/bin/cp /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/threshold.conf"); + exec("/bin/cp /usr/local/etc/snort/snort.conf /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/snort.conf"); + exec("/bin/cp/usr/bin/touch /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/barnyard2.conf"); + exec("/bin/mkdir -p /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/rules"); } } -} /* define snortalertlogtype */ $snortalertlogtype = $config['installedpackages']['snortglobal']['snortalertlogtype']; @@ -1064,7 +1079,7 @@ if ($tcpdumplog_info_chk == on) /* define snortunifiedlog */ $snortunifiedlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['snortunifiedlog']; if ($snortunifiedlog_info_chk == on) - $snortunifiedlog_type = "output unified2: filename snort.u2_$id$if_real, limit 128"; + $snortunifiedlog_type = "output unified2: filename snort.u2_{$snort_uuid}_{$if_real}, limit 128"; /* define spoink (DISABLED)*/ $spoink_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['blockoffenders7']; @@ -1321,7 +1336,7 @@ else if($config['installedpackages']['snortglobal']['rule'][$id]['performance']) $snort_performance = $config['installedpackages']['snortglobal']['rule'][$id]['performance']; else - $snort_performance = "lowmem"; + $snort_performance = "ac-bnfa"; /* open snort's whitelist for writing */ $whitelist = fopen("/var/db/whitelist", "w"); @@ -1452,7 +1467,7 @@ $snort_perform_stat = <<> /root/test.log"); + + } + } + } +} + /* check downloaded text from snort.org to make sure that an error did not occur * for example, if you are not a premium subscriber you can only download rules * so often, etc. TO BE: Removed unneeded. */ + function check_for_common_errors($filename) { global $snort_filename, $snort_filename_md5, $console_mode; - ob_flush(); + +// ob_flush(); $contents = file_get_contents($filename); if(stristr($contents, "You don't have permission")) { if(!$console_mode) { diff --git a/config/snort-dev/snort_barnyard.php b/config/snort-dev/snort_barnyard.php index 10afa183..667de21a 100644 --- a/config/snort-dev/snort_barnyard.php +++ b/config/snort-dev/snort_barnyard.php @@ -105,6 +105,7 @@ if (isset($id) && $a_nat[$id]) { $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; $pconfig['enable'] = $a_nat[$id]['enable']; + $pconfig['uuid'] = $a_nat[$id]['uuid']; $pconfig['interface'] = $a_nat[$id]['interface']; $pconfig['descr'] = $a_nat[$id]['descr']; $pconfig['performance'] = $a_nat[$id]['performance']; @@ -144,6 +145,7 @@ if ($_POST) { if ($pconfig['interface'] != "") { $natent['interface'] = $pconfig['interface']; } if ($pconfig['enable'] != "") { $natent['enable'] = $pconfig['enable']; } + if ($pconfig['uuid'] != "") { $natent['uuid'] = $pconfig['uuid']; } if ($pconfig['descr'] != "") { $natent['descr'] = $pconfig['descr']; } if ($pconfig['performance'] != "") { $natent['performance'] = $pconfig['performance']; } if ($pconfig['blockoffenders7'] != "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } diff --git a/config/snort-dev/snort_define_servers.php b/config/snort-dev/snort_define_servers.php index a2cafc05..550cf153 100644 --- a/config/snort-dev/snort_define_servers.php +++ b/config/snort-dev/snort_define_servers.php @@ -105,6 +105,7 @@ if (isset($id) && $a_nat[$id]) { $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; $pconfig['enable'] = $a_nat[$id]['enable']; + $pconfig['uuid'] = $a_nat[$id]['uuid']; $pconfig['interface'] = $a_nat[$id]['interface']; $pconfig['descr'] = $a_nat[$id]['descr']; $pconfig['performance'] = $a_nat[$id]['performance']; @@ -133,6 +134,7 @@ if ($_POST) { /* repost the options already in conf */ if ($pconfig['interface'] != "") { $natent['interface'] = $pconfig['interface']; } if ($pconfig['enable'] != "") { $natent['enable'] = $pconfig['enable']; } + if ($pconfig['uuid'] != "") { $natent['uuid'] = $pconfig['uuid']; } if ($pconfig['descr'] != "") { $natent['descr'] = $pconfig['descr']; } if ($pconfig['performance'] != "") { $natent['performance'] = $pconfig['performance']; } if ($pconfig['blockoffenders7'] != "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } diff --git a/config/snort-dev/snort_gui.inc b/config/snort-dev/snort_gui.inc index 1746ab54..c485d1ac 100644 --- a/config/snort-dev/snort_gui.inc +++ b/config/snort-dev/snort_gui.inc @@ -29,37 +29,40 @@ POSSIBILITY OF SUCH DAMAGE. */ -function print_info_box_np2($msg) { - global $g; - echo "\n"; - echo " \n"; - echo " \n"; - echo "
\n"; - echo "
\n"; - echo " \n"; - echo " "; - echo "
\n"; - echo "    \n"; - echo " {$msg}\n"; - echo "
\n"; - echo "
\n"; - echo "
\n"; - echo "\n"; - echo "\n
\n"; -} - - - - - - +include_once("/usr/local/pkg/snort/snort.inc"); +function print_info_box_np2($msg) { + global $config, $g; + + echo "\n"; + echo " \n"; + echo " \n"; + echo "
\n"; + echo "
\n"; + echo " \n"; + echo " "; + if(stristr($msg, "apply") == true) { + echo " "; + } + echo "
\n"; + echo "    \n"; + echo " {$msg}\n"; + echo " "; + echo " \n"; + echo "
\n"; + echo "
\n"; + echo "
\n"; + echo "\n"; + echo "\n
\n"; + + exec("echo \"Funtion print info ....\" >> /root/test.log"); +} ?> \ No newline at end of file diff --git a/config/snort-dev/snort_interfaces.php b/config/snort-dev/snort_interfaces.php index 996ff83b..e2cf9fdb 100644 --- a/config/snort-dev/snort_interfaces.php +++ b/config/snort-dev/snort_interfaces.php @@ -42,6 +42,16 @@ if (!is_array($config['installedpackages']['snortglobal']['rule'])) $a_nat = &$config['installedpackages']['snortglobal']['rule']; +/////////// + +if (isset($config['installedpackages']['snortglobal']['rule'])) { +$id_gen = count($config['installedpackages']['snortglobal']['rule']); +}else{ +$id_gen = '0'; +} + +/////////// + /* if a custom message has been passed along, lets process it */ if ($_GET['savemsg']) $savemsg = $_GET['savemsg']; @@ -71,6 +81,8 @@ if ($_POST) { unlink($d_filterconfdirty_path); } + exec("echo \"Sync Empty on POST on interfaces.php....\" >> /root/test.log"); + } } @@ -81,17 +93,19 @@ if (isset($_POST['del_x'])) { /* convert fake interfaces to real */ $if_real = convert_friendly_interface_to_real_interface_name($a_nat[$rulei]['interface']); + $snort_uuid = $a_nat[$rulei]['uuid']; + + /* cool code to check if any snort is up */ + $snort_up_ck = exec("/bin/ps -auwx | /usr/bin/grep -v grep | /usr/bin/grep snort | /usr/bin/awk '{print \$2;}' | sed 1q"); - $snort_pid = exec("/bin/ps -auwx | grep -v grep | grep \"$if_real -c\" | awk '{print $2;}'"); - - if ($snort_pid != "") + if ($snort_up_ck != "") { - $start_up_pre = exec("/bin/cat /var/run/snort_{$if_real}{$rulei}{$if_real}.pid"); + $start_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$snort_uuid}_{$if_real}\" | awk '{print \$1;}'"); $start_up_s = exec("/usr/bin/top -U snort -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); $start_up_r = exec("/usr/bin/top -U root -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); - $start2_upb_pre = exec("/bin/cat /var/run/barnyard2_{$rulei}{$if_real}.pid"); + $start2_upb_pre = exec("/bin/cat /var/run/barnyard2_{$snort_uuid}_{$if_real}.pid"); $start2_upb_s = exec("/usr/bin/top -U snort -u | grep barnyard2 | grep {$start2_upb_pre} | awk '{ print $1; }'"); $start2_upb_r = exec("/usr/bin/top -U root -u | grep barnyard2 | grep {$start2_upb_pre} | awk '{ print $1; }'"); @@ -100,113 +114,68 @@ if (isset($_POST['del_x'])) { { /* dont flood the syslog code */ - exec("/bin/cp /var/log/system.log /var/log/system.log.bk"); - sleep(3); + //exec("/bin/cp /var/log/system.log /var/log/system.log.bk"); + //sleep(3); /* remove only running instances */ if ($start_up_s != "") { exec("/bin/kill {$start_up_s}"); - exec("/bin/rm /var/run/snort_$if_real$rulei$if_real*"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real}*"); } if ($start2_upb_s != "") { exec("/bin/kill {$start2_upb_s}"); - exec("/bin/rm /var/run/barnyard2_$rulei$if_real*"); + exec("/bin/rm /var/run/barnyard2_{$snort_uuid}_{$if_real}*"); } if ($start_up_r != "") { exec("/bin/kill {$start_up_r}"); - exec("/bin/rm /var/run/snort_$if_real$rulei$if_real*"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real}*"); } if ($start2_upb_r != "") { exec("/bin/kill {$start2_upb_r}"); - exec("/bin/rm /var/run/barnyard2_$rulei$if_real*"); + exec("/bin/rm /var/run/barnyard2_{$snort_uuid}_{$if_real}*"); } /* stop syslog flood code */ - $if_real_wan_rulei = $a_nat[$rulei]['interface']; - $if_real_wan_rulei2 = convert_friendly_interface_to_real_interface_name2($if_real_wan_rulei); - exec("/sbin/ifconfig $if_real_wan_rulei2 -promisc"); - exec("/bin/cp /var/log/system.log /var/log/snort/snort_sys_$rulei$if_real.log"); - exec("/usr/bin/killall syslogd"); - exec("/usr/sbin/clog -i -s 262144 /var/log/system.log"); - exec("/usr/sbin/syslogd -c -ss -f /var/etc/syslog.conf"); - sleep(2); - exec("/bin/cp /var/log/system.log.bk /var/log/system.log"); - $after_mem = exec("/usr/bin/top | /usr/bin/grep Wired | /usr/bin/awk '{ print $2 }'"); - exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'MEM after {$rulei}{$if_real} STOP {$after_mem}'"); - exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'Interface Rule removed for {$rulei}{$if_real}...'"); + //$if_real_wan_rulei = $a_nat[$rulei]['interface']; + //$if_real_wan_rulei2 = convert_friendly_interface_to_real_interface_name2($if_real_wan_rulei); + //exec("/sbin/ifconfig $if_real_wan_rulei2 -promisc"); + //exec("/bin/cp /var/log/system.log /var/log/snort/snort_sys_$rulei$if_real.log"); + //exec("/usr/bin/killall syslogd"); + //exec("/usr/sbin/clog -i -s 262144 /var/log/system.log"); + //exec("/usr/sbin/syslogd -c -ss -f /var/etc/syslog.conf"); + //sleep(2); + //exec("/bin/cp /var/log/system.log.bk /var/log/system.log"); + //$after_mem = exec("/usr/bin/top | /usr/bin/grep Wired | /usr/bin/awk '{ print $2 }'"); + //exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'MEM after {$rulei}{$if_real} STOP {$after_mem}'"); + //exec("/usr/bin/logger -p daemon.info -i -t SnortStartup 'Interface Rule removed for {$rulei}{$if_real}...'"); } } unset($a_nat[$rulei]); - } + exec("echo \"Removing old files ....\" >> /root/test.log"); conf_mount_rw(); - exec("/bin/rm -r /usr/local/etc/snort/snort_$rulei$if_real"); - exec("/bin/rm /usr/local/etc/rc.d/snort_$rulei$if_real.sh"); - exec("/bin/rm /var/log/snort/snort.u2_$rulei$if_real*"); + exec("/bin/rm /var/log/snort/snort.u2_{$snort_uuid}_{$if_real}*"); + exec("/bin/rm -r /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}"); conf_mount_ro(); write_config(); - // touch($d_natconfdirty_path); + touch($d_natconfdirty_path); header("Location: /snort/snort_interfaces.php"); exit; } -} else { - - /* yuck - IE won't send value attributes for image buttons, while Mozilla does - so we use .x/.y to find move button clicks instead... */ - unset($movebtn); - foreach ($_POST as $pn => $pd) { - if (preg_match("/move_(\d+)_x/", $pn, $matches)) { - $movebtn = $matches[1]; - break; - } - } - /* move selected rules before this rule */ - if (isset($movebtn) && is_array($_POST['rule']) && count($_POST['rule'])) { - $a_nat_new = array(); - - /* copy all rules < $movebtn and not selected */ - for ($i = 0; $i < $movebtn; $i++) { - if (!in_array($i, $_POST['rule'])) - $a_nat_new[] = $a_nat[$i]; - } - - /* copy all selected rules */ - for ($i = 0; $i < count($a_nat); $i++) { - if ($i == $movebtn) - continue; - if (in_array($i, $_POST['rule'])) - $a_nat_new[] = $a_nat[$i]; - } - - /* copy $movebtn rule */ - if ($movebtn < count($a_nat)) - $a_nat_new[] = $a_nat[$movebtn]; - - /* copy all rules > $movebtn and not selected */ - for ($i = $movebtn+1; $i < count($a_nat); $i++) { - if (!in_array($i, $_POST['rule'])) - $a_nat_new[] = $a_nat[$i]; - } - $a_nat = $a_nat_new; - write_config(); - touch($d_natconfdirty_path); - header("Location: snort_interfaces.php"); - - exit; - } } @@ -215,8 +184,10 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") { $if_real2 = convert_friendly_interface_to_real_interface_name($a_nat[$id]['interface']); + + $snort_uuid = $a_nat[$id]['uuid']; - $start_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$id}{$if_real2}\" | awk '{print \$1;}'"); + $start_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$snort_uuid}_{$if_real2}\" | awk '{print \$1;}'"); $start_up_s = exec("/usr/bin/top -U snort -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); $start_up_r = exec("/usr/bin/top -U root -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); @@ -235,7 +206,7 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") if ($start_up_s != "") { exec("/bin/kill {$start_up_s}"); - exec("/bin/rm /var/run/snort_$if_real2$id$if_real2*"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real2}*"); } //if ($start2_upb_s != "") @@ -247,7 +218,7 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") if ($start_up_r != "") { exec("/bin/kill {$start_up_r}"); - exec("/bin/rm /var/run/snort_$if_real2$id$if_real2*"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real2}*"); } //if ($start2_upb_r != "") @@ -280,9 +251,9 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") header("Location: /snort/snort_interfaces.php"); }else{ - sync_snort_package_all(); + //sync_snort_package_all(); - exec("/usr/local/bin/snort -u snort -g snort -R \"$id$if_real2\" -D -q -l /var/log/snort -G $id -c /usr/local/etc/snort/snort_$id$if_real2/snort.conf -i $if_real2"); + exec("/usr/local/bin/snort -u snort -g snort -R \"{$snort_uuid}_{$if_real2}\" -D -q -l /var/log/snort -G {$snort_uuid} -c /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real2}/snort.conf -i {$if_real2}"); //print_r("$id $if_real2"); header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); @@ -296,7 +267,7 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") } -$pgtitle = "Services: Snort 2.8.5.3 pkg v. 1.10 alpha"; +$pgtitle = "Services: Snort 2.8.5.3 pkg v. 1.12 Beta"; include("head.inc"); ?> @@ -353,12 +324,12 @@ padding: 15px 10px 50% 50px; padding-left: 0px; } - - + + + +
-

- + @@ -410,6 +381,7 @@ padding: 15px 10px 50% 50px; /* convert fake interfaces to real and check if iface is up */ /* There has to be a smarter way to do this */ $if_real = convert_friendly_interface_to_real_interface_name($natent['interface']); + $snort_uuid = $natent['uuid']; $color_up_ck = exec("/bin/ps -auwx | /usr/bin/grep -v grep | /usr/bin/grep snort | /usr/bin/awk '{print \$2;}' | sed 1q"); @@ -422,7 +394,7 @@ padding: 15px 10px 50% 50px; if ($color_up_ck != "") { //$color_up_pre = exec("/bin/cat /var/run/snort_{$if_real}{$nnats}{$if_real}.pid"); - $color_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R $nnats$if_real\" | awk '{print \$1;}'"); + $color_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$snort_uuid}_{$if_real}\" | awk '{print \$1;}'"); // /bin/ps -auwx | grep -v grep | grep "$id$if_real -c" | awk '{print $2;}' $color_up_s = exec("/usr/bin/top -U snort -u | grep snort | grep {$color_up_pre} | /usr/bin/awk '{print \$1;}'"); diff --git a/config/snort-dev/snort_interfaces_edit.php b/config/snort-dev/snort_interfaces_edit.php index 6bdb0dc7..f67cb828 100644 --- a/config/snort-dev/snort_interfaces_edit.php +++ b/config/snort-dev/snort_interfaces_edit.php @@ -48,6 +48,25 @@ if (isset($_GET['dup'])) { $after = $_GET['dup']; } +/* always have a limit of (65535) numbers only or snort will not start do to id limits */ +/* TODO: When inline gets added make the uuid the port number lisstening */ +//function gen_snort_uuid($fileline) +//{ + /* return the first 5 */ + //if (preg_match("/...../", $fileline, $matches1)) + //{ + //$uuid_final = "$matches1[0]"; + //} +//return $uuid_final; +//} + +/* gen uuid for each iface !inportant */ +if ($a_nat[$id]['interface'] == '') { + //$snort_uuid = gen_snort_uuid(strrev(uniqid(true))); + $snort_uuid = mt_rand(0, 65534); + $pconfig['uuid'] = $snort_uuid; +} + if (isset($id) && $a_nat[$id]) { /* old options */ @@ -97,10 +116,12 @@ if (isset($id) && $a_nat[$id]) { $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; $pconfig['enable'] = $a_nat[$id]['enable']; + $pconfig['uuid'] = $a_nat[$id]['uuid']; $pconfig['interface'] = $a_nat[$id]['interface']; $pconfig['descr'] = $a_nat[$id]['descr']; $pconfig['performance'] = $a_nat[$id]['performance']; $pconfig['blockoffenders7'] = $a_nat[$id]['blockoffenders7']; + $pconfig['snortalertlogtype'] = $a_nat[$id]['snortalertlogtype']; $pconfig['alertsystemlog'] = $a_nat[$id]['alertsystemlog']; $pconfig['tcpdumplog'] = $a_nat[$id]['tcpdumplog']; $pconfig['snortunifiedlog'] = $a_nat[$id]['snortunifiedlog']; @@ -121,7 +142,7 @@ if (isset($_GET['dup'])) /* convert fake interfaces to real */ $if_real = convert_friendly_interface_to_real_interface_name($pconfig['interface']); -if ($_POST['Submit']) { +if ($_POST["Submit"]) { /* input validation */ // if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") { @@ -167,26 +188,26 @@ if ($_POST['Submit']) { // if ($config['installedpackages']['snortglobal']['rule']) { -// if ($_POST['descr'] == "") { -// $input_errors[] = "Please enter a description for your reference."; -// } + if ($_POST['descr'] == "") { + $input_errors[] = "Please enter a description for your reference."; + } -// if ($id == "" && $config['installedpackages']['snortglobal']['rule'][0]['interface'] != "") { + if ($id == "" && $config['installedpackages']['snortglobal']['rule'][0]['interface'] != "") { -// $rule_array = $config['installedpackages']['snortglobal']['rule']; -// $id_c = -1; -// foreach ($rule_array as $value) { + $rule_array = $config['installedpackages']['snortglobal']['rule']; + $id_c = -1; + foreach ($rule_array as $value) { -// $id_c += 1; + $id_c += 1; -// $result_lan = $config['installedpackages']['snortglobal']['rule'][$id_c]['interface']; -// $if_real = convert_friendly_interface_to_real_interface_name($result_lan); + $result_lan = $config['installedpackages']['snortglobal']['rule'][$id_c]['interface']; + $if_real = convert_friendly_interface_to_real_interface_name($result_lan); -// if ($_POST['interface'] == $result_lan) { -// $input_errors[] = "Interface $result_lan is in use. Please select another interface."; -// } -// } -// } + if ($_POST['interface'] == $result_lan) { + $input_errors[] = "Interface $result_lan is in use. Please select another interface."; + } + } + } /* check for overlaps */ foreach ($a_nat as $natent) { @@ -204,10 +225,12 @@ if ($_POST['Submit']) { $natent['interface'] = $_POST['interface'] ? $_POST['interface'] : $pconfig['interface']; /* if post write to conf or rewite the answer */ $natent['enable'] = $_POST['enable'] ? on : off; + $natent['uuid'] = $pconfig['uuid']; $natent['descr'] = $_POST['descr'] ? $_POST['descr'] : $pconfig['descr']; $natent['performance'] = $_POST['performance'] ? $_POST['performance'] : $pconfig['performance']; /* if post = on use on off or rewrite the conf */ if ($_POST['blockoffenders7'] == "on") { $natent['blockoffenders7'] = on; }else{ $natent['blockoffenders7'] = off; } if ($_POST['enable'] == "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } + $natent['snortalertlogtype'] = $_POST['snortalertlogtype'] ? $_POST['snortalertlogtype'] : $pconfig['snortalertlogtype']; if ($_POST['alertsystemlog'] == "on") { $natent['alertsystemlog'] = on; }else{ $natent['alertsystemlog'] = off; } if ($_POST['enable'] == "") { $natent['alertsystemlog'] = $pconfig['alertsystemlog']; } if ($_POST['tcpdumplog'] == "on") { $natent['tcpdumplog'] = on; }else{ $natent['tcpdumplog'] = off; } if ($_POST['enable'] == "") { $natent['tcpdumplog'] = $pconfig['tcpdumplog']; } if ($_POST['snortunifiedlog'] == "on") { $natent['snortunifiedlog'] = on; }else{ $natent['snortunifiedlog'] = off; } if ($_POST['enable'] == "") { $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; } @@ -277,35 +300,61 @@ if ($_POST['Submit']) { write_config(); // stop_service("snort"); - if ($pconfig['interface'] != '' && $id != '') { + if ($pconfig['interface'] != "") { sync_snort_package_all(); - } - if ($pconfig['interface'] != '' && $id != '') { + //touch($d_natconfdirty_path); header("Location: /snort/snort_interfaces_edit.php?id=$id"); - }else{ - touch($d_natconfdirty_path); - header("Location: /snort/snort_interfaces.php"); - - } + exit; } } + if (isset($config['installedpackages']['snortglobal']['rule'][$id]['interface'])) + { + if (uniq_snort_proc($id, $if_real) == 'false') + { + $snort_up_ck = ''; + }else{ + $snort_up_ck = ''; + } + }else{ + $snort_up_ck = ''; + } + if ($_POST["Submit2"]) { - if ($id != '') - { - sync_snort_package_all(); - } + sync_snort_package_all($id, $if_real); sleep(1); - exec("/bin/sh /usr/local/etc/rc.d/snort.sh start {$id}{$if_real}"); + exec("/usr/local/bin/snort -u snort -g snort -R \"{$snort_uuid}_{$if_real}\" -D -q -l /var/log/snort -G {$snort_uuid} -c /usr/local/etc/snort/snort_{$snort_uuid}_{$if_real}/snort.conf -i {$if_real}"); header("Location: /snort/snort_interfaces_edit.php?id=$id"); exit; } -$ifname = strtoupper($pconfig['interface']); -$pgtitle = "Snort: Interface: $id$if_real Settings Edit"; + if ($_POST["Submit3"]) + { + sync_snort_package_all($id, $if_real); + sleep(1); + + $start_up_pre = exec("/usr/bin/top -a -U snort -u | grep -v grep | grep \"R {$snort_uuid}_{$if_real}\" | awk '{print \$1;}'"); + $start_up_s = exec("/usr/bin/top -U snort -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); + $start_up_r = exec("/usr/bin/top -U root -u | grep snort | grep {$start_up_pre} | awk '{ print $1; }'"); + + if ($start_up_s != '') + { + exec("/bin/kill {$start_up_s}"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real}*"); + } + + if ($start_up_r != '') + { + exec("/bin/kill {$start_up_r}"); + exec("/bin/rm /var/run/snort_{$snort_uuid}_{$if_real}*"); + } + } + +$iface_uuid = $a_nat[$id]['uuid']; +$pgtitle = "Snort: Interface Edit: $id $iface_uuid $if_real"; include("head.inc"); ?> @@ -313,7 +362,6 @@ include("head.inc"); -