\n\n"; echo "Please click on the Update Rules tab to install your selected rule sets."; include("fend.inc"); echo ""; echo ""; exit(0); } function get_middle(\$source, \$beginning, \$ending, \$init_pos) { \$beginning_pos = strpos(\$source, \$beginning, \$init_pos); \$middle_pos = \$beginning_pos + strlen(\$beginning); \$ending_pos = strpos(\$source, \$ending, \$beginning_pos); \$middle = substr(\$source, \$middle_pos, \$ending_pos - \$middle_pos); return \$middle; } function write_rule_file(\$content_changed, \$received_file) { conf_mount_rw(); //read snort file with writing enabled \$filehandle = fopen(\$received_file, "w"); //delimiter for each new rule is a new line \$delimiter = "\n"; //implode the array back into a string for writing purposes \$fullfile = implode(\$delimiter, \$content_changed); //write data to file fwrite(\$filehandle, \$fullfile); //close file handle fclose(\$filehandle); conf_mount_rw(); } function load_rule_file(\$incoming_file) { //read snort file \$filehandle = fopen(\$incoming_file, "r"); //read file into string, and get filesize \$contents = fread(\$filehandle, filesize(\$incoming_file)); //close handler fclose (\$filehandle); //string for populating category select \$currentruleset = substr(\$file, 27); //delimiter for each new rule is a new line \$delimiter = "\n"; //split the contents of the string file into an array using the delimiter \$splitcontents = explode(\$delimiter, \$contents); return \$splitcontents; } \$ruledir = "/usr/local/etc/snort_{$snortIf}/rules_{$snortIf}/"; \$dh = opendir(\$ruledir); \$message_reload = "The Snort rule configuration has been changed.
You must apply the changes in order for them to take effect."; while (false !== (\$filename = readdir(\$dh))) { //only populate this array if its a rule file \$isrulefile = strstr(\$filename, ".rules"); if (\$isrulefile !== false) { \$files[] = \$filename; } } sort(\$files); if (\$_GET['openruleset']) { \$file = \$_GET['openruleset']; } else { \$file = \$ruledir.\$files[0]; } //Load the rule file \$splitcontents = load_rule_file(\$file); if (\$_POST) { if (!\$_POST['apply']) { //retrieve POST data \$post_lineid = \$_POST['lineid']; \$post_enabled = \$_POST['enabled']; \$post_src = \$_POST['src']; \$post_srcport = \$_POST['srcport']; \$post_dest = \$_POST['dest']; \$post_destport = \$_POST['destport']; //clean up any white spaces insert by accident \$post_src = str_replace(" ", "", \$post_src); \$post_srcport = str_replace(" ", "", \$post_srcport); \$post_dest = str_replace(" ", "", \$post_dest); \$post_destport = str_replace(" ", "", \$post_destport); //copy rule contents from array into string \$tempstring = \$splitcontents[\$post_lineid]; //search string \$findme = "# alert"; //find string for disabled alerts //find if alert is disabled \$disabled = strstr(\$tempstring, \$findme); //if find alert is false, then rule is disabled if (\$disabled !== false) { //has rule been enabled if (\$post_enabled == "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array \$tempstring = str_replace("# alert", "alert", \$tempstring); \$counter2 = 1; } else { //rule is staying disabled \$counter2 = 2; } } else { //has rule been disabled if (\$post_enabled != "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array \$tempstring = str_replace("alert", "# alert", \$tempstring); \$counter2 = 2; } else { //rule is staying enabled \$counter2 = 1; } } //explode rule contents into an array, (delimiter is space) \$rule_content = explode(' ', \$tempstring); //insert new values \$counter2++; \$rule_content[\$counter2] = \$post_src;//source location \$counter2++; \$rule_content[\$counter2] = \$post_srcport;//source port location \$counter2 = \$counter2+2; \$rule_content[\$counter2] = \$post_dest;//destination location \$counter2++; \$rule_content[\$counter2] = \$post_destport;//destination port location //implode the array back into string \$tempstring = implode(' ', \$rule_content); //copy string into file array for writing \$splitcontents[\$post_lineid] = \$tempstring; //write the new .rules file write_rule_file(\$splitcontents, \$file); //once file has been written, reload file \$splitcontents = load_rule_file(\$file); \$stopMsg = true; } if (\$_POST['apply']) { // stop_service("snort"); // sleep(2); // start_service("snort"); \$savemsg = "The snort rules selections have been saved. Please restart snort by clicking save on the settings tab."; \$stopMsg = false; } } else if (\$_GET['act'] == "toggle") { \$toggleid = \$_GET['id']; //copy rule contents from array into string \$tempstring = \$splitcontents[\$toggleid]; //explode rule contents into an array, (delimiter is space) \$rule_content = explode(' ', \$tempstring); //search string \$findme = "# alert"; //find string for disabled alerts //find if alert is disabled \$disabled = strstr(\$tempstring, \$findme); //if find alert is false, then rule is disabled if (\$disabled !== false) { //rule has been enabled //move counter up 1, so we do not retrieve the # in the rule_content array \$tempstring = str_replace("# alert", "alert", \$tempstring); } else { //has rule been disabled //move counter up 1, so we do not retrieve the # in the rule_content array \$tempstring = str_replace("alert", "# alert", \$tempstring); } //copy string into array for writing \$splitcontents[\$toggleid] = \$tempstring; //write the new .rules file write_rule_file(\$splitcontents, \$file); //once file has been written, reload file \$splitcontents = load_rule_file(\$file); \$stopMsg = true; //write disable/enable sid to config.xml if (\$disabled == false) { \$string_sid = strstr(\$tempstring, 'sid:'); \$sid_pieces = explode(";", \$string_sid); \$sid_off_cut = \$sid_pieces[0]; // sid being turned off \$sid_off = str_replace("sid:", "", \$sid_off_cut); // rule_sid_on registers \$sid_on_pieces = \$config['installedpackages']['snort']['rule_sid_on']; // if off sid is the same as on sid remove it \$sid_on_old = str_replace("||enablesid \$sid_off", "", "\$sid_on_pieces"); // write the replace sid back as empty \$config['installedpackages']['snort']['rule_sid_on'] = \$sid_on_old; // rule sid off registers \$sid_off_pieces = \$config['installedpackages']['snort']['rule_sid_off']; // if off sid is the same as off sid remove it \$sid_off_old = str_replace("||disablesid \$sid_off", "", "\$sid_off_pieces"); // write the replace sid back as empty \$config['installedpackages']['snort']['rule_sid_off'] = \$sid_off_old; // add sid off registers to new off sid \$config['installedpackages']['snort']['rule_sid_off'] = "||disablesid \$sid_off" . \$config['installedpackages']['snort']['rule_sid_off']; write_config(); } else { \$string_sid = strstr(\$tempstring, 'sid:'); \$sid_pieces = explode(";", \$string_sid); \$sid_on_cut = \$sid_pieces[0]; // sid being turned off \$sid_on = str_replace("sid:", "", \$sid_on_cut); // rule_sid_off registers \$sid_off_pieces = \$config['installedpackages']['snort']['rule_sid_off']; // if off sid is the same as on sid remove it \$sid_off_old = str_replace("||disablesid \$sid_on", "", "\$sid_off_pieces"); // write the replace sid back as empty \$config['installedpackages']['snort']['rule_sid_off'] = \$sid_off_old; // rule sid on registers \$sid_on_pieces = \$config['installedpackages']['snort']['rule_sid_on']; // if on sid is the same as on sid remove it \$sid_on_old = str_replace("||enablesid \$sid_on", "", "\$sid_on_pieces"); // write the replace sid back as empty \$config['installedpackages']['snort']['rule_sid_on'] = \$sid_on_old; // add sid on registers to new on sid \$config['installedpackages']['snort']['rule_sid_on'] = "||enablesid \$sid_on" . \$config['installedpackages']['snort']['rule_sid_on']; write_config(); } } \$pgtitle = "Snort: Rules"; require("guiconfig.inc"); include("head.inc"); ?>

Category: "; //string for populating category select \$currentruleset = substr(\$file, 27); ?> >" "; \$textse = ""; \$iconb = "icon_block_d.gif"; } else { \$textss = \$textse = ""; \$iconb = "icon_block.gif"; } \$rule_content = explode(' ', \$tempstring); \$protocol = \$rule_content[\$counter2];//protocol location \$counter2++; \$source = \$rule_content[\$counter2];//source location \$counter2++; \$source_port = \$rule_content[\$counter2];//source port location \$counter2 = \$counter2+2; \$destination = \$rule_content[\$counter2];//destination location \$counter2++; \$destination_port = \$rule_content[\$counter2];//destination port location \$message = get_middle(\$tempstring, 'msg:"', '";', 0); echo ""; echo ""; echo ""; echo ""; echo ""; echo ""; echo ""; ?> "; ?>   SID Proto Source Port Destination Port Message "; echo \$textss; ?> "; echo " "; echo \$textss; echo \$sid; echo \$textse; echo " "; echo \$textss; echo \$protocol; \$printcounter++; echo \$textse; echo " "; echo \$textss; echo \$source; echo \$textse; echo " "; echo \$textss; echo \$source_port; echo \$textse; echo " "; echo \$textss; echo \$destination; echo \$textse; echo " "; echo \$textss; echo \$destination_port; echo \$textse; echo " "; ?> Rule Enabled Rule Disabled