You must apply the changes in order for them to take effect.";
while (false !== ($filename = readdir($dh)))
{
//only populate this array if its a rule file
$isrulefile = strstr($filename, ".rules");
if ($isrulefile !== false)
{
$files[] = $filename;
}
}
sort($files);
if ($_GET['openruleset'])
{
$file = $_GET['openruleset'];
}
else
{
$file = $ruledir.$files[0];
}
//Load the rule file
$splitcontents = load_rule_file($file);
if ($_POST)
{
if (!$_POST['apply']) {
//retrieve POST data
$post_lineid = $_POST['lineid'];
$post_enabled = $_POST['enabled'];
$post_src = $_POST['src'];
$post_srcport = $_POST['srcport'];
$post_dest = $_POST['dest'];
$post_destport = $_POST['destport'];
//clean up any white spaces insert by accident
$post_src = str_replace(" ", "", $post_src);
$post_srcport = str_replace(" ", "", $post_srcport);
$post_dest = str_replace(" ", "", $post_dest);
$post_destport = str_replace(" ", "", $post_destport);
//copy rule contents from array into string
$tempstring = $splitcontents[$post_lineid];
//search string
$findme = "# alert"; //find string for disabled alerts
//find if alert is disabled
$disabled = strstr($tempstring, $findme);
//if find alert is false, then rule is disabled
if ($disabled !== false)
{
//has rule been enabled
if ($post_enabled == "yes")
{
//move counter up 1, so we do not retrieve the # in the rule_content array
$tempstring = str_replace("# alert", "alert", $tempstring);
$counter2 = 1;
}
else
{
//rule is staying disabled
$counter2 = 2;
}
}
else
{
//has rule been disabled
if ($post_enabled != "yes")
{
//move counter up 1, so we do not retrieve the # in the rule_content array
$tempstring = str_replace("alert", "# alert", $tempstring);
$counter2 = 2;
}
else
{
//rule is staying enabled
$counter2 = 1;
}
}
//explode rule contents into an array, (delimiter is space)
$rule_content = explode(' ', $tempstring);
//insert new values
$counter2++;
$rule_content[$counter2] = $post_src;//source location
$counter2++;
$rule_content[$counter2] = $post_srcport;//source port location
$counter2 = $counter2+2;
$rule_content[$counter2] = $post_dest;//destination location
$counter2++;
$rule_content[$counter2] = $post_destport;//destination port location
//implode the array back into string
$tempstring = implode(' ', $rule_content);
//copy string into file array for writing
$splitcontents[$post_lineid] = $tempstring;
//write the new .rules file
write_rule_file($splitcontents, $file);
//once file has been written, reload file
$splitcontents = load_rule_file($file);
$stopMsg = true;
}
if ($_POST['apply']) {
// stop_service("snort");
// sleep(2);
// start_service("snort");
$savemsg = "The snort rules selections have been saved. Please restart snort by clicking save on the settings tab.";
$stopMsg = false;
}
}
else if ($_GET['act'] == "toggle")
{
$toggleid = $_GET['id'];
//copy rule contents from array into string
$tempstring = $splitcontents[$toggleid];
//explode rule contents into an array, (delimiter is space)
$rule_content = explode(' ', $tempstring);
//search string
$findme = "# alert"; //find string for disabled alerts
//find if alert is disabled
$disabled = strstr($tempstring, $findme);
//if find alert is false, then rule is disabled
if ($disabled !== false)
{
//rule has been enabled
//move counter up 1, so we do not retrieve the # in the rule_content array
$tempstring = str_replace("# alert", "alert", $tempstring);
}
else
{
//has rule been disabled
//move counter up 1, so we do not retrieve the # in the rule_content array
$tempstring = str_replace("alert", "# alert", $tempstring);
}
//copy string into array for writing
$splitcontents[$toggleid] = $tempstring;
//write the new .rules file
write_rule_file($splitcontents, $file);
//once file has been written, reload file
$splitcontents = load_rule_file($file);
$stopMsg = true;
//write disable/enable sid to config.xml
if ($disabled == false) {
$string_sid = strstr($tempstring, 'sid:');
$sid_pieces = explode(";", $string_sid);
$sid_off_cut = $sid_pieces[0];
// sid being turned off
$sid_off = str_replace("sid:", "", $sid_off_cut);
// rule_sid_on registers
$sid_on_pieces = $config['installedpackages']['snort']['rule_sid_on'];
// if off sid is the same as on sid remove it
$sid_on_old = str_replace("||enablesid $sid_off", "", "$sid_on_pieces");
// write the replace sid back as empty
$config['installedpackages']['snort']['rule_sid_on'] = $sid_on_old;
// rule sid off registers
$sid_off_pieces = $config['installedpackages']['snort']['rule_sid_off'];
// if off sid is the same as off sid remove it
$sid_off_old = str_replace("||disablesid $sid_off", "", "$sid_off_pieces");
// write the replace sid back as empty
$config['installedpackages']['snort']['rule_sid_off'] = $sid_off_old;
// add sid off registers to new off sid
$config['installedpackages']['snort']['rule_sid_off'] = "||disablesid $sid_off" . $config['installedpackages']['snort']['rule_sid_off'];
write_config();
}
else
{
$string_sid = strstr($tempstring, 'sid:');
$sid_pieces = explode(";", $string_sid);
$sid_on_cut = $sid_pieces[0];
// sid being turned off
$sid_on = str_replace("sid:", "", $sid_on_cut);
// rule_sid_off registers
$sid_off_pieces = $config['installedpackages']['snort']['rule_sid_off'];
// if off sid is the same as on sid remove it
$sid_off_old = str_replace("||disablesid $sid_on", "", "$sid_off_pieces");
// write the replace sid back as empty
$config['installedpackages']['snort']['rule_sid_off'] = $sid_off_old;
// rule sid on registers
$sid_on_pieces = $config['installedpackages']['snort']['rule_sid_on'];
// if on sid is the same as on sid remove it
$sid_on_old = str_replace("||enablesid $sid_on", "", "$sid_on_pieces");
// write the replace sid back as empty
$config['installedpackages']['snort']['rule_sid_on'] = $sid_on_old;
// add sid on registers to new on sid
$config['installedpackages']['snort']['rule_sid_on'] = "||enablesid $sid_on" . $config['installedpackages']['snort']['rule_sid_on'];
write_config();
}
}
$pgtitle = "Snort: Rules";
require("guiconfig.inc");
include("head.inc");
?>
";
?>
