\n\n"; echo "Please click on the Update Rules tab to install your selected rule sets."; include("fend.inc"); echo ""; echo ""; exit(0); } function get_middle($source, $beginning, $ending, $init_pos) { $beginning_pos = strpos($source, $beginning, $init_pos); $middle_pos = $beginning_pos + strlen($beginning); $ending_pos = strpos($source, $ending, $beginning_pos); $middle = substr($source, $middle_pos, $ending_pos - $middle_pos); return $middle; } function write_rule_file($content_changed, $received_file) { conf_mount_rw(); //read snort file with writing enabled $filehandle = fopen($received_file, "w"); //delimiter for each new rule is a new line $delimiter = "\n"; //implode the array back into a string for writing purposes $fullfile = implode($delimiter, $content_changed); //write data to file fwrite($filehandle, $fullfile); //close file handle fclose($filehandle); conf_mount_rw(); } function load_rule_file($incoming_file) { //read snort file $filehandle = fopen($incoming_file, "r"); //read file into string, and get filesize $contents = fread($filehandle, filesize($incoming_file)); //close handler fclose ($filehandle); //string for populating category select $currentruleset = substr($file, 27); //delimiter for each new rule is a new line $delimiter = "\n"; //split the contents of the string file into an array using the delimiter $splitcontents = explode($delimiter, $contents); return $splitcontents; } $ruledir = "/usr/local/etc/snort/rules/"; $dh = opendir($ruledir); $message_reload = "The Snort rule configuration has been changed.
You must apply the changes in order for them to take effect."; while (false !== ($filename = readdir($dh))) { //only populate this array if its a rule file $isrulefile = strstr($filename, ".rules"); if ($isrulefile !== false) { $files[] = $filename; } } sort($files); if ($_GET['openruleset']) { $file = $_GET['openruleset']; } else { $file = $ruledir.$files[0]; } //Load the rule file $splitcontents = load_rule_file($file); if ($_POST) { if (!$_POST['apply']) { //retrieve POST data $post_lineid = $_POST['lineid']; $post_enabled = $_POST['enabled']; $post_src = $_POST['src']; $post_srcport = $_POST['srcport']; $post_dest = $_POST['dest']; $post_destport = $_POST['destport']; //clean up any white spaces insert by accident $post_src = str_replace(" ", "", $post_src); $post_srcport = str_replace(" ", "", $post_srcport); $post_dest = str_replace(" ", "", $post_dest); $post_destport = str_replace(" ", "", $post_destport); //copy rule contents from array into string $tempstring = $splitcontents[$post_lineid]; //search string $findme = "# alert"; //find string for disabled alerts //find if alert is disabled $disabled = strstr($tempstring, $findme); //if find alert is false, then rule is disabled if ($disabled !== false) { //has rule been enabled if ($post_enabled == "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("# alert", "alert", $tempstring); $counter2 = 1; } else { //rule is staying disabled $counter2 = 2; } } else { //has rule been disabled if ($post_enabled != "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("alert", "# alert", $tempstring); $counter2 = 2; } else { //rule is staying enabled $counter2 = 1; } } //explode rule contents into an array, (delimiter is space) $rule_content = explode(' ', $tempstring); //insert new values $counter2++; $rule_content[$counter2] = $post_src;//source location $counter2++; $rule_content[$counter2] = $post_srcport;//source port location $counter2 = $counter2+2; $rule_content[$counter2] = $post_dest;//destination location $counter2++; $rule_content[$counter2] = $post_destport;//destination port location //implode the array back into string $tempstring = implode(' ', $rule_content); //copy string into file array for writing $splitcontents[$post_lineid] = $tempstring; //write the new .rules file write_rule_file($splitcontents, $file); //once file has been written, reload file $splitcontents = load_rule_file($file); $stopMsg = true; } if ($_POST['apply']) { // stop_service("snort"); // sleep(2); // start_service("snort"); $savemsg = "The snort rules selections have been saved. Please restart snort by clicking save on the settings tab."; $stopMsg = false; } } else if ($_GET['act'] == "toggle") { $toggleid = $_GET['id']; //copy rule contents from array into string $tempstring = $splitcontents[$toggleid]; //explode rule contents into an array, (delimiter is space) $rule_content = explode(' ', $tempstring); //search string $findme = "# alert"; //find string for disabled alerts //find if alert is disabled $disabled = strstr($tempstring, $findme); //if find alert is false, then rule is disabled if ($disabled !== false) { //rule has been enabled //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("# alert", "alert", $tempstring); } else { //has rule been disabled //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("alert", "# alert", $tempstring); } //copy string into array for writing $splitcontents[$toggleid] = $tempstring; //write the new .rules file write_rule_file($splitcontents, $file); //once file has been written, reload file $splitcontents = load_rule_file($file); $stopMsg = true; //write disable/enable sid to config.xml if ($disabled == false) { $string_sid = strstr($tempstring, 'sid:'); $sid_pieces = explode(";", $string_sid); $sid_off_cut = $sid_pieces[0]; // sid being turned off $sid_off = str_replace("sid:", "", $sid_off_cut); // rule_sid_on registers $sid_on_pieces = $config['installedpackages']['snort']['rule_sid_on']; // if off sid is the same as on sid remove it $sid_on_old = str_replace("||enablesid $sid_off", "", "$sid_on_pieces"); // write the replace sid back as empty $config['installedpackages']['snort']['rule_sid_on'] = $sid_on_old; // rule sid off registers $sid_off_pieces = $config['installedpackages']['snort']['rule_sid_off']; // if off sid is the same as off sid remove it $sid_off_old = str_replace("||disablesid $sid_off", "", "$sid_off_pieces"); // write the replace sid back as empty $config['installedpackages']['snort']['rule_sid_off'] = $sid_off_old; // add sid off registers to new off sid $config['installedpackages']['snort']['rule_sid_off'] = "||disablesid $sid_off" . $config['installedpackages']['snort']['rule_sid_off']; write_config(); } else { $string_sid = strstr($tempstring, 'sid:'); $sid_pieces = explode(";", $string_sid); $sid_on_cut = $sid_pieces[0]; // sid being turned off $sid_on = str_replace("sid:", "", $sid_on_cut); // rule_sid_off registers $sid_off_pieces = $config['installedpackages']['snort']['rule_sid_off']; // if off sid is the same as on sid remove it $sid_off_old = str_replace("||disablesid $sid_on", "", "$sid_off_pieces"); // write the replace sid back as empty $config['installedpackages']['snort']['rule_sid_off'] = $sid_off_old; // rule sid on registers $sid_on_pieces = $config['installedpackages']['snort']['rule_sid_on']; // if on sid is the same as on sid remove it $sid_on_old = str_replace("||enablesid $sid_on", "", "$sid_on_pieces"); // write the replace sid back as empty $config['installedpackages']['snort']['rule_sid_on'] = $sid_on_old; // add sid on registers to new on sid $config['installedpackages']['snort']['rule_sid_on'] = "||enablesid $sid_on" . $config['installedpackages']['snort']['rule_sid_on']; write_config(); } } $pgtitle = "Snort: Rules"; require("guiconfig.inc"); include("head.inc"); ?>

Category: "; //string for populating category select $currentruleset = substr($file, 27); ?> >" "; $textse = ""; $iconb = "icon_block_d.gif"; } else { $textss = $textse = ""; $iconb = "icon_block.gif"; } $rule_content = explode(' ', $tempstring); $protocol = $rule_content[$counter2];//protocol location $counter2++; $source = $rule_content[$counter2];//source location $counter2++; $source_port = $rule_content[$counter2];//source port location $counter2 = $counter2+2; $destination = $rule_content[$counter2];//destination location $counter2++; $destination_port = $rule_content[$counter2];//destination port location $message = get_middle($tempstring, 'msg:"', '";', 0); echo ""; echo ""; echo ""; echo ""; echo ""; echo ""; echo ""; ?> "; ?>   SID Proto Source Port Destination Port Message "; echo $textss; ?> "; echo " "; echo $textss; echo $sid; echo $textse; echo " "; echo $textss; echo $protocol; $printcounter++; echo $textse; echo " "; echo $textss; echo $source; echo $textse; echo " "; echo $textss; echo $source_port; echo $textse; echo " "; echo $textss; echo $destination; echo $textse; echo " "; echo $textss; echo $destination_port; echo $textse; echo " "; ?> Rule Enabled Rule Disabled