. * Copyright (C) 2008-2009 Robert Zelaya. * Copyright (C) 2011-2012 Ermal Luci * Copyright (C) 2013 Bill Meeks * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ require_once("guiconfig.inc"); require_once("/usr/local/pkg/snort/snort.inc"); global $g, $rebuild_rules; $snortlogdir = SNORTLOGDIR; $id = $_GET['id']; if (isset($_POST['id'])) $id = $_POST['id']; if (is_null($id)) { header("Location: /snort/snort_interfaces.php"); exit; } if (!is_array($config['installedpackages']['snortglobal'])) $config['installedpackages']['snortglobal'] = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'])) $config['installedpackages']['snortglobal']['rule'] = array(); // Initialize multiple config engine arrays for supported preprocessors if necessary if (!is_array($config['installedpackages']['snortglobal']['rule'][$id]['frag3_engine']['item'])) $config['installedpackages']['snortglobal']['rule'][$id]['frag3_engine']['item'] = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'][$id]['stream5_tcp_engine']['item'])) $config['installedpackages']['snortglobal']['rule'][$id]['stream5_tcp_engine']['item'] = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'][$id]['http_inspect_engine']['item'])) $config['installedpackages']['snortglobal']['rule'][$id]['http_inspect_engine']['item'] = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'][$id]['ftp_server_engine']['item'])) $config['installedpackages']['snortglobal']['rule'][$id]['ftp_server_engine']['item'] = array(); if (!is_array($config['installedpackages']['snortglobal']['rule'][$id]['ftp_client_engine']['item'])) $config['installedpackages']['snortglobal']['rule'][$id]['ftp_client_engine']['item'] = array(); $a_nat = &$config['installedpackages']['snortglobal']['rule']; $vrt_enabled = $config['installedpackages']['snortglobal']['snortdownload']; $frag3_engine_next_id = count($a_nat[$id]['frag3_engine']['item']); $stream5_tcp_engine_next_id = count($a_nat[$id]['stream5_tcp_engine']['item']); $http_inspect_engine_next_id = count($a_nat[$id]['http_inspect_engine']['item']); $ftp_server_engine_next_id = count($a_nat[$id]['ftp_server_engine']['item']); $ftp_client_engine_next_id = count($a_nat[$id]['ftp_client_engine']['item']); $pconfig = array(); if (isset($id) && $a_nat[$id]) { $pconfig = $a_nat[$id]; /* Get current values from config for page form fields */ $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; $pconfig['host_attribute_table'] = $a_nat[$id]['host_attribute_table']; $pconfig['host_attribute_data'] = $a_nat[$id]['host_attribute_data']; $pconfig['max_attribute_hosts'] = $a_nat[$id]['max_attribute_hosts']; $pconfig['max_attribute_services_per_host'] = $a_nat[$id]['max_attribute_services_per_host']; $pconfig['max_paf'] = $a_nat[$id]['max_paf']; $pconfig['other_preprocs'] = $a_nat[$id]['other_preprocs']; $pconfig['ftp_preprocessor'] = $a_nat[$id]['ftp_preprocessor']; $pconfig['ftp_telnet_inspection_type'] = $a_nat[$id]['ftp_telnet_inspection_type']; $pconfig['ftp_telnet_alert_encrypted'] = $a_nat[$id]['ftp_telnet_alert_encrypted']; $pconfig['ftp_telnet_check_encrypted'] = $a_nat[$id]['ftp_telnet_check_encrypted']; $pconfig['ftp_telnet_normalize'] = $a_nat[$id]['ftp_telnet_normalize']; $pconfig['ftp_telnet_detect_anomalies'] = $a_nat[$id]['ftp_telnet_detect_anomalies']; $pconfig['ftp_telnet_ayt_attack_threshold'] = $a_nat[$id]['ftp_telnet_ayt_attack_threshold']; $pconfig['smtp_preprocessor'] = $a_nat[$id]['smtp_preprocessor']; $pconfig['sf_portscan'] = $a_nat[$id]['sf_portscan']; $pconfig['pscan_protocol'] = $a_nat[$id]['pscan_protocol']; $pconfig['pscan_type'] = $a_nat[$id]['pscan_type']; $pconfig['pscan_sense_level'] = $a_nat[$id]['pscan_sense_level']; $pconfig['pscan_memcap'] = $a_nat[$id]['pscan_memcap']; $pconfig['pscan_ignore_scanners'] = $a_nat[$id]['pscan_ignore_scanners']; $pconfig['dce_rpc_2'] = $a_nat[$id]['dce_rpc_2']; $pconfig['dns_preprocessor'] = $a_nat[$id]['dns_preprocessor']; $pconfig['sensitive_data'] = $a_nat[$id]['sensitive_data']; $pconfig['sdf_alert_data_type'] = $a_nat[$id]['sdf_alert_data_type']; $pconfig['sdf_alert_threshold'] = $a_nat[$id]['sdf_alert_threshold']; $pconfig['sdf_mask_output'] = $a_nat[$id]['sdf_mask_output']; $pconfig['ssl_preproc'] = $a_nat[$id]['ssl_preproc']; $pconfig['pop_preproc'] = $a_nat[$id]['pop_preproc']; $pconfig['imap_preproc'] = $a_nat[$id]['imap_preproc']; $pconfig['sip_preproc'] = $a_nat[$id]['sip_preproc']; $pconfig['dnp3_preproc'] = $a_nat[$id]['dnp3_preproc']; $pconfig['modbus_preproc'] = $a_nat[$id]['modbus_preproc']; $pconfig['gtp_preproc'] = $a_nat[$id]['gtp_preproc']; $pconfig['ssh_preproc'] = $a_nat[$id]['ssh_preproc']; $pconfig['preproc_auto_rule_disable'] = $a_nat[$id]['preproc_auto_rule_disable']; $pconfig['protect_preproc_rules'] = $a_nat[$id]['protect_preproc_rules']; // Frag3 global settings $pconfig['frag3_detection'] = $a_nat[$id]['frag3_detection']; $pconfig['frag3_max_frags'] = $a_nat[$id]['frag3_max_frags']; $pconfig['frag3_memcap'] = $a_nat[$id]['frag3_memcap']; // See if new Frag3 engine array is configured and use it; // otherwise create a default engine configuration. if (empty($pconfig['frag3_engine']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", "timeout" => 60, "min_ttl" => 1, "detect_anomalies" => "on", "overlap_limit" => 0, "min_frag_len" => 0 ); $pconfig['frag3_engine']['item'] = array(); $pconfig['frag3_engine']['item'][] = $default; if (!is_array($a_nat[$id]['frag3_engine']['item'])) $a_nat[$id]['frag3_engine']['item'] = array(); $a_nat[$id]['frag3_engine']['item'][] = $default; write_config(); $frag3_engine_next_id++; } else $pconfig['frag3_engine'] = $a_nat[$id]['frag3_engine']; // Stream5 global settings $pconfig['stream5_reassembly'] = $a_nat[$id]['stream5_reassembly']; $pconfig['stream5_flush_on_alert'] = $a_nat[$id]['stream5_flush_on_alert']; $pconfig['stream5_prune_log_max'] = $a_nat[$id]['stream5_prune_log_max']; $pconfig['stream5_mem_cap'] = $a_nat[$id]['stream5_mem_cap']; $pconfig['stream5_track_tcp'] = $a_nat[$id]['stream5_track_tcp']; $pconfig['stream5_max_tcp'] = $a_nat[$id]['stream5_max_tcp']; $pconfig['stream5_track_udp'] = $a_nat[$id]['stream5_track_udp']; $pconfig['stream5_max_udp'] = $a_nat[$id]['stream5_max_udp']; $pconfig['stream5_udp_timeout'] = $a_nat[$id]['stream5_udp_timeout']; $pconfig['stream5_track_icmp'] = $a_nat[$id]['stream5_track_icmp']; $pconfig['stream5_max_icmp'] = $a_nat[$id]['stream5_max_icmp']; $pconfig['stream5_icmp_timeout'] = $a_nat[$id]['stream5_icmp_timeout']; // See if new Stream5 engine array is configured and use it; // otherwise create a default engine configuration. if (empty($pconfig['stream5_tcp_engine']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "policy" => "bsd", "timeout" => 30, "max_queued_bytes" => 1048576, "detect_anomalies" => "off", "overlap_limit" => 0, "max_queued_segs" => 2621, "require_3whs" => "off", "startup_3whs_timeout" => 0, "no_reassemble_async" => "off", "max_window" => 0, "use_static_footprint_sizes" => "off", "check_session_hijacking" => "off", "dont_store_lg_pkts" => "off", "ports_client" => "default", "ports_both" => "default", "ports_server" => "none" ); $pconfig['stream5_tcp_engine']['item'] = array(); $pconfig['stream5_tcp_engine']['item'][] = $default; if (!is_array($a_nat[$id]['stream5_tcp_engine']['item'])) $a_nat[$id]['stream5_tcp_engine']['item'] = array(); $a_nat[$id]['stream5_tcp_engine']['item'][] = $default; write_config(); $stream5_tcp_engine_next_id++; } else $pconfig['stream5_tcp_engine'] = $a_nat[$id]['stream5_tcp_engine']; // HTTP_INSPECT global settings $pconfig['http_inspect'] = $a_nat[$id]['http_inspect']; $pconfig['http_inspect_memcap'] = $a_nat[$id]['http_inspect_memcap']; $pconfig['http_inspect_proxy_alert'] = $a_nat[$id]['http_inspect_proxy_alert']; $pconfig['http_inspect_max_gzip_mem'] = $a_nat[$id]['http_inspect_max_gzip_mem']; // See if new HTTP_INSPECT engine array is configured and use it; // otherwise create a default engine configuration. if (empty($pconfig['http_inspect_engine']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "server_profile" => "all", "enable_xff" => "off", "log_uri" => "off", "log_hostname" => "off", "server_flow_depth" => 65535, "enable_cookie" => "on", "client_flow_depth" => 1460, "extended_response_inspection" => "on", "no_alerts" => "off", "unlimited_decompress" => "on", "inspect_gzip" => "on", "normalize_cookies" =>"on", "normalize_headers" => "on", "normalize_utf" => "on", "normalize_javascript" => "on", "allow_proxy_use" => "off", "inspect_uri_only" => "off", "max_javascript_whitespaces" => 200, "post_depth" => -1, "max_headers" => 0, "max_spaces" => 0, "max_header_length" => 0, "ports" => "default" ); $pconfig['http_inspect_engine']['item'] = array(); $pconfig['http_inspect_engine']['item'][] = $default; if (!is_array($a_nat[$id]['http_inspect_engine']['item'])) $a_nat[$id]['http_inspect_engine']['item'] = array(); $a_nat[$id]['http_inspect_engine']['item'][] = $default; write_config(); $http_inspect_engine_next_id++; } else $pconfig['http_inspect_engine'] = $a_nat[$id]['http_inspect_engine']; // See if new FTP client engine array is configured and use it; // otherwise create a default engine configuration.. if (empty($pconfig['ftp_client_engine']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "max_resp_len" => 256, "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", "bounce" => "yes", "bounce_to_net" => "", "bounce_to_port" => "" ); $pconfig['ftp_client_engine']['item'] = array(); $pconfig['ftp_client_engine']['item'][] = $default; if (!is_array($a_nat[$id]['ftp_client_engine']['item'])) $a_nat[$id]['ftp_client_engine']['item'] = array(); $a_nat[$id]['ftp_client_engine']['item'][] = $default; write_config(); $ftp_client_engine_next_id++; } else $pconfig['ftp_client_engine'] = $a_nat[$id]['ftp_client_engine']; // See if new FTP server engine array is configured and use it; // otherwise create a default engine configuration.. if (empty($pconfig['ftp_server_engine']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "ports" => "default", "telnet_cmds" => "no", "ignore_telnet_erase_cmds" => "yes", "ignore_data_chan" => "no", "def_max_param_len" => 100 ); $pconfig['ftp_server_engine']['item'] = array(); $pconfig['ftp_server_engine']['item'][] = $default; if (!is_array($a_nat[$id]['ftp_server_engine']['item'])) $a_nat[$id]['ftp_server_engine']['item'] = array(); $a_nat[$id]['ftp_server_engine']['item'][] = $default; write_config(); $ftp_server_engine_next_id++; } else $pconfig['ftp_server_engine'] = $a_nat[$id]['ftp_server_engine']; /* If not using the Snort VRT rules, then disable */ /* the Sensitive Data (sdf) preprocessor. */ if ($vrt_enabled == "off") $pconfig['sensitive_data'] = "off"; /************************************************************/ /* To keep new users from shooting themselves in the foot */ /* enable the most common required preprocessors by default */ /* and set reasonable values for any options. */ /************************************************************/ if (empty($pconfig['max_attribute_hosts'])) $pconfig['max_attribute_hosts'] = '10000'; if (empty($pconfig['max_attribute_services_per_host'])) $pconfig['max_attribute_services_per_host'] = '10'; if (empty($pconfig['max_paf']) && $pconfig['max_paf'] <> 0) $pconfig['max_paf'] = '16000'; if (empty($pconfig['ftp_preprocessor'])) $pconfig['ftp_preprocessor'] = 'on'; if (empty($pconfig['ftp_telnet_inspection_type'])) $pconfig['ftp_telnet_inspection_type'] = 'stateful'; if (empty($pconfig['ftp_telnet_alert_encrypted'])) $pconfig['ftp_telnet_alert_encrypted'] = 'off'; if (empty($pconfig['ftp_telnet_check_encrypted'])) $pconfig['ftp_telnet_check_encrypted'] = 'on'; if (empty($pconfig['ftp_telnet_normalize'])) $pconfig['ftp_telnet_normalize'] = 'on'; if (empty($pconfig['ftp_telnet_detect_anomalies'])) $pconfig['ftp_telnet_detect_anomalies'] = 'on'; if (empty($pconfig['ftp_telnet_ayt_attack_threshold']) && $pconfig['ftp_telnet_ayt_attack_threshold'] <> 0) $pconfig['ftp_telnet_ayt_attack_threshold'] = '20'; if (empty($pconfig['sdf_alert_data_type'])) $pconfig['sdf_alert_data_type'] = "Credit Card,Email Addresses,U.S. Phone Numbers,U.S. Social Security Numbers"; if (empty($pconfig['sdf_alert_threshold'])) $pconfig['sdf_alert_threshold'] = '25'; if (empty($pconfig['sdf_mask_output'])) $pconfig['sdf_mask_output'] = 'off'; if (empty($pconfig['smtp_preprocessor'])) $pconfig['smtp_preprocessor'] = 'on'; if (empty($pconfig['dce_rpc_2'])) $pconfig['dce_rpc_2'] = 'on'; if (empty($pconfig['dns_preprocessor'])) $pconfig['dns_preprocessor'] = 'on'; if (empty($pconfig['ssl_preproc'])) $pconfig['ssl_preproc'] = 'on'; if (empty($pconfig['pop_preproc'])) $pconfig['pop_preproc'] = 'on'; if (empty($pconfig['imap_preproc'])) $pconfig['imap_preproc'] = 'on'; if (empty($pconfig['sip_preproc'])) $pconfig['sip_preproc'] = 'on'; if (empty($pconfig['other_preprocs'])) $pconfig['other_preprocs'] = 'on'; if (empty($pconfig['ssh_preproc'])) $pconfig['ssh_preproc'] = 'on'; if (empty($pconfig['http_inspect'])) $pconfig['http_inspect'] = "on"; if (empty($pconfig['http_inspect_proxy_alert'])) $pconfig['http_inspect_proxy_alert'] = "off"; if (empty($pconfig['http_inspect_memcap'])) $pconfig['http_inspect_memcap'] = "150994944"; if (empty($pconfig['http_inspect_max_gzip_mem'])) $pconfig['http_inspect_max_gzip_mem'] = "838860"; if (empty($pconfig['frag3_max_frags'])) $pconfig['frag3_max_frags'] = '8192'; if (empty($pconfig['frag3_memcap'])) $pconfig['frag3_memcap'] = '4194304'; if (empty($pconfig['frag3_detection'])) $pconfig['frag3_detection'] = 'on'; if (empty($pconfig['stream5_reassembly'])) $pconfig['stream5_reassembly'] = 'on'; if (empty($pconfig['stream5_flush_on_alert'])) $pconfig['stream5_flush_on_alert'] = 'off'; if (empty($pconfig['stream5_prune_log_max']) && $pconfig['stream5_prune_log_max'] <> 0) $pconfig['stream5_prune_log_max'] = '1048576'; if (empty($pconfig['stream5_track_tcp'])) $pconfig['stream5_track_tcp'] = 'on'; if (empty($pconfig['stream5_max_tcp'])) $pconfig['stream5_max_tcp'] = '262144'; if (empty($pconfig['stream5_track_udp'])) $pconfig['stream5_track_udp'] = 'on'; if (empty($pconfig['stream5_max_udp'])) $pconfig['stream5_max_udp'] = '131072'; if (empty($pconfig['stream5_udp_timeout'])) $pconfig['stream5_udp_timeout'] = '30'; if (empty($pconfig['stream5_track_icmp'])) $pconfig['stream5_track_icmp'] = 'off'; if (empty($pconfig['stream5_max_icmp'])) $pconfig['stream5_max_icmp'] = '65536'; if (empty($pconfig['stream5_icmp_timeout'])) $pconfig['stream5_icmp_timeout'] = '30'; if (empty($pconfig['stream5_mem_cap'])) $pconfig['stream5_mem_cap']= '8388608'; if (empty($pconfig['pscan_protocol'])) $pconfig['pscan_protocol'] = 'all'; if (empty($pconfig['pscan_type'])) $pconfig['pscan_type'] = 'all'; if (empty($pconfig['pscan_memcap'])) $pconfig['pscan_memcap'] = '10000000'; if (empty($pconfig['pscan_sense_level'])) $pconfig['pscan_sense_level'] = 'medium'; } /* Define the "disabled_preproc_rules.log" file for this interface */ $iface = snort_get_friendly_interface($pconfig['interface']); $disabled_rules_log = "{$snortlogdir}/{$iface}_disabled_preproc_rules.log"; if ($_GET['act'] && isset($_GET['eng_id'])) { $natent = array(); $natent = $pconfig; if ($_GET['act'] == "del_frag3") unset($natent['frag3_engine']['item'][$_GET['eng_id']]); elseif ($_GET['act'] == "del_stream5_tcp") unset($natent['stream5_tcp_engine']['item'][$_GET['eng_id']]); elseif ($_GET['act'] == "del_http_inspect") unset($natent['http_inspect_engine']['item'][$_GET['eng_id']]); elseif ($_GET['act'] == "del_ftp_server") unset($natent['ftp_server_engine']['item'][$_GET['eng_id']]); if (isset($id) && $a_nat[$id]) { $a_nat[$id] = $natent; write_config(); } header("Location: snort_preprocessors.php?id=$id"); exit; } // Check for returned "selected alias" if action is import if ($_GET['act'] == "import" && isset($_GET['varname']) && !empty($_GET['varvalue'])) { $pconfig[$_GET['varname']] = $_GET['varvalue']; } if ($_POST['ResetAll']) { /* Reset all the preprocessor settings to defaults */ $pconfig['perform_stat'] = "off"; $pconfig['host_attribute_table'] = "off"; $pconfig['max_attribute_hosts'] = '10000'; $pconfig['max_attribute_services_per_host'] = '10'; $pconfig['max_paf'] = '16000'; $pconfig['stream5_reassembly'] = "on"; $pconfig['stream5_flush_on_alert'] = 'off'; $pconfig['stream5_prune_log_max'] = '1048576'; $pconfig['stream5_track_tcp'] = "on"; $pconfig['stream5_max_tcp'] = "262144"; $pconfig['stream5_track_udp'] = "on"; $pconfig['stream5_max_udp'] = "131072"; $pconfig['stream5_track_icmp'] = "off"; $pconfig['stream5_max_icmp'] = "65536"; $pconfig['stream5_mem_cap'] = "8388608"; $pconfig['stream5_udp_timeout'] = "30"; $pconfig['stream5_icmp_timeout'] = "30"; $pconfig['http_inspect'] = "on"; $pconfig['http_inspect_proxy_alert'] = "off"; $pconfig['http_inspect_memcap'] = "150994944"; $pconfig['http_inspect_max_gzip_mem'] = "838860"; $pconfig['other_preprocs'] = "on"; $pconfig['ftp_preprocessor'] = "on"; $pconfig['ftp_telnet_inspection_type'] = "stateful"; $pconfig['ftp_telnet_alert_encrypted'] = "off"; $pconfig['ftp_telnet_check_encrypted'] = "on"; $pconfig['ftp_telnet_normalize'] = "on"; $pconfig['ftp_telnet_detect_anomalies'] = "on"; $pconfig['ftp_telnet_ayt_attack_threshold'] = "20"; $pconfig['smtp_preprocessor'] = "on"; $pconfig['sf_portscan'] = "off"; $pconfig['pscan_protocol'] = "all"; $pconfig['pscan_type'] = "all"; $pconfig['pscan_sense_level'] = "medium"; $pconfig['pscan_ignore_scanners'] = ""; $pconfig['pscan_memcap'] = '10000000'; $pconfig['dce_rpc_2'] = "on"; $pconfig['dns_preprocessor'] = "on"; $pconfig['sensitive_data'] = "off"; $pconfig['sdf_alert_data_type'] = "Credit Card,Email Addresses,U.S. Phone Numbers,U.S. Social Security Numbers"; $pconfig['sdf_alert_threshold'] = "25"; $pconfig['sdf_mask_output'] = "off"; $pconfig['ssl_preproc'] = "on"; $pconfig['pop_preproc'] = "on"; $pconfig['imap_preproc'] = "on"; $pconfig['sip_preproc'] = "on"; $pconfig['dnp3_preproc'] = "off"; $pconfig['modbus_preproc'] = "off"; $pconfig['gtp_preproc'] = "off"; $pconfig['ssh_preproc'] = "on"; $pconfig['preproc_auto_rule_disable'] = "off"; $pconfig['protect_preproc_rules'] = "off"; $pconfig['frag3_detection'] = "on"; $pconfig['frag3_max_frags'] = "8192"; $pconfig['frag3_memcap'] = "4194304"; /* Log a message at the top of the page to inform the user */ $savemsg = gettext("All preprocessor settings have been reset to their defaults."); } elseif ($_POST['Submit']) { $natent = array(); $natent = $pconfig; // Validate SDF alert threshold and alert data type values if SDF is enabled if ($_POST['sensitive_data'] == 'on') { if ($_POST['sdf_alert_threshold'] < 1 || $_POST['sdf_alert_threshold'] > 65535) $input_errors[] = gettext("The value for Sensitive_Data_Alert_Threshold must be between 1 and 65,535."); if (empty($_POST['sdf_alert_data_type'])) $input_errors[] = gettext("You must select at least one sensitive data type to inspect for when Sensitive Data detection is enabled."); } /* if no errors write to conf */ if (!$input_errors) { /* post new options */ if ($_POST['max_attribute_hosts'] != "") { $natent['max_attribute_hosts'] = $_POST['max_attribute_hosts']; }else{ $natent['max_attribute_hosts'] = "10000"; } if ($_POST['max_attribute_services_per_host'] != "") { $natent['max_attribute_services_per_host'] = $_POST['max_attribute_services_per_host']; }else{ $natent['max_attribute_services_per_host'] = "10"; } if ($_POST['max_paf'] != "") { $natent['max_paf'] = $_POST['max_paf']; }else{ $natent['max_paf'] = "16000"; } if ($_POST['http_inspect_memcap'] != "") { $natent['http_inspect_memcap'] = $_POST['http_inspect_memcap']; }else{ $natent['http_inspect_memcap'] = "150994944"; } if ($_POST['http_inspect_max_gzip_mem'] != "") { $natent['http_inspect_max_gzip_mem'] = $_POST['http_inspect_max_gzip_mem']; }else{ $natent['http_inspect_max_gzip_mem'] = "838860"; } if ($_POST['stream5_mem_cap'] != "") { $natent['stream5_mem_cap'] = $_POST['stream5_mem_cap']; }else{ $natent['stream5_mem_cap'] = "8388608"; } if ($_POST['stream5_prune_log_max'] != "") { $natent['stream5_prune_log_max'] = $_POST['stream5_prune_log_max']; }else{ $natent['stream5_prune_log_max'] = "1048576"; } if ($_POST['stream5_udp_timeout'] != "") { $natent['stream5_udp_timeout'] = $_POST['stream5_udp_timeout']; }else{ $natent['stream5_udp_timeout'] = "30"; } if ($_POST['stream5_icmp_timeout'] != "") { $natent['stream5_icmp_timeout'] = $_POST['stream5_icmp_timeout']; }else{ $natent['stream5_icmp_timeout'] = "30"; } if ($_POST['stream5_max_tcp'] != "") { $natent['stream5_max_tcp'] = $_POST['stream5_max_tcp']; }else{ $natent['stream5_max_tcp'] = "262144"; } if ($_POST['stream5_max_udp'] != "") { $natent['stream5_max_udp'] = $_POST['stream5_max_udp']; }else{ $natent['stream5_max_udp'] = "131072"; } if ($_POST['stream5_max_icmp'] != "") { $natent['stream5_max_icmp'] = $_POST['stream5_max_icmp']; }else{ $natent['stream5_max_icmp'] = "65536"; } if ($_POST['pscan_protocol'] != "") { $natent['pscan_protocol'] = $_POST['pscan_protocol']; }else{ $natent['pscan_protocol'] = "all"; } if ($_POST['pscan_type'] != "") { $natent['pscan_type'] = $_POST['pscan_type']; }else{ $natent['pscan_type'] = "all"; } if ($_POST['pscan_memcap'] != "") { $natent['pscan_memcap'] = $_POST['pscan_memcap']; }else{ $natent['pscan_memcap'] = "10000000"; } if ($_POST['pscan_sense_level'] != "") { $natent['pscan_sense_level'] = $_POST['pscan_sense_level']; }else{ $natent['pscan_sense_level'] = "medium"; } if ($_POST['pscan_ignore_scanners'] != "") { $natent['pscan_ignore_scanners'] = $_POST['pscan_ignore_scanners']; }else{ $natent['pscan_ignore_scanners'] = ""; } if ($_POST['frag3_max_frags'] != "") { $natent['frag3_max_frags'] = $_POST['frag3_max_frags']; }else{ $natent['frag3_max_frags'] = "8192"; } if ($_POST['frag3_memcap'] != "") { $natent['frag3_memcap'] = $_POST['frag3_memcap']; }else{ $natent['frag3_memcap'] = "4194304"; } if ($_POST['ftp_telnet_inspection_type'] != "") { $natent['ftp_telnet_inspection_type'] = $_POST['ftp_telnet_inspection_type']; }else{ $natent['ftp_telnet_inspection_type'] = "stateful"; } if ($_POST['ftp_telnet_ayt_attack_threshold'] != "") { $natent['ftp_telnet_ayt_attack_threshold'] = $_POST['ftp_telnet_ayt_attack_threshold']; }else{ $natent['ftp_telnet_ayt_attack_threshold'] = "20"; } if ($_POST['sdf_alert_threshold'] != "") { $natent['sdf_alert_threshold'] = $_POST['sdf_alert_threshold']; }else{ $natent['sdf_alert_threshold'] = "25"; } // Set SDF inspection types $natent['sdf_alert_data_type'] = implode(",",$_POST['sdf_alert_data_type']); $natent['perform_stat'] = $_POST['perform_stat'] ? 'on' : 'off'; $natent['host_attribute_table'] = $_POST['host_attribute_table'] ? 'on' : 'off'; $natent['http_inspect'] = $_POST['http_inspect'] ? 'on' : 'off'; $natent['http_inspect_proxy_alert'] = $_POST['http_inspect_proxy_alert'] ? 'on' : 'off'; $natent['other_preprocs'] = $_POST['other_preprocs'] ? 'on' : 'off'; $natent['ftp_preprocessor'] = $_POST['ftp_preprocessor'] ? 'on' : 'off'; $natent['ftp_telnet_alert_encrypted'] = $_POST['ftp_telnet_alert_encrypted'] ? 'on' : 'off'; $natent['ftp_telnet_check_encrypted'] = $_POST['ftp_telnet_check_encrypted'] ? 'on' : 'off'; $natent['ftp_telnet_normalize'] = $_POST['ftp_telnet_normalize'] ? 'on' : 'off'; $natent['ftp_telnet_detect_anomalies'] = $_POST['ftp_telnet_detect_anomalies'] ? 'on' : 'off'; $natent['smtp_preprocessor'] = $_POST['smtp_preprocessor'] ? 'on' : 'off'; $natent['sf_portscan'] = $_POST['sf_portscan'] ? 'on' : 'off'; $natent['dce_rpc_2'] = $_POST['dce_rpc_2'] ? 'on' : 'off'; $natent['dns_preprocessor'] = $_POST['dns_preprocessor'] ? 'on' : 'off'; $natent['sensitive_data'] = $_POST['sensitive_data'] ? 'on' : 'off'; $natent['sdf_mask_output'] = $_POST['sdf_mask_output'] ? 'on' : 'off'; $natent['ssl_preproc'] = $_POST['ssl_preproc'] ? 'on' : 'off'; $natent['pop_preproc'] = $_POST['pop_preproc'] ? 'on' : 'off'; $natent['imap_preproc'] = $_POST['imap_preproc'] ? 'on' : 'off'; $natent['dnp3_preproc'] = $_POST['dnp3_preproc'] ? 'on' : 'off'; $natent['modbus_preproc'] = $_POST['modbus_preproc'] ? 'on' : 'off'; $natent['sip_preproc'] = $_POST['sip_preproc'] ? 'on' : 'off'; $natent['modbus_preproc'] = $_POST['modbus_preproc'] ? 'on' : 'off'; $natent['gtp_preproc'] = $_POST['gtp_preproc'] ? 'on' : 'off'; $natent['ssh_preproc'] = $_POST['ssh_preproc'] ? 'on' : 'off'; $natent['preproc_auto_rule_disable'] = $_POST['preproc_auto_rule_disable'] ? 'on' : 'off'; $natent['protect_preproc_rules'] = $_POST['protect_preproc_rules'] ? 'on' : 'off'; $natent['frag3_detection'] = $_POST['frag3_detection'] ? 'on' : 'off'; $natent['stream5_reassembly'] = $_POST['stream5_reassembly'] ? 'on' : 'off'; $natent['stream5_flush_on_alert'] = $_POST['stream5_flush_on_alert'] ? 'on' : 'off'; $natent['stream5_track_tcp'] = $_POST['stream5_track_tcp'] ? 'on' : 'off'; $natent['stream5_track_udp'] = $_POST['stream5_track_udp'] ? 'on' : 'off'; $natent['stream5_track_icmp'] = $_POST['stream5_track_icmp'] ? 'on' : 'off'; if (isset($id) && $a_nat[$id]) { $a_nat[$id] = $natent; write_config(); } /*************************************************/ /* Update the snort.conf file and rebuild the */ /* rules for this interface. */ /*************************************************/ $rebuild_rules = true; snort_generate_conf($natent); $rebuild_rules = false; /* If 'preproc_auto_rule_disable' is off, then clear log file */ if ($natent['preproc_auto_rule_disable'] == 'off') @unlink("{$disabled_rules_log}"); /*******************************************************/ /* Signal Snort to reload Host Attribute Table if one */ /* is configured and saved. */ /*******************************************************/ if ($natent['host_attribute_table'] == "on" && !empty($natent['host_attribute_data'])) snort_reload_config($natent, "SIGURG"); /* after click go to this page */ header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' ); header( 'Cache-Control: no-store, no-cache, must-revalidate' ); header( 'Cache-Control: post-check=0, pre-check=0', false ); header( 'Pragma: no-cache' ); header("Location: snort_preprocessors.php?id=$id"); exit; } } elseif ($_POST['btn_import']) { if (is_uploaded_file($_FILES['host_attribute_file']['tmp_name'])) { $data = file_get_contents($_FILES['host_attribute_file']['tmp_name']); if ($data === false) $input_errors[] = gettext("Error uploading file {$_FILES['host_attribute_file']}!"); else { if (isset($id) && $a_nat[$id]) { $a_nat[$id]['host_attribute_table'] = "on"; $a_nat[$id]['host_attribute_data'] = base64_encode($data); $pconfig['host_attribute_data'] = $a_nat[$id]['host_attribute_data']; $a_nat[$id]['max_attribute_hosts'] = $pconfig['max_attribute_hosts']; $a_nat[$id]['max_attribute_services_per_host'] = $pconfig['max_attribute_services_per_host']; write_config(); } header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' ); header( 'Cache-Control: no-store, no-cache, must-revalidate' ); header( 'Cache-Control: post-check=0, pre-check=0', false ); header( 'Pragma: no-cache' ); header("Location: snort_preprocessors.php?id=$id"); exit; } } else $input_errors[] = gettext("No filename specified for import!"); } elseif ($_POST['btn_edit_hat']) { if (isset($id) && $a_nat[$id]) { $a_nat[$id]['host_attribute_table'] = "on"; $a_nat[$id]['max_attribute_hosts'] = $pconfig['max_attribute_hosts']; $a_nat[$id]['max_attribute_services_per_host'] = $pconfig['max_attribute_services_per_host']; write_config(); header("Location: snort_edit_hat_data.php?id=$id"); exit; } } /* If Host Attribute Table option is enabled, but */ /* no Host Attribute data exists, flag an error. */ if ($pconfig['host_attribute_table'] == 'on' && empty($pconfig['host_attribute_data'])) $input_errors[] = gettext("The Host Attribute Table option is enabled, but no Host Attribute data has been loaded. Data may be entered manually or imported from a suitable file."); $if_friendly = snort_get_friendly_interface($pconfig['interface']); $pgtitle = gettext("Snort: Interface {$if_friendly} - Preprocessors and Flow"); include_once("head.inc"); ?> ' . $pgtitle . '

';} /* Display Alert message */ if ($input_errors) { print_input_errors($input_errors); // TODO: add checks } if ($savemsg) { print_info_box($savemsg); } ?>
'; echo '
'; $menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface "); $tab_array = array(); $tab_array[] = array($menu_iface . gettext("Settings"), false, "/snort/snort_interfaces_edit.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Categories"), false, "/snort/snort_rulesets.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Rules"), false, "/snort/snort_rules.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Variables"), false, "/snort/snort_define_servers.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Preprocessors"), true, "/snort/snort_preprocessors.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/snort/snort_barnyard.php?id={$id}"); display_top_tabs($tab_array); ?>
>
'on') echo "disabled"; ?>>
 

" . gettext("Hint: ") . "" . gettext("Most users should leave this unchecked."); ?>
> ' . gettext("Not Checked"); ?>.
0): ?>
 
     
> .

  




" class="formbtn">  
" . gettext("Warning: ") . "" . gettext("No Host Attribute Data loaded - import from a file or enter it manually."); } ?>
   " . gettext("32") . "" . gettext(" and Max is ") . "" . gettext("524288") . ""; ?>.
" . gettext("10000") . ""; ?>.
   " . gettext("1") . "" . gettext(" and Max is ") . "" . gettext("65535") . ""; ?>.
" . gettext("10") . ""; ?>.
  " . gettext("0") . "" . gettext(" (off) and Max is ") . "" . gettext("63780") . ""; ?>.

" . gettext("16000") . ". " . gettext("A value of 0 disables Protocol Aware Flushing."); ?>.
> .
> .

" . gettext("By adding Server Configurations below and enabling " . "the 'allow_proxy_use' parameter within them, alerts will be generated for web users that aren't using the configured " . "proxies or are using a rogue proxy server.") . "

" . gettext("Warning: ") . "" . gettext("If users are not required to configure web proxy use, you may get a lot " . "of proxy alerts. Only use this feature with traditional proxy environments. Blind firewall proxies don't count!");?>
  " . gettext("2304") . "" . gettext(" and the Maximum is ") . "" . gettext("603979776") . "" . gettext(" (576 MB)"); ?>.

" . gettext("150,994,944") . "" . gettext(" (144 MB)."); ?> .
  " . gettext("3276") . "";?>.

" . gettext("838860") . "" . gettext(" bytes.");?>
$v): ?>
"> ">
"> "all") : ?> "> ">
> " . gettext("Checked") . ".";?>

" . gettext("4MB") . "."; ?>
.
8192.";?>
$v): ?>
"> ">
"> "all") : ?> "> ">
> " . gettext("Checked") . ""; ?>.
> " . gettext("Not Checked") . "
" . gettext("Note: ") . "" . gettext("This parameter is for backwards compatibility.");?>
0" . gettext(" (disabled), or if not disabled, ") . "1024" . gettext(". Maximum is ") . "" . gettext("1073741824") . "";?>. 1048576" . gettext(" bytes."); ?>
onclick="stream5_track_tcp_enable_change();"> " . gettext("Checked") . "."; ?>
onclick="stream5_track_udp_enable_change();"> " . gettext("Checked") . "."; ?>
onclick="stream5_track_icmp_enable_change();"> " . gettext("Not Checked") . "."; ?>
1" . gettext(" and Max is ") . "" . gettext("1048576") . ".";?>
" . gettext("131072") . "."; ?>
1" . gettext(" and Max is ") . "" . gettext("86400") . "" . gettext(" (1 day).");?>
" . gettext("30") . "" . gettext(" seconds."); ?>
1" . gettext(" and Max is ") . "" . gettext("1048576") . ".";?>
" . gettext("65536") . "."; ?>
1" . gettext(" and Max is ") . "86400" . gettext(" (1 day).");?>
" . gettext("30") . "" . gettext(" seconds."); ?>
1" . gettext(" and Max is ") . "" . gettext("1048576") . ".";?>
" . gettext("262144") . "."; ?>
" . gettext("32768") . "" . gettext(" and Max is ") . "" . gettext("1073741824") . "" . gettext(" bytes.");?>
" . gettext("8388608") . "" . gettext(" (8 MB)"); ?>.
$v): ?>
"> ">
"> "all") : ?> "> ">
> " . gettext("Not Checked") . ""; ?>.
  " . gettext("all") . "."; ?>
  " . gettext("all") . "."; ?>
one scan; one host scans multiple ports on another host."); ?>
many scan; one host scans a single port on multiple hosts."); ?>
one scan; attacker has spoofed source address inter-mixed with real scanning address."); ?>
one scan; multiple hosts query one host for open services."); ?>
  " . gettext("Medium") . "."; ?>
" . gettext("10000000") . "" . gettext(" (10 MB)"); ?>.
10,000,000" . gettext(" bytes. (10 MB)"); ?>
  " . gettext("\$HOME_NET") . ""; ?>. "/>
onclick="ftp_telnet_enable_change();"> " . gettext("Checked") . ""; ?>.
  " . gettext("stateful") . "."; ?>
> " . gettext("Checked") . ""; ?>.
> " . gettext("Not Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
" . gettext("0") . "" . gettext(" to disable. Default is ") . "" . gettext("20.") . "";?>
$v): ?>
"> ">
"> "all") : ?> "> ">
$v): ?>
"> ">
"> "all") : ?> "> ">
>
" . gettext("Global Settings") . "" . gettext(" tab."); ?>



" . gettext("25") . ".";?>
> " . gettext("Not Checked") . "."; ?>
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
>
>
> " . gettext("Checked") . ""; ?>.
> " . gettext("Checked") . ""; ?>.
> " . "" . gettext("Note: ") . "" . gettext("If your network does not contain Modbus-enabled devices, you can leave this preprocessor disabled."); ?>
> " . "" . gettext("Note: ") . "" . gettext("If your network does not contain DNP3-enabled devices, you can leave this preprocessor disabled."); ?>
  ">      >