' . $pgtitle . '

\n\n"; echo "Please click on the Update Rules tab to install your selected rule sets."; include("fend.inc"); echo ""; echo ""; exit(0); } else { /* Make sure that we have the rules */ mwexec("/bin/cp /usr/local/etc/snort/rules/*.rules /usr/local/etc/snort/snort_{$iface_uuid}_{$if_real}/rules", true); } } function get_middle($source, $beginning, $ending, $init_pos) { $beginning_pos = strpos($source, $beginning, $init_pos); $middle_pos = $beginning_pos + strlen($beginning); $ending_pos = strpos($source, $ending, $beginning_pos); $middle = substr($source, $middle_pos, $ending_pos - $middle_pos); return $middle; } function write_rule_file($content_changed, $received_file) { @file_put_contents($received_file, implode("\n", $content_changed)); } function load_rule_file($incoming_file) { //read file into string, and get filesize $contents = @file_get_contents($incoming_file); //split the contents of the string file into an array using the delimiter return explode("\n", $contents); } $ruledir = "/usr/local/etc/snort/snort_{$iface_uuid}_{$if_real}/rules/"; //$ruledir = "/usr/local/etc/snort/rules/"; $dh = opendir($ruledir); while (false !== ($filename = readdir($dh))) { //only populate this array if its a rule file $isrulefile = strstr($filename, ".rules"); if ($isrulefile !== false) $files[] = $filename; } sort($files); if ($_GET['openruleset']) $rulefile = $_GET['openruleset']; else $rulefile = $ruledir.$files[0]; if ($_POST) { conf_mount_rw(); if (!$_POST['apply']) { //retrieve POST data $post_lineid = $_POST['lineid']; $post_enabled = $_POST['enabled']; $post_src = $_POST['src']; $post_srcport = $_POST['srcport']; $post_dest = $_POST['dest']; $post_destport = $_POST['destport']; //clean up any white spaces insert by accident $post_src = str_replace(" ", "", $post_src); $post_srcport = str_replace(" ", "", $post_srcport); $post_dest = str_replace(" ", "", $post_dest); $post_destport = str_replace(" ", "", $post_destport); //copy rule contents from array into string $tempstring = $splitcontents[$post_lineid]; //search string $findme = "# alert"; //find string for disabled alerts //find if alert is disabled $disabled = strstr($tempstring, $findme); //if find alert is false, then rule is disabled if ($disabled !== false) { //has rule been enabled if ($post_enabled == "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("# alert", "alert", $tempstring); $counter2 = 1; } else { //rule is staying disabled $counter2 = 2; } } else { //has rule been disabled if ($post_enabled != "yes") { //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("alert", "# alert", $tempstring); $counter2 = 2; } else { //rule is staying enabled $counter2 = 1; } } //explode rule contents into an array, (delimiter is space) $rule_content = explode(' ', $tempstring); //insert new values $counter2++; $rule_content[$counter2] = $post_src;//source location $counter2++; $rule_content[$counter2] = $post_srcport;//source port location $counter2 = $counter2+2; $rule_content[$counter2] = $post_dest;//destination location $counter2++; $rule_content[$counter2] = $post_destport;//destination port location //implode the array back into string $tempstring = implode(' ', $rule_content); //copy string into file array for writing $splitcontents[$post_lineid] = $tempstring; //write the new .rules file write_rule_file($splitcontents, $rulefile); //once file has been written, reload file $splitcontents = load_rule_file($rulefile); $stopMsg = true; } conf_mount_ro(); } else if ($_GET['act'] == "toggle") { conf_mount_rw(); $toggleid = $_GET['ids']; //copy rule contents from array into string $tempstring = $splitcontents[$toggleid]; //explode rule contents into an array, (delimiter is space) $rule_content = explode(' ', $tempstring); //search string $findme = "# alert"; //find string for disabled alerts //find if alert is disabled $disabled = strstr($tempstring, $findme); //if find alert is false, then rule is disabled if ($disabled !== false) { //rule has been enabled //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("# alert", "alert", $tempstring); } else { //has rule been disabled //move counter up 1, so we do not retrieve the # in the rule_content array $tempstring = str_replace("alert", "# alert", $tempstring); } //copy string into array for writing $splitcontents[$toggleid] = $tempstring; //write the new .rules file write_rule_file($splitcontents, $rulefile); //once file has been written, reload file $splitcontents = load_rule_file($rulefile); $stopMsg = true; //write disable/enable sid to config.xml if ($disabled == false) { $string_sid = strstr($tempstring, 'sid:'); $sid_pieces = explode(";", $string_sid); $sid_off_cut = $sid_pieces[0]; // sid being turned off $sid_off = str_replace("sid:", "", $sid_off_cut); // rule_sid_on registers $sid_on_pieces = $a_nat[$id]['rule_sid_on']; // if off sid is the same as on sid remove it $sid_on_old = str_replace("||enablesid $sid_off", "", "$sid_on_pieces"); // write the replace sid back as empty $a_nat[$id]['rule_sid_on'] = $sid_on_old; // rule sid off registers $sid_off_pieces = $a_nat[$id]['rule_sid_off']; // if off sid is the same as off sid remove it $sid_off_old = str_replace("||disablesid $sid_off", "", "$sid_off_pieces"); // write the replace sid back as empty $a_nat[$id]['rule_sid_off'] = $sid_off_old; // add sid off registers to new off sid $a_nat[$id]['rule_sid_off'] = "||disablesid $sid_off" . $a_nat[$id]['rule_sid_off']; } else { $string_sid = strstr($tempstring, 'sid:'); $sid_pieces = explode(";", $string_sid); $sid_on_cut = $sid_pieces[0]; // sid being turned off $sid_on = str_replace("sid:", "", $sid_on_cut); // rule_sid_off registers $sid_off_pieces = $a_nat[$id]['rule_sid_off']; // if off sid is the same as on sid remove it $sid_off_old = str_replace("||disablesid $sid_on", "", "$sid_off_pieces"); // write the replace sid back as empty $a_nat[$id]['rule_sid_off'] = $sid_off_old; // rule sid on registers $sid_on_pieces = $a_nat[$id]['rule_sid_on']; // if on sid is the same as on sid remove it $sid_on_old = str_replace("||enablesid $sid_on", "", "$sid_on_pieces"); // write the replace sid back as empty $a_nat[$id]['rule_sid_on'] = $sid_on_old; // add sid on registers to new on sid $a_nat[$id]['rule_sid_on'] = "||enablesid $sid_on" . $a_nat[$id]['rule_sid_on']; } write_config(); conf_mount_ro(); } if ($_GET['saved'] == 'yes') { $message = "The Snort rule configuration has been changed.
You must restart this snort interface in order for the changes to take effect."; // stop_service("snort"); // sleep(2); // start_service("snort"); // $savemsg = ""; // $stopMsg = false; } $currentruleset = basename($rulefile); $ifname = strtoupper($pconfig['interface']); require_once("guiconfig.inc"); include_once("head.inc"); $pgtitle = "Snort: $id $iface_uuid $if_real Category: $currentruleset"; ?> ' . $pgtitle . '

$value ) { $disabled = "False"; $comments = "False"; $findme = "# alert"; //find string for disabled alerts $disabled_pos = strstr($value, $findme); $counter2 = 1; $sid = get_middle($value, 'sid:', ';', 0); //check to see if the sid is numberical if (!is_numeric($sid)) continue; //if find alert is false, then rule is disabled if ($disabled_pos !== false){ $counter2 = $counter2+1; $textss = ""; $textse = ""; $iconb = "icon_block_d.gif"; $ischecked = ""; } else { $textss = $textse = ""; $iconb = "icon_block.gif"; $ischecked = "checked"; } $rule_content = explode(' ', $value); $protocol = $rule_content[$counter2];//protocol location $counter2++; $source = substr($rule_content[$counter2], 0, 20) . "...";//source location $counter2++; $source_port = $rule_content[$counter2];//source port location $counter2 = $counter2+2; $destination = substr($rule_content[$counter2], 0, 20) . "...";//destination location $counter2++; $destination_port = $rule_content[$counter2];//destination port location if (strstr($value, 'msg: "')) $message = get_middle($value, 'msg: "', '";', 0); else if (strstr($value, 'msg:"')) $message = get_middle($value, 'msg:"', '";', 0); echo ""; ?> Category: {$value}\n"; } ?>   SID Proto Source Port Destination Port Message $textss\n"; ?> $textss $sid $textse $textss $protocol"; echo "$textse $textss $source $textse $textss $source_port $textse $textss $destination $textse $textss $destination_port $textse $textss $message $textse

There are {$counter} rules in this category. "; ?>

Rule Enabled Rule Disabled