"engine_{$eng_id}", "bind_to" => "", "policy" => "bsd", "timeout" => 30, "max_queued_bytes" => 1048576, "detect_anomalies" => "off", "overlap_limit" => 0, "max_queued_segs" => 2621, "require_3whs" => "off", "startup_3whs_timeout" => 0, "no_reassemble_async" => "off", "dont_store_lg_pkts" => "off", "max_window" => 0, "use_static_footprint_sizes" => "off", "check_session_hijacking" => "off", "ports_client" => "default", "ports_both" => "default", "ports_server" => "none" ); // See if this is initial entry and set to "default" if true if ($eng_id < 1) { $def['name'] = "default"; $def['bind_to'] = "all"; } $pconfig = $def; } else { $pconfig = $a_nat[$eng_id]; // Check for empty values and set sensible defaults if (empty($pconfig['policy'])) $pconfig['policy'] = "bsd"; if (empty($pconfig['timeout'])) $pconfig['timeout'] = 30; if (empty($pconfig['max_queued_bytes']) && $pconfig['max_queued_bytes'] <> 0) $pconfig['max_queued_bytes'] = 1048576; if (empty($pconfig['detect_anomalies'])) $pconfig['detect_anomalies'] = "off"; if (empty($pconfig['overlap_limit'])) $pconfig['overlap_limit'] = 0; if (empty($pconfig['max_queued_segs']) && $pconfig['max_queued_segs'] <> 0) $pconfig['max_queued_segs'] = 2621; if (empty($pconfig['require_3whs'])) $pconfig['require_3whs'] = "off"; if (empty($pconfig['startup_3whs_timeout'])) $pconfig['startup_3whs_timeout'] = 0; if (empty($pconfig['no_reassemble_async'])) $pconfig['no_reassemble_async'] = "off"; if (empty($pconfig['dont_store_lg_pkts'])) $pconfig['dont_store_lg_pkts'] = "off"; if (empty($pconfig['max_window'])) $pconfig['max_window'] = 0; if (empty($pconfig['use_static_footprint_sizes'])) $pconfig['use_static_footprint_sizes'] = "off"; if (empty($pconfig['check_session_hijacking'])) $pconfig['check_session_hijacking'] = "off"; if (empty($pconfig['ports_client'])) $pconfig['ports_client'] = "default"; if (empty($pconfig['ports_both'])) $pconfig['ports_both'] = "default"; if (empty($pconfig['ports_server'])) $pconfig['ports_server'] = "none"; } if ($_POST['Cancel']) { // Clear and close out any session variable we created session_start(); unset($_SESSION['stream5_client_import']); session_write_close(); header("Location: /snort/snort_preprocessors.php?id={$id}#stream5_row"); exit; } // Check for returned "selected alias" if action is import if ($_GET['act'] == "import") { session_start(); if (($_GET['varname'] == "bind_to" || $_GET['varname'] == "ports_client" || $_GET['varname'] == "ports_both" || $_GET['varname'] == "ports_server") && !empty($_GET['varvalue'])) { $pconfig[$_GET['varname']] = htmlspecialchars($_GET['varvalue']); if(!isset($_SESSION['stream5_client_import'])) $_SESSION['stream5_client_import'] = array(); $_SESSION['stream5_client_import'][$_GET['varname']] = $_GET['varvalue']; if (isset($_SESSION['stream5_client_import']['bind_to'])) $pconfig['bind_to'] = $_SESSION['stream5_client_import']['bind_to']; if (isset($_SESSION['stream5_client_import']['ports_client'])) $pconfig['ports_client'] = $_SESSION['stream5_client_import']['ports_client']; if (isset($_SESSION['stream5_client_import']['ports_both'])) $pconfig['ports_both'] = $_SESSION['stream5_client_import']['ports_both']; if (isset($_SESSION['stream5_client_import']['ports_server'])) $pconfig['ports_server'] = $_SESSION['stream5_client_import']['ports_server']; } // If "varvalue" is empty, user likely hit CANCEL in Select Dialog, // so restore any saved values. elseif (empty($_GET['varvalue'])) { if (isset($_SESSION['stream5_client_import']['bind_to'])) $pconfig['bind_to'] = $_SESSION['stream5_client_import']['bind_to']; if (isset($_SESSION['stream5_client_import']['ports_client'])) $pconfig['ports_client'] = $_SESSION['stream5_client_import']['ports_client']; if (isset($_SESSION['stream5_client_import']['ports_both'])) $pconfig['ports_both'] = $_SESSION['stream5_client_import']['ports_both']; if (isset($_SESSION['stream5_client_import']['ports_server'])) $pconfig['ports_server'] = $_SESSION['stream5_client_import']['ports_server']; } else { unset($_SESSION['stream5_client_import']); unset($_SESSION['org_referer']); unset($_SESSION['org_querystr']); session_write_close(); } } if ($_POST['save']) { // Clear and close out any session variable we created session_start(); unset($_SESSION['org_referer']); unset($_SESSION['org_querystr']); unset($_SESSION['stream5_client_import']); session_write_close(); /* Grab all the POST values and save in new temp array */ $engine = array(); if ($_POST['stream5_name']) { $engine['name'] = trim($_POST['stream5_name']); } else { $engine['name'] = "default"; } /* Validate input values before saving */ if ($_POST['stream5_bind_to']) { if (is_alias($_POST['stream5_bind_to'])) { $engine['bind_to'] = $_POST['stream5_bind_to']; if (!snort_is_single_addr_alias($_POST['stream5_bind_to'])) $input_errors[] = gettext("An Alias that evaluates to a single IP address or CIDR network is required for the 'Bind-To IP Address' value."); } elseif (strtolower(trim($_POST['stream5_bind_to'])) == "all") $engine['bind_to'] = "all"; else $input_errors[] = gettext("You must provide a valid Alias or the reserved keyword 'all' for the 'Bind-To IP Address' value."); } else { $input_errors[] = gettext("The 'Bind-To IP Address' value cannot be blank. Provide a valid Alias or the reserved keyword 'all'."); } if ($_POST['stream5_ports_client']) { if (is_alias($_POST['stream5_ports_client'])) $engine['ports_client'] = $_POST['stream5_ports_client']; elseif (strtolower(trim($_POST['stream5_ports_client'])) == "default") $engine['ports_client'] = "default"; elseif (strtolower(trim($_POST['stream5_ports_client'])) == "all") $engine['ports_client'] = "all"; elseif (strtolower(trim($_POST['stream5_ports_client'])) == "none") $engine['ports_client'] = "none"; else $input_errors[] = gettext("You must provide a valid Alias or one of the reserved keywords 'default', 'all' or 'none' for the TCP Target Ports 'ports_client' value."); } if ($_POST['stream5_ports_both']) { if (is_alias($_POST['stream5_ports_both'])) $engine['ports_both'] = $_POST['stream5_ports_both']; elseif (strtolower(trim($_POST['stream5_ports_both'])) == "default") $engine['ports_both'] = "default"; elseif (strtolower(trim($_POST['stream5_ports_both'])) == "all") $engine['ports_both'] = "all"; elseif (strtolower(trim($_POST['stream5_ports_both'])) == "none") $engine['ports_both'] = "none"; else $input_errors[] = gettext("You must provide a valid Alias or one of the reserved keywords 'default', 'all' or 'none' for the TCP Target Ports 'ports_both' value."); } if ($_POST['stream5_ports_server']) { if (is_alias($_POST['stream5_ports_server'])) $engine['ports_server'] = $_POST['stream5_ports_server']; elseif (strtolower(trim($_POST['stream5_ports_server'])) == "default") $engine['ports_server'] = "default"; elseif (strtolower(trim($_POST['stream5_ports_server'])) == "all") $engine['ports_server'] = "all"; elseif (strtolower(trim($_POST['stream5_ports_server'])) == "none") $engine['ports_server'] = "none"; else $input_errors[] = gettext("You must provide a valid Alias or one of the reserved keywords 'default', 'all' or 'none' for the TCP Target Ports 'ports_server' value."); } if (!empty($_POST['stream5_timeout']) || $_POST['stream5_timeout'] == 0) { $engine['timeout'] = $_POST['stream5_timeout']; if ($engine['timeout'] < 1 || $engine['timeout'] > 86400) $input_errors[] = gettext("The value for Timeout must be between 1 and 86400."); } else $engine['timeout'] = 60; if (!empty($_POST['stream5_max_queued_bytes']) || $_POST['stream5_max_queued_bytes'] == 0) { $engine['max_queued_bytes'] = $_POST['stream5_max_queued_bytes']; if ($engine['max_queued_bytes'] <> 0) { if ($engine['max_queued_bytes'] < 1024 || $engine['max_queued_bytes'] > 1073741824) $input_errors[] = gettext("The value for Max_Queued_Bytes must either be 0, or between 1024 and 1073741824."); } } else $engine['max_queued_bytes'] = 1048576; if (!empty($_POST['stream5_max_queued_segs']) || $_POST['stream5_max_queued_segs'] == 0) { $engine['max_queued_segs'] = $_POST['stream5_max_queued_segs']; if ($engine['max_queued_segs'] <> 0) { if ($engine['max_queued_segs'] < 2 || $engine['max_queued_segs'] > 1073741824) $input_errors[] = gettext("The value for Max_Queued_Segs must either be 0, or between 2 and 1073741824."); } } else $engine['max_queued_segs'] = 2621; if (!empty($_POST['stream5_overlap_limit']) || $_POST['stream5_overlap_limit'] == 0) { $engine['overlap_limit'] = $_POST['stream5_overlap_limit']; if ($engine['overlap_limit'] < 0 || $engine['overlap_limit'] > 255) $input_errors[] = gettext("The value for Overlap_Limit must be between 0 and 255."); } else $engine['overlap_limit'] = 0; if (!empty($_POST['stream5_max_window']) || $_POST['stream5_max_window'] == 0) { $engine['max_window'] = $_POST['stream5_max_window']; if ($engine['max_window'] < 0 || $engine['max_window'] > 1073725440) $input_errors[] = gettext("The value for Max_Window must be between 0 and 1073725440."); } else $engine['max_window'] = 0; if (!empty($_POST['stream5_3whs_startup_timeout']) || $_POST['stream5_3whs_startup_timeout'] == 0) { $engine['startup_3whs_timeout'] = $_POST['stream5_3whs_startup_timeout']; if ($engine['startup_3whs_timeout'] < 0 || $engine['startup_3whs_timeout'] > 86400) $input_errors[] = gettext("The value for 3whs_Startup_Timeout must be between 0 and 86400."); } else $engine['startup_3whs_timeout'] = 0; if ($_POST['stream5_policy']) { $engine['policy'] = $_POST['stream5_policy']; } else { $engine['policy'] = "bsd"; } if ($_POST['stream5_ports']) { $engine['ports'] = $_POST['stream5_ports']; } else { $engine['ports'] = "both"; } $engine['detect_anomalies'] = $_POST['stream5_detect_anomalies'] ? 'on' : 'off'; $engine['require_3whs'] = $_POST['stream5_require_3whs'] ? 'on' : 'off'; $engine['no_reassemble_async'] = $_POST['stream5_no_reassemble_async'] ? 'on' : 'off'; $engine['dont_store_lg_pkts'] = $_POST['stream5_dont_store_lg_pkts'] ? 'on' : 'off'; $engine['use_static_footprint_sizes'] = $_POST['stream5_use_static_footprint_sizes'] ? 'on' : 'off'; $engine['check_session_hijacking'] = $_POST['stream5_check_session_hijacking'] ? 'on' : 'off'; /* Can only have one "all" Bind_To address */ if ($engine['bind_to'] == "all" && $engine['name'] <> "default") $input_errors[] = gettext("Only one default Stream5 Engine can be bound to all addresses."); $pconfig = $engine; /* if no errors, write new entry to conf */ if (!$input_errors) { if (isset($eng_id) && $a_nat[$eng_id]) { $a_nat[$eng_id] = $engine; } else $a_nat[] = $engine; /* Reorder the engine array to ensure the */ /* 'bind_to=all' entry is at the bottom */ /* if it contains more than one entry. */ if (count($a_nat) > 1) { $i = -1; foreach ($a_nat as $f => $v) { if ($v['bind_to'] == "all") { $i = $f; break; } } /* Only relocate the entry if we */ /* found it, and it's not already */ /* at the end. */ if ($i > -1 && ($i < (count($a_nat) - 1))) { $tmp = $a_nat[$i]; unset($a_nat[$i]); $a_nat[] = $tmp; } } /* Now write the new engine array to conf */ write_config(); header("Location: /snort/snort_preprocessors.php?id={$id}#stream5_row"); exit; } } $if_friendly = convert_friendly_interface_to_friendly_descr($config['installedpackages']['snortglobal']['rule'][$id]['interface']); $pgtitle = gettext("Snort: Interface {$if_friendly} - Stream5 Preprocessor TCP Engine"); include_once("head.inc"); ?>
"default") echo gettext("Name or description for this engine. (Max 25 characters)"); else echo "" . gettext("The name for the 'default' engine is read-only.") . "";?>
" . gettext("default") . ""; ?>.
"default") : ?>
  "/>
" . gettext("all") . "" . gettext(". Only a single IP address or single network in CIDR form may be specified. ") . gettext("IP Lists are not allowed.");?>

" . gettext("Supplied value must be a pre-configured Alias or the keyword 'all'. ");?>   " . gettext("IP List for the default engine is read-only and must be 'all'.") . "";?>

  " . gettext("BSD") . ""; ?>.


  " . gettext("default") . ".";?> "/>
  " . gettext("none") . ".";?> "/>
  " . gettext("default") . ".";?> "/>



" . gettext("Supplied value must be a pre-configured Alias or the keyword 'default', 'all' or 'none'.");?>
" . gettext("Most users should leave these settings at their default values.");?>
0" . gettext(" and max is ") . "1073725440" . gettext(" (65535 left shift 14)"); ?>.

0" . gettext(" (unlimited). This option is intended to prevent a DoS against Stream5 by " . "attacker using an abnormally large window, so using a value near the maximum is discouraged."); ?>
1" . gettext(" and max is ") . "86400" . gettext(" (approximately 1 day)"); ?>.

30" . gettext(" seconds."); ?>
" . gettext("1024") . "" . gettext(" and Maximum is ") . "" . gettext("1073741824") . "" . gettext(" (") . "" . gettext("0") . "" . gettext(" means Maximum)."); ?>

1048576"); ?>.
" . gettext("2") . "" . gettext(" and Maximum is ") . "" . gettext("1073741824") . "" . gettext(" (") . "" . gettext("0") . "" . gettext(" means Maximum)");?>.

2621"); ?>.
0" . gettext(" (unlimited) and Maximum is ") . "" . gettext("255") . ""; ?>.

0" . gettext(" (unlimited)."); ?>
> " . gettext("Not Checked") . ""; ?>.
> " . gettext("Not Checked") . ""; ?>.

onclick="stream5_3whs_enable_change();"> " . gettext("Not Checked") . ""; ?>.
" . gettext("0") . "" . gettext(" and Max is ") . "" . gettext("86400") . "" . gettext(" (1 day).");?>

" . gettext("0") . "" . gettext(", (don't consider existing sessions established).");?>
> " . gettext("Not Checked") . ""; ?>.
> " . gettext("Not Checked") . ""; ?>.
> " . gettext("Not Checked") . ""; ?>.

" . gettext("Warning: ") . "" . gettext("Enabling this option could result in missed packets. Recommended setting is not checked."); ?>
  ">      ">