. * Copyright (C) 2003-2004 Manuel Kasper . * Copyright (C) 2006 Scott Ullrich * Copyright (C) 2009 Robert Zelaya Sr. Developer * Copyright (C) 2012 Ermal Luci * All rights reserved. * * Adapted for Suricata by: * Copyright (C) 2014 Bill Meeks * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ require_once("guiconfig.inc"); require_once("/usr/local/pkg/suricata/suricata.inc"); global $g, $rebuild_rules; if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; elseif (isset($_GET['id']) && is_numericint($_GET['id'])) $id = htmlspecialchars($_GET['id']); if (is_null($id)) $id=0; if (!is_array($config['installedpackages']['suricata'])) $config['installedpackages']['suricata'] = array(); if (!is_array($config['installedpackages']['suricata']['rule'])) $config['installedpackages']['suricata']['rule'] = array(); // Initialize required array variables as necessary if (!is_array($config['aliases']['alias'])) $config['aliases']['alias'] = array(); $a_aliases = $config['aliases']['alias']; // Initialize Host-OS Policy engine arrays if necessary if (!is_array($config['installedpackages']['suricata']['rule'][$id]['host_os_policy']['item'])) $config['installedpackages']['suricata']['rule'][$id]['host_os_policy']['item'] = array(); $a_nat = &$config['installedpackages']['suricata']['rule']; $host_os_policy_engine_next_id = count($a_nat[$id]['host_os_policy']['item']); // Build a lookup array of currently used engine 'bind_to' Aliases // so we can screen matching Alias names from the list. $used = array(); foreach ($a_nat[$id]['host_os_policy']['item'] as $v) $used[$v['bind_to']] = true; $pconfig = array(); if (isset($id) && $a_nat[$id]) { /* Get current values from config for page form fields */ $pconfig = $a_nat[$id]; // See if Host-OS policy engine array is configured and use // it; otherwise create a default engine configuration. if (empty($pconfig['host_os_policy']['item'])) { $default = array( "name" => "default", "bind_to" => "all", "policy" => "bsd" ); $pconfig['host_os_policy']['item'] = array(); $pconfig['host_os_policy']['item'][] = $default; if (!is_array($a_nat[$id]['host_os_policy']['item'])) $a_nat[$id]['host_os_policy']['item'] = array(); $a_nat[$id]['host_os_policy']['item'][] = $default; write_config(); $host_os_policy_engine_next_id++; } else $pconfig['host_os_policy'] = $a_nat[$id]['host_os_policy']; } // Check for "import or select alias mode" and set flags if TRUE. // "selectalias", when true, displays radio buttons to limit // multiple selections. if ($_POST['import_alias']) { $importalias = true; $selectalias = false; $title = "Host Operating System Policy"; } elseif ($_POST['select_alias']) { $importalias = true; $selectalias = true; $title = "Host Operating System Policy"; // Preserve current OS Policy Engine settings $eng_id = $_POST['eng_id']; $eng_name = $_POST['policy_name']; $eng_bind = $_POST['policy_bind_to']; $eng_policy = $_POST['policy']; $mode = "add_edit_os_policy"; } if ($_POST['save_os_policy']) { if ($_POST['eng_id'] != "") { $eng_id = $_POST['eng_id']; // Grab all the POST values and save in new temp array $engine = array(); $policy_name = trim($_POST['policy_name']); if ($policy_name) { $engine['name'] = $policy_name; } else { $input_errors[] = gettext("The 'Policy Name' value cannot be blank."); $add_edit_os_policy = true; } if ($_POST['policy_bind_to']) { if (is_alias($_POST['policy_bind_to'])) $engine['bind_to'] = $_POST['policy_bind_to']; elseif (strtolower(trim($_POST['policy_bind_to'])) == "all") $engine['bind_to'] = "all"; else { $input_errors[] = gettext("You must provide a valid Alias or the reserved keyword 'all' for the 'Bind-To IP Address' value."); $add_edit_os_policy = true; } } else { $input_errors[] = gettext("The 'Bind-To IP Address' value cannot be blank. Provide a valid Alias or the reserved keyword 'all'."); $add_edit_os_policy = true; } if ($_POST['policy']) { $engine['policy'] = $_POST['policy']; } else { $engine['policy'] = "bsd"; } // Can only have one "all" Bind_To address if ($engine['bind_to'] == "all" && $engine['name'] <> "default") { $input_errors[] = gettext("Only one default OS-Policy Engine can be bound to all addresses."); $add_edit_os_policy = true; $pengcfg = $engine; } // if no errors, write new entry to conf if (!$input_errors) { if (isset($eng_id) && $a_nat[$id]['host_os_policy']['item'][$eng_id]) { $a_nat[$id]['host_os_policy']['item'][$eng_id] = $engine; } else $a_nat[$id]['host_os_policy']['item'][] = $engine; /* Reorder the engine array to ensure the */ /* 'bind_to=all' entry is at the bottom */ /* if it contains more than one entry. */ if (count($a_nat[$id]['host_os_policy']['item']) > 1) { $i = -1; foreach ($a_nat[$id]['host_os_policy']['item'] as $f => $v) { if ($v['bind_to'] == "all") { $i = $f; break; } } /* Only relocate the entry if we */ /* found it, and it's not already */ /* at the end. */ if ($i > -1 && ($i < (count($a_nat[$id]['host_os_policy']['item']) - 1))) { $tmp = $a_nat[$id]['host_os_policy']['item'][$i]; unset($a_nat[$id]['host_os_policy']['item'][$i]); $a_nat[$id]['host_os_policy']['item'][] = $tmp; } } // Now write the new engine array to conf write_config(); $pconfig['host_os_policy']['item'] = $a_nat[$id]['host_os_policy']['item']; } } } elseif ($_POST['add_os_policy']) { $add_edit_os_policy = true; $pengcfg = array( "name" => "engine_{$host_os_policy_engine_next_id}", "bind_to" => "", "policy" => "bsd" ); $eng_id = $host_os_policy_engine_next_id; } elseif ($_POST['edit_os_policy']) { if ($_POST['eng_id'] != "") { $add_edit_os_policy = true; $eng_id = $_POST['eng_id']; $pengcfg = $a_nat[$id]['host_os_policy']['item'][$eng_id]; } } elseif ($_POST['del_os_policy']) { $natent = array(); $natent = $pconfig; if ($_POST['eng_id'] != "") { unset($natent['host_os_policy']['item'][$_POST['eng_id']]); $pconfig = $natent; } if (isset($id) && $a_nat[$id]) { $a_nat[$id] = $natent; write_config(); } } elseif ($_POST['cancel_os_policy']) { $add_edit_os_policy = false; } elseif ($_POST['ResetAll']) { /* Reset all the settings to defaults */ $pconfig['ip_max_frags'] = "65535"; $pconfig['ip_frag_timeout'] = "60"; $pconfig['frag_memcap'] = '33554432'; $pconfig['ip_max_trackers'] = '65535'; $pconfig['frag_hash_size'] = '65536'; $pconfig['flow_memcap'] = '33554432'; $pconfig['flow_prealloc'] = '10000'; $pconfig['flow_hash_size'] = '65536'; $pconfig['flow_emerg_recovery'] = '30'; $pconfig['flow_prune'] = '5'; $pconfig['flow_tcp_new_timeout'] = '60'; $pconfig['flow_tcp_established_timeout'] = '3600'; $pconfig['flow_tcp_closed_timeout'] = '120'; $pconfig['flow_tcp_emerg_new_timeout'] = '10'; $pconfig['flow_tcp_emerg_established_timeout'] = '300'; $pconfig['flow_tcp_emerg_closed_timeout'] = '20'; $pconfig['flow_udp_new_timeout'] = '30'; $pconfig['flow_udp_established_timeout'] = '300'; $pconfig['flow_udp_emerg_new_timeout'] = '10'; $pconfig['flow_udp_emerg_established_timeout'] = '100'; $pconfig['flow_icmp_new_timeout'] = '30'; $pconfig['flow_icmp_established_timeout'] = '300'; $pconfig['flow_icmp_emerg_new_timeout'] = '10'; $pconfig['flow_icmp_emerg_established_timeout'] = '100'; $pconfig['stream_memcap'] = '33554432'; $pconfig['stream_prealloc_sessions'] = '32768'; $pconfig['reassembly_memcap'] = '67108864'; $pconfig['reassembly_depth'] = '1048576'; $pconfig['reassembly_to_server_chunk'] = '2560'; $pconfig['reassembly_to_client_chunk'] = '2560'; $pconfig['enable_midstream_sessions'] = 'off'; $pconfig['enable_async_sessions'] = 'off'; /* Log a message at the top of the page to inform the user */ $savemsg = gettext("All flow and stream settings have been reset to their defaults. Click APPLY to save the changes."); } elseif ($_POST['save'] || $_POST['apply']) { $natent = array(); $natent = $pconfig; // TODO: validate input values /* if no errors write to conf */ if (!$input_errors) { if ($_POST['ip_max_frags'] != "") { $natent['ip_max_frags'] = $_POST['ip_max_frags']; }else{ $natent['ip_max_frags'] = "65535"; } if ($_POST['ip_frag_timeout'] != "") { $natent['ip_frag_timeout'] = $_POST['ip_frag_timeout']; }else{ $natent['ip_frag_timeout'] = "60"; } if ($_POST['frag_memcap'] != "") { $natent['frag_memcap'] = $_POST['frag_memcap']; }else{ $natent['frag_memcap'] = "33554432"; } if ($_POST['ip_max_trackers'] != "") { $natent['ip_max_trackers'] = $_POST['ip_max_trackers']; }else{ $natent['ip_max_trackers'] = "65535"; } if ($_POST['frag_hash_size'] != "") { $natent['frag_hash_size'] = $_POST['frag_hash_size']; }else{ $natent['frag_hash_size'] = "65536"; } if ($_POST['flow_memcap'] != "") { $natent['flow_memcap'] = $_POST['flow_memcap']; }else{ $natent['flow_memcap'] = "33554432"; } if ($_POST['flow_prealloc'] != "") { $natent['flow_prealloc'] = $_POST['flow_prealloc']; }else{ $natent['flow_prealloc'] = "10000"; } if ($_POST['flow_hash_size'] != "") { $natent['flow_hash_size'] = $_POST['flow_hash_size']; }else{ $natent['flow_hash_size'] = "65536"; } if ($_POST['flow_emerg_recovery'] != "") { $natent['flow_emerg_recovery'] = $_POST['flow_emerg_recovery']; }else{ $natent['flow_emerg_recovery'] = "30"; } if ($_POST['flow_prune'] != "") { $natent['flow_prune'] = $_POST['flow_prune']; }else{ $natent['flow_prune'] = "5"; } if ($_POST['flow_tcp_new_timeout'] != "") { $natent['flow_tcp_new_timeout'] = $_POST['flow_tcp_new_timeout']; }else{ $natent['flow_tcp_new_timeout'] = "60"; } if ($_POST['flow_tcp_established_timeout'] != "") { $natent['flow_tcp_established_timeout'] = $_POST['flow_tcp_established_timeout']; }else{ $natent['flow_tcp_established_timeout'] = "3600"; } if ($_POST['flow_tcp_closed_timeout'] != "") { $natent['flow_tcp_closed_timeout'] = $_POST['flow_tcp_closed_timeout']; }else{ $natent['flow_tcp_closed_timeout'] = "120"; } if ($_POST['flow_tcp_emerg_new_timeout'] != "") { $natent['flow_tcp_emerg_new_timeout'] = $_POST['flow_tcp_emerg_new_timeout']; }else{ $natent['flow_tcp_emerg_new_timeout'] = "10"; } if ($_POST['flow_tcp_emerg_established_timeout'] != "") { $natent['flow_tcp_emerg_established_timeout'] = $_POST['flow_tcp_emerg_established_timeout']; }else{ $natent['flow_tcp_emerg_established_timeout'] = "300"; } if ($_POST['flow_tcp_emerg_closed_timeout'] != "") { $natent['flow_tcp_emerg_closed_timeout'] = $_POST['flow_tcp_emerg_closed_timeout']; }else{ $natent['flow_tcp_emerg_closed_timeout'] = "20"; } if ($_POST['flow_udp_new_timeout'] != "") { $natent['flow_udp_new_timeout'] = $_POST['flow_udp_new_timeout']; }else{ $natent['flow_udp_new_timeout'] = "30"; } if ($_POST['flow_udp_established_timeout'] != "") { $natent['flow_udp_established_timeout'] = $_POST['flow_udp_established_timeout']; }else{ $natent['flow_udp_established_timeout'] = "300"; } if ($_POST['flow_udp_emerg_new_timeout'] != "") { $natent['flow_udp_emerg_new_timeout'] = $_POST['flow_udp_emerg_new_timeout']; }else{ $natent['flow_udp_emerg_new_timeout'] = "10"; } if ($_POST['flow_udp_emerg_established_timeout'] != "") { $natent['flow_udp_emerg_established_timeout'] = $_POST['flow_udp_emerg_established_timeout']; }else{ $natent['flow_udp_emerg_established_timeout'] = "100"; } if ($_POST['flow_icmp_new_timeout'] != "") { $natent['flow_icmp_new_timeout'] = $_POST['flow_icmp_new_timeout']; }else{ $natent['flow_icmp_new_timeout'] = "30"; } if ($_POST['flow_icmp_established_timeout'] != "") { $natent['flow_icmp_established_timeout'] = $_POST['flow_icmp_established_timeout']; }else{ $natent['flow_icmp_established_timeout'] = "300"; } if ($_POST['flow_icmp_emerg_new_timeout'] != "") { $natent['flow_icmp_emerg_new_timeout'] = $_POST['flow_icmp_emerg_new_timeout']; }else{ $natent['flow_icmp_emerg_new_timeout'] = "10"; } if ($_POST['flow_icmp_emerg_established_timeout'] != "") { $natent['flow_icmp_emerg_established_timeout'] = $_POST['flow_icmp_emerg_established_timeout']; }else{ $natent['flow_icmp_emerg_established_timeout'] = "100"; } if ($_POST['stream_memcap'] != "") { $natent['stream_memcap'] = $_POST['stream_memcap']; }else{ $natent['stream_memcap'] = "33554432"; } if ($_POST['stream_prealloc_sessions'] != "") { $natent['stream_prealloc_sessions'] = $_POST['stream_prealloc_sessions']; }else{ $natent['stream_prealloc_sessions'] = "32768"; } if ($_POST['enable_midstream_sessions'] == "on") { $natent['enable_midstream_sessions'] = 'on'; }else{ $natent['enable_midstream_sessions'] = 'off'; } if ($_POST['enable_async_sessions'] == "on") { $natent['enable_async_sessions'] = 'on'; }else{ $natent['enable_async_sessions'] = 'off'; } if ($_POST['reassembly_memcap'] != "") { $natent['reassembly_memcap'] = $_POST['reassembly_memcap']; }else{ $natent['reassembly_memcap'] = "67108864"; } if ($_POST['reassembly_depth'] != "") { $natent['reassembly_depth'] = $_POST['reassembly_depth']; }else{ $natent['reassembly_depth'] = "1048576"; } if ($_POST['reassembly_to_server_chunk'] != "") { $natent['reassembly_to_server_chunk'] = $_POST['reassembly_to_server_chunk']; }else{ $natent['reassembly_to_server_chunk'] = "2560"; } if ($_POST['reassembly_to_client_chunk'] != "") { $natent['reassembly_to_client_chunk'] = $_POST['reassembly_to_client_chunk']; }else{ $natent['reassembly_to_client_chunk'] = "2560"; } /**************************************************/ /* If we have a valid rule ID, save configuration */ /* then update the suricata.conf file for this */ /* interface. */ /**************************************************/ if (isset($id) && $a_nat[$id]) { $a_nat[$id] = $natent; write_config(); $rebuild_rules = false; conf_mount_rw(); suricata_generate_yaml($natent); conf_mount_ro(); // Sync to configured CARP slaves if any are enabled suricata_sync_on_changes(); } header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' ); header( 'Cache-Control: no-store, no-cache, must-revalidate' ); header( 'Cache-Control: post-check=0, pre-check=0', false ); header( 'Pragma: no-cache' ); header("Location: suricata_flow_stream.php?id=$id"); exit; } } elseif ($_POST['save_import_alias']) { // If saving out of "select alias" mode, // then return to Host OS Policy Engine edit // page. if ($_POST['mode'] =='add_edit_os_policy') { $pengcfg = array(); $eng_id = $_POST['eng_id']; $pengcfg['name'] = $_POST['eng_name']; $pengcfg['bind_to'] = $_POST['eng_bind']; $pengcfg['policy'] = $_POST['eng_policy']; $add_edit_os_policy = true; $mode = "add_edit_os_policy"; if (is_array($_POST['aliastoimport']) && count($_POST['aliastoimport']) == 1) { $pengcfg['bind_to'] = $_POST['aliastoimport'][0]; $importalias = false; $selectalias = false; } else { $input_errors[] = gettext("No Alias is selected for import. Nothing to SAVE."); $importalias = true; $selectalias = true; $eng_id = $_POST['eng_id']; $eng_name = $_POST['eng_name']; $eng_bind = $_POST['eng_bind']; $eng_policy = $_POST['eng_policy']; } } else { // Assume we are importing one or more aliases // for use in new Host OS Policy engines. $engine = array( "name" => "", "bind_to" => "", "policy" => "bsd" ); // See if anything was checked to import if (is_array($_POST['aliastoimport']) && count($_POST['aliastoimport']) > 0) { foreach ($_POST['aliastoimport'] as $item) { $engine['name'] = strtolower($item); $engine['bind_to'] = $item; $a_nat[$id]['host_os_policy']['item'][] = $engine; } } else { $input_errors[] = gettext("No entries were selected for import. Please select one or more Aliases for import and click SAVE."); $importalias = true; } // if no errors, write new entry to conf if (!$input_errors) { // Reorder the engine array to ensure the // 'bind_to=all' entry is at the bottom if // the array contains more than one entry. if (count($a_nat[$id]['host_os_policy']['item']) > 1) { $i = -1; foreach ($a_nat[$id]['host_os_policy']['item'] as $f => $v) { if ($v['bind_to'] == "all") { $i = $f; break; } } // Only relocate the entry if we // found it, and it's not already // at the end. if ($i > -1 && ($i < (count($a_nat[$id]['host_os_policy']['item']) - 1))) { $tmp = $a_nat[$id]['host_os_policy']['item'][$i]; unset($a_nat[$id]['host_os_policy']['item'][$i]); $a_nat[$id]['host_os_policy']['item'][] = $tmp; } $pconfig['host_os_policy']['item'] = $a_nat[$id]['host_os_policy']['item']; } // Write the new engine array to config file write_config(); $importalias = false; $selectalias = false; } } } elseif ($_POST['cancel_import_alias']) { $importalias = false; $selectalias = false; $eng_id = $_POST['eng_id']; // If cancelling out of "select alias" mode, // then return to Host OS Policy Engine edit // page. if ($_POST['mode'] == 'add_edit_os_policy') { $pengcfg = array(); $pengcfg['name'] = $_POST['eng_name']; $pengcfg['bind_to'] = $_POST['eng_bind']; $pengcfg['policy'] = $_POST['eng_policy']; $add_edit_os_policy = true; } } $if_friendly = convert_friendly_interface_to_friendly_descr($pconfig['interface']); $pgtitle = gettext("Suricata: Interface {$if_friendly} - Flow and Stream"); include_once("head.inc"); ?>
'; echo '
'; $menu_iface=($if_friendly?substr($if_friendly,0,5)." ":"Iface "); $tab_array = array(); $tab_array[] = array($menu_iface . gettext("Settings"), false, "/suricata/suricata_interfaces_edit.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Categories"), false, "/suricata/suricata_rulesets.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Rules"), false, "/suricata/suricata_rules.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Flow/Stream"), true, "/suricata/suricata_flow_stream.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("App Parsers"), false, "/suricata/suricata_app_parsers.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Variables"), false, "/suricata/suricata_define_vars.php?id={$id}"); $tab_array[] = array($menu_iface . gettext("Barnyard2"), false, "/suricata/suricata_barnyard.php?id={$id}"); display_top_tabs($tab_array, true); ?>
'; echo ''; echo ''; } ?>
$v): ?>
"/> "/>
"/> "all") : ?> "/> ">
  " . gettext("33,554,432") . "" . gettext(" bytes (32 MB)."); ?>

  " . gettext("65,535") . "" . gettext(" fragments.");?>

  " . gettext("65,535") . "" . gettext(" fragments.");?>



" . gettext("This must be equal to or greater than the Max Trackers value specified above."); ?>
  " . gettext("65,536") . "" . gettext(" entries."); ?>

  " . gettext("60") . "" . gettext(" seconds.");?>

  " . gettext("33,554,432") . "" . gettext(" bytes (32 MB)"); ?>
  " . gettext("65,536") . "" . gettext(" entries."); ?>
  " . gettext("10,000") . "" . gettext(" flows."); ?>
  " . gettext("30%") . "."; ?>
  " . gettext("5") . "" . gettext(" flows."); ?>
  " . gettext("60") . "."; ?>
  " . gettext("3600") . "."; ?>
  " . gettext("120") . "."; ?>
  " . gettext("10") . "."; ?>
  " . gettext("300") . "."; ?>
  " . gettext("20") . "."; ?>
  " . gettext("30") . "."; ?>
  " . gettext("300") . "."; ?>
  " . gettext("10") . "."; ?>
  " . gettext("100") . "."; ?>
  " . gettext("30") . "."; ?>
  " . gettext("300") . "."; ?>
  " . gettext("10") . "."; ?>
  " . gettext("100") . "."; ?>
  " . gettext("33,554,432") . "" . gettext(" bytes (32MB)"); ?>

  " . gettext("32,768") . "" . gettext(" sessions."); ?>

> " . gettext("Not Checked") . "."; ?>
> " . gettext("Not Checked") . "."; ?>
  " . gettext("67,108,864") . "" . gettext(" bytes (64MB)."); ?>

  " . gettext("1,048,576") . "" . gettext(" bytes (1MB)."); ?>

" . "" . gettext("Note: ") . "" . gettext("Set to 0 (unlimited) to reassemble entire stream. This is required for file extraction."); ?>
  " . gettext("2,560") . "" . gettext(" bytes."); ?>

  " . gettext("2,560") . "" . gettext(" bytes."); ?>

  ">      >