. * Copyright (C) 2003-2004 Manuel Kasper . * Copyright (C) 2006 Scott Ullrich * Copyright (C) 2009 Robert Zelaya Sr. Developer * Copyright (C) 2012 Ermal Luci * All rights reserved. * * Adapted for Suricata by: * Copyright (C) 2014 Bill Meeks * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ require_once("guiconfig.inc"); require_once("/usr/local/pkg/suricata/suricata.inc"); global $g; $suricatadir = SURICATADIR; $pconfig = array(); // If doing a postback, used typed values, else load from stored config if (!empty($_POST)) { $pconfig = $_POST; } else { $pconfig['enable_vrt_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules']; $pconfig['oinkcode'] = $config['installedpackages']['suricata']['config'][0]['oinkcode']; $pconfig['etprocode'] = $config['installedpackages']['suricata']['config'][0]['etprocode']; $pconfig['enable_etopen_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules']; $pconfig['enable_etpro_rules'] = $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules']; $pconfig['rm_blocked'] = $config['installedpackages']['suricata']['config'][0]['rm_blocked']; $pconfig['autoruleupdate'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdate']; $pconfig['autoruleupdatetime'] = $config['installedpackages']['suricata']['config'][0]['autoruleupdatetime']; $pconfig['live_swap_updates'] = $config['installedpackages']['suricata']['config'][0]['live_swap_updates']; $pconfig['log_to_systemlog'] = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog']; $pconfig['log_to_systemlog_facility'] = $config['installedpackages']['suricata']['config'][0]['log_to_systemlog_facility']; $pconfig['forcekeepsettings'] = $config['installedpackages']['suricata']['config'][0]['forcekeepsettings']; $pconfig['snortcommunityrules'] = $config['installedpackages']['suricata']['config'][0]['snortcommunityrules']; $pconfig['snort_rules_file'] = $config['installedpackages']['suricata']['config'][0]['snort_rules_file']; $pconfig['autogeoipupdate'] = $config['installedpackages']['suricata']['config'][0]['autogeoipupdate']; $pconfig['hide_deprecated_rules'] = $config['installedpackages']['suricata']['config'][0]['hide_deprecated_rules'] == "on" ? 'on' : 'off'; } // Do input validation on parameters if (empty($pconfig['autoruleupdatetime'])) $pconfig['autoruleupdatetime'] = '00:30'; if (empty($pconfig['log_to_systemlog_facility'])) $pconfig['log_to_systemlog_facility'] = "local1"; if ($_POST['autoruleupdatetime']) { if (!preg_match('/^([01]?[0-9]|2[0-3]):?([0-5][0-9])$/', $_POST['autoruleupdatetime'])) $input_errors[] = "Invalid Rule Update Start Time! Please supply a value in 24-hour format as 'HH:MM'."; } if ($_POST['enable_vrt_rules'] == "on" && empty($_POST['snort_rules_file'])) $input_errors[] = "You must supply a snort rules tarball filename in the box provided in order to enable Snort VRT rules!"; if ($_POST['enable_vrt_rules'] == "on" && empty($_POST['oinkcode'])) $input_errors[] = "You must supply an Oinkmaster code in the box provided in order to enable Snort VRT rules!"; if ($_POST['enable_etpro_rules'] == "on" && empty($_POST['etprocode'])) $input_errors[] = "You must supply a subscription code in the box provided in order to enable Emerging Threats Pro rules!"; /* if no errors move foward with save */ if (!$input_errors) { if ($_POST["save"]) { $config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'] = $_POST['enable_vrt_rules'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['snortcommunityrules'] = $_POST['snortcommunityrules'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'] = $_POST['enable_etopen_rules'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'] = $_POST['enable_etpro_rules'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['autogeoipupdate'] = $_POST['autogeoipupdate'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['hide_deprecated_rules'] = $_POST['hide_deprecated_rules'] ? 'on' : 'off'; // If any rule sets are being turned off, then remove them // from the active rules section of each interface. Start // by building an arry of prefixes for the disabled rules. $disabled_rules = array(); $disable_ips_policy = false; if ($config['installedpackages']['suricata']['config'][0]['enable_vrt_rules'] == 'off') { $disabled_rules[] = VRT_FILE_PREFIX; $disable_ips_policy = true; } if ($config['installedpackages']['suricata']['config'][0]['snortcommunityrules'] == 'off') $disabled_rules[] = GPL_FILE_PREFIX; if ($config['installedpackages']['suricata']['config'][0]['enable_etopen_rules'] == 'off') $disabled_rules[] = ET_OPEN_FILE_PREFIX; if ($config['installedpackages']['suricata']['config'][0]['enable_etpro_rules'] == 'off') $disabled_rules[] = ET_PRO_FILE_PREFIX; // Now walk all the configured interface rulesets and remove // any matching the disabled ruleset prefixes. if (is_array($config['installedpackages']['suricata']['rule'])) { foreach ($config['installedpackages']['suricata']['rule'] as &$iface) { // Disable Snort IPS policy if VRT rules are disabled if ($disable_ips_policy) { $iface['ips_policy_enable'] = 'off'; unset($iface['ips_policy']); } $enabled_rules = explode("||", $iface['rulesets']); foreach ($enabled_rules as $k => $v) { foreach ($disabled_rules as $d) if (strpos(trim($v), $d) !== false) unset($enabled_rules[$k]); } $iface['rulesets'] = implode("||", $enabled_rules); } } // If deprecated rules should be removed, then do it if ($config['installedpackages']['suricata']['config'][0]['hide_deprecated_rules'] == "on") { log_error(gettext("[Suricata] Hide Deprecated Rules is enabled. Removing obsoleted rules categories.")); suricata_remove_dead_rules(); } $config['installedpackages']['suricata']['config'][0]['snort_rules_file'] = $_POST['snort_rules_file']; $config['installedpackages']['suricata']['config'][0]['oinkcode'] = $_POST['oinkcode']; $config['installedpackages']['suricata']['config'][0]['etprocode'] = $_POST['etprocode']; $config['installedpackages']['suricata']['config'][0]['rm_blocked'] = $_POST['rm_blocked']; $config['installedpackages']['suricata']['config'][0]['autoruleupdate'] = $_POST['autoruleupdate']; /* Check and adjust format of Rule Update Starttime string to add colon and leading zero if necessary */ if ($_POST['autoruleupdatetime']) { $pos = strpos($_POST['autoruleupdatetime'], ":"); if ($pos === false) { $tmp = str_pad($_POST['autoruleupdatetime'], 4, "0", STR_PAD_LEFT); $_POST['autoruleupdatetime'] = substr($tmp, 0, 2) . ":" . substr($tmp, -2); } $config['installedpackages']['suricata']['config'][0]['autoruleupdatetime'] = str_pad($_POST['autoruleupdatetime'], 4, "0", STR_PAD_LEFT); } $config['installedpackages']['suricata']['config'][0]['log_to_systemlog'] = $_POST['log_to_systemlog'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['log_to_systemlog_facility'] = $_POST['log_to_systemlog_facility']; $config['installedpackages']['suricata']['config'][0]['live_swap_updates'] = $_POST['live_swap_updates'] ? 'on' : 'off'; $config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] = $_POST['forcekeepsettings'] ? 'on' : 'off'; $retval = 0; write_config("Suricata pkg: modified global settings."); /* Toggle cron task for GeoIP database updates if setting was changed */ if ($config['installedpackages']['suricata']['config'][0]['autogeoipupdate'] == 'on' && !suricata_cron_job_exists("/usr/local/pkg/suricata/suricata_geoipupdate.php")) { include("/usr/local/pkg/suricata/suricata_geoipupdate.php"); install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_geoipupdate.php", TRUE, 0, 0, 8, "*", "*", "root"); } elseif ($config['installedpackages']['suricata']['config'][0]['autogeoipupdate'] == 'off' && suricata_cron_job_exists("/usr/local/pkg/suricata/suricata_geoipupdate.php")) install_cron_job("/usr/local/pkg/suricata/suricata_geoipupdate.php", FALSE); /* create passlist and homenet file, then sync files */ conf_mount_rw(); sync_suricata_package_config(); conf_mount_ro(); /* forces page to reload new settings */ header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' ); header( 'Cache-Control: no-store, no-cache, must-revalidate' ); header( 'Cache-Control: post-check=0, pre-check=0', false ); header( 'Pragma: no-cache' ); header("Location: /suricata/suricata_global.php"); exit; } } $pgtitle = gettext("Suricata: Global Settings"); include_once("head.inc"); ?>
" . gettext("Emerging Threats") . "" . gettext(" rules");?>
/>
/>
 
  " . gettext("Note:") . "" . " " . gettext("The ETPro rules contain all of the ETOpen rules, so the ETOpen rules are not required and are disabled when the ETPro rules are selected."); ?>
 

" . gettext("Snort VRT") . "" . gettext(" rules");?>
/>
 
 

" . gettext("snortrules-snapshot-2962.tar.gz");?>

 
" . gettext("Snort Community") . "" . gettext(" rules");?>
/>

" . gettext("Note: ") . "" . gettext("If you are a Snort VRT Paid Subscriber, the community ruleset is already built into your download of the ") . gettext("Snort VRT rules, and there is no benefit in adding this rule set.");?>
/>   " . gettext("Not Checked") . "" . gettext("."); ?>
  " . gettext("NEVER") . "" . gettext(" disables auto-updates."); ?>

" . gettext("Hint: ") . "" . gettext("in most cases, every 12 hours is a good choice."); ?>
/>   " . gettext("00:03") . ""; ?>.

/>  " . gettext("Not Checked") . ""; ?>

/>  " . gettext("Checked") . ""; ?>


" . gettext("If you have a subscription for more current GeoIP updates, uncheck this option and instead create your own process to place the required database files in " . SURICATA_PBI_BASEDIR . "share/GeoIP/."); ?>
 

" . gettext("Hint:") . "" . gettext(" in most cases, 1 hour is a good choice.");?>
/> 
   " . gettext("local1") . "."; ?>
/>