Ruleset-retrieve obtains the newest Snort IDS ruleset from www.snort.org or whitehats.com and inserts your ip address into the appropriate areas.
b8bb6e29cff60690998357271c7e4ebbd86123e027df695e6983acae1a84cd10
/*
Obtains ruleset from www.snort.org or whitehats.com
and inserts your ip address into appropriate areas.
Starts snort -c <ruleset> -D
vacuum@technotronic.com 2000
Special thanks to S (super@udel.edu) and
shift@codemonkey.net for input.
Uses ideas from address_config.sh by Sten Kalenda Apeldoorn
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <unistd.h>
#include <netinet/in.h>
#include <string.h>
#include <stdlib.h>
#include <rpc/rpc.h>
FILE *fp, *stream, *stream2;
int mask = 32; /* Change to match your subnet */
int main(int argc, char *argv[]){
char *p;
char ruleset[1024];
char home_net[1024];
char internal[1024];
char external[1024];
char portscan[1024];
char interface[1024];
char buf[64000];
int sockfd;
struct hostent *he;
struct sockaddr_in sn;
int header = 1;
if (argc !=3)
{
printf("%s retrieves rulesets from http://www.snort.org\n",argv[0]);
printf("and modifies the var HOME_NET to match your IP address.\n");
printf("If <ruleset> is vision.conf then, %s retrieves file from\n", argv[
0]);
printf("http://www.whitehats.com\nvacuum@technotronic.com 2000\n");
printf("Usage: %s <ruleset> <interface>\n\n",argv[0]);
exit(-1);
}
/* Get IP address for ruleset variables */
get_myaddress(&sn);
sprintf(home_net, "var HOME_NET %s/%d\n",inet_ntoa(sn.sin_addr),mask); /* sn
ort.org */
sprintf(internal, "var INTERNAL %s/%d\n",inet_ntoa(sn.sin_addr),mask); /* sn
ort.org */
sprintf(external, "var EXTERNAL !%s/%d\n",inet_ntoa(sn.sin_addr),mask); /* wh
itehat.com */
sprintf(portscan, "#preprocessor portscan %s/%d 3 5 /var/log/snort_portscan.l
og\n",inet_ntoa(sn.sin_addr),mask);
if((stream = fopen(argv[1], "w" )) == NULL){
printf("Could not open %s\n",argv[1]);
exit(-1);
}
printf("Retrieving %s from ",argv[1]);
if(strstr(argv[1], "vision.conf"))
{
if ((he = gethostbyname("www.whitehats.com")) == NULL) {
printf("http://www.whitehats.com\n");
herror("gethostbyname");
exit(-1);
}
printf("http://www.whitehats.com\n");
}
else
{
if ((he = gethostbyname("www.snort.org")) == NULL) {
printf("http://www.snort.org\n");
herror("gethostbyname");
exit(-1);
}
printf("http://www.snort.org\n");
}
sn.sin_family = he->h_addrtype;
memcpy(&sn.sin_addr, he->h_addr, he->h_length);
sn.sin_port = htons(80);
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
{
perror("socket");
exit(-1);
}
else
printf( "Socket initialized.\n");
if ((connect(sockfd, (struct sockaddr*)&sn,sizeof(sn)) == -1))
{
perror("connect");
printf("port 80 (http) not open\n");
exit(-1);
}
else
{
printf("Connected.\n");
}
if((fp = fdopen(sockfd,"r+")) == NULL)
{
printf("Error opening file descriptor on socket\n");
exit(-1);
}
if(strstr(argv[1], "vision.conf"))
sprintf(ruleset, "GET http://www.whitehats.com/ids/vision.conf \n\n");
else
sprintf(ruleset, "GET /files/%s \n\n",argv[1]);
printf("Retrieving File: %s\n",argv[1]);
if((fputs(ruleset,fp)) == -1)
{
printf("Error sending request\n");
exit(-1);
}
else
printf("Receiving Data...\n");
while(fgets(buf, sizeof(buf), fp))
{
if(strstr(buf, "var HOME_NET yournet/subnet"))
{
fputs(home_net, stream);
printf("Modified %s\n",home_net);
}
else
if(strstr(buf, "var INTERNAL 10.0.0.0/24"))
{
fputs(internal, stream);
printf("Modified %s\n", internal);
}
else
if(strstr(buf, "var EXTERNAL !10.0.0.0/24"))
{
fputs(external, stream);
printf("Modified %s\n", external);
}
else
if(strstr(buf, "#preprocessor portscan: 12.23.34.45/32 3 5 /var
/log/snort_portscan.log"))
{
fputs(portscan, stream);
printf("Modified %s\n",portscan);
}
else
fputs(buf,stream);
}
close(sockfd);
fclose(stream);
sprintf(interface, "`cat /var/run/snort_%s.pid`",argv[2]);
execlp("snort", "snort", "-c", argv[1], "-i", argv[2], "-D", NULL);
exit(0);
}