/* 
   Obtains ruleset from www.snort.org or whitehats.com
   and inserts your ip address into appropriate areas.
   Starts snort -c <ruleset> -D 

   vacuum@technotronic.com 2000
   Special thanks to S (super@udel.edu) and
   shift@codemonkey.net for input.
   Uses ideas from address_config.sh by Sten Kalenda Apeldoorn
 */

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <unistd.h>
#include <netinet/in.h>
#include <string.h>
#include <stdlib.h>
#include <rpc/rpc.h>

FILE *fp, *stream, *stream2;
int mask = 32; /* Change to match your subnet */

int main(int argc, char *argv[]){
  char *p;
  char ruleset[1024];
  char home_net[1024];
  char internal[1024];
  char external[1024];
  char portscan[1024];
  char interface[1024];

  char buf[64000];
  int sockfd;
  struct  hostent *he;
  struct sockaddr_in sn;
  int header = 1;
 
  if (argc !=3)
  {
     printf("%s retrieves rulesets from http://www.snort.org\n",argv[0]);
     printf("and modifies the var HOME_NET to match your IP address.\n"); 
     printf("If <ruleset> is vision.conf then, %s retrieves file from\n", argv[
0]);
     printf("http://www.whitehats.com\nvacuum@technotronic.com 2000\n"); 
     printf("Usage: %s <ruleset> <interface>\n\n",argv[0]);
     exit(-1);
  } 

  /* Get IP address for ruleset variables */ 
  get_myaddress(&sn);
  sprintf(home_net, "var HOME_NET %s/%d\n",inet_ntoa(sn.sin_addr),mask);  /* sn
ort.org */
  sprintf(internal, "var INTERNAL %s/%d\n",inet_ntoa(sn.sin_addr),mask);  /* sn
ort.org */
  sprintf(external, "var EXTERNAL !%s/%d\n",inet_ntoa(sn.sin_addr),mask); /* wh
itehat.com */
  sprintf(portscan, "#preprocessor portscan %s/%d 3 5 /var/log/snort_portscan.l
og\n",inet_ntoa(sn.sin_addr),mask);

  
  if((stream = fopen(argv[1], "w" )) == NULL){
      printf("Could not open %s\n",argv[1]);
      exit(-1);
   }
printf("Retrieving %s from ",argv[1]);
if(strstr(argv[1], "vision.conf"))
  {
   if ((he = gethostbyname("www.whitehats.com")) == NULL) {
     printf("http://www.whitehats.com\n");  
     herror("gethostbyname");
     exit(-1);
     }
    printf("http://www.whitehats.com\n");
  }
   
  else
  {
   if ((he = gethostbyname("www.snort.org")) == NULL) {
      printf("http://www.snort.org\n");
      herror("gethostbyname");
      exit(-1);
   }
   printf("http://www.snort.org\n"); 
  }
  sn.sin_family = he->h_addrtype;
  memcpy(&sn.sin_addr, he->h_addr, he->h_length);
  sn.sin_port = htons(80); 
  if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
  {
      perror("socket");
      exit(-1);
   }
  else
     printf( "Socket initialized.\n");
 
  if ((connect(sockfd, (struct sockaddr*)&sn,sizeof(sn)) == -1))
     {
        perror("connect");
        printf("port 80 (http) not open\n");
        exit(-1);
     }
  else
     {
     printf("Connected.\n");
    }
    if((fp = fdopen(sockfd,"r+")) == NULL)
     {
        printf("Error opening file descriptor on socket\n");
        exit(-1);
     }
    if(strstr(argv[1], "vision.conf"))
       sprintf(ruleset, "GET http://www.whitehats.com/ids/vision.conf \n\n");
    else
       sprintf(ruleset, "GET /files/%s \n\n",argv[1]);    
    
    printf("Retrieving File: %s\n",argv[1]);
    
    if((fputs(ruleset,fp)) == -1)
      {
        printf("Error sending request\n");
        exit(-1);
      }
    else
      printf("Receiving Data...\n");
    while(fgets(buf, sizeof(buf), fp))
    {
                if(strstr(buf, "var HOME_NET yournet/subnet"))
                {
                        fputs(home_net, stream);
                        printf("Modified %s\n",home_net);
                } 
                else
                if(strstr(buf, "var INTERNAL 10.0.0.0/24"))
                {
                       fputs(internal, stream);
                       printf("Modified %s\n", internal);
                } 
                else
                if(strstr(buf, "var EXTERNAL !10.0.0.0/24")) 
                {
                      fputs(external, stream);
                      printf("Modified %s\n", external);
                } 
                else
                if(strstr(buf, "#preprocessor portscan: 12.23.34.45/32 3 5 /var
/log/snort_portscan.log"))
                {
                        fputs(portscan, stream);
                        printf("Modified %s\n",portscan);
                }
                else
                        fputs(buf,stream);  
     }

   close(sockfd);
   fclose(stream);
  
   sprintf(interface, "`cat /var/run/snort_%s.pid`",argv[2]);
execlp("snort", "snort", "-c", argv[1], "-i", argv[2], "-D", NULL);

exit(0);
}