From a80695fe1c8fbc9db716f439d707ab30dbeddba0 Mon Sep 17 00:00:00 2001
From: Will Metcalf <wmetcalf@qualys.com>
Date: Wed, 14 Sep 2011 12:59:53 -0500
Subject: [PATCH] Add VRT/ET specific sig URL's along with Local range

---
 app/models/event.rb               |   29 +++++++++++++++++++++++------
 app/views/settings/index.html.erb |   12 ++++++++++--
 db/seeds.rb                       |    4 +++-
 3 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/app/models/event.rb b/app/models/event.rb
index fa0cb4b..df648a4 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -9,7 +9,9 @@ class Event
   # Included for the truncate helper method.
   extend ActionView::Helpers::TextHelper

-  SIGNATURE_URL = "http://rootedyour.com/snortsid?sid=$$gid$$-$$sid$$"
+  VRT_SIGNATURE_URL = "http://rootedyour.com/snortsid?sid=$$gid$$-$$sid$$"
+  ET_SIGNATURE_URL = "http://doc.emergingthreats.net/bin/view/Main/$$sid$$"
+  LOCAL_SIGNATURE_URL = "http://localhost/"

   storage_names[:default] = "event"

@@ -133,13 +135,28 @@ class Event

   def signature_url
     sid, gid = [/\$\$sid\$\$/, /\$\$gid\$\$/]
-
-    @signature_url = if Setting.signature_lookup?
-      Setting.find(:signature_lookup)
+    print signature.sig_sid
+    if signature.sig_sid <= 1000000
+      @signature_url = if Setting.vrt_signature_lookup?
+        Setting.find(:vrt_signature_lookup)
+      else
+        VRT_SIGNATURE_URL
+      end
+    elsif (signature.sig_sid > 1000000) && (signature.sig_sid < 2000000)
+      @signature_url = if Setting.local_signature_lookup?
+        Setting.find(:local_signature_lookup)
+      else
+        LOCAL_SIGNATURE_URL
+      end
+    elsif (signature.sig_sid >= 2000000) && (signature.sig_sid < 3000000)
+      @signature_url = if Setting.et_signature_lookup?
+        Setting.find(:et_signature_lookup)
+      else
+        ET_SIGNATURE_URL
+      end
     else
-      SIGNATURE_URL
+       @signature_url = "Unknown"
     end
-
     @signature_url.sub(sid, signature.sig_sid.to_s).sub(gid, signature.sig_gid.to_s)
   end

diff --git a/app/views/settings/index.html.erb b/app/views/settings/index.html.erb
index 9d6fef3..3f6ac3d 100644
--- a/app/views/settings/index.html.erb
+++ b/app/views/settings/index.html.erb
@@ -23,8 +23,16 @@
                        </p>

                        <p>
-                               <%= label_tag 'Signature Lookup URL' %> <i>(user $$sid$$ and $$gid$$ for the get request parameters)</i><br />
-                               <%= text_field_tag '[settings][signature_lookup]', (Setting.signature_lookup ? Setting.find(:signature_lookup) : nil), :placeholder => 'Signature Lookup URL', :autocomplete => :off, :class => 'required url' %>
+                               <%= label_tag 'VRT Signature Lookup URL (sids 1-1000000)' %> <i>(user $$sid$$ and $$gid$$ for the get request parameters)</i><br />
+                               <%= text_field_tag '[settings][vrt_signature_lookup]', (Setting.vrt_signature_lookup ? Setting.find(:vrt_signature_lookup) : nil), :placeholder => 'VRT Signature Lookup URL', :autocomplete => :off, :class => 'url' %>
+                        </p>
+                        <p>
+                                <%= label_tag 'Local Signature Lookup URL (sids 1000001-1999999)' %> <i>(user $$sid$$ and $$gid$$ for the get request parameters)</i><br />
+                                <%= text_field_tag '[settings][local_signature_lookup]', (Setting.local_signature_lookup ? Setting.find(:local_signature_lookup) : nil), :placeholder => 'Local Signature Lookup URL', :autocomplete => :off, :class => 'url' %>
+                        </p>
+                        <p>
+                                <%= label_tag 'ET Signature Lookup URL (sids 2000000-2999999)' %> <i>(user $$sid$$ and $$gid$$ for the get request parameters)</i><br />
+                                <%= text_field_tag '[settings][et_signature_lookup]', (Setting.et_signature_lookup ? Setting.find(:et_signature_lookup) : nil), :placeholder => 'ET Signature Lookup URL', :autocomplete => :off, :class => 'url' %>
                        </p>

                        <p>
diff --git a/db/seeds.rb b/db/seeds.rb
index f2a4277..1376f44 100644
--- a/db/seeds.rb
+++ b/db/seeds.rb
@@ -7,7 +7,9 @@ User.create(:name => 'Administrator', :email => 'snorby@snorby.org', :password =
 # Snorby General Settings
 Setting.set(:company, 'Snorby.org') unless Setting.company?
 Setting.set(:email, 'snorby@snorby.org') unless Setting.email?
-Setting.set(:signature_lookup, 'http://rootedyour.com/snortsid?sid=$$gid$$:$$sid$$') unless Setting.signature_lookup?
+Setting.set(:vrt_signature_lookup, 'http://rootedyour.com/snortsid?sid=$$gid$$:$$sid$$') unless Setting.vrt_signature_lookup?
+Setting.set(:local_signature_lookup, 'http://localhost/') unless Setting.local_signature_lookup?
+Setting.set(:et_signature_lookup, 'http://doc.emergingthreats.net/bin/view/Main/$$sid$$') unless Setting.et_signature_lookup?
 Setting.set(:daily, 1) unless Setting.daily?
 Setting.set(:weekly, 1) unless Setting.weekly?
 Setting.set(:monthly, 1) unless Setting.monthly?
--
1.7.0.4