# Loop through the array of used providers.
foreach my $provider (@enabled_providers) {
# Gather used rulefiles.
- my @used_rulesfiles = &IDS::read_used_provider_rulesfiles($provider);
+ my @used_rulesfiles = &IDS::get_provider_used_rulesfiles($provider);
# Loop through the array of used rulesfiles.
foreach my $rulefile (@used_rulesfiles) {
# Save ruleset.
if ($cgiparams{'RULESET'} eq $Lang::tr{'ids apply'}) {
- # Arrays to store which rulefiles have been enabled and will be used.
- my @enabled_rulefiles;
-
- # Store if a restart of suricata is required.
- my $suricata_restart_required;
-
- # Loop through the hash of idsrules.
- foreach my $rulefile(keys %idsrules) {
- # Check if the state of the rulefile has been changed.
- unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) {
- # A restart of suricata is required to apply the changes of the used rulefiles.
- $suricata_restart_required = 1;
- }
-
- # Check if the rulefile is enabled.
- if ($cgiparams{$rulefile} eq "on") {
- # Add rulefile to the array of enabled rulefiles.
- push(@enabled_rulefiles, $rulefile);
-
- # Drop item from cgiparams hash.
- delete $cgiparams{$rulefile};
- }
- }
-
# Get enabled providers.
my @enabled_providers = &IDS::get_enabled_providers();
# Hash to store the used-enabled and disabled sids.
my %enabled_disabled_sids;
+ # Hash to store the enabled rulefiles for the current processed provider.
+ my %used_rulefiles;
+
# Get name of the file which holds the ruleset modification of the provider.
my $modifications_file = &IDS::get_provider_ruleset_modifications_file($provider);
+ # Get the name of the file which contains the used rulefiles for this provider.
+ my $used_rulefiles_file = &IDS::get_provider_used_rulesfiles_file($provider);
+
# Read-in modifications file, if exists.
&General::readhash("$modifications_file", \%enabled_disabled_sids) if (-f "$modifications_file");
# Skip the rulefile if the vendor is not our current processed provider.
next unless ($rulefile_vendor eq $provider);
+ # Check if the rulefile is enabled.
+ if ($cgiparams{$rulefile} eq "on") {
+ # Add the rulefile to the hash of enabled rulefiles of this provider.
+ $used_rulefiles{$rulefile} = "enabled";
+
+ # Drop item from cgiparams hash.
+ delete $cgiparams{$rulefile};
+ }
+
# Loop through the single rules of the rulefile.
foreach my $sid (keys %{$idsrules{$rulefile}}) {
# Skip the current sid if it is not numeric.
# Write the modifications file.
&General::writehash("$modifications_file", \%enabled_disabled_sids);
}
- }
-
- # Handle enabled / disabled rulefiles.
- #
- # Loop through the array of enabled providers.
- foreach my $provider(@enabled_providers) {
- # Array to store the rulefiles which belong to the current processed provider.
- my @provider_rulefiles = ();
-
- # Loop through the array of enabled rulefiles.
- foreach my $rulesfile (@enabled_rulefiles) {
- # Split the rulefile name.
- my @filename_parts = split(/-/, "$rulesfile");
-
- # Assign vendor name for easy processings.
- my $vendor = @filename_parts[0];
-
- # Check if the rulesvendor is our current processed enabled provider.
- if ("$vendor" eq "$provider") {
- # Add the rulesfile to the array of provider rulesfiles.
- push(@provider_rulefiles, $rulesfile);
- }
-
- # Call function and write the providers used rulesfile file.
- &IDS::write_used_provider_rulefiles_file($provider, @provider_rulefiles);
- }
+ # Write the used rulefiles file.
+ &General::writehash("$used_rulefiles_file", \%used_rulefiles);
}
# Call function to generate and write the used rulefiles file.
- &IDS::write_main_used_rulefiles_file(@enabled_providers);
+ &IDS::write_used_rulefiles_file(@enabled_providers);
# Lock the webpage and print message.
- &working_notice("$Lang::tr{'ids apply ruleset changes'}");
-
- # Call oinkmaster to alter the ruleset.
- &IDS::oinkmaster();
+ &oinkmaster_web();
# Check if the IDS is running.
if(&IDS::ids_is_running()) {
- # Check if a restart of suricata is required.
- if ($suricata_restart_required) {
- # Call suricatactrl to perform the restart.
- &IDS::call_suricatactrl("restart");
- } else {
- # Call suricatactrl to perform a reload.
- &IDS::call_suricatactrl("reload");
- }
+ # Call suricatactrl to perform a reload.
+ &IDS::call_suricatactrl("reload");
}
# Reload page.
unless ($errormessage) {
# Lock the webpage and print notice about downloading
# a new ruleset.
- &working_notice("$Lang::tr{'ids download new ruleset'}");
+ &_open_working_notice("$Lang::tr{'ids download new ruleset'}");
# Call subfunction to download the ruleset.
- if(&IDS::downloadruleset($provider)) {
- $errormessage = "$provider - $Lang::tr{'could not download latest updates'}";
+ my $return = &IDS::downloadruleset($provider);
+
+ # Check if the download function gives a return code.
+ if ($return) {
+ # Handle different return codes.
+ if ($return eq "not modified") {
+ $errormessage = "$provider - $Lang::tr{'ids ruleset is up to date'}";
+ } else {
+ $errormessage = "$provider - $Lang::tr{'could not download latest updates'}: $return";
+ }
# Call function to store the errormessage.
&IDS::_store_error_message($errormessage);
+ # Close the working notice.
+ &_close_working_notice();
+
# Preform a reload of the page.
&reload();
} else {
# Call subfunction to launch oinkmaster.
- &IDS::oinkmaster();
+ &oinkmaster_web("nolock");
+
+ # Close the working notice.
+ &_close_working_notice();
# Check if the IDS is running.
if(&IDS::ids_is_running()) {
# Reset a provider to it's defaults.
} elsif ($cgiparams{'PROVIDERS'} eq "$Lang::tr{'ids reset provider'}") {
+ # Get enabled providers.
+ my @enabled_providers = &IDS::get_enabled_providers();
+
# Grab provider handle from cgihash.
my $provider = $cgiparams{'PROVIDER'};
# Lock the webpage and print message.
&working_notice("$Lang::tr{'ids apply ruleset changes'}");
- # Create new empty file for used rulefiles
- # for this provider.
- &IDS::write_used_provider_rulefiles_file($provider);
+ # Get the name of the file which contains the used rulefiles for this provider.
+ my $used_rulefiles_file = &IDS::get_provider_used_rulesfiles_file($provider);
+
+ # Remove the file if it exists.
+ unlink("$used_rulefiles_file") if (-f "$used_rulefiles_file");
# Call function to get the path and name for file which holds the ruleset modifications
# for the given provider.
unlink("$modifications_file");
}
+ # Write used rulesfiles file.
+ &IDS::write_used_rulefiles_file(@enabled_providers);
+
# Regenerate ruleset.
- &IDS::oinkmaster();
+ &oinkmaster_web();
# Check if the IDS is running.
if(&IDS::ids_is_running()) {
- # Get enabled providers.
- my @enabled_providers = &IDS::get_enabled_providers();
-
# Get amount of enabled providers.
my $amount = @enabled_providers;
# Check if at least one enabled provider remains.
if ($amount >= 1) {
# Call suricatactrl to perform a reload.
- &IDS::call_suricatactrl("restart");
+ &IDS::call_suricatactrl("reload");
# Stop suricata if no enabled provider remains.
} else {
&General::writehash("$IDS::ids_settings_file", \%cgiparams);
}
- # Check if the the automatic rule update hass been touched.
- if($cgiparams{'AUTOUPDATE_INTERVAL'} ne $oldidssettings{'AUTOUPDATE_INTERVAL'}) {
- # Call suricatactrl to set the new interval.
- &IDS::call_suricatactrl("cron", $cgiparams{'AUTOUPDATE_INTERVAL'});
- }
-
# Generate file to store the home net.
&IDS::generate_home_net_file();
# Generate file to store the HTTP ports.
&IDS::generate_http_ports_file();
- # Write the modify sid's file and pass the taken ruleaction.
- &IDS::write_modify_sids_file();
-
- # Check if "MONITOR_TRAFFIC_ONLY" has been changed.
- if($cgiparams{'MONITOR_TRAFFIC_ONLY'} ne $oldidssettings{'MONITOR_TRAFFIC_ONLY'}) {
- # Check if at least one provider is enabled.
- if (@enabled_providers) {
- # Lock the webpage and print message.
- &working_notice("$Lang::tr{'ids working'}");
-
- # Call oinkmaster to alter the ruleset.
- &IDS::oinkmaster();
-
- # Set reload_page to "True".
- $reload_page="True";
- }
- }
-
# Check if the IDS currently is running.
if(&IDS::ids_is_running()) {
# Check if ENABLE_IDS is set to on.
}
# Modify the status of the existing entry.
- $used_providers{$id} = ["$used_providers{$id}[0]", "$used_providers{$id}[1]", "$status_autoupdate", "$used_providers{$id}[3]"];
+ $used_providers{$id} = ["$used_providers{$id}[0]", "$used_providers{$id}[1]", "$status_autoupdate", "$used_providers{$id}[3]", "$used_providers{$id}[4]"];
# Write the changed hash to the providers settings file.
&General::writehasharray($IDS::providers_settings_file, \%used_providers);
my $provider = $cgiparams{'PROVIDER'};
my $subscription_code = $cgiparams{'SUBSCRIPTION_CODE'};
my $status_autoupdate;
+ my $mode;
+ my $regenerate_ruleset_required;
# Handle autoupdate checkbox.
if ($cgiparams{'ENABLE_AUTOUPDATE'} eq "on") {
$status_autoupdate = "disabled";
}
+ # Handle monitor traffic only checkbox.
+ if ($cgiparams{'MONITOR_TRAFFIC_ONLY'} eq "on") {
+ $mode = "IDS";
+ } else {
+ $mode = "IPS";
+ }
+
# Check if we are going to add a new provider.
if ($cgiparams{'PROVIDERS'} eq "$Lang::tr{'add'}") {
# Loop through the hash of used providers.
# Undef the given ID.
undef($cgiparams{'ID'});
+ # Grab the configured mode.
+ my $stored_mode = $used_providers{$id}[4];
+
+ # Check if the ruleset action (mode) has been changed.
+ if ($stored_mode ne $mode) {
+ # It has been changed, so the ruleset needs to be regenerated.
+ $regenerate_ruleset_required = "1";
+ }
+
# Grab the configured status of the corresponding entry.
$status = $used_providers{$id}[3];
} else {
}
# Add/Modify the entry to/in the used providers hash..
- $used_providers{$id} = ["$provider", "$subscription_code", "$status_autoupdate", "$status"];
+ $used_providers{$id} = ["$provider", "$subscription_code", "$status_autoupdate", "$status", "$mode"];
# Write the changed hash to the providers settings file.
&General::writehasharray($IDS::providers_settings_file, \%used_providers);
&working_notice("$Lang::tr{'ids working'}");
# Download the ruleset.
- if(&IDS::downloadruleset($provider)) {
- $errormessage = "$Lang::tr{'ids could not add provider'} - $Lang::tr{'ids unable to download the ruleset'}";
+ my $return = &IDS::downloadruleset($provider);
+
+ # Check if the downloader returned a code.
+ if ($return) {
+ $errormessage = "$Lang::tr{'ids could not add provider'} - $Lang::tr{'ids unable to download the ruleset'}: $return";
# Call function to store the errormessage.
&IDS::_store_error_message($errormessage);
# Cleanup temporary directory.
&IDS::cleanup_tmp_directory();
-
- # Create new empty file for used rulefiles
- # for this provider.
- &IDS::write_used_provider_rulefiles_file($provider);
}
# Perform a reload of the page.
&reload();
+ } else {
+ # Remove the configured provider again.
+ &remove_provider($id);
}
}
+ # Check if the ruleset has to be regenerated.
+ if ($regenerate_ruleset_required) {
+ # Call oinkmaster web function.
+ &oinkmaster_web();
+
+ # Perform a reload of the page.
+ &reload();
+ }
}
# Undefine providers flag.
}
# Modify the status of the existing entry.
- $used_providers{$id} = ["$used_providers{$id}[0]", "$used_providers{$id}[1]", "$used_providers{$id}[2]", "$status"];
+ $used_providers{$id} = ["$used_providers{$id}[0]", "$used_providers{$id}[1]", "$used_providers{$id}[2]", "$status", "$used_providers{$id}[4]"];
# Write the changed hash to the providers settings file.
&General::writehasharray($IDS::providers_settings_file, \%used_providers);
my @enabled_providers = &IDS::get_enabled_providers();
# Write the main providers include file.
- &IDS::write_main_used_rulefiles_file(@enabled_providers);
+ &IDS::write_used_rulefiles_file(@enabled_providers);
# Check if oinkmaster has to be executed.
if ($oinkmaster eq "True") {
- # Lock the webpage and print message.
- &working_notice("$Lang::tr{'ids apply ruleset changes'}");
-
# Launch oinkmaster.
- &IDS::oinkmaster();
+ &oinkmaster_web();
}
# Check if the IDS is running.
# Undef the given ID.
undef($cgiparams{'ID'});
- # Lock the webpage and print message.
- &working_notice("$Lang::tr{'ids apply ruleset changes'}");
-
# Drop the stored ruleset file.
&IDS::drop_dl_rulesfile($provider);
+ # Remove may stored etag data.
+ &IDS::remove_from_etags($provider);
+
# Get the name of the provider rulessets include file.
- my $provider_used_rulefile = &IDS::get_used_provider_rulesfile_file($provider);
+ my $provider_used_rulefile = &IDS::get_provider_used_rulesfiles_file($provider);
# Drop the file, it is not longer needed.
unlink("$provider_used_rulefile");
}
# Regenerate ruleset.
- &IDS::oinkmaster();
+ &oinkmaster_web();
# Gather all enabled providers.
my @enabled_providers = &IDS::get_enabled_providers();
# Regenerate main providers include file.
- &IDS::write_main_used_rulefiles_file(@enabled_providers);
+ &IDS::write_used_rulefiles_file(@enabled_providers);
# Check if the IDS is running.
if(&IDS::ids_is_running()) {
&General::readhash("$IDS::ids_settings_file", \%idssettings);
&General::readhasharray("$IDS::providers_settings_file", \%used_providers);
- # If no autoupdate intervall has been configured yet, set default value.
- unless(exists($idssettings{'AUTOUPDATE_INTERVAL'})) {
- # Set default to "weekly".
- $idssettings{'AUTOUPDATE_INTERVAL'} = 'weekly';
- }
-
# Read-in ignored hosts.
&General::readhasharray("$IDS::ignored_file", \%ignored) if (-e $IDS::ignored_file);
$checked{'ENABLE_IDS'}{'off'} = '';
$checked{'ENABLE_IDS'}{'on'} = '';
$checked{'ENABLE_IDS'}{$idssettings{'ENABLE_IDS'}} = "checked='checked'";
- $checked{'MONITOR_TRAFFIC_ONLY'}{'off'} = '';
- $checked{'MONITOR_TRAFFIC_ONLY'}{'on'} = '';
- $checked{'MONITOR_TRAFFIC_ONLY'}{$idssettings{'MONITOR_TRAFFIC_ONLY'}} = "checked='checked'";
- $selected{'AUTOUPDATE_INTERVAL'}{'off'} = '';
- $selected{'AUTOUPDATE_INTERVAL'}{'daily'} = '';
- $selected{'AUTOUPDATE_INTERVAL'}{'weekly'} = '';
- $selected{'AUTOUPDATE_INTERVAL'}{$idssettings{'AUTOUPDATE_INTERVAL'}} = "selected='selected'";
# Draw current state of the IDS
&Header::openbox('100%', 'left', $Lang::tr{'intrusion detection system'});
<input type='checkbox' name='ENABLE_IDS' $checked{'ENABLE_IDS'}{'on'}> $Lang::tr{'ids enable'}
</td>
- <td class='base' colspan='2'>
- <input type='checkbox' name='MONITOR_TRAFFIC_ONLY' $checked{'MONITOR_TRAFFIC_ONLY'}{'on'}> $Lang::tr{'ids monitor traffic only'}
</td>
</tr>
print <<END
</tr>
-
- <tr>
- <td><br><br></td>
- <td><br><br></td>
- <td><br><br></td>
- <td><br><br></td>
- </tr>
-
- <tr>
- <td colspan='4'><b>$Lang::tr{'ids automatic rules update'}</b></td>
- </tr>
-
- <tr>
- <td>
- <select name='AUTOUPDATE_INTERVAL'>
- <option value='off' $selected{'AUTOUPDATE_INTERVAL'}{'off'} >- $Lang::tr{'Disabled'} -</option>
- <option value='daily' $selected{'AUTOUPDATE_INTERVAL'}{'daily'} >$Lang::tr{'Daily'}</option>
- <option value='weekly' $selected{'AUTOUPDATE_INTERVAL'}{'weekly'} >$Lang::tr{'Weekly'}</option>
- </select>
- </td>
- </tr>
</table>
<br><br>
$col="bgcolor='$color{'color20'}'";
}
+ # Handle providers which are not longer supported.
+ unless ($provider_name) {
+ # Set the provider name to the provider handle
+ # to display something helpful.
+ $provider_name = $provider;
+
+ # Assign background color
+ $col="bgcolor='#FF4D4D'";
+ }
+
# Choose icons for the checkboxes.
my $status_gif;
my $status_gdesc;
$checked{'ENABLE_AUTOUPDATE'} = "checked='checked'";
}
+ # Check if the monitor traffic only mode is set for this provider.
+ if ($used_providers{$cgiparams{'ID'}}[4] eq "IDS") {
+ # Set the checkbox to be checked.
+ $checked{'MONITOR_TRAFFIC_ONLY'} = "checked='checked'";
+ }
+
# Display section to force an rules update and to reset the provider.
&show_additional_provider_actions();
</tr>
<tr>
- <td colspan='2'>
+ <td>
<input type='checkbox' name='ENABLE_AUTOUPDATE' $checked{'ENABLE_AUTOUPDATE'}> $Lang::tr{'ids enable automatic updates'}
</td>
+
+ <td>
+ <input type='checkbox' name='MONITOR_TRAFFIC_ONLY' $checked{'MONITOR_TRAFFIC_ONLY'}> $Lang::tr{'ids monitor traffic only'}
+ </td>
</tr>
<tr>
## Function to show the area where additional provider actions can be done.
#
sub show_additional_provider_actions() {
- my $disabled;
+ my $disabled_reset;
+ my $disabled_update;
my %used_providers = ();
# Read-in providers settings file.
# Disable the reset provider button if no provider modified sids file exists.
unless (-f $modifications_file) {
- $disabled = "disabled";
+ $disabled_reset = "disabled";
+ }
+
+ # Disable the manual update button if the provider is not longer supported.
+ unless ($IDS::Ruleset::Providers{$provider}) {
+ $disabled_update = "disabled";
}
&Header::openbox('100%', 'center', "");
<tr>
<td align='center'>
<input type='hidden' name='PROVIDER' value='$provider'>
- <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids reset provider'}' $disabled>
- <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids force ruleset update'}'>
+ <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids reset provider'}' $disabled_reset>
+ <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids force ruleset update'}' $disabled_update>
</td>
</tr>
</table>
sub working_notice ($) {
my ($message) = @_;
+ &_open_working_notice ($message);
+ &_close_working_notice();
+}
+
+#
+## Private function to lock the page and tell the user what is going on.
+#
+sub _open_working_notice ($) {
+ my ($message) = @_;
+
&Header::openpage($Lang::tr{'intrusion detection system'}, 1, '');
&Header::openbigbox('100%', 'left', '', $errormessage);
&Header::openbox( 'Waiting', 1,);
<td><img src='/images/indicator.gif' alt='$Lang::tr{'aktiv'}' /></td>
<td>$message</td>
</tr>
- </table>
END
+}
+
+#
+## Private function to close a working notice.
+#
+sub _close_working_notice () {
+ print "</table>\n";
+
&Header::closebox();
&Header::closebigbox();
&Header::closepage();
}
+#
+## Function which locks the webpage and basically does the same as the
+## oinkmaster function, but provides a lot of HTML formated status output.
+#
+sub oinkmaster_web () {
+ my ($nolock) = @_;
+
+ my @enabled_providers = &IDS::get_enabled_providers();
+
+ # Lock the webpage and print message.
+ unless ($nolock) {
+ &_open_working_notice("$Lang::tr{'ids apply ruleset changes'}");
+ }
+
+ # Check if the files in rulesdir have the correct permissions.
+ &IDS::_check_rulesdir_permissions();
+
+ print "<tr><td><br><br></td></tr>\n";
+
+ # Cleanup the rules directory before filling it with the new rulests.
+ &_add_to_notice("$Lang::tr{'ids remove rule structures'}");
+ &IDS::_cleanup_rulesdir();
+
+ # Loop through the array of enabled providers.
+ foreach my $provider (@enabled_providers) {
+ &_add_to_notice("$Lang::tr{'ids extract ruleset'} $provider");
+ # Call the extractruleset function.
+ &IDS::extractruleset($provider);
+ }
+
+ # Call function to process the ruleset and do all modifications.
+ &_add_to_notice("$Lang::tr{'ids adjust ruleset'}");
+ &IDS::process_ruleset(@enabled_providers);
+
+ # Call function to merge the classification files.
+ &_add_to_notice("$Lang::tr{'ids merge classifications'}");
+ &IDS::merge_classifications(@enabled_providers);
+
+ # Call function to merge the sid to message mapping files.
+ &_add_to_notice("$Lang::tr{'ids merge sid files'}");
+ &IDS::merge_sid_msg(@enabled_providers);
+
+ # Cleanup temporary directory.
+ &_add_to_notice("$Lang::tr{'ids cleanup tmp dir'}");
+ &IDS::cleanup_tmp_directory();
+
+ # Finished - print a notice.
+ &_add_to_notice("$Lang::tr{'ids finished'}");
+
+ # Close the working notice.
+ unless ($nolock) {
+ &_close_working_notice();
+ }
+}
+
+#
+## Tiny private function to add a given message to a notice table.
+#
+sub _add_to_notice ($) {
+ my ($message) = @_;
+
+ print "<tr><td colspan='2'><li><b>$message</b></li></td></tr>\n";
+}
+
#
## A tiny function to perform a reload of the webpage after one second.
#
my ($handle) = @_;
my $provider_name;
+ # Early exit if the given provider does not longer exist.
+ return unless ($IDS::Ruleset::Providers{$handle});
+
# Get the required translation string for the given provider handle.
my $tr_string = $IDS::Ruleset::Providers{$handle}{'tr_string'};
projects / people / pmueller / ipfire-2.x.git / blobdiff