IDS: Dynamically generate and import the HTTP ports.

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ids.cgi

diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index da009f89189499f47face02de862407435f12f35..bc31a341f0528a34e04e1e19e14c964989bb602a 100644 (file)
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -49,6 +49,11 @@ my %ignored=();
 # the list of zones in an array.
 my @network_zones = &IDS::get_available_network_zones();
 
+# Check if openvpn is started and add it to the array of network zones.
+if ( -e "/var/run/openvpn.pid") {
+       push(@network_zones, "ovpn");
+}
+
 my $errormessage;
 
 # Create files if they does not exist yet.
@@ -59,7 +64,8 @@ my %colourhash = (
        'red' => $Header::colourred,
        'green' => $Header::colourgreen,
        'blue' => $Header::colourblue,
-       'orange' => $Header::colourorange
+       'orange' => $Header::colourorange,
+       'ovpn' => $Header::colourovpn
 );
 
 &Header::showhttpheaders();
@@ -406,8 +412,17 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) {
        # Hash to store the user-enabled and disabled sids.
        my %enabled_disabled_sids;
 
+       # Store if a restart of suricata is required.
+       my $suricata_restart_required;
+
        # Loop through the hash of idsrules.
        foreach my $rulefile(keys %idsrules) {
+               # Check if the state of the rulefile has been changed.
+               unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) {
+                       # A restart of suricata is required to apply the changes of the used rulefiles.
+                       $suricata_restart_required = 1;
+               }
+
                # Check if the rulefile is enabled.
                if ($cgiparams{$rulefile} eq "on") {
                        # Add rulefile to the array of enabled rulefiles.
@@ -507,8 +522,14 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) {
 
        # Check if the IDS is running.
        if(&IDS::ids_is_running()) {
-               # Call suricatactrl to perform a reload.
-               &IDS::call_suricatactrl("reload");
+               # Check if a restart of suricata is required.
+               if ($suricata_restart_required) {
+                       # Call suricatactrl to perform the restart.
+                       &IDS::call_suricatactrl("restart");
+               } else {
+                       # Call suricatactrl to perform a reload.
+                       &IDS::call_suricatactrl("reload");
+               }
        }
 
        # Reload page.
@@ -604,6 +625,9 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) {
        # Generate file to the store the DNS servers.
        &IDS::generate_dns_servers_file();
 
+       # Generate file to store the HTTP ports.
+       &IDS::generate_http_ports_file();
+
        # Write the modify sid's file and pass the taken ruleaction.
        &IDS::write_modify_sids_file();
 
@@ -839,7 +863,7 @@ END
                        $checked_input = "checked = 'checked'";
                }
 
-               print "<td class='base' width='25%'>\n";
+               print "<td class='base' width='20%'>\n";
                print "<input type='checkbox' name='ENABLE_IDS_$zone_upper' $checked_input>\n";
                print "&nbsp;$Lang::tr{'enabled on'}<font color='$colourhash{$zone}'> $Lang::tr{$zone_name}</font>\n";
                print "</td>\n";