###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the list of zones in an array.
my @network_zones = &IDS::get_available_network_zones();
+# Check if openvpn is started and add it to the array of network zones.
+if ( -e "/var/run/openvpn.pid") {
+ push(@network_zones, "ovpn");
+}
+
my $errormessage;
# Create files if they does not exist yet.
'red' => $Header::colourred,
'green' => $Header::colourgreen,
'blue' => $Header::colourblue,
- 'orange' => $Header::colourorange
+ 'orange' => $Header::colourorange,
+ 'ovpn' => $Header::colourovpn
);
&Header::showhttpheaders();
}
}
+# Check if the page is locked, in this case, the ids_page_lock_file exists.
+if (-e $IDS::ids_page_lock_file) {
+ # Lock the webpage and print notice about autoupgrade of the ruleset
+ # is in progess.
+ &working_notice("$Lang::tr{'ids ruleset autoupdate in progress'}");
+
+ # Loop and check if the file still exists.
+ while(-e $IDS::ids_page_lock_file) {
+ # Sleep for a second and re-check.
+ sleep 1;
+ }
+
+ # Page has been unlocked, perform a reload.
+ &reload();
+}
+
# Check if any error has been stored.
if (-e $IDS::storederrorfile) {
# Open file to read in the stored error message.
unlink($IDS::storederrorfile);
}
-## Grab all available snort rules and store them in the idsrules hash.
+## Grab all available rules and store them in the idsrules hash.
#
-# Open snort rules directory and do a directory listing.
+# Open rules directory and do a directory listing.
opendir(DIR, $IDS::rulespath) or die $!;
# Loop through the direcory.
while (my $file = readdir(DIR)) {
# Save ruleset configuration.
if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) {
my %oldsettings;
+ my %rulesetsources;
# Read-in current (old) IDS settings.
&General::readhash("$IDS::rules_settings_file", \%oldsettings);
+ # Get all available ruleset locations.
+ &General::readhash("$IDS::rulesetsourcesfile", \%rulesetsources);
+
# Prevent form name from been stored in conf file.
delete $cgiparams{'RULESET'};
- # Check if an oinkcode has been provided.
- if ($cgiparams{'OINKCODE'}) {
- # Check if the oinkcode contains unallowed chars.
- unless ($cgiparams{'OINKCODE'} =~ /^[a-z0-9]+$/) {
- $errormessage = $Lang::tr{'invalid input for oink code'};
+ # Grab the URL based on the choosen vendor.
+ my $url = $rulesetsources{$cgiparams{'RULES'}};
+
+ # Check if the choosen vendor (URL) requires an subscription/oinkcode.
+ if ($url =~ /\<oinkcode\>/ ) {
+ # Check if an subscription/oinkcode has been provided.
+ if ($cgiparams{'OINKCODE'}) {
+ # Check if the oinkcode contains unallowed chars.
+ unless ($cgiparams{'OINKCODE'} =~ /^[a-z0-9]+$/) {
+ $errormessage = $Lang::tr{'invalid input for oink code'};
+ }
+ } else {
+ # Print an error message, that an subsription/oinkcode is required for this
+ # vendor.
+ $errormessage = $Lang::tr{'ids oinkcode required'};
}
}
if (!$errormessage) {
# Store settings into settings file.
&General::writehash("$IDS::rules_settings_file", \%cgiparams);
- }
-
- # Check if the the automatic rule update hass been touched.
- if($cgiparams{'AUTOUPDATE_INTERVAL'} ne $oldsettings{'AUTOUPDATE_INTERVAL'}) {
- # Call suricatactrl to set the new interval.
- &IDS::call_suricatactrl("cron", $cgiparams{'AUTOUPDATE_INTERVAL'});
- }
- # Check if a ruleset is present - if not download it.
- unless (%idsrules) {
- # Check if the red device is active.
- unless (-e "${General::swroot}/red/active") {
- $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}";
+ # Check if the the automatic rule update hass been touched.
+ if($cgiparams{'AUTOUPDATE_INTERVAL'} ne $oldsettings{'AUTOUPDATE_INTERVAL'}) {
+ # Call suricatactrl to set the new interval.
+ &IDS::call_suricatactrl("cron", $cgiparams{'AUTOUPDATE_INTERVAL'});
}
- # Check if enought free disk space is availabe.
- if(&IDS::checkdiskspace()) {
- $errormessage = "$Lang::tr{'not enough disk space'}";
- }
+ # Check if a ruleset is present - if not or the source has been changed download it.
+ if((! %idsrules) || ($oldsettings{'RULES'} ne $cgiparams{'RULES'})) {
+ # Check if the red device is active.
+ unless (-e "${General::swroot}/red/active") {
+ $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}";
+ }
- # Check if any errors happend.
- unless ($errormessage) {
- # Lock the webpage and print notice about downloading
- # a new ruleset.
- &working_notice("$Lang::tr{'snort working'}");
+ # Check if enough free disk space is availabe.
+ if(&IDS::checkdiskspace()) {
+ $errormessage = "$Lang::tr{'not enough disk space'}";
+ }
- # Call subfunction to download the ruleset.
- if(&IDS::downloadruleset()) {
- $errormessage = $Lang::tr{'could not download latest updates'};
+ # Check if any errors happend.
+ unless ($errormessage) {
+ # Lock the webpage and print notice about downloading
+ # a new ruleset.
+ &working_notice("$Lang::tr{'ids working'}");
- # Call function to store the errormessage.
- &IDS::_store_error_message($errormessage);
- } else {
- # Call subfunction to launch oinkmaster.
- &IDS::oinkmaster();
- }
+ # Write the modify sid's file and pass the taken ruleaction.
+ &IDS::write_modify_sids_file();
- # Perform a reload of the page.
- &reload();
+ # Call subfunction to download the ruleset.
+ if(&IDS::downloadruleset()) {
+ $errormessage = $Lang::tr{'could not download latest updates'};
+
+ # Call function to store the errormessage.
+ &IDS::_store_error_message($errormessage);
+ } else {
+ # Call subfunction to launch oinkmaster.
+ &IDS::oinkmaster();
+ }
+
+ # Check if the IDS is running.
+ if(&IDS::ids_is_running()) {
+ # Call suricatactrl to stop the IDS - because of the changed
+ # ruleset - the use has to configure it before suricata can be
+ # used again.
+ &IDS::call_suricatactrl("stop");
+ }
+
+ # Perform a reload of the page.
+ &reload();
+ }
}
}
# Save ruleset.
-} elsif ($cgiparams{'RULESET'} eq $Lang::tr{'update'}) {
+} elsif ($cgiparams{'RULESET'} eq $Lang::tr{'ids apply'}) {
# Arrays to store which rulefiles have been enabled and will be used.
my @enabled_rulefiles;
# Hash to store the user-enabled and disabled sids.
my %enabled_disabled_sids;
+ # Store if a restart of suricata is required.
+ my $suricata_restart_required;
+
# Loop through the hash of idsrules.
foreach my $rulefile(keys %idsrules) {
+ # Check if the state of the rulefile has been changed.
+ unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) {
+ # A restart of suricata is required to apply the changes of the used rulefiles.
+ $suricata_restart_required = 1;
+ }
+
# Check if the rulefile is enabled.
if ($cgiparams{$rulefile} eq "on") {
# Add rulefile to the array of enabled rulefiles.
&IDS::write_used_rulefiles_file(@enabled_rulefiles);
# Lock the webpage and print message.
- &working_notice("$Lang::tr{'snort working'}");
+ &working_notice("$Lang::tr{'ids apply ruleset changes'}");
# Call oinkmaster to alter the ruleset.
&IDS::oinkmaster();
# Check if the IDS is running.
if(&IDS::ids_is_running()) {
- # Call suricatactrl to perform a reload.
- &IDS::call_suricatactrl("reload");
+ # Check if a restart of suricata is required.
+ if ($suricata_restart_required) {
+ # Call suricatactrl to perform the restart.
+ &IDS::call_suricatactrl("restart");
+ } else {
+ # Call suricatactrl to perform a reload.
+ &IDS::call_suricatactrl("reload");
+ }
}
# Reload page.
unless ($errormessage) {
# Lock the webpage and print notice about downloading
# a new ruleset.
- &working_notice("$Lang::tr{'snort working'}");
+ &working_notice("$Lang::tr{'ids download new ruleset'}");
# Call subfunction to download the ruleset.
if(&IDS::downloadruleset()) {
&reload();
}
}
-# Save snort settings.
+# Save IDS settings.
} elsif ($cgiparams{'IDS'} eq $Lang::tr{'save'}) {
my %oldidssettings;
my $reload_page;
# Generate file to store the home net.
&IDS::generate_home_net_file();
- # Temporary variable to set the ruleaction.
- # Default is "drop" to use suricata as IPS.
- my $ruleaction="drop";
+ # Generate file to the store the DNS servers.
+ &IDS::generate_dns_servers_file();
- # Check if the traffic only should be monitored.
- if($cgiparams{'MONITOR_TRAFFIC_ONLY'} eq 'on') {
- # Switch the ruleaction to "alert".
- # Suricata acts as an IDS only.
- $ruleaction="alert";
- }
+ # Generate file to store the HTTP ports.
+ &IDS::generate_http_ports_file();
# Write the modify sid's file and pass the taken ruleaction.
- &IDS::write_modify_sids_file($ruleaction);
+ &IDS::write_modify_sids_file();
# Check if "MONITOR_TRAFFIC_ONLY" has been changed.
if($cgiparams{'MONITOR_TRAFFIC_ONLY'} ne $oldidssettings{'MONITOR_TRAFFIC_ONLY'}) {
# Check if a ruleset exists.
if (%idsrules) {
# Lock the webpage and print message.
- &working_notice("$Lang::tr{'snort working'}");
+ &working_notice("$Lang::tr{'ids working'}");
# Call oinkmaster to alter the ruleset.
&IDS::oinkmaster();
&Header::openpage($Lang::tr{'intrusion detection system'}, 1, '');
### Java Script ###
+print"<script>\n";
+
+# Java script variable declaration for show and hide.
+print"var show = \"$Lang::tr{'ids show'}\"\;\n";
+print"var hide = \"$Lang::tr{'ids hide'}\"\;\n";
+
print <<END
-<script>
- // JQuery function to show/hide the text input field for
+ // Java Script function to show/hide the text input field for
// Oinkcode/Subscription code.
- \$(function() {
- \$('#RULES').change(function(){
- if(\$('#RULES').val() == 'registered') {
- \$('#code').show();
- } else if(\$('#RULES').val() == 'subscripted') {
- \$('#code').show();
- } else if(\$('#RULES').val() == 'emerging_pro') {
- \$('#code').show();
- } else {
- \$('#code').hide();
- }
- });
+ var update_code = function() {
+ if(\$('#RULES').val() == 'registered') {
+ \$('#code').show();
+ } else if(\$('#RULES').val() == 'subscripted') {
+ \$('#code').show();
+ } else if(\$('#RULES').val() == 'emerging_pro') {
+ \$('#code').show();
+ } else {
+ \$('#code').hide();
+ }
+ };
+
+ // JQuery function to call corresponding function when
+ // the ruleset is changed or the page is loaded for showing/hiding
+ // the code area.
+ \$(document).ready(function() {
+ \$('#RULES').change(update_code);
+ update_code();
});
// Tiny java script function to show/hide the rules
// of a given category.
function showhide(tblname) {
\$("#" + tblname).toggle();
+
+ // Get current content of the span element.
+ var content = document.getElementById("span_" + tblname);
+
+ if (content.innerHTML === show) {
+ content.innerHTML = hide;
+ } else {
+ content.innerHTML = show;
+ }
}
</script>
END
END
}
-my $rulesdate;
-
-# Check if a ruleset allready has been downloaded.
-if ( -f "$IDS::rulestarball"){
- # Call stat on the filename to obtain detailed information.
- my @Info = stat("$IDS::rulestarball");
-
- # Grab details about the creation time.
- $rulesdate = localtime($Info[9]);
-}
+# Only show this area, if a ruleset is present.
+if (%idsrules) {
-print <<END
+ print <<END
-<br><br><h2>$Lang::tr{'settings'}</h2>
+ <br><br><h2>$Lang::tr{'settings'}</h2>
-<form method='post' action='$ENV{'SCRIPT_NAME'}'>
- <table width='100%' border='0'>
- <tr>
- <td class='base' colspan='2'>
- <input type='checkbox' name='ENABLE_IDS' $checked{'ENABLE_IDS'}{'on'}>$Lang::tr{'ids activate'} $Lang::tr{'intrusion detection system'}
- </td>
+ <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+ <table width='100%' border='0'>
+ <tr>
+ <td class='base' colspan='2'>
+ <input type='checkbox' name='ENABLE_IDS' $checked{'ENABLE_IDS'}{'on'}> $Lang::tr{'ids enable'}
+ </td>
- <td class='base' colspan='2'>
- <input type='checkbox' name='MONITOR_TRAFFIC_ONLY' $checked{'MONITOR_TRAFFIC_ONLY'}{'on'}>$Lang::tr{'ids monitor traffic only'}
+ <td class='base' colspan='2'>
+ <input type='checkbox' name='MONITOR_TRAFFIC_ONLY' $checked{'MONITOR_TRAFFIC_ONLY'}{'on'}> $Lang::tr{'ids monitor traffic only'}
</td>
- </tr>
+ </tr>
- <tr>
- <td><br><br></td>
- <td><br><br></td>
- <td><br><br></td>
- <td><br><br></td>
- </tr>
+ <tr>
+ <td><br><br></td>
+ <td><br><br></td>
+ <td><br><br></td>
+ <td><br><br></td>
+ </tr>
- <tr>
- <td colspan='4'><b>$Lang::tr{'ids monitored interfaces'}</b><br></td>
- </tr>
+ <tr>
+ <td colspan='4'><b>$Lang::tr{'ids monitored interfaces'}</b><br></td>
+ </tr>
- <tr>
+ <tr>
END
;
-# Loop through the array of available networks and print config options.
-foreach my $zone (@network_zones) {
- my $checked_input;
- my $checked_forward;
+ # Loop through the array of available networks and print config options.
+ foreach my $zone (@network_zones) {
+ my $checked_input;
+ my $checked_forward;
- # Convert current zone name to upper case.
- my $zone_upper = uc($zone);
+ # Convert current zone name to upper case.
+ my $zone_upper = uc($zone);
- # Set zone name.
- my $zone_name = $zone;
+ # Set zone name.
+ my $zone_name = $zone;
- # Dirty hack to get the correct language string for the red zone.
- if ($zone eq "red") {
- $zone_name = "red1";
- }
+ # Dirty hack to get the correct language string for the red zone.
+ if ($zone eq "red") {
+ $zone_name = "red1";
+ }
- # Grab checkbox status from settings hash.
- if ($idssettings{"ENABLE_IDS_$zone_upper"} eq "on") {
- $checked_input = "checked = 'checked'";
- }
+ # Grab checkbox status from settings hash.
+ if ($idssettings{"ENABLE_IDS_$zone_upper"} eq "on") {
+ $checked_input = "checked = 'checked'";
+ }
- print "<td class='base' width='25%'>\n";
- print "<input type='checkbox' name='ENABLE_IDS_$zone_upper' $checked_input>\n";
- print " $Lang::tr{'enabled on'}<font color='$colourhash{$zone}'> $Lang::tr{$zone_name}</font>\n";
- print "</td>\n";
-}
+ print "<td class='base' width='20%'>\n";
+ print "<input type='checkbox' name='ENABLE_IDS_$zone_upper' $checked_input>\n";
+ print " $Lang::tr{'enabled on'}<font color='$colourhash{$zone}'> $Lang::tr{$zone_name}</font>\n";
+ print "</td>\n";
+ }
print <<END
- </tr>
- </table>
+ </tr>
+ </table>
- <br><br>
+ <br><br>
- <table width='100%'>
- <tr>
- <td align='right'><input type='submit' name='IDS' value='$Lang::tr{'save'}' /></td>
- </tr>
- </table>
-</form>
+ <table width='100%'>
+ <tr>
+ <td align='right'><input type='submit' name='IDS' value='$Lang::tr{'save'}' /></td>
+ </tr>
+ </table>
+ </form>
END
;
+}
+
&Header::closebox();
# Draw elements for ruleset configuration.
<td>
<select name='AUTOUPDATE_INTERVAL'>
- <option value='off' $selected{'AUTOUPDATE_INTERVAL'}{'off'} >$Lang::tr{'no'}</option>
- <option value='daily' $selected{'AUTOUPDATE_INTERVAL'}{'daily'} >$Lang::tr{'urlfilter daily'}</option>
- <option value='weekly' $selected{'AUTOUPDATE_INTERVAL'}{'weekly'} >$Lang::tr{'urlfilter weekly'}</option>
+ <option value='off' $selected{'AUTOUPDATE_INTERVAL'}{'off'} >- $Lang::tr{'Disabled'} -</option>
+ <option value='daily' $selected{'AUTOUPDATE_INTERVAL'}{'daily'} >$Lang::tr{'Daily'}</option>
+ <option value='weekly' $selected{'AUTOUPDATE_INTERVAL'}{'weekly'} >$Lang::tr{'Weekly'}</option>
</select>
</td>
</tr>
<td align='right'>
END
;
- # Check if a ruleset has been downloaded yet.
- if (%idsrules) {
+ # Show the "Update Ruleset"-Button only if a ruleset has been downloaded yet and automatic updates are disabled.
+ if ((%idsrules) && ($rulessettings{'AUTOUPDATE_INTERVAL'} eq "off")) {
# Display button to update the ruleset.
print"<input type='submit' name='RULESET' value='$Lang::tr{'update ruleset'}'>\n";
}
#
# Whitelist / Ignorelist
#
-&Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
+&Header::openbox('100%', 'center', $Lang::tr{'ids ignored hosts'});
print <<END;
<table width='100%'>
# Only show the section for configuring the ruleset if one is present.
if (%idsrules) {
- &Header::openbox('100%', 'LEFT', $Lang::tr{'intrusion detection system rules'});
+ # Load neccessary perl modules for file stat and to format the timestamp.
+ use File::stat;
+ use POSIX qw( strftime );
+
+ # Call stat on the rulestarball.
+ my $stat = stat("$IDS::rulestarball");
+
+ # Get timestamp the file creation.
+ my $mtime = $stat->mtime;
+
+ # Convert into human read-able format.
+ my $rulesdate = strftime('%Y-%m-%d %H:%M:%S', localtime($mtime));
+
+ &Header::openbox('100%', 'LEFT', "$Lang::tr{'intrusion detection system rules'} ($rulesdate)" );
print"<form method='POST' action='$ENV{'SCRIPT_NAME'}'>\n";
print"</td>\n";
print"<td class='base' width='90%'><b>$rulefile</b></td>\n";
print"<td class='base' width='5%' align='right'>\n";
- print"<a href=\"javascript:showhide('$categoryname')\">SHOW</a>\n";
+ print"<a href=\"javascript:showhide('$categoryname')\"><span id='span_$categoryname'>$Lang::tr{'ids show'}</span></a>\n";
print"</td>\n";
print"</tr>\n";
print <<END
<table width='100%'>
<tr>
- <td width='100%' align='right'><input type='submit' name='RULESET' value='$Lang::tr{'update'}'>
- <!-- space for future online help link -->
- </td>
+ <td width='100%' align='right'><input type='submit' name='RULESET' value='$Lang::tr{'ids apply'}'></td>
</tr>
</table>
</form>