X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=4d66d22d76bee20635896603b64031b50c78ef52;hb=21d7908cf365228d3facd0c2b83c49a3fb05a641;hp=362e7b38c62dffd4b076bc799a08cd9e4a8d1829;hpb=824a0f689e6269c178e54feeaba878078bb6a49b;p=people%2Fpmueller%2Fipfire-2.x.git
diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index 362e7b38c6..4d66d22d76 100644
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# Copyright (C) 2005-2010 IPFire Team #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -19,20 +19,21 @@
# #
###############################################################################
-
-use LWP::UserAgent;
-use File::Copy;
-use File::Temp qw/ tempfile tempdir /;
use strict;
# enable only the following on debugging purpose
#use warnings;
#use CGI::Carp 'fatalsToBrowser';
+use File::Copy;
require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";
+sub refreshpage{&Header::openbox( 'Waiting', 1, "" );print "
$Lang::tr{'pagerefresh'}";&Header::closebox();}
+
+$a = new CGI;
+
my %color = ();
my %mainsettings = ();
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
@@ -43,8 +44,6 @@ my %checked=();
my %selected=();
my %netsettings=();
our $errormessage = '';
-our $md5 = '0';# not '' to avoid displaying the wrong message when INSTALLMD5 not set
-our $realmd5 = '';
our $results = '';
our $tempdir = '';
our $url='';
@@ -56,7 +55,6 @@ $snortsettings{'ENABLE_SNORT'} = 'off';
$snortsettings{'ENABLE_SNORT_GREEN'} = 'off';
$snortsettings{'ENABLE_SNORT_BLUE'} = 'off';
$snortsettings{'ENABLE_SNORT_ORANGE'} = 'off';
-$snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} = 'off';
$snortsettings{'ENABLE_GUARDIAN'} = 'off';
$snortsettings{'GUARDIAN_INTERFACE'} = `cat /var/ipfire/red/iface`;
$snortsettings{'GUARDIAN_HOSTGATEWAYBYTE'} = '1';
@@ -65,13 +63,13 @@ $snortsettings{'GUARDIAN_ALERTFILE'} = '/var/log/snort/alert';
$snortsettings{'GUARDIAN_IGNOREFILE'} = '/var/ipfire/guardian/guardian.ignore';
$snortsettings{'GUARDIAN_TARGETFILE'} = '/var/ipfire/guardian/guardian.target';
$snortsettings{'GUARDIAN_TIMELIMIT'} = '86400';
-$snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'} = `cat $snortsettings{'GUARDIAN_IGNOREFILE'}`;
$snortsettings{'ACTION'} = '';
$snortsettings{'ACTION2'} = '';
$snortsettings{'RULES'} = '';
$snortsettings{'OINKCODE'} = '';
$snortsettings{'INSTALLDATE'} = '';
-$snortsettings{'INSTALLMD5'} = '';
+$snortsettings{'FILE'} = '';
+$snortsettings{'UPLOAD'} = '';
&Header::getcgihash(\%snortsettings, {'wantfile' => 1, 'filevar' => 'FH'});
@@ -106,23 +104,12 @@ if (-e "/etc/snort/snort.conf") {
if ( $temp =~ /$_/ ){next;}
else { push(@snortconfig,"#include \$RULE_PATH/".$_);}
}
-
+
# Loop over each line
foreach my $line (@snortconfig) {
# Trim the line
chomp $line;
- if ($snortsettings{'ACTION'} eq $Lang::tr{'save'}) {
- # Check for preprocessor settings
- if ($line =~ /preprocessor http_inspect/) {
- # Strip out leading # from rule line
- $line =~ s/\# ?//i;
- if (($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'off')) {
- $line = "# $line";
- }
- }
- }
-
# Check for a line with .rules
if ($line =~ /\.rules$/) {
# Parse out rule file name
@@ -159,7 +146,7 @@ if (-e "/etc/snort/snort.conf") {
# If see more than one dashed line, (start to) create rule file description
if ($dashlinecnt > 1) {
# Check for a line starting with a #
- if ($ruleline =~ /^\#/) {
+ if ($ruleline =~ /^\#/ and $ruleline !~ /^\#alert/) {
# Create tempruleline
my $tempruleline = $ruleline;
@@ -238,7 +225,7 @@ if (-e "/etc/snort/snort.conf") {
if (!exists $snortsettings{"SNORT_RULE_$rule"}) {
$line = "# $line";
}
-
+
}
# Check for rule state
@@ -276,11 +263,15 @@ if (-e "/etc/snort/snort.conf") {
####################### End added for snort rules control #################################
if ($snortsettings{'RULES'} eq 'subscripted') {
- $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.6_s.tar.gz";
+ #$url="http://dl.snort.org/sub-rules/snortrules-snapshot-2.8_s.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2860_s.tar.gz/$snortsettings{'OINKCODE'}";
+ #$url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.8_s.tar.gz";
} elsif ($snortsettings{'RULES'} eq 'registered') {
- $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.6.tar.gz";
+ #$url="http://dl.snort.org/reg-rules/snortrules-snapshot-2.8.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2860.tar.gz/$snortsettings{'OINKCODE'}";
+ #$url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.8.tar.gz";
} else {
- $url="http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz";
+ $url="http://www.emergingthreats.net/rules/emerging.rules.tar.gz";
}
if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" )
@@ -295,19 +286,19 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e
system ('/usr/bin/touch', "${General::swroot}/snort/enable");
} else {
unlink "${General::swroot}/snort/enable";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_green");
} else {
unlink "${General::swroot}/snort/enable_green";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue");
} else {
unlink "${General::swroot}/snort/enable_blue";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange");
@@ -319,7 +310,7 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e
system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect");
} else {
unlink "${General::swroot}/snort/enable_preprocessor_http_inspect";
- }
+ }
if ($snortsettings{'ENABLE_GUARDIAN'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/guardian/enable");
@@ -330,6 +321,12 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e
system('/usr/local/bin/snortctrl restart >/dev/null');
} elsif ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "guardian" ){
+ foreach my $key (keys %snortsettings){
+ if ( $key !~ /^GUARDIAN/ ){
+ delete $snortsettings{$key};
+ }
+ }
+ &General::writehashpart("${General::swroot}/snort/settings", \%snortsettings);
open(IGNOREFILE, ">$snortsettings{'GUARDIAN_IGNOREFILE'}") or die "Unable to write guardian ignore file $snortsettings{'GUARDIAN_IGNOREFILE'}";
print IGNOREFILE $snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'};
close(IGNOREFILE);
@@ -350,24 +347,43 @@ END
# INSTALLMD5 is not in the form, so not retrieved by getcgihash
&General::readhash("${General::swroot}/snort/settings", \%snortsettings);
-if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) {
- $md5 = &getmd5;
- if (($snortsettings{'INSTALLMD5'} ne $md5) && defined $md5 ) {
- chomp($md5);
- my $filename = &downloadrulesfile();
- if (defined $filename) {
- # Check MD5sum
- $realmd5 = `/usr/bin/md5sum $filename`;
- chomp ($realmd5);
- $realmd5 =~ s/^(\w+)\s.*$/$1/;
- if ($md5 ne $realmd5) {
- $errormessage = "$Lang::tr{'invalid md5sum'}";
+if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) {
+
+ my @df = `/bin/df -B M /var`;
+ foreach my $line (@df) {
+ next if $line =~ m/^Filesystem/;
+ my $return;
+
+ if ($line =~ m/dev/ ) {
+ $line =~ m/^.* (\d+)M.*$/;
+ my @temp = split(/ +/,$line);
+ if ($1<300) {
+ $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB";
} else {
- $results = "$Lang::tr{'installed updates'}\n";
- $results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
- $results .= "
";
+
+ if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} ){
+
+ &downloadrulesfile();
+ sleep(3);
+ $return = `cat /var/tmp/log 2>/dev/null`;
+
+ } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'} ) {
+ my $upload = $a->param("UPLOAD");
+ open UPLOADFILE, ">/var/tmp/snortrules.tar.gz";
+ binmode $upload;
+ while ( <$upload> ) {
+ print UPLOADFILE;
+ }
+ close UPLOADFILE;
+ }
+
+ if ($return =~ "ERROR"){
+ $errormessage = "
".$return."
";
+ } else {
+ system("/usr/local/bin/oinkmaster.pl -v -s -u file:///var/tmp/snortrules.tar.gz -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules >>/var/tmp/log 2>&1 &");
+ sleep(2);
+ }
}
- unlink ($filename);
}
}
}
@@ -384,9 +400,6 @@ $checked{'ENABLE_SNORT_BLUE'}{$snortsettings{'ENABLE_SNORT_BLUE'}} = "checked='c
$checked{'ENABLE_SNORT_ORANGE'}{'off'} = '';
$checked{'ENABLE_SNORT_ORANGE'}{'on'} = '';
$checked{'ENABLE_SNORT_ORANGE'}{$snortsettings{'ENABLE_SNORT_ORANGE'}} = "checked='checked'";
-$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{'off'} = '';
-$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{'on'} = '';
-$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{$snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}} = "checked='checked'";
$checked{'ENABLE_GUARDIAN'}{'off'} = '';
$checked{'ENABLE_GUARDIAN'}{'on'} = '';
$checked{'ENABLE_GUARDIAN'}{$snortsettings{'ENABLE_GUARDIAN'}} = "checked='checked'";
@@ -401,7 +414,7 @@ $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'";
####################### Added for snort rules control #################################
print "";
print <
+