ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl

[ipfire-2.x.git] / config / cfgroot / ids-functions.pl

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index c35bed7e5ffc92d8159d8dec0e7c512024f291a5..2a358b1cc114faede8a879d14113a6c5807ac837 100644 (file)
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -130,21 +130,21 @@ sub checkdiskspace () {
 }
 
 #
-## This function is responsible for downloading the configured snort ruleset.
+## This function is responsible for downloading the configured IDS ruleset.
 ##
-## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
+## * At first it obtains from the stored rules settings which ruleset should be downloaded.
 ## * The next step is to get the download locations for all available rulesets.
 ## * After that, the function will check if an upstream proxy should be used and grab the settings.
 ## * The last step will be to generate the final download url, by obtaining the URL for the desired
 ##   ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
 #
 sub downloadruleset {
-       # Get snort settings.
-       my %snortsettings=();
-       &General::readhash("$settingsdir/settings", \%snortsettings);
+       # Get rules settings.
+       my %rulessettings=();
+       &General::readhash("$rules_settings_file", \%rulessettings);
 
        # Check if a ruleset has been configured.
-       unless($snortsettings{'RULES'}) {
+       unless($rulessettings{'RULES'}) {
                # Log that no ruleset has been configured and abort.
                &_log_to_syslog("No ruleset source has been configured.");
 
@@ -198,10 +198,10 @@ sub downloadruleset {
        }
 
        # Grab the right url based on the configured vendor.
-       my $url = $rulesetsources{$snortsettings{'RULES'}};
+       my $url = $rulesetsources{$rulessettings{'RULES'}};
 
        # Check if the vendor requires an oinkcode and add it if needed.
-       $url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;
+       $url =~ s/\<oinkcode\>/$rulessettings{'OINKCODE'}/g;
 
        # Abort if no url could be determined for the vendor.
        unless ($url) {
@@ -746,4 +746,52 @@ sub get_suricata_version($) {
        } 
 }
 
+#
+## Function to generate the rules file with whitelisted addresses.
+#
+sub generate_ignore_file() {
+       my %ignored = ();
+
+       # SID range 1000000-1999999 Reserved for Local Use
+       # Put your custom rules in this range to avoid conflicts
+       my $sid = 1500000;
+
+       # Read-in ignoredfile.
+       &General::readhasharray($IDS::ignored_file, \%ignored);
+
+       # Open ignorefile for writing.
+       open(FILE, ">$IDS::whitelist_file") or die "Could not write to $IDS::whitelist_file. $!\n";
+
+       # Config file header.
+       print FILE "# Autogenerated file.\n";
+       print FILE "# All user modifications will be overwritten.\n\n";
+
+       # Add all user defined addresses to the whitelist.
+       #
+       # Check if the hash contains any elements.
+       if (keys (%ignored)) {
+               # Loop through the entire hash and write the host/network
+               # and remark to the ignore file.
+               while ( (my $key) = each %ignored) {
+                       my $address = $ignored{$key}[0];
+                       my $remark = $ignored{$key}[1];
+                       my $status = $ignored{$key}[2];
+
+                       # Check if the status of the entry is "enabled".
+                       if ($status eq "enabled") {
+                               # Check if the address/network is valid.
+                               if ((&General::validip($address)) || (&General::validipandmask($address))) {
+                                       # Write rule line to the file to pass any traffic from this IP
+                                       print FILE "pass ip $address any -> any any (msg:\"pass all traffic from/to $address\"\; sid:$sid\;)\n";
+
+                                       # Increment sid.
+                                       $sid++;
+                               }
+                       }
+               }
+       }
+
+       close(FILE);
+}
+
 1;