X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=313714486553d5debd53ec67477eb91912370009;hp=388abf2d77346a5c22015225b29cf78678966c90;hb=5fbd7b29829caf0bcadcccd6f56ead51e2fb812e;hpb=422dc4caf97696ac34b65410784f22875f3412c0 diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 388abf2d77..3137144865 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -210,6 +210,22 @@ if (($cgiparams{'WHITELIST'} eq $Lang::tr{'add'}) || ($cgiparams{'WHITELIST'} eq } } +# Check if the page is locked, in this case, the ids_page_lock_file exists. +if (-e $IDS::ids_page_lock_file) { + # Lock the webpage and print notice about autoupgrade of the ruleset + # is in progess. + &working_notice("$Lang::tr{'ids ruleset autoupdate in progress'}"); + + # Loop and check if the file still exists. + while(-e $IDS::ids_page_lock_file) { + # Sleep for a second and re-check. + sleep 1; + } + + # Page has been unlocked, perform a reload. + &reload(); +} + # Check if any error has been stored. if (-e $IDS::storederrorfile) { # Open file to read in the stored error message. @@ -225,9 +241,9 @@ if (-e $IDS::storederrorfile) { unlink($IDS::storederrorfile); } -## Grab all available snort rules and store them in the idsrules hash. +## Grab all available rules and store them in the idsrules hash. # -# Open snort rules directory and do a directory listing. +# Open rules directory and do a directory listing. opendir(DIR, $IDS::rulespath) or die $!; # Loop through the direcory. while (my $file = readdir(DIR)) { @@ -296,18 +312,32 @@ if(-f $IDS::used_rulefiles_file) { # Save ruleset configuration. if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { my %oldsettings; + my %rulesetsources; # Read-in current (old) IDS settings. &General::readhash("$IDS::rules_settings_file", \%oldsettings); + # Get all available ruleset locations. + &General::readhash("$IDS::rulesetsourcesfile", \%rulesetsources); + # Prevent form name from been stored in conf file. delete $cgiparams{'RULESET'}; - # Check if an oinkcode has been provided. - if ($cgiparams{'OINKCODE'}) { - # Check if the oinkcode contains unallowed chars. - unless ($cgiparams{'OINKCODE'} =~ /^[a-z0-9]+$/) { - $errormessage = $Lang::tr{'invalid input for oink code'}; + # Grab the URL based on the choosen vendor. + my $url = $rulesetsources{$cgiparams{'RULES'}}; + + # Check if the choosen vendor (URL) requires an subscription/oinkcode. + if ($url =~ /\/ ) { + # Check if an subscription/oinkcode has been provided. + if ($cgiparams{'OINKCODE'}) { + # Check if the oinkcode contains unallowed chars. + unless ($cgiparams{'OINKCODE'} =~ /^[a-z0-9]+$/) { + $errormessage = $Lang::tr{'invalid input for oink code'}; + } + } else { + # Print an error message, that an subsription/oinkcode is required for this + # vendor. + $errormessage = $Lang::tr{'ids oinkcode required'}; } } @@ -315,58 +345,58 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { if (!$errormessage) { # Store settings into settings file. &General::writehash("$IDS::rules_settings_file", \%cgiparams); - } - - # Check if the the automatic rule update hass been touched. - if($cgiparams{'AUTOUPDATE_INTERVAL'} ne $oldsettings{'AUTOUPDATE_INTERVAL'}) { - # Call suricatactrl to set the new interval. - &IDS::call_suricatactrl("cron", $cgiparams{'AUTOUPDATE_INTERVAL'}); - } - # Check if a ruleset is present - if not or the source has been changed download it. - if((! %idsrules) || ($oldsettings{'RULES'} ne $cgiparams{'RULES'})) { - # Check if the red device is active. - unless (-e "${General::swroot}/red/active") { - $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}"; + # Check if the the automatic rule update hass been touched. + if($cgiparams{'AUTOUPDATE_INTERVAL'} ne $oldsettings{'AUTOUPDATE_INTERVAL'}) { + # Call suricatactrl to set the new interval. + &IDS::call_suricatactrl("cron", $cgiparams{'AUTOUPDATE_INTERVAL'}); } - # Check if enought free disk space is availabe. - if(&IDS::checkdiskspace()) { - $errormessage = "$Lang::tr{'not enough disk space'}"; - } + # Check if a ruleset is present - if not or the source has been changed download it. + if((! %idsrules) || ($oldsettings{'RULES'} ne $cgiparams{'RULES'})) { + # Check if the red device is active. + unless (-e "${General::swroot}/red/active") { + $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}"; + } - # Check if any errors happend. - unless ($errormessage) { - # Lock the webpage and print notice about downloading - # a new ruleset. - &working_notice("$Lang::tr{'snort working'}"); + # Check if enought free disk space is availabe. + if(&IDS::checkdiskspace()) { + $errormessage = "$Lang::tr{'not enough disk space'}"; + } - # Call subfunction to download the ruleset. - if(&IDS::downloadruleset()) { - $errormessage = $Lang::tr{'could not download latest updates'}; + # Check if any errors happend. + unless ($errormessage) { + # Lock the webpage and print notice about downloading + # a new ruleset. + &working_notice("$Lang::tr{'ids working'}"); - # Call function to store the errormessage. - &IDS::_store_error_message($errormessage); - } else { - # Call subfunction to launch oinkmaster. - &IDS::oinkmaster(); - } + # Call subfunction to download the ruleset. + if(&IDS::downloadruleset()) { + $errormessage = $Lang::tr{'could not download latest updates'}; - # Check if the IDS is running. - if(&IDS::ids_is_running()) { - # Call suricatactrl to stop the IDS - because of the changed - # ruleset - the use has to configure it before suricata can be - # used again. - &IDS::call_suricatactrl("stop"); - } + # Call function to store the errormessage. + &IDS::_store_error_message($errormessage); + } else { + # Call subfunction to launch oinkmaster. + &IDS::oinkmaster(); + } - # Perform a reload of the page. - &reload(); + # Check if the IDS is running. + if(&IDS::ids_is_running()) { + # Call suricatactrl to stop the IDS - because of the changed + # ruleset - the use has to configure it before suricata can be + # used again. + &IDS::call_suricatactrl("stop"); + } + + # Perform a reload of the page. + &reload(); + } } } # Save ruleset. -} elsif ($cgiparams{'RULESET'} eq $Lang::tr{'update'}) { +} elsif ($cgiparams{'RULESET'} eq $Lang::tr{'ids apply'}) { # Arrays to store which rulefiles have been enabled and will be used. my @enabled_rulefiles; @@ -467,7 +497,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { &IDS::write_used_rulefiles_file(@enabled_rulefiles); # Lock the webpage and print message. - &working_notice("$Lang::tr{'snort working'}"); + &working_notice("$Lang::tr{'ids apply ruleset changes'}"); # Call oinkmaster to alter the ruleset. &IDS::oinkmaster(); @@ -497,7 +527,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { unless ($errormessage) { # Lock the webpage and print notice about downloading # a new ruleset. - &working_notice("$Lang::tr{'snort working'}"); + &working_notice("$Lang::tr{'ids download new ruleset'}"); # Call subfunction to download the ruleset. if(&IDS::downloadruleset()) { @@ -522,7 +552,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { &reload(); } } -# Save snort settings. +# Save IDS settings. } elsif ($cgiparams{'IDS'} eq $Lang::tr{'save'}) { my %oldidssettings; my $reload_page; @@ -587,7 +617,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Check if a ruleset exists. if (%idsrules) { # Lock the webpage and print message. - &working_notice("$Lang::tr{'snort working'}"); + &working_notice("$Lang::tr{'ids working'}"); # Call oinkmaster to alter the ruleset. &IDS::oinkmaster(); @@ -753,17 +783,6 @@ END END } -my $rulesdate; - -# Check if a ruleset allready has been downloaded. -if ( -f "$IDS::rulestarball"){ - # Call stat on the filename to obtain detailed information. - my @Info = stat("$IDS::rulestarball"); - - # Grab details about the creation time. - $rulesdate = localtime($Info[9]); -} - # Only show this area, if a ruleset is present. if (%idsrules) { @@ -888,8 +907,8 @@ print < END ; - # Check if a ruleset has been downloaded yet. - if (%idsrules) { + # Show the "Update Ruleset"-Button only if a ruleset has been downloaded yet and automatic updates are disabled. + if ((%idsrules) && ($rulessettings{'AUTOUPDATE_INTERVAL'} eq "off")) { # Display button to update the ruleset. print"\n"; } @@ -1039,7 +1058,20 @@ END # Only show the section for configuring the ruleset if one is present. if (%idsrules) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'intrusion detection system rules'}); + # Load neccessary perl modules for file stat and to format the timestamp. + use File::stat; + use POSIX qw( strftime ); + + # Call stat on the rulestarball. + my $stat = stat("$IDS::rulestarball"); + + # Get timestamp the file creation. + my $mtime = $stat->mtime; + + # Convert into human read-able format. + my $rulesdate = strftime('%Y-%m-%d %H:%M:%S', localtime($mtime)); + + &Header::openbox('100%', 'LEFT', "$Lang::tr{'intrusion detection system rules'} ($rulesdate)" ); print"
\n"; @@ -1134,9 +1166,7 @@ if (%idsrules) { print < - -   - +