ids-functions.pl: Introduce file for local rules.
authorStefan Schantl <stefan.schantl@ipfire.org>
Wed, 22 Jan 2020 13:40:34 +0000 (14:40 +0100)
committerArne Fitzenreiter <arne_f@ipfire.org>
Sat, 25 Jan 2020 15:04:39 +0000 (15:04 +0000)
This file is to be used, to store customized IDS rules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
config/cfgroot/ids-functions.pl

index 3fa19fa..3cfe837 100644 (file)
@@ -67,6 +67,9 @@ our $ids_page_lock_file = "/tmp/ids_page_locked";
 # Location where the rulefiles are stored.
 our $rulespath = "/var/lib/suricata";
 
+# Location to store local rules. This file will not be touched.
+our $local_rules_file = "$rulespath/local.rules";
+
 # File which contains the rules to whitelist addresses on suricata.
 our $whitelist_file = "$rulespath/whitelist.rules";
 
@@ -581,6 +584,9 @@ sub _cleanup_rulesdir() {
                # Skip rules file for whitelisted hosts.
                next if ("$rulespath/$file" eq $whitelist_file);
 
+               # Skip rules file with local rules.
+               next if ("$rulespath/$file" eq $local_rules_file);
+
                # Delete the current processed file, if not, exit this function
                # and return an error message.
                unlink("$rulespath/$file") or return "Could not delete $rulespath/$file. $!\n";