X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=d9082979dcc94bea2d4f9780fff2345a089992fc;hp=7469b0d462bac2b47ac9591c4e405234c74fab36;hb=32810952ccb7190822848f75b4c417f6e1b9ad5f;hpb=cb5e9c6c64d5281eba5c790f14c2e5f3066becbf
diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index 7469b0d462..d9082979dc 100644
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -1,11 +1,24 @@
#!/usr/bin/perl
-#
-# SmoothWall CGIs
-#
-# This code is distributed under the terms of the GPL
-#
-# (c) The SmoothWall Team
-#
+###############################################################################
+# #
+# IPFire.org - A linux based firewall #
+# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
+# #
+# This program is free software: you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation, either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# This program is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with this program. If not, see . #
+# #
+###############################################################################
+
use LWP::UserAgent;
use File::Copy;
@@ -13,8 +26,8 @@ use File::Temp qw/ tempfile tempdir /;
use strict;
# enable only the following on debugging purpose
-#use warnings;
-#use CGI::Carp 'fatalsToBrowser';
+use warnings;
+use CGI::Carp 'fatalsToBrowser';
require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
@@ -30,8 +43,6 @@ my %checked=();
my %selected=();
my %netsettings=();
our $errormessage = '';
-our $md5 = '0';# not '' to avoid displaying the wrong message when INSTALLMD5 not set
-our $realmd5 = '';
our $results = '';
our $tempdir = '';
our $url='';
@@ -51,13 +62,11 @@ $snortsettings{'GUARDIAN_ALERTFILE'} = '/var/log/snort/alert';
$snortsettings{'GUARDIAN_IGNOREFILE'} = '/var/ipfire/guardian/guardian.ignore';
$snortsettings{'GUARDIAN_TARGETFILE'} = '/var/ipfire/guardian/guardian.target';
$snortsettings{'GUARDIAN_TIMELIMIT'} = '86400';
-$snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'} = `cat $snortsettings{'GUARDIAN_IGNOREFILE'}`;
$snortsettings{'ACTION'} = '';
$snortsettings{'ACTION2'} = '';
$snortsettings{'RULES'} = '';
$snortsettings{'OINKCODE'} = '';
$snortsettings{'INSTALLDATE'} = '';
-$snortsettings{'INSTALLMD5'} = '';
&Header::getcgihash(\%snortsettings, {'wantfile' => 1, 'filevar' => 'FH'});
@@ -92,10 +101,10 @@ if (-e "/etc/snort/snort.conf") {
if ( $temp =~ /$_/ ){next;}
else { push(@snortconfig,"#include \$RULE_PATH/".$_);}
}
-
+
# Loop over each line
foreach my $line (@snortconfig) {
- # Trim the line
+ # Trim the line
chomp $line;
# Check for a line with .rules
@@ -213,6 +222,7 @@ if (-e "/etc/snort/snort.conf") {
if (!exists $snortsettings{"SNORT_RULE_$rule"}) {
$line = "# $line";
}
+
}
# Check for rule state
@@ -250,9 +260,13 @@ if (-e "/etc/snort/snort.conf") {
####################### End added for snort rules control #################################
if ($snortsettings{'RULES'} eq 'subscripted') {
- $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT_s.tar.gz";
+ #$url="http://dl.snort.org/sub-rules/snortrules-snapshot-2.8_s.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ $url="http://dl.snort.org/sub-rules/snortrules-snapshot-2853_s.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ #$url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.8_s.tar.gz";
} elsif ($snortsettings{'RULES'} eq 'registered') {
- $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT.tar.gz";
+ $url="http://dl.snort.org/reg-rules/snortrules-snapshot-2.8.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ #$url="http://dl.snort.org/reg-rules/snortrules-snapshot-2853.tar.gz?oink_code=$snortsettings{'OINKCODE'}";
+ #$url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.8.tar.gz";
} else {
$url="http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz";
}
@@ -269,25 +283,31 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e
system ('/usr/bin/touch', "${General::swroot}/snort/enable");
} else {
unlink "${General::swroot}/snort/enable";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_green");
} else {
unlink "${General::swroot}/snort/enable_green";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue");
} else {
unlink "${General::swroot}/snort/enable_blue";
- }
+ }
if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange");
} else {
unlink "${General::swroot}/snort/enable_orange";
}
+ if ($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect");
+ } else {
+ unlink "${General::swroot}/snort/enable_preprocessor_http_inspect";
+ }
if ($snortsettings{'ENABLE_GUARDIAN'} eq 'on')
{
system ('/usr/bin/touch', "${General::swroot}/guardian/enable");
@@ -295,11 +315,11 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e
unlink "${General::swroot}/guardian/enable";
}
- system('/usr/local/bin/snortctrl restart >/dev/null');
+ system('/usr/local/bin/snortctrl restart >/dev/null');
} elsif ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "guardian" ){
open(IGNOREFILE, ">$snortsettings{'GUARDIAN_IGNOREFILE'}") or die "Unable to write guardian ignore file $snortsettings{'GUARDIAN_IGNOREFILE'}";
- print IGNOREFILE $snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'};
+ print IGNOREFILE $snortsettings{'IGNOREFILE_CONTENT'};
close(IGNOREFILE);
open(GUARDIAN, ">/var/ipfire/guardian/guardian.conf") or die "Unable to write guardian conf /var/ipfire/guardian/guardian.conf";
print GUARDIAN </dev/null');
-} else {
+}
# INSTALLMD5 is not in the form, so not retrieved by getcgihash
&General::readhash("${General::swroot}/snort/settings", \%snortsettings);
-}
if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) {
- $md5 = &getmd5;
- if (($snortsettings{'INSTALLMD5'} ne $md5) && defined $md5 ) {
- chomp($md5);
- my $filename = &downloadrulesfile();
- if (defined $filename) {
- # Check MD5sum
- $realmd5 = `/usr/bin/md5sum $filename`;
- chomp ($realmd5);
- $realmd5 =~ s/^(\w+)\s.*$/$1/;
- if ($md5 ne $realmd5) {
- $errormessage = "$Lang::tr{'invalid md5sum'}";
+
+ my @df = `/bin/df -B M /var`;
+ foreach my $line (@df) {
+ next if $line =~ m/^Filesystem/;
+
+ if ($line =~ m/dev/ ) {
+ $line =~ m/^.* (\d+)M.*$/;
+ my @temp = split(/ +/,$line);
+ if ($1<600) {
+ $errormessage = "$Lang::tr{'not enough disk space'} < 600MB, /var $1MB";
} else {
- $results = "$Lang::tr{'installed updates'}\n";
- $results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
- $results .= "
";
+ my $filename = &downloadrulesfile();
+ if (defined $filename) {
+ $results = "$Lang::tr{'installed updates'}\n";
+ $results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
+ $results .= "
";
+ }
+ unlink ($filename);
}
- unlink ($filename);
+
}
}
+
+
}
$checked{'ENABLE_SNORT'}{'off'} = '';
@@ -367,7 +391,7 @@ $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'";
####################### Added for snort rules control #################################
print "";
print <
+