X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=4bd0128cb4cf4a5e4ff6e0de3d76e4010e393da2;hp=6ef9da7d37aa3862accec314ec157cc6a2a7a697;hb=f2665db1adb48ecbdfc59619c4693525be21974a;hpb=46dff71309ed3cb2af23aecc06c409eac4608c94 diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 6ef9da7d3..4bd0128cb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -1,32 +1,49 @@ #!/usr/bin/perl -# -# SmoothWall CGIs -# -# This code is distributed under the terms of the GPL -# -# (c) The SmoothWall Team -# - -use LWP::UserAgent; -use File::Copy; -use File::Temp qw/ tempfile tempdir /; +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2013 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + use strict; # enable only the following on debugging purpose -use warnings; -use CGI::Carp 'fatalsToBrowser'; +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; +use File::Copy; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +sub refreshpage{&Header::openbox( 'Waiting', 1, "" );print "

$Lang::tr{'pagerefresh'}
";&Header::closebox();} + +$a = new CGI; + +my %color = (); +my %mainsettings = (); +&General::readhash("${General::swroot}/main/settings", \%mainsettings); +&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); + my %snortsettings=(); my %checked=(); my %selected=(); my %netsettings=(); our $errormessage = ''; -our $md5 = '0';# not '' to avoid displaying the wrong message when INSTALLMD5 not set -our $realmd5 = ''; our $results = ''; our $tempdir = ''; our $url=''; @@ -38,16 +55,26 @@ $snortsettings{'ENABLE_SNORT'} = 'off'; $snortsettings{'ENABLE_SNORT_GREEN'} = 'off'; $snortsettings{'ENABLE_SNORT_BLUE'} = 'off'; $snortsettings{'ENABLE_SNORT_ORANGE'} = 'off'; +$snortsettings{'ENABLE_GUARDIAN'} = 'off'; +$snortsettings{'GUARDIAN_INTERFACE'} = `cat /var/ipfire/red/iface`; +$snortsettings{'GUARDIAN_HOSTGATEWAYBYTE'} = '1'; +$snortsettings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log'; +$snortsettings{'GUARDIAN_ALERTFILE'} = '/var/log/snort/alert'; +$snortsettings{'GUARDIAN_IGNOREFILE'} = '/var/ipfire/guardian/guardian.ignore'; +$snortsettings{'GUARDIAN_TARGETFILE'} = '/var/ipfire/guardian/guardian.target'; +$snortsettings{'GUARDIAN_TIMELIMIT'} = '86400'; $snortsettings{'ACTION'} = ''; +$snortsettings{'ACTION2'} = ''; $snortsettings{'RULES'} = ''; $snortsettings{'OINKCODE'} = ''; $snortsettings{'INSTALLDATE'} = ''; -$snortsettings{'INSTALLMD5'} = ''; +$snortsettings{'FILE'} = ''; +$snortsettings{'UPLOAD'} = ''; &Header::getcgihash(\%snortsettings, {'wantfile' => 1, 'filevar' => 'FH'}); ####################### Added for snort rules control ################################# -my $snortrulepath; +my $snortrulepath; # change to "/etc/snort/rules" - maniac my @snortconfig; my $restartsnortrequired = 0; my %snortrules; @@ -62,12 +89,22 @@ my $border = ''; my $checkboxname = ''; if (-e "/etc/snort/snort.conf") { + + # Open snort.conf file, read it in, close it, and re-open for writing open(FILE, "/etc/snort/snort.conf") or die 'Unable to read snort config file.'; @snortconfig = ; close(FILE); open(FILE, ">/etc/snort/snort.conf") or die 'Unable to write snort config file.'; + my @rules = `cd /etc/snort/rules/ && ls *.rules 2>/dev/null`; # With this loop the rule might be display with correct rulepath set + foreach (@rules) { + chomp $_; + my $temp = join(";",@snortconfig); + if ( $temp =~ /$_/ ){next;} + else { push(@snortconfig,"#include \$RULE_PATH/".$_);} + } + # Loop over each line foreach my $line (@snortconfig) { # Trim the line @@ -109,7 +146,7 @@ if (-e "/etc/snort/snort.conf") { # If see more than one dashed line, (start to) create rule file description if ($dashlinecnt > 1) { # Check for a line starting with a # - if ($ruleline =~ /^\#/) { + if ($ruleline =~ /^\#/ and $ruleline !~ /^\#alert/) { # Create tempruleline my $tempruleline = $ruleline; @@ -188,6 +225,7 @@ if (-e "/etc/snort/snort.conf") { if (!exists $snortsettings{"SNORT_RULE_$rule"}) { $line = "# $line"; } + } # Check for rule state @@ -218,27 +256,29 @@ if (-e "/etc/snort/snort.conf") { close(FILE); if ($restartsnortrequired) { - system('/usr/local/bin/restartsnort','red','orange','blue','green'); + system('/usr/local/bin/snortctrl restart >/dev/null'); } } ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT_s.tar.gz"; + $url=" http://www.snort.org/sub-rules/snortrules-snapshot-2953.tar.gz/$snortsettings{'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT.tar.gz"; -} elsif ($snortsettings{'RULES'} eq 'bleeding') { - $url="http://www.bleedingsnort.com/bleeding.rules.tar.gz"; + $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2950.tar.gz/$snortsettings{'OINKCODE'}"; +} elsif ($snortsettings{'RULES'} eq 'community') { + $url=" http://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz"; } else { - $url="http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz"; + $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } -if ($snortsettings{'ACTION'} eq $Lang::tr{'save'}) +if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) { $errormessage = $Lang::tr{'invalid input for oink code'} unless ( ($snortsettings{'OINKCODE'} =~ /^[a-z0-9]+$/) || - ($snortsettings{'RULESTYPE'} eq 'nothing' ) ); + ($snortsettings{'RULES'} eq 'nothing' ) || + ($snortsettings{'RULES'} eq 'emerging' ) || + ($snortsettings{'RULES'} eq 'community' )); &General::writehash("${General::swroot}/snort/settings", \%snortsettings); if ($snortsettings{'ENABLE_SNORT'} eq 'on') @@ -246,51 +286,104 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'}) system ('/usr/bin/touch', "${General::swroot}/snort/enable"); } else { unlink "${General::swroot}/snort/enable"; - } + } if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_green"); } else { unlink "${General::swroot}/snort/enable_green"; - } + } if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue"); } else { unlink "${General::swroot}/snort/enable_blue"; - } + } if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange"); } else { unlink "${General::swroot}/snort/enable_orange"; } + if ($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'on') + { + system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect"); + } else { + unlink "${General::swroot}/snort/enable_preprocessor_http_inspect"; + } + if ($snortsettings{'ENABLE_GUARDIAN'} eq 'on') + { + system ('/usr/bin/touch', "${General::swroot}/guardian/enable"); + } else { + unlink "${General::swroot}/guardian/enable"; + } - system('/usr/local/bin/restartsnort','red','orange','blue','green'); + system('/usr/local/bin/snortctrl restart >/dev/null'); -} else { +} elsif ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "guardian" ){ + foreach my $key (keys %snortsettings){ + if ( $key !~ /^GUARDIAN/ ){ + delete $snortsettings{$key}; + } + } + &General::writehashpart("${General::swroot}/snort/settings", \%snortsettings); + open(IGNOREFILE, ">$snortsettings{'GUARDIAN_IGNOREFILE'}") or die "Unable to write guardian ignore file $snortsettings{'GUARDIAN_IGNOREFILE'}"; + print IGNOREFILE $snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'}; + close(IGNOREFILE); + open(GUARDIAN, ">/var/ipfire/guardian/guardian.conf") or die "Unable to write guardian conf /var/ipfire/guardian/guardian.conf"; + print GUARDIAN </dev/null'); +} # INSTALLMD5 is not in the form, so not retrieved by getcgihash &General::readhash("${General::swroot}/snort/settings", \%snortsettings); -} -if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) { - $md5 = &getmd5; - if (($snortsettings{'INSTALLMD5'} ne $md5) && defined $md5 ) { - chomp($md5); - my $filename = &downloadrulesfile(); - if (defined $filename) { - # Check MD5sum - $realmd5 = `/usr/bin/md5sum $filename`; - chomp ($realmd5); - $realmd5 =~ s/^(\w+)\s.*$/$1/; - if ($md5 ne $realmd5) { - $errormessage = "$Lang::tr{'invalid md5sum'}"; +if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) { + + my @df = `/bin/df -B M /var`; + foreach my $line (@df) { + next if $line =~ m/^Filesystem/; + my $return; + + if ($line =~ m/dev/ ) { + $line =~ m/^.* (\d+)M.*$/; + my @temp = split(/ +/,$line); + if ($1<300) { + $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB"; } else { - $results = "$Lang::tr{'installed updates'}\n
";
-				$results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
-				$results .= "
"; + + if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} ){ + + &downloadrulesfile(); + sleep(3); + $return = `cat /var/tmp/log 2>/dev/null`; + + } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'} ) { + my $upload = $a->param("UPLOAD"); + open UPLOADFILE, ">/var/tmp/snortrules.tar.gz"; + binmode $upload; + while ( <$upload> ) { + print UPLOADFILE; + } + close UPLOADFILE; + } + + if ($return =~ "ERROR"){ + $errormessage = "
".$return."
"; + } else { + system("/usr/local/bin/oinkmaster.pl -v -s -u file:///var/tmp/snortrules.tar.gz -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules >>/var/tmp/log 2>&1 &"); + sleep(2); + } } - unlink ($filename); } } } @@ -307,9 +400,12 @@ $checked{'ENABLE_SNORT_BLUE'}{$snortsettings{'ENABLE_SNORT_BLUE'}} = "checked='c $checked{'ENABLE_SNORT_ORANGE'}{'off'} = ''; $checked{'ENABLE_SNORT_ORANGE'}{'on'} = ''; $checked{'ENABLE_SNORT_ORANGE'}{$snortsettings{'ENABLE_SNORT_ORANGE'}} = "checked='checked'"; +$checked{'ENABLE_GUARDIAN'}{'off'} = ''; +$checked{'ENABLE_GUARDIAN'}{'on'} = ''; +$checked{'ENABLE_GUARDIAN'}{$snortsettings{'ENABLE_GUARDIAN'}} = "checked='checked'"; $selected{'RULES'}{'nothing'} = ''; -$selected{'RULES'}{'bleeding'} = ''; $selected{'RULES'}{'community'} = ''; +$selected{'RULES'}{'emerging'} = ''; $selected{'RULES'}{'registered'} = ''; $selected{'RULES'}{'subscripted'} = ''; $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; @@ -319,18 +415,18 @@ $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; ####################### Added for snort rules control ################################# print ""; print < +