X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=4bd0128cb4cf4a5e4ff6e0de3d76e4010e393da2;hp=7469b0d462bac2b47ac9591c4e405234c74fab36;hb=f2665db1adb48ecbdfc59619c4693525be21974a;hpb=cb5e9c6c64d5281eba5c790f14c2e5f3066becbf diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 7469b0d46..4bd0128cb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -1,25 +1,39 @@ #!/usr/bin/perl -# -# SmoothWall CGIs -# -# This code is distributed under the terms of the GPL -# -# (c) The SmoothWall Team -# - -use LWP::UserAgent; -use File::Copy; -use File::Temp qw/ tempfile tempdir /; +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2013 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + use strict; # enable only the following on debugging purpose #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use File::Copy; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +sub refreshpage{&Header::openbox( 'Waiting', 1, "" );print "

$Lang::tr{'pagerefresh'}
";&Header::closebox();} + +$a = new CGI; + my %color = (); my %mainsettings = (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); @@ -30,8 +44,6 @@ my %checked=(); my %selected=(); my %netsettings=(); our $errormessage = ''; -our $md5 = '0';# not '' to avoid displaying the wrong message when INSTALLMD5 not set -our $realmd5 = ''; our $results = ''; our $tempdir = ''; our $url=''; @@ -51,13 +63,13 @@ $snortsettings{'GUARDIAN_ALERTFILE'} = '/var/log/snort/alert'; $snortsettings{'GUARDIAN_IGNOREFILE'} = '/var/ipfire/guardian/guardian.ignore'; $snortsettings{'GUARDIAN_TARGETFILE'} = '/var/ipfire/guardian/guardian.target'; $snortsettings{'GUARDIAN_TIMELIMIT'} = '86400'; -$snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'} = `cat $snortsettings{'GUARDIAN_IGNOREFILE'}`; $snortsettings{'ACTION'} = ''; $snortsettings{'ACTION2'} = ''; $snortsettings{'RULES'} = ''; $snortsettings{'OINKCODE'} = ''; $snortsettings{'INSTALLDATE'} = ''; -$snortsettings{'INSTALLMD5'} = ''; +$snortsettings{'FILE'} = ''; +$snortsettings{'UPLOAD'} = ''; &Header::getcgihash(\%snortsettings, {'wantfile' => 1, 'filevar' => 'FH'}); @@ -85,17 +97,17 @@ if (-e "/etc/snort/snort.conf") { close(FILE); open(FILE, ">/etc/snort/snort.conf") or die 'Unable to write snort config file.'; - my @rules = `cd /etc/snort/rules/ && ls *.rules`; # With this loop the rule might be display with correct rulepath set + my @rules = `cd /etc/snort/rules/ && ls *.rules 2>/dev/null`; # With this loop the rule might be display with correct rulepath set foreach (@rules) { chomp $_; my $temp = join(";",@snortconfig); if ( $temp =~ /$_/ ){next;} else { push(@snortconfig,"#include \$RULE_PATH/".$_);} } - + # Loop over each line foreach my $line (@snortconfig) { - # Trim the line + # Trim the line chomp $line; # Check for a line with .rules @@ -134,7 +146,7 @@ if (-e "/etc/snort/snort.conf") { # If see more than one dashed line, (start to) create rule file description if ($dashlinecnt > 1) { # Check for a line starting with a # - if ($ruleline =~ /^\#/) { + if ($ruleline =~ /^\#/ and $ruleline !~ /^\#alert/) { # Create tempruleline my $tempruleline = $ruleline; @@ -213,6 +225,7 @@ if (-e "/etc/snort/snort.conf") { if (!exists $snortsettings{"SNORT_RULE_$rule"}) { $line = "# $line"; } + } # Check for rule state @@ -250,18 +263,22 @@ if (-e "/etc/snort/snort.conf") { ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT_s.tar.gz"; + $url=" http://www.snort.org/sub-rules/snortrules-snapshot-2953.tar.gz/$snortsettings{'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-CURRENT.tar.gz"; + $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2950.tar.gz/$snortsettings{'OINKCODE'}"; +} elsif ($snortsettings{'RULES'} eq 'community') { + $url=" http://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz"; } else { - $url="http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz"; + $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) { $errormessage = $Lang::tr{'invalid input for oink code'} unless ( ($snortsettings{'OINKCODE'} =~ /^[a-z0-9]+$/) || - ($snortsettings{'RULESTYPE'} eq 'nothing' ) ); + ($snortsettings{'RULES'} eq 'nothing' ) || + ($snortsettings{'RULES'} eq 'emerging' ) || + ($snortsettings{'RULES'} eq 'community' )); &General::writehash("${General::swroot}/snort/settings", \%snortsettings); if ($snortsettings{'ENABLE_SNORT'} eq 'on') @@ -269,25 +286,31 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e system ('/usr/bin/touch', "${General::swroot}/snort/enable"); } else { unlink "${General::swroot}/snort/enable"; - } + } if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_green"); } else { unlink "${General::swroot}/snort/enable_green"; - } + } if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue"); } else { unlink "${General::swroot}/snort/enable_blue"; - } + } if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange"); } else { unlink "${General::swroot}/snort/enable_orange"; } + if ($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'on') + { + system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect"); + } else { + unlink "${General::swroot}/snort/enable_preprocessor_http_inspect"; + } if ($snortsettings{'ENABLE_GUARDIAN'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/guardian/enable"); @@ -295,9 +318,15 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e unlink "${General::swroot}/guardian/enable"; } - system('/usr/local/bin/snortctrl restart >/dev/null'); + system('/usr/local/bin/snortctrl restart >/dev/null'); } elsif ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "guardian" ){ + foreach my $key (keys %snortsettings){ + if ( $key !~ /^GUARDIAN/ ){ + delete $snortsettings{$key}; + } + } + &General::writehashpart("${General::swroot}/snort/settings", \%snortsettings); open(IGNOREFILE, ">$snortsettings{'GUARDIAN_IGNOREFILE'}") or die "Unable to write guardian ignore file $snortsettings{'GUARDIAN_IGNOREFILE'}"; print IGNOREFILE $snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'}; close(IGNOREFILE); @@ -314,29 +343,47 @@ END ; close(GUARDIAN); system('/usr/local/bin/snortctrl restart >/dev/null'); -} else { +} # INSTALLMD5 is not in the form, so not retrieved by getcgihash &General::readhash("${General::swroot}/snort/settings", \%snortsettings); -} -if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) { - $md5 = &getmd5; - if (($snortsettings{'INSTALLMD5'} ne $md5) && defined $md5 ) { - chomp($md5); - my $filename = &downloadrulesfile(); - if (defined $filename) { - # Check MD5sum - $realmd5 = `/usr/bin/md5sum $filename`; - chomp ($realmd5); - $realmd5 =~ s/^(\w+)\s.*$/$1/; - if ($md5 ne $realmd5) { - $errormessage = "$Lang::tr{'invalid md5sum'}"; +if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) { + + my @df = `/bin/df -B M /var`; + foreach my $line (@df) { + next if $line =~ m/^Filesystem/; + my $return; + + if ($line =~ m/dev/ ) { + $line =~ m/^.* (\d+)M.*$/; + my @temp = split(/ +/,$line); + if ($1<300) { + $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB"; } else { - $results = "$Lang::tr{'installed updates'}\n
";
-				$results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
-				$results .= "
"; + + if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} ){ + + &downloadrulesfile(); + sleep(3); + $return = `cat /var/tmp/log 2>/dev/null`; + + } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'} ) { + my $upload = $a->param("UPLOAD"); + open UPLOADFILE, ">/var/tmp/snortrules.tar.gz"; + binmode $upload; + while ( <$upload> ) { + print UPLOADFILE; + } + close UPLOADFILE; + } + + if ($return =~ "ERROR"){ + $errormessage = "
".$return."
"; + } else { + system("/usr/local/bin/oinkmaster.pl -v -s -u file:///var/tmp/snortrules.tar.gz -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules >>/var/tmp/log 2>&1 &"); + sleep(2); + } } - unlink ($filename); } } } @@ -358,6 +405,7 @@ $checked{'ENABLE_GUARDIAN'}{'on'} = ''; $checked{'ENABLE_GUARDIAN'}{$snortsettings{'ENABLE_GUARDIAN'}} = "checked='checked'"; $selected{'RULES'}{'nothing'} = ''; $selected{'RULES'}{'community'} = ''; +$selected{'RULES'}{'emerging'} = ''; $selected{'RULES'}{'registered'} = ''; $selected{'RULES'}{'subscripted'} = ''; $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; @@ -367,7 +415,7 @@ $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; ####################### Added for snort rules control ################################# print ""; print < +