X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fids.cgi;h=984e795e72bf002446ee150166a174ef56c114e5;hp=111aea66796182b0b7b95d283e8c4ffacf92a162;hb=e6d8a42109651b5054eec7a9b613f732bf8d323f;hpb=a4ff59ef4fc420c48faa4a228dbced4dea2cb6c3 diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 111aea667..984e795e7 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2013 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -19,20 +19,21 @@ # # ############################################################################### - -use LWP::UserAgent; -use File::Copy; -use File::Temp qw/ tempfile tempdir /; use strict; # enable only the following on debugging purpose #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use File::Copy; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +sub refreshpage{&Header::openbox( 'Waiting', 1, "" );print "

$Lang::tr{'pagerefresh'}
";&Header::closebox();} + +$a = new CGI; + my %color = (); my %mainsettings = (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); @@ -43,8 +44,6 @@ my %checked=(); my %selected=(); my %netsettings=(); our $errormessage = ''; -our $md5 = '0';# not '' to avoid displaying the wrong message when INSTALLMD5 not set -our $realmd5 = ''; our $results = ''; our $tempdir = ''; our $url=''; @@ -56,7 +55,6 @@ $snortsettings{'ENABLE_SNORT'} = 'off'; $snortsettings{'ENABLE_SNORT_GREEN'} = 'off'; $snortsettings{'ENABLE_SNORT_BLUE'} = 'off'; $snortsettings{'ENABLE_SNORT_ORANGE'} = 'off'; -$snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} = 'off'; $snortsettings{'ENABLE_GUARDIAN'} = 'off'; $snortsettings{'GUARDIAN_INTERFACE'} = `cat /var/ipfire/red/iface`; $snortsettings{'GUARDIAN_HOSTGATEWAYBYTE'} = '1'; @@ -65,13 +63,13 @@ $snortsettings{'GUARDIAN_ALERTFILE'} = '/var/log/snort/alert'; $snortsettings{'GUARDIAN_IGNOREFILE'} = '/var/ipfire/guardian/guardian.ignore'; $snortsettings{'GUARDIAN_TARGETFILE'} = '/var/ipfire/guardian/guardian.target'; $snortsettings{'GUARDIAN_TIMELIMIT'} = '86400'; -$snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'} = `cat $snortsettings{'GUARDIAN_IGNOREFILE'}`; $snortsettings{'ACTION'} = ''; $snortsettings{'ACTION2'} = ''; $snortsettings{'RULES'} = ''; $snortsettings{'OINKCODE'} = ''; $snortsettings{'INSTALLDATE'} = ''; -$snortsettings{'INSTALLMD5'} = ''; +$snortsettings{'FILE'} = ''; +$snortsettings{'UPLOAD'} = ''; &Header::getcgihash(\%snortsettings, {'wantfile' => 1, 'filevar' => 'FH'}); @@ -99,30 +97,19 @@ if (-e "/etc/snort/snort.conf") { close(FILE); open(FILE, ">/etc/snort/snort.conf") or die 'Unable to write snort config file.'; - my @rules = `cd /etc/snort/rules/ && ls *.rules`; # With this loop the rule might be display with correct rulepath set + my @rules = `cd /etc/snort/rules/ && ls *.rules 2>/dev/null`; # With this loop the rule might be display with correct rulepath set foreach (@rules) { chomp $_; my $temp = join(";",@snortconfig); if ( $temp =~ /$_/ ){next;} else { push(@snortconfig,"#include \$RULE_PATH/".$_);} } - + # Loop over each line foreach my $line (@snortconfig) { # Trim the line chomp $line; - if ($snortsettings{'ACTION'} eq $Lang::tr{'save'}) { - # Check for preprocessor settings - if ($line =~ /preprocessor http_inspect/) { - # Strip out leading # from rule line - $line =~ s/\# ?//i; - if (($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'off')) { - $line = "# $line"; - } - } - } - # Check for a line with .rules if ($line =~ /\.rules$/) { # Parse out rule file name @@ -159,7 +146,7 @@ if (-e "/etc/snort/snort.conf") { # If see more than one dashed line, (start to) create rule file description if ($dashlinecnt > 1) { # Check for a line starting with a # - if ($ruleline =~ /^\#/) { + if ($ruleline =~ /^\#/ and $ruleline !~ /^\#alert/) { # Create tempruleline my $tempruleline = $ruleline; @@ -238,7 +225,7 @@ if (-e "/etc/snort/snort.conf") { if (!exists $snortsettings{"SNORT_RULE_$rule"}) { $line = "# $line"; } - + } # Check for rule state @@ -276,18 +263,22 @@ if (-e "/etc/snort/snort.conf") { ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.6_s.tar.gz"; + $url=" http://www.snort.org/sub-rules/snortrules-snapshot-2953.tar.gz/$snortsettings{'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url="http://www.snort.org/pub-bin/oinkmaster.cgi/$snortsettings{'OINKCODE'}/snortrules-snapshot-2.6.tar.gz"; + $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2950.tar.gz/$snortsettings{'OINKCODE'}"; +} elsif ($snortsettings{'RULES'} eq 'community') { + $url=" http://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz"; } else { - $url="http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz"; + $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) { $errormessage = $Lang::tr{'invalid input for oink code'} unless ( ($snortsettings{'OINKCODE'} =~ /^[a-z0-9]+$/) || - ($snortsettings{'RULESTYPE'} eq 'nothing' ) ); + ($snortsettings{'RULES'} eq 'nothing' ) || + ($snortsettings{'RULES'} eq 'emerging' ) || + ($snortsettings{'RULES'} eq 'community' )); &General::writehash("${General::swroot}/snort/settings", \%snortsettings); if ($snortsettings{'ENABLE_SNORT'} eq 'on') @@ -295,19 +286,19 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e system ('/usr/bin/touch', "${General::swroot}/snort/enable"); } else { unlink "${General::swroot}/snort/enable"; - } + } if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_green"); } else { unlink "${General::swroot}/snort/enable_green"; - } + } if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue"); } else { unlink "${General::swroot}/snort/enable_blue"; - } + } if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange"); @@ -319,7 +310,7 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect"); } else { unlink "${General::swroot}/snort/enable_preprocessor_http_inspect"; - } + } if ($snortsettings{'ENABLE_GUARDIAN'} eq 'on') { system ('/usr/bin/touch', "${General::swroot}/guardian/enable"); @@ -330,6 +321,12 @@ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} e system('/usr/local/bin/snortctrl restart >/dev/null'); } elsif ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "guardian" ){ + foreach my $key (keys %snortsettings){ + if ( $key !~ /^GUARDIAN/ ){ + delete $snortsettings{$key}; + } + } + &General::writehashpart("${General::swroot}/snort/settings", \%snortsettings); open(IGNOREFILE, ">$snortsettings{'GUARDIAN_IGNOREFILE'}") or die "Unable to write guardian ignore file $snortsettings{'GUARDIAN_IGNOREFILE'}"; print IGNOREFILE $snortsettings{'GUARDIAN_IGNOREFILE_CONTENT'}; close(IGNOREFILE); @@ -350,24 +347,43 @@ END # INSTALLMD5 is not in the form, so not retrieved by getcgihash &General::readhash("${General::swroot}/snort/settings", \%snortsettings); -if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) { - $md5 = &getmd5; - if (($snortsettings{'INSTALLMD5'} ne $md5) && defined $md5 ) { - chomp($md5); - my $filename = &downloadrulesfile(); - if (defined $filename) { - # Check MD5sum - $realmd5 = `/usr/bin/md5sum $filename`; - chomp ($realmd5); - $realmd5 =~ s/^(\w+)\s.*$/$1/; - if ($md5 ne $realmd5) { - $errormessage = "$Lang::tr{'invalid md5sum'}"; +if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) { + + my @df = `/bin/df -B M /var`; + foreach my $line (@df) { + next if $line =~ m/^Filesystem/; + my $return; + + if ($line =~ m/dev/ ) { + $line =~ m/^.* (\d+)M.*$/; + my @temp = split(/ +/,$line); + if ($1<300) { + $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB"; } else { - $results = "$Lang::tr{'installed updates'}\n
";
-				$results .=`/usr/local/bin/oinkmaster.pl -s -u file://$filename -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules 2>&1`;
-				$results .= "
"; + + if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} ){ + + &downloadrulesfile(); + sleep(3); + $return = `cat /var/tmp/log 2>/dev/null`; + + } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'} ) { + my $upload = $a->param("UPLOAD"); + open UPLOADFILE, ">/var/tmp/snortrules.tar.gz"; + binmode $upload; + while ( <$upload> ) { + print UPLOADFILE; + } + close UPLOADFILE; + } + + if ($return =~ "ERROR"){ + $errormessage = "
".$return."
"; + } else { + system("/usr/local/bin/oinkmaster.pl -v -s -u file:///var/tmp/snortrules.tar.gz -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules >>/var/tmp/log 2>&1 &"); + sleep(2); + } } - unlink ($filename); } } } @@ -384,14 +400,12 @@ $checked{'ENABLE_SNORT_BLUE'}{$snortsettings{'ENABLE_SNORT_BLUE'}} = "checked='c $checked{'ENABLE_SNORT_ORANGE'}{'off'} = ''; $checked{'ENABLE_SNORT_ORANGE'}{'on'} = ''; $checked{'ENABLE_SNORT_ORANGE'}{$snortsettings{'ENABLE_SNORT_ORANGE'}} = "checked='checked'"; -$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{'off'} = ''; -$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{'on'} = ''; -$checked{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}{$snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'}} = "checked='checked'"; $checked{'ENABLE_GUARDIAN'}{'off'} = ''; $checked{'ENABLE_GUARDIAN'}{'on'} = ''; $checked{'ENABLE_GUARDIAN'}{$snortsettings{'ENABLE_GUARDIAN'}} = "checked='checked'"; $selected{'RULES'}{'nothing'} = ''; $selected{'RULES'}{'community'} = ''; +$selected{'RULES'}{'emerging'} = ''; $selected{'RULES'}{'registered'} = ''; $selected{'RULES'}{'subscripted'} = ''; $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; @@ -399,9 +413,9 @@ $selected{'RULES'}{$snortsettings{'RULES'}} = "selected='selected'"; &Header::openpage($Lang::tr{'intrusion detection system'}, 1, ''); ####################### Added for snort rules control ################################# -print ""; +print ""; print < + + END ; ####################### End added for snort rules control ################################# &Header::openbigbox('100%', 'left', '', $errormessage); +############### +# DEBUG DEBUG +# &Header::openbox('100%', 'left', 'DEBUG'); +# my $debugCount = 0; +# foreach my $line (sort keys %snortsettings) { +# print "$line = $snortsettings{$line}
\n"; +# $debugCount++; +# } +# print " Count: $debugCount\n"; +# &Header::closebox(); +# DEBUG DEBUG +############### + if ($errormessage) { &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); print "$errormessage\n"; @@ -433,7 +460,38 @@ if ($errormessage) { &Header::closebox(); } -&Header::openbox('100%', 'left', $Lang::tr{'intrusion detection system2'}); +my $return = `pidof oinkmaster.pl -x`; +chomp($return); +if ($return) { + &Header::openbox( 'Waiting', 1, "" ); + print < + + $Lang::tr{  + + $Lang::tr{'snort working'} + +
+ +
+ 
+END
+	my @output = `tail -20 /var/tmp/log`;
+	foreach (@output) {
+		print "$_";
+	}
+	print <
+		
+END
+	&Header::closebox();
+	&Header::closebigbox();
+	&Header::closepage();
+	exit;
+	refreshpage();
+}
+
+&Header::openbox('100%', 'left', $Lang::tr{'intrusion detection system'});
 print <
-	
-
-
-	
-
-
-  	
-	
+	
@@ -469,6 +519,7 @@ print <
 	
-	";
-} else {
-	if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} && $md5 eq $realmd5 ) {
-		$snortsettings{'INSTALLMD5'} = $realmd5;
-		$snortsettings{'INSTALLDATE'} = `/bin/date +'%Y-%m-%d'`;
-		&General::writehash("${General::swroot}/snort/settings", \%snortsettings);
-	}
-	print " $Lang::tr{'updates installed'}: $snortsettings{'INSTALLDATE'}";
+if ( -e "/var/tmp/snortrules.tar.gz"){
+	my @Info = stat("/var/tmp/snortrules.tar.gz");
+	$snortsettings{'INSTALLDATE'} = localtime($Info[9]);
 }
+print " $Lang::tr{'updates installed'}: $snortsettings{'INSTALLDATE'}";
+
 print <
 

 
GREEN Snort
@@ -453,15 +511,7 @@ if ( -e "/var/ipfire/guardian/guardian.conf" ) {
 print <

 
$Lang::tr{'ids preprocessor'}
  http_inspect $Lang::tr{'active'}
-



 

 

 	$Lang::tr{'ids rules update'}

 	

-		$Lang::tr{'ids rules license'} http://www.snort.org.

-		

-		$Lang::tr{'ids rules license2'} USER PREFERENCES, $Lang::tr{'ids rules license3'}

+		$Lang::tr{'ids rules license'} www.snort.org$Lang::tr{'ids rules license1'}


+		$Lang::tr{'ids rules license2'} Get an Oinkcode, $Lang::tr{'ids rules license3'}
 			
 

 

 	Oinkcode: 
 

 

+	

 END
 ;
-
-if ($snortsettings{'INSTALLMD5'} eq $md5) {
-	print " $Lang::tr{'rules already up to date'}

-

+


 
-	
+	

 

 

 

 
@@ -524,17 +569,17 @@ if ( -e "/var/ipfire/guardian/guardian.conf" ) {
 	&Header::openbox('100%', 'LEFT', $Lang::tr{'guardian configuration'});
 print <
-
-
-
-
-
-
+
$Lang::tr{'guardian interface'}
$Lang::tr{'guardian timelimit'}
$Lang::tr{'guardian logfile'}
$Lang::tr{'guardian alertfile'}
$Lang::tr{'guardian ignorefile'}

 

 
 END
@@ -549,8 +594,8 @@ END
 if ( -e "${General::swroot}/snort/enable" || -e "${General::swroot}/snort/enable_green" || -e "${General::swroot}/snort/enable_blue" || -e "${General::swroot}/snort/enable_orange" ) {
 	&Header::openbox('100%', 'LEFT', $Lang::tr{'intrusion detection system rules'});
 		# Output display table for rule files
-		print "
";
-		
+		print "
";
+
 		print "";
 
 		# Local vars
@@ -563,9 +608,14 @@ if ( -e "${General::swroot}/snort/enable" || -e "${General::swroot}/snort/enable
 		foreach my $rulefile (sort keys(%snortrules)) {
 			my $rulechecked = '';
 
+			# Hide inkompatible Block rules
+			if ($rulefile =~'-BLOCK.rules') {
+				next;
+			}
+
 			# Check if reached half-way through rule file rules to start new column
  		if ($ruledisplaycnt > $rulecnt) {
-				print "
";
+				print "
";
 				$ruledisplaycnt = 0;
 			}
 
@@ -616,21 +666,21 @@ if ( -e "${General::swroot}/snort/enable" || -e "${General::swroot}/snort/enable
 			}
 
 			# Output rule file name and checkbox
-			print "";
-			print "";
+			print "
 $rulefile
";
+			print "
 $rulefile
";
 
 			# Check for empty 'Description'
 			if ($snortrules{$rulefile}{'Description'} eq '') {
-				print "";
+				print "
No description available
";
 			} else {
 				# Output rule file 'Description'
-				print "
No description available
";
+				print "
$snortrules{$rulefile}{'Description'}
";
 			}
 
 			# Check for display flag
 			if ($displayrulefilerules) {
 				# Rule file definition rule display
-				print "";
 		}
 
 			# Close display table
-			print "
$snortrules{$rulefile}{'Description'}
";
+				print "";
+				print "
";
 
 				# Local vars
 			 	my $ruledefdisplaycnt = 0;
@@ -645,7 +695,7 @@ if ( -e "${General::swroot}/snort/enable" || -e "${General::swroot}/snort/enable
 
 					# If have display 2 rules, start new row
 					if (($ruledefdisplaycnt % 2) == 0) {
-						print "";
+						print "";
 						$ruledefdisplaycnt = 0;
 					}
 
@@ -657,34 +707,32 @@ if ( -e "${General::swroot}/snort/enable" || -e "${General::swroot}/snort/enable
 					# Create rule file rule's checkbox
 					$checkboxname = "SNORT_RULE_$rulefile";
 					$checkboxname .= "_$ruledef";
-					print "";
+					print "";
 
 					# Increment count
 					$ruledefdisplaycnt++;
 				}
-	
+
 				# If do not have second rule for row, create empty cell
 				if (($ruledefdisplaycnt % 2) != 0) {
-					print "";
+					print "";
 				}
 
 				# Close display table
-				print "
 $snortrules{$rulefile}{'Definition'}{$ruledef}{'Description'} $snortrules{$rulefile}{'Definition'}{$ruledef}{'Description'}
";
+			print "
";
 
 			# Increment ruledisplaycnt
 		$ruledisplaycnt++;
 		}
-	print "
";
+	print "";
 	print <
 
-	 
-	
-	
+	
 		  
 	
 
@@ -699,73 +747,27 @@ END
 &Header::closebigbox();
 &Header::closepage();
 
-sub getmd5 {
-	# Retrieve MD5 sum from $url.md5 file
-	#
-	my $md5buf = &geturl("$url.md5");
-	return undef unless $md5buf;
-
-	if (0) { # 1 to debug
-		my $filename='';
-		my $fh='';
-		($fh, $filename) = tempfile('/tmp/XXXXXXXX',SUFFIX => '.md5' );
-		binmode ($fh);
-		syswrite ($fh, $md5buf->content);
-		close($fh);
-	}
-	return $md5buf->content;
-}
 sub downloadrulesfile {
-	my $return = &geturl($url);
-	return undef unless $return;
-
-	if (index($return->content, "\037\213") == -1 ) { # \037\213 is .gz beginning
-		$errormessage = $Lang::tr{'invalid loaded file'};
-		return undef;
-	}
+	my $peer;
+	my $peerport;
 
-	my $filename='';
-	my $fh='';
-	($fh, $filename) = tempfile('/tmp/XXXXXXXX',SUFFIX => '.tar.gz' );#oinkmaster work only with this extension
-	binmode ($fh);
-	syswrite ($fh, $return->content);
-	close($fh);
-	return $filename;
-}
-
-sub geturl ($) {
-	my $url=$_[0];
+	unlink("/var/tmp/log");
 
 	unless (-e "${General::swroot}/red/active") {
 		$errormessage = $Lang::tr{'could not download latest updates'};
 		return undef;
 	}
 
-	my $downloader = LWP::UserAgent->new;
-	$downloader->timeout(5);
-
 	my %proxysettings=();
 	&General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
 
 	if ($_=$proxysettings{'UPSTREAM_PROXY'}) {
-		my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
-		if ($proxysettings{'UPSTREAM_USER'}) {
-			$downloader->proxy("http","http://$proxysettings{'UPSTREAM_USER'}:$proxysettings{'UPSTREAM_PASSWORD'}@"."$peer:$peerport/");
-		} else {
-			$downloader->proxy("http","http://$peer:$peerport/");
-		}
+		($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
 	}
 
-	my $return = $downloader->get($url,'Cache-Control','no-cache');
-
-	if ($return->code == 403) {
-		$errormessage = $Lang::tr{'access refused with this oinkcode'};
-		return undef;
-	} elsif (!$return->is_success()) {
-		$errormessage = $Lang::tr{'could not download latest updates'};
-		return undef;
+	if ($peer) {
+		system("wget -r --proxy=on --proxy-user=$proxysettings{'UPSTREAM_USER'} --proxy-passwd=$proxysettings{'UPSTREAM_PASSWORD'} -e http_proxy=http://$peer:$peerport/ -o /var/tmp/log --no-check-certificate --output-document=/var/tmp/snortrules.tar.gz $url");
+	} else {
+		system("wget -r --no-check-certificate -o /var/tmp/log --output-document=/var/tmp/snortrules.tar.gz $url");
 	}
-
-	return $return;
-
 }