ids-functions.pl: Introduce function write_modify_sids_file()

This function is used to write the corresponding file which
tells oinkmaster to alter the whole ruleset and finally
switches suricata into an IPS or IDS.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

config/cfgroot/ids-functions.pl

@@ -687,4 +687,26 @@ sub write_used_rulefiles_file(@) {
 	close(FILE);
 }
 
+#
+## Function to generate and write the file for modify the ruleset.
+#
+sub write_modify_sids_file($) {
+	my ($ruleaction) = @_;
+
+	# Open modify sid's file for writing.
+	open(FILE, ">$IDS::modify_sids_file") or die "Could not write to $IDS::modify_sids_file. $!\n";
+
+	# Write file header.
+	print FILE "#Autogenerated file. Any custom changes will be overwritten!\n";
+
+	# Check if the traffic only should be monitored.
+	unless($ruleaction eq "alert") {
+		# Tell oinkmaster to switch all rules from alert to drop.
+		print FILE "modifysid \* \"alert\" \| \"drop\"\n";
+	}
+
+	# Close file handle.
+	close(FILE);
+}
+
 1;