webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-11 11:35:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

ids.cgi: Dynamically generate the HOME_NET details for suricata.

Browse Source 
Introduce generate_home_net_file() which uses the current network
config to obtain the network address and subnetmask for each
available network zone, generate and write these HOME_NET information
into a yaml compatible file which can be included into the suricata
configuration file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This commit is contained in:
Stefan Schantl
2018-08-09 15:33:25 +02:00
parent e0bfd338ee
commit 8d2f6b0b59
1 changed files with 91 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
html/cgi-bin/ids.cgi
View File

@@ -47,7 +47,12 @@ my %selected=();
# the list of zones in an array.
my @network_zones = &IDS::get_available_network_zones();
# File where the used rulefiles are stored.
my $idsusedrulefilesfile = "$IDS::settingsdir/suricata-used-rulefiles.yaml";
# File where the addresses of the homenet are stored.
my $idshomenetfile = "$IDS::settingsdir/suricata-homenet.yaml";
my $errormessage;
&Header::showhttpheaders();
@@ -305,10 +310,10 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'update'}) {
if (!$errormessage) {
# Store settings into settings file.
&General::writehash("$IDS::settingsdir/settings", \%cgiparams);
# Call suricatactrl to restart the IDS
system('/usr/local/bin/suricatactrl restart >/dev/null');
}
# Generate file to store the home net.
&generate_home_net_file();
}
# Read-in idssettings
@@ -721,7 +726,9 @@ sub readrulesfile ($) {
}
}
# Function to get the used memory of a given process-id.
#
## Function to get the used memory of a given process-id.
#
sub get_memory_usage($) {
my $pid = @_;
@@ -750,3 +757,83 @@ sub get_memory_usage($) {
return;
}
#
## Function to generate the file which contains the home net information.
#
sub generate_home_net_file() {
my %netsettings;
# Read-in network settings.
&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
# Get available network zones.
my @network_zones = &IDS::get_available_network_zones();
# Temporary array to store network address and prefix of the configured
# networks.
my @networks;
# Loop through the array of available network zones.
foreach my $zone (@network_zones) {
# Skip the red network - It never can be part to the home_net!
next if($zone eq "red");
# Convert current zone name into upper case.
$zone = uc($zone);
# Generate key to access the required data from the netsettings hash.
my $zone_netaddress = $zone . "_NETADDRESS";
my $zone_netmask = $zone . "_NETMASK";
# Obtain the settings from the netsettings hash.
my $netaddress = $netsettings{$zone_netaddress};
my $netmask = $netsettings{$zone_netmask};
# Convert the subnetmask into prefix notation.
my $prefix = &Network::convert_netmask2prefix($netmask);
# Generate full network string.
my $network = join("/", $netaddress,$prefix);
# Check if the network is valid.
if(&Network::check_subnet($network)) {
# Add the generated network to the array of networks.
push(@networks, $network);
}
}
# Format home net declaration.
my $line = "\"\[";
# Loop through the array of networks.
foreach my $network (@networks) {
# Add the network to the line.
$line = "$line" . "$network";
# Check if the current network was the last in the array.
if ($network eq $networks[-1]) {
# Close the line.
$line = "$line" . "\]\"";
} else {
# Add "," for the next network.
$line = "$line" . "\,";
}
}
# Open file to store the addresses of the home net.
open(FILE, ">$idshomenetfile") or die "Could not open $idshomenetfile. $!\n";
# Print yaml header.
print FILE "%YAML 1.1\n";
print FILE "---\n\n";
# Print notice about autogenerated file.
print FILE "#Autogenerated file. Any custom changes will be overwritten!\n";
# Print the generated and required HOME_NET declaration to the file.
print FILE "HOME_NET:\t$line\n";
# Close file handle.
close(FILE);
}