Development April 2020

development@lists.ipfire.org

12 participants
133 discussions

[PATCH 1/2] Suricata: Add port 81 (UpdateAccelerator) to group of HTTP ports.
by Stefan Schantl 01 Apr '20

01 Apr '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index ed71898f4..cb7ececb4 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -30,7 +30,7 @@ vars: ENIP_SERVER: "$HOME_NET" port-groups: - HTTP_PORTS: "80" + HTTP_PORTS: "[80,81]" SHELLCODE_PORTS: "!80" ORACLE_PORTS: 1521 SSH_PORTS: "[22,222]" -- 2.26.0

3 3

[PATCH] ids.cgi: Restart suricata if necessary when altering the ruleset.
by Stefan Schantl 01 Apr '20

01 Apr '20

Suricata does support re-reading it's configuration files and therfore we need to restart it, if one or more ruleset files should be loaded or not loaded anymore. If simple some rules inside the same files are activated or deactivated we are still fine to call the reload method to send suricata the signal to reload its ruleset. Fixes #12340. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/ids.cgi | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 2a8a7cb26..c3e5eefdb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -412,6 +412,9 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Hash to store the user-enabled and disabled sids. my %enabled_disabled_sids; + # Store if a restart of suricata is required. + my $suricata_restart_required; + # Loop through the hash of idsrules. foreach my $rulefile(keys %idsrules) { # Check if the rulefile is enabled. @@ -419,6 +422,12 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Add rulefile to the array of enabled rulefiles. push(@enabled_rulefiles, $rulefile); + # Check if the state of the rulefile has been changed. + unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) { + # A restart of suricata is required to apply the changes of the used rulefiles. + $suricata_restart_required = 1; + } + # Drop item from cgiparams hash. delete $cgiparams{$rulefile}; } @@ -513,8 +522,14 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Check if the IDS is running. if(&IDS::ids_is_running()) { - # Call suricatactrl to perform a reload. - &IDS::call_suricatactrl("reload"); + # Check if a restart of suricata is required. + if ($suricata_restart_required) { + # Call suricatactrl to perform the restart. + &IDS::call_suricatactrl("restart"); + } else { + # Call suricatactrl to perform a reload. + &IDS::call_suricatactrl("reload"); + } } # Reload page. -- 2.26.0

2 1

VPN Graphs
by Tom Rymes 01 Apr '20

01 Apr '20

I noticed that graphs for OpenVPN connections have been added to the WUI, and with all of the added VPN usage in the last weeks, it sure would be nice to have similar graphs for IPsec Roadwarriors and Net-to-Net connections. I’m not certain if the nature of IPSec will prevent that from being possible, but it sure would be nice. Tom PS: In the meantime, and in the event it might be handy for anyone in a similar situation, I have been using the following commands for ‘iftop’ to get a handle on any VPN users that are hogging bandwidth: iftop -i red0 -nP iftop -n -i green0 -F x.x.x.x/y (place in a subnet you want to restrict results to, I use the IPSec RoadWarrior address block).

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2020