2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2021 IPFire Development Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
24 require '/var/ipfire/general-functions.pl';
25 require "${General::swroot}/ids-functions.pl1";
27 # Old file declarations
28 my $old_rules_settings_file = "$IDS::settingsdir/rules-settings";
29 my $old_used_rulefiles_file = "$IDS::settingsdir/suricata-used-rulefiles.yaml";
30 my $old_enabled_sids_file = "$IDS::settingsdir/oinkmaster-enabled-sids.conf";
31 my $old_disabled_sids_file = "$IDS::settingsdir/oinkmaster-disabled-sids.conf";
32 my $old_rules_tarball = "/var/tmp/idsrules.tar.gz";
34 # Script wide variable to store the used ruleset provider.
37 # Hashes to store the old and new settings.
38 my %old_rules_settings = ();
40 my %providers_settings = ();
42 exit unless(-f
$IDS::ids_settings_file
and -f
$old_rules_settings_file);
44 # Read-in all settings.
45 &General
::readhash
($old_rules_settings_file, \
%old_rules_settings);
46 &General
::readhash
($IDS::ids_settings_file
, \
%idssettings);
49 ## Step 1: Create new file layout
51 &IDS
::check_and_create_filelayout
();
54 ## Step 2: Migrate automatic update interval.
57 # Get old configured autoupdate interval.
58 my $autoupdate_interval = $old_rules_settings{'AUTOUPDATE_INTERVAL'};
60 # Check for valid intervals.
61 if ($autoupdate_interval eq "off" || $autoupdate_interval eq "daily" || $autoupdate_interval eq "weekly") {
62 # Put the setting to the new configuration location.
63 $idssettings{'AUTOUPDATE_INTERVAL'} = $autoupdate_interval;
65 # Swith to default which should be weekly.
66 $idssettings{'AUTOUPDATE_INTERVAL'} = "weekly";
69 # Store the updated idssettings file.
70 &General
::writehash
($IDS::ids_settings_file
, \
%idssettings);
73 ## Step 3: Migrate the providers settings.
76 # Try to get the previously configured provider.
77 $ruleset_provider = $old_rules_settings{'RULES'};
79 # Exit the script if no ruleset provider has configured.
80 exit unless ($ruleset_provider);
84 my $enabled = "enabled";
85 my $autoupdate_status = "enabled";
87 # Try to get a configured subscription code.
88 my $subscription_code = $old_rules_settings{'OINKCODE'};
90 # Check if the autoupdate should be disabled.
91 if ($idssettings{'AUTOUPDATE_INTERVAL'} eq "off") {
92 # Set the autoupdate for the provider to disabled.
93 $autoupdate_status = "disabled";
96 # Create and assign the provider structure to the providers hash.
97 $providers_settings{$id} = [ "$ruleset_provider", "$subscription_code", "$autoupdate_status", "$enabled" ];
99 # Write the converted provider settings to the new providers-settings file.
100 &General
::writehasharray
($IDS::providers_settings_file
, \
%providers_settings);
102 # Set correct ownership.
103 &IDS
::set_ownership
("$IDS::providers_settings_file");
105 # Remove old rules settings file.
106 unlink($old_rules_settings_file);
109 ## Step 4: Rename downloaded rulestarball to new name sheme.
112 # Check if a rulestarball exists.
113 if (-f
$old_rules_tarball) {
114 # Load perl module which contains the move command.
117 # Call function to generate the path and filename for the new rules tarball name.
118 my $new_rules_tarball = &IDS
::_get_dl_rulesfile
($ruleset_provider);
120 # Move the rulestarball to the new location.
121 move
($old_rules_tarball, $new_rules_tarball);
123 # Set correct ownership.
124 &IDS
::set_ownership
("$new_rules_tarball");
128 ## Step 5: Migrate oinkmaster configuration files for enabled and disabled rules.
131 # Read-in old enabled / disabled sids files.
132 my %enabled_disabled_sids = (
133 &IDS
::read_enabled_disabled_sids_file
($old_enabled_sids_file),
134 &IDS
::read_enabled_disabled_sids_file
($old_disabled_sids_file)
137 # Check if any modifications have been done.
138 if (%enabled_disabled_sids) {
139 # Get path and filename for new file.
140 my $oinkmaster_provider_modified_sids_file = &IDS
::get_oinkmaster_provider_modified_sids_file
($ruleset_provider);
142 # Open the new file for writing.
143 open (FILE
, $oinkmaster_provider_modified_sids_file) or die "Could not write to $oinkmaster_provider_modified_sids_file. $!\n";
145 # Write header to the files.
146 print PROVIDER_MOD_FILE
"#Autogenerated file. Any custom changes will be overwritten!\n";
148 # Loop through the hash.
149 foreach my $sid (keys %enabled_disabled_sids) {
150 # Check if the sid is enabled.
151 if ($enabled_disabled_sids{$sid} eq "enabled") {
152 # Print the sid as enabled to the file.
153 print FILE
"enablesid $sid\n";
154 # Check if the sid is disabled.
155 } elsif ($enabled_disabled_sids{$sid} eq "disabled") {
156 # Print the sid as disabled to the file.
157 print FILE
"disablesid $sid\n";
158 # Something strange happende - skip the current sid.
164 # Close the file handle.
167 # Add the provider modifications file to the oinkmaster provider includes file.
168 &IDS
::alter_oinkmaster_provider_includes_file
("add", "$ruleset_provider");
170 # Set correct ownerships.
171 &IDS
::set_ownership
("$IDS::oinkmaster_provider_includes_file");
172 &IDS
::set_ownership
("$oinkmaster_provider_modified_sids_file");
176 unlink($old_enabled_sids_file);
177 unlink($old_disabled_sids_file);
180 ## Step 6: Call oinkmaster and regenerate the ruleset structures.
184 # Set correct ownerships.
185 &IDS
::set_ownership
("$IDS::rulespath");
188 ## Step 7: Migrate used rulefiles into new format.
191 # Check if the a used rulesfile exists.
192 if (-f
$old_used_rulefiles_file) {
193 # Array to collect the used rulefiles.
194 my @used_rulefiles = ();
196 # Open the file or used rulefiles and read-in content.
197 open(FILE
, $old_used_rulefiles_file) or die "Could not open $old_used_rulefiles_file. $!\n";
200 # Assign the current line to a nice variable.
207 next if ($line =~ /\#/);
210 next if ($line =~ /^\s*$/);
212 # Gather the rulefile.
213 if ($line =~ /.*- (.*)/) {
216 # Skip whitelist.rules and local.rules
217 next if ($rulefile eq "whitelist.rules" || $rulefile eq "local.rules");
219 # Splitt the filename into chunks.
220 my @filename = split("-", $rulefile);
223 @filename = reverse(@filename);
225 # Get the amount of elements in the array.
226 my $elements = @filename;
228 # Remove last element of the hash.
229 # It contains the vendor name, which will be replaced.
230 if ($elements >= 3) {
231 # Remove last element from hash.
235 # Check if the last element of the filename does not
236 # contain the providers name.
237 if ($filename[-1] ne "$ruleset_provider") {
238 # Add provider name as last element.
239 push(@filename, $ruleset_provider);
242 # Reverse the array back.
243 @filename = reverse(@filename);
245 # Generate the name for the rulesfile.
246 $rulefile = join("-", @filename);
248 # Add the rulefile to the array of used rulesfiles.
249 push(@used_rulefiles, $rulefile);
256 # Write the new provider exclusive used rulesfiles file.
257 &IDS
::write_used_provider_rulefiles_file
($ruleset_provider, @used_rulefiles);
259 # Write main used rulefiles file.
260 &IDS
::write_main_used_rulefiles_file
("$ruleset_provider");
262 # Get the provider specific used rulefiles file name.
263 my $provider_used_rulefiles_file = &IDS
::get_used_provider_rulesfile_file
($ruleset_provider);
265 # Set correct ownerships.
266 &IDS
::set_ownership
("$provider_used_rulefiles_file");
267 &IDS
::set_ownership
("$IDS::suricata_used_providers_file");
268 &IDS
::set_ownership
("$IDS::suricata_static_rulefiles_file");
272 ## Step 8: Reload the IDS ruleset if running.
275 # Check if the IDS is running.
276 if(&IDS
::ids_is_running
()) {
277 # Call suricatactrl to restart it.
278 &IDS
::call_suricatactrl
("restart");