require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
+# Location and name of the tarball which contains the ruleset.
+our $rulestarball = "/var/tmp/snortrules.tar.gz";
+
+# File to store any errors, which also will be read and displayed by the wui.
+our $storederrorfile = "/tmp/ids_storederror";
+
#
## Function for checking if at least 300MB of free disk space are available
## on the "/var" partition.
return;
}
+#
+## This function is responsible for downloading the configured snort ruleset.
+##
+## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
+## * The next step is to get the download locations for all available rulesets.
+## * After that, the function will check if an upstream proxy should be used and grab the settings.
+## * The last step will be to generate the final download url, by obtaining the URL for the desired
+## ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
+#
+sub downloadruleset {
+ # Get snort settings.
+ my %snortsettings=();
+ &General::readhash("${General::swroot}/snort/settings", \%snortsettings);
+
+ # Get all available ruleset locations.
+ my %rulesetsources=();
+ &General::readhash("${General::swroot}/snort/ruleset-sources.list", \%rulesetsources);
+
+ # Read proxysettings.
+ my %proxysettings=();
+ &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
+
+ # Load required perl module to handle the download.
+ use LWP::UserAgent;
+
+ # Init the download module.
+ my $downloader = LWP::UserAgent->new;
+
+ # Set timeout to 10 seconds.
+ $downloader->timeout(10);
+
+ # Check if an upstream proxy is configured.
+ if ($proxysettings{'UPSTREAM_PROXY'}) {
+ my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
+ my $proxy_url;
+
+ # Check if we got a peer.
+ if ($peer) {
+ $proxy_url = "http://";
+
+ # Check if the proxy requires authentication.
+ if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) {
+ $proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@";
+ }
+
+ # Add proxy server address and port.
+ $proxy_url .= "$peer\:$peerport";
+ } else {
+ # Break and return error message.
+ return "$Lang::tr{'could not download latest updates'}";
+ }
+
+ # Setup proxy settings.
+ $downloader->proxy('http', $proxy_url);
+ }
+
+ # Grab the right url based on the configured vendor.
+ my $url = $rulesetsources{$snortsettings{'RULES'}};
+
+ # Check if the vendor requires an oinkcode and add it if needed.
+ $url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;
+
+ # Abort if no url could be determined for the vendor.
+ unless ($url) {
+ # Abort and return errormessage.
+ return "$Lang::tr{'could not download latest updates'}";
+ }
+
+ # Pass the requested url to the downloader.
+ my $request = HTTP::Request->new(GET => $url);
+
+ # Perform the request and save the output into the "$rulestarball" file.
+ my $response = $downloader->request($request, $rulestarball);
+
+ # Check if there was any error.
+ unless ($response->is_success) {
+ # Return error message.
+ return "$response->status_line";
+ }
+
+ # If we got here, everything worked fine. Return nothing.
+ return;
+}
+
+#
+## A tiny wrapper function to call the oinkmaster script.
+#
+sub oinkmaster () {
+ # Load perl module to talk to the kernel syslog.
+ use Sys::Syslog qw(:DEFAULT setlogsock);
+
+ # Establish the connection to the syslog service.
+ openlog('oinkmaster', 'cons,pid', 'user');
+
+ # Call oinkmaster to generate ruleset.
+ open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules|");
+
+ # Log output of oinkmaster to syslog.
+ while(<OINKMASTER>) {
+ # The syslog function works best with an array based input,
+ # so generate one before passing the message details to syslog.
+ my @syslog = ("INFO", "$_");
+
+ # Send the log message.
+ syslog(@syslog);
+ }
+
+ # Close the pipe to oinkmaster process.
+ close(OINKMASTER);
+
+ # Close the log handle.
+ closelog();
+}
+
+#
+## Function to do all the logging stuff if the downloading or updating of the ruleset fails.
+#
+sub log_error ($) {
+ my ($error) = @_;
+
+ # Remove any newline.
+ chomp($error);
+
+ # Call private function to write/store the error message in the storederrorfile.
+ &_store_error_message($error);
+}
+
+#
+## Private function to write a given error message to the storederror file.
+#
+sub _store_error_message ($) {
+ my ($message) = @_;
+
+ # Remove any newline.
+ chomp($message);
+
+ # Open file for writing.
+ open (ERRORFILE, ">$storederrorfile") or die "Could not write to $storederrorfile. $!\n";
+
+ # Write error to file.
+ print ERRORFILE "$message\n";
+
+ # Close file.
+ close (ERRORFILE);
+}
1;
projects / ipfire-2.x.git / blobdiff