Merge branch 'switch-to-libloc' into next-switch-to-libloc

[people/pmueller/ipfire-2.x.git] / config / suricata / convert-snort

diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort
index ca650b149a212d9f0074297d78626fec96d8fd11..3e938137efe3c06e21b9069f22bc756f017a90b2 100644 (file)
--- a/config/suricata/convert-snort
+++ b/config/suricata/convert-snort
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2019 IPFire Development Team <info@ipfire.org>                #
+# Copyright (C) 2020 IPFire Development Team <info@ipfire.org>                #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -34,7 +34,42 @@ my $snort_config_file = "/etc/snort/snort.conf";
 my $snort_rules_tarball = "/var/tmp/snortrules.tar.gz";
 
 #
-## Step 1: Setup directory and file layout, if not present and set correct
+## Step 1: Convert snort user and group to suricata if exist.
+#
+
+# Check if the snort user exists.
+if (getpwnam("snort")) {
+       # Change username.
+       my @command = (
+               '/usr/sbin/usermod',
+               '-l', 'suricata', 'snort'
+       );
+
+       system(@command) == 0 or die "Could not change username: @command failed: $?\n";
+
+       # Adjust home directory.
+       @command = (
+               '/usr/sbin/usermod',
+               '-d', "/var/log/suricata",
+               'suricata'
+       );
+
+       system(@command) == 0 or die "Failed to adjust home directory: @command failed: $?\n";
+}
+
+# Check if the snort group exists.
+if (getgrnam("snort")) {
+       # Change groupname
+       my @command = (
+               '/usr/sbin/groupmod',
+               '-n', 'suricata', 'snort'
+       );
+
+       system(@command) == 0 or die "Could not rename groupname: @command failed: $?\n";
+}
+
+#
+## Step 2: Setup directory and file layout, if not present and set correct
 ##         ownership. The converter runs as a privileged user, but the files
 ##         needs to be full access-able by the WUI user and group (nobody:nobody).
 #
@@ -71,7 +106,7 @@ if (-z "$snort_settings_file") {
 }
 
 #
-## Step 2: Import snort settings and convert to the required format for the new IDS
+## Step 3: Import snort settings and convert to the required format for the new IDS
 ##         (suricata).
 #
 
@@ -135,7 +170,7 @@ if($snortsettings{"OINKCODE"}) {
 }
 
 #
-## Step 3: Import guardian settings and whitelist if the addon is installed.
+## Step 4: Import guardian settings and whitelist if the addon is installed.
 #
 
 # Pakfire meta file for owncloud.
@@ -183,7 +218,7 @@ if (-f $guardian_meta) {
 }
 
 #
-## Step 4: Save IDS and rules settings.
+## Step 5: Save IDS and rules settings.
 #
 
 # Write IDS settings.
@@ -193,27 +228,17 @@ if (-f $guardian_meta) {
 &General::writehash("$IDS::rules_settings_file", \%rulessettings);
 
 #
-## Step 5: Generate and write the file to modify the ruleset.
+## Step 6: Generate and write the file to modify the ruleset.
 #
 
-# Converters default is to only monitor the traffic, so set the IDS action to
-# "alert".
-my $IDS_action = "alert";
-
-# Check if the traffic only should be monitored.
-if ($idssettings{"MONITOR_TRAFFIC_ONLY"} eq "off") {
-       # Swith IDS action to alert only.
-       $IDS_action = "drop";
-}
-
 # Call subfunction and pass the desired IDS action.
-&IDS::write_modify_sids_file($IDS_action);
+&IDS::write_modify_sids_file();
 
 # Set correct ownership.
 &IDS::set_ownership("$IDS::modify_sids_file");
 
 #
-## Step 6: Move rulestarball to its new location.
+## Step 7: Move rulestarball to its new location.
 #
 
 # Check if a rulestarball has been downloaded yet.
@@ -231,13 +256,16 @@ if (-f $snort_rules_tarball) {
 } else {
        # Check if enought disk space is available.
        if(&IDS::checkdiskspace()) {
+               # Print error message.
+               print "Could not download ruleset - Not enough free diskspace available.\n";
+       } else {
                # Call the download function and grab the new ruleset.
                &IDS::downloadruleset();
        }
 }
 
 #
-## Step 7: Call oinkmaster to extract and setup the rules structures.
+## Step 8: Call oinkmaster to extract and setup the rules structures.
 #
 
 # Check if a rulestarball is present.
@@ -250,7 +278,47 @@ if (-f $IDS::rulestarball) {
 }
 
 #
-## Step 8: Grab used ruleset files from snort config file and convert
+## Step 9: Generate file for the HOME Net.
+#
+
+# Call subfunction to generate the file.
+&IDS::generate_home_net_file();
+
+# Set correct ownership for the homenet file.
+&IDS::set_ownership("$IDS::homenet_file");
+
+#
+## Step 10: Generate file for the DNS servers.
+#
+
+# Call subfunction to generate the file.
+&IDS::generate_dns_servers_file();
+
+# Set correct ownership for the dns_servers_file.
+&IDS::set_ownership("$IDS::dns_servers_file");
+
+#
+## Step 11: Generate file which contains the HTTP ports.
+#
+
+# Call subfunction to generate the file.
+&IDS::generate_http_ports_file();
+
+# Set correct ownership for the http_ports_file.
+&IDS::set_ownership("$IDS::http_ports_file");
+
+#
+## Step 12: Setup automatic ruleset updates.
+#
+
+# Check if a ruleset is configured.
+if($rulessettings{"RULES"}) {
+       # Call suricatactrl and setup the periodic update mechanism.
+       &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'});
+}
+
+#
+## Step 13: Grab used ruleset files from snort config file and convert
 ##         them into the new format.
 #
 
@@ -296,24 +364,7 @@ close(SNORTCONF);
 &IDS::write_used_rulefiles_file(@enabled_rule_files);
 
 #
-## Step 9: Generate file for the HOME Net.
-#
-
-# Call subfunction to generate the file.
-&IDS::generate_home_net_file();
-
-#
-## Step 10: Setup automatic ruleset updates.
-#
-
-# Check if a ruleset is configured.
-if($rulessettings{"RULES"}) {
-       # Call suricatactrl and setup the periodic update mechanism.
-       &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'});
-}
-
-#
-## Step 11: Start the IDS if enabled.
+## Step 14: Start the IDS if enabled.
 #
 
 # Check if the IDS should be started.