[ipfire-2.x.git] / config / cfgroot / ids-functions.pl

#!/usr/bin/perl -w
############################################################################
#                                                                          #
# This file is part of the IPFire Firewall.                                #
#                                                                          #
# IPFire is free software; you can redistribute it and/or modify           #
# it under the terms of the GNU General Public License as published by     #
# the Free Software Foundation; either version 2 of the License, or        #
# (at your option) any later version.                                      #
#                                                                          #
# IPFire is distributed in the hope that it will be useful,                #
# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
# GNU General Public License for more details.                             #
#                                                                          #
# You should have received a copy of the GNU General Public License        #
# along with IPFire; if not, write to the Free Software                    #
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
#                                                                          #
# Copyright (C) 2018 IPFire Team <info@ipfire.org>.                        #
#                                                                          #
############################################################################

package IDS;

require '/var/ipfire/general-functions.pl';

# Location where all config and settings files are stored.
our $settingsdir = "${General::swroot}/suricata";

# Location and name of the tarball which contains the ruleset.
our $rulestarball = "/var/tmp/idsrules.tar.gz";

# File to store any errors, which also will be read and displayed by the wui.
our $storederrorfile = "/tmp/ids_storederror";

# Location where the rulefiles are stored.
our $rulespath = "/etc/suricata/rules";

#
## Function for checking if at least 300MB of free disk space are available
## on the "/var" partition.
#
sub checkdiskspace () {
	# Call diskfree to gather the free disk space of /var.
	my @df = `/bin/df -B M /var`;

	# Loop through the output.
	foreach my $line (@df) {
		# Ignore header line.
		next if $line =~ m/^Filesystem/;

		# Search for a line with the device information.
		if ($line =~ m/dev/ ) {
			# Split the line into single pieces.
			my @values = split(' ', $line);
			my ($filesystem, $blocks, $used, $available, $used_perenctage, $mounted_on) = @values;

			# Check if the available disk space is more than 300MB.
			if ($available < 300) {
				# Log error to syslog.
				&_log_to_syslog("Not enough free disk space on /var. Only $available MB from 300 MB available.");

				# Exit function and return "1" - False.
				return 1;
			}
		}
	}

	# Everything okay, return nothing.
	return;
}

#
## This function is responsible for downloading the configured snort ruleset.
##
## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
## * The next step is to get the download locations for all available rulesets.
## * After that, the function will check if an upstream proxy should be used and grab the settings.
## * The last step will be to generate the final download url, by obtaining the URL for the desired
##   ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
#
sub downloadruleset {
	# Get snort settings.
	my %snortsettings=();
	&General::readhash("$settingsdir/settings", \%snortsettings);

	# Get all available ruleset locations.
	my %rulesetsources=();
	&General::readhash("$settingsdir/ruleset-sources.list", \%rulesetsources);

	# Read proxysettings.
	my %proxysettings=();
	&General::readhash("${General::swroot}/proxy/settings", \%proxysettings);

	# Load required perl module to handle the download.
	use LWP::UserAgent;

	# Init the download module.
	my $downloader = LWP::UserAgent->new;

	# Set timeout to 10 seconds.
	$downloader->timeout(10);

	# Check if an upstream proxy is configured.
	if ($proxysettings{'UPSTREAM_PROXY'}) {
		my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
		my $proxy_url;

		# Check if we got a peer.
		if ($peer) {
			$proxy_url = "http://";

			# Check if the proxy requires authentication.
			if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) {
				$proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@";
			}

			# Add proxy server address and port.
			$proxy_url .= "$peer\:$peerport";
		} else {
			# Log error message and break.
			&_log_to_syslog("Could not proper configure the proxy server access.");

			# Return "1" - false.
			return 1;
		}

		# Setup proxy settings.
		$downloader->proxy('http', $proxy_url);
	}

	# Grab the right url based on the configured vendor.
	my $url = $rulesetsources{$snortsettings{'RULES'}};

	# Check if the vendor requires an oinkcode and add it if needed.
	$url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;

	# Abort if no url could be determined for the vendor.
	unless ($url) {
		# Log error and abort.
		&_log_to_syslog("Unable to gather a download URL for the selected ruleset.");
		return 1;
	}

	# Pass the requested url to the downloader.
	my $request = HTTP::Request->new(GET => $url);

	# Perform the request and save the output into the "$rulestarball" file.
	my $response = $downloader->request($request, $rulestarball);

	# Check if there was any error.
	unless ($response->is_success) {
		# Log error message.
		&_log_to_syslog("Unable to download the ruleset. $response->status_line");

		# Return "1" - false.
		return 1;
	}

	# If we got here, everything worked fine. Return nothing.
	return;
}

#
## A tiny wrapper function to call the oinkmaster script.
#
sub oinkmaster () {
	# Load perl module to talk to the kernel syslog.
	use Sys::Syslog qw(:DEFAULT setlogsock);

	# Establish the connection to the syslog service.
	openlog('oinkmaster', 'cons,pid', 'user');

	# Call oinkmaster to generate ruleset.
	open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|");

	# Log output of oinkmaster to syslog.
	while(<OINKMASTER>) {
		# The syslog function works best with an array based input,
		# so generate one before passing the message details to syslog.
		my @syslog = ("INFO", "$_");

		# Send the log message.
		syslog(@syslog);
	}

	# Close the pipe to oinkmaster process.
	close(OINKMASTER);

	# Close the log handle.
	closelog();
}

#
## Function to do all the logging stuff if the downloading or updating of the ruleset fails.
#
sub log_error ($) {
	my ($error) = @_;

	# Remove any newline.
	chomp($error);

	# Call private function to log the error message to syslog.
	&_log_to_syslog($error);

	# Call private function to write/store the error message in the storederrorfile.
	&_store_error_message($error);
}

#
## Function to log a given error message to the kernel syslog.
#
sub _log_to_syslog ($) {
	my ($message) = @_;

	# Load perl module to talk to the kernel syslog.
	use Sys::Syslog qw(:DEFAULT setlogsock);

	# The syslog function works best with an array based input,
	# so generate one before passing the message details to syslog.
	my @syslog = ("ERR", "<ERROR> $message");

	# Establish the connection to the syslog service.
	openlog('oinkmaster', 'cons,pid', 'user');

	# Send the log message.
	syslog(@syslog);

	# Close the log handle.
	closelog();
}

#
## Private function to write a given error message to the storederror file.
#
sub _store_error_message ($) {
        my ($message) = @_;

	# Remove any newline.
	chomp($message);

        # Open file for writing.
        open (ERRORFILE, ">$storederrorfile") or die "Could not write to $storederrorfile. $!\n";

        # Write error to file.
        print ERRORFILE "$message\n";

        # Close file.
        close (ERRORFILE);
}

1;
Commit	Line	Data
8dcebe53 SS	1	#!/usr/bin/perl -w
	2	############################################################################
	3	# #
	4	# This file is part of the IPFire Firewall. #
	5	# #
	6	# IPFire is free software; you can redistribute it and/or modify #
	7	# it under the terms of the GNU General Public License as published by #
	8	# the Free Software Foundation; either version 2 of the License, or #
	9	# (at your option) any later version. #
	10	# #
	11	# IPFire is distributed in the hope that it will be useful, #
	12	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	13	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	14	# GNU General Public License for more details. #
	15	# #
	16	# You should have received a copy of the GNU General Public License #
	17	# along with IPFire; if not, write to the Free Software #
	18	# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
	19	# #
	20	# Copyright (C) 2018 IPFire Team <info@ipfire.org>. #
	21	# #
	22	############################################################################
	23
	24	package IDS;
	25
	26	require '/var/ipfire/general-functions.pl';
8dcebe53	27
02844177	28	# Location where all config and settings files are stored.
164eab66	29	our $settingsdir = "${General::swroot}/suricata";
02844177	30
eea2670b	31	# Location and name of the tarball which contains the ruleset.
164eab66	32	our $rulestarball = "/var/tmp/idsrules.tar.gz";
eea2670b	33
3983aebd	34	# File to store any errors, which also will be read and displayed by the wui.
77910792	35	our $storederrorfile = "/tmp/ids_storederror";
3983aebd	36
298ef5ba	37	# Location where the rulefiles are stored.
164eab66	38	our $rulespath = "/etc/suricata/rules";
298ef5ba	39
8dcebe53 SS	40	#
	41	## Function for checking if at least 300MB of free disk space are available
	42	## on the "/var" partition.
	43	#
	44	sub checkdiskspace () {
	45	# Call diskfree to gather the free disk space of /var.
	46	my @df = `/bin/df -B M /var`;
	47
	48	# Loop through the output.
	49	foreach my $line (@df) {
	50	# Ignore header line.
	51	next if $line =~ m/^Filesystem/;
	52
	53	# Search for a line with the device information.
	54	if ($line =~ m/dev/ ) {
	55	# Split the line into single pieces.
	56	my @values = split(' ', $line);
	57	my ($filesystem, $blocks, $used, $available, $used_perenctage, $mounted_on) = @values;
	58
	59	# Check if the available disk space is more than 300MB.
	60	if ($available < 300) {
434001d0 SS	61	# Log error to syslog.
434001d0 SS	62	&_log_to_syslog("Not enough free disk space on /var. Only $available MB from 300 MB available.");
8dcebe53	63
434001d0 SS	64	# Exit function and return "1" - False.
434001d0 SS	65	return 1;
8dcebe53 SS	66	}
	67	}
	68	}
	69
	70	# Everything okay, return nothing.
	71	return;
	72	}
	73
eea2670b SS	74	#
	75	## This function is responsible for downloading the configured snort ruleset.
	76	##
	77	## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
	78	## * The next step is to get the download locations for all available rulesets.
	79	## * After that, the function will check if an upstream proxy should be used and grab the settings.
	80	## * The last step will be to generate the final download url, by obtaining the URL for the desired
	81	## ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
	82	#
	83	sub downloadruleset {
	84	# Get snort settings.
	85	my %snortsettings=();
02844177	86	&General::readhash("$settingsdir/settings", \%snortsettings);
eea2670b SS	87
	88	# Get all available ruleset locations.
	89	my %rulesetsources=();
02844177	90	&General::readhash("$settingsdir/ruleset-sources.list", \%rulesetsources);
eea2670b SS	91
	92	# Read proxysettings.
	93	my %proxysettings=();
	94	&General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
	95
	96	# Load required perl module to handle the download.
	97	use LWP::UserAgent;
	98
	99	# Init the download module.
	100	my $downloader = LWP::UserAgent->new;
	101
	102	# Set timeout to 10 seconds.
	103	$downloader->timeout(10);
	104
	105	# Check if an upstream proxy is configured.
	106	if ($proxysettings{'UPSTREAM_PROXY'}) {
	107	my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]?(?:\:[A-Za-z0-9\_\.\-]?)?\@)?([a-zA-Z0-9\.\_\-]?)(?:\:([0-9]{1,5}))?(?:\/.?)?$/);
	108	my $proxy_url;
	109
	110	# Check if we got a peer.
	111	if ($peer) {
	112	$proxy_url = "http://";
	113
	114	# Check if the proxy requires authentication.
	115	if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) {
	116	$proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@";
	117	}
	118
	119	# Add proxy server address and port.
	120	$proxy_url .= "$peer\:$peerport";
	121	} else {
434001d0 SS	122	# Log error message and break.
	123	&_log_to_syslog("Could not proper configure the proxy server access.");
	124
	125	# Return "1" - false.
	126	return 1;
eea2670b SS	127	}
	128
	129	# Setup proxy settings.
	130	$downloader->proxy('http', $proxy_url);
	131	}
	132
	133	# Grab the right url based on the configured vendor.
	134	my $url = $rulesetsources{$snortsettings{'RULES'}};
	135
	136	# Check if the vendor requires an oinkcode and add it if needed.
	137	$url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;
	138
	139	# Abort if no url could be determined for the vendor.
	140	unless ($url) {
434001d0 SS	141	# Log error and abort.
	142	&_log_to_syslog("Unable to gather a download URL for the selected ruleset.");
	143	return 1;
eea2670b SS	144	}
	145
	146	# Pass the requested url to the downloader.
	147	my $request = HTTP::Request->new(GET => $url);
	148
	149	# Perform the request and save the output into the "$rulestarball" file.
	150	my $response = $downloader->request($request, $rulestarball);
	151
	152	# Check if there was any error.
	153	unless ($response->is_success) {
434001d0 SS	154	# Log error message.
	155	&_log_to_syslog("Unable to download the ruleset. $response->status_line");
	156
	157	# Return "1" - false.
	158	return 1;
eea2670b SS	159	}
	160
	161	# If we got here, everything worked fine. Return nothing.
	162	return;
	163	}
8dcebe53	164
25f5cb0d SS	165	#
	166	## A tiny wrapper function to call the oinkmaster script.
	167	#
	168	sub oinkmaster () {
0e40e1e7 SS	169	# Load perl module to talk to the kernel syslog.
	170	use Sys::Syslog qw(:DEFAULT setlogsock);
	171
	172	# Establish the connection to the syslog service.
	173	openlog('oinkmaster', 'cons,pid', 'user');
	174
25f5cb0d	175	# Call oinkmaster to generate ruleset.
02844177	176	open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath\|");
0e40e1e7 SS	177
	178	# Log output of oinkmaster to syslog.
	179	while(<OINKMASTER>) {
	180	# The syslog function works best with an array based input,
	181	# so generate one before passing the message details to syslog.
	182	my @syslog = ("INFO", "$_");
	183
	184	# Send the log message.
	185	syslog(@syslog);
	186	}
	187
	188	# Close the pipe to oinkmaster process.
	189	close(OINKMASTER);
	190
	191	# Close the log handle.
	192	closelog();
25f5cb0d SS	193	}
25f5cb0d SS	194
3983aebd SS	195	#
	196	## Function to do all the logging stuff if the downloading or updating of the ruleset fails.
	197	#
	198	sub log_error ($) {
	199	my ($error) = @_;
	200
	201	# Remove any newline.
	202	chomp($error);
	203
eb5592c1 SS	204	# Call private function to log the error message to syslog.
	205	&_log_to_syslog($error);
	206
3983aebd SS	207	# Call private function to write/store the error message in the storederrorfile.
	208	&_store_error_message($error);
	209	}
	210
eb5592c1 SS	211	#
	212	## Function to log a given error message to the kernel syslog.
	213	#
	214	sub _log_to_syslog ($) {
	215	my ($message) = @_;
	216
	217	# Load perl module to talk to the kernel syslog.
	218	use Sys::Syslog qw(:DEFAULT setlogsock);
	219
	220	# The syslog function works best with an array based input,
	221	# so generate one before passing the message details to syslog.
	222	my @syslog = ("ERR", "<ERROR> $message");
	223
	224	# Establish the connection to the syslog service.
	225	openlog('oinkmaster', 'cons,pid', 'user');
	226
	227	# Send the log message.
	228	syslog(@syslog);
	229
	230	# Close the log handle.
	231	closelog();
	232	}
	233
3983aebd SS	234	#
	235	## Private function to write a given error message to the storederror file.
	236	#
	237	sub _store_error_message ($) {
	238	my ($message) = @_;
	239
	240	# Remove any newline.
	241	chomp($message);
	242
	243	# Open file for writing.
	244	open (ERRORFILE, ">$storederrorfile") or die "Could not write to $storederrorfile. $!\n";
	245
	246	# Write error to file.
	247	print ERRORFILE "$message\n";
	248
	249	# Close file.
	250	close (ERRORFILE);
	251	}
	252
8dcebe53	253	1;