config/cfgroot/ids-functions.pl

   1 #!/usr/bin/perl -w
   2 ############################################################################
   3 #                                                                          #
   4 # This file is part of the IPFire Firewall.                                #
   5 #                                                                          #
   6 # IPFire is free software; you can redistribute it and/or modify           #
   7 # it under the terms of the GNU General Public License as published by     #
   8 # the Free Software Foundation; either version 2 of the License, or        #
   9 # (at your option) any later version.                                      #
  10 #                                                                          #
  11 # IPFire is distributed in the hope that it will be useful,                #
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of           #
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
  14 # GNU General Public License for more details.                             #
  15 #                                                                          #
  16 # You should have received a copy of the GNU General Public License        #
  17 # along with IPFire; if not, write to the Free Software                    #
  18 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
  19 #                                                                          #
  20 # Copyright (C) 2018 IPFire Team <info@ipfire.org>.                        #
  21 #                                                                          #
  22 ############################################################################
  23
  24 package IDS;
  25
  26 require '/var/ipfire/general-functions.pl';
  27
  28 # Location where all config and settings files are stored.
  29 our $settingsdir = "${General::swroot}/suricata";
  30
  31 # Location and name of the tarball which contains the ruleset.
  32 our $rulestarball = "/var/tmp/idsrules.tar.gz";
  33
  34 # File to store any errors, which also will be read and displayed by the wui.
  35 our $storederrorfile = "/tmp/ids_storederror";
  36
  37 # Location where the rulefiles are stored.
  38 our $rulespath = "/etc/suricata/rules";
  39
  40 # File which contains a list of all supported ruleset sources.
  41 # (Sourcefire, Emergingthreads, etc..)
  42 our $rulesetsourcesfile = "$settingsdir/ruleset-sources";
  43
  44 #
  45 ## Function for checking if at least 300MB of free disk space are available
  46 ## on the "/var" partition.
  47 #
  48 sub checkdiskspace () {
  49         # Call diskfree to gather the free disk space of /var.
  50         my @df = `/bin/df -B M /var`;
  51
  52         # Loop through the output.
  53         foreach my $line (@df) {
  54                 # Ignore header line.
  55                 next if $line =~ m/^Filesystem/;
  56
  57                 # Search for a line with the device information.
  58                 if ($line =~ m/dev/ ) {
  59                         # Split the line into single pieces.
  60                         my @values = split(' ', $line);
  61                         my ($filesystem, $blocks, $used, $available, $used_perenctage, $mounted_on) = @values;
  62
  63                         # Check if the available disk space is more than 300MB.
  64                         if ($available < 300) {
  65                                 # Log error to syslog.
  66                                 &_log_to_syslog("Not enough free disk space on /var. Only $available MB from 300 MB available.");
  67
  68                                 # Exit function and return "1" - False.
  69                                 return 1;
  70                         }
  71                 }
  72         }
  73
  74         # Everything okay, return nothing.
  75         return;
  76 }
  77
  78 #
  79 ## This function is responsible for downloading the configured snort ruleset.
  80 ##
  81 ## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
  82 ## * The next step is to get the download locations for all available rulesets.
  83 ## * After that, the function will check if an upstream proxy should be used and grab the settings.
  84 ## * The last step will be to generate the final download url, by obtaining the URL for the desired
  85 ##   ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
  86 #
  87 sub downloadruleset {
  88         # Get snort settings.
  89         my %snortsettings=();
  90         &General::readhash("$settingsdir/settings", \%snortsettings);
  91
  92         # Get all available ruleset locations.
  93         my %rulesetsources=();
  94         &General::readhash($rulesetsourcesfile, \%rulesetsources);
  95
  96         # Read proxysettings.
  97         my %proxysettings=();
  98         &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
  99
 100         # Load required perl module to handle the download.
 101         use LWP::UserAgent;
 102
 103         # Init the download module.
 104         my $downloader = LWP::UserAgent->new;
 105
 106         # Set timeout to 10 seconds.
 107         $downloader->timeout(10);
 108
 109         # Check if an upstream proxy is configured.
 110         if ($proxysettings{'UPSTREAM_PROXY'}) {
 111                 my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
 112                 my $proxy_url;
 113
 114                 # Check if we got a peer.
 115                 if ($peer) {
 116                         $proxy_url = "http://";
 117
 118                         # Check if the proxy requires authentication.
 119                         if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) {
 120                                 $proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@";
 121                         }
 122
 123                         # Add proxy server address and port.
 124                         $proxy_url .= "$peer\:$peerport";
 125                 } else {
 126                         # Log error message and break.
 127                         &_log_to_syslog("Could not proper configure the proxy server access.");
 128
 129                         # Return "1" - false.
 130                         return 1;
 131                 }
 132
 133                 # Setup proxy settings.
 134                 $downloader->proxy('http', $proxy_url);
 135         }
 136
 137         # Grab the right url based on the configured vendor.
 138         my $url = $rulesetsources{$snortsettings{'RULES'}};
 139
 140         # Check if the vendor requires an oinkcode and add it if needed.
 141         $url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;
 142
 143         # Abort if no url could be determined for the vendor.
 144         unless ($url) {
 145                 # Log error and abort.
 146                 &_log_to_syslog("Unable to gather a download URL for the selected ruleset.");
 147                 return 1;
 148         }
 149
 150         # Pass the requested url to the downloader.
 151         my $request = HTTP::Request->new(GET => $url);
 152
 153         # Perform the request and save the output into the "$rulestarball" file.
 154         my $response = $downloader->request($request, $rulestarball);
 155
 156         # Check if there was any error.
 157         unless ($response->is_success) {
 158                 # Log error message.
 159                 &_log_to_syslog("Unable to download the ruleset. $response->status_line");
 160
 161                 # Return "1" - false.
 162                 return 1;
 163         }
 164
 165         # If we got here, everything worked fine. Return nothing.
 166         return;
 167 }
 168
 169 #
 170 ## A tiny wrapper function to call the oinkmaster script.
 171 #
 172 sub oinkmaster () {
 173         # Load perl module to talk to the kernel syslog.
 174         use Sys::Syslog qw(:DEFAULT setlogsock);
 175
 176         # Establish the connection to the syslog service.
 177         openlog('oinkmaster', 'cons,pid', 'user');
 178
 179         # Call oinkmaster to generate ruleset.
 180         open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|");
 181
 182         # Log output of oinkmaster to syslog.
 183         while(<OINKMASTER>) {
 184                 # The syslog function works best with an array based input,
 185                 # so generate one before passing the message details to syslog.
 186                 my @syslog = ("INFO", "$_");
 187
 188                 # Send the log message.
 189                 syslog(@syslog);
 190         }
 191
 192         # Close the pipe to oinkmaster process.
 193         close(OINKMASTER);
 194
 195         # Close the log handle.
 196         closelog();
 197 }
 198
 199 #
 200 ## Function to do all the logging stuff if the downloading or updating of the ruleset fails.
 201 #
 202 sub log_error ($) {
 203         my ($error) = @_;
 204
 205         # Remove any newline.
 206         chomp($error);
 207
 208         # Call private function to log the error message to syslog.
 209         &_log_to_syslog($error);
 210
 211         # Call private function to write/store the error message in the storederrorfile.
 212         &_store_error_message($error);
 213 }
 214
 215 #
 216 ## Function to log a given error message to the kernel syslog.
 217 #
 218 sub _log_to_syslog ($) {
 219         my ($message) = @_;
 220
 221         # Load perl module to talk to the kernel syslog.
 222         use Sys::Syslog qw(:DEFAULT setlogsock);
 223
 224         # The syslog function works best with an array based input,
 225         # so generate one before passing the message details to syslog.
 226         my @syslog = ("ERR", "<ERROR> $message");
 227
 228         # Establish the connection to the syslog service.
 229         openlog('oinkmaster', 'cons,pid', 'user');
 230
 231         # Send the log message.
 232         syslog(@syslog);
 233
 234         # Close the log handle.
 235         closelog();
 236 }
 237
 238 #
 239 ## Private function to write a given error message to the storederror file.
 240 #
 241 sub _store_error_message ($) {
 242         my ($message) = @_;
 243
 244         # Remove any newline.
 245         chomp($message);
 246
 247         # Open file for writing.
 248         open (ERRORFILE, ">$storederrorfile") or die "Could not write to $storederrorfile. $!\n";
 249
 250         # Write error to file.
 251         print ERRORFILE "$message\n";
 252
 253         # Close file.
 254         close (ERRORFILE);
 255 }
 256
 257 1;