config/cfgroot/ids-functions.pl

   1 #!/usr/bin/perl -w
   2 ############################################################################
   3 #                                                                          #
   4 # This file is part of the IPFire Firewall.                                #
   5 #                                                                          #
   6 # IPFire is free software; you can redistribute it and/or modify           #
   7 # it under the terms of the GNU General Public License as published by     #
   8 # the Free Software Foundation; either version 2 of the License, or        #
   9 # (at your option) any later version.                                      #
  10 #                                                                          #
  11 # IPFire is distributed in the hope that it will be useful,                #
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of           #
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
  14 # GNU General Public License for more details.                             #
  15 #                                                                          #
  16 # You should have received a copy of the GNU General Public License        #
  17 # along with IPFire; if not, write to the Free Software                    #
  18 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
  19 #                                                                          #
  20 # Copyright (C) 2018 IPFire Team <info@ipfire.org>.                        #
  21 #                                                                          #
  22 ############################################################################
  23
  24 package IDS;
  25
  26 require '/var/ipfire/general-functions.pl';
  27 require "${General::swroot}/lang.pl";
  28
  29 # Location and name of the tarball which contains the ruleset.
  30 our $rulestarball = "/var/tmp/snortrules.tar.gz";
  31
  32 # File to store any errors, which also will be read and displayed by the wui.
  33 our $storederrorfile = "/tmp/ids_storederror";
  34
  35 #
  36 ## Function for checking if at least 300MB of free disk space are available
  37 ## on the "/var" partition.
  38 #
  39 sub checkdiskspace () {
  40         # Call diskfree to gather the free disk space of /var.
  41         my @df = `/bin/df -B M /var`;
  42
  43         # Loop through the output.
  44         foreach my $line (@df) {
  45                 # Ignore header line.
  46                 next if $line =~ m/^Filesystem/;
  47
  48                 # Search for a line with the device information.
  49                 if ($line =~ m/dev/ ) {
  50                         # Split the line into single pieces.
  51                         my @values = split(' ', $line);
  52                         my ($filesystem, $blocks, $used, $available, $used_perenctage, $mounted_on) = @values;
  53
  54                         # Check if the available disk space is more than 300MB.
  55                         if ($available < 300) {
  56                                 # If there is not enough space, print out an error message.
  57                                 my $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $available MB";
  58
  59                                 # Exit function and return the error message.
  60                                 return $errormessage;
  61                         }
  62                 }
  63         }
  64
  65         # Everything okay, return nothing.
  66         return;
  67 }
  68
  69 #
  70 ## This function is responsible for downloading the configured snort ruleset.
  71 ##
  72 ## * At first it obtains from the stored snortsettings which ruleset should be downloaded.
  73 ## * The next step is to get the download locations for all available rulesets.
  74 ## * After that, the function will check if an upstream proxy should be used and grab the settings.
  75 ## * The last step will be to generate the final download url, by obtaining the URL for the desired
  76 ##   ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server.
  77 #
  78 sub downloadruleset {
  79         # Get snort settings.
  80         my %snortsettings=();
  81         &General::readhash("${General::swroot}/snort/settings", \%snortsettings);
  82
  83         # Get all available ruleset locations.
  84         my %rulesetsources=();
  85         &General::readhash("${General::swroot}/snort/ruleset-sources.list", \%rulesetsources);
  86
  87         # Read proxysettings.
  88         my %proxysettings=();
  89         &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
  90
  91         # Load required perl module to handle the download.
  92         use LWP::UserAgent;
  93
  94         # Init the download module.
  95         my $downloader = LWP::UserAgent->new;
  96
  97         # Set timeout to 10 seconds.
  98         $downloader->timeout(10);
  99
 100         # Check if an upstream proxy is configured.
 101         if ($proxysettings{'UPSTREAM_PROXY'}) {
 102                 my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
 103                 my $proxy_url;
 104
 105                 # Check if we got a peer.
 106                 if ($peer) {
 107                         $proxy_url = "http://";
 108
 109                         # Check if the proxy requires authentication.
 110                         if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) {
 111                                 $proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@";
 112                         }
 113
 114                         # Add proxy server address and port.
 115                         $proxy_url .= "$peer\:$peerport";
 116                 } else {
 117                         # Break and return error message.
 118                         return "$Lang::tr{'could not download latest updates'}";
 119                 }
 120
 121                 # Setup proxy settings.
 122                 $downloader->proxy('http', $proxy_url);
 123         }
 124
 125         # Grab the right url based on the configured vendor.
 126         my $url = $rulesetsources{$snortsettings{'RULES'}};
 127
 128         # Check if the vendor requires an oinkcode and add it if needed.
 129         $url =~ s/\<oinkcode\>/$snortsettings{'OINKCODE'}/g;
 130
 131         # Abort if no url could be determined for the vendor.
 132         unless ($url) {
 133                 # Abort and return errormessage.
 134                 return "$Lang::tr{'could not download latest updates'}";
 135         }
 136
 137         # Pass the requested url to the downloader.
 138         my $request = HTTP::Request->new(GET => $url);
 139
 140         # Perform the request and save the output into the "$rulestarball" file.
 141         my $response = $downloader->request($request, $rulestarball);
 142
 143         # Check if there was any error.
 144         unless ($response->is_success) {
 145                 # Return error message.
 146                 return "$response->status_line";
 147         }
 148
 149         # If we got here, everything worked fine. Return nothing.
 150         return;
 151 }
 152
 153 #
 154 ## A tiny wrapper function to call the oinkmaster script.
 155 #
 156 sub oinkmaster () {
 157         # Load perl module to talk to the kernel syslog.
 158         use Sys::Syslog qw(:DEFAULT setlogsock);
 159
 160         # Establish the connection to the syslog service.
 161         openlog('oinkmaster', 'cons,pid', 'user');
 162
 163         # Call oinkmaster to generate ruleset.
 164         open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules|");
 165
 166         # Log output of oinkmaster to syslog.
 167         while(<OINKMASTER>) {
 168                 # The syslog function works best with an array based input,
 169                 # so generate one before passing the message details to syslog.
 170                 my @syslog = ("INFO", "$_");
 171
 172                 # Send the log message.
 173                 syslog(@syslog);
 174         }
 175
 176         # Close the pipe to oinkmaster process.
 177         close(OINKMASTER);
 178
 179         # Close the log handle.
 180         closelog();
 181 }
 182
 183 #
 184 ## Function to do all the logging stuff if the downloading or updating of the ruleset fails.
 185 #
 186 sub log_error ($) {
 187         my ($error) = @_;
 188
 189         # Remove any newline.
 190         chomp($error);
 191
 192         # Call private function to log the error message to syslog.
 193         &_log_to_syslog($error);
 194
 195         # Call private function to write/store the error message in the storederrorfile.
 196         &_store_error_message($error);
 197 }
 198
 199 #
 200 ## Function to log a given error message to the kernel syslog.
 201 #
 202 sub _log_to_syslog ($) {
 203         my ($message) = @_;
 204
 205         # Load perl module to talk to the kernel syslog.
 206         use Sys::Syslog qw(:DEFAULT setlogsock);
 207
 208         # The syslog function works best with an array based input,
 209         # so generate one before passing the message details to syslog.
 210         my @syslog = ("ERR", "<ERROR> $message");
 211
 212         # Establish the connection to the syslog service.
 213         openlog('oinkmaster', 'cons,pid', 'user');
 214
 215         # Send the log message.
 216         syslog(@syslog);
 217
 218         # Close the log handle.
 219         closelog();
 220 }
 221
 222 #
 223 ## Private function to write a given error message to the storederror file.
 224 #
 225 sub _store_error_message ($) {
 226         my ($message) = @_;
 227
 228         # Remove any newline.
 229         chomp($message);
 230
 231         # Open file for writing.
 232         open (ERRORFILE, ">$storederrorfile") or die "Could not write to $storederrorfile. $!\n";
 233
 234         # Write error to file.
 235         print ERRORFILE "$message\n";
 236
 237         # Close file.
 238         close (ERRORFILE);
 239 }
 240
 241 1;