suricata: Rule files are now located in /var/lib/suricata

[ipfire-2.x.git] / config / cfgroot / ids-functions.pl

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index 6f7f3ee7ef7eb07857a5982607c13fdf734a70b6..3f6cb3ee2edf8312672163f47e028db5286f34d6 100644 (file)
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -35,7 +35,7 @@ our $rulestarball = "/var/tmp/idsrules.tar.gz";
 our $storederrorfile = "/tmp/ids_storederror";
 
 # Location where the rulefiles are stored.
-our $rulespath = "/etc/suricata/rules";
+our $rulespath = "/var/lib/suricata";
 
 # File which contains a list of all supported ruleset sources.
 # (Sourcefire, Emergingthreads, etc..)
@@ -48,7 +48,7 @@ our $idspidfile = "/var/run/suricata.pid";
 my $suricatactrl = "/usr/local/bin/suricatactrl";
 
 # Array with allowed commands of suricatactrl.
-my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload' );
+my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir' );
 
 #
 ## Function for checking if at least 300MB of free disk space are available
@@ -98,6 +98,15 @@ sub downloadruleset {
        my %snortsettings=();
        &General::readhash("$settingsdir/settings", \%snortsettings);
 
+       # Check if a ruleset has been configured.
+       unless($snortsettings{'RULES'}) {
+               # Log that no ruleset has been configured and abort.
+               &_log_to_syslog("No ruleset source has been configured.");
+
+               # Return "1".
+               return 1;
+       }
+
        # Get all available ruleset locations.
        my %rulesetsources=();
        &General::readhash($rulesetsourcesfile, \%rulesetsources);
@@ -182,6 +191,9 @@ sub downloadruleset {
 ## A tiny wrapper function to call the oinkmaster script.
 #
 sub oinkmaster () {
+       # Check if the files in rulesdir have the correct permissions.
+       &_check_rulesdir_permissions();
+
        # Load perl module to talk to the kernel syslog.
        use Sys::Syslog qw(:DEFAULT setlogsock);
 
@@ -377,4 +389,33 @@ sub create_empty_file($) {
        return 1;
 }
 
+#
+## Private function to check if the file permission of the rulespath are correct.
+## If not, call suricatactrl to fix them.
+#
+sub _check_rulesdir_permissions() {
+       # Check if the rulepath main directory is writable.
+       unless (-W $rulespath) {
+               # If not call suricatctrl to fix it.
+               &call_suricatactrl("fix-rules-dir");
+       }
+
+       # Open snort rules directory and do a directory listing.
+       opendir(DIR, $rulespath) or die $!;
+       # Loop through the direcory.
+       while (my $file = readdir(DIR)) {
+               # We only want files.
+               next unless (-f "$rulespath/$file");
+
+               # Check if the file is writable by the user.
+               if (-W "$rulespath/$file") {
+                       # Everything is okay - go on to the next file.
+                       next;
+               } else {
+                       # There are wrong permissions, call suricatactrl to fix it.
+                       &call_suricatactrl("fix-rules-dir");
+               }
+       }
+}
+
 1;