suricata: Rule files are now located in /var/lib/suricata

[ipfire-2.x.git] / config / cfgroot / ids-functions.pl

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index ebbf61585ecead28ae9057d3893449955f836539..3f6cb3ee2edf8312672163f47e028db5286f34d6 100644 (file)
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -35,7 +35,7 @@ our $rulestarball = "/var/tmp/idsrules.tar.gz";
 our $storederrorfile = "/tmp/ids_storederror";
 
 # Location where the rulefiles are stored.
-our $rulespath = "/etc/suricata/rules";
+our $rulespath = "/var/lib/suricata";
 
 # File which contains a list of all supported ruleset sources.
 # (Sourcefire, Emergingthreads, etc..)
@@ -44,6 +44,12 @@ our $rulesetsourcesfile = "$settingsdir/ruleset-sources";
 # The pidfile of the IDS.
 our $idspidfile = "/var/run/suricata.pid";
 
+# Location of suricatactrl.
+my $suricatactrl = "/usr/local/bin/suricatactrl";
+
+# Array with allowed commands of suricatactrl.
+my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir' );
+
 #
 ## Function for checking if at least 300MB of free disk space are available
 ## on the "/var" partition.
@@ -92,6 +98,15 @@ sub downloadruleset {
        my %snortsettings=();
        &General::readhash("$settingsdir/settings", \%snortsettings);
 
+       # Check if a ruleset has been configured.
+       unless($snortsettings{'RULES'}) {
+               # Log that no ruleset has been configured and abort.
+               &_log_to_syslog("No ruleset source has been configured.");
+
+               # Return "1".
+               return 1;
+       }
+
        # Get all available ruleset locations.
        my %rulesetsources=();
        &General::readhash($rulesetsourcesfile, \%rulesetsources);
@@ -158,8 +173,11 @@ sub downloadruleset {
 
        # Check if there was any error.
        unless ($response->is_success) {
+               # Obtain error.
+               my $error = $response->content;
+
                # Log error message.
-               &_log_to_syslog("Unable to download the ruleset. $response->status_line");
+               &_log_to_syslog("Unable to download the ruleset. \($error\)");
 
                # Return "1" - false.
                return 1;
@@ -173,6 +191,9 @@ sub downloadruleset {
 ## A tiny wrapper function to call the oinkmaster script.
 #
 sub oinkmaster () {
+       # Check if the files in rulesdir have the correct permissions.
+       &_check_rulesdir_permissions();
+
        # Load perl module to talk to the kernel syslog.
        use Sys::Syslog qw(:DEFAULT setlogsock);
 
@@ -180,7 +201,7 @@ sub oinkmaster () {
        openlog('oinkmaster', 'cons,pid', 'user');
 
        # Call oinkmaster to generate ruleset.
-       open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|");
+       open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|") or die "Could not execute oinkmaster $!\n";
 
        # Log output of oinkmaster to syslog.
        while(<OINKMASTER>) {
@@ -321,4 +342,80 @@ sub ids_is_running () {
        return;
 }
 
+#
+## Function to call suricatactrl binary with a given command.
+#
+sub call_suricatactrl ($) {
+       # Get called option.
+       my ($option) = @_;
+
+       # Loop through the array of supported commands and check if
+       # the given one is part of it.
+       foreach my $cmd (@suricatactrl_cmds) {
+               # Skip current command unless the given one has been found.
+               next unless($cmd eq $option);
+
+               # Call the suricatactrl binary and pass the requrested
+               # option to it.
+               system("$suricatactrl $option &>/dev/null");
+
+               # Return "1" - True.
+               return 1;
+       }
+
+       # Command not found - return nothing.
+       return;
+}
+
+#
+## Function to create a new empty file.
+#
+sub create_empty_file($) {
+       my ($file) = @_;
+
+       # Check if the given file exists.
+       if(-e $file) {
+               # Do nothing to prevent from overwriting existing files.
+               return;
+       }
+
+       # Open the file for writing.
+       open(FILE, ">$file") or die "Could not write to $file. $!\n";
+
+       # Close file handle.
+       close(FILE);
+
+       # Return true.
+       return 1;
+}
+
+#
+## Private function to check if the file permission of the rulespath are correct.
+## If not, call suricatactrl to fix them.
+#
+sub _check_rulesdir_permissions() {
+       # Check if the rulepath main directory is writable.
+       unless (-W $rulespath) {
+               # If not call suricatctrl to fix it.
+               &call_suricatactrl("fix-rules-dir");
+       }
+
+       # Open snort rules directory and do a directory listing.
+       opendir(DIR, $rulespath) or die $!;
+       # Loop through the direcory.
+       while (my $file = readdir(DIR)) {
+               # We only want files.
+               next unless (-f "$rulespath/$file");
+
+               # Check if the file is writable by the user.
+               if (-W "$rulespath/$file") {
+                       # Everything is okay - go on to the next file.
+                       next;
+               } else {
+                       # There are wrong permissions, call suricatactrl to fix it.
+                       &call_suricatactrl("fix-rules-dir");
+               }
+       }
+}
+
 1;