package IDS;
require '/var/ipfire/general-functions.pl';
-require "${General::swroot}/lang.pl";
+
+# Location where all config and settings files are stored.
+our $settingsdir = "${General::swroot}/suricata";
# Location and name of the tarball which contains the ruleset.
-our $rulestarball = "/var/tmp/snortrules.tar.gz";
+our $rulestarball = "/var/tmp/idsrules.tar.gz";
# File to store any errors, which also will be read and displayed by the wui.
our $storederrorfile = "/tmp/ids_storederror";
+# Location where the rulefiles are stored.
+our $rulespath = "/etc/suricata/rules";
+
+# File which contains a list of all supported ruleset sources.
+# (Sourcefire, Emergingthreads, etc..)
+our $rulesetsourcesfile = "$settingsdir/ruleset-sources";
+
+# The pidfile of the IDS.
+our $idspidfile = "/var/run/suricata.pid";
+
+# Location of suricatactrl.
+my $suricatactrl = "/usr/local/bin/suricatactrl";
+
+# Array with allowed commands of suricatactrl.
+my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload' );
+
#
## Function for checking if at least 300MB of free disk space are available
## on the "/var" partition.
# Check if the available disk space is more than 300MB.
if ($available < 300) {
- # If there is not enough space, print out an error message.
- my $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $available MB";
+ # Log error to syslog.
+ &_log_to_syslog("Not enough free disk space on /var. Only $available MB from 300 MB available.");
- # Exit function and return the error message.
- return $errormessage;
+ # Exit function and return "1" - False.
+ return 1;
}
}
}
sub downloadruleset {
# Get snort settings.
my %snortsettings=();
- &General::readhash("${General::swroot}/snort/settings", \%snortsettings);
+ &General::readhash("$settingsdir/settings", \%snortsettings);
# Get all available ruleset locations.
my %rulesetsources=();
- &General::readhash("${General::swroot}/snort/ruleset-sources.list", \%rulesetsources);
+ &General::readhash($rulesetsourcesfile, \%rulesetsources);
# Read proxysettings.
my %proxysettings=();
# Add proxy server address and port.
$proxy_url .= "$peer\:$peerport";
} else {
- # Break and return error message.
- return "$Lang::tr{'could not download latest updates'}";
+ # Log error message and break.
+ &_log_to_syslog("Could not proper configure the proxy server access.");
+
+ # Return "1" - false.
+ return 1;
}
# Setup proxy settings.
# Abort if no url could be determined for the vendor.
unless ($url) {
- # Abort and return errormessage.
- return "$Lang::tr{'could not download latest updates'}";
+ # Log error and abort.
+ &_log_to_syslog("Unable to gather a download URL for the selected ruleset.");
+ return 1;
}
# Pass the requested url to the downloader.
# Check if there was any error.
unless ($response->is_success) {
- # Return error message.
- return "$response->status_line";
+ # Obtain error.
+ my $error = $response->content;
+
+ # Log error message.
+ &_log_to_syslog("Unable to download the ruleset. \($error\)");
+
+ # Return "1" - false.
+ return 1;
}
# If we got here, everything worked fine. Return nothing.
openlog('oinkmaster', 'cons,pid', 'user');
# Call oinkmaster to generate ruleset.
- open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules|");
+ open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|") or die "Could not execute oinkmaster $!\n";
# Log output of oinkmaster to syslog.
while(<OINKMASTER>) {
# Remove any newline.
chomp($error);
+ # Call private function to log the error message to syslog.
+ &_log_to_syslog($error);
+
# Call private function to write/store the error message in the storederrorfile.
&_store_error_message($error);
}
+#
+## Function to log a given error message to the kernel syslog.
+#
+sub _log_to_syslog ($) {
+ my ($message) = @_;
+
+ # Load perl module to talk to the kernel syslog.
+ use Sys::Syslog qw(:DEFAULT setlogsock);
+
+ # The syslog function works best with an array based input,
+ # so generate one before passing the message details to syslog.
+ my @syslog = ("ERR", "<ERROR> $message");
+
+ # Establish the connection to the syslog service.
+ openlog('oinkmaster', 'cons,pid', 'user');
+
+ # Send the log message.
+ syslog(@syslog);
+
+ # Close the log handle.
+ closelog();
+}
+
#
## Private function to write a given error message to the storederror file.
#
close (ERRORFILE);
}
+#
+## Function to get a list of all available network zones.
+#
+sub get_available_network_zones () {
+ # Get netsettings.
+ my %netsettings = ();
+ &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
+
+ # Obtain the configuration type from the netsettings hash.
+ my $config_type = $netsettings{'CONFIG_TYPE'};
+
+ # Hash which contains the conversation from the config mode
+ # to the existing network interface names. They are stored like
+ # an array.
+ #
+ # Mode "0" red is a modem and green
+ # Mode "1" red is a netdev and green
+ # Mode "2" red, green and orange
+ # Mode "3" red, green and blue
+ # Mode "4" red, green, blue, orange
+ my %config_type_to_interfaces = (
+ "0" => [ "red", "green" ],
+ "1" => [ "red", "green" ],
+ "2" => [ "red", "green", "orange" ],
+ "3" => [ "red", "green", "blue" ],
+ "4" => [ "red", "green", "blue", "orange" ]
+ );
+
+ # Obtain and dereference the corresponding network interaces based on the read
+ # network config type.
+ my @network_zones = @{ $config_type_to_interfaces{$config_type} };
+
+ # Return them.
+ return @network_zones;
+}
+
+#
+## Function to check if the IDS is running.
+#
+sub ids_is_running () {
+ if(-f $idspidfile) {
+ # Open PID file for reading.
+ open(PIDFILE, "$idspidfile") or die "Could not open $idspidfile. $!\n";
+
+ # Grab the process-id.
+ my $pid = <PIDFILE>;
+
+ # Close filehandle.
+ close(PIDFILE);
+
+ # Remove any newline.
+ chomp($pid);
+
+ # Check if a directory for the process-id exists in proc.
+ if(-d "/proc/$pid") {
+ # The IDS daemon is running return the process id.
+ return $pid;
+ }
+ }
+
+ # Return nothing - IDS is not running.
+ return;
+}
+
+#
+## Function to call suricatactrl binary with a given command.
+#
+sub call_suricatactrl ($) {
+ # Get called option.
+ my ($option) = @_;
+
+ # Loop through the array of supported commands and check if
+ # the given one is part of it.
+ foreach my $cmd (@suricatactrl_cmds) {
+ # Skip current command unless the given one has been found.
+ next unless($cmd eq $option);
+
+ # Call the suricatactrl binary and pass the requrested
+ # option to it.
+ system("$suricatactrl $option &>/dev/null");
+
+ # Return "1" - True.
+ return 1;
+ }
+
+ # Command not found - return nothing.
+ return;
+}
+
+#
+## Function to create a new empty file.
+#
+sub create_empty_file($) {
+ my ($file) = @_;
+
+ # Check if the given file exists.
+ if(-e $file) {
+ # Do nothing to prevent from overwriting existing files.
+ return;
+ }
+
+ # Open the file for writing.
+ open(FILE, ">$file") or die "Could not write to $file. $!\n";
+
+ # Close file handle.
+ close(FILE);
+
+ # Return true.
+ return 1;
+}
+
1;
projects / ipfire-2.x.git / blobdiff