our $storederrorfile = "/tmp/ids_storederror";
# Location where the rulefiles are stored.
-our $rulespath = "/etc/suricata/rules";
+our $rulespath = "/var/lib/suricata";
# File which contains a list of all supported ruleset sources.
# (Sourcefire, Emergingthreads, etc..)
my $suricatactrl = "/usr/local/bin/suricatactrl";
# Array with allowed commands of suricatactrl.
-my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload' );
+my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir', 'cron' );
+
+# Array with supported cron intervals.
+my @cron_intervals = ('off', 'daily', 'weekly' );
#
## Function for checking if at least 300MB of free disk space are available
my %snortsettings=();
&General::readhash("$settingsdir/settings", \%snortsettings);
+ # Check if a ruleset has been configured.
+ unless($snortsettings{'RULES'}) {
+ # Log that no ruleset has been configured and abort.
+ &_log_to_syslog("No ruleset source has been configured.");
+
+ # Return "1".
+ return 1;
+ }
+
# Get all available ruleset locations.
my %rulesetsources=();
&General::readhash($rulesetsourcesfile, \%rulesetsources);
return 1;
}
+ # Pass the requrested url to the downloader.
+ my $request = HTTP::Request->new(HEAD => $url);
+
+ # Accept the html header.
+ $request->header('Accept' => 'text/html');
+
+ # Perform the request and fetch the html header.
+ my $response = $downloader->request($request);
+
+ # Check if there was any error.
+ unless ($response->is_success) {
+ # Obtain error.
+ my $error = $response->content;
+
+ # Log error message.
+ &_log_to_syslog("Unable to download the ruleset. \($error\)");
+
+ # Return "1" - false.
+ return 1;
+ }
+
+ # Assign the fetched header object.
+ my $header = $response->headers;
+
+ # Grab the remote file size from the object and store it in the
+ # variable.
+ my $remote_filesize = $header->content_length;
+
+ # Load perl module to deal with temporary files.
+ use File::Temp;
+
+ # Generate temporay file name, located in "/var/tmp" and with a suffix of ".tar.gz".
+ my $tmp = File::Temp->new( SUFFIX => ".tar.gz", DIR => "/var/tmp/", UNLINK => 0 );
+ my $tmpfile = $tmp->filename();
+
# Pass the requested url to the downloader.
my $request = HTTP::Request->new(GET => $url);
- # Perform the request and save the output into the "$rulestarball" file.
- my $response = $downloader->request($request, $rulestarball);
+ # Perform the request and save the output into the tmpfile.
+ my $response = $downloader->request($request, $tmpfile);
# Check if there was any error.
unless ($response->is_success) {
return 1;
}
+ # Load perl stat module.
+ use File::stat;
+
+ # Perform stat on the tmpfile.
+ my $stat = stat($tmpfile);
+
+ # Grab the local filesize of the downloaded tarball.
+ my $local_filesize = $stat->size;
+
+ # Check if both file sizes match.
+ unless ($remote_filesize eq $local_filesize) {
+ # Log error message.
+ &_log_to_syslog("Unable to completely download the ruleset. ");
+ &_log_to_syslog("Only got $local_filesize Bytes instead of $remote_filesize Bytes. ");
+
+ # Delete temporary file.
+ unlink("$tmpfile");
+
+ # Return "1" - false.
+ return 1;
+ }
+
+ # Load file copy module, which contains the move() function.
+ use File::Copy;
+
+ # Overwrite existing rules tarball with the new downloaded one.
+ move("$tmpfile", "$rulestarball");
+
# If we got here, everything worked fine. Return nothing.
return;
}
## A tiny wrapper function to call the oinkmaster script.
#
sub oinkmaster () {
+ # Check if the files in rulesdir have the correct permissions.
+ &_check_rulesdir_permissions();
+
+ # Cleanup the rules directory before filling it with the new rulest.
+ &_cleanup_rulesdir();
+
# Load perl module to talk to the kernel syslog.
use Sys::Syslog qw(:DEFAULT setlogsock);
openlog('oinkmaster', 'cons,pid', 'user');
# Call oinkmaster to generate ruleset.
- open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|");
+ open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|") or die "Could not execute oinkmaster $!\n";
# Log output of oinkmaster to syslog.
while(<OINKMASTER>) {
#
sub call_suricatactrl ($) {
# Get called option.
- my ($option) = @_;
+ my ($option, $interval) = @_;
# Loop through the array of supported commands and check if
# the given one is part of it.
# Skip current command unless the given one has been found.
next unless($cmd eq $option);
- # Call the suricatactrl binary and pass the requrested
- # option to it.
- system("$suricatactrl $option &>/dev/null");
+ # Check if the given command is "cron".
+ if ($option eq "cron") {
+ # Check if an interval has been given.
+ if ($interval) {
+ # Check if the given interval is valid.
+ foreach my $element (@cron_intervals) {
+ # Skip current element until the given one has been found.
+ next unless($element eq $interval);
+
+ # Call the suricatactrl binary and pass the "cron" command
+ # with the requrested interval.
+ system("$suricatactrl $option $interval &>/dev/null");
+
+ # Return "1" - True.
+ return 1;
+ }
+ }
- # Return "1" - True.
- return 1;
+ # If we got here, the given interval is not supported or none has been given. - Return nothing.
+ return;
+ } else {
+ # Call the suricatactrl binary and pass the requrested
+ # option to it.
+ system("$suricatactrl $option &>/dev/null");
+
+ # Return "1" - True.
+ return 1;
+ }
}
# Command not found - return nothing.
return;
}
+#
+## Function to create a new empty file.
+#
+sub create_empty_file($) {
+ my ($file) = @_;
+
+ # Check if the given file exists.
+ if(-e $file) {
+ # Do nothing to prevent from overwriting existing files.
+ return;
+ }
+
+ # Open the file for writing.
+ open(FILE, ">$file") or die "Could not write to $file. $!\n";
+
+ # Close file handle.
+ close(FILE);
+
+ # Return true.
+ return 1;
+}
+
+#
+## Private function to check if the file permission of the rulespath are correct.
+## If not, call suricatactrl to fix them.
+#
+sub _check_rulesdir_permissions() {
+ # Check if the rulepath main directory is writable.
+ unless (-W $rulespath) {
+ # If not call suricatctrl to fix it.
+ &call_suricatactrl("fix-rules-dir");
+ }
+
+ # Open snort rules directory and do a directory listing.
+ opendir(DIR, $rulespath) or die $!;
+ # Loop through the direcory.
+ while (my $file = readdir(DIR)) {
+ # We only want files.
+ next unless (-f "$rulespath/$file");
+
+ # Check if the file is writable by the user.
+ if (-W "$rulespath/$file") {
+ # Everything is okay - go on to the next file.
+ next;
+ } else {
+ # There are wrong permissions, call suricatactrl to fix it.
+ &call_suricatactrl("fix-rules-dir");
+ }
+ }
+}
+
+#
+## Private function to cleanup the directory which contains
+## the IDS rules, before extracting and modifing the new ruleset.
+#
+sub _cleanup_rulesdir() {
+ # Open rules directory and do a directory listing.
+ opendir(DIR, $rulespath) or die $!;
+
+ # Loop through the direcory.
+ while (my $file = readdir(DIR)) {
+ # We only want files.
+ next unless (-f "$rulespath/$file");
+
+ # Skip element if it has config as file extension.
+ next if ($file =~ m/\.config$/);
+
+ # Delete the current processed file, if not, exit this function
+ # and return an error message.
+ unlink("$rulespath/$file") or return "Could not delete $rulespath/$file. $!\n";
+ }
+
+ # Return nothing;
+ return;
+}
+
1;
projects / ipfire-2.x.git / blobdiff