X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=blobdiff_plain;f=config%2Fcfgroot%2Fids-functions.pl;h=4452b4be3de32ea6de4cfd8254811ae4f8dd43b3;hp=684566731fddf635a684d9bf8ed212f946d03f55;hb=bcbc9897e392a237105fc2e12af2323804bd2a42;hpb=8cf04a165696c512c8c2cb1f3d282c1f0cc88787 diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index 684566731f..4452b4be3d 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -28,6 +28,30 @@ require '/var/ipfire/general-functions.pl'; # Location where all config and settings files are stored. our $settingsdir = "${General::swroot}/suricata"; +# File where the used rulefiles are stored. +our $used_rulefiles_file = "$settingsdir/suricata-used-rulefiles.yaml"; + +# File where the addresses of the homenet are stored. +our $homenet_file = "$settingsdir/suricata-homenet.yaml"; + +# File which contains the enabled sids. +our $enabled_sids_file = "$settingsdir/oinkmaster-enabled-sids.conf"; + +# File which contains the disabled sids. +our $disabled_sids_file = "$settingsdir/oinkmaster-disabled-sids.conf"; + +# File which contains wheater the rules should be changed. +our $modify_sids_file = "$settingsdir/oinkmaster-modify-sids.conf"; + +# File which stores the configured IPS settings. +our $ids_settings_file = "$settingsdir/settings"; + +# File which stores the configured rules-settings. +our $rules_settings_file = "$settingsdir/rules-settings"; + +# File which stores the configured settings for whitelisted addresses. +our $ignored_file = "$settingsdir/ignored"; + # Location and name of the tarball which contains the ruleset. our $rulestarball = "/var/tmp/idsrules.tar.gz"; @@ -37,6 +61,9 @@ our $storederrorfile = "/tmp/ids_storederror"; # Location where the rulefiles are stored. our $rulespath = "/var/lib/suricata"; +# File which contains the rules to whitelist addresses on suricata. +our $whitelist_file = "$rulespath/whitelist.rules"; + # File which contains a list of all supported ruleset sources. # (Sourcefire, Emergingthreads, etc..) our $rulesetsourcesfile = "$settingsdir/ruleset-sources"; @@ -53,6 +80,21 @@ my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir', # Array with supported cron intervals. my @cron_intervals = ('off', 'daily', 'weekly' ); +# +## Function to check and create all IDS related files, if the does not exist. +# +sub check_and_create_filelayout() { + # Check if the files exist and if not, create them. + unless (-f "$enabled_sids_file") { &create_empty_file($enabled_sids_file); } + unless (-f "$disabled_sids_file") { &create_empty_file($disabled_sids_file); } + unless (-f "$modify_sids_file") { &create_empty_file($modify_sids_file); } + unless (-f "$used_rulefiles_file") { &create_empty_file($used_rulefiles_file); } + unless (-f "$ids_settings_file") { &create_empty_file($ids_settings_file); } + unless (-f "$rules_settings_file") { &create_empty_file($rules_settings_file); } + unless (-f "$ignored_file") { &create_empty_file($ignored_file); } + unless (-f "$whitelist_file" ) { &create_empty_file($whitelist_file); } +} + # ## Function for checking if at least 300MB of free disk space are available ## on the "/var" partition. @@ -88,21 +130,21 @@ sub checkdiskspace () { } # -## This function is responsible for downloading the configured snort ruleset. +## This function is responsible for downloading the configured IDS ruleset. ## -## * At first it obtains from the stored snortsettings which ruleset should be downloaded. +## * At first it obtains from the stored rules settings which ruleset should be downloaded. ## * The next step is to get the download locations for all available rulesets. ## * After that, the function will check if an upstream proxy should be used and grab the settings. ## * The last step will be to generate the final download url, by obtaining the URL for the desired ## ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server. # sub downloadruleset { - # Get snort settings. - my %snortsettings=(); - &General::readhash("$settingsdir/settings", \%snortsettings); + # Get rules settings. + my %rulessettings=(); + &General::readhash("$rules_settings_file", \%rulessettings); # Check if a ruleset has been configured. - unless($snortsettings{'RULES'}) { + unless($rulessettings{'RULES'}) { # Log that no ruleset has been configured and abort. &_log_to_syslog("No ruleset source has been configured."); @@ -152,14 +194,14 @@ sub downloadruleset { } # Setup proxy settings. - $downloader->proxy('http', $proxy_url); + $downloader->proxy(['http', 'https'], $proxy_url); } # Grab the right url based on the configured vendor. - my $url = $rulesetsources{$snortsettings{'RULES'}}; + my $url = $rulesetsources{$rulessettings{'RULES'}}; # Check if the vendor requires an oinkcode and add it if needed. - $url =~ s/\/$snortsettings{'OINKCODE'}/g; + $url =~ s/\/$rulessettings{'OINKCODE'}/g; # Abort if no url could be determined for the vendor. unless ($url) { @@ -168,11 +210,46 @@ sub downloadruleset { return 1; } + # Pass the requrested url to the downloader. + my $request = HTTP::Request->new(HEAD => $url); + + # Accept the html header. + $request->header('Accept' => 'text/html'); + + # Perform the request and fetch the html header. + my $response = $downloader->request($request); + + # Check if there was any error. + unless ($response->is_success) { + # Obtain error. + my $error = $response->content; + + # Log error message. + &_log_to_syslog("Unable to download the ruleset. \($error\)"); + + # Return "1" - false. + return 1; + } + + # Assign the fetched header object. + my $header = $response->headers; + + # Grab the remote file size from the object and store it in the + # variable. + my $remote_filesize = $header->content_length; + + # Load perl module to deal with temporary files. + use File::Temp; + + # Generate temporay file name, located in "/var/tmp" and with a suffix of ".tar.gz". + my $tmp = File::Temp->new( SUFFIX => ".tar.gz", DIR => "/var/tmp/", UNLINK => 0 ); + my $tmpfile = $tmp->filename(); + # Pass the requested url to the downloader. my $request = HTTP::Request->new(GET => $url); - # Perform the request and save the output into the "$rulestarball" file. - my $response = $downloader->request($request, $rulestarball); + # Perform the request and save the output into the tmpfile. + my $response = $downloader->request($request, $tmpfile); # Check if there was any error. unless ($response->is_success) { @@ -186,6 +263,34 @@ sub downloadruleset { return 1; } + # Load perl stat module. + use File::stat; + + # Perform stat on the tmpfile. + my $stat = stat($tmpfile); + + # Grab the local filesize of the downloaded tarball. + my $local_filesize = $stat->size; + + # Check if both file sizes match. + unless ($remote_filesize eq $local_filesize) { + # Log error message. + &_log_to_syslog("Unable to completely download the ruleset. "); + &_log_to_syslog("Only got $local_filesize Bytes instead of $remote_filesize Bytes. "); + + # Delete temporary file. + unlink("$tmpfile"); + + # Return "1" - false. + return 1; + } + + # Load file copy module, which contains the move() function. + use File::Copy; + + # Overwrite existing rules tarball with the new downloaded one. + move("$tmpfile", "$rulestarball"); + # If we got here, everything worked fine. Return nothing. return; } @@ -282,6 +387,9 @@ sub _store_error_message ($) { # Close file. close (ERRORFILE); + + # Set correct ownership for the file. + &set_ownership("$storederrorfile"); } # @@ -464,11 +572,378 @@ sub _cleanup_rulesdir() { # Delete the current processed file, if not, exit this function # and return an error message. - unlink($rulespath/$file) or return "Could not delete $rulespath/$file. $!\n"; + unlink("$rulespath/$file") or return "Could not delete $rulespath/$file. $!\n"; } # Return nothing; return; } +# +## Function to generate the file which contains the home net information. +# +sub generate_home_net_file() { + my %netsettings; + + # Read-in network settings. + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + + # Get available network zones. + my @network_zones = &get_available_network_zones(); + + # Temporary array to store network address and prefix of the configured + # networks. + my @networks; + + # Loop through the array of available network zones. + foreach my $zone (@network_zones) { + # Check if the current processed zone is red. + if($zone eq "red") { + # Grab the IP-address of the red interface. + my $red_address = &get_red_address(); + + # Check if an address has been obtained. + if ($red_address) { + # Generate full network string. + my $red_network = join("/", $red_address, "32"); + + # Add the red network to the array of networks. + push(@networks, $red_network); + } + + # Check if the configured RED_TYPE is static. + if ($netsettings{'RED_TYPE'} eq "STATIC") { + # Get configured and enabled aliases. + my @aliases = &get_aliases(); + + # Loop through the array. + foreach my $alias (@aliases) { + # Add "/32" prefix. + my $network = join("/", $alias, "32"); + + # Add the generated network to the array of networks. + push(@networks, $network); + } + } + # Process remaining network zones. + } else { + # Convert current zone name into upper case. + $zone = uc($zone); + + # Generate key to access the required data from the netsettings hash. + my $zone_netaddress = $zone . "_NETADDRESS"; + my $zone_netmask = $zone . "_NETMASK"; + + # Obtain the settings from the netsettings hash. + my $netaddress = $netsettings{$zone_netaddress}; + my $netmask = $netsettings{$zone_netmask}; + + # Convert the subnetmask into prefix notation. + my $prefix = &Network::convert_netmask2prefix($netmask); + + # Generate full network string. + my $network = join("/", $netaddress,$prefix); + + # Check if the network is valid. + if(&Network::check_subnet($network)) { + # Add the generated network to the array of networks. + push(@networks, $network); + } + } + } + + # Format home net declaration. + my $line = "\"\["; + + # Loop through the array of networks. + foreach my $network (@networks) { + # Add the network to the line. + $line = "$line" . "$network"; + + # Check if the current network was the last in the array. + if ($network eq $networks[-1]) { + # Close the line. + $line = "$line" . "\]\""; + } else { + # Add "," for the next network. + $line = "$line" . "\,"; + } + } + + # Open file to store the addresses of the home net. + open(FILE, ">$homenet_file") or die "Could not open $homenet_file. $!\n"; + + # Print yaml header. + print FILE "%YAML 1.1\n"; + print FILE "---\n\n"; + + # Print notice about autogenerated file. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Print the generated and required HOME_NET declaration to the file. + print FILE "HOME_NET:\t$line\n"; + + # Close file handle. + close(FILE); +} + +# +## Function to generate and write the file for used rulefiles. +# +sub write_used_rulefiles_file(@) { + my @files = @_; + + # Open file for used rulefiles. + open (FILE, ">$used_rulefiles_file") or die "Could not write to $used_rulefiles_file. $!\n"; + + # Write yaml header to the file. + print FILE "%YAML 1.1\n"; + print FILE "---\n\n"; + + # Write header to file. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Allways use the whitelist. + print FILE " - whitelist.rules\n"; + + # Loop through the array of given files. + foreach my $file (@files) { + # Check if the given filename exists and write it to the file of used rulefiles. + if(-f "$rulespath/$file") { + print FILE " - $file\n"; + } + } + + # Close file after writing. + close(FILE); +} + +# +## Function to generate and write the file for modify the ruleset. +# +sub write_modify_sids_file($) { + my ($ruleaction) = @_; + + # Open modify sid's file for writing. + open(FILE, ">$modify_sids_file") or die "Could not write to $modify_sids_file. $!\n"; + + # Write file header. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Check if the traffic only should be monitored. + unless($ruleaction eq "alert") { + # Tell oinkmaster to switch all rules from alert to drop. + print FILE "modifysid \* \"alert\" \| \"drop\"\n"; + } + + # Close file handle. + close(FILE); +} + +# +## Function to gather the version of suricata. +# +sub get_suricata_version($) { + my ($format) = @_; + + # Execute piped suricata command and return the version information. + open(SURICATA, "suricata -V |") or die "Couldn't execute program: $!"; + + # Grab and store the output of the piped program. + my $version_string = ; + + # Close pipe. + close(SURICATA); + + # Remove newlines. + chomp($version_string); + + # Grab the version from the version string. + $version_string =~ /([0-9]+([.][0-9]+)+)/; + + # Splitt the version into single chunks. + my ($major_ver, $minor_ver, $patchlevel) = split(/\./, $1); + + # Check and return the requested version sheme. + if ($format eq "major") { + # Return the full version. + return "$major_ver"; + } elsif ($format eq "minor") { + # Return the major and minor part. + return "$major_ver.$minor_ver"; + } else { + # Return the full version string. + return "$major_ver.$minor_ver.$patchlevel"; + } +} + +# +## Function to generate the rules file with whitelisted addresses. +# +sub generate_ignore_file() { + my %ignored = (); + + # SID range 1000000-1999999 Reserved for Local Use + # Put your custom rules in this range to avoid conflicts + my $sid = 1500000; + + # Read-in ignoredfile. + &General::readhasharray($IDS::ignored_file, \%ignored); + + # Open ignorefile for writing. + open(FILE, ">$IDS::whitelist_file") or die "Could not write to $IDS::whitelist_file. $!\n"; + + # Config file header. + print FILE "# Autogenerated file.\n"; + print FILE "# All user modifications will be overwritten.\n\n"; + + # Add all user defined addresses to the whitelist. + # + # Check if the hash contains any elements. + if (keys (%ignored)) { + # Loop through the entire hash and write the host/network + # and remark to the ignore file. + while ( (my $key) = each %ignored) { + my $address = $ignored{$key}[0]; + my $remark = $ignored{$key}[1]; + my $status = $ignored{$key}[2]; + + # Check if the status of the entry is "enabled". + if ($status eq "enabled") { + # Check if the address/network is valid. + if ((&General::validip($address)) || (&General::validipandmask($address))) { + # Write rule line to the file to pass any traffic from this IP + print FILE "pass ip $address any -> any any (msg:\"pass all traffic from/to $address\"\; sid:$sid\;)\n"; + + # Increment sid. + $sid++; + } + } + } + } + + close(FILE); +} + +# +## Function to set correct ownership for single files and directories. +# + +sub set_ownership($) { + my ($target) = @_; + + # User and group of the WUI. + my $uname = "nobody"; + my $grname = "nobody"; + + # The chown function implemented in perl requies the user and group as nummeric id's. + my $uid = getpwnam($uname); + my $gid = getgrnam($grname); + + # Check if the given target exists. + unless ($target) { + # Stop the script and print error message. + die "The $target does not exist. Cannot change the ownership!\n"; + } + + # Check weather the target is a file or directory. + if (-f $target) { + # Change ownership ot the single file. + chown($uid, $gid, "$target"); + } elsif (-d $target) { + # Do a directory listing. + opendir(DIR, $target) or die $!; + # Loop through the direcory. + while (my $file = readdir(DIR)) { + + # We only want files. + next unless (-f "$target/$file"); + + # Set correct ownership for the files. + chown($uid, $gid, "$target/$file"); + } + + closedir(DIR); + + # Change ownership of the directory. + chown($uid, $gid, "$target"); + } +} + +# +## Function to read-in the aliases file and returns all configured and enabled aliases. +# +sub get_aliases() { + # Location of the aliases file. + my $aliases_file = "${General::swroot}/ethernet/aliases"; + + # Array to store the aliases. + my @aliases; + + # Check if the file is empty. + if (-z $aliases_file) { + # Abort nothing to do. + return; + } + + # Open the aliases file. + open(ALIASES, $aliases_file) or die "Could not open $aliases_file. $!\n"; + + # Loop through the file content. + while (my $line = ) { + # Remove newlines. + chomp($line); + + # Splitt line content into single chunks. + my ($address, $state, $remark) = split(/\,/, $line); + + # Check if the state of the current processed alias is "on". + if ($state eq "on") { + # Check if the address is valid. + if(&Network::check_ip_address($address)) { + # Add the alias to the array of aliases. + push(@aliases, $address); + } + } + } + + # Close file handle. + close(ALIASES); + + # Return the array. + return @aliases; +} + +# +## Function to grab the current assigned IP-address on red. +# +sub get_red_address() { + # File, which contains the current IP-address of the red interface. + my $file = "${General::swroot}/red/local-ipaddress"; + + # Check if the file exists. + if (-e $file) { + # Open the given file. + open(FILE, "$file") or die "Could not open $file."; + + # Obtain the address from the first line of the file. + my $address = ; + + # Close filehandle + close(FILE); + + # Remove newlines. + chomp $address; + + # Check if the grabbed address is valid. + if (&General::validip($address)) { + # Return the address. + return $address; + } + } + + # Return nothing. + return; +} + 1;