X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=blobdiff_plain;f=config%2Fcfgroot%2Fids-functions.pl;h=5530da11eb1f6cddcfd98ab59cdc41e4a7a1804d;hp=acf097bb828ad73dd488b4eee385e7dc0f555ff8;hb=40407aee99546b4f25632bcaeb796d2a53cb1bcb;hpb=1cae702c22ed31784393980968634626af8fe653 diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index acf097bb82..5530da11eb 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -28,19 +28,76 @@ require '/var/ipfire/general-functions.pl'; # Location where all config and settings files are stored. our $settingsdir = "${General::swroot}/suricata"; +# File where the used rulefiles are stored. +our $used_rulefiles_file = "$settingsdir/suricata-used-rulefiles.yaml"; + +# File where the addresses of the homenet are stored. +our $homenet_file = "$settingsdir/suricata-homenet.yaml"; + +# File which contains the enabled sids. +our $enabled_sids_file = "$settingsdir/oinkmaster-enabled-sids.conf"; + +# File which contains the disabled sids. +our $disabled_sids_file = "$settingsdir/oinkmaster-disabled-sids.conf"; + +# File which contains wheater the rules should be changed. +our $modify_sids_file = "$settingsdir/oinkmaster-modify-sids.conf"; + +# File which stores the configured IPS settings. +our $ids_settings_file = "$settingsdir/settings"; + +# File which stores the configured rules-settings. +our $rules_settings_file = "$settingsdir/rules-settings"; + +# File which stores the configured settings for whitelisted addresses. +our $ignored_file = "$settingsdir/ignored"; + # Location and name of the tarball which contains the ruleset. our $rulestarball = "/var/tmp/idsrules.tar.gz"; # File to store any errors, which also will be read and displayed by the wui. our $storederrorfile = "/tmp/ids_storederror"; +# File to lock the WUI, while the autoupdate script runs. +our $ids_page_lock_file = "/tmp/ids_page_locked"; + # Location where the rulefiles are stored. -our $rulespath = "/etc/suricata/rules"; +our $rulespath = "/var/lib/suricata"; + +# File which contains the rules to whitelist addresses on suricata. +our $whitelist_file = "$rulespath/whitelist.rules"; # File which contains a list of all supported ruleset sources. # (Sourcefire, Emergingthreads, etc..) our $rulesetsourcesfile = "$settingsdir/ruleset-sources"; +# The pidfile of the IDS. +our $idspidfile = "/var/run/suricata.pid"; + +# Location of suricatactrl. +my $suricatactrl = "/usr/local/bin/suricatactrl"; + +# Array with allowed commands of suricatactrl. +my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir', 'cron' ); + +# Array with supported cron intervals. +my @cron_intervals = ('off', 'daily', 'weekly' ); + +# +## Function to check and create all IDS related files, if the does not exist. +# +sub check_and_create_filelayout() { + # Check if the files exist and if not, create them. + unless (-f "$enabled_sids_file") { &create_empty_file($enabled_sids_file); } + unless (-f "$disabled_sids_file") { &create_empty_file($disabled_sids_file); } + unless (-f "$modify_sids_file") { &create_empty_file($modify_sids_file); } + unless (-f "$used_rulefiles_file") { &create_empty_file($used_rulefiles_file); } + unless (-f "$ids_settings_file") { &create_empty_file($ids_settings_file); } + unless (-f "$rules_settings_file") { &create_empty_file($rules_settings_file); } + unless (-f "$ignored_file") { &create_empty_file($ignored_file); } + unless (-f "$whitelist_file" ) { &create_empty_file($whitelist_file); } +} + # ## Function for checking if at least 300MB of free disk space are available ## on the "/var" partition. @@ -76,18 +133,27 @@ sub checkdiskspace () { } # -## This function is responsible for downloading the configured snort ruleset. +## This function is responsible for downloading the configured IDS ruleset. ## -## * At first it obtains from the stored snortsettings which ruleset should be downloaded. +## * At first it obtains from the stored rules settings which ruleset should be downloaded. ## * The next step is to get the download locations for all available rulesets. ## * After that, the function will check if an upstream proxy should be used and grab the settings. ## * The last step will be to generate the final download url, by obtaining the URL for the desired ## ruleset, add the settings for the upstream proxy and final grab the rules tarball from the server. # sub downloadruleset { - # Get snort settings. - my %snortsettings=(); - &General::readhash("$settingsdir/settings", \%snortsettings); + # Get rules settings. + my %rulessettings=(); + &General::readhash("$rules_settings_file", \%rulessettings); + + # Check if a ruleset has been configured. + unless($rulessettings{'RULES'}) { + # Log that no ruleset has been configured and abort. + &_log_to_syslog("No ruleset source has been configured."); + + # Return "1". + return 1; + } # Get all available ruleset locations. my %rulesetsources=(); @@ -108,37 +174,27 @@ sub downloadruleset { # Check if an upstream proxy is configured. if ($proxysettings{'UPSTREAM_PROXY'}) { - my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/); my $proxy_url; - # Check if we got a peer. - if ($peer) { - $proxy_url = "http://"; + $proxy_url = "http://"; - # Check if the proxy requires authentication. - if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) { - $proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@"; - } - - # Add proxy server address and port. - $proxy_url .= "$peer\:$peerport"; - } else { - # Log error message and break. - &_log_to_syslog("Could not proper configure the proxy server access."); - - # Return "1" - false. - return 1; + # Check if the proxy requires authentication. + if (($proxysettings{'UPSTREAM_USER'}) && ($proxysettings{'UPSTREAM_PASSWORD'})) { + $proxy_url .= "$proxysettings{'UPSTREAM_USER'}\:$proxysettings{'UPSTREAM_PASSWORD'}\@"; } + # Add proxy server address and port. + $proxy_url .= $proxysettings{'UPSTREAM_PROXY'}; + # Setup proxy settings. - $downloader->proxy('http', $proxy_url); + $downloader->proxy(['http', 'https'], $proxy_url); } # Grab the right url based on the configured vendor. - my $url = $rulesetsources{$snortsettings{'RULES'}}; + my $url = $rulesetsources{$rulessettings{'RULES'}}; # Check if the vendor requires an oinkcode and add it if needed. - $url =~ s/\/$snortsettings{'OINKCODE'}/g; + $url =~ s/\/$rulessettings{'OINKCODE'}/g; # Abort if no url could be determined for the vendor. unless ($url) { @@ -147,21 +203,96 @@ sub downloadruleset { return 1; } + # Variable to store the filesize of the remote object. + my $remote_filesize; + + # The sourcfire (snort rules) does not allow to send "HEAD" requests, so skip this check + # for this webserver. + # + # Check if the ruleset source contains "snort.org". + unless ($url =~ /\.snort\.org/) { + # Pass the requrested url to the downloader. + my $request = HTTP::Request->new(HEAD => $url); + + # Accept the html header. + $request->header('Accept' => 'text/html'); + + # Perform the request and fetch the html header. + my $response = $downloader->request($request); + + # Check if there was any error. + unless ($response->is_success) { + # Obtain error. + my $error = $response->status_line(); + + # Log error message. + &_log_to_syslog("Unable to download the ruleset. \($error\)"); + + # Return "1" - false. + return 1; + } + + # Assign the fetched header object. + my $header = $response->headers(); + + # Grab the remote file size from the object and store it in the + # variable. + $remote_filesize = $header->content_length; + } + + # Load perl module to deal with temporary files. + use File::Temp; + + # Generate temporay file name, located in "/var/tmp" and with a suffix of ".tar.gz". + my $tmp = File::Temp->new( SUFFIX => ".tar.gz", DIR => "/var/tmp/", UNLINK => 0 ); + my $tmpfile = $tmp->filename(); + # Pass the requested url to the downloader. my $request = HTTP::Request->new(GET => $url); - # Perform the request and save the output into the "$rulestarball" file. - my $response = $downloader->request($request, $rulestarball); + # Perform the request and save the output into the tmpfile. + my $response = $downloader->request($request, $tmpfile); # Check if there was any error. unless ($response->is_success) { + # Obtain error. + my $error = $response->content; + # Log error message. - &_log_to_syslog("Unable to download the ruleset. $response->status_line"); + &_log_to_syslog("Unable to download the ruleset. \($error\)"); # Return "1" - false. return 1; } + # Load perl stat module. + use File::stat; + + # Perform stat on the tmpfile. + my $stat = stat($tmpfile); + + # Grab the local filesize of the downloaded tarball. + my $local_filesize = $stat->size; + + # Check if both file sizes match. + if (($remote_filesize) && ($remote_filesize ne $local_filesize)) { + # Log error message. + &_log_to_syslog("Unable to completely download the ruleset. "); + &_log_to_syslog("Only got $local_filesize Bytes instead of $remote_filesize Bytes. "); + + # Delete temporary file. + unlink("$tmpfile"); + + # Return "1" - false. + return 1; + } + + # Load file copy module, which contains the move() function. + use File::Copy; + + # Overwrite existing rules tarball with the new downloaded one. + move("$tmpfile", "$rulestarball"); + # If we got here, everything worked fine. Return nothing. return; } @@ -170,6 +301,12 @@ sub downloadruleset { ## A tiny wrapper function to call the oinkmaster script. # sub oinkmaster () { + # Check if the files in rulesdir have the correct permissions. + &_check_rulesdir_permissions(); + + # Cleanup the rules directory before filling it with the new rulest. + &_cleanup_rulesdir(); + # Load perl module to talk to the kernel syslog. use Sys::Syslog qw(:DEFAULT setlogsock); @@ -177,7 +314,7 @@ sub oinkmaster () { openlog('oinkmaster', 'cons,pid', 'user'); # Call oinkmaster to generate ruleset. - open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -v -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath|"); + open(OINKMASTER, "/usr/local/bin/oinkmaster.pl -s -u file://$rulestarball -C $settingsdir/oinkmaster.conf -o $rulespath 2>&1 |") or die "Could not execute oinkmaster $!\n"; # Log output of oinkmaster to syslog. while() { @@ -252,6 +389,9 @@ sub _store_error_message ($) { # Close file. close (ERRORFILE); + + # Set correct ownership for the file. + &set_ownership("$storederrorfile"); } # @@ -290,4 +430,539 @@ sub get_available_network_zones () { return @network_zones; } +# +## Function to check if the IDS is running. +# +sub ids_is_running () { + if(-f $idspidfile) { + # Open PID file for reading. + open(PIDFILE, "$idspidfile") or die "Could not open $idspidfile. $!\n"; + + # Grab the process-id. + my $pid = ; + + # Close filehandle. + close(PIDFILE); + + # Remove any newline. + chomp($pid); + + # Check if a directory for the process-id exists in proc. + if(-d "/proc/$pid") { + # The IDS daemon is running return the process id. + return $pid; + } + } + + # Return nothing - IDS is not running. + return; +} + +# +## Function to call suricatactrl binary with a given command. +# +sub call_suricatactrl ($) { + # Get called option. + my ($option, $interval) = @_; + + # Loop through the array of supported commands and check if + # the given one is part of it. + foreach my $cmd (@suricatactrl_cmds) { + # Skip current command unless the given one has been found. + next unless($cmd eq $option); + + # Check if the given command is "cron". + if ($option eq "cron") { + # Check if an interval has been given. + if ($interval) { + # Check if the given interval is valid. + foreach my $element (@cron_intervals) { + # Skip current element until the given one has been found. + next unless($element eq $interval); + + # Call the suricatactrl binary and pass the "cron" command + # with the requrested interval. + system("$suricatactrl $option $interval &>/dev/null"); + + # Return "1" - True. + return 1; + } + } + + # If we got here, the given interval is not supported or none has been given. - Return nothing. + return; + } else { + # Call the suricatactrl binary and pass the requrested + # option to it. + system("$suricatactrl $option &>/dev/null"); + + # Return "1" - True. + return 1; + } + } + + # Command not found - return nothing. + return; +} + +# +## Function to create a new empty file. +# +sub create_empty_file($) { + my ($file) = @_; + + # Check if the given file exists. + if(-e $file) { + # Do nothing to prevent from overwriting existing files. + return; + } + + # Open the file for writing. + open(FILE, ">$file") or die "Could not write to $file. $!\n"; + + # Close file handle. + close(FILE); + + # Return true. + return 1; +} + +# +## Private function to check if the file permission of the rulespath are correct. +## If not, call suricatactrl to fix them. +# +sub _check_rulesdir_permissions() { + # Check if the rulepath main directory is writable. + unless (-W $rulespath) { + # If not call suricatctrl to fix it. + &call_suricatactrl("fix-rules-dir"); + } + + # Open snort rules directory and do a directory listing. + opendir(DIR, $rulespath) or die $!; + # Loop through the direcory. + while (my $file = readdir(DIR)) { + # We only want files. + next unless (-f "$rulespath/$file"); + + # Check if the file is writable by the user. + if (-W "$rulespath/$file") { + # Everything is okay - go on to the next file. + next; + } else { + # There are wrong permissions, call suricatactrl to fix it. + &call_suricatactrl("fix-rules-dir"); + } + } +} + +# +## Private function to cleanup the directory which contains +## the IDS rules, before extracting and modifing the new ruleset. +# +sub _cleanup_rulesdir() { + # Open rules directory and do a directory listing. + opendir(DIR, $rulespath) or die $!; + + # Loop through the direcory. + while (my $file = readdir(DIR)) { + # We only want files. + next unless (-f "$rulespath/$file"); + + # Skip element if it has config as file extension. + next if ($file =~ m/\.config$/); + + # Delete the current processed file, if not, exit this function + # and return an error message. + unlink("$rulespath/$file") or return "Could not delete $rulespath/$file. $!\n"; + } + + # Return nothing; + return; +} + +# +## Function to generate the file which contains the home net information. +# +sub generate_home_net_file() { + my %netsettings; + + # Read-in network settings. + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + + # Get available network zones. + my @network_zones = &get_available_network_zones(); + + # Temporary array to store network address and prefix of the configured + # networks. + my @networks; + + # Loop through the array of available network zones. + foreach my $zone (@network_zones) { + # Check if the current processed zone is red. + if($zone eq "red") { + # Grab the IP-address of the red interface. + my $red_address = &get_red_address(); + + # Check if an address has been obtained. + if ($red_address) { + # Generate full network string. + my $red_network = join("/", $red_address, "32"); + + # Add the red network to the array of networks. + push(@networks, $red_network); + } + + # Check if the configured RED_TYPE is static. + if ($netsettings{'RED_TYPE'} eq "STATIC") { + # Get configured and enabled aliases. + my @aliases = &get_aliases(); + + # Loop through the array. + foreach my $alias (@aliases) { + # Add "/32" prefix. + my $network = join("/", $alias, "32"); + + # Add the generated network to the array of networks. + push(@networks, $network); + } + } + # Process remaining network zones. + } else { + # Convert current zone name into upper case. + $zone = uc($zone); + + # Generate key to access the required data from the netsettings hash. + my $zone_netaddress = $zone . "_NETADDRESS"; + my $zone_netmask = $zone . "_NETMASK"; + + # Obtain the settings from the netsettings hash. + my $netaddress = $netsettings{$zone_netaddress}; + my $netmask = $netsettings{$zone_netmask}; + + # Convert the subnetmask into prefix notation. + my $prefix = &Network::convert_netmask2prefix($netmask); + + # Generate full network string. + my $network = join("/", $netaddress,$prefix); + + # Check if the network is valid. + if(&Network::check_subnet($network)) { + # Add the generated network to the array of networks. + push(@networks, $network); + } + } + } + + # Format home net declaration. + my $line = "\"\["; + + # Loop through the array of networks. + foreach my $network (@networks) { + # Add the network to the line. + $line = "$line" . "$network"; + + # Check if the current network was the last in the array. + if ($network eq $networks[-1]) { + # Close the line. + $line = "$line" . "\]\""; + } else { + # Add "," for the next network. + $line = "$line" . "\,"; + } + } + + # Open file to store the addresses of the home net. + open(FILE, ">$homenet_file") or die "Could not open $homenet_file. $!\n"; + + # Print yaml header. + print FILE "%YAML 1.1\n"; + print FILE "---\n\n"; + + # Print notice about autogenerated file. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Print the generated and required HOME_NET declaration to the file. + print FILE "HOME_NET:\t$line\n"; + + # Close file handle. + close(FILE); +} + +# +## Function to generate and write the file for used rulefiles. +# +sub write_used_rulefiles_file(@) { + my @files = @_; + + # Open file for used rulefiles. + open (FILE, ">$used_rulefiles_file") or die "Could not write to $used_rulefiles_file. $!\n"; + + # Write yaml header to the file. + print FILE "%YAML 1.1\n"; + print FILE "---\n\n"; + + # Write header to file. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Allways use the whitelist. + print FILE " - whitelist.rules\n"; + + # Loop through the array of given files. + foreach my $file (@files) { + # Check if the given filename exists and write it to the file of used rulefiles. + if(-f "$rulespath/$file") { + print FILE " - $file\n"; + } + } + + # Close file after writing. + close(FILE); +} + +# +## Function to generate and write the file for modify the ruleset. +# +sub write_modify_sids_file($) { + my ($ruleaction) = @_; + + # Open modify sid's file for writing. + open(FILE, ">$modify_sids_file") or die "Could not write to $modify_sids_file. $!\n"; + + # Write file header. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Check if the traffic only should be monitored. + unless($ruleaction eq "alert") { + # Tell oinkmaster to switch all rules from alert to drop. + print FILE "modifysid \* \"alert\" \| \"drop\"\n"; + } + + # Close file handle. + close(FILE); +} + +# +## Function to gather the version of suricata. +# +sub get_suricata_version($) { + my ($format) = @_; + + # Execute piped suricata command and return the version information. + open(SURICATA, "suricata -V |") or die "Couldn't execute program: $!"; + + # Grab and store the output of the piped program. + my $version_string = ; + + # Close pipe. + close(SURICATA); + + # Remove newlines. + chomp($version_string); + + # Grab the version from the version string. + $version_string =~ /([0-9]+([.][0-9]+)+)/; + + # Splitt the version into single chunks. + my ($major_ver, $minor_ver, $patchlevel) = split(/\./, $1); + + # Check and return the requested version sheme. + if ($format eq "major") { + # Return the full version. + return "$major_ver"; + } elsif ($format eq "minor") { + # Return the major and minor part. + return "$major_ver.$minor_ver"; + } else { + # Return the full version string. + return "$major_ver.$minor_ver.$patchlevel"; + } +} + +# +## Function to generate the rules file with whitelisted addresses. +# +sub generate_ignore_file() { + my %ignored = (); + + # SID range 1000000-1999999 Reserved for Local Use + # Put your custom rules in this range to avoid conflicts + my $sid = 1500000; + + # Read-in ignoredfile. + &General::readhasharray($IDS::ignored_file, \%ignored); + + # Open ignorefile for writing. + open(FILE, ">$IDS::whitelist_file") or die "Could not write to $IDS::whitelist_file. $!\n"; + + # Config file header. + print FILE "# Autogenerated file.\n"; + print FILE "# All user modifications will be overwritten.\n\n"; + + # Add all user defined addresses to the whitelist. + # + # Check if the hash contains any elements. + if (keys (%ignored)) { + # Loop through the entire hash and write the host/network + # and remark to the ignore file. + while ( (my $key) = each %ignored) { + my $address = $ignored{$key}[0]; + my $remark = $ignored{$key}[1]; + my $status = $ignored{$key}[2]; + + # Check if the status of the entry is "enabled". + if ($status eq "enabled") { + # Check if the address/network is valid. + if ((&General::validip($address)) || (&General::validipandmask($address))) { + # Write rule line to the file to pass any traffic from this IP + print FILE "pass ip $address any -> any any (msg:\"pass all traffic from/to $address\"\; sid:$sid\;)\n"; + + # Increment sid. + $sid++; + } + } + } + } + + close(FILE); +} + +# +## Function to set correct ownership for single files and directories. +# + +sub set_ownership($) { + my ($target) = @_; + + # User and group of the WUI. + my $uname = "nobody"; + my $grname = "nobody"; + + # The chown function implemented in perl requies the user and group as nummeric id's. + my $uid = getpwnam($uname); + my $gid = getgrnam($grname); + + # Check if the given target exists. + unless ($target) { + # Stop the script and print error message. + die "The $target does not exist. Cannot change the ownership!\n"; + } + + # Check weather the target is a file or directory. + if (-f $target) { + # Change ownership ot the single file. + chown($uid, $gid, "$target"); + } elsif (-d $target) { + # Do a directory listing. + opendir(DIR, $target) or die $!; + # Loop through the direcory. + while (my $file = readdir(DIR)) { + + # We only want files. + next unless (-f "$target/$file"); + + # Set correct ownership for the files. + chown($uid, $gid, "$target/$file"); + } + + closedir(DIR); + + # Change ownership of the directory. + chown($uid, $gid, "$target"); + } +} + +# +## Function to read-in the aliases file and returns all configured and enabled aliases. +# +sub get_aliases() { + # Location of the aliases file. + my $aliases_file = "${General::swroot}/ethernet/aliases"; + + # Array to store the aliases. + my @aliases; + + # Check if the file is empty. + if (-z $aliases_file) { + # Abort nothing to do. + return; + } + + # Open the aliases file. + open(ALIASES, $aliases_file) or die "Could not open $aliases_file. $!\n"; + + # Loop through the file content. + while (my $line = ) { + # Remove newlines. + chomp($line); + + # Splitt line content into single chunks. + my ($address, $state, $remark) = split(/\,/, $line); + + # Check if the state of the current processed alias is "on". + if ($state eq "on") { + # Check if the address is valid. + if(&Network::check_ip_address($address)) { + # Add the alias to the array of aliases. + push(@aliases, $address); + } + } + } + + # Close file handle. + close(ALIASES); + + # Return the array. + return @aliases; +} + +# +## Function to grab the current assigned IP-address on red. +# +sub get_red_address() { + # File, which contains the current IP-address of the red interface. + my $file = "${General::swroot}/red/local-ipaddress"; + + # Check if the file exists. + if (-e $file) { + # Open the given file. + open(FILE, "$file") or die "Could not open $file."; + + # Obtain the address from the first line of the file. + my $address = ; + + # Close filehandle + close(FILE); + + # Remove newlines. + chomp $address; + + # Check if the grabbed address is valid. + if (&General::validip($address)) { + # Return the address. + return $address; + } + } + + # Return nothing. + return; +} + +# +## Function to write the lock file for locking the WUI, while +## the autoupdate script runs. +# +sub lock_ids_page() { + # Call subfunction to create the file. + &create_empty_file($ids_page_lock_file); +} + +# +## Function to release the lock of the WUI, again. +# +sub unlock_ids_page() { + # Delete lock file. + unlink($ids_page_lock_file); +} + 1;