Skip to content

Commit

Permalink
Merge pull request #654 from bmeeks8/pfSense-pkg-snort-4.0_2
Browse files Browse the repository at this point in the history
  • Loading branch information
@rbgarga
rbgarga committed Jun 25, 2019
2 parents c52e392 + 6f5d1b6 commit 89c139a
Show file tree
Hide file tree
Showing 12 changed files with 310 additions and 222 deletions.
2 changes: 1 addition & 1 deletion security/pfSense-pkg-snort/Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

PORTNAME= pfSense-pkg-snort
PORTVERSION= 4.0
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= security
MASTER_SITES= # empty
DISTFILES= # empty
Expand Down
132 changes: 66 additions & 66 deletions security/pfSense-pkg-snort/files/usr/local/pkg/snort/snort.inc
View file

Large diffs are not rendered by default.

34 changes: 19 additions & 15 deletions security/pfSense-pkg-snort/files/usr/local/pkg/snort/snort_check_cron_misc.inc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@
* snort_check_cron_misc.inc
*
* part of pfSense (https://www.pfsense.org)
* Copyright (c) 2018 Rubicon Communications, LLC (Netgate)
* Copyright (c) 2019 Rubicon Communications, LLC (Netgate)
* Copyright (c) 2009-2010 Robert Zelaya
* Copyright (c) 2018 Bill Meeks
* Copyright (c) 2019 Bill Meeks
* All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
Expand Down Expand Up @@ -44,11 +44,11 @@ function snort_check_dir_size_limit($snortloglimitsize) {
$snortloglimitsizeKB = round($snortloglimitsize * 1024);
$snortlogdirsizeKB = snort_Getdirsize(SNORTLOGDIR);
if ($snortlogdirsizeKB > 0 && $snortlogdirsizeKB > $snortloglimitsizeKB) {
log_error(gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated."));
syslog(LOG_NOTICE, gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated."));

// Truncate the Rules Update Log file if it exists
if (file_exists(SNORT_RULES_UPD_LOGFILE)) {
log_error(gettext("[Snort] Truncating the Rules Update Log file..."));
syslog(LOG_NOTICE, gettext("[Snort] Truncating the Rules Update Log file..."));
@file_put_contents(SNORT_RULES_UPD_LOGFILE, "");
}

Expand All @@ -57,12 +57,16 @@ function snort_check_dir_size_limit($snortloglimitsize) {
$if_real = get_real_interface($value['interface']);
$snort_uuid = $value['uuid'];
$snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}";
log_error(gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})..."));
syslog(LOG_NOTICE, gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})..."));
snort_post_delete_logs($snort_uuid);

// Truncate the alert log file if it exists
if (file_exists("{$snort_log_dir}/alert")) {
@file_put_contents("{$snort_log_dir}/alert", "");
try {
fclose(fopen("{$snort_log_dir}/alert", 'w'));
} catch (Exception $e) {
syslog(LOG_ERR, gettext("[Snort] ERROR: Failed to truncate file '{$snort_log_dir}/alert' -- error was {$e->getMessage()}"));
}
}

// Cleanup any perfmon stats logs
Expand All @@ -85,11 +89,11 @@ function snort_check_dir_size_limit($snortloglimitsize) {

// Soft-restart Snort process to resync logging
if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
log_error(gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})..."));
syslog(LOG_NOTICE, gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})..."));
mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a");
}
}
log_error(gettext("[Snort] Automatic clean-up of Snort logs completed."));
syslog(LOG_NOTICE, gettext("[Snort] Automatic clean-up of Snort logs completed."));
}
}

Expand Down Expand Up @@ -120,10 +124,10 @@ function snort_check_rotate_log($log_file, $log_limit, $retention) {
if (($log_limit > 0) && (filesize($log_file) >= $log_limit)) {
$newfile = $log_file . "." . strval(time());
try {
copy($log_file, $newfile);
file_put_contents($log_file, "");
rename($log_file, $newfile);
touch($log_file);
} catch (Exception $e) {
log_error("[Snort] Failed to rotate file '{$log_file}' -- error was {$e->getMessage()}");
syslog(LOG_ERR, "[Snort] Failed to rotate file '{$log_file}' -- error was {$e->getMessage()}");
}
}

Expand Down Expand Up @@ -190,7 +194,7 @@ if ($config['installedpackages']['snortglobal']['enable_log_mgmt'] == 'on') {
}
unset($rotated_files);
if ($prune_count > 0)
log_error(gettext("[Snort] Alert pcap file cleanup job removed {$prune_count} pcap file(s) from {$snort_log_dir}/..."));
syslog(LOG_NOTICE, gettext("[Snort] Alert pcap file cleanup job removed {$prune_count} pcap file(s) from {$snort_log_dir}/..."));
}

// Prune any aged-out Barnyard2 archived logs if any exist
Expand All @@ -206,7 +210,7 @@ if ($config['installedpackages']['snortglobal']['enable_log_mgmt'] == 'on') {
}
unset($files);
if ($prune_count > 0)
log_error(gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/barnyard2/archive/..."));
syslog(LOG_NOTICE, gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/barnyard2/archive/..."));
}

// Prune aged-out perfmon stats logs if any exist
Expand All @@ -227,7 +231,7 @@ if ($config['installedpackages']['snortglobal']['enable_log_mgmt'] == 'on') {
}
unset($list, $files);
if ($prune_count > 0)
log_error(gettext("[Snort] perfmon stats logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/..."));
syslog(LOG_NOTICE, gettext("[Snort] perfmon stats logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/..."));
}

// Prune any aged-out AppID stats logs if any exist
Expand All @@ -243,7 +247,7 @@ if ($config['installedpackages']['snortglobal']['enable_log_mgmt'] == 'on') {
}
unset($files);
if ($prune_count > 0)
log_error(gettext("[Snort] AppID stats logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/..."));
syslog(LOG_NOTICE, gettext("[Snort] AppID stats logs cleanup job removed {$prune_count} file(s) from {$snort_log_dir}/..."));
}
}
}
Expand Down
35 changes: 17 additions & 18 deletions security/pfSense-pkg-snort/files/usr/local/pkg/snort/snort_check_for_rule_updates.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -222,8 +222,8 @@ function snort_download_file_url($url, $file_out) {
$rc = curl_exec($ch);
if ($rc === true)
break;
log_error(gettext("[Snort] Rules download error: " . curl_error($ch)));
log_error(gettext("[Snort] Will retry in 15 seconds..."));
syslog(LOG_ERR, gettext("[Snort] Rules download error: " . curl_error($ch)));
syslog(LOG_ERR, gettext("[Snort] Will retry in 15 seconds..."));
sleep(15);
}
if ($rc === false)
Expand All @@ -236,12 +236,12 @@ function snort_download_file_url($url, $file_out) {

// If we had to try more than once, log it
if ($counter > 1)
log_error(gettext("File '" . basename($file_out) . "' download attempts: {$counter} ..."));
syslog(LOG_NOTICE, gettext("File '" . basename($file_out) . "' download attempts: {$counter} ..."));
return ($http_code == 200) ? true : $http_code;
}
else {
$last_curl_error = gettext("Failed to create file " . $file_out);
log_error(gettext("[Snort] Failed to create file {$file_out} ..."));
syslog(LOG_ERR, gettext("[Snort] Failed to create file {$file_out} ..."));
return false;
}
}
Expand Down Expand Up @@ -286,7 +286,7 @@ function snort_check_rule_md5($file_url, $file_dst, $desc = "") {
snort_update_status(gettext(" done.") . "\n");
if ($md5_check_new == $md5_check_old) {
snort_update_status(gettext("{$desc} are current. No update required.") . "\n");
log_error(gettext("[Snort] {$desc} are up to date..."));
syslog(LOG_NOTICE, gettext("[Snort] {$desc} are up to date..."));
error_log(gettext("\t{$desc} are up to date.\n"), 3, SNORT_RULES_UPD_LOGFILE);
return false;
}
Expand All @@ -303,8 +303,8 @@ function snort_check_rule_md5($file_url, $file_dst, $desc = "") {
snort_update_status(gettext(" FAILED!") . "\n");
snort_update_status(gettext("{$desc} md5 error ... Server returned error code {$rc} ...") . "\n");
snort_update_status(gettext("{$desc} will not be updated.\n{$snort_err_msg}") . "\n");
log_error(gettext("[Snort] {$desc} md5 download failed..."));
log_error(gettext("[Snort] Server returned error code {$rc}..."));
syslog(LOG_ERR, gettext("[Snort] {$desc} md5 download failed..."));
syslog(LOG_ERR, gettext("[Snort] Server returned error code {$rc}..."));
error_log(gettext("\t{$snort_err_msg}\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\tServer error message was: {$last_curl_error}\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\t{$desc} will not be updated.\n"), 3, SNORT_RULES_UPD_LOGFILE);
Expand Down Expand Up @@ -338,23 +338,23 @@ function snort_fetch_new_rules($file_url, $file_dst, $file_md5, $desc = "") {
$filename = basename($file_dst);

snort_update_status(gettext("There is a new set of {$desc} posted.\nDownloading {$filename}..."));
log_error(gettext("[Snort] There is a new set of {$desc} posted. Downloading {$filename}..."));
syslog(LOG_NOTICE, gettext("[Snort] There is a new set of {$desc} posted. Downloading {$filename}..."));
error_log(gettext("\tThere is a new set of {$desc} posted.\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\tDownloading file '{$filename}'...\n"), 3, SNORT_RULES_UPD_LOGFILE);
$rc = snort_download_file_url($file_url, $file_dst);

// See if the download from the URL was successful
if ($rc === true) {
snort_update_status(gettext(" done.") . "\n");
log_error("[Snort] {$desc} file update downloaded successfully");
syslog(LOG_NOTICE, "[Snort] {$desc} file update downloaded successfully");
error_log(gettext("\tDone downloading rules file.\n"),3, SNORT_RULES_UPD_LOGFILE);

// Test integrity of the rules file. Turn off update if file has wrong md5 hash
if ($file_md5 != trim(md5_file($file_dst))){
snort_update_status(gettext("{$desc} file MD5 checksum failed...") . "\n");
log_error(gettext("[Snort] {$desc} file download failed. Bad MD5 checksum..."));
log_error(gettext("[Snort] Downloaded File MD5: " . md5_file($file_dst)));
log_error(gettext("[Snort] Expected File MD5: {$file_md5}"));
syslog(LOG_ERR, gettext("[Snort] {$desc} file download failed. Bad MD5 checksum..."));
syslog(LOG_ERR, gettext("[Snort] Downloaded File MD5: " . md5_file($file_dst)));
syslog(LOG_ERR, gettext("[Snort] Expected File MD5: {$file_md5}"));
error_log(gettext("\t{$desc} file download failed. Bad MD5 checksum.\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\tDownloaded {$desc} file MD5: " . md5_file($file_dst) . "\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\tExpected {$desc} file MD5: {$file_md5}\n"), 3, SNORT_RULES_UPD_LOGFILE);
Expand All @@ -367,7 +367,7 @@ function snort_fetch_new_rules($file_url, $file_dst, $file_md5, $desc = "") {
else {
snort_update_status(gettext(" FAILED!") . "\n");
snort_update_status(gettext("{$desc} file download failed... server returned error '{$rc}'.") . "\n");
log_error(gettext("[Snort] {$desc} file download failed... server returned error '{$rc}'..."));
syslog(LOG_ERR, gettext("[Snort] {$desc} file download failed... server returned error '{$rc}'..."));
error_log(gettext("\t{$desc} file download failed. Server returned error {$rc}.\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\tThe error text was: {$last_curl_error}\n"), 3, SNORT_RULES_UPD_LOGFILE);
error_log(gettext("\t{$desc} will not be updated.\n"), 3, SNORT_RULES_UPD_LOGFILE);
Expand All @@ -387,7 +387,6 @@ function snort_fetch_new_rules($file_url, $file_dst, $file_md5, $desc = "") {

/* Make sure required snortdirs exsist */
safe_mkdir("{$snortdir}/rules");
safe_mkdir("{$snortdir}/signatures");
safe_mkdir("{$snortdir}/preproc_rules");
safe_mkdir("{$tmpfname}");
safe_mkdir("{$snortlibdir}/snort_dynamicrules");
Expand Down Expand Up @@ -668,7 +667,7 @@ function snort_fetch_new_rules($file_url, $file_dst, $file_md5, $desc = "") {

// If removing deprecated rules categories, then do it
if ($config['installedpackages']['snortglobal']['hide_deprecated_rules'] == "on") {
log_error(gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories."));
syslog(LOG_NOTICE, gettext("[Snort] Hide Deprecated Rules is enabled. Removing obsoleted rules categories."));
snort_remove_dead_rules();
}

Expand Down Expand Up @@ -787,7 +786,7 @@ function snort_apply_customizations($snortcfg, $if_real) {
sleep(3);
unlink_if_exists("{$g['varrun_path']}/snort_pkg_starting.lck");
snort_update_status(gettext(" done.") . "\n");
log_error(gettext("[Snort] Snort has restarted with your new set of rules..."));
syslog(LOG_NOTICE, gettext("[Snort] Snort has restarted with your new set of rules..."));
error_log(gettext("\tSnort has restarted with your new set of rules.\n"), 3, SNORT_RULES_UPD_LOGFILE);
}
}
Expand All @@ -804,7 +803,7 @@ function snort_apply_customizations($snortcfg, $if_real) {
sleep(2);
unlink_if_exists("{$g['varrun_path']}/snort_pkg_starting.lck");
snort_update_status(gettext(" done.") . "\n");
log_error(gettext("[Snort] Snort has restarted with your new set of OpenAppID detectors..."));
syslog(LOG_NOTICE, gettext("[Snort] Snort has restarted with your new set of OpenAppID detectors..."));
error_log(gettext("\tSnort has restarted with your new set of OpenAppID detectors.\n"), 3, SNORT_RULES_UPD_LOGFILE);
}
}
Expand All @@ -817,7 +816,7 @@ function snort_apply_customizations($snortcfg, $if_real) {
}

snort_update_status(gettext("The Rules update has finished.") . "\n");
log_error(gettext("[Snort] The Rules update has finished."));
syslog(LOG_NOTICE, gettext("[Snort] The Rules update has finished."));
error_log(gettext("The Rules update has finished. Time: " . date("Y-m-d H:i:s"). "\n\n"), 3, SNORT_RULES_UPD_LOGFILE);

/* Save this update status to the configuration file */
Expand Down

0 comments on commit 89c139a

Please sign in to comment.