# TIE: Update Snort network addresses plug-in function

#

# doSnortNetworkAddressesPlugin()

# Temporary fix for problem identified by Nick see:

# http://www.clearfoundation.com/component/option,com_kunena/Itemid,232/catid,8/func,view/id,60799/

#

SNORT_NETWORK_ADDRESSES_PLUGIN_VERSION=1.0 # Script version



IPCALC=/bin/ipcalc

DO_SNORT_NETWORK_ADDRESSES_PLUGIN_ENABLED="$TRUE"

doSnortNetworkAddressesPlugin() {

  doDebug "Enter function doSnortNetworkAddressesPlugin() ..."



  if [[ ! -x "$IPCALC" ]]; then 

    doWarning "doSnortNetworkAddressesPlugin() "$IPCALC" executable does not exist or is improperly configured. Can not check the snort network addresses being protecting"

    doDebug "Exit function doSnortNetworkAddressesPlugin() missing executable "$IPCALC". Can not check SNORT config: "$SNORT_CONF" ipvar HOME_NET variable"

    return "$FAILED"

  fi



  local serverNetworkAddresses=""

  local missingNetworkAddress="$FALSE"

  # Retrieve list of nics

  local nics="$(ifconfig | grep -E "encap:Ethernet|encap:Point-to-Point" | cut -d' ' -f1)"



  for i in ${nics[@]}; do

    local ip="$(ifconfig "$i" | sed -rn 's/.*r[^ ]+) .*/\1/p')" # Retrieve ip from ifconfig

    local netmask="$(ifconfig "$i" | sed -rn 's/.*k[^ ]+).*/\1/p')" # Retrieve netmask from ifconfig



    if doExist "$ip" && doExist "$netmask"; then

      if ! eval "$("$IPCALC" -np "$ip" "$netmask")"; then # Convert ip to network ip and netmask to prefix

        doError "doSnortNetworkAddressesPlugin() Was not able to execute command: "$IPCALC" -np "$ip" "$netmask""

        doDebug "Exit function doSnortNetworkAddressesPlugin() with exit code: "$FAILED""

        return "$FAILED"

      fi

      doDebug "doSnortNetworkAddressesPlugin() Found Interface: "$i", IP Address: "$ip", Netmask: "$netmask", Network: "$NETWORK", Prefix: "$PREFIX""



      if [[ "$PREFIX" -eq 32 ]]; then

        serverNetworkAddresses="$serverNetworkAddresses","$NETWORK" # Prefix probably would work but not necessary

      else

        serverNetworkAddresses="$serverNetworkAddresses","$NETWORK"\\/"$PREFIX"

      fi



      if [[ $(grep "^ *ipvar HOME_NET.*$NETWORK" "$SNORT_CONF" | wc -l) -eq 0 ]]; then

        missingNetworkAddress="$TRUE"

        doWarning "doSnortNetworkAddressesPlugin() Found "$SNORT_CONF" Network Addresses ipvar HOME_NET variable:"

        doWarning ""$(grep "^ *ipvar HOME_NET " "$SNORT_CONF")"" # There is a character retrieved from the grep making my logging function fail.

        doWarning "doSnortNetworkAddressesPlugin() Was not able to find one of the following current network addresses: "$serverNetworkAddresses","$NETWORK"/"$PREFIX" in file: "$SNORT_CONF""

      fi

    else

      doDebug "doSnortNetworkAddressesPlugin() Found Interface: "$i" with no IP Address."

    fi

  done



  # No changes

  if ! "$missingNetworkAddress"; then

    doDebug "Exit function doSnortNetworkAddressesPlugin() with exit code: "$SUCCESS""

    return "$SUCCESS"

  fi



  # Substitute current addresses for new ones

  local snortNetworkAddresses="$(grep "^ *ipvar HOME_NET " "$SNORT_CONF")"  

  local snortNetworkAddresses=${snortNetworkAddresses//\//\\\/}

  local snortNetworkAddresses=${snortNetworkAddresses//[/\\[}

  local snortNetworkAddresses=${snortNetworkAddresses//]/\\]}

  sed -i -r "s/$snortNetworkAddresses/ipvar HOME_NET \[${serverNetworkAddresses:1}\]/" "$SNORT_CONF"

  doWarning "doSnortNetworkAddressesPlugin() Replace "$SNORT_CONF" Network Addresses ipvar HOME_NET variable with: "${serverNetworkAddresses:1}""

  local stdErr="$(service snort restart 2>&1 > /dev/null)"

  if [[ "$?" -eq 0 ]]; then

    doNotice "doSnortNetworkAddressesPlugin() Snort Service Restarted..."

  else

    doError "Ouch ... failed to start Snort"

    if doExist "$stdErr"; then

      doDebug "doSnortNetworkAddressesPlugin() "$stdErr""

    fi

    doDebug "Exit function doSnortNetworkAddressesPlugin() with exit code: "$FAILED""

    return "$FAILED"

  fi



  doDebug "Exit function doSnortNetworkAddressesPlugin() with exit code: "$SUCCESS""

  return "$SUCCESS"

}