install.pl

#!/usr/bin/perl -w
#
#######################################################################
#
# File: install.pl
#
# Purpose: This is the installation script for fwsnort.
#
# Copyright (C) 2003-2011 Michael Rash (mbr@cipherdyne.org)
#
# License (GNU Public License):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
#    USA
#
# TODO:
#   - Write the uninstall() routine.
#
#######################################################################
#

use Cwd;
use IO::Socket;
use File::Copy;
use File::Path;
use Getopt::Long;
use strict;

#========================= config ========================
my $fwsnort_conf_file = 'fwsnort.conf';

my $sbin_dir     = '/usr/sbin';
my $install_root = '/';

my $update_website = 'www.emergingthreats.net';

### system binaries
my $perlCmd = '/usr/bin/perl';
my $makeCmd = '/usr/bin/make';
my $wgetCmd = '/usr/bin/wget';
my $gzipCmd = '/bin/gzip';
my $tarCmd  = '/bin/tar';
#======================= end config ======================

my %config = ();

my @cmd_search_paths = qw(
    /bin
    /sbin
    /usr/bin
    /usr/sbin
    /usr/local/bin
    /usr/local/sbin
);

my %exclude_cmds = (
    'ip6tables' => ''
);

### map perl modules to versions
my %required_perl_modules = (
    'NetAddr::IP' => {
        'force-install' => 0,
        'mod-dir' => 'NetAddr-IP'
    },
    'IPTables::Parse' => {
        'force-install' => 1,
        'mod-dir' => 'IPTables-Parse'
    }
);

### rules update link
my $rules_url = 'http://rules.emergingthreats.net/open/snort-2.9.0/emerging-all.rules';

### establish some defaults
my $uninstall = 0;
my $skip_module_install   = 0;
my $cmdline_force_install = 0;
my $install_test_dir = 0;
my $force_mod_re = '';
my $exclude_mod_re = '';
my $deps_dir = 'deps';
my $is_root = 0;
my $help = 0;
my $locale = 'C';  ### default LC_ALL env variable
my $no_locale = 0;

my $src_dir = getcwd() or die "[*] Could not get current working directory.";

my %cmds = (
    'perl' => $perlCmd,
    'make' => $makeCmd,
    'gzip' => $gzipCmd,
    'wget' => $wgetCmd,
    'tar'  => $tarCmd
);

### make Getopts case sensitive
Getopt::Long::Configure('no_ignore_case');

&usage(1) unless (GetOptions(
    'force-mod-install' => \$cmdline_force_install,  ### force install of all modules
    'Force-mod-regex=s' => \$force_mod_re, ### force specific mod install with regex
    'Exclude-mod-regex=s' => \$exclude_mod_re, ### exclude a particular perl module
    'Skip-mod-install'  => \$skip_module_install,
    'rules-url=s' => \$rules_url,
    'uninstall' => \$uninstall, ### uninstall fwsnort
    'install-test-dir'  => \$install_test_dir,
    'LC_ALL=s'  => \$locale,
    'no-LC_ALL' => \$no_locale,
    'help'      => \$help
));

&usage(0) if $help;

### set LC_ALL env variable
$ENV{'LC_ALL'} = $locale unless $no_locale;

### make a copy of the original fwsnort.conf file and restore at the end
copy $fwsnort_conf_file, "${fwsnort_conf_file}.orig" or die "[*] Could not ",
    "copy $fwsnort_conf_file -> $fwsnort_conf_file.orig";

if ($install_test_dir) {
    $install_root = getcwd() . '/test/fwsnort-install';
}

&import_config();

$force_mod_re = qr|$force_mod_re| if $force_mod_re;
$exclude_mod_re = qr|$exclude_mod_re| if $exclude_mod_re;

### see if the deps/ directory exists, and if not then we are installing
### from the -nodeps sources so don't install any perl modules
$skip_module_install = 1 unless -d $deps_dir;

### make sure the system binaries are where we think they are.
&check_commands();

### check to make sure we are running as root
 die "You need to be root (or equivalent UID 0",
    " account) to install/uninstall fwsnort!\n" unless &is_root();

if ($uninstall) {
    &uninstall();
} else {
    &install()
}

### restore the original fwsnort.conf file (this is just the local one in the
### sources directory).
if (-e "${fwsnort_conf_file}.orig") {
    unlink $fwsnort_conf_file if -e $fwsnort_conf_file;
    move "${fwsnort_conf_file}.orig", $fwsnort_conf_file;
}

exit 0;
#===================== end main ===================

sub install() {
    die "[*] You must run install.pl from the fwsnort " .
        "sources directory." unless -e 'fwsnort' and -e 'fwsnort.conf';

    unless (-d $config{'CONF_DIR'}) {
        &full_mkdir($config{'CONF_DIR'}, 0500);
    }
    unless (-d $config{'RULES_DIR'}) {
        &full_mkdir($config{'RULES_DIR'}, 0500);
    }

    ### install perl modules
    unless ($skip_module_install) {
        for my $module (keys %required_perl_modules) {
            &install_perl_module($module);
        }
    }
    chdir $src_dir or die "[*] Could not chdir $src_dir: $!";

    my $local_rules_dir = 'deps/snort_rules';
    if (-d 'deps' and -d $local_rules_dir
            and &query_get_emerging_threats_sigs()) {
        chdir $local_rules_dir or die "[*] Could not chdir $local_rules_dir";
        if (-e 'emerging-all.rules') {
            move 'emerging-all.rules', 'emerging-all.rules.tmp'
                or die "[*] Could not move emerging-all.rules -> ",
                "emerging-all.rules.tmp";
        }
        system "$cmds{'wget'} $rules_url";
        if (-e 'emerging-all.rules') {  ### successful download
            unlink 'emerging-all.rules.tmp';
        } else {
            print "[-] Could not download emerging-all.rules file.\n";
            if (-e 'emerging-all.rules.tmp') {
                ### move the original back
                move 'emerging-all.rules', 'emerging-all.rules.tmp'
                    or die "[*] Could not move emerging-all.rules -> ",
                    "emerging-all.rules.tmp";
            }
        }
        chdir '../..';
    }

    if (-d 'deps' and -d $local_rules_dir) {
        opendir D, $local_rules_dir or die "[*] Could not open ",
            "the $local_rules_dir directory: $!";
        my @rfiles = readdir D;
        closedir D;

        print "[+] Copying all rules files to $config{'RULES_DIR'}\n";
        for my $rfile (@rfiles) {
            next unless $rfile =~ /\.rules$/;
            print "[+] Installing $rfile\n";
            copy "$local_rules_dir/${rfile}", "$config{'RULES_DIR'}/${rfile}"
                or die "[*] Could not copy $local_rules_dir/${rfile} ",
                    "-> $config{'RULES_DIR'}/${rfile}";
        }
    }

    print "\n";

    ### install the fwsnort.8 man page
    &install_manpage();

    my $preserve_rv = 0;
    if (-e "$config{'CONF_DIR'}/fwsnort.conf") {
        $preserve_rv = &query_preserve_config();
    }

    if ($preserve_rv) {
        &preserve_config();
    } else {
        print "[+] Copying fwsnort.conf -> $config{'CONF_DIR'}/fwsnort.conf\n";
        copy 'fwsnort.conf', "$config{'CONF_DIR'}/fwsnort.conf";
        chmod 0600, "$config{'CONF_DIR'}/fwsnort.conf";
    }

    print "[+] Copying fwsnort -> ${sbin_dir}/fwsnort\n";
    copy 'fwsnort', "${sbin_dir}/fwsnort";
    chmod 0500, "${sbin_dir}/fwsnort";

    print "\n========================================================\n",
        "\n[+] fwsnort will generate an iptables script located at:\n",
        "    /var/lib/fwsnort.sh when executed.\n",
        "\n[+] fwsnort has been successfully installed!\n\n";

    return;
}

sub install_perl_module() {
    my $mod_name = shift;

    chdir $src_dir or die "[*] Could not chdir $src_dir: $!";
    chdir $deps_dir or die "[*] Could not chdir($deps_dir): $!";

    die '[*] Missing force-install key in required_perl_modules hash.'
        unless defined $required_perl_modules{$mod_name}{'force-install'};
    die '[*] Missing mod-dir key in required_perl_modules hash.'
        unless defined $required_perl_modules{$mod_name}{'mod-dir'};

    if ($exclude_mod_re and $exclude_mod_re =~ /$mod_name/) {
        print "[+] Excluding installation of $mod_name module.\n";
        return;
    }

    my $version = '(NA)';

    my $mod_dir = $required_perl_modules{$mod_name}{'mod-dir'};

    if (-e "$mod_dir/VERSION") {
        open F, "< $mod_dir/VERSION" or
            die "[*] Could not open $mod_dir/VERSION: $!";
        $version = <F>;
        close F;
        chomp $version;
    } else {
        print "[-] Warning: VERSION file does not exist in $mod_dir\n";
    }

    my $install_module = 0;

    if ($required_perl_modules{$mod_name}{'force-install'}
            or $cmdline_force_install) {
        ### install regardless of whether the module may already be
        ### installed
        $install_module = 1;
    } elsif ($force_mod_re and $force_mod_re =~ /$mod_name/) {
        print "[+] Forcing installation of $mod_name module.\n";
        $install_module = 1;
    } else {
        if (has_perl_module($mod_name)) {
            print "[+] Module $mod_name is already installed in the ",
                "system perl tree, skipping.\n";
        } else {
            ### install the module in the /usr/lib/fwsnort directory because
            ### it is not already installed.
            $install_module = 1;
        }
    }

    if ($install_module) {
        unless (-d $config{'LIBS_DIR'}) {
            print "[+] Creating $config{'LIBS_DIR'}\n";
            &full_mkdir($config{'LIBS_DIR'}, 0755);
        }
        print "[+] Installing the $mod_name $version perl " .
            "module in $config{'LIBS_DIR'}/\n";
        my $mod_dir = $required_perl_modules{$mod_name}{'mod-dir'};
        chdir $mod_dir or die "[*] Could not chdir to ",
            "$mod_dir: $!";
        unless (-e 'Makefile.PL') {
            die "[*] Your $mod_name source directory appears to be incomplete!\n",
                "    Download the latest sources from ",
                "http://www.cipherdyne.org/\n";
        }
        system "$cmds{'make'} clean" if -e 'Makefile';
        system "$cmds{'perl'} Makefile.PL " .
            "PREFIX=$config{'LIBS_DIR'} LIB=$config{'LIBS_DIR'}";
        system $cmds{'make'};
#        system "$cmds{'make'} test";
        system "$cmds{'make'} install";

        print "\n\n";
    }
    chdir $src_dir or die "[*] Could not chdir $src_dir: $!";
    return;
}

sub has_perl_module() {
    my $module = shift;

    # 5.8.0 has a bug with require Foo::Bar alone in an eval, so an
    # extra statement is a workaround.
    my $file = "$module.pm";
    $file =~ s{::}{/}g;
    eval { require $file };

    return $@ ? 0 : 1;
}

sub uninstall() {
    ### FIXME
    return;
}

sub install_manpage() {
    my $manpage = 'fwsnort.8';
    ### remove old man page
    unlink "/usr/local/man/man8/${manpage}" if
        (-e "/usr/local/man/man8/${manpage}");

    ### default location to put the fwsnort man page, but check with
    ### /etc/man.config
    my $mpath = '/usr/share/man/man8';
    if (-e '/etc/man.config') {
        ### prefer to install $manpage in /usr/local/man/man8 if
        ### this directory is configured in /etc/man.config
        open M, '< /etc/man.config' or
            die "[*] Could not open /etc/man.config: $!";
        my @lines = <M>;
        close M;
        ### prefer the path "/usr/share/man"
        my $found = 0;
        for my $line (@lines) {
            chomp $line;
            if ($line =~ m|^MANPATH\s+/usr/share/man|) {
                $found = 1;
                last;
            }
        }
        ### try to find "/usr/local/man" if we didn't find /usr/share/man
        unless ($found) {
            for my $line (@lines) {
                chomp $line;
                if ($line =~ m|^MANPATH\s+/usr/local/man|) {
                    $mpath = '/usr/local/man/man8';
                    $found = 1;
                    last;
                }
            }
        }
        ### if we still have not found one of the above man paths,
        ### just select the first one out of /etc/man.config
        unless ($found) {
            for my $line (@lines) {
                chomp $line;
                if ($line =~ m|^MANPATH\s+(\S+)|) {
                    $mpath = $1;
                    last;
                }
            }
        }
    }
    &full_mkdir($mpath, 0755);
    my $mfile = "${mpath}/${manpage}";
    print "[+] Installing $manpage man page as $mfile\n";
    copy $manpage, $mfile or die "[*] Could not copy $manpage to " .
        "$mfile: $!";
    chmod 0644, $mfile;
    print "[+] Compressing manpage $mfile\n";
    ### remove the old one so gzip doesn't prompt us
    unlink "${mfile}.gz" if -e "${mfile}.gz";
    system "$gzipCmd $mfile";
    return;
}

sub query_get_emerging_threats_sigs() {
    return 0 if $install_test_dir;
    my $ans = '';
    print "[+] Would you like to download the latest Snort rules from \n",
        "    http://$update_website/?\n";
    while ($ans ne 'y' && $ans ne 'n') {
        print "    ([y]/n)?  ";
        $ans = <STDIN>;
        return 1 if $ans eq "\n";
        chomp $ans;
    }
    if ($ans eq 'y') {
        return 1;
    }
    return 0;
}

sub import_config() {
    open C, "< $fwsnort_conf_file"
        or die "[*] Could not open $fwsnort_conf_file: $!";
    while (<C>) {
        next if /^\s*#/;
        if (/^\s*(\S+)\s+(.*?)\;/) {
            my $varname = $1;
            my $val     = $2;
            if ($val =~ m|/.+| and $varname =~ /^\s*(\S+)Cmd$/) {
                ### found a command
                $cmds{$1} = $val;
            } else {
                $config{$varname} = $val;
            }
        }
    }
    close C;

    ### see if the install root is the same as the default in fwsnort.conf and
    ### update if not
    if ($install_root ne '/') {
        $install_root = getcwd() . "/$install_root"
            unless $install_root =~ m|^/|;
        $config{'INSTALL_ROOT'} = $install_root;
        $sbin_dir = $config{'INSTALL_ROOT'} . $sbin_dir;

        &put_var('INSTALL_ROOT', $install_root, $fwsnort_conf_file);
    }

    ### resolve internal vars within variable values
    &expand_vars();

    for my $dir ($install_root,
            $sbin_dir,
            $config{'LOG_DIR'},
            $config{'LIBS_DIR'},
            $config{'STATE_DIR'},
            $config{'QUEUE_RULES_DIR'},
            $config{'ARCHIVE_DIR'},
        ) {
        &full_mkdir($dir, 0755) unless -d $dir;
    }

    &required_vars();

    return;
}

sub expand_vars() {

    my $has_sub_var = 1;
    my $resolve_ctr = 0;

    while ($has_sub_var) {
        $resolve_ctr++;
        $has_sub_var = 0;
        if ($resolve_ctr >= 20) {
            die "[*] Exceeded maximum variable resolution counter.";
        }
        for my $hr (\%config, \%cmds) {
            for my $var (keys %$hr) {
                my $val = $hr->{$var};
                if ($val =~ m|\$(\w+)|) {
                    my $sub_var = $1;
                    die "[*] sub-ver $sub_var not allowed within same ",
                        "variable $var" if $sub_var eq $var;
                    if (defined $config{$sub_var}) {
                        if ($sub_var eq 'INSTALL_ROOT' and $config{$sub_var} eq '/') {
                            $val =~ s|\$$sub_var||;
                        } else {
                            $val =~ s|\$$sub_var|$config{$sub_var}|;
                        }
                        $hr->{$var} = $val;
                    } else {
                        die "[*] sub-var \"$sub_var\" not defined in ",
                            "config for var: $var."
                    }
                    $has_sub_var = 1;
                }
            }
        }
    }
    return;
}

sub put_var() {
    my ($var, $value, $file) = @_;

    open RF, "< $file" or die "[*] Could not open $file: $!";
    my @lines = <RF>;
    close RF;
    open F, "> $file" or die "[*] Could not open $file: $!";
    for my $line (@lines) {
        if ($line =~ /^\s*$var\s+.*;/) {
            printf F "%-24s%s;\n", $var, $value;
        } else {
            print F $line;
        }
    }
    close F;
    return;
}

sub required_vars() {
    my @required_vars = qw(
        CONF_DIR RULES_DIR ARCHIVE_DIR QUEUE_RULES_DIR LOG_DIR LIBS_DIR
        CONF_FILE FWSNORT_SCRIPT LOG_FILE
    );
    for my $var (@required_vars) {
        die "[*] Variable $var not defined in $fwsnort_conf_file. Exiting.\n"
            unless defined $config{$var};
    }
    return;
}

### check paths to commands and attempt to correct if any are wrong.
sub check_commands() {

    CMD: for my $cmd (keys %cmds) {
        next CMD if defined $exclude_cmds{$cmd};
        unless (-x $cmds{$cmd}) {
            my $found = 0;
            PATH: for my $dir (@cmd_search_paths) {
                if (-x "${dir}/${cmd}") {
                    $cmds{$cmd} = "${dir}/${cmd}";
                    $found = 1;
                    last PATH;
                }
            }
            unless ($found) {
                die "\n[*] Could not find $cmd anywhere!!!  ",
                    "Please edit the config section to include the path to ",
                    "$cmd.";
            }
        }
        unless (-x $cmds{$cmd}) {
            return unless &is_root();
            die "\n[*] $cmd is located at ",
                "$cmds{$cmd} but is not executable by uid: $<";
        }
    }
    return;
}

sub is_root() {
    if ($< == 0 and $> == 0) {
        $is_root = 1;
    }
    return $is_root;
}

sub query_preserve_config() {
    return 0 if $install_test_dir;
    my $ans = '';
    while ($ans ne 'y' && $ans ne 'n') {
        print "[+] Would you like to preserve the config from the\n",
            '    existing fwsnort installation ([y]/n)?  ';
        $ans = <STDIN>;
        return 1 if $ans eq "\n";
        chomp $ans;
    }
    if ($ans eq 'y') {
        return 1;
    }
    return 0;
}

sub preserve_config() {
    my $file = 'fwsnort.conf';
    open C, "< $file" or die "[*] Could not open $file: $!";
    my @new_lines = <C>;
    close C;

    open CO, "< $config{'CONF_DIR'}/$file" or die "[*] Could not open ",
        "$config{'CONF_DIR'}/$file: $!";
    my @orig_lines = <CO>;
    close CO;

    print "[+] Preserving existing config: $config{'CONF_DIR'}/$file\n";
    ### write to a tmp file and then move.
    my $printed_intf_warning = 0;
    open CONF, "> $config{'CONF_DIR'}/${file}.new" or die "[*] Could not open ",
        "$config{'CONF_DIR'}/${file}.new: $!";
    for my $new_line (@new_lines) {
        if ($new_line =~ /^\s*#/) {
            print CONF $new_line;
        } elsif ($new_line =~ /^\s*(\S+)/) {
            my $var = $1;
            my $found = 0;
            for my $orig_line (@orig_lines) {
                if ($orig_line =~ /^\s*\S+INTF\s/) {
                    ### interfaces are no longer used!
                    unless ($printed_intf_warning) {
                        print "    NOTE: Interfaces are no longer used as of the ",
                        "0.8.0 release;\n    removing $var\n";
                        $printed_intf_warning = 1;
                    }
                }
                if ($orig_line =~ /^\s*$var\s/
                        and $orig_line !~ /INTF/) {
                    print CONF $orig_line;
                    $found = 1;
                    last;
                }
            }
            unless ($found) {
                print CONF $new_line;
            }
        } else {
            print CONF $new_line;
        }
    }
    close CONF;
    move "$config{'CONF_DIR'}/${file}.new", "$config{'CONF_DIR'}/$file";
    return;
}

sub full_mkdir() {
    my ($dir, $perms) = @_;

    my @dirs = split /\//, $dir;
    my $path = $dirs[0];
    shift @dirs;
    for my $d (@dirs) {
        next unless $d and $d =~ /\S/;
        $path .= "/$d";
        unless (-d $path) {
            printf "[+] mkdir $path, %o\n", $perms;
            mkdir $path, $perms or die "[*] Could not mkdir($path): $!";
        }
    }
    return;
}

sub usage() {
    my $exit = shift;
    print <<_HELP_;
install.pl: [options]
    -f, --force-mod-install        - Install all perl modules regardless
                                     of whether they already installed on
                                     the system.
    -F, --Force-mod-regex <regex>  - Install perl module that matches a
                                     specific regular expression.
    -E, --Exclude-mod-regex <re>   - Exclude a perl module that matches this
                                     regular expression.
    -S, --Skip-mod-install         - Skip installation of modules.
    -r, --rules-url <url>          - Specify the URL to use for updating the
                                     Emerging Threats rule set - the default is:
                                     $rules_url
    --install-test-dir             - Install fwsnort in test/fwsnort-install
                                     for test suite.
    -u, --uninstall   - uninstall fwsnort
    -h, --help        - print help and exit
_HELP_
    exit $exit;
}