Upgrade to 3.2.0. Added LUA and NOFW options. Improved plist.sh scripts.

7 files changed, 61 insertions, 50 deletions

diff --git a/security/ossec-hids-local-config/Makefile b/security/ossec-hids-local-config/Makefile
index 44edf99..7b8390d 100644
--- a/security/ossec-hids-local-config/Makefile
+++ b/security/ossec-hids-local-config/Makefile
@@ -1,8 +1,8 @@
 # $FreeBSD: head/security/ossec-hids-local-config/Makefile 485977 2018-11-27 01:58:02Z swills $
 
 PORTNAME=	ossec-hids
-PORTVERSION=	3.1.0
-PORTREVISION=	1
+PORTVERSION=	3.2.0
+PORTREVISION=
 CATEGORIES=	security
 PKGNAMESUFFIX=	-${OSSEC_TYPE}-config
 
@@ -47,14 +47,15 @@ NO_ARCH=	yes
 OPTIONS_SUB=			yes
 
 OPTIONS_SINGLE=			FIREWALL
-OPTIONS_SINGLE_FIREWALL=	IPF IPFW PF
+OPTIONS_SINGLE_FIREWALL=	NOFW IPF IPFW PF
 
-OPTIONS_DEFAULT+=		IPF
+OPTIONS_DEFAULT+=		NOFW
 
 FIREWALL_DESC=		Active Response Firewall
 PF_DESC=		Packet Filter
 IPFW_DESC=		ipfirewall
 IPF_DESC=		ipfilter
+NOFW_DESC=		Custom or no firewall
 
 TEMPL_ENABLED_HEADER=		template-header-enabled.xml
 TEMPL_DISABLED_HEADER=		template-header-disabled.xml
@@ -68,6 +69,7 @@ TEMPL_SAMPLE_DB=	template-sample-database.xml
 PF_VARS=		FW_DROP=pf.sh PKGMSG_FILES+=message-pf
 IPFW_VARS=		FW_DROP=ipfw.sh
 IPF_VARS=		FW_DROP=ipfilter.sh
+NOFW_VARS=		FW_DROP=
 
 .if defined(MAINTAINER_MODE)
 OSSEC_HOME=		${PREFIX}/${PORTNAME}
diff --git a/security/ossec-hids-local-config/distinfo b/security/ossec-hids-local-config/distinfo
index 38a6c3c..78bdadd 100644
--- a/security/ossec-hids-local-config/distinfo
+++ b/security/ossec-hids-local-config/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1539459620
-SHA256 (ossec-ossec-hids-3.1.0_GH0.tar.gz) = e0e2987751badb95c2bf618531c7853b2289c910f796da85ff394c0faea43f50
-SIZE (ossec-ossec-hids-3.1.0_GH0.tar.gz) = 1886469
+TIMESTAMP = 1553010491
+SHA256 (ossec-ossec-hids-3.2.0_GH0.tar.gz) = b36cc4db73c265f5fd65f2b5450d69e332316612b5602a3e310ae8907e9d2548
+SIZE (ossec-ossec-hids-3.2.0_GH0.tar.gz) = 1896977
diff --git a/security/ossec-hids-local-config/files/pkg-deinstall.in b/security/ossec-hids-local-config/files/pkg-deinstall.in
index 0de19bf..f9f3e7e 100644
--- a/security/ossec-hids-local-config/files/pkg-deinstall.in
+++ b/security/ossec-hids-local-config/files/pkg-deinstall.in
@@ -1,10 +1,19 @@
 #!/bin/sh
 
 ossec_home="%%OSSEC_HOME%%"
+fw_drop="%%FW_DROP%%"
+
+ar_bin_dir="${ossec_home}/active-response/bin"
 ossec_conf="${ossec_home}/etc/ossec.conf"
 agent_conf="${ossec_home}/etc/shared/agent.conf"
 
 if [ "$2" == "DEINSTALL"  ]; then
     rm -f "${ossec_conf}"
     rm -f "${agent_conf}"
+
+    if [ -n "${fw_drop}" ]; then
+        if [ "${ar_bin_dir}/${fw_drop}" -ef "${ar_bin_dir}/firewall-drop.sh" ]; then
+            rm -f "${ar_bin_dir}/firewall-drop.sh"
+        fi
+    fi
 fi
diff --git a/security/ossec-hids-local-config/files/pkg-install.in b/security/ossec-hids-local-config/files/pkg-install.in
index f164b9c..b8af2c8 100644
--- a/security/ossec-hids-local-config/files/pkg-install.in
+++ b/security/ossec-hids-local-config/files/pkg-install.in
@@ -1,6 +1,8 @@
 #!/bin/sh
 
 ossec_home="%%OSSEC_HOME%%"
+fw_drop="%%FW_DROP%%"
+
 ar_bin_dir="${ossec_home}/active-response/bin"
 ossec_conf="${ossec_home}/etc/ossec.conf"
 ossec_conf_bak="${ossec_conf}.bak"
@@ -8,7 +10,9 @@ agent_conf="${ossec_home}/etc/shared/agent.conf"
 agent_conf_bak="${ossec_home}/etc/agent.conf.bak"
 
 if [ "$2" == "POST-INSTALL"  ]; then
-    ln -f "${ar_bin_dir}/%%FW_DROP%%" "${ar_bin_dir}/firewall-drop.sh"
+    if [ -n "${fw_drop}" ]; then
+        ln -f "${ar_bin_dir}/${fw_drop}" "${ar_bin_dir}/firewall-drop.sh"
+    fi
 
     if [ -e "${ossec_conf}" ]; then
         mv -f "${ossec_conf}" "${ossec_conf_bak}"
diff --git a/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in
index 37c2166..6591f57 100644
--- a/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in
+++ b/security/ossec-hids-local-config/files/template-rootcheck-basic.xml.in
@@ -15,6 +15,7 @@
   <rootcheck>
     <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
     <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+    <system_audit>/var/ossec/etc/shared/system_audit_pw.txt</system_audit>
     <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
     <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
   </rootcheck>
diff --git a/security/ossec-hids-local-config/files/template-rules-default.xml.in b/security/ossec-hids-local-config/files/template-rules-default.xml.in
index 5f34a6a..511d551 100644
--- a/security/ossec-hids-local-config/files/template-rules-default.xml.in
+++ b/security/ossec-hids-local-config/files/template-rules-default.xml.in
@@ -51,6 +51,7 @@
     <include>ms_ipsec_rules.xml</include>
     <include>vmware_rules.xml</include>
     <include>ids_rules.xml</include>
+    <include>ms_powershell_rules.xml</include>
     <include>apache_rules.xml</include>
     <include>web_rules.xml</include>
     <include>zeus_rules.xml</include>
@@ -78,6 +79,9 @@
     <include>ms_firewall_rules.xml</include>
     <include>psad_rules.xml</include>
     <include>unbound_rules.xml</include>
+    <include>kesl_rules.xml</include>
+    <include>mhn_dionaea_rules.xml</include>
+    <include>mhn_cowrie_rules.xml</include>
     <include>local_rules.xml</include>
 
     <!-- Files not included by default -->
diff --git a/security/ossec-hids-local-config/scripts/plist.sh b/security/ossec-hids-local-config/scripts/plist.sh
index 6d61787..a58b25a 100644
--- a/security/ossec-hids-local-config/scripts/plist.sh
+++ b/security/ossec-hids-local-config/scripts/plist.sh
@@ -11,11 +11,17 @@ PLIST=$3
 WORKDIR=$4
 STAGEDIR=$5
 
-staged_plist="${WORKDIR}/.staged-plist"
 fixed_lines=""
 skip_lines=""
 skip_paths=""
-sample_paths="/etc/command.conf.sample /etc/ossec.conf.d/900.local.conf.sample /etc/agent.conf.d/900.local.conf.sample"
+
+sample_paths="
+/etc/command.conf.sample
+/etc/ossec.conf.d/900.local.conf.sample
+/etc/agent.conf.d/900.local.conf.sample"
+
+NL=$'\n'
+IFS=${NL}
 
 print_path() {
     local path="$1"
@@ -28,15 +34,28 @@ print_path() {
         fi
     fi
     local user=`stat -f "%Su" "${full_path}"`
-    if [ "${user}" == "${USER}" ]; then
+    if [ "${user}" = "${USER}" ]; then
         user=""
     fi
     local group=`stat -f "%Sg" "${full_path}"`
-    if [ "${group}" == "${GROUP}" ]; then
+    if [ "${group}" = "${GROUP}" ]; then
         group=""
     fi
     local mode=`stat -f "%p" "${full_path}" | tail -c 5`
-    echo -e "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}"
+    echo "${command}(${user},${group},${mode}) %%OSSEC_HOME%%${path}" >> "${PLIST}"
+}
+
+contains() {
+    local list="$1"
+    local word="$2"
+
+    for e in ${list}; do
+        if [ "${e}" = "${word}" ]; then
+            return 0
+        fi
+    done
+
+    return 1
 }
 
 echo -n > "${PLIST}"
@@ -45,16 +64,9 @@ print_path
 
 done_paths=""
 while read line; do
-    skip_line=""
-    for e in ${skip_lines}; do
-        if [ "${e}" == "${line}" ]; then
-            skip_line="${e}"
-            break
-        fi
-    done
-    if [ -z "${skip_line}" ]; then
+    if ! contains "${skip_lines}" "${line}"; then
         path=""
-        case $line in
+        case ${line} in
             "@dir %%OSSEC_HOME%%"*)
                 path=`echo "${line}" | sed -e "s|@dir %%OSSEC_HOME%%||g"`
                 ;;
@@ -62,7 +74,7 @@ while read line; do
                 path=`echo "${line}" | sed -e "s|%%OSSEC_HOME%%||g"`
                 ;;
             "%%"*)
-                unchanged_lines="${unchanged_lines} ${line}"
+                unchanged_lines="${unchanged_lines}${NL}${line}"
                 ;;
         esac
         if [ -n "${path}" ]; then
@@ -70,33 +82,12 @@ while read line; do
             path=""
             for segment in ${segments}; do
                 path="${path}/${segment}"
-                skip_path=""
-                for e in ${skip_paths}; do
-                    if [ "${e}" == "${path}" ]; then
-                        skip_path="${e}"
-                        break
-                    fi
-                done
-                if [ -n "${skip_path}" ]; then
+                if contains "${skip_paths}" "${path}"; then
                     break
                 fi
-                done_path=""
-                for e in ${done_paths}; do
-                    if [ "${e}" == "${path}" ]; then
-                        done_path="${e}"
-                        break
-                    fi
-                done
-                if [ -z "${done_path}" ]; then
-                    done_paths="${done_paths} ${path}"
-                    sample_path=""
-                    for e in ${sample_paths}; do
-                        if [ "${e}" == "${path}" ]; then
-                            sample_path="${e}"
-                            break
-                        fi
-                    done
-                    if [ -n "${sample_path}" ]; then
+                if ! contains "${done_paths}" "${path}"; then
+                    done_paths="${done_paths}${NL}${path}"
+                    if contains "${sample_paths}" "${path}"; then
                         print_path "${path}" @sample
                     else
                         print_path "${path}"
@@ -105,9 +96,9 @@ while read line; do
             done
         fi
     fi
-done < "${staged_plist}"
+done < "${WORKDIR}/.staged-plist"
 
-unchanged_lines="${unchanged_lines} ${fixed_lines}"
+unchanged_lines="${unchanged_lines}${NL}${fixed_lines}"
 for line in ${unchanged_lines}; do
     echo "${line}" >> "${PLIST}"
 done