From b33b9a9d050bd5bc8247fc4c95ff7bde39d612f2 Mon Sep 17 00:00:00 2001
From: bmeeks8
Date: Wed, 19 Feb 2014 22:34:27 -0500
Subject: Incorporate Ermal's comments into Suricata BETA pkg code.
---
config/suricata/README.md | 6 -
config/suricata/suricata.inc | 178 +++++-------------
config/suricata/suricata_app_parsers.php | 59 ++----
config/suricata/suricata_define_vars.php | 46 ++---
config/suricata/suricata_download_updates.php | 215 ++++++++++------------
config/suricata/suricata_flow_stream.php | 58 ++----
config/suricata/suricata_libhtp_policy_engine.php | 25 +--
config/suricata/suricata_log_view.php | 86 ---------
config/suricata/suricata_os_policy_engine.php | 30 +--
config/suricata/suricata_post_install.php | 13 +-
config/suricata/suricata_uninstall.php | 67 ++-----
11 files changed, 200 insertions(+), 583 deletions(-)
delete mode 100644 config/suricata/README.md
delete mode 100644 config/suricata/suricata_log_view.php
(limited to 'config/suricata')
diff --git a/config/suricata/README.md b/config/suricata/README.md
deleted file mode 100644
index 2ec1d9a3..00000000
--- a/config/suricata/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-pfsense-suricata
-================
-
-Suricata package port for pfSense
-
-This is a port of the Suricata package for pfSense 2.1 and higher. It is currently under development and is still considered BETA software. Use on production systems is not recommended.
diff --git a/config/suricata/suricata.inc b/config/suricata/suricata.inc
index 95b95711..b87e2f6a 100644
--- a/config/suricata/suricata.inc
+++ b/config/suricata/suricata.inc
@@ -29,6 +29,7 @@
require_once("pfsense-utils.inc");
require_once("config.inc");
require_once("functions.inc");
+require_once("services.inc");
require_once("service-utils.inc");
require_once("pkg-utils.inc");
require_once("filter.inc");
@@ -74,7 +75,7 @@ function suricata_generate_id() {
function suricata_is_running($suricata_uuid, $if_real, $type = 'suricata') {
global $config, $g;
- if (file_exists("{$g['varrun_path']}/{$type}_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/{$type}_{$if_real}{$suricata_uuid}.pid"))
+ if (isvalidpid("{$g['varrun_path']}/{$type}_{$if_real}{$suricata_uuid}.pid"))
return 'yes';
else
return 'no';
@@ -84,9 +85,9 @@ function suricata_barnyard_stop($suricatacfg, $if_real) {
global $config, $g;
$suricata_uuid = $suricatacfg['uuid'];
- if (file_exists("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid")) {
log_error("[Suricata] Barnyard2 STOP for {$suricatacfg['descr']}({$if_real})...");
- exec("/bin/pkill -TERM -F {$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid");
+ killbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid");
}
}
@@ -94,14 +95,15 @@ function suricata_stop($suricatacfg, $if_real) {
global $config, $g;
$suricata_uuid = $suricatacfg['uuid'];
- if (file_exists("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid")) {
log_error("[Suricata] Suricata STOP for {$suricatacfg['descr']}({$if_real})...");
- exec("/bin/pkill -TERM -F {$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid");
- sleep(1);
- }
- if (file_exists("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid"))
- exec("/bin/pkill -TERM -F {$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid");
+ killbypid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid");
+ sleep(2);
+ // For some reason Suricata seems to need a double TERM signal to actually shutdown
+ if (isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid"))
+ killbypid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid");
+ }
// Stop Barnyard2 on the interface if running
suricata_barnyard_stop($suricatacfg, $if_real);
}
@@ -158,9 +160,10 @@ function suricata_reload_config($suricatacfg, $signal="USR2") {
/* Only send the SIGUSR2 if Suricata is running and */
/* we can find a valid PID for the process. */
/******************************************************/
- if (file_exists("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid")) {
log_error("[Suricata] Suricata LIVE RULE RELOAD initiated for {$suricatacfg['descr']} ({$if_real})...");
- exec("/bin/pkill -{$signal} -F {$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid 2>&1 &");
+ sigkillbypid("{$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid", $signal);
+// exec("/bin/pkill -{$signal} -F {$g['varrun_path']}/suricata_{$if_real}{$suricata_uuid}.pid 2>&1 &");
}
}
@@ -186,63 +189,34 @@ function suricata_barnyard_reload_config($suricatacfg, $signal="HUP") {
/* Only send the SIGHUP if Barnyard2 is running and */
/* we can find a valid PID for the process. */
/******************************************************/
- if (file_exists("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid") && isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid")) {
+ if (isvalidpid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid")) {
log_error("[Suricata] Barnyard2 CONFIG RELOAD initiated for {$suricatacfg['descr']} ({$if_real})...");
- exec("/bin/pkill -{$signal} -F {$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid 2>&1 &");
+ sigkillbypid("{$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid", $signal);
+// exec("/bin/pkill -{$signal} -F {$g['varrun_path']}/barnyard2_{$if_real}{$suricata_uuid}.pid 2>&1 &");
}
}
function suricata_get_friendly_interface($interface) {
- if (function_exists('convert_friendly_interface_to_friendly_descr'))
- $iface = convert_friendly_interface_to_friendly_descr($interface);
- else {
- if (!$interface || ($interface == "wan"))
- $iface = "WAN";
- else if(strtolower($interface) == "lan")
- $iface = "LAN";
- else if(strtolower($interface) == "pppoe")
- $iface = "PPPoE";
- else if(strtolower($interface) == "pptp")
- $iface = "PPTP";
- else
- $iface = strtoupper($interface);
- }
-
- return $iface;
+ // Pass this directly to the system for now.
+ // Later, this wrapper will be removed and all
+ // the Suricata code changed to use the system call.
+ return convert_friendly_interface_to_friendly_descr($interface);
}
function suricata_get_real_interface($interface) {
- global $config;
-
- $lc_interface = strtolower($interface);
- if (function_exists('get_real_interface'))
- return get_real_interface($lc_interface);
- else {
- if ($lc_interface == "lan") {
- if ($config['inerfaces']['lan'])
- return $config['interfaces']['lan']['if'];
- return $interface;
- }
- if ($lc_interface == "wan")
- return $config['interfaces']['wan']['if'];
- $ifdescrs = array();
- for ($j = 1; isset($config['interfaces']['opt' . $j]); $j++) {
- $ifname = "opt{$j}";
- if(strtolower($ifname) == $lc_interface)
- return $config['interfaces'][$ifname]['if'];
- if(isset($config['interfaces'][$ifname]['descr']) && (strtolower($config['interfaces'][$ifname]['descr']) == $lc_interface))
- return $config['interfaces'][$ifname]['if'];
- }
- }
- return $interface;
+ // Pass this directly to the system for now.
+ // Later, this wrapper will be removed and all
+ // the Suricata code changed to use the system call.
+ return get_real_interface($interface);
}
function suricata_get_blocked_ips() {
+ // This is a placeholder function for later use.
+ // Blocking is not currently enabled in Suricata.
return array();
-
}
/* func builds custom white lists */
@@ -451,18 +425,9 @@ function suricata_build_list($suricatacfg, $listname = "", $whitelist = false) {
function suricata_rules_up_install_cron($should_install) {
global $config, $g;
- if(!$config['cron']['item'])
- $config['cron']['item'] = array();
+ $command = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/suricata/suricata_check_for_rule_updates.php";
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], "suricata_check_for_rule_updates.php")) {
- $is_installed = true;
- break;
- }
- $x++;
- }
+ // Get auto-rule update parameter from configuration
$suricata_rules_up_info_ck = $config['installedpackages']['suricata']['config'][0]['autoruleupdate'];
// See if a customized start time has been set for rule file updates
@@ -525,65 +490,14 @@ function suricata_rules_up_install_cron($should_install) {
$suricata_rules_up_month = "*";
$suricata_rules_up_wday = "*";
}
- switch($should_install) {
- case true:
- $cron_item = array();
- $cron_item['minute'] = $suricata_rules_up_min;
- $cron_item['hour'] = $suricata_rules_up_hr;
- $cron_item['mday'] = $suricata_rules_up_mday;
- $cron_item['month'] = $suricata_rules_up_month;
- $cron_item['wday'] = $suricata_rules_up_wday;
- $cron_item['who'] = "root";
- $cron_item['command'] = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/suricata/suricata_check_for_rule_updates.php";
-
- // Add cron job if not already installed, else just update the existing one
- if (!$is_installed)
- $config['cron']['item'][] = $cron_item;
- elseif ($is_installed)
- $config['cron']['item'][$x] = $cron_item;
- break;
- case false:
- if($is_installed == true)
- unset($config['cron']['item'][$x]);
- break;
- }
+
+ // System call to manage the cron job.
+ install_cron_job($command, $should_install, $suricata_rules_up_min, $suricata_rules_up_hr, $suricata_rules_up_mday, $suricata_rules_up_month, $suricata_rules_up_wday, "root");
}
function suricata_loglimit_install_cron($should_install) {
- global $config, $g;
-
- if (!is_array($config['cron']['item']))
- $config['cron']['item'] = array();
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], 'suricata_check_cron_misc.inc')) {
- $is_installed = true;
- break;
- }
- $x++;
- }
-
- switch($should_install) {
- case true:
- if(!$is_installed) {
- $cron_item = array();
- $cron_item['minute'] = "*/5";
- $cron_item['hour'] = "*";
- $cron_item['mday'] = "*";
- $cron_item['month'] = "*";
- $cron_item['wday'] = "*";
- $cron_item['who'] = "root";
- $cron_item['command'] = "/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_check_cron_misc.inc";
- $config['cron']['item'][] = $cron_item;
- }
- break;
- case false:
- if($is_installed == true)
- unset($config['cron']['item'][$x]);
- break;
- }
+ install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_check_cron_misc.inc", $should_install, "*/5");
}
function sync_suricata_package_config() {
@@ -617,13 +531,9 @@ function sync_suricata_package_config() {
suricata_create_rc();
$suricataglob = $config['installedpackages']['suricata']['config'][0];
-
+ // setup the log directory size check job if enabled
suricata_loglimit_install_cron($suricataglob['suricataloglimit'] == 'on' ? true : false);
-
- // set the suricata block hosts time IMPORTANT
-// suricata_rm_blocked_install_cron($suricataglob['rm_blocked'] != "never_b" ? true : false);
-
- // set the suricata rules update time
+ // setup the suricata rules update job if enabled
suricata_rules_up_install_cron($suricataglob['autoruleupdate'] != "never_up" ? true : false);
write_config();
@@ -781,6 +691,7 @@ function suricata_post_delete_logs($suricata_uuid = 0) {
unset($filelist[count($filelist) - 1]);
foreach ($filelist as $file)
@unlink($file);
+ unset($filelist);
}
}
}
@@ -1946,11 +1857,9 @@ esac
EOD;
// Write out the suricata.sh script file
- if (!@file_put_contents("{$rcdir}/suricata.sh", $suricata_sh_text)) {
- log_error("Could not open {$rcdir}/suricata.sh for writing.");
- return;
- }
+ @file_put_contents("{$rcdir}/suricata.sh", $suricata_sh_text);
@chmod("{$rcdir}/suricata.sh", 0755);
+ unset($suricata_sh_text);
}
function suricata_generate_barnyard2_conf($suricatacfg, $if_real) {
@@ -2051,6 +1960,7 @@ EOD;
/* Write out barnyard2_conf text string to disk */
@file_put_contents("{$suricatadir}/barnyard2.conf", $barnyard2_conf_text);
+ unset($barnyard2_conf_text);
}
function suricata_generate_yaml($suricatacfg) {
@@ -2096,14 +2006,8 @@ function suricata_generate_yaml($suricatacfg) {
include("/usr/local/pkg/suricata/suricata_yaml_template.inc");
// Now write out the conf file using $suricata_conf_text contents
- $conf = fopen("{$suricatacfgdir}/suricata.yaml", "w");
- if(!$conf) {
- log_error("Could not open {$suricatacfgdir}/suricata.yaml for writing.");
- return -1;
- }
- fwrite($conf, $suricata_conf_text);
- fclose($conf);
-
+ @file_put_contents("{$suricatacfgdir}/suricata.yaml", $suricata_conf_text);
+ unset($suricata_conf_text);
conf_mount_ro();
}
diff --git a/config/suricata/suricata_app_parsers.php b/config/suricata/suricata_app_parsers.php
index def78f94..bf6650cd 100644
--- a/config/suricata/suricata_app_parsers.php
+++ b/config/suricata/suricata_app_parsers.php
@@ -282,56 +282,19 @@ include_once("head.inc");
diff --git a/config/suricata/suricata_define_vars.php b/config/suricata/suricata_define_vars.php
index 05378477..c9ec2bcd 100644
--- a/config/suricata/suricata_define_vars.php
+++ b/config/suricata/suricata_define_vars.php
@@ -245,44 +245,22 @@ if ($savemsg)
diff --git a/config/suricata/suricata_download_updates.php b/config/suricata/suricata_download_updates.php
index 8ff30e9b..ecfd5f8b 100644
--- a/config/suricata/suricata_download_updates.php
+++ b/config/suricata/suricata_download_updates.php
@@ -34,7 +34,6 @@ require_once("/usr/local/pkg/suricata/suricata.inc");
/* Define some locally required variables from Suricata constants */
$suricatadir = SURICATADIR;
$suricata_rules_upd_log = RULES_UPD_LOGFILE;
-$log = $suricata_rules_upd_log;
/* load only javascript that is needed */
$suricata_load_jquery = 'yes';
@@ -56,7 +55,7 @@ else {
$et_name = "EMERGING THREATS RULES";
}
-/* quick md5s chk */
+/* quick md5 chk of downloaded rules */
$snort_org_sig_chk_local = 'N/A';
if (file_exists("{$suricatadir}{$snort_rules_file}.md5"))
$snort_org_sig_chk_local = file_get_contents("{$suricatadir}{$snort_rules_file}.md5");
@@ -70,48 +69,45 @@ if (file_exists("{$suricatadir}{$snort_community_rules_filename}.md5"))
$snort_community_sig_chk_local = file_get_contents("{$suricatadir}{$snort_community_rules_filename}.md5");
/* Check for postback to see if we should clear the update log file. */
-if (isset($_POST['clear'])) {
+if ($_POST['clear']) {
if (file_exists("{$suricata_rules_upd_log}"))
mwexec("/bin/rm -f {$suricata_rules_upd_log}");
}
-if (isset($_POST['update'])) {
+if ($_POST['update']) {
header("Location: /suricata/suricata_download_rules.php");
exit;
}
/* check for logfile */
-$suricata_rules_upd_log_chk = 'no';
if (file_exists("{$suricata_rules_upd_log}"))
$suricata_rules_upd_log_chk = 'yes';
+else
+ $suricata_rules_upd_log_chk = 'no';
-$pgtitle = gettext("Suricata: Rule Updates");
+if ($_POST['view']&& $suricata_rules_upd_log_chk == 'yes') {
+ $contents = @file_get_contents($suricata_rules_upd_log);
+ if (empty($contents))
+ $input_errors[] = gettext("Unable to read log file: {$suricata_rules_upd_log}");
+}
+
+$pgtitle = gettext("Suricata: Update Rules Set Files");
include_once("head.inc");
?>
-' . $pgtitle . '
';}?>
-
-
-
+
diff --git a/config/suricata/suricata_flow_stream.php b/config/suricata/suricata_flow_stream.php
index 8db40a47..a994593c 100644
--- a/config/suricata/suricata_flow_stream.php
+++ b/config/suricata/suricata_flow_stream.php
@@ -622,56 +622,20 @@ include_once("head.inc");
diff --git a/config/suricata/suricata_libhtp_policy_engine.php b/config/suricata/suricata_libhtp_policy_engine.php
index a1f6a77c..6b710e85 100644
--- a/config/suricata/suricata_libhtp_policy_engine.php
+++ b/config/suricata/suricata_libhtp_policy_engine.php
@@ -296,29 +296,14 @@ if ($savemsg)
+
+
diff --git a/config/suricata/suricata_post_install.php b/config/suricata/suricata_post_install.php
index 0d6f553e..653f47fd 100644
--- a/config/suricata/suricata_post_install.php
+++ b/config/suricata/suricata_post_install.php
@@ -47,14 +47,14 @@ $rcdir = RCFILEPREFIX;
// Hard kill any running Suricata process that may have been started by any
// of the pfSense scripts such as check_reload_status() or rc.start_packages
if(is_process_running("suricata")) {
- exec("/usr/bin/killall -z suricata");
+ killbyname("suricata");
sleep(2);
// Delete any leftover suricata PID files in /var/run
array_map('@unlink', glob("/var/run/suricata_*.pid"));
}
// Hard kill any running Barnyard2 processes
if(is_process_running("barnyard")) {
- exec("/usr/bin/killall -z barnyard2");
+ killbyname("barnyard2");
sleep(2);
// Delete any leftover barnyard2 PID files in /var/run
array_map('@unlink', glob("/var/run/barnyard2_*.pid"));
@@ -63,13 +63,6 @@ if(is_process_running("barnyard")) {
// Set flag for post-install in progress
$g['suricata_postinstall'] = true;
-// Fix up the sample filenames from a PBI package install
-//$sample_files = array("classification.config", "reference.config", "suricata.yaml");
-//foreach ($sample_files as $file) {
-// if (file_exists("{$suricatadir}{$file}-sample"))
-// @rename("{$suricatadir}{$file}-sample", "{$suricatadir}{$file}");
-//}
-
// Remove any previously installed script since we rebuild it
@unlink("{$rcdir}/suricata.sh");
@@ -92,7 +85,7 @@ if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] =
// Create the suricata.yaml files for each enabled interface
$suriconf = $config['installedpackages']['suricata']['rule'];
foreach ($suriconf as $value) {
- $if_real = suricata_get_real_interface($value['interface']);
+ $if_real = get_real_interface($value['interface']);
// create a suricata.yaml file for interface
suricata_generate_yaml($value);
diff --git a/config/suricata/suricata_uninstall.php b/config/suricata/suricata_uninstall.php
index 808aefec..071a89a4 100644
--- a/config/suricata/suricata_uninstall.php
+++ b/config/suricata/suricata_uninstall.php
@@ -42,11 +42,8 @@ log_error(gettext("[Suricata] Suricata package uninstall in progress..."));
/* Log a message only if a running process is detected */
if (is_service_running("suricata"))
log_error(gettext("[Suricata] Suricata STOP for all interfaces..."));
-
-mwexec('/usr/bin/killall -z suricata', true);
-sleep(2);
-mwexec('/usr/bin/killall -9 suricata', true);
-sleep(2);
+killbyname("suricata");
+sleep(1);
// Delete any leftover suricata PID files in /var/run
array_map('@unlink', glob("/var/run/suricata_*.pid"));
@@ -55,11 +52,8 @@ array_map('@unlink', glob("/var/run/suricata_*.pid"));
/* Log a message only if a running process is detected */
if (is_service_running("barnyard2"))
log_error(gettext("[Suricata] Barnyard2 STOP for all interfaces..."));
-
-mwexec('/usr/bin/killall -z barnyard2', true);
-sleep(2);
-mwexec('/usr/bin/killall -9 barnyard2', true);
-sleep(2);
+killbyname("barnyard2");
+sleep(1);
// Delete any leftover barnyard2 PID files in /var/run
array_map('@unlink', glob("/var/run/barnyard2_*.pid"));
@@ -67,58 +61,21 @@ array_map('@unlink', glob("/var/run/barnyard2_*.pid"));
/* Remove the suricata user and group */
mwexec('/usr/sbin/pw userdel suricata; /usr/sbin/pw groupdel suricata', true);
-/* Remove suricata cron entries Ugly code needs smoothness */
-if (!function_exists('suricata_deinstall_cron')) {
- function suricata_deinstall_cron($crontask) {
- global $config, $g;
-
- if(!is_array($config['cron']['item']))
- return;
-
- $x=0;
- $is_installed = false;
- foreach($config['cron']['item'] as $item) {
- if (strstr($item['command'], $crontask)) {
- $is_installed = true;
- break;
- }
- $x++;
- }
- if ($is_installed == true)
- unset($config['cron']['item'][$x]);
- }
-}
-
-/* Remove all the Suricata cron jobs. */
-suricata_deinstall_cron("suricata_check_for_rule_updates.php");
-suricata_deinstall_cron("suricata_check_cron_misc.inc");
-configure_cron();
-
-/**********************************************************/
-/* Test for existence of library backup tarballs in /tmp. */
-/* If these are present, then a package "delete" */
-/* operation is in progress and we need to wipe out the */
-/* configuration files. Otherwise we leave the binary- */
-/* side configuration intact since only a GUI files */
-/* deinstall and reinstall operation is in progress. */
-/* */
-/* XXX: hopefully a better method presents itself in */
-/* future versions of pfSense. */
-/**********************************************************/
-if (file_exists("/tmp/pkg_libs.tgz") || file_exists("/tmp/pkg_bins.tgz")) {
- log_error(gettext("[Suricata] Package deletion requested... removing all package files..."));
- mwexec("/bin/rm -f {$rcdir}/suricata.sh");
- mwexec("/bin/rm -rf /usr/local/etc/suricata");
- mwexec("/bin/rm -rf /usr/local/pkg/suricata");
- mwexec("/bin/rm -rf /usr/local/www/suricata");
-}
+/* Remove the Suricata cron jobs. */
+install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/www/suricata/suricata_check_for_rule_updates.php", false);
+install_cron_job("/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/suricata/suricata_check_cron_misc.inc", false);
+/* See if we are to keep Suricata log files on uninstall */
if ($config['installedpackages']['suricata']['config'][0]['clearlogs'] == 'on') {
log_error(gettext("[Suricata] Clearing all Suricata-related log files..."));
@unlink("{$suricata_rules_upd_log}");
mwexec("/bin/rm -rf {$suricatalogdir}");
}
+/* Remove the Suricata GUI app directories */
+@unlink("/usr/local/pkg/suricata");
+@unlink("/usr/local/www/suricata");
+
/* Keep this as a last step */
if ($config['installedpackages']['suricata']['config'][0]['forcekeepsettings'] != 'on') {
log_error(gettext("Not saving settings... all Suricata configuration info and logs deleted..."));
--
cgit v1.2.3