postinst

#!/bin/sh -e

CONFIG=/etc/snort/snort.debian.conf
CONFIG_CHECKSUM=/var/lib/snort/snort.debian.conf.md5sum
DBCONFIG=/etc/snort/database.conf
DBCONFIG_CHECKSUM=/var/lib/snort/database.conf.md5sum
# Create the checksum directory if it does not exist
if [ ! -d $(dirname $CONFIG_CHECKSUM) ]; then
    mkdir $(dirname $CONFIG_CHECKSUM)
fi


. /usr/share/debconf/confmodule
test $DEBIAN_SCRIPT_DEBUG && set -v -x

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see /usr/doc/packaging-manual/
#
# quoting from the policy:
#     Any necessary prompting should almost always be confined to the
#     post-installation script, and should be protected with a conditional
#     so that unnecessary prompting doesn't happen if a package's
#     installation fails and the `postinst' is called with `abort-upgrade',
#     `abort-remove' or `abort-deconfigure'.


FIRSTINST=
RECONFIGURE=
if [ "$1" = "reconfigure" ] || [ -n "$DEBCONF_RECONFIGURE" ]; then
  RECONFIGURE="true"
  else
  RECONFIGURE=
fi

if ([ "$1" = "install" ] || [ "$1" = "configure" ]) && [ -z "$2" ]; then
    FIRSTINST="yes"
fi

if [ -z "$RECONFIGURE" ] && [ -z "$FIRSTINST" ]; then
    UPGRADE="yes"
fi


case "$1" in
    install)
	;;
    upgrade)
	db_get snort-mysql/startup || true
	if [ "$RET" = "manual" ]; then
		#db_fset snort-mysql/please_restart_manually seen false
		db_beginblock
		db_input high snort-mysql/please_restart_manually || true
		db_endblock
		db_go
		db_stop
	fi
	;;
    configure)
        # only mess with config file it exists; otherwise, assume that's the way the
        # user wants it, but only if upgrading
        if [ -e "$CONFIG" ] || [ -z "$UPGRADE" ]; then
          # similarly, check for the existence of the checksum file; if it doesn't
          # exist, assume that's the way the user wants it, but only if upgrading
            if [ -e "$CONFIG_CHECKSUM" ] || [ -z "$UPGRADE" ]; then
        # next, compare the current and stored checksums; if they do not match,
        # assume that's the way the user wants it ... upgrading etc
             if [ "$(md5sum "$CONFIG" 2>/dev/null)" = \
                  "$(cat "$CONFIG_CHECKSUM" 2>/dev/null)" ] || \
                  [ -z "$UPGRADE" ]; then
                    # they match; get ready to prepare a new version of the config file
                  overwrite_config="yes"
             fi
            fi
        fi

	# generate new config file
	db_get snort-mysql/startup || true; 		STARTUP="$RET"
	db_get snort-mysql/interface || true; 	INTERFACE="$RET"
	db_get snort-mysql/address_range || true;	ADDRESS_RANGE="$RET"
	db_get snort-mysql/disable_promiscuous || true; DISABLE_PROMISCUOUS="$RET"
	db_get snort-mysql/send_stats || true;	STATS_SEND="$RET"
	db_get snort-mysql/stats_rcpt || true;	STATS_RCPT="$RET"
	db_get snort-mysql/stats_treshold || true;	STATS_THRESHOLD="$RET"
	db_get snort-mysql/options || true;		OPTIONS="$RET"

	test "$DISABLE_PROMISCUOUS" = "true" && OPTIONS="$OPTIONS -p"

	# Failsafe in case the values above are blank (jfs)
	[ -z "$STATS_RCPT" ] && STATS_RCPT=root
	[ -z "$STATS_THRESHOLD" ] && STATS_THRESHOLD=1
	# STATS_RCPT=`echo "$STATS_RCPT" | sed -e 's/@/\\\\@/g' -e 's/,/\\\\,/g'`


        # If this is an upgrade from a previous release that did not have
        # a configuration checksum then try to determine if we can
        # upgrade.
        #
        # To do this: tlest the current configuration against the old auto-generated configuration 
        # file if there is no configuration checksum and create one if it exists.
        # Also, tell the script to overwrite with the new configuration file.
        if  [ ! -e "$CONFIG_CHECKSUM" ] && [ -e "$CONFIG" ] && dpkg --compare-versions "$2" lt-nl 2.8.5.2-6; then
        OLD_CONFIG=$(tempfile)
	cat <<EOF >>"$OLD_CONFIG"
# This file is used for options that are changed by Debian to leave
# the original lib files untouched.
# You have to use "dpkg-reconfigure snort" to change them.

DEBIAN_SNORT_STARTUP="$STARTUP"
DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
DEBIAN_SNORT_OPTIONS="$OPTIONS"
DEBIAN_SNORT_INTERFACE="$INTERFACE"
DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
EOF
            if cmp -s "$CONFIG" "$OLD_CONFIG"; then
                md5sum "$CONFIG" > "$CONFIG_CHECKSUM"
                overwrite_config="yes"
            fi
        rm -f "$OLD_CONFIG"
        fi

        # Create the new configuration file based on debconf information
        NEW_CONFIG=$(tempfile)

	cat <<EOF >>"$NEW_CONFIG"
# snort.debian.config (Debian Snort configuration file)
#
# This file was generated by the post-installation script of the snort-mysql
# package using values from the debconf database.
#
# It is used for options that are changed by Debian to leave
# the original configuration files untouched.
#
# This file is automatically updated on upgrades of the snort-mysql 
# package *only* if it has not been modified since the last upgrade of that package.
#
# If you have edited this file but would like it to be automatically updated
# again, run the following command as root:
#   dpkg-reconfigure snort-mysql

DEBIAN_SNORT_STARTUP="$STARTUP"
DEBIAN_SNORT_HOME_NET="$ADDRESS_RANGE"
DEBIAN_SNORT_OPTIONS="$OPTIONS"
DEBIAN_SNORT_INTERFACE="$INTERFACE"
DEBIAN_SNORT_SEND_STATS="$STATS_SEND"
DEBIAN_SNORT_STATS_RCPT="$STATS_RCPT"
DEBIAN_SNORT_STATS_THRESHOLD="$STATS_THRESHOLD"
EOF

        if ! cmp -s "$CONFIG" "$NEW_CONFIG"; then
                if [ "$overwrite_config" = "yes" ] ;then
                    cp "$NEW_CONFIG" "$CONFIG.dpkg-new"
                    mv "$CONFIG.dpkg-new" "$CONFIG"
                    md5sum "$CONFIG" > "$CONFIG_CHECKSUM"
                else
                    if [ ! -e "$CONFIG" ] ; then
                        echo "snort: not updating $CONFIG; file does not exist" >&2
                    else 
                        if [ ! -e "$CONFIG_CHECKSUM" ] ; then
                            echo "snort: not updating $CONFIG; no stored checksum available and it does not match the debconf database configuration" >&2
                        else
                            echo "snort: not updating $CONFIG; file has been customized" >&2
                        fi
                    fi
                fi
        else
            # Update the md5sum file
            md5sum "$CONFIG" > "$CONFIG_CHECKSUM"
        fi
        rm -f "$NEW_CONFIG"


	if [ -e /etc/snort/db-pending-config ] ; then
	  STARTUP="manual"
	  echo
	  echo "/etc/snort/db-pending-config file found"
	  echo "Snort will not start as its database is not yet configured."
	  echo "Please configure the database as described in"
	  echo "/usr/share/doc/snort-mysql/README-database.Debian"
	  echo "and then remove /etc/snort/db-pending-config"
	fi

# create database config stuff in the configuration file,
# or configure it for syslog-logging.
        db_get snort-mysql/configure_db
        if  [ "$RET" = "true" ]; then

                # only mess with config file it exists; otherwise, assume that's the way the
                # user wants it, but only if upgrading
                if [ -e "$DBCONFIG" ] || [ -z "$UPGRADE" ]; then
                    # similarly, check for the existence of the checksum file; if it doesn't
                    # exist, assume that's the way the user wants it, but only if upgrading
                    if [ -e "$DBCONFIG_CHECKSUM" ] || [ -z "$UPGRADE" ]; then
                        # next, compare the current and stored checksums; if they do not match,
                        # assume that's the way the user wants it ... upgrading etc
                        if [ "$(md5sum "$DBCONFIG" 2>/dev/null)" = \
                             "$(cat "$DBCONFIG_CHECKSUM" 2>/dev/null)" ] || \
                             [ -z "$UPGRADE" ]; then
                            # they match; get ready to prepare a new version of the config file
                             overwrite_dbconfig="yes"
                        fi
                    fi
                 fi
                if [ ! -e "$DBCONFIG" ] && [ "$FIRSTINST" = "yes" ]; then
                        overwrite_config="yes"
                fi

		db_get snort-mysql/db_host || true; DB_HOST=$RET
		db_get snort-mysql/db_database || true; DB_DATABASE=$RET
		db_get snort-mysql/db_user || true; DB_USER=$RET
		db_get snort-mysql/db_pass || true; DB_PASS=$RET

                # Check if this is an upgrade from previous version with no checksum
                if  [ ! -e "$DBCONFIG_CHECKSUM" ] && [ -e "$DBCONFIG" ] && dpkg --compare-versions "$2" lt-nl 2.8.5.2-6; then

		# Here we put the database stuff in the config file.
		TEMPFILE=$(tempfile)
                # Header information
                echo "# AUTOMATIC GENERATED FILE -- DO NOT EDIT" >> $TEMPFILE
                echo "# Please, keep your paws off of these file" >> $TEMPFILE
                echo "# or you *will* break the configure process (snort-pgsql/snort-mysql only)" >> $TEMPFILE
                echo "# Anything you put in this file will be removed on (re)configure." >> $TEMPFILE

		echo -n "output database: log, mysql, " >> $TEMPFILE
		if [ -n "$DB_USER" ]
		then
			echo -n "user=$DB_USER " >> $TEMPFILE
		fi
		if [ -n "$DB_PASS" ]
		then
			echo -n "password=$DB_PASS " >> $TEMPFILE
		fi
		if [ -n "$DB_DATABASE" ]
		then
			echo -n "dbname=$DB_DATABASE " >> $TEMPFILE
		fi
		if [ -n "$DB_HOST" ]
		then
			echo -n "host=$DB_HOST " >> $TEMPFILE
		fi
		echo " " >> $TEMPFILE

                if cmp -s "$DBCONFIG" "$TEMPFILE"; then
                    md5sum "$DBCONFIG" > "$DBCONFIG_CHECKSUM"
                    overwrite_dbconfig="yes"
                fi
            fi

            NEW_DBCONFIG=$(tempfile)
            cat <<EOF >>"$NEW_DBCONFIG"
# database.config (Debian Snort database configuration file)
#
# This file was generated by the post-installation script of the 
# snort-mysql package using values from the debconf database.
#
# It is used for database options for Snort that are configured
# by the sysadmin to live the original configuration files untouched.
#
# This file is automatically updated on upgrades of the snort-mysql
# package *only* if it has not been modified since the last upgrade of that
# package.
#
# If you have edited this file but would like it to be automatically updated
# again, run the following command as root:
#   dpkg-reconfigure snort-mysql
#
EOF

              echo -n "output database: log, mysql, " >> "$NEW_DBCONFIG"
              [ -n "$DB_USER" ] && echo -n "user=$DB_USER " >> "$NEW_DBCONFIG"
              [ -n "$DB_PASS" ] && echo -n "password=$DB_PASS " >> "$NEW_DBCONFIG"
              [ -n "$DB_DATABASE" ] && echo -n "dbname=$DB_DATABASE " >> "$NEW_DBCONFIG"
              [ -n "$DB_HOST" ] && echo -n "host=$DB_HOST " >> "$NEW_DBCONFIG"
              echo " " >> "$NEW_DBCONFIG"

              if ! cmp -s "$CONFIG" "$NEW_DBCONFIG"; then
                if [ "$overwrite_dbconfig" = "yes" ] ;then
                    cp "$NEW_DBCONFIG" "$DBCONFIG.dpkg-new"
                    mv "$DBCONFIG.dpkg-new" "$DBCONFIG"
                    md5sum "$DBCONFIG" > "$DBCONFIG_CHECKSUM"
                else
                        if [ ! -e "$DBCONFIG" ] ; then
                            echo "snort: not updating $DBCONFIG; file does not exist" >&2
                        else 
                            if [ ! -e "$DBCONFIG_CHECKSUM" ] ; then
                                echo "snort: not updating $DBCONFIG; no stored checksum available and it does not match the debconf database configuration" >&2
                        else
                            echo "snort: not updating $DBCONFIG; file has been customized" >&2
                        fi
                 fi
               fi
              fi
              rm -f "$NEW_DBCONFIG"


        fi # of if $RET true - end of database configuration

            # Ensure the config file is readable by root.root and mode 600
            if ! dpkg-statoverride --list /etc/snort/snort.conf >/dev/null
            then
                chown root:snort /etc/snort/snort.conf
                chmod 640 /etc/snort/snort.conf
            fi
            if ! dpkg-statoverride --list /etc/snort/database.conf >/dev/null
            then
                chown root:snort /etc/snort/database.conf
                chmod 640 /etc/snort/database.conf
            fi 

	db_stop

	# Check for left-over files from woody packages.
	OLDCONF=/etc/snort/snort.rules.conf
	if [ -f "$OLDCONF" ]; then
		mv "$OLDCONF" "$OLDCONF.OBSOLETE"
	fi

	# Update the rc.d's
	update-rc.d snort defaults >/dev/null

        if [ "$STARTUP" != "manual" ]; then
	# in the case we reconfigure we have to restart and not just to start.
	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
		invoke-rc.d snort stop || exit $?
	else
		/etc/init.d/snort stop || exit $?
	fi
        fi # of if STARTUP - manual
	;;
    abort-upgrade)
	;;
    *)
	echo "postinst called with unknown argument \`$1'" >&2
	exit 0
	;;
esac

if [ "$STARTUP" = "dialup" ]; then

	# Try to guess environments for all pppds we have no .env for...
	for PPPD_PID in $(pidof pppd ipppd); do
		# If we got an empty PID (however), we break here
		test "$PPPD_PID" || continue

		#
		# This is a lot of shell voodoo, let's try to figure it out:
		# 1. egrep:
		#    It greps for our current pppd PID in all pppd and ipppd
		#    pidfiles.
		#    It *should* return exactly one file name: the one with
		#    our current pppd PID in it; however, to be safe, we fence
		#    it with a head -1.
		# 2. basename $(egrep ...) .pid:
		#    It takes the file name from the egrep and strips off its
		#    path and the .pid suffix
		# 3. sed:
		#    Unfortunately the filenames of pppd and ipppd differ:
		#    pppd uses $INTERFACE.pid, while ipppd uses
		#    ipppd.$INTERFACE.pid.
		#    The .pid is already stripped off by basename, thus, we
		#    just strip off any "ipppd." prefix and end up in the
		#    plain interface name.
		#    Maybe pppd decides to change it's pidfile naming
		#    convention according to ipppd somewhere in the future,
		#    thus, we use '^i\?pppd\.' (sed eregex) and thus strip
		#    off all "ipppd." and all "pppd." prefixes. This doesn't
		#    harm anyways.
		#    Because of the pppd pidfile naming convention, our
		#    approach works always with ipppd and mostly with pppd:
		#    the latter only, if the user did not decide to rename
		#    his ppp interface to something else than ppp*
		#    (not possible currently, afaics).
		#
		PPP_IFACE=$(basename $(egrep -l "^[[:space:]]*$PPPD_PID[[:space:]]*\$" /var/run/ppp*.pid /var/run/ipppd.*.pid 2> /dev/null | head -1) .pid | sed -e 's/^i\?pppd\.//')

		#
		# If we got no interface from pidfiles (because there are no
		# pidfiles, for example), we assume the most common case:
		# one pppd with default route set.
		# This is ugly, but there is no other chance. Let's hope,
		# nobody ever manages multiple pppds without pidfiles for
		# them.
		#
		test "$PPP_IFACE" || PPP_IFACE=$(route -n |	awk '/^0\.0\.0\.0 / { print $8 }')

		# If we couldn't discover an interface name, we break here
		test "$PPP_IFACE" || continue

		PPP_LOCAL=$(ifconfig $PPP_IFACE | awk '/inet addr:/ { gsub("addr:", ""); print $2 }')

		# If we couldn't discover a local IP, we break here
		test "$PPP_LOCAL" || continue

		ENVFILE=/var/run/snort_$PPP_IFACE.env

		# If we already have an .env for that interface, we break here
		test -e "$ENVFILE" && continue

		# Write .env for that interface
		echo "Creating missing $ENVFILE"
		echo "PPPD_PID=$PPPD_PID"    > "$ENVFILE"
		echo "PPP_IFACE=$PPP_IFACE" >> "$ENVFILE"
		echo "PPP_LOCAL=$PPP_LOCAL" >> "$ENVFILE"

		# If such a snort is still running, just kill it
		ps -ef | grep /usr/sbin/snort | grep "$PPP_LOCAL" |
			grep "$PPP_IFACE" | awk '{ print $2 }' |
			xargs --no-run-if-empty kill -s KILL >/dev/null
	done
fi

if [ "$STARTUP" = "boot" ] || [ "$STARTUP" = "dialup" ]; then
	if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
		invoke-rc.d snort start || exit $?
	else
		/etc/init.d/snort start || exit $?
	fi
fi

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.



exit 0
snort-mysql 2.9.2-3ubuntu1 / postinst
