(IDS) add syslog support

PR: https://github.com/opnsense/core/issues/1018

(cherry picked from commit b9ff688b)
(cherry picked from commit e98569bb)

src/etc/inc/plugins.inc.d/suricata.inc

+<?php
+
+/*
+    Copyright (C) 2016 Deciso B.V.
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+
+function suricata_syslog()
+{
+    $logfacilities = array();
+    $logfacilities['suricata.syslog'] = array(
+        'facility' => array('suricata')
+    );
+
+    return $logfacilities;
+}

src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml

@@ -17,6 +17,12 @@
         <type>checkbox</type>
         <help><![CDATA[Enable promiscuous mode, for certain setups (like IPS with vlans), this is required to actually capture data on the physical interface.]]></help>
     </field>
+    <field>
+        <id>ids.general.syslog</id>
+        <label>Enable syslog</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable syslog, sends alerts (in fast log format) and messages to syslog. This won't change the alert logging used by the product itself.]]></help>
+    </field>
     <field>
         <id>ids.general.MPMAlgo</id>
         <label>Pattern matcher</label>

src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml

@@ -146,6 +146,10 @@
               </OptionValues>
               <ValidationMessage>Please select a valid pattern matcher algorithm</ValidationMessage>
             </MPMAlgo>
+            <syslog type="BooleanField">
+                <default>0</default>
+                <Required>Y</Required>
+            </syslog>
         </general>
     </items>
 </model>

src/opnsense/service/templates/OPNsense/IDS/suricata.yaml

@@ -226,7 +226,7 @@ outputs:
 
   # a line based alerts log similar to fast.log into syslog
   - syslog:
-      enabled: no
+      enabled: {% if OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
       # reported identity to syslog. If ommited the program name (usually
       # suricata) will be used.
       #identity: "suricata"
@@ -740,7 +740,8 @@ logging:
       enabled: yes
       filename: /var/log/suricata.log
   - syslog:
-      enabled: no
+      enabled: {% if OPNsense.IDS.general.syslog|default('0') == '0' %}no{% else %}yes{% endif %}
+
       facility: local5
       format: "[%i] <%d> -- "