From d7720dcf3e21e352889fb6bb7b8836709ee8d819 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Sun, 18 Mar 2018 21:27:31 +0000
Subject: [PATCH] intrusion detection: provide custom.yaml stub #2268

---
 plist                                                 |  1 +
 src/opnsense/service/templates/OPNsense/IDS/+TARGETS  | 11 ++++++-----
 .../service/templates/OPNsense/IDS/custom.yaml.sample |  1 +
 .../service/templates/OPNsense/IDS/suricata.yaml      |  3 +++
 4 files changed, 11 insertions(+), 5 deletions(-)
 create mode 100644 src/opnsense/service/templates/OPNsense/IDS/custom.yaml.sample

diff --git a/plist b/plist
index dbe948455..8d5eae94d 100644
--- a/plist
+++ b/plist
@@ -1182,5 +1182,6 @@
 @sample /usr/local/etc/bogons.sample
 @sample /usr/local/etc/bogonsv6.sample
 @sample /usr/local/etc/config.xml.sample
+@sample /usr/local/opnsense/service/templates/OPNsense/IDS/custom.yaml.sample
 @shadow /usr/local/etc/pkg/repos/FreeBSD.conf.sample
 @shadow /usr/local/etc/pkg/repos/origin.conf.sample
diff --git a/src/opnsense/service/templates/OPNsense/IDS/+TARGETS b/src/opnsense/service/templates/OPNsense/IDS/+TARGETS
index 04f7e0813..b329faca7 100644
--- a/src/opnsense/service/templates/OPNsense/IDS/+TARGETS
+++ b/src/opnsense/service/templates/OPNsense/IDS/+TARGETS
@@ -1,8 +1,9 @@
+OPNsense.rules:/usr/local/etc/suricata/rules/OPNsense.rules
+classification.config:/usr/local/etc/suricata/classification.config
+custom.yaml:/usr/local/etc/suricata/custom.yaml
+newsyslog.conf:/etc/newsyslog.conf.d/suricata
 rc.conf.d:/etc/rc.conf.d/suricata
+reference.config:/usr/local/etc/suricata/reference.config
+rule-updater.config:/usr/local/etc/suricata/rule-updater.config
 rules.config:/usr/local/etc/suricata/rules.config
 suricata.yaml:/usr/local/etc/suricata/suricata.yaml
-newsyslog.conf:/etc/newsyslog.conf.d/suricata
-rule-updater.config:/usr/local/etc/suricata/rule-updater.config
-classification.config:/usr/local/etc/suricata/classification.config
-reference.config:/usr/local/etc/suricata/reference.config
-OPNsense.rules:/usr/local/etc/suricata/rules/OPNsense.rules
diff --git a/src/opnsense/service/templates/OPNsense/IDS/custom.yaml.sample b/src/opnsense/service/templates/OPNsense/IDS/custom.yaml.sample
new file mode 100644
index 000000000..17d869edf
--- /dev/null
+++ b/src/opnsense/service/templates/OPNsense/IDS/custom.yaml.sample
@@ -0,0 +1 @@
+# empty stub for custom modifications
diff --git a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
index b52980cdc..55ec488cd 100644
--- a/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
+++ b/src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
@@ -1146,3 +1146,6 @@ napatech:
 
 # include installed rules list (generated by OPNsense install rules script)
 include: installed_rules.yaml
+
+# include custom file (may be persistently modified)
+include: custom.yaml