Skip to content

Commit

Permalink
suricata: T751: Initial support for suricata
Browse files Browse the repository at this point in the history
  • Loading branch information
@0xThiebaut
0xThiebaut committed May 7, 2024
1 parent 91c1a85 commit e97bcff
Show file tree
Hide file tree
Showing 9 changed files with 1,746 additions and 1 deletion.
1,280 changes: 1,280 additions & 0 deletions data/templates/ids/suricata.j2
View file

Large diffs are not rendered by default.

17 changes: 17 additions & 0 deletions data/templates/ids/suricata_logrotate.j2
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{% for filename in [(output.eve.filename | default("eve.json"))] %}
{{ filename if filename.startswith("/") else ("/var/log/suricata/" + filename) }}
{% endfor %}{
weekly
dateext
dateformat _%Y-%m-%d_%H-%M-%S
maxsize 10M
rotate 10
missingok
nocompress
nocreate
nomail
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/suricata.pid 2>/dev/null` 2>/dev/null || true
endscript
}
2 changes: 2 additions & 0 deletions debian/control
View file
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,8 @@ Depends:
# End "service dns dynamic"
# # For "service ids"
fastnetmon [amd64],
suricata,
suricata-update,
# End "service ids"
# # For "service ndp-proxy"
ndppd,
Expand Down
217 changes: 217 additions & 0 deletions interface-definitions/service_ids_suricata.xml.in
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,217 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="service">
<children>
<node name="ids">
<properties>
<help>Intrusion Detection System</help>
</properties>
<children>
<node name="suricata" owner="${vyos_conf_scripts_dir}/service_ids_suricata.py">
<properties>
<help>Suricata high performance Network IDS, IPS and Network Security Monitoring engine</help>
<priority>740</priority>
</properties>
<children>
#include <include/generic-interface-multi.xml.i>
<tagNode name="address-group">
<properties>
<help>Address group name</help>
<completionHelp>
<list>home-net external-net http-servers smtp-servers sql-servers dns-servers telnet-servers aim-servers dc-servers dnp3-server dnp3-client modbus-client modbus-server enip-client enip-server</list>
</completionHelp>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="address">
<properties>
<help>IP address or subnet</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv6</format>
<description>IPv6 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv4net</format>
<description>IPv4 prefix to match</description>
</valueHelp>
<valueHelp>
<format>ipv6net</format>
<description>IPv6 prefix to match</description>
</valueHelp>
<valueHelp>
<format>!ipv4</format>
<description>Exclude the specified IPv4 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6</format>
<description>Exclude the specified IPv6 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv4net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<constraint>
<validator name="ipv4-address"/>
<validator name="ipv6-address"/>
<validator name="ipv4-prefix"/>
<validator name="ipv6-prefix"/>
<validator name="ipv4-address-exclude"/>
<validator name="ipv6-address-exclude"/>
<validator name="ipv4-prefix-exclude"/>
<validator name="ipv6-prefix-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Address group</help>
<completionHelp>
<path>service ids suricata address-group</path>
<list>home-net external-net http-servers smtp-servers sql-servers dns-servers telnet-servers aim-servers dc-servers dnp3-server dnp3-client modbus-client modbus-server enip-client enip-server</list>
</completionHelp>
<valueHelp>
<format>string</format>
<description>Address group to match</description>
</valueHelp>
<valueHelp>
<format>!string</format>
<description>Exclude the specified address group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<tagNode name="port-group">
<properties>
<help>Port group name</help>
<completionHelp>
<list>http-ports shellcode-ports oracle-ports ssh-ports dnp3-ports modbus-ports file-data-ports ftp-ports geneve-ports vxlan-ports teredo-ports</list>
</completionHelp>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="port">
<properties>
<help>Port number</help>
<valueHelp>
<format>u32:1-65535</format>
<description>Numeric port to match</description>
</valueHelp>
<valueHelp>
<format>!u32:1-65535</format>
<description>Numeric port to exclude from matches</description>
</valueHelp>
<valueHelp>
<format>start-end</format>
<description>Numbered port range (e.g. 1001-1005) to match</description>
</valueHelp>
<valueHelp>
<format>!start-end</format>
<description>Numbered port range (e.g. !1001-1005) to exclude from matches</description>
</valueHelp>
<constraint>
<validator name="port-range"/>
<validator name="port-range-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Port group</help>
<completionHelp>
<path>service ids suricata port-group</path>
<list>http-ports shellcode-ports oracle-ports ssh-ports dnp3-ports modbus-ports file-data-ports ftp-ports geneve-ports vxlan-ports teredo-ports</list>
</completionHelp>
<valueHelp>
<format>string</format>
<description>Port group to match</description>
</valueHelp>
<valueHelp>
<format>!string</format>
<description>Exclude the specified port group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<node name="output">
<properties>
<help>Suricata log outputs</help>
</properties>
<children>
<node name="eve">
<properties>
<help>Extensible Event Format (nicknamed EVE) event log in JSON format</help>
</properties>
<children>
<leafNode name="filetype">
<properties>
<help>EVE logging destination</help>
<completionHelp>
<list>regular syslog</list>
</completionHelp>
<valueHelp>
<format>regular</format>
<description>Log to filename</description>
</valueHelp>
<valueHelp>
<format>syslog</format>
<description>Log to syslog</description>
</valueHelp>
<constraint>
<regex>(regular|syslog)</regex>
</constraint>
</properties>
<defaultValue>regular</defaultValue>
</leafNode>
<leafNode name="filename">
<properties>
<help>Log file name in default Suricata log directory</help>
</properties>
<defaultValue>eve.json</defaultValue>
</leafNode>
<leafNode name="type">
<properties>
<help>Log types</help>
<completionHelp>
<list>alert anomaly http dns tls files drop smtp dnp3 ftp rdp nfs smb tftp ikev2 dcerpc krb5 snmp rfb sip dhcp ssh mqtt http2 flow netflow</list>
</completionHelp>
<constraint>
<regex>(alert|anomaly|http|dns|tls|files|drop|smtp|dnp3|ftp|rdp|nfs|smb|tftp|ikev2|dcerpc|krb5|snmp|rfb|sip|dhcp|ssh|mqtt|http2|flow|netflow)</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</interfaceDefinition>
23 changes: 23 additions & 0 deletions op-mode-definitions/suricata.xml.in
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="update">
<children>
<node name="suricata">
<properties>
<help>Update Suricata</help>
</properties>
<command>if test -f /run/suricata/suricata.yaml; then sudo suricata-update --suricata-conf /run/suricata/suricata.yaml; sudo systemctl restart suricata; else echo "Service Suricata not configured"; fi </command>
</node>
</children>
</node>
<node name="restart">
<children>
<node name="suricata">
<properties>
<help>Restart Suricata service</help>
</properties>
<command>if systemctl is-active --quiet suricata; then sudo systemctl restart suricata.service; else echo "Service Suricata not configured"; fi</command>
</node>
</children>
</node>
</interfaceDefinition>
2 changes: 1 addition & 1 deletion python/vyos/base.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ def print(self):
isfirstmessage = False
initial_indent = self.standardindent
print(f'{mes}')
print('')
print('', flush=True)


class Warning():
Expand Down
Loading

0 comments on commit e97bcff

Please sign in to comment.