Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

suricata: T751: Initial support for suricata #3399

Merged
merged 4 commits into from
May 23, 2024
Merged

suricata: T751: Initial support for suricata #3399

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
549089a
suricata: T751: Initial support for suricata
0xThiebaut May 1, 2024
cd32928
suricata: T751: move CLI from "service ids suricata" -> "service suri…
c-po May 23, 2024
2af04a5
suricata: T751: remove implicit default dictionary
c-po May 23, 2024
01464a6
suricata: T751: use key_mangling in get_config_dict()
c-po May 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,280 changes: 1,280 additions & 0 deletions data/templates/ids/suricata.j2
View file
Open in desktop

Large diffs are not rendered by default.

17 changes: 17 additions & 0 deletions data/templates/ids/suricata_logrotate.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{% for filename in [(log.eve.filename | default("eve.json"))] %}
{{ filename if filename.startswith("/") else ("/var/log/suricata/" + filename) }}
{% endfor %}{
weekly
dateext
dateformat _%Y-%m-%d_%H-%M-%S
maxsize 10M
rotate 10
missingok
nocompress
nocreate
nomail
sharedscripts
postrotate
/bin/kill -HUP `cat /run/suricata/suricata.pid 2>/dev/null` 2>/dev/null || true
endscript
}
2 changes: 2 additions & 0 deletions debian/control
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,8 @@ Depends:
# End "service dns dynamic"
# # For "service ids"
fastnetmon [amd64],
suricata,
suricata-update,
# End "service ids"
# # For "service ndp-proxy"
ndppd,
Expand Down
238 changes: 238 additions & 0 deletions interface-definitions/service_suricata.xml.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,238 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="service">
<children>
<node name="suricata" owner="${vyos_conf_scripts_dir}/service_suricata.py">
<properties>
<help>Network IDS, IPS and Security Monitoring</help>
<priority>740</priority>
</properties>
<children>
#include <include/generic-interface-multi.xml.i>
<tagNode name="address-group">
<properties>
<help>Address group name</help>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="address">
<properties>
<help>IP address or subnet</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv6</format>
<description>IPv6 address to match</description>
</valueHelp>
<valueHelp>
<format>ipv4net</format>
<description>IPv4 prefix to match</description>
</valueHelp>
<valueHelp>
<format>ipv6net</format>
<description>IPv6 prefix to match</description>
</valueHelp>
<valueHelp>
<format>!ipv4</format>
<description>Exclude the specified IPv4 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6</format>
<description>Exclude the specified IPv6 address from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv4net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<valueHelp>
<format>!ipv6net</format>
<description>Exclude the specified IPv6 prefix from matches</description>
</valueHelp>
<constraint>
<validator name="ipv4-address"/>
<validator name="ipv6-address"/>
<validator name="ipv4-prefix"/>
<validator name="ipv6-prefix"/>
<validator name="ipv4-address-exclude"/>
<validator name="ipv6-address-exclude"/>
<validator name="ipv4-prefix-exclude"/>
<validator name="ipv6-prefix-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Address group</help>
<completionHelp>
<path>service ids suricata address-group</path>
</completionHelp>
<valueHelp>
<format>txt</format>
<description>Address group to match</description>
</valueHelp>
<valueHelp>
<format>!txt</format>
<description>Exclude the specified address group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<tagNode name="port-group">
<properties>
<help>Port group name</help>
<constraint>
<regex>[a-z0-9-]+</regex>
</constraint>
</properties>
<children>
<leafNode name="port">
<properties>
<help>Port number</help>
<valueHelp>
<format>u32:1-65535</format>
<description>Numeric port to match</description>
</valueHelp>
<valueHelp>
<format>!u32:1-65535</format>
<description>Numeric port to exclude from matches</description>
</valueHelp>
<valueHelp>
<format>start-end</format>
<description>Numbered port range (e.g. 1001-1005) to match</description>
</valueHelp>
<valueHelp>
<format>!start-end</format>
<description>Numbered port range (e.g. !1001-1005) to exclude from matches</description>
</valueHelp>
<constraint>
<validator name="port-range"/>
<validator name="port-range-exclude"/>
</constraint>
<multi/>
</properties>
</leafNode>
<leafNode name="group">
<properties>
<help>Port group</help>
<completionHelp>
<path>service ids suricata port-group</path>
</completionHelp>
<valueHelp>
<format>txt</format>
<description>Port group to match</description>
</valueHelp>
<valueHelp>
<format>!txt</format>
<description>Exclude the specified port group from matches</description>
</valueHelp>
<constraint>
<regex>!?[a-z0-9-]+</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</tagNode>
<node name="log">
<properties>
<help>Suricata log outputs</help>
</properties>
<children>
<node name="eve">
<properties>
<help>Extensible Event Format (EVE)</help>
</properties>
<children>
<leafNode name="filetype">
<properties>
<help>EVE logging destination</help>
<completionHelp>
<list>regular syslog</list>
</completionHelp>
<valueHelp>
<format>regular</format>
<description>Log to filename</description>
</valueHelp>
<valueHelp>
<format>syslog</format>
<description>Log to syslog</description>
</valueHelp>
<constraint>
<regex>(regular|syslog)</regex>
</constraint>
</properties>
<defaultValue>regular</defaultValue>
</leafNode>
<leafNode name="filename">
<properties>
<help>Log file</help>
<valueHelp>
<format>filename</format>
<description>File name in default Suricata log directory</description>
</valueHelp>
<valueHelp>
<format>/path</format>
<description>Absolute file path</description>
</valueHelp>
</properties>
<defaultValue>eve.json</defaultValue>
</leafNode>
<leafNode name="type">
<properties>
<help>Log types</help>
<completionHelp>
<list>alert anomaly drop files http dns tls smtp dnp3 ftp rdp nfs smb tftp ikev2 dcerpc krb5 snmp rfb sip dhcp ssh mqtt http2 flow netflow</list>
</completionHelp>
<valueHelp>
<format>alert</format>
<description>Record events for rule matches</description>
</valueHelp>
<valueHelp>
<format>anomaly</format>
<description>Record unexpected conditions such as truncated packets, packets with invalid IP/UDP/TCP length values, and other events that render the packet invalid for further processing or describe unexpected behavior on an established stream</description>
</valueHelp>
<valueHelp>
<format>drop</format>
<description>Record events for dropped packets</description>
</valueHelp>
<valueHelp>
<format>file</format>
<description>Record file details (e.g., MD5) for files extracted from application protocols (e.g., HTTP)</description>
</valueHelp>
<valueHelp>
<format>application (http, dns, tls, ...)</format>
<description>Record application-level transactions</description>
</valueHelp>
<valueHelp>
<format>flow</format>
<description>Record bi-directional flows</description>
</valueHelp>
<valueHelp>
<format>netflow</format>
<description>Record uni-directional flows</description>
</valueHelp>
<constraint>
<regex>(alert|anomaly|http|dns|tls|files|drop|smtp|dnp3|ftp|rdp|nfs|smb|tftp|ikev2|dcerpc|krb5|snmp|rfb|sip|dhcp|ssh|mqtt|http2|flow|netflow)</regex>
</constraint>
<multi/>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</interfaceDefinition>
23 changes: 23 additions & 0 deletions op-mode-definitions/suricata.xml.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="update">
<children>
<node name="suricata">
<properties>
<help>Update Suricata</help>
</properties>
<command>if test -f /run/suricata/suricata.yaml; then sudo suricata-update --suricata-conf /run/suricata/suricata.yaml; sudo systemctl restart suricata; else echo "Service Suricata not configured"; fi </command>
</node>
</children>
</node>
<node name="restart">
<children>
<node name="suricata">
<properties>
<help>Restart Suricata service</help>
</properties>
<command>if systemctl is-active --quiet suricata; then sudo systemctl restart suricata.service; else echo "Service Suricata not configured"; fi</command>
</node>
</children>
</node>
</interfaceDefinition>
2 changes: 1 addition & 1 deletion python/vyos/base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ def print(self):
isfirstmessage = False
initial_indent = self.standardindent
print(f'{mes}')
print('')
print('', flush=True)


class Warning():
Expand Down
Loading
Loading