telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

tweaking

Browse Source 
fix condition when no internet connection is available
check internet connection before download of rules and avoid errors
check internet connection before setting up capture filters (with FQDNs, resulted in endless restart of suricata) and unset capture filters if no internet connection is available
This commit is contained in:
Marco Ochse
2018-05-23 13:02:19 +00:00
parent fbe1fff088
commit 38fce345cf
3 changed files with 38 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
docker/suricata/dist/null.bpf vendored Normal file
View File

37
docker/suricata/dist/update.sh vendored
View File

@ -1,4 +1,4 @@
#!/bin/bash
#!/bin/ash
# Let's ensure normal operation on exit or if interrupted ...
function fuCLEANUP {
@ -11,16 +11,15 @@ myOINKCODE="$1"
function fuDLRULES {
### Check if args are present then download rules, if not throw error
if [ "$myOINKCODE" != "" ] && [ "$myOINKCODE" == "OPEN" ];
then
echo "Downloading ET open ruleset."
wget --tries=2 --timeout=2 https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz -O /tmp/rules.tar.gz
wget -q --tries=2 --timeout=2 https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz -O /tmp/rules.tar.gz
else
if [ "$myOINKCODE" != "" ];
then
echo "Downloading ET pro ruleset with Oinkcode $myOINKCODE."
wget --tries=2 --timeout=2 https://rules.emergingthreatspro.com/$myOINKCODE/suricata-4.0/etpro.rules.tar.gz -O /tmp/rules.tar.gz
wget -q --tries=2 --timeout=2 https://rules.emergingthreatspro.com/$myOINKCODE/suricata-4.0/etpro.rules.tar.gz -O /tmp/rules.tar.gz
else
echo "Usage: update.sh <[OPEN, OINKCODE]>"
exit
@ -28,9 +27,29 @@ if [ "$myOINKCODE" != "" ] && [ "$myOINKCODE" == "OPEN" ];
fi
}
# Download rules
fuDLRULES
# Check internet availability
function fuCHECKINET () {
mySITES=$1
error=0
for i in $mySITES;
do
curl --connect-timeout 5 -Is $i 2>&1 > /dev/null
if [ $? -ne 0 ];
then
let error+=1
fi;
done;
echo $error
}
# Extract and enable all rules
tar xvfz /tmp/rules.tar.gz -C /etc/suricata/
sed -i s/^#alert/alert/ /etc/suricata/rules/*.rules
# Check for connectivity and download rules
myCHECK=$(fuCHECKINET "rules.emergingthreatspro.com rules.emergingthreats.net")
if [ "$myCHECK" == "0" ];
then
fuDLRULES 2>&1 > /dev/null
tar xvfz /tmp/rules.tar.gz -C /etc/suricata/ 2>&1 > /dev/null
sed -i s/^#alert/alert/ /etc/suricata/rules/*.rules 2>&1 > /dev/null
echo "/etc/suricata/capture-filter.bpf"
else
echo "/etc/suricata/null.bpf"
fi