Shivani Bhardwaj [Fri, 23 Nov 2018 14:55:29 +0000 (20:25 +0530)]
Install requirements if using pip
Current setup was using distutils which does not allow to define the
requirements of a package. Check if the installation of
`suricata-update` is being done with `pip` and if it is, install the
requirements while installing the package.
This way distutils will not throw a warning of the `install_requires`
option being unrecognized, however, it would still not install the
requirements.
Now, with the installation of `suricata-update` package, all the
requirements are installed as well if it is installed with `pip`.
Shivani Bhardwaj [Wed, 31 Oct 2018 15:38:02 +0000 (21:08 +0530)]
Add --free argument to list-sources command
Add the functionality of being able to list only the free sources with
the `list-sources` command. This patch differentiates a free source from
a non-free source based on the availability of "subscription-url" for a
particular source.
This argument is also available in the help section of `list-sources`
command.
optional arguments:
-h, --help show this help message and exit
-v, --verbose Be more verbose
-q, --quiet Be quiet, warning and error messages only
-D <directory>, --data-dir <directory>
Data directory (default: /var/lib/suricata)
-c <filename>, --config <filename>
configuration file (default:
/etc/suricata/update.yaml)
--suricata-conf <filename>
configuration file (default:
/etc/suricata/suricata.yaml)
--suricata <path> Path to Suricata program
--suricata-version <version>
Override Suricata version
--user-agent <user-agent>
Set custom user-agent string
--no-check-certificate
Disable server SSL/TLS certificate verification
-V, --version Display version
--free List all freely available sources
```
`suricata-update` sends a User Agent as a part of the request header to
get some basic information about the user system like the suricata-update
version, python version, etc. However, some users do not like this
behavior and are facililated with a `--user-agent` option whereby they
can modify the `User-Agent` header to a custom string. Although, in some
cases, it has been observed that the `User-Agent` header can be set to
nothing. In some other cases, users wish to set it to an empty string.
Jason Ish [Tue, 30 Oct 2018 19:35:16 +0000 (13:35 -0600)]
Show error on failure to create output directory.
Previously:
Output directory does not exist and could not be created:
/var/lib/suricata/rules
Now:
Failed to create directory /var/lib/suricata/rules:
[Errno 13] Permission denied: '/var/lib/suricata
Use assertEqual instead of deprecated assertEquals
Replace the use of assertEquals in all places with assertEqual as the
former was deprecated in https://bugs.python.org/issue9424
assertEquals goes well with Python 2.7 alongwith Python 3.x so this does
not break any existing test cases.
Current tox configuration was missing Python 3.7 because of which tests were
never run for a Python 3.7 environment. Fix that by adding py37 to the configurations.
Jason Ish [Mon, 23 Jul 2018 21:31:52 +0000 (15:31 -0600)]
add-source: fix prompt for required fields
The command had the code to prompt the user for the required
fields but the argument parser was forcing them to be set
on the command line. Make the name and url optional for
the argument parser, and prompt if not provided.
Jason Ish [Wed, 25 Apr 2018 20:48:16 +0000 (14:48 -0600)]
attempt to load defaults from a defaults module
The defaults module is installed by suricata into the
and contains compile time values such as sysconfdir,
and the directory where distribution provided rules
are found.
Jason Ish [Sun, 25 Mar 2018 14:34:30 +0000 (08:34 -0600)]
fail safe if ssl.create_default_context doesn't exist
fall back to the default SSL handler when create_default_context
doesn't exist as on Python versions prior to 2.7.9 where it hasn't
been backported (Ubuntu Trusty).
The downside is no certificate verification is done.
Jason Ish [Mon, 26 Feb 2018 17:33:27 +0000 (11:33 -0600)]
validate rule vars, disabling rules on error
If the Suricata config is available, suricata-update will check
that all rule vars are defined. If a rule uses a var that is
not defined a warning message will be logged, and the rule
will be disabled.
Jason Ish [Thu, 14 Dec 2017 21:42:23 +0000 (15:42 -0600)]
on download failure, return cached version (if exists)
Previously if a download failed, an error would be logged and
the rules that were downloaded were processed. This could lead
to an output that was no expected (missing rules).
Now if the download fails, check if we have the previous download.
If we do, log a warning and return the cached files.
If we don't have the previous download, log an error and process
what rules we do have.
The list of possible sources for suricata-update is downloaded from "https://www.openinfosecfoundation.org/rules/index.yaml" per default. Suricata-Update uses the insecure yaml.load()-function. Code will be executed if the yaml-file contains lines like:
The vulnerable function can be triggered by "suricata-update list-sources". The locally stored index.yaml will be loaded in this function and the malicious code gets executed.
Jason Ish [Thu, 7 Dec 2017 13:40:21 +0000 (07:40 -0600)]
tests: remove specific python2 and python3 tests
With tox, the tests are run under multiple versions of Python.
Just use the interpreter running the tests to hit all versions
instead of relying whats installed on the host system.
Jason Ish [Wed, 6 Dec 2017 01:28:55 +0000 (19:28 -0600)]
more specific exception handling when downloading
Only catch and log errors related to downloading such as bad
URLs, or 404 type errors.
Let actual coding error exeptions ripple up, as a catch all
handler here can catch actual code errors causing them to only be
logged and not crash the program during testing.
projects / thirdparty / suricata-update.git / log
