Jason Ish [Wed, 2 Jul 2025 17:52:27 +0000 (11:52 -0600)]
rules: fix parsing of address lists
The previous parser just looked for the next "]" to find the end of a
list without respect for list depth. Instead step through the array
tracking the depth of the nested lists.
Jason Ish [Fri, 28 Mar 2025 22:30:36 +0000 (16:30 -0600)]
reload: if quiet, suppress rule reload output
If successful, and the quiet flag was provided, don't output the
return from the suricatasc socket command, or whatever the rule reload
command returns.
If there was an error, the output will be logged as an error.
Jason Ish [Wed, 15 Jan 2025 15:40:22 +0000 (09:40 -0600)]
engine: choose better Suricata logging levels for rule test
The current default is to use SC_LOG_LEVEL=warning which can output
non-fatal warnings which is generally not what you want when running
from cron with "suricata-update -q".
Now, if "-q" is provided, run Suricata with SC_LOG_LEVEL=error which
is useful for cron to ony be notified of fata errors. Generally
end-users are not worried about rule warnings such as:
ja3.hash should not be used together with nocase, since the rule
is automatically lowercased anyway which makes nocase redundant.
This also allows for log level be set with SC_LOG_LEVEL, in which case
Suricata-Update will not change the log level.
Additionally, make Suricata more verbose if Suricata-Update is run
with "-v".
Jason Ish [Mon, 8 Jul 2024 22:05:13 +0000 (16:05 -0600)]
fix: set usedforsecurity=False for md5 operations
To work on machines with FIPS enfored, md5 can't be used for security,
and Python enforces this by default, but can be used with an extra
function argument.
Re-use md5_hexdigest as it wasn't be used so we can determine if this
function argument is available, as its only available on Python 3.9
and newer.
Jason Ish [Wed, 27 Nov 2024 22:00:49 +0000 (16:00 -0600)]
matching: consolidate sid matchers into a set matcher
Consolidate SID matchers into a single SID set matcher which stores a
dict of all SIDs to be matched. An array of many SID matchers to a
single matcher with much faster lookup.
This can reduce a many minute runtime down to 10s of seconds.
Jason Ish [Tue, 12 Mar 2024 19:02:26 +0000 (13:02 -0600)]
filehashes: fix for unique filehash filenames
Commit 8725e565a78caffae79584c6ec48670ca71d6618 gave each downloaded a
file a unique name so dataset files from different sources wouldn't
clobber each other, but this was applied to all files breaking file
hash lists as that code wasn't updated for the new filename scheme.
Update the file hashing code to find the files based on the filename
prefix of the rule referencing the file.
Jason Ish [Tue, 5 Mar 2024 23:12:55 +0000 (17:12 -0600)]
sources: give each filename from a source a unique filename
To prevent dataset files from difference sources from overwriting each
other, give each file downloaded and extracted a prefix based on the
URL (a hash). This ensures unique filenames across all rulesets.
This mostly matters for datasets, as when datasets are processed we
are working with a merged set of filenames, unlike rules which are
parsed much earlier when we still have a list of files.
Not the most elegant solution, but saves a rather large refactor.
Jason Ish [Tue, 5 Mar 2024 22:54:13 +0000 (16:54 -0600)]
datasets: use filename based on filename; not content
By using a hash of the content, a new file was created everytime the
dataset was updated and never cleaned up. To address this, use a
filename that doesn't change based on the content.
Jason Ish [Tue, 4 Jul 2023 18:56:08 +0000 (12:56 -0600)]
config: prefer configuration specified files
Suricata-Update was preferring the existence of "disable.conf" in
$sysconfdir over it be specified in the update.yaml.
Refactor the auto-conf to only search and apply the default
$sysconfdir files if they don't already exist in the config.
Additonally, now that the default, if not set or found will be none,
log a warning if a specific configuration file is not found instead of
silently ignoring.
Jason Ish [Wed, 23 Nov 2022 18:04:10 +0000 (12:04 -0600)]
update: allow index "checksum" value to be a url
If the checksum field in the index is a string, use it as the checksum
URL. This allows a source to specify a custom checksum URL instead of
the derived ".md5" URL.
Jason Ish [Tue, 3 May 2022 19:11:03 +0000 (13:11 -0600)]
entry point: update sys.path for non-distutils install
When bundled with Suricata, Suricata-Update will not be installed with
distutils/setuptools and will be installed in a custom location. Update
the search path for these changes.
This will still work correctly if installed from pip, or running from a
custom directory not bundled with Suricata.
Jason Ish [Fri, 1 Apr 2022 16:34:03 +0000 (10:34 -0600)]
datasets: disable rule if file not found
If a dataset file is not found for load, print a warning and disable the
rule. This will allow Suricata to pass the -T test so the working rules
are updated instead of rolling back.
Jason Ish [Wed, 30 Mar 2022 21:00:54 +0000 (15:00 -0600)]
Respect Suricata's install location when loading config.
During startup change the default locations of S-U configuration files
(enable.conf, disable.conf, etc) to be relative to the installed
Suricata's --sysconfdir, but only if they exist. This keeps the
fallback behaviour to /etc/suricata for now.
projects / thirdparty / suricata-update.git / log
