mirror of https://github.com/OISF/suricata
python: remove python implementation of suricatasc/suricatactl
Jason Ish
1 year ago
committed by
Victor Julien
parent
8fa347410e
commit
a0089190df
@ -1,39 +0,0 @@
|
|||||||
#! /usr/bin/env python
|
|
||||||
#
|
|
||||||
# Copyright (C) 2017-2022 Open Information Security Foundation
|
|
||||||
#
|
|
||||||
# You can copy, redistribute or modify this Program under the terms of
|
|
||||||
# the GNU General Public License version 2 as published by the Free
|
|
||||||
# Software Foundation.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# version 2 along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
# 02110-1301, USA.
|
|
||||||
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import site
|
|
||||||
|
|
||||||
exec_dir = os.path.dirname(__file__)
|
|
||||||
|
|
||||||
if os.path.exists(os.path.join(exec_dir, "..", "suricata", "ctl", "main.py")):
|
|
||||||
# Looks like we're running from the development directory.
|
|
||||||
sys.path.insert(0, ".")
|
|
||||||
else:
|
|
||||||
# Check if the Python modules are installed in the Suricata installation
|
|
||||||
# prefix.
|
|
||||||
version_info = sys.version_info
|
|
||||||
pyver = "%d.%d" % (version_info.major, version_info.minor)
|
|
||||||
path = os.path.realpath(os.path.join(
|
|
||||||
exec_dir, "..", "lib", "suricata", "python", "suricata"))
|
|
||||||
if os.path.exists(path):
|
|
||||||
sys.path.insert(0, os.path.dirname(path))
|
|
||||||
|
|
||||||
from suricata.ctl.main import main
|
|
||||||
sys.exit(main())
|
|
||||||
@ -1,100 +0,0 @@
|
|||||||
#! /usr/bin/env python
|
|
||||||
#
|
|
||||||
# Copyright(C) 2013-2023 Open Information Security Foundation
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 2 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
||||||
|
|
||||||
from __future__ import print_function
|
|
||||||
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import argparse
|
|
||||||
|
|
||||||
# Find the Python libdir.
|
|
||||||
exec_dir = os.path.dirname(__file__)
|
|
||||||
if os.path.exists(os.path.join(exec_dir, "..", "suricata", "ctl", "main.py")):
|
|
||||||
# Looks like we're running from the development directory.
|
|
||||||
sys.path.insert(0, ".")
|
|
||||||
else:
|
|
||||||
# Check if the Python modules are installed in the Suricata installation
|
|
||||||
# prefix.
|
|
||||||
version_info = sys.version_info
|
|
||||||
pyver = "%d.%d" % (version_info.major, version_info.minor)
|
|
||||||
path = os.path.realpath(os.path.join(
|
|
||||||
exec_dir, "..", "lib", "suricata", "python", "suricata"))
|
|
||||||
if os.path.exists(path):
|
|
||||||
sys.path.insert(0, os.path.dirname(path))
|
|
||||||
|
|
||||||
from suricata.sc import *
|
|
||||||
|
|
||||||
try:
|
|
||||||
from suricata.config import defaults
|
|
||||||
has_defaults = True
|
|
||||||
except:
|
|
||||||
has_defaults = False
|
|
||||||
|
|
||||||
parser = argparse.ArgumentParser(prog='suricatasc', description='Client for Suricata unix socket')
|
|
||||||
parser.add_argument('-v', '--verbose', action='store_const', const=True, help='verbose output (including JSON dump)')
|
|
||||||
parser.add_argument('-c', '--command', default=None, help='execute on single command and return JSON')
|
|
||||||
parser.add_argument('socket', metavar='socket', nargs='?', help='socket file to connect to', default=None)
|
|
||||||
args = parser.parse_args()
|
|
||||||
|
|
||||||
if args.socket != None:
|
|
||||||
SOCKET_PATH = args.socket
|
|
||||||
elif has_defaults:
|
|
||||||
SOCKET_PATH = os.path.join(defaults.localstatedir, "suricata-command.socket")
|
|
||||||
else:
|
|
||||||
print("Unable to determine path to suricata-command.socket.", file=sys.stderr)
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
sc = SuricataSC(SOCKET_PATH, verbose=args.verbose)
|
|
||||||
try:
|
|
||||||
sc.connect()
|
|
||||||
except SuricataNetException as err:
|
|
||||||
print("Unable to connect to socket %s: %s" % (SOCKET_PATH, err), file=sys.stderr)
|
|
||||||
sys.exit(1)
|
|
||||||
except SuricataReturnException as err:
|
|
||||||
print("Unable to negotiate version with server: %s" % (err), file=sys.stderr)
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
if args.command:
|
|
||||||
try:
|
|
||||||
(command, arguments) = sc.parse_command(args.command)
|
|
||||||
except SuricataCommandException as err:
|
|
||||||
print(err.value)
|
|
||||||
sys.exit(1)
|
|
||||||
try:
|
|
||||||
res = sc.send_command(command, arguments)
|
|
||||||
except (SuricataCommandException, SuricataReturnException) as err:
|
|
||||||
print(err.value)
|
|
||||||
sys.exit(1)
|
|
||||||
print(json.dumps(res))
|
|
||||||
sc.close()
|
|
||||||
if res['return'] == 'OK':
|
|
||||||
sys.exit(0)
|
|
||||||
else:
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
try:
|
|
||||||
sc.interactive()
|
|
||||||
except SuricataNetException as err:
|
|
||||||
print("Communication error: %s" % (err))
|
|
||||||
sys.exit(1)
|
|
||||||
except SuricataReturnException as err:
|
|
||||||
print("Invalid return from server: %s" % (err))
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
print("[+] Quit command client")
|
|
||||||
|
|
||||||
sc.close()
|
|
||||||
@ -1,129 +0,0 @@
|
|||||||
# Copyright (C) 2018 Open Information Security Foundation
|
|
||||||
#
|
|
||||||
# You can copy, redistribute or modify this Program under the terms of
|
|
||||||
# the GNU General Public License version 2 as published by the Free
|
|
||||||
# Software Foundation.
|
|
||||||
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# version 2 along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
# 02110-1301, USA.
|
|
||||||
|
|
||||||
from __future__ import print_function
|
|
||||||
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import os.path
|
|
||||||
import time
|
|
||||||
import re
|
|
||||||
import logging
|
|
||||||
|
|
||||||
logger = logging.getLogger("filestore")
|
|
||||||
|
|
||||||
|
|
||||||
class InvalidAgeFormatError(Exception):
|
|
||||||
pass
|
|
||||||
|
|
||||||
|
|
||||||
def register_args(parser):
|
|
||||||
subparser = parser.add_subparsers(help="sub-command help")
|
|
||||||
prune_parser = subparser.add_parser("prune",
|
|
||||||
help="Remove files in specified directory older than specified age")
|
|
||||||
required_args = prune_parser.add_argument_group("required arguments")
|
|
||||||
required_args.add_argument("-d", "--directory",
|
|
||||||
help="filestore directory", required=True)
|
|
||||||
required_args.add_argument("--age",
|
|
||||||
help="prune files older than age, units: s, m, h, d")
|
|
||||||
prune_parser.add_argument(
|
|
||||||
"-n", "--dry-run", action="store_true", default=False,
|
|
||||||
help="only print what would happen")
|
|
||||||
prune_parser.add_argument(
|
|
||||||
"-v", "--verbose", action="store_true",
|
|
||||||
default=False, help="increase verbosity")
|
|
||||||
prune_parser.add_argument(
|
|
||||||
"-q", "--quiet", action="store_true", default=False,
|
|
||||||
help="be quiet, log warnings and errors only")
|
|
||||||
prune_parser.set_defaults(func=prune)
|
|
||||||
|
|
||||||
|
|
||||||
def is_fileinfo(path):
|
|
||||||
return path.endswith(".json")
|
|
||||||
|
|
||||||
|
|
||||||
def parse_age(age):
|
|
||||||
matched_age = re.match(r"(\d+)\s*(\w+)", age)
|
|
||||||
if not matched_age:
|
|
||||||
raise InvalidAgeFormatError(age)
|
|
||||||
val = int(matched_age.group(1))
|
|
||||||
unit = matched_age.group(2)
|
|
||||||
ts_units = ["s", "m", "h", "d"]
|
|
||||||
try:
|
|
||||||
idx = ts_units.index(unit)
|
|
||||||
except ValueError:
|
|
||||||
raise InvalidAgeFormatError("bad unit: %s" % (unit))
|
|
||||||
multiplier = 60 ** idx if idx != 3 else 24 * 60 ** 2
|
|
||||||
return val * multiplier
|
|
||||||
|
|
||||||
|
|
||||||
def get_filesize(path):
|
|
||||||
return os.stat(path).st_size
|
|
||||||
|
|
||||||
|
|
||||||
def remove_file(path, dry_run):
|
|
||||||
size = 0
|
|
||||||
size += get_filesize(path)
|
|
||||||
if not dry_run:
|
|
||||||
os.unlink(path)
|
|
||||||
return size
|
|
||||||
|
|
||||||
|
|
||||||
def set_logger_level(args):
|
|
||||||
if args.verbose:
|
|
||||||
logger.setLevel(logging.DEBUG)
|
|
||||||
if args.quiet:
|
|
||||||
logger.setLevel(logging.WARNING)
|
|
||||||
|
|
||||||
|
|
||||||
def perform_sanity_checks(args):
|
|
||||||
set_logger_level(args)
|
|
||||||
err_msg = {
|
|
||||||
"directory": "filestore directory must be provided",
|
|
||||||
"age": "no age provided, nothing to do",
|
|
||||||
}
|
|
||||||
for val, msg in err_msg.items():
|
|
||||||
if not getattr(args, val):
|
|
||||||
print("Error: {}".format(msg), file=sys.stderr)
|
|
||||||
sys.exit(1)
|
|
||||||
required_dirs = ["tmp", "00", "ff"]
|
|
||||||
for required_dir in required_dirs:
|
|
||||||
if not os.path.exists(os.path.join(args.directory, required_dir)):
|
|
||||||
logger.error("Provided directory is not a filestore directory")
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
|
|
||||||
def prune(args):
|
|
||||||
perform_sanity_checks(args)
|
|
||||||
age = parse_age(args.age)
|
|
||||||
now = time.time()
|
|
||||||
size = 0
|
|
||||||
count = 0
|
|
||||||
|
|
||||||
for dirpath, dirnames, filenames in os.walk(args.directory, topdown=True):
|
|
||||||
# Do not go into the tmp directory.
|
|
||||||
if "tmp" in dirnames:
|
|
||||||
dirnames.remove("tmp")
|
|
||||||
for filename in filenames:
|
|
||||||
path = os.path.join(dirpath, filename)
|
|
||||||
mtime = os.path.getmtime(path)
|
|
||||||
this_age = now - mtime
|
|
||||||
if this_age > age:
|
|
||||||
logger.debug("Deleting %s; age=%ds", path, this_age)
|
|
||||||
size += remove_file(path, args.dry_run)
|
|
||||||
count += 1
|
|
||||||
logger.info("Removed %d files; %d bytes.", count, size)
|
|
||||||
return 0
|
|
||||||
@ -1,81 +0,0 @@
|
|||||||
# Copyright (C) 2017 Open Information Security Foundation
|
|
||||||
# Copyright (c) 2016 Jason Ish
|
|
||||||
#
|
|
||||||
# You can copy, redistribute or modify this Program under the terms of
|
|
||||||
# the GNU General Public License version 2 as published by the Free
|
|
||||||
# Software Foundation.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# version 2 along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
# 02110-1301, USA.
|
|
||||||
|
|
||||||
import logging
|
|
||||||
import time
|
|
||||||
|
|
||||||
GREEN = "\x1b[32m"
|
|
||||||
BLUE = "\x1b[34m"
|
|
||||||
REDB = "\x1b[1;31m"
|
|
||||||
YELLOW = "\x1b[33m"
|
|
||||||
RED = "\x1b[31m"
|
|
||||||
YELLOWB = "\x1b[1;33m"
|
|
||||||
ORANGE = "\x1b[38;5;208m"
|
|
||||||
RESET = "\x1b[0m"
|
|
||||||
|
|
||||||
# A list of secrets that will be replaced in the log output.
|
|
||||||
secrets = {}
|
|
||||||
|
|
||||||
def add_secret(secret, replacement):
|
|
||||||
"""Register a secret to be masked. The secret will be replaced with:
|
|
||||||
<replacement>
|
|
||||||
"""
|
|
||||||
secrets[str(secret)] = str(replacement)
|
|
||||||
|
|
||||||
class SuriColourLogHandler(logging.StreamHandler):
|
|
||||||
"""An alternative stream log handler that logs with Suricata inspired
|
|
||||||
log colours."""
|
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def format_time(record):
|
|
||||||
local_time = time.localtime(record.created)
|
|
||||||
formatted_time = "%d/%d/%d -- %02d:%02d:%02d" % (local_time.tm_mday,
|
|
||||||
local_time.tm_mon,
|
|
||||||
local_time.tm_year,
|
|
||||||
local_time.tm_hour,
|
|
||||||
local_time.tm_min,
|
|
||||||
local_time.tm_sec)
|
|
||||||
return "%s" % (formatted_time)
|
|
||||||
|
|
||||||
def emit(self, record):
|
|
||||||
|
|
||||||
if record.levelname == "ERROR":
|
|
||||||
level_prefix = REDB
|
|
||||||
message_prefix = REDB
|
|
||||||
elif record.levelname == "WARNING":
|
|
||||||
level_prefix = ORANGE
|
|
||||||
message_prefix = ORANGE
|
|
||||||
else:
|
|
||||||
level_prefix = YELLOW
|
|
||||||
message_prefix = ""
|
|
||||||
|
|
||||||
self.stream.write("%s%s%s - <%s%s%s> -- %s%s%s\n" % (
|
|
||||||
GREEN,
|
|
||||||
self.format_time(record),
|
|
||||||
RESET,
|
|
||||||
level_prefix,
|
|
||||||
record.levelname.title(),
|
|
||||||
RESET,
|
|
||||||
message_prefix,
|
|
||||||
self.mask_secrets(record.getMessage()),
|
|
||||||
RESET))
|
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def mask_secrets(msg):
|
|
||||||
for secret in secrets:
|
|
||||||
msg = msg.replace(secret, "<%s>" % secrets[secret])
|
|
||||||
return msg
|
|
||||||
@ -1,46 +0,0 @@
|
|||||||
# Copyright (C) 2018 Open Information Security Foundation
|
|
||||||
#
|
|
||||||
# You can copy, redistribute or modify this Program under the terms of
|
|
||||||
# the GNU General Public License version 2 as published by the Free
|
|
||||||
# Software Foundation.
|
|
||||||
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# version 2 along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
# 02110-1301, USA.
|
|
||||||
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import argparse
|
|
||||||
import logging
|
|
||||||
|
|
||||||
from suricata.ctl import filestore, loghandler
|
|
||||||
|
|
||||||
def init_logger():
|
|
||||||
""" Initialize logging, use colour if on a tty. """
|
|
||||||
if os.isatty(sys.stderr.fileno()):
|
|
||||||
logger = logging.getLogger()
|
|
||||||
logger.setLevel(level=logging.INFO)
|
|
||||||
logger.addHandler(loghandler.SuriColourLogHandler())
|
|
||||||
else:
|
|
||||||
logging.basicConfig(
|
|
||||||
level=logging.INFO,
|
|
||||||
format="%(asctime)s - <%(levelname)s> - %(message)s")
|
|
||||||
|
|
||||||
def main():
|
|
||||||
init_logger()
|
|
||||||
parser = argparse.ArgumentParser()
|
|
||||||
subparsers = parser.add_subparsers(help='sub-command help')
|
|
||||||
fs_parser = subparsers.add_parser("filestore", help="Filestore related commands")
|
|
||||||
filestore.register_args(parser=fs_parser)
|
|
||||||
args = parser.parse_args()
|
|
||||||
try:
|
|
||||||
func = args.func
|
|
||||||
except AttributeError:
|
|
||||||
parser.error("too few arguments")
|
|
||||||
func(args)
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
from __future__ import print_function
|
|
||||||
|
|
||||||
import unittest
|
|
||||||
|
|
||||||
from suricata.ctl import filestore
|
|
||||||
|
|
||||||
class PruneTestCase(unittest.TestCase):
|
|
||||||
|
|
||||||
def test_parse_age(self):
|
|
||||||
self.assertEqual(filestore.parse_age("1s"), 1)
|
|
||||||
self.assertEqual(filestore.parse_age("1m"), 60)
|
|
||||||
self.assertEqual(filestore.parse_age("1h"), 3600)
|
|
||||||
self.assertEqual(filestore.parse_age("1d"), 86400)
|
|
||||||
|
|
||||||
with self.assertRaises(filestore.InvalidAgeFormatError):
|
|
||||||
filestore.parse_age("1")
|
|
||||||
with self.assertRaises(filestore.InvalidAgeFormatError):
|
|
||||||
filestore.parse_age("1y")
|
|
||||||
@ -1 +0,0 @@
|
|||||||
from suricata.sc.suricatasc import *
|
|
||||||
@ -1,228 +0,0 @@
|
|||||||
argsd = {
|
|
||||||
"pcap-file": [
|
|
||||||
{
|
|
||||||
"name": "filename",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "output-dir",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "tenant",
|
|
||||||
"type": int,
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "continuous",
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "delete-when-done",
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"pcap-file-continuous": [
|
|
||||||
{
|
|
||||||
"name": "filename",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "output-dir",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "continuous",
|
|
||||||
"val": True,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "tenant",
|
|
||||||
"type": int,
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "delete-when-done",
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"iface-stat": [
|
|
||||||
{
|
|
||||||
"name": "iface",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"conf-get": [
|
|
||||||
{
|
|
||||||
"name": "variable",
|
|
||||||
"required": 1,
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"unregister-tenant-handler": [
|
|
||||||
{
|
|
||||||
"name": "id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "htype",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hargs",
|
|
||||||
"type": int,
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"register-tenant-handler": [
|
|
||||||
{
|
|
||||||
"name": "id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "htype",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hargs",
|
|
||||||
"type": int,
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"unregister-tenant": [
|
|
||||||
{
|
|
||||||
"name": "id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"register-tenant": [
|
|
||||||
{
|
|
||||||
"name": "id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "filename",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"reload-tenant": [
|
|
||||||
{
|
|
||||||
"name": "id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "filename",
|
|
||||||
"required": 0,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"add-hostbit": [
|
|
||||||
{
|
|
||||||
"name": "ipaddress",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hostbit",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "expire",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"remove-hostbit": [
|
|
||||||
{
|
|
||||||
"name": "ipaddress",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hostbit",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"list-hostbit": [
|
|
||||||
{
|
|
||||||
"name": "ipaddress",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"memcap-set": [
|
|
||||||
{
|
|
||||||
"name": "config",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "memcap",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"memcap-show": [
|
|
||||||
{
|
|
||||||
"name": "config",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"dataset-add": [
|
|
||||||
{
|
|
||||||
"name": "setname",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "settype",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "datavalue",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"dataset-remove": [
|
|
||||||
{
|
|
||||||
"name": "setname",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "settype",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "datavalue",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"get-flow-stats-by-id": [
|
|
||||||
{
|
|
||||||
"name": "flow_id",
|
|
||||||
"type": int,
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
"dataset-clear": [
|
|
||||||
{
|
|
||||||
"name": "setname",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "settype",
|
|
||||||
"required": 1,
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"dataset-lookup": [
|
|
||||||
{
|
|
||||||
"name": "setname",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "settype",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "datavalue",
|
|
||||||
"required": 1,
|
|
||||||
},
|
|
||||||
],
|
|
||||||
}
|
|
||||||
@ -1,293 +0,0 @@
|
|||||||
# Copyright(C) 2012-2023 Open Information Security Foundation
|
|
||||||
|
|
||||||
# This program is free software; you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 2 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program; if not, write to the Free Software
|
|
||||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
||||||
|
|
||||||
try:
|
|
||||||
import simplejson as json
|
|
||||||
except ImportError:
|
|
||||||
import json
|
|
||||||
import readline
|
|
||||||
import select
|
|
||||||
import sys
|
|
||||||
from socket import AF_UNIX, error, socket
|
|
||||||
from inspect import currentframe
|
|
||||||
|
|
||||||
from suricata.sc.specs import argsd
|
|
||||||
|
|
||||||
SURICATASC_VERSION = "1.0"
|
|
||||||
VERSION = "0.2"
|
|
||||||
INC_SIZE = 1024
|
|
||||||
|
|
||||||
|
|
||||||
def get_linenumber():
|
|
||||||
cf = currentframe()
|
|
||||||
return cf.f_back.f_lineno
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataException(Exception):
|
|
||||||
"""
|
|
||||||
Generic class for suricatasc exception
|
|
||||||
"""
|
|
||||||
def __init__(self, value):
|
|
||||||
super(SuricataException, self).__init__(value)
|
|
||||||
self.value = value
|
|
||||||
|
|
||||||
def __str__(self):
|
|
||||||
return str(self.value)
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataNetException(SuricataException):
|
|
||||||
"""
|
|
||||||
Exception raised when a network error occurs
|
|
||||||
"""
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataCommandException(SuricataException):
|
|
||||||
"""
|
|
||||||
Exception raised when the command is incorrect
|
|
||||||
"""
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataReturnException(SuricataException):
|
|
||||||
"""
|
|
||||||
Exception raised when return message is incorrect
|
|
||||||
"""
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataCompleter:
|
|
||||||
def __init__(self, words):
|
|
||||||
self.words = words
|
|
||||||
self.generator = None
|
|
||||||
|
|
||||||
def complete(self, text):
|
|
||||||
for word in self.words:
|
|
||||||
if word.startswith(text):
|
|
||||||
yield word
|
|
||||||
|
|
||||||
def __call__(self, text, state):
|
|
||||||
if state == 0:
|
|
||||||
self.generator = self.complete(text)
|
|
||||||
try:
|
|
||||||
return next(self.generator)
|
|
||||||
except StopIteration:
|
|
||||||
return None
|
|
||||||
|
|
||||||
|
|
||||||
class SuricataSC:
|
|
||||||
def __init__(self, sck_path, verbose=False):
|
|
||||||
self.basic_commands = [
|
|
||||||
"shutdown",
|
|
||||||
"quit",
|
|
||||||
"pcap-file-number",
|
|
||||||
"pcap-file-list",
|
|
||||||
"pcap-last-processed",
|
|
||||||
"pcap-interrupt",
|
|
||||||
"iface-list",
|
|
||||||
"reload-tenants",
|
|
||||||
]
|
|
||||||
self.fn_commands = [
|
|
||||||
"pcap-file",
|
|
||||||
"pcap-file-continuous",
|
|
||||||
"iface-stat",
|
|
||||||
"conf-get",
|
|
||||||
"unregister-tenant-handler",
|
|
||||||
"register-tenant-handler",
|
|
||||||
"unregister-tenant",
|
|
||||||
"register-tenant",
|
|
||||||
"reload-tenant",
|
|
||||||
"add-hostbit",
|
|
||||||
"remove-hostbit",
|
|
||||||
"list-hostbit",
|
|
||||||
"memcap-set",
|
|
||||||
"memcap-show",
|
|
||||||
"dataset-add",
|
|
||||||
"dataset-remove",
|
|
||||||
"get-flow-stats-by-id",
|
|
||||||
"dataset-clear",
|
|
||||||
"dataset-lookup",
|
|
||||||
]
|
|
||||||
self.cmd_list = self.basic_commands + self.fn_commands
|
|
||||||
self.sck_path = sck_path
|
|
||||||
self.verbose = verbose
|
|
||||||
self.socket = socket(AF_UNIX)
|
|
||||||
|
|
||||||
def json_recv(self):
|
|
||||||
cmdret = None
|
|
||||||
data = ""
|
|
||||||
while True:
|
|
||||||
if sys.version < '3':
|
|
||||||
received = self.socket.recv(INC_SIZE)
|
|
||||||
else:
|
|
||||||
received = self.socket.recv(INC_SIZE).decode('iso-8859-1')
|
|
||||||
|
|
||||||
if not received:
|
|
||||||
break
|
|
||||||
|
|
||||||
data += received
|
|
||||||
if data.endswith('\n'):
|
|
||||||
cmdret = json.loads(data)
|
|
||||||
break
|
|
||||||
return cmdret
|
|
||||||
|
|
||||||
def send_command(self, command, arguments=None):
|
|
||||||
if command not in self.cmd_list and command != 'command-list':
|
|
||||||
raise SuricataCommandException("L{}: Command not found: {}".format(get_linenumber(), command))
|
|
||||||
|
|
||||||
cmdmsg = {}
|
|
||||||
cmdmsg['command'] = command
|
|
||||||
if arguments:
|
|
||||||
cmdmsg['arguments'] = arguments
|
|
||||||
if self.verbose:
|
|
||||||
print("SND: " + json.dumps(cmdmsg))
|
|
||||||
cmdmsg_str = json.dumps(cmdmsg) + "\n"
|
|
||||||
if sys.version < '3':
|
|
||||||
self.socket.send(cmdmsg_str)
|
|
||||||
else:
|
|
||||||
self.socket.send(bytes(cmdmsg_str, 'iso-8859-1'))
|
|
||||||
|
|
||||||
ready = select.select([self.socket], [], [], 600)
|
|
||||||
if ready[0]:
|
|
||||||
cmdret = self.json_recv()
|
|
||||||
else:
|
|
||||||
cmdret = None
|
|
||||||
if not cmdret:
|
|
||||||
raise SuricataReturnException("L{}: Unable to get message from server".format(get_linenumber))
|
|
||||||
|
|
||||||
if self.verbose:
|
|
||||||
print("RCV: "+ json.dumps(cmdret))
|
|
||||||
|
|
||||||
return cmdret
|
|
||||||
|
|
||||||
def connect(self):
|
|
||||||
try:
|
|
||||||
if self.socket is None:
|
|
||||||
self.socket = socket(AF_UNIX)
|
|
||||||
self.socket.connect(self.sck_path)
|
|
||||||
except error as err:
|
|
||||||
raise SuricataNetException("L{}: {}".format(get_linenumber(), err))
|
|
||||||
|
|
||||||
self.socket.settimeout(10)
|
|
||||||
#send version
|
|
||||||
if self.verbose:
|
|
||||||
print("SND: " + json.dumps({"version": VERSION}))
|
|
||||||
if sys.version < '3':
|
|
||||||
self.socket.send(json.dumps({"version": VERSION}))
|
|
||||||
else:
|
|
||||||
self.socket.send(bytes(json.dumps({"version": VERSION}), 'iso-8859-1'))
|
|
||||||
|
|
||||||
ready = select.select([self.socket], [], [], 600)
|
|
||||||
if ready[0]:
|
|
||||||
cmdret = self.json_recv()
|
|
||||||
else:
|
|
||||||
cmdret = None
|
|
||||||
|
|
||||||
if not cmdret:
|
|
||||||
raise SuricataReturnException("L{}: Unable to get message from server".format(get_linenumber()))
|
|
||||||
|
|
||||||
if self.verbose:
|
|
||||||
print("RCV: "+ json.dumps(cmdret))
|
|
||||||
|
|
||||||
if cmdret["return"] == "NOK":
|
|
||||||
raise SuricataReturnException("L{}: Error: {}".format(get_linenumber(), cmdret["message"]))
|
|
||||||
|
|
||||||
cmdret = self.send_command("command-list")
|
|
||||||
|
|
||||||
# we silently ignore NOK as this means server is old
|
|
||||||
if cmdret["return"] == "OK":
|
|
||||||
self.cmd_list = cmdret["message"]["commands"]
|
|
||||||
self.cmd_list.append("quit")
|
|
||||||
|
|
||||||
def close(self):
|
|
||||||
self.socket.close()
|
|
||||||
self.socket = None
|
|
||||||
|
|
||||||
def execute(self, command):
|
|
||||||
full_cmd = command.split()
|
|
||||||
cmd = full_cmd[0]
|
|
||||||
cmd_specs = argsd[cmd]
|
|
||||||
required_args_count = len([d["required"] for d in cmd_specs if d["required"] and not "val" in d])
|
|
||||||
arguments = dict()
|
|
||||||
for c, spec in enumerate(cmd_specs, 1):
|
|
||||||
spec_type = str if "type" not in spec else spec["type"]
|
|
||||||
if spec["required"]:
|
|
||||||
if spec.get("val"):
|
|
||||||
arguments[spec["name"]] = spec_type(spec["val"])
|
|
||||||
continue
|
|
||||||
try:
|
|
||||||
arguments[spec["name"]] = spec_type(full_cmd[c])
|
|
||||||
except IndexError:
|
|
||||||
phrase = " at least" if required_args_count != len(cmd_specs) else ""
|
|
||||||
msg = "Missing arguments: expected{} {}".format(phrase, required_args_count)
|
|
||||||
raise SuricataCommandException("L{}: {}".format(get_linenumber(), msg))
|
|
||||||
except ValueError as ve:
|
|
||||||
raise SuricataCommandException("L{}: Erroneous arguments: {}".format(get_linenumber(), ve))
|
|
||||||
elif c < len(full_cmd):
|
|
||||||
arguments[spec["name"]] = spec_type(full_cmd[c])
|
|
||||||
return cmd, arguments
|
|
||||||
|
|
||||||
def parse_command(self, command):
|
|
||||||
arguments = None
|
|
||||||
cmd = command.split()[0] if command else None
|
|
||||||
if cmd in self.cmd_list:
|
|
||||||
if cmd in self.fn_commands:
|
|
||||||
cmd, arguments = getattr(self, "execute")(command=command)
|
|
||||||
else:
|
|
||||||
raise SuricataCommandException("L{}: Unknown command: {}".format(get_linenumber(), command))
|
|
||||||
return cmd, arguments
|
|
||||||
|
|
||||||
def interactive(self):
|
|
||||||
print("Command list: " + ", ".join(self.cmd_list))
|
|
||||||
try:
|
|
||||||
readline.set_completer(SuricataCompleter(self.cmd_list))
|
|
||||||
readline.set_completer_delims(";")
|
|
||||||
readline.parse_and_bind('tab: complete')
|
|
||||||
while True:
|
|
||||||
if sys.version < '3':
|
|
||||||
command = raw_input(">>> ").strip()
|
|
||||||
else:
|
|
||||||
command = input(">>> ").strip()
|
|
||||||
if command == "quit":
|
|
||||||
break
|
|
||||||
if len(command.strip()) == 0:
|
|
||||||
continue
|
|
||||||
try:
|
|
||||||
cmd, arguments = self.parse_command(command)
|
|
||||||
except SuricataCommandException as err:
|
|
||||||
print(err)
|
|
||||||
continue
|
|
||||||
try:
|
|
||||||
cmdret = self.send_command(cmd, arguments)
|
|
||||||
except IOError as err:
|
|
||||||
# try to reconnect and resend command
|
|
||||||
print("Connection lost, trying to reconnect")
|
|
||||||
try:
|
|
||||||
self.close()
|
|
||||||
self.connect()
|
|
||||||
except (SuricataNetException, SuricataReturnException) as err:
|
|
||||||
print(err.value)
|
|
||||||
continue
|
|
||||||
cmdret = self.send_command(cmd, arguments)
|
|
||||||
except (SuricataCommandException, SuricataReturnException) as err:
|
|
||||||
print("An exception occured: " + str(err.value))
|
|
||||||
continue
|
|
||||||
#decode json message
|
|
||||||
if cmdret["return"] == "NOK":
|
|
||||||
print("Error:")
|
|
||||||
print(json.dumps(cmdret["message"], sort_keys=True, indent=4, separators=(',', ': ')))
|
|
||||||
else:
|
|
||||||
print("Success:")
|
|
||||||
print(json.dumps(cmdret["message"], sort_keys=True, indent=4, separators=(',', ': ')))
|
|
||||||
except KeyboardInterrupt:
|
|
||||||
print("[!] Interrupted")
|
|
||||||
sys.exit(0)
|
|
||||||
@ -1 +0,0 @@
|
|||||||
from suricata.sc import *
|
|
||||||
Loading…
Reference in New Issue