mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
93 lines
2.0 KiB
Bash
93 lines
2.0 KiB
Bash
#!/bin/bash
|
|
|
|
# Script for QA purposes to exercise the unix socket runmode.
|
|
# Call from the suricata directory, with a single argument:
|
|
# Path to a checkout out Suricata-Verify repo.
|
|
# The script will start Suricata, then find all pcap files from the
|
|
# SV repo and use the unix socket to pass them to Suricata.
|
|
|
|
set -x
|
|
#set -e
|
|
|
|
SV="$1"
|
|
PCAPS="${SV}/tests/"
|
|
|
|
USOCKET="/var/run/suricata/suricata.socket"
|
|
mkdir -p /var/run/suricata/
|
|
# Use ET open from SV
|
|
RULES="${SV}/tests/test-ruleparse-etopen-01/emerging-all.rules"
|
|
VERBOSE=""
|
|
|
|
UnixCommand () {
|
|
COMMAND=$1
|
|
PYTHONPATH=python/ python3 python/bin/suricatasc -c "${COMMAND}" ${USOCKET}
|
|
}
|
|
|
|
Start () {
|
|
src/suricata -c suricata.yaml --unix-socket --set "default-log-dir=." \
|
|
--set "unix-command.filename=$USOCKET" -S ${RULES} \
|
|
--set classification-file=classification.config \
|
|
--set reference-config-file=reference.config -k none &
|
|
SURIPID=$!
|
|
echo "SURIPID $SURIPID"
|
|
}
|
|
|
|
Stop () {
|
|
echo "sending shutdown command"
|
|
UnixCommand shutdown
|
|
|
|
echo "waiting for suri $SURIPID to exit"
|
|
wait $SURIPID
|
|
RETVAL=$?
|
|
if [ $RETVAL -ne 0 ]; then
|
|
echo "FAILURE"
|
|
exit 1
|
|
else
|
|
echo "success"
|
|
exit 0
|
|
fi
|
|
}
|
|
|
|
SocketReady() {
|
|
RETVAL=255
|
|
CNT=0
|
|
|
|
while [ $RETVAL -ne 0 ]; do
|
|
UnixCommand version
|
|
RETVAL=$?
|
|
sleep 1
|
|
((CNT++))
|
|
if [ $CNT -eq 300 ]; then
|
|
echo "ERROR: failed to start up"
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
FeedPcaps() {
|
|
PCAPLIST=$(find ${PCAPS} -type f -name '*.pcap')
|
|
for P in $PCAPLIST; do
|
|
UnixCommand "pcap-file ${P} ."
|
|
done
|
|
|
|
# wait for engine to report 0 pcaps in list
|
|
CNT=1
|
|
while [ $CNT -ne 0 ]; do
|
|
RAWCNT=$(UnixCommand pcap-file-number)
|
|
CNT=$(echo $RAWCNT|jq -r 'select(.message)|.message')
|
|
sleep 3
|
|
echo $CNT
|
|
done
|
|
echo "FeedPcaps: loop done"
|
|
sleep 60
|
|
echo "FeedPcaps: end"
|
|
}
|
|
|
|
Start
|
|
SocketReady
|
|
FeedPcaps
|
|
echo "stopping suri"
|
|
Stop
|
|
echo "suri stopped"
|
|
exit 0
|