diff options
Diffstat (limited to 'net-analyzer/suricata/files/suricata-4.0.4-init')
| -rw-r--r-- | net-analyzer/suricata/files/suricata-4.0.4-init | 147 |
1 files changed, 147 insertions, 0 deletions
diff --git a/net-analyzer/suricata/files/suricata-4.0.4-init b/net-analyzer/suricata/files/suricata-4.0.4-init new file mode 100644 index 000000000000..1db8137f31a4 --- /dev/null +++ b/net-analyzer/suricata/files/suricata-4.0.4-init @@ -0,0 +1,147 @@ +#!/sbin/openrc-run +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +SURICATA_BIN=/usr/bin/suricata +SURICATA_DIR=${SURICATA_DIR:-/etc/suricata} +SURICATA=${SVCNAME#*.} +SURICATAID=$(shell_var "${SURICATA}") +if [ -n "${SURICATA}" ] && [ ${SVCNAME} != "suricata" ]; then + eval SURICATACONF=\$SURICATA_CONF_${SURICATAID} + [ ${#SURICATACONF} -eq 0 ] && SURICATACONF="${SURICATA_DIR}/suricata-${SURICATA}.yaml" || SURICATACONF="${SURICATA_DIR}/${SURICATACONF}" + SURICATAPID="/var/run/suricata/suricata.${SURICATA}.pid" + eval SURICATAOPTS=\$SURICATA_OPTS_${SURICATAID} + eval SURICATALOGPATH=\$SURICATA_LOG_FILE_${SURICATAID} + eval SURICATAUSER=\$SURICATA_USER_${SURICATAID} + eval SURICATAGROUP=\$SURICATA_GROUP_${SURICATAID} +else + SURICATACONF=${SURICATA_CONF} + [ ${#SURICATACONF} -eq 0 ] && SURICATACONF="${SURICATA_DIR}/suricata.yaml" || SURICATACONF="${SURICATA_DIR}/${SURICATACONF}" + SURICATAPID="/var/run/suricata/suricata.pid" + SURICATAOPTS=${SURICATA_OPTS} + SURICATALOGPATH=${SURICATA_LOG_FILE} + SURICATAUSER=${SURICATA_USER} + SURICATAGROUP=${SURICATA_GROUP} +fi +SURICATAUSER=${SURICATAUSER:-${SURICATA_USER}} +SURICATAGROUP=${SURICATAGROUP:-${SURICATA_GROUP}} +[ -e ${SURICATACONF} ] && SURICATAOPTS="-c ${SURICATACONF} ${SURICATAOPTS}" +[[ -z "${SURICATA_MAX_WAIT_ON_STOP// }" ]] || SURICATA_RETRY="--retry ${SURICATA_MAX_WAIT_ON_STOP}" + +description="Suricata IDS/IPS" +extra_commands="checkconfig dump" +description_checkconfig="Check config for ${SVCNAME}" +description_dump="List all config values that can be used with --set" +extra_started_commands="reload relog" +description_reload="Live rule and config reload" +description_relog="Close and re-open all log files" + +depend() { + need net + after mysql + after postgresql +} + +checkconfig() { + if [ ! -d "/var/run/suricata" ] ; then + checkpath -d /var/run/suricata + fi + if [ ${#SURICATALOGPATH} -gt 0 ]; then + SURICATALOGFILE=$( basename ${SURICATALOGPATH} ) + SURICATALOGFILE=${SURICATALOGFILE:-suricata.log} + SURICATALOGPATH=$( dirname ${SURICATALOGPATH} ) + if [ ! -d "${SURICATALOGPATH}" ] ; then + checkpath -d "${SURICATALOGPATH}" + fi + if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ] && [ -e "${SURICATALOGPATH}" ]; then + chown ${SURICATAUSER}:${SURICATAGROUP} "${SURICATALOGPATH}" || return 1 + chown ${SURICATAUSER}:${SURICATAGROUP} "${SURICATALOGPATH}"/* >/dev/null 2>&1 3>&1 + fi + SURICATAOPTS="${SURICATAOPTS} --set logging.outputs.1.file.filename=${SURICATALOGPATH}/${SURICATALOGFILE}" + SURICATALOGPATH="-l ${SURICATALOGPATH}" + fi + if [ ! -e ${SURICATACONF} ] ; then + einfo "The configuration file ${SURICATACONF} was not found." + einfo "If this is OK then make sure you set enough options for ${SVCNAME} in /etc/conf.d/suricata." + einfo "Take a look at the suricata arguments --set and --dump-config." + fi + if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then + einfo "${SVCNAME} will run as user ${SURICATAUSER}:${SURICATAGROUP}." + SURICATAOPTS="${SURICATAOPTS} --user=${SURICATAUSER} --group=${SURICATAGROUP}" + fi +} + +initpidinfo() { + [ -e ${SURICATAPID} ] && SUR_PID="$(cat ${SURICATAPID})" + if [ ${#SUR_PID} -gt 0 ]; then + SUR_PID_CHECK="$(ps -eo pid | grep -c ${SUR_PID})" + SUR_USER="$(ps -p ${SUR_PID} --no-headers -o user)" + fi +} + +checkpidinfo() { + initpidinfo + if [ ! -e ${SURICATAPID} ]; then + eerror "${SVCNAME} isn't running" + return 1 + elif [ ${#SUR_PID} -eq 0 ] || [ $((SUR_PID_CHECK)) -ne 1 ]; then + eerror "Could not determine PID of ${SVCNAME}! Did the service crash?" + return 1 + elif [ ${#SUR_USER} -eq 0 ]; then + eerror "Unable to determine user running ${SVCNAME}!" + return 1 + elif [ "x${SUR_USER}" != "xroot" ]; then + ewarn "${SVCNAME} may need to be running as root or as a priviledged user for the extra commands reload and relog to work." + fi +} + +start() { + checkconfig || return 1 + ebegin "Starting ${SVCNAME}" + start-stop-daemon --start --quiet --exec ${SURICATA_BIN} \ + -- --pidfile ${SURICATAPID} -D ${SURICATAOPTS} ${SURICATALOGPATH} >/dev/null 2>&1 + local SUR_EXIT=$? + if [ $((SUR_EXIT)) -ne 0 ]; then + einfo "Could not start ${SURICATA_BIN} with:" + einfo "--pidfile ${SURICATAPID} -D ${SURICATAOPTS} ${SURICATALOGPATH}" + einfo "Exit code ${SUR_EXIT}" + fi + eend ${SUR_EXIT} +} + +stop() { + ebegin "Stopping ${SVCNAME}" + start-stop-daemon --stop ${SURICATA_RETRY} --quiet --pidfile ${SURICATAPID} >/dev/null 2>&1 + eend $? +} + +reload() { + checkpidinfo || return 1 + checkconfig || return 1 + ebegin "Sending USR2 signal to ${SVCNAME} to perform a live rule and config reload." + if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then + start-stop-daemon --user ${SURICATAUSER} --group ${SURICATAGROUP} --signal USR2 --pidfile ${SURICATAPID} + else + start-stop-daemon --signal USR2 --pidfile ${SURICATAPID} + fi + eend $? +} + +relog() { + checkpidinfo || return 1 + checkconfig || return 1 + ebegin "Sending HUP signal to ${SVCNAME} to close and re-open all log files." + if [ ${#SURICATAUSER} -gt 0 ] && [ ${#SURICATAGROUP} -gt 0 ]; then + start-stop-daemon --user ${SURICATAUSER} --group ${SURICATAGROUP} --signal HUP --pidfile ${SURICATAPID} + else + start-stop-daemon --signal HUP --pidfile ${SURICATAPID} + fi + eend $? +} + +dump() { + checkconfig || return 1 + ebegin "Dumping ${SVCNAME} config values and quitting." + ${SURICATA_BIN} --dump-config --pidfile ${SURICATAPID} ${SURICATAOPTS} ${SURICATALOGPATH} + eend $? +} |