gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc2_worked

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-15 18:29:36 +02:00
parent fc3a2944b2
commit 71b6c0d86f
62 changed files with 9112 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/entrypoint.sh
+27 -20
View File
@@ -1,13 +1,24 @@
#!/bin/sh
set -eu
mkdir -p /data /data/suricata /var/log/suricata /var/lib/suricata/rules /run/suricata
PERSIST_ROOT="${PERSIST_ROOT:-/data}"
PERSIST_LOG_DIR="${SURICATA_PERSIST_LOG_DIR:-${PERSIST_ROOT}/logs/suricata}"
PERSIST_LIB_DIR="${SURICATA_PERSIST_LIB_DIR:-${PERSIST_ROOT}/lib/suricata}"
PERSIST_STATE_DIR="${SURICATA_STATE_DIR:-${PERSIST_ROOT}/suricata}"
mkdir -p \
"$PERSIST_ROOT" \
"$PERSIST_LOG_DIR" \
"$PERSIST_LIB_DIR/rules" \
"$PERSIST_STATE_DIR" \
/run/suricata
if ! id -u suricata >/dev/null 2>&1 || ! getent group suricata >/dev/null 2>&1; then
echo "[entrypoint] FATAL: missing suricata user/group in the image; rebuild the image from the current Dockerfile" >&2
exit 70
fi
init_file() {
src="$1"
dst="$2"
@@ -17,20 +28,18 @@ init_file() {
chmod 0644 "$dst"
}
cp /opt/ids/suricata/local.rules /data/suricata/local.rules
chmod 0644 /data/suricata/local.rules
init_file /opt/ids/suricata/custom.rules.default /data/suricata/custom.rules
init_file /opt/ids/suricata/threshold.config /data/suricata/threshold.config
init_file /opt/ids/suricata/disable.conf /data/suricata/disable.conf
init_file /opt/ids/suricata/enable.conf /data/suricata/enable.conf
init_file /opt/ids/suricata/modify.conf /data/suricata/modify.conf
cp /opt/ids/suricata/local.rules "$PERSIST_STATE_DIR/local.rules"
chmod 0644 "$PERSIST_STATE_DIR/local.rules"
init_file /opt/ids/suricata/custom.rules.default "$PERSIST_STATE_DIR/custom.rules"
init_file /opt/ids/suricata/threshold.config "$PERSIST_STATE_DIR/threshold.config"
init_file /opt/ids/suricata/disable.conf "$PERSIST_STATE_DIR/disable.conf"
init_file /opt/ids/suricata/enable.conf "$PERSIST_STATE_DIR/enable.conf"
init_file /opt/ids/suricata/modify.conf "$PERSIST_STATE_DIR/modify.conf"
# RouterOS mounts /var/lib/suricata from persistent storage. On the first
# deployment that mount is empty, so seed it from the ET/Open snapshot baked
# into the image before optional online updates run.
if [ ! -s /var/lib/suricata/rules/suricata.rules ] && [ -d /opt/ids/vendor-rules-seed ]; then
echo "[entrypoint] seeding baseline vendor rules into persistent storage"
cp -a /opt/ids/vendor-rules-seed/. /var/lib/suricata/
# Seed vendor rule state into /data/lib/suricata on first start.
if [ ! -s "$PERSIST_LIB_DIR/rules/suricata.rules" ] && [ -d /opt/ids/vendor-rules-seed ]; then
echo "[entrypoint] seeding baseline vendor rules into /data"
cp -a /opt/ids/vendor-rules-seed/. "$PERSIST_LIB_DIR/"
fi
case "${UPDATE_RULES_ON_START:-false}" in
@@ -42,13 +51,11 @@ case "${UPDATE_RULES_ON_START:-false}" in
;;
esac
RULES=/var/lib/suricata/rules/suricata.rules
RULES="$PERSIST_LIB_DIR/rules/suricata.rules"
[ -f "$RULES" ] || : > "$RULES"
chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata
# Rule state is edited by the root Python supervisor but must remain readable by
# the Suricata process after it drops privileges.
chmod 0755 /data /data/suricata || true
chmod 0644 /data/suricata/* 2>/dev/null || true
chown -R suricata:suricata "$PERSIST_LOG_DIR" "$PERSIST_LIB_DIR" /run/suricata
chmod 0755 "$PERSIST_ROOT" "$PERSIST_STATE_DIR" || true
chmod 0644 "$PERSIST_STATE_DIR"/* 2>/dev/null || true
exec python3 -m app.main