gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc3

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-15 23:43:58 +02:00
parent 71b6c0d86f
commit e8e5515e24
27 changed files with 861 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy-routeros.sh
+18
View File
@@ -39,6 +39,11 @@ ROOT_DIR="/containers/${CONTAINER_NAME}/root"
: "${SURICATA_HOME_NET:=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]}"
: "${MONITORED_NETWORKS:=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12}"
: "${SURICATA_LOG_MAX_MB:=512}"
: "${FORENSIC_PCAP_MODE:=blocks}"
: "${FORENSIC_PCAP_WINDOW_SECONDS:=60}"
: "${FORENSIC_PCAP_MEMORY_MB:=64}"
: "${FORENSIC_PCAP_MAX_FILES:=32}"
: "${FORENSIC_PCAP_MAX_TOTAL_MB:=512}"
: "${AUTO_BLOCK:=false}"
: "${AUTO_BLOCK_MAX_SEVERITY:=1}"
: "${BLOCK_TIMEOUT:=1h}"
@@ -124,9 +129,17 @@ esac
case "$TZSP_PORT" in
*[!0-9]*|'') echo "TZSP_PORT must be numeric" >&2; exit 2 ;;
esac
case "$FORENSIC_PCAP_MODE" in
blocks|alerts|all|off) ;;
*) echo "FORENSIC_PCAP_MODE must be one of: blocks, alerts, all, off" >&2; exit 2 ;;
esac
for numeric_pair in \
"REDIS_PORT=$REDIS_PORT" \
"SURICATA_LOG_MAX_MB=$SURICATA_LOG_MAX_MB" \
"FORENSIC_PCAP_WINDOW_SECONDS=$FORENSIC_PCAP_WINDOW_SECONDS" \
"FORENSIC_PCAP_MEMORY_MB=$FORENSIC_PCAP_MEMORY_MB" \
"FORENSIC_PCAP_MAX_FILES=$FORENSIC_PCAP_MAX_FILES" \
"FORENSIC_PCAP_MAX_TOTAL_MB=$FORENSIC_PCAP_MAX_TOTAL_MB" \
"REDIS_MAXMEMORY_MB=$REDIS_MAXMEMORY_MB" \
"REDIS_SNAPSHOT_SECONDS=$REDIS_SNAPSHOT_SECONDS" \
"TRAFFIC_RETENTION_HOURS=$TRAFFIC_RETENTION_HOURS" \
@@ -278,6 +291,11 @@ cat > "$LOCAL_RSC" <<RSC
/container/envs/add list=IDS_ENV key=TAP_MTU value="9000"
/container/envs/add list=IDS_ENV key=SURICATA_HOME_NET value="${SURICATA_HOME_NET}"
/container/envs/add list=IDS_ENV key=SURICATA_LOG_MAX_MB value="${SURICATA_LOG_MAX_MB}"
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MODE value="${FORENSIC_PCAP_MODE}"
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_WINDOW_SECONDS value="${FORENSIC_PCAP_WINDOW_SECONDS}"
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MEMORY_MB value="${FORENSIC_PCAP_MEMORY_MB}"
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MAX_FILES value="${FORENSIC_PCAP_MAX_FILES}"
/container/envs/add list=IDS_ENV key=FORENSIC_PCAP_MAX_TOTAL_MB value="${FORENSIC_PCAP_MAX_TOTAL_MB}"
/container/envs/add list=IDS_ENV key=MONITORED_NETWORKS value="${MONITORED_NETWORKS}"
/container/envs/add list=IDS_ENV key=AUTO_BLOCK value="${AUTO_BLOCK}"
/container/envs/add list=IDS_ENV key=AUTO_BLOCK_MAX_SEVERITY value="${AUTO_BLOCK_MAX_SEVERITY}"