worked poc
This commit is contained in:
Mateusz Gruszczyński
+100
-95
@@ -12,14 +12,21 @@ if [ -f "$CONFIG_FILE" ]; then
|
||||
esac
|
||||
fi
|
||||
|
||||
VERSION="$(tr -d '[:space:]' < VERSION)"
|
||||
[ -n "$VERSION" ] || { echo "VERSION is empty" >&2; exit 2; }
|
||||
case "$VERSION" in
|
||||
*[!A-Za-z0-9._-]*) echo "VERSION contains unsupported characters: $VERSION" >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
CONTAINER_NAME="suricata_${VERSION}"
|
||||
ROOT_DIR="/containers/${CONTAINER_NAME}/root"
|
||||
|
||||
: "${ROUTER_HOST:=192.168.88.1}"
|
||||
: "${ROUTER_USER:=admin}"
|
||||
: "${ROUTER_PORT:=22}"
|
||||
: "${ROUTER_IDENTITY_FILE:=}"
|
||||
: "${ROUTER_ARCH:=auto}"
|
||||
: "${ROUTER_SCP_DIR:=/}"
|
||||
: "${ROUTER_DISK:=disk1}"
|
||||
: "${ROUTER_SCP_DIR:=$ROUTER_DISK}"
|
||||
: "${CONTAINER_NAME:=suricata-ids}"
|
||||
: "${CONTAINER_IP:=172.31.255.2/30}"
|
||||
: "${CONTAINER_GATEWAY:=172.31.255.1}"
|
||||
: "${CONTAINER_SUBNET:=172.31.255.0/30}"
|
||||
@@ -35,15 +42,43 @@ fi
|
||||
: "${AUTO_BLOCK_MAX_SEVERITY:=1}"
|
||||
: "${BLOCK_TIMEOUT:=1h}"
|
||||
: "${UPDATE_RULES_ON_START:=false}"
|
||||
: "${RULE_UPDATE_INTERVAL_HOURS:=24}"
|
||||
: "${ALERT_RETENTION_DAYS:=14}"
|
||||
: "${ALERT_MAX_SEVERITY:=2}"
|
||||
: "${ALERT_DEDUP_WINDOW_SECONDS:=300}"
|
||||
: "${ALERT_IGNORE_SIDS:=1000001}"
|
||||
: "${ALERT_IGNORE_CATEGORIES:=}"
|
||||
: "${ADMIN_TOKEN:=}"
|
||||
: "${CREATE_REST_USER:=false}"
|
||||
: "${ENABLE_WWW_SSL:=false}"
|
||||
: "${ROUTEROS_REST_USER:=suricata-api}"
|
||||
: "${ROUTEROS_REST_PASSWORD:=CHANGE_ME}"
|
||||
: "${ROUTEROS_VERIFY_TLS:=false}"
|
||||
: "${ROUTEROS_ADDRESS_LIST:=IDS-BLOCK}"
|
||||
: "${REPLACE_EXISTING:=true}"
|
||||
: "${KEEP_REMOTE_TAR:=true}"
|
||||
: "${ENGINE:=}"
|
||||
: "${KEEP_REMOTE_RSC:=false}"
|
||||
|
||||
usage() {
|
||||
cat <<USAGE
|
||||
Usage: $0 <RouterOS image TAR path>
|
||||
|
||||
The TAR must already exist on RouterOS. Example:
|
||||
./scripts/upload-routeros-image.sh build/routeros-suricata-tzsp-arm64.tar
|
||||
$0 routeros-suricata-tzsp-arm64.tar
|
||||
|
||||
Container name: ${CONTAINER_NAME}
|
||||
Root dir: ${ROOT_DIR}
|
||||
USAGE
|
||||
}
|
||||
|
||||
IMAGE_TAR_ROS="${1:-}"
|
||||
if [ -z "$IMAGE_TAR_ROS" ]; then
|
||||
usage >&2
|
||||
exit 2
|
||||
fi
|
||||
case "$IMAGE_TAR_ROS" in
|
||||
*.tar) ;;
|
||||
*) echo "RouterOS image path must point to a .tar file: $IMAGE_TAR_ROS" >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
need() {
|
||||
command -v "$1" >/dev/null 2>&1 || {
|
||||
@@ -64,8 +99,6 @@ case "$TZSP_PORT" in
|
||||
*[!0-9]*|'') echo "TZSP_PORT must be numeric" >&2; exit 2 ;;
|
||||
esac
|
||||
|
||||
# Values are inserted into a RouterOS script inside quoted strings. Reject
|
||||
# characters that would require RouterOS-specific escaping.
|
||||
check_ros_value() {
|
||||
label="$1"
|
||||
value="$2"
|
||||
@@ -76,7 +109,7 @@ check_ros_value() {
|
||||
;;
|
||||
esac
|
||||
case "$value" in
|
||||
*'\n'*|*'\r'*)
|
||||
*"\n"*|*"\r"*)
|
||||
echo "$label contains a newline" >&2
|
||||
exit 3
|
||||
;;
|
||||
@@ -84,8 +117,8 @@ check_ros_value() {
|
||||
}
|
||||
|
||||
for pair in \
|
||||
"IMAGE_TAR_ROS=$IMAGE_TAR_ROS" \
|
||||
"ROUTER_DISK=$ROUTER_DISK" \
|
||||
"CONTAINER_NAME=$CONTAINER_NAME" \
|
||||
"CONTAINER_IP=$CONTAINER_IP" \
|
||||
"CONTAINER_GATEWAY=$CONTAINER_GATEWAY" \
|
||||
"CONTAINER_SUBNET=$CONTAINER_SUBNET" \
|
||||
@@ -94,6 +127,9 @@ for pair in \
|
||||
"SURICATA_HOME_NET=$SURICATA_HOME_NET" \
|
||||
"MONITORED_NETWORKS=$MONITORED_NETWORKS" \
|
||||
"BLOCK_TIMEOUT=$BLOCK_TIMEOUT" \
|
||||
"ALERT_IGNORE_SIDS=$ALERT_IGNORE_SIDS" \
|
||||
"ALERT_IGNORE_CATEGORIES=$ALERT_IGNORE_CATEGORIES" \
|
||||
"ADMIN_TOKEN=$ADMIN_TOKEN" \
|
||||
"ROUTEROS_REST_USER=$ROUTEROS_REST_USER" \
|
||||
"ROUTEROS_REST_PASSWORD=$ROUTEROS_REST_PASSWORD" \
|
||||
"ROUTEROS_ADDRESS_LIST=$ROUTEROS_ADDRESS_LIST"
|
||||
@@ -119,73 +155,53 @@ scp_put() {
|
||||
fi
|
||||
}
|
||||
|
||||
printf '[deploy] version: %s\n' "$VERSION"
|
||||
printf '[deploy] container: %s\n' "$CONTAINER_NAME"
|
||||
printf '[deploy] image on RouterOS: %s\n' "$IMAGE_TAR_ROS"
|
||||
printf '[deploy] root-dir: %s\n' "$ROOT_DIR"
|
||||
|
||||
echo "[deploy] RouterOS preflight"
|
||||
if ! ssh_run '/container/print' >/dev/null; then
|
||||
echo "RouterOS container menu is unavailable. Install the matching container package and enable container device-mode first." >&2
|
||||
echo "RouterOS container menu is unavailable." >&2
|
||||
exit 4
|
||||
fi
|
||||
if ! ssh_run "/file/print without-paging where name=\"${IMAGE_TAR_ROS}\"" | grep -F "$IMAGE_TAR_ROS" >/dev/null 2>&1; then
|
||||
echo "Image TAR not found on RouterOS: $IMAGE_TAR_ROS" >&2
|
||||
echo "Upload it first with scripts/upload-routeros-image.sh." >&2
|
||||
exit 5
|
||||
fi
|
||||
if [ "$CONFIGURE_SNIFFER" = "true" ]; then
|
||||
if ! ssh_run '/tool/sniffer/print' >/dev/null; then
|
||||
echo "RouterOS sniffer is unavailable. Check device-mode sniffer=yes before deployment." >&2
|
||||
echo "RouterOS sniffer is unavailable." >&2
|
||||
exit 4
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ROUTER_ARCH" = "auto" ]; then
|
||||
echo "[deploy] detecting RouterOS architecture"
|
||||
RESOURCE="$(ssh_run '/system/resource/print without-paging')"
|
||||
DETECTED="$(printf '%s\n' "$RESOURCE" | awk -F: '/architecture-name/ {gsub(/[[:space:]]/, "", $2); print $2; exit}')"
|
||||
case "$DETECTED" in
|
||||
arm64) ROUTER_ARCH=arm64 ;;
|
||||
x86_64|x86|amd64) ROUTER_ARCH=amd64 ;;
|
||||
arm) ROUTER_ARCH=arm ;;
|
||||
*)
|
||||
echo "Unsupported or undetected RouterOS architecture: ${DETECTED:-unknown}" >&2
|
||||
echo "Set ROUTER_ARCH manually to arm64, amd64 or arm." >&2
|
||||
exit 4
|
||||
;;
|
||||
esac
|
||||
echo "[deploy] RouterOS architecture: $DETECTED -> image target $ROUTER_ARCH"
|
||||
fi
|
||||
|
||||
case "$ROUTER_ARCH" in
|
||||
arm64|amd64|arm) ;;
|
||||
*) echo "ROUTER_ARCH must be auto, arm64, amd64 or arm" >&2; exit 4 ;;
|
||||
esac
|
||||
|
||||
if [ -n "$ENGINE" ]; then
|
||||
ENGINE="$ENGINE" ./scripts/build-routeros.sh "$ROUTER_ARCH"
|
||||
else
|
||||
./scripts/build-routeros.sh "$ROUTER_ARCH"
|
||||
fi
|
||||
|
||||
LOCAL_TAR="build/routeros-suricata-tzsp-${ROUTER_ARCH}.tar"
|
||||
[ -f "$LOCAL_TAR" ] || { echo "Missing $LOCAL_TAR" >&2; exit 5; }
|
||||
|
||||
DEPLOY_ID="$(date -u +%Y%m%d%H%M%S)"
|
||||
REMOTE_TAR_NAME="routeros-suricata-tzsp-${ROUTER_ARCH}-${DEPLOY_ID}.tar"
|
||||
REMOTE_TAR_ROS="${ROUTER_DISK}/${REMOTE_TAR_NAME}"
|
||||
REMOTE_TAR_SCP="${ROUTER_SCP_DIR%/}/${REMOTE_TAR_NAME}"
|
||||
LOCAL_RSC="build/deploy-${DEPLOY_ID}.rsc"
|
||||
REMOTE_RSC_NAME="deploy-${DEPLOY_ID}.rsc"
|
||||
REMOTE_RSC_ROS="${ROUTER_DISK}/${REMOTE_RSC_NAME}"
|
||||
REMOTE_RSC_SCP="${ROUTER_SCP_DIR%/}/${REMOTE_RSC_NAME}"
|
||||
ROOT_DIR="${ROUTER_DISK}/containers/${CONTAINER_NAME}-${DEPLOY_ID}"
|
||||
DATA_DIR="${ROUTER_DISK}/containers/${CONTAINER_NAME}-data"
|
||||
LOG_DIR="${ROUTER_DISK}/containers/${CONTAINER_NAME}-logs"
|
||||
RULES_DIR="${ROUTER_DISK}/containers/${CONTAINER_NAME}-rules"
|
||||
|
||||
REST_URL="https://${CONTAINER_GATEWAY}"
|
||||
CONTAINER_IP_ONLY="${CONTAINER_IP%/*}"
|
||||
|
||||
if [ "$CREATE_REST_USER" = "true" ] && [ "$ROUTEROS_REST_PASSWORD" = "CHANGE_ME" ]; then
|
||||
echo "CREATE_REST_USER=true requires a real ROUTEROS_REST_PASSWORD" >&2
|
||||
exit 6
|
||||
fi
|
||||
|
||||
DEPLOY_ID="$(date -u +%Y%m%d%H%M%S)"
|
||||
mkdir -p build
|
||||
LOCAL_RSC="build/deploy-${CONTAINER_NAME}-${DEPLOY_ID}.rsc"
|
||||
REMOTE_RSC_NAME="deploy-${CONTAINER_NAME}-${DEPLOY_ID}.rsc"
|
||||
REMOTE_RSC_SCP="${ROUTER_SCP_DIR%/}/${REMOTE_RSC_NAME}"
|
||||
[ "$ROUTER_SCP_DIR" = "/" ] && REMOTE_RSC_SCP="/${REMOTE_RSC_NAME}"
|
||||
|
||||
# Keep persistent application state stable between versioned containers.
|
||||
DATA_DIR="${ROUTER_DISK}/containers/suricata-data"
|
||||
LOG_DIR="${ROUTER_DISK}/containers/suricata-logs"
|
||||
RULES_DIR="${ROUTER_DISK}/containers/suricata-rules"
|
||||
REST_URL="https://${CONTAINER_GATEWAY}"
|
||||
CONTAINER_IP_ONLY="${CONTAINER_IP%/*}"
|
||||
|
||||
cat > "$LOCAL_RSC" <<RSC
|
||||
# Generated by scripts/deploy-routeros.sh at ${DEPLOY_ID} UTC.
|
||||
# Image: ${REMOTE_TAR_ROS}
|
||||
# Version: ${VERSION}
|
||||
# Container: ${CONTAINER_NAME}
|
||||
# Image: ${IMAGE_TAR_ROS}
|
||||
# Root: ${ROOT_DIR}
|
||||
|
||||
:if ([:len [/interface/bridge/find where name="${CONTAINER_BRIDGE}"]] = 0) do={
|
||||
/interface/bridge/add name="${CONTAINER_BRIDGE}" comment="Suricata IDS container bridge"
|
||||
@@ -219,6 +235,13 @@ cat > "$LOCAL_RSC" <<RSC
|
||||
/container/envs/add list=IDS_ENV key=ROUTEROS_VERIFY_TLS value="${ROUTEROS_VERIFY_TLS}"
|
||||
/container/envs/add list=IDS_ENV key=ROUTEROS_ADDRESS_LIST value="${ROUTEROS_ADDRESS_LIST}"
|
||||
/container/envs/add list=IDS_ENV key=UPDATE_RULES_ON_START value="${UPDATE_RULES_ON_START}"
|
||||
/container/envs/add list=IDS_ENV key=RULE_UPDATE_INTERVAL_HOURS value="${RULE_UPDATE_INTERVAL_HOURS}"
|
||||
/container/envs/add list=IDS_ENV key=ALERT_RETENTION_DAYS value="${ALERT_RETENTION_DAYS}"
|
||||
/container/envs/add list=IDS_ENV key=ALERT_MAX_SEVERITY value="${ALERT_MAX_SEVERITY}"
|
||||
/container/envs/add list=IDS_ENV key=ALERT_DEDUP_WINDOW_SECONDS value="${ALERT_DEDUP_WINDOW_SECONDS}"
|
||||
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_SIDS value="${ALERT_IGNORE_SIDS}"
|
||||
/container/envs/add list=IDS_ENV key=ALERT_IGNORE_CATEGORIES value="${ALERT_IGNORE_CATEGORIES}"
|
||||
/container/envs/add list=IDS_ENV key=ADMIN_TOKEN value="${ADMIN_TOKEN}"
|
||||
|
||||
/container/mounts/remove [find where list="IDS_MOUNTS"]
|
||||
/container/mounts/add list=IDS_MOUNTS src="${DATA_DIR}" dst=/data
|
||||
@@ -255,42 +278,26 @@ cat >> "$LOCAL_RSC" <<RSC
|
||||
/ip/firewall/filter/add chain=forward action=drop dst-address-list="${ROUTEROS_ADDRESS_LIST}" disabled=yes comment="IDS-BLOCK destination"
|
||||
}
|
||||
|
||||
:local old [/container/find where name="${CONTAINER_NAME}"]
|
||||
:if ([:len \$old] > 0) do={
|
||||
RSC
|
||||
if [ "$REPLACE_EXISTING" = "true" ]; then
|
||||
cat >> "$LOCAL_RSC" <<'RSC'
|
||||
:if ([/container/get $old status] = "running") do={
|
||||
/container/stop $old
|
||||
:delay 3s
|
||||
}
|
||||
/container/remove $old
|
||||
RSC
|
||||
else
|
||||
cat >> "$LOCAL_RSC" <<'RSC'
|
||||
:error "Container already exists and REPLACE_EXISTING=false"
|
||||
RSC
|
||||
fi
|
||||
|
||||
cat >> "$LOCAL_RSC" <<RSC
|
||||
:if ([:len [/container/find where name="${CONTAINER_NAME}"]] > 0) do={
|
||||
:error "Container ${CONTAINER_NAME} already exists"
|
||||
}
|
||||
|
||||
/container/add file="${REMOTE_TAR_ROS}" interface="${CONTAINER_VETH}" root-dir="${ROOT_DIR}" mountlists=IDS_MOUNTS envlist=IDS_ENV name="${CONTAINER_NAME}" start-on-boot=yes logging=yes
|
||||
/container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}" interface="${CONTAINER_VETH}" root-dir="${ROOT_DIR}" mountlists=IDS_MOUNTS envlist=IDS_ENV start-on-boot=yes logging=yes
|
||||
|
||||
:local cid [/container/find where name="${CONTAINER_NAME}"]
|
||||
# Wait until the newly added image has finished extracting, using find filters only.
|
||||
:local tries 0
|
||||
:while (\$tries < 180) do={
|
||||
:if ([/container/get \$cid status] = "stopped") do={
|
||||
:if ([:len [/container/find where name="${CONTAINER_NAME}" and status="stopped"]] > 0) do={
|
||||
:set tries 999
|
||||
} else={
|
||||
:delay 2s
|
||||
:set tries (\$tries + 1)
|
||||
}
|
||||
}
|
||||
:if ([/container/get \$cid status] != "stopped") do={
|
||||
:error "Container image extraction did not reach stopped state"
|
||||
:if ([:len [/container/find where name="${CONTAINER_NAME}" and status="stopped"]] = 0) do={
|
||||
:error "Container extraction did not reach stopped state"
|
||||
}
|
||||
/container/start \$cid
|
||||
/container/start [find where name="${CONTAINER_NAME}"]
|
||||
:delay 5s
|
||||
RSC
|
||||
|
||||
@@ -309,23 +316,20 @@ fi
|
||||
|
||||
cat >> "$LOCAL_RSC" <<RSC
|
||||
|
||||
:log info "Suricata IDS deployment ${DEPLOY_ID}: container created and start requested"
|
||||
:log info "Suricata deployment ${VERSION}: ${CONTAINER_NAME} created from ${IMAGE_TAR_ROS}"
|
||||
/container/print detail where name="${CONTAINER_NAME}"
|
||||
RSC
|
||||
|
||||
printf '[deploy] uploading image via SCP: %s -> %s:%s\n' "$LOCAL_TAR" "$SSH_TARGET" "$REMOTE_TAR_SCP"
|
||||
scp_put "$LOCAL_TAR" "$REMOTE_TAR_SCP"
|
||||
printf '[deploy] uploading RouterOS deployment script: %s\n' "$REMOTE_RSC_SCP"
|
||||
scp_put "$LOCAL_RSC" "$REMOTE_RSC_SCP"
|
||||
|
||||
echo "[deploy] importing configuration and starting container"
|
||||
ssh_run "/import file-name=\"${REMOTE_RSC_ROS}\""
|
||||
echo "[deploy] importing configuration and creating ${CONTAINER_NAME}"
|
||||
ssh_run "/import file-name=\"${REMOTE_RSC_NAME}\""
|
||||
|
||||
if [ "$KEEP_REMOTE_TAR" != "true" ]; then
|
||||
ssh_run "/file/remove [find where name=\"${REMOTE_TAR_ROS}\"]" || true
|
||||
if [ "$KEEP_REMOTE_RSC" != "true" ]; then
|
||||
# The generated RSC may contain the REST password.
|
||||
ssh_run "/file/remove [find where name=\"${REMOTE_RSC_NAME}\"]" || true
|
||||
fi
|
||||
# The generated RSC can contain the REST password, so remove it after import.
|
||||
ssh_run "/file/remove [find where name=\"${REMOTE_RSC_ROS}\"]" || true
|
||||
|
||||
echo "[deploy] final status"
|
||||
ssh_run "/container/print detail where name=\"${CONTAINER_NAME}\""
|
||||
@@ -333,6 +337,7 @@ echo "[deploy] recent container log lines"
|
||||
ssh_run "/log/print without-paging where message~\"suricata|TZSP|IDS\"" || true
|
||||
|
||||
echo "[deploy] done"
|
||||
echo "Container IP: ${CONTAINER_IP_ONLY}"
|
||||
echo "Container: ${CONTAINER_NAME}"
|
||||
echo "Image: ${IMAGE_TAR_ROS}"
|
||||
echo "Root dir: ${ROOT_DIR}"
|
||||
echo "Dashboard: http://${CONTAINER_IP_ONLY}:8080/"
|
||||
echo "AUTO_BLOCK=${AUTO_BLOCK}; firewall DROP rules remain disabled by design."
|
||||
|
||||
Reference in New Issue
Block a user