worked poc

scripts/update-rules.sh

@@ -1,23 +1,85 @@
 #!/bin/sh
 set -eu
 
+NO_RELOAD=false
+if [ "${1:-}" = "--no-reload" ]; then
+  NO_RELOAD=true
+fi
+
 if ! command -v suricata-update >/dev/null 2>&1; then
   cd "$(dirname "$0")/.."
   if command -v docker >/dev/null 2>&1; then
-    exec docker compose exec -T ids /opt/ids/scripts/update-rules.sh
+    exec docker compose exec -T ids /opt/ids/scripts/update-rules.sh "$@"
   fi
   echo "suricata-update is not installed; run this script inside the IDS container" >&2
   exit 2
 fi
 
-suricata-update
-RULES=/var/lib/suricata/rules/suricata.rules
-LOCAL=/opt/ids/suricata/local.rules
-if ! grep -q 'sid:1000001;' "$RULES"; then
-  printf '\n# ---- local project rules ----\n' >> "$RULES"
-  cat "$LOCAL" >> "$RULES"
+STATE_DIR="${SURICATA_STATE_DIR:-/data/suricata}"
+RULES="/var/lib/suricata/rules/suricata.rules"
+SURICATA_CONFIG="${SURICATA_CONFIG:-/etc/suricata/suricata.yaml}"
+SURICATA_HOME_NET="${SURICATA_HOME_NET:-[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]}"
+SURICATA_EXTRA_RULES_GLOB="${SURICATA_EXTRA_RULES_GLOB:-/data/suricata/*.rules}"
+SURICATA_THRESHOLD_CONFIG="${SURICATA_THRESHOLD_CONFIG:-/data/suricata/threshold.config}"
+
+mkdir -p "$STATE_DIR" /var/lib/suricata/rules
+for name in disable.conf enable.conf modify.conf threshold.config; do
+  [ -f "$STATE_DIR/$name" ] || : > "$STATE_DIR/$name"
+done
+
+TMP_DIR="$(mktemp -d /tmp/suricata-rule-update.XXXXXX)"
+BACKUP="$TMP_DIR/suricata.rules.previous"
+VALIDATE_LOG="$TMP_DIR/validate-log"
+mkdir -p "$VALIDATE_LOG"
+HAD_RULES=false
+if [ -s "$RULES" ]; then
+  cp -p "$RULES" "$BACKUP"
+  HAD_RULES=true
 fi
+cleanup() {
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT HUP INT TERM
+
+restore_previous_rules() {
+  if [ "$HAD_RULES" = "true" ]; then
+    cp -p "$BACKUP" "$RULES"
+  else
+    rm -f "$RULES"
+  fi
+}
+
+echo "[rules] downloading enabled feeds with suricata-update"
+if ! suricata-update \
+  --disable-conf="$STATE_DIR/disable.conf" \
+  --enable-conf="$STATE_DIR/enable.conf" \
+  --modify-conf="$STATE_DIR/modify.conf"; then
+  echo "[rules] download/update failed; restoring previous rules" >&2
+  restore_previous_rules
+  exit 10
+fi
+
+[ -f "$RULES" ] || : > "$RULES"
+
+echo "[rules] validating downloaded rules before activation"
+if ! suricata -T \
+  -c "$SURICATA_CONFIG" \
+  -l "$VALIDATE_LOG" \
+  -s "$SURICATA_EXTRA_RULES_GLOB" \
+  --set "vars.address-groups.HOME_NET=$SURICATA_HOME_NET" \
+  --set "threshold-file=$SURICATA_THRESHOLD_CONFIG"; then
+  echo "[rules] validation failed; restoring previous known-good rules" >&2
+  restore_previous_rules
+  exit 11
+fi
+
 chown suricata:suricata "$RULES"
+chmod 0644 "$RULES"
+
+if [ "$NO_RELOAD" = "true" ]; then
+  echo "Rules downloaded, validated and installed; reload skipped"
+  exit 0
+fi
 
 PID=""
 if [ -f /run/suricata.pid ]; then
@@ -25,7 +87,7 @@ if [ -f /run/suricata.pid ]; then
 fi
 if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then
   kill -USR2 "$PID"
-  echo "Rules updated; live reload requested for Suricata PID $PID"
+  echo "Rules downloaded, validated and installed; live reload requested for Suricata PID $PID"
 else
-  echo "Rules updated; Suricata is not currently running"
+  echo "Rules downloaded, validated and installed; Suricata is not currently running"
 fi