~oisf/suricata-update-git/suricata-update-git : changes

~oisf/suricata-update-git/suricata-update-git » Changes from revision 192

From Revision 192 to 173

Rev	Summary	Authors	Date
192	Catch Keyboard Interrupt and exit cleanly. Catch Keyboard Interrupt and exit cleanly. Optimization #2878 https://redmine.openinfosecfoundation.org/issues/2878 Can be done by importing python library signal, and defining a function signal_handler which will print a message if keyboard interrupt is detected and exit the program.	Vrinda Narayan	4 years ago
191	Add "offline" command Add "offline" command Add a command line option `--offline` that uses locally cached latest version of rules without trying to download rules from sources.	Vagisha Gupta	4 years ago
190	Log a warning on duplicate SID Log a warning on duplicate SID Currently when suricata-update encounters a rule with duplicate SIDs, it silently uses the one with the higher revision without logging the warnings. On duplicate SID, warnings are logged for equal as well as different revisions.	Vagisha Gupta	4 years ago
189	Parse rule files alphabetically Parse rule files alphabetically Sort the file names before parsing them. Example: Currently, ``` suricata-update -v ``` generates ``` 24/3/2019 -- 10:38:16 - <Debug> -- Parsing rules/emerging-chat.rules. 24/3/2019 -- 10:38:16 - <Debug> -- Parsing sslblacklist.rules. 24/3/2019 -- 10:38:16 - <Debug> -- Parsing rules/emerging-web_client.rules. 24/3/2019 -- 10:38:16 - <Debug> -- Parsing rules/botcc.portgrouped.rules. 24/3/2019 -- 10:38:16 - <Debug> -- Parsing rules/emerging-smtp.rules. ``` i.e., the rule files are not parsed in alphabetical order. Thus, changing the parser to load these files in alphabetical order by sorting the filenames before starting to work on them fixes the issue. Now the output generated on running ``` suricata-update -v ``` is ``` 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/botcc.rules. 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/ciarmy.rules. 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/compromised.rules. 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/drop.rules. 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/dshield.rules. 24/3/2019 -- 10:34:24 - <Debug> -- Parsing rules/emerging-activex.rules. ``` Rules files are now parsed in sorted order. Closes Redmine ticket #2892	Vidushi Agrawal	4 years ago
188	add test cases for flowbit dependencies and noalert option add test cases for flowbit dependencies and noalert option	Konstantin Klinger	4 years ago
187	rule: recognise more noalert cases rule: recognise more noalert cases This commit ensures that rules only tagged with "noalert;" option and not only with "flowbits:noalert;" will get the rule.noalert value set to true.	Konstantin Klinger	4 years ago
186	make sure that noalert is set in newly enabled rules make sure that noalert is set in newly enabled rules This commit adds functionality that ensures that previously disabled rules enabled by flowbit dependencies will receive the noalert option.	Konstantin Klinger	4 years ago
185	tests: update test index to latest index tests: update test index to latest index	Jason Ish	4 years ago
184	doc: update default index url doc: update default index url From jasonish repo to https://www.openinfosecfoundation.org/rules/index.yaml	Jason Ish	4 years ago
183	index: update embedded intel index index: update embedded intel index	Jason Ish	4 years ago
182	index update: use oisf index, not jasonish index update: use oisf index, not jasonish	Jason Ish	4 years ago
181	address code comments address code comments	Sascha Steinbiss	5 years ago
180	add documentation paragraph about updating add documentation paragraph about updating	Sascha Steinbiss	5 years ago
179	print info log message on changed source parameter print info log message on changed source parameter	Sascha Steinbiss	5 years ago
178	do not fail on repeated enabling/disabling of sources do not fail on repeated enabling/disabling of sources	Sascha Steinbiss	5 years ago
177	Fix default for the --ignore flag Fix default for the --ignore flag suricata-update doesn't properly load some sections in update.yaml file. Example: Even after setting the following in update.yaml ``` ignore: - "deleted.rules" - "pop3.rules" ``` ``` $ ./bin/suricata-update -v ``` generates ``` 16/3/2019 -- 03:14:59 - <Debug> -- Parsing rules/emerging-pop3.rules. 16/3/2019 -- 03:15:01 - <Debug> -- Parsing rules/emerging-deleted.rules. ``` which means the files do not get ignored. It seems that the code loading command line parameters override previous settings even when no parameters are given. Thus changing the default for the --ignore flag from "[]" to "None", fixes the issue. Closes Redmine ticket #2851.	Vidushi Agrawal	5 years ago
176	Fix Failure with --no-merge Fix Failure with --no-merge UnboundLocalError: local variable 'rule' referenced before assignment 'suricata-update --no-merge' runs into an error. 'rule.id' is changed to 'key' variable to fix this issue because 'rule' is not used in the loop. Appended 'key' to the added list i.e. List of rule IDs that have been added.	Vagisha Gupta	5 years ago
175	Add timeout of 30 sec for all GET requests Add timeout of 30 sec for all GET requests suricata-update has been reported to get hung in case the download fails for a particular source. Add a timeout parameter to urllib to avoid that and continue further processing after a timeout of 30 seconds. Closes redmine ticket #2703.	Shivani Bhardwaj	5 years ago
174	Fix null pointer dereference issue detected by coverity Fix null pointer dereference issue detected by coverity Coverity scan of the current code raised the following issue: ``` >>> CID 327298: Null pointer dereferences (FORWARD_NULL) >>> Accessing a property of null-like value "val". 271 if val.find("noalert") > -1: ``` Fix this by adding a null check on val. Closes redmine ticket #2834.	Shivani Bhardwaj	5 years ago
173	Add dhcp-events.rules as a known engine provided rule. Add dhcp-events.rules as a known engine provided rule.	Jason Ish	5 years ago

Older »