nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-03 21:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/suricata: add support for --drop-conf rules (#562044)

Browse Source
This commit is contained in:
Sandro
2026-09-12 17:04:33 +00:00
committed by GitHub
parent 7265c06f3e 23ca81b76b
commit ce86e226c1
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
nixos/modules/services/networking/suricata/default.nix
View File

@@ -149,7 +149,20 @@ in
"2270007"
];
description = ''
List of rules that should be disabled.
List of matchers specifying which rules should be disabled.
These can be raw SID numbers or something like "group:emerging-coinminer.rules".
'';
};
dropRules = mkOption {
type = types.listOf types.str;
default = [ ];
example = literalExpression ''
[ "2274852" "4327876" "902244405" ]
'';
description = ''
List of matchers specifying which rules should be converted to drop rules.
These can be raw SID numbers or something like "group:emerging-coinminer.rules".
'';
};
};
@@ -230,7 +243,8 @@ in
${concatStringsSep "\n" enabledSourcesCmds}
${python.interpreter} ${pkg}/bin/suricata-update update-sources
${python.interpreter} ${pkg}/bin/suricata-update update --suricata-conf ${cfg.configFile} --no-test \
--disable-conf ${pkgs.writeText "suricata-disable-conf" "${concatStringsSep "\n" cfg.disabledRules}"}
--disable-conf ${pkgs.writeText "suricata-disable-conf" "${concatStringsSep "\n" cfg.disabledRules}"} \
--drop-conf ${pkgs.writeText "suricata-drop.conf" "${concatStringsSep "\n" cfg.dropRules}"}
'';
serviceConfig = {
Type = "oneshot";