<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 18 okt. 2015, at 20:33, ravin goyal <<a href="mailto:ravirocks1021@gmail.com">ravirocks1021@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><p dir="ltr"><br>
On 18-Oct-2015 10:07 PM, "Jason Ish" <<a href="mailto:lists@unx.ca">lists@unx.ca</a>> wrote:<br>
><br>
> On Fri, Oct 16, 2015 at 6:33 AM, ravin goyal <<a href="mailto:ravirocks1021@gmail.com">ravirocks1021@gmail.com</a>> wrote:<br>
> > Hii all, I am working on suricata-2.0.8 and implemented it in IPS mode<br>
> > to inspect ssl certificate , I am specifically want to inspect ssl<br>
> > traffic and based upon the tls subject field values, we are dropping<br>
> > the packets.<br>
> > Works pretty well<br>
> ><br>
> ><br>
> > But I want to link database with suricata to store rules rather than<br>
> > flat file structure.<br>
> > I am going through the source code but I don't know where should I<br>
> > begin my journey.<br>
> ><br>
> > I would appreciate if you provide an alternate solution to my<br>
> > scenario, if my idea seems pretty broken.<br>
><br>
> I'd try a simpler approach like a small tool that pulled the rules out<br>
> of the database, wrote out the files and then sent Suricata a reload<br>
> signal. If using PostgreSQL, have it run in the background, wait for<br>
> Postgres notifications, write out the rules files and reload.<br>
><br>
> I think I'd explore something like that before modifying Suricata.</p>
<p dir="ltr">Thanks jason , I would try out it first as you have suggest, but my concern is related to real time performance issues with flat file structure.<br></p></div></blockquote><div><br></div><div>How is real time performance related to one rule file that Suricata reads/reloads from - being less performant as opposed to database handling it the process ?</div><div><br></div><br><blockquote type="cite"><div><p dir="ltr">
I want to eliminate the concept of file in it<br>
As database keep on updating (with each read write operation) ,suricata behaves accordingly( dropping packets as per the rules). <br>
Wouldn't it be much simpler??</p>
<p dir="ltr">Regards</p>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/">http://suricata-ids.org/participate/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a></span><br><span>Redmine: <a href="https://redmine.openinfosecfoundation.org/">https://redmine.openinfosecfoundation.org/</a></span><br><span>Developer Training in Copenhagen Sept 14-18: <a href="http://suricata-ids.org/training/">http://suricata-ids.org/training/</a></span></div></blockquote></body></html>