From 15799cf57e28e60ce87b11b5a40565da8ccdb26a Mon Sep 17 00:00:00 2001
From: Timo Sigurdsson <public_timo.s@silentcreek.de>
Date: Sun, 11 Oct 2020 02:25:37 +0200
Subject: [PATCH 1/2] Add test for Suricata IDS/IPS

Commit 94e0a4e added a test for the Suricata binary, but the result appears to
be used nowhere. Add a proper test for an active Suricata daemon in the
IDS/IPS tooling section.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
---
 include/tests_tooling | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/include/tests_tooling b/include/tests_tooling
index 7fed8460..c70ac847 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -372,6 +372,33 @@
     fi
 #
 #################################################################################
+#
+    # Test        : TOOL-5130
+    # Description : Check for Suricata
+    Register --test-no TOOL-5130 --weight L --network NO --category security --description "Check for active Suricata daemon"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Suricata presence
+        if [ -n "${SURICATABINARY}" ]; then
+            Report "ids_ips_tooling[]=suricata"
+            LogText "Result: Suricata is installed (${SURICATABINARY})"
+            # Suricata status
+            # Suricata sets its process name to Suricata-Main on Linux, but this might differ on other platforms,
+            # so fall back to checking the full commandline instead if the first test fails
+            if IsRunning "Suricata-Main" || IsRunning --full "${SURICATABINARY} "; then
+                # Only satisfy test TOOL-5190 if Suricata is actually running
+                IDS_IPS_TOOL_FOUND=1
+                LogText "Result: Suricata daemon is active"
+                Display --indent 2 --text "- Checking Suricata status" --result "${STATUS_RUNNING}" --color GREEN
+            else
+                LogText "Result: Suricata daemon not active"
+                Display --indent 2 --text "- Checking Suricata status" --result "${STATUS_NOT_RUNNING}" --color YELLOW
+            fi
+        else
+            LogText "Result: Suricata not installed (suricata not found)"
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : TOOL-5160
     # Description : Check for OSSEC

From b7d5b8a4b90064da922c4d007ecec61a4f4c4115 Mon Sep 17 00:00:00 2001
From: Timo Sigurdsson <public_timo.s@silentcreek.de>
Date: Sun, 11 Oct 2020 11:15:48 +0200
Subject: [PATCH 2/2] Update tests.db and CHANGELOG.md for new test TOOL-5130

Add the new test TOOL-5130 (Check for active Suricata daemon) to the tests
database and update the changelog accordingly.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
---
 CHANGELOG.md | 7 +++++++
 db/tests.db  | 1 +
 2 files changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0728f8c9..a7f7e88f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Lynis Changelog
 
+## Lynis 3.0.2 (not released yet)
+
+### Added
+- New test: TOOL-5130 - Check for active Suricata daemon
+
+---------------------------------------------------------------------------------
+
 ## Lynis 3.0.1 (2020-10-05)
 
 ### Added
diff --git a/db/tests.db b/db/tests.db
index 26fc8f87..867fa4a5 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -425,6 +425,7 @@ TOOL-5102:test:security:tooling::Check for presence of Fail2ban:
 TOOL-5104:test:security:tooling::Enabled tests for Fail2ban:
 TOOL-5120:test:security:tooling::Presence of Snort IDS:
 TOOL-5122:test:security:tooling::Snort IDS configuration file:
+TOOL-5130:test:security:tooling::Check for active Suricata daemon:
 TOOL-5160:test:security:tooling::Check for active OSSEC daemon:
 TOOL-5190:test:security:tooling::Check presence of available IDS/IPS tooling:
 USB-1000:test:security:storage:Linux:Check if USB storage is disabled: