#!/bin/bash
#
# suricata:    Advanced Network Intrusion Detection System
#
# chkconfig: - 60 40
# description: The Suricata Engine is an Open Source Next Generation Intrusion
#              Detection and Prevention Engine. This engine is not intended to
#              just replace or emulate the existing tools in the industry, but
#              will bring new ideas and technologies to the field. This new Engine
#              supports Multi-threading, Automatic Protocol Detection (IP, TCP,
#              UDP, ICMP, HTTP, TLS, FTP and SMB! ), Gzip Decompression, Fast IP
#              Matching, and GeoIP identification.
# processname: /usr/sbin/suricata
# config:      /etc/suricata/suricata.yaml
# config:      /etc/sysconfig/suricata

# Sanity checks.
[ -f /etc/suricata/suricata.yaml ] || exit 0
[ -x /usr/sbin/suricata ] || exit 0

# Source function library.
. /etc/init.d/functions

LISTENMODE="af-packet"
INTERFACE="eth0"
QUEUE=0

# Source an auxiliary options file if we have one.
[ -r /etc/sysconfig/suricata ] && . /etc/sysconfig/suricata

RETVAL=0
prog=suricata

if [ "$LISTENMODE" == "af-packet" ]; then
    LISTENOPT="-i $INTERFACE"
fi
if [ "$LISTENMODE" == "nfq" ]; then
    LISTENOPT="-q $QUEUE"
fi

start () {
    [ -d /var/run/suricata ] || mkdir /var/run/suricata
    chown suricata:suricata /var/run/suricata
    echo -n $"Starting $prog: "
    daemon /usr/sbin/suricata -c /etc/suricata/suricata.yaml --user suricata --pidfile /var/run/suricata/suricata.pid -D $OPTIONS
    RETVAL=$?
    echo
    if [ $RETVAL -eq 0 ]; then
        touch /var/lock/subsys/suricata
        /usr/libexec/suricata/post_start
    fi
    return $RETVAL
}

stop () {
    echo -n $"Stopping $prog: "
    /usr/libexec/suricata/pre_stop
    /usr/sbin/suricatasc -c shutdown >/dev/null 2>&1
    RETVAL=$?
    if [ $RETVAL -eq 0 ]; then
       	rm -f /var/lock/subsys/suricata
        rm -f /var/run/suricata/suricata.pid
       	success $"$prog shutdown"
    else
       	failure $"$prog shutdown"
    fi
    echo
    return $RETVAL
}

restart() {
    stop
    start
}

# See how we were called.
case "$1" in
    start)
	[ -e /var/lock/subsys/suricata ] || start
	RETVAL=$?
	;;
    stop)
	[ ! -e /var/lock/subsys/suricata ] || stop
	RETVAL=$?
	;;
    status)
	status suricata
	RETVAL=$?
	;;
    restart)
	restart
	RETVAL=$?
	;;
    reload)
    	echo -n $"Reloading $prog: "
    	kill -USR2 $(pidof suricata)
    	RETVAL=$?
    	echo
	;;
    *)
	echo $"Usage: $0 {start|stop|status|restart|reload|condrestart}"
	RETVAL=1
	;;
esac
exit $RETVAL
