Skip to content

Commit fb6478e

Browse files
AlyaGomaaAlyaGomaa
authored
Merge pull request #1090 from stratosphereips/develop
Slips v1.1.4
2 parents 6e6bc6f + 1feaa36 commit fb6478e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+9912
-1112
lines changed

‎.github/workflows/install-slips-dependencies.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Install Slips Dependencies
2+
3+
on:
4+
# workflow_call make this workflow re-usable
5+
workflow_call:
6+
# these are like variables to make the workflow more clean
7+
# we can pass these variable from another workflows if we want
8+
inputs:
9+
zeek-repo-url:
10+
description: 'Zeek repository URL'
11+
required: false
12+
default: 'http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/'
13+
type: string
14+
zeek-key-url:
15+
description: 'Zeek key URL'
16+
required: false
17+
default: 'https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key'
18+
type: string
19+
python-version:
20+
description: 'Python version to set up'
21+
required: false
22+
default: '3.10.12'
23+
type: string
24+
25+
jobs:
26+
install-dependencies:
27+
runs-on: ubuntu-22.04
28+
steps:
29+
- uses: actions/checkout@v4
30+
with:
31+
ref: ${{ github.ref }}
32+
fetch-depth: ''
33+
34+
- name: Enable memory overcommit (for Redis)
35+
run: sysctl vm.overcommit_memory=1
36+
37+
- name: Install APT dependencies
38+
run: |
39+
sudo apt-get update --fix-missing && sudo apt-get -y --no-install-recommends install $(cat install/apt_dependencies.txt)
40+
sudo apt-get -y install font-manager
41+
42+
- name: Save APT Cache
43+
uses: actions/cache@v4
44+
with:
45+
path: |
46+
/var/cache/apt/archives
47+
/var/lib/apt/lists
48+
key: apt-cache
49+
50+
- name: Set up Python with caching enabled
51+
uses: actions/setup-python@v5
52+
with:
53+
python-version: ${{ inputs.python-version }}
54+
cache: 'pip'
55+
56+
- name: Install Python dependencies
57+
run: python3 -m pip install -r install/requirements.txt
58+
59+
- name: Install Zeek
60+
run: |
61+
echo "deb ${{ inputs.zeek-repo-url }} /" | sudo tee /etc/apt/sources.list.d/security:zeek.list
62+
curl -fsSL ${{ inputs.zeek-key-url }} | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/security_zeek.gpg
63+
sudo apt update && sudo apt install -y --no-install-recommends zeek
64+
sudo ln -s /opt/zeek/bin/zeek /usr/local/bin/bro

‎.github/workflows/integration-tests.yml‎

Lines changed: 39 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,45 @@ on:
77
- 'develop'
88

99
jobs:
10-
tests:
10+
# uses the common workflow that builds slips
11+
install-dependencies-using-reusable-workflow:
12+
uses: ./.github/workflows/install-slips-dependencies.yml
13+
14+
15+
integration-tests:
1116
runs-on: ubuntu-22.04
12-
timeout-minutes: 7200
17+
timeout-minutes: 1800
18+
# make this job depend on the first job
19+
needs: install-dependencies-using-reusable-workflow
1320

1421
strategy:
1522
matrix:
1623
test_file:
17-
- tests/integration_tests/test_config_files.py
18-
- tests/integration_tests/test_portscans.py
19-
- tests/integration_tests/test_dataset.py
24+
- test_config_files.py
25+
- test_portscans.py
26+
- test_dataset.py
2027

2128
steps:
2229
- uses: actions/checkout@v4
2330
with:
2431
ref: ${{ github.ref }}
2532
fetch-depth: ''
2633

27-
- name: Install slips dependencies
28-
run: sudo apt-get update --fix-missing && sudo apt-get -y --no-install-recommends install python3 redis-server python3-pip python3-certifi python3-dev build-essential file lsof net-tools iproute2 iptables python3-tzlocal nfdump tshark git whois golang nodejs notify-osd yara libnotify-bin
34+
- name: Restore Zeek Build from Cache
35+
id: zeek-cache
36+
uses: actions/cache@v4
37+
with:
38+
path: /opt/zeek
39+
key: zeek-cache
40+
41+
- name: Restore APT cache
42+
id: apt-cache
43+
uses: actions/cache@v4
44+
with:
45+
path: |
46+
/var/cache/apt/archives
47+
/var/lib/apt/lists
48+
key: apt-cache
2949

3050
- name: Install Zeek
3151
run: |
@@ -34,22 +54,25 @@ jobs:
3454
sudo apt update && sudo apt install -y --no-install-recommends --fix-missing zeek
3555
sudo ln -s /opt/zeek/bin/zeek /usr/local/bin/bro
3656
37-
- name: Set up Python 3.10.12
38-
uses: actions/setup-python@v5
39-
with:
40-
python-version: "3.10.12"
4157
42-
- name: Install Python dependencies
58+
- name: Install apt dependencies (from cache if possible)
59+
run: |
60+
sudo apt-get update
61+
sudo apt-get install -y $(cat install/apt_dependencies.txt)
62+
63+
- name: Install Python dependencies (from cache if possible)
4364
run: |
44-
python -m pip install --upgrade pip
45-
python3 -m pip install --no-cache-dir -r install/requirements.txt
46-
python3 -m pip install pytest-timeout
65+
python3 -m pip install --upgrade pip
66+
python3 -m pip install -r install/requirements.txt
67+
68+
4769
4870
- name: Start redis server
4971
run: redis-server --daemonize yes
5072

5173
- name: Run Integration Tests for ${{ matrix.test_file }}
52-
run: python3 -m pytest ${{ matrix.test_file }} -vvv -s
74+
run: |
75+
python3 -m pytest tests/integration_tests/${{ matrix.test_file }} -p no:warnings -vv -s -n 5
5376
5477
- name: Upload Artifacts
5578
if: success() || failure()

.github/workflows/publish-slips-image.yml renamed to .github/workflows/publish-slips-images.yml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: CI-production-publishing-slips-image
1+
name: CI-production-publishing-slips-images
22

33
on:
44
push:
@@ -40,7 +40,7 @@ jobs:
4040
- name: Set up Docker Buildx
4141
uses: docker/setup-buildx-action@v3
4242

43-
- name: Build and push Slips image using dockerfile
43+
- name: Build and push the main Slips image
4444
id: docker_build_slips
4545
uses: docker/build-push-action@v6
4646
with:
@@ -51,3 +51,15 @@ jobs:
5151
stratosphereips/slips:latest
5252
stratosphereips/slips:${{ env.SLIPS_VERSION }}
5353
push: true
54+
55+
- name: Build and push the light Slips image
56+
id: docker_build_light_slips
57+
uses: docker/build-push-action@v6
58+
with:
59+
allow: network.host
60+
context: ./
61+
file: ./docker/light/Dockerfile
62+
tags: |
63+
stratosphereips/slips_light:latest
64+
stratosphereips/slips_light:${{ env.SLIPS_VERSION }}
65+
push: true

‎.github/workflows/unit-tests.yml‎

Lines changed: 79 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -6,100 +6,110 @@ on:
66
- 'master'
77
- 'develop'
88

9+
910
jobs:
10-
tests:
11+
# uses the common workflow that builds slips
12+
install-dependencies-using-reusable-workflow:
13+
uses: ./.github/workflows/install-slips-dependencies.yml
14+
15+
unit-tests:
1116
runs-on: ubuntu-22.04
1217
timeout-minutes: 1800
18+
# make this job depend on the first job
19+
needs: install-dependencies-using-reusable-workflow
1320

1421
strategy:
1522
matrix:
1623
test_file:
17-
- tests/test_inputProc.py
18-
- tests/test_main.py
19-
- tests/test_conn.py
20-
- tests/test_downloaded_file.py
21-
- tests/test_ssl.py
22-
- tests/test_tunnel.py
23-
- tests/test_ssh.py
24-
- tests/test_dns.py
25-
- tests/test_notice.py
26-
- tests/test_software.py
27-
- tests/test_smtp.py
28-
- tests/test_whitelist.py
29-
- tests/test_arp.py
30-
- tests/test_blocking.py
31-
- tests/test_flow_handler.py
32-
- tests/test_horizontal_portscans.py
33-
- tests/test_http_analyzer.py
34-
- tests/test_vertical_portscans.py
35-
- tests/test_network_discovery.py
36-
- tests/test_virustotal.py
37-
- tests/test_update_file_manager.py
38-
- tests/test_threat_intelligence.py
39-
- tests/test_slips_utils.py
40-
- tests/test_slips.py
41-
- tests/test_profiler.py
42-
- tests/test_leak_detector.py
43-
- tests/test_ip_info.py
44-
- tests/test_evidence.py
45-
- tests/test_asn_info.py
46-
- tests/test_urlhaus.py
47-
- tests/test_markov_chain.py
48-
- tests/test_daemon.py
49-
- tests/test_go_director.py
50-
- tests/test_notify.py
51-
- tests/test_checker.py
52-
- tests/test_base_model.py
53-
- tests/test_set_evidence.py
54-
- tests/test_trustdb.py
55-
- tests/test_cesnet.py
56-
- tests/test_output.py
57-
- tests/test_riskiq.py
58-
- tests/test_spamhaus.py
59-
- tests/test_circllu.py
60-
- tests/test_evidence_handler.py
61-
- tests/test_alert_handler.py
62-
- tests/test_redis_manager.py
63-
- tests/test_ioc_handler.py
64-
- tests/test_timeline.py
65-
- tests/test_database.py
66-
- tests/test_symbols_handler.py
24+
- test_inputProc.py
25+
- test_main.py
26+
- test_conn.py
27+
- test_downloaded_file.py
28+
- test_ssl.py
29+
- test_tunnel.py
30+
- test_ssh.py
31+
- test_dns.py
32+
- test_notice.py
33+
- test_software.py
34+
- test_smtp.py
35+
- test_whitelist.py
36+
- test_arp.py
37+
- test_blocking.py
38+
- test_flow_handler.py
39+
- test_horizontal_portscans.py
40+
- test_http_analyzer.py
41+
- test_vertical_portscans.py
42+
- test_network_discovery.py
43+
- test_virustotal.py
44+
- test_update_file_manager.py
45+
- test_threat_intelligence.py
46+
- test_slips_utils.py
47+
- test_slips.py
48+
- test_profiler.py
49+
- test_leak_detector.py
50+
- test_ip_info.py
51+
- test_evidence.py
52+
- test_asn_info.py
53+
- test_urlhaus.py
54+
- test_markov_chain.py
55+
- test_daemon.py
56+
- test_go_director.py
57+
- test_notify.py
58+
- test_checker.py
59+
- test_base_model.py
60+
- test_set_evidence.py
61+
- test_trustdb.py
62+
- test_cesnet.py
63+
- test_output.py
64+
- test_riskiq.py
65+
- test_spamhaus.py
66+
- test_circllu.py
67+
- test_evidence_handler.py
68+
- test_alert_handler.py
69+
- test_redis_manager.py
70+
- test_ioc_handler.py
71+
- test_timeline.py
72+
- test_database.py
73+
- test_symbols_handler.py
6774

6875
steps:
6976
- uses: actions/checkout@v4
7077
with:
7178
ref: ${{ github.ref }}
7279
fetch-depth: ''
7380

74-
- name: Enable memory overcommit (for redis)
75-
run: sysctl vm.overcommit_memory=1
7681

77-
- name: Install slips dependencies
78-
run: sudo apt-get update --fix-missing && sudo apt-get -y --no-install-recommends install python3 redis-server python3-pip python3-certifi python3-dev build-essential file lsof net-tools iproute2 iptables python3-tzlocal nfdump tshark git whois golang nodejs notify-osd yara libnotify-bin
82+
- name: Restore APT cache
83+
id: apt-cache
84+
uses: actions/cache@v4
85+
with:
86+
path: |
87+
/var/cache/apt/archives
88+
/var/lib/apt/lists
89+
key: apt-cache
90+
91+
- if: ${{ steps.apt-cache.outputs.cache-hit == 'true' }}
92+
name: Echo restored from cache
93+
continue-on-error: true
94+
run: echo "Restored APT dependencies from cache successfully"
7995

80-
- name: Install Zeek
96+
- name: Install Python dependencies (from cache if possible)
8197
run: |
82-
sudo echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
83-
curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null
84-
sudo apt update && sudo apt install -y --no-install-recommends --fix-missing zeek
85-
sudo ln -s /opt/zeek/bin/zeek /usr/local/bin/bro
86-
87-
- name: Set up Python 3.10.12
88-
uses: actions/setup-python@v5
89-
with:
90-
python-version: "3.10.12"
98+
python3 -m pip install --upgrade pip
99+
python3 -m pip install -r install/requirements.txt
91100
92-
- name: Install Python dependencies
101+
- name: Install apt dependencies (from cache if possible)
93102
run: |
94-
python -m pip install --upgrade pip
95-
python3 -m pip install --no-cache-dir -r install/requirements.txt
103+
sudo apt-get update
104+
sudo apt-get install -y $(cat install/apt_dependencies.txt)
105+
96106
97107
- name: Start redis server
98108
run: redis-server --daemonize yes
99109

100110
- name: Run Unit Tests for ${{ matrix.test_file }}
101111
run: |
102-
python3 -m pytest ${{ matrix.test_file }} -p no:warnings -vv -s -n 5
112+
python3 -m pytest tests/${{ matrix.test_file }} -p no:warnings -vv -s -n 5
103113
104114
- name: Upload Artifacts
105115
if: success() || failure()

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,12 @@ repos:
1616
hooks:
1717
- id: trailing-whitespace
1818
- id: check-added-large-files
19+
exclude: ^config/local_ti_files/known_fp_hashes\.csv$
1920
- id: check-docstring-first
2021
- id: check-merge-conflict
2122
- id: end-of-file-fixer
2223
- id: detect-private-key
23-
exclude: .*dataset/.*|
24+
exclude: .*dataset/.* |
2425
(?x)(
2526
^config/$|
2627
.*test.* |

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
- 1.1.4 (Nov 29th, 2024)
2+
- Fix changing the used database in the web interface.
3+
- Reduce false positive evidence about malicious downloaded files.
4+
- Fix datetime errors when running on interface
5+
- Improve the detection of "DNS without connection".
6+
- Add support for a light Slips docker image.
7+
18
- 1.1.3 (October 30th, 2024)
29
- Enhanced Slips shutdown process for smoother operations.
310
- Optimized resource management in Slips, resolving issues with lingering threads in memory.

0 commit comments

Comments
 (0)