snort-rule 1.1.1 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5769406b39c3f4e4d6f69f7e93dedb7480569ede
-  data.tar.gz: 87099f070762d3fe352aa9394dc9ee7faf366265
+  metadata.gz: 983c58cf46f3b4d8c65327fa4bedcc2e1edebe93
+  data.tar.gz: 45fbd8510d45346efd45603d3b350b1034b556e3
 SHA512:
-  metadata.gz: 9985ac508c0dd80e357e6b7885537b9682f0a7ea0d1b7cacf5d3b3730c22f243d3cf861f36dd6194571e1dd8b78c3e1e798ebb4df0e22410affd2ba6fb2cc773
-  data.tar.gz: 588b14c3522b7283b13c1c481133c83c7fc50510abf73c74f0d87c2f8ae6d7cf995f3b023c8a066d0a19e75b974b948c211f251df13913ddf7f8f6d44d10ced2
+  metadata.gz: dca88327fc2206fe1f8067665815b535d9d2624ddcee0e4a4a4c6e03ffc276a0cc93a1a0b6177c8c73209abe099177abfe4aa888742345302391368fc3f34927
+  data.tar.gz: c6eb769c685cddc3c6195fb27f9b1d40d7cb547083e0d5932c9179986216a90c9bc8d91a642f38d07d79f0fa2f69799c356a3951c5d63ad727afee125e7920ef

data/README.md

@@ -18,6 +18,7 @@ Or install it yourself as:
 
 ## Usage
 
+	require 'snort/rule'
 	rule = Snort::Rule.new({:enabled => true, :action => 'pass', :proto => 'udp', :src => '192.168.0.1', :sport => 'any', :dir => '<>', :dst => 'any', :dport => 53, :opts => {'sid' => 48, 'threshold' => 'type limit,track by_src,count 1,seconds 3600' }})
 
 	rule.to_s => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"
@@ -29,8 +30,15 @@ Or install it yourself as:
 	rule.src = '192.168.0.1'
 	rule.dir = '<>'
 	rule.dport = 53
-	rule.opts['sid'] = 48
-	rule.opts['threshold'] = 'type limit,track by_src,count 1,seconds 3600'
+	rule.options << Snort::RuleOption.new('sid', 48)
+	rule.options << Snort::RuleOption.new('threshold', 'type limit,track by_src,count 1,seconds 3600')
+	rule.options << Snort::RuleOption.new('ref', 'ref1')
+	rule.options << Snort::RuleOption.new('ref', 'ref2')
+	rule.options.each do |opt|
+		puts opt
+	end
+	rule.options_hash["sid"] == 48
+	rule.options_hash["ref"] == "ref2"
 
 	# if the rule is disabled, then it will begin with a #
 	rule.to_s => "#pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"
@@ -46,4 +54,6 @@ Or install it yourself as:
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create new Pull Request
 
-Thanks so much for those who have already contributed.
+Thanks so much for those who have already contributed.
+
+<a href='mailto:github@chrislee[dot]dhs[dot]org[stop here]xxx'><img src='http://chrisleephd.us/images/github-email.png?snort-rule'></a>

data/bin/snortrule

@@ -7,6 +7,7 @@ def usage
 	puts "Usage: #{$0} [-hE] [-a <action>] [-p <protocol>] [-s <srcip>] [-x <srcport>] [-w <direction>] [-d <dstip>] [-c <dstport>] [-o <key:value>] [-o <key:value> ...]"
 	puts "-h             This text."
   puts "-E             Not enabled.  i.e., commented out"
+	puts "-r <rule>      full rule text for parsing and echoing back"
 	puts "-a <action>    alert, log, pass, ... : alert"
 	puts "-p <protocol>  ip, udp, tcp, ... : ip"
 	puts "-s <srcip>     dotted quad IP address : any"

data/lib/snort/rule.rb

@@ -11,7 +11,7 @@ module Snort
 
   # This class stores and generates the features of a snort rule
   class Rule
-    attr_accessor :enabled, :action, :proto, :src, :sport, :dir, :dst, :dport
+    attr_accessor :enabled, :action, :proto, :src, :sport, :dir, :dst, :dport, :options_hash
     attr_reader :options
 
     # Initializes the Rule
@@ -39,6 +39,7 @@ module Snort
       @dst = kwargs[:dst] || 'any'
       @dport = kwargs[:dport] || 'any'
       @options = kwargs[:options] || []
+      @options_hash = Hash[@options.map {|x| [x.keyword, x.arguments]}]
     end
 
     # Output the current object into a snort rule
@@ -48,13 +49,28 @@ module Snort
         rule = "#"
       end
       rule += [@action, @proto, @src, @sport, @dir, @dst, @dport].join(" ") unless options_only
-      if options.any?
+      if @options.any?
         rule += " (" unless options_only
-        rule += options.join(' ')
+        rule += @options.join(' ')
         rule += ")" unless options_only
       end
       rule
     end
+    
+    def add_option(option)
+      @options << option
+      @options_hash = Hash[@options.map {|x| [x.keyword, x.arguments]}]
+    end
+    
+    def del_option(option)
+      @options.delete(option)
+      @options_hash = Hash[@options.map {|x| [x.keyword, x.arguments]}]
+    end
+    
+    def clear_options()
+      @options = []
+      @options_hash = {}
+    end
 
     # Parse a snort rule to generate an object
     def Rule::parse(string)
@@ -78,6 +94,7 @@ module Snort
           rule.options << Snort::RuleOption.new(x)
         end
       end if optspart
+      rule.options_hash = Hash[rule.options.map {|x| [x.keyword, x.arguments]}]
       rule
     end
   end

data/lib/snort/rule/option.rb

@@ -11,10 +11,8 @@ module Snort
     end
 
     def to_s
-      output = @keyword
-      output << ":#{@arguments}" unless @arguments.empty?
-      output << ';'
-      output
+      return "#{@keyword};" if @arguments.empty?
+      "#{@keyword}:#{@arguments};"
     end
 
     def ==(other)

data/lib/snort/rule/version.rb

@@ -1,5 +1,5 @@
 module Snort
   class Rule
-    VERSION = "1.1.1"
+    VERSION = "1.2.0"
   end
 end

data/test/helper.rb

@@ -1,3 +1,5 @@
+# rake warned with suggestion to add gem 'minitest' ahead of require 'minitest/autorun'
+gem 'minitest'
 require 'minitest/autorun'
 require 'minitest/pride'
 require File.expand_path('../../lib/snort/rule.rb', __FILE__)

data/test/test_snort_rule_option.rb

@@ -36,5 +36,18 @@ class TestSnortRuleOption < Minitest::Test
     option2 = Snort::RuleOption.new('msg', '"OHAI"')
     assert_equal option1.hash, option2.hash
   end
+  
+  def test_options_hash
+    strule = 'alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"test"; flow:to_server, established; content:"GET"; http_method; content:"/private.php?"; nocase; http_uri; content:"id="; nocase; http_uri; content:"UNITED"; nocase; http_uri; content:"SELECTED"; nocase; http_uri; pcre:"/UNITED.+SELECTED/Ui"; reference:ref1; reference:ref2; reference:ref3; classtype:test-attack; sid:1234; rev:442;)'
+    rule = Snort::Rule.parse(strule)
+    assert_equal "\"test\"", rule.options_hash["msg"]
+    assert_equal "to_server, established", rule.options_hash["flow"]
+    assert rule.options_hash["http_method"]
+    assert rule.options_hash["http_method"].empty?
+    assert_equal "ref3", rule.options_hash["reference"]
+    assert rule.options_hash["nocase"]
+    assert rule.options_hash["nocase"].empty?
+    assert_nil rule.options_hash["xxxx"]
+  end
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: snort-rule
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.2.0
 platform: ruby
 authors:
 - chrislee35
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-05 00:00:00.000000000 Z
+date: 2014-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler