threshold 0.0.3 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 80c9df2ec5e67d9e05e5424a136adf096550cfb2
-  data.tar.gz: c3e99e5725ba57c4f55c254348fc7a2168655018
+  metadata.gz: a1bada0dac9f9f832e9ffcc50fa9faea1ab14a3d
+  data.tar.gz: 30cf5b417e323b2508e3d32291809d8b6d92f4a2
 SHA512:
-  metadata.gz: 6c8a93ec39c051fefa5f0b72a5f058ba9387f8fdfb11218c91315af3086ac8673229b08f0356b99870b98260e8918ff09ee9b15f5d5fae57eee4984694c57e6b
-  data.tar.gz: da6daf4ccea9b2581a9b9f3e6f043b4b29eec4d215db777e391e288181344383904116b5a0bc01289206dd383ccddce0e7bb516b621f6d40228a5b6ad7c18ad0
+  metadata.gz: b1a99450cd9e0187944d439a0194033ddefbabac23a49f283f4e898f9f51515726751f20cc7d810774dedb10dc5e9eeeb895c0d67e2bf96d360321e2ced76fc2
+  data.tar.gz: 3144ca335eb414503518ce1b67eed32b1c0888eb49c403955338cb214b35bc948b4c3456436e0bc5bdef60bfef56f7710f06f70584d269e1e9e074c2d974b789

data/README.md

@@ -1,7 +1,66 @@
 # snort-thresholds
+[![Gem Version](https://badge.fury.io/rb/threshold.png)](http://badge.fury.io/rb/threshold)
 
-[![Build Status](https://travis-ci.org/shadowbq/snort-thresholds.svg?branch=master)](https://travis-ci.org/shadowbq/snort-thresholds) [![Code Climate](https://codeclimate.com/github/shadowbq/snort-thresholds/badges/gpa.svg)](https://codeclimate.com/github/shadowbq/snort-thresholds) [![Test Coverage](https://codeclimate.com/github/shadowbq/snort-thresholds/badges/coverage.svg)](https://codeclimate.com/github/shadowbq/snort-thresholds)
+Threshold is an ORM to map to Snort 2.9.x threshold.conf files.
 
-Work in progress 
+It currently supports all standalone snort filters generally found in a threshold configuration. These include  suppressions, event_filters, and rate_filters as defined in [Snort README.filters](https://github.com/jasonish/snort/blob/master/doc/README.filters
+). 
+
+## Code Status
+
+[![Build Status](https://travis-ci.org/shadowbq/snort-thresholds.svg?branch=master)](https://travis-ci.org/shadowbq/snort-thresholds) 
+[![Code Climate](https://codeclimate.com/github/shadowbq/snort-thresholds/badges/gpa.svg)](https://codeclimate.com/github/shadowbq/snort-thresholds) 
+[![Test Coverage](https://codeclimate.com/github/shadowbq/snort-thresholds/badges/coverage.svg)](https://codeclimate.com/github/shadowbq/snort-thresholds)
+
+Look at the branch **tags** for current & prior releases. 
+
+## Installation
+
+`$> gem install threshold`
+
+## Usage
+
+This is an example Threshold accessing `/tmp/threshold.conf` for loading, appending a new suppression, validiating the configuration, and writing the changes back to the file (flush).
+
+```ruby
+2.1.2 :001 > require 'threshold'
+ => true 
+2.1.2 :002 > a = Threshold::Thresholds.new
+ => [] 
+2.1.2 :003 > a.file = '/tmp/threshold.conf'
+ => "/tmp/threshold.conf" 
+2.1.2 :004 > a.loadfile
+ => [{"SUPPRESSION"=>["suppress gen_id 1, sig_id 2"], "GID"=>["1", nil, nil], "SID"=>["2", nil, nil]}, {"SUPPRESSION"=>["suppress gen_id 444, sig_id 2"], "GID"=>["444", nil, nil], "SID"=>["2", nil, nil]}] 
+2.1.2 :005 > a.valid?
+ => true 
+2.1.2 :006 > b = Threshold::Suppression.new
+ => #<Threshold::Suppression:0x00000002a576f0> 
+2.1.2 :007 > b.gid=124
+ => 124 
+2.1.2 :008 > b.sid=45544
+ => 45544 
+2.1.2 :009 > a << b
+ => [#<Threshold::Suppression:0x00000002a87b98 @gid=1, @sid=2>, #<Threshold::Suppression:0x00000002a846c8 @gid=444, @sid=2>, #<Threshold::Suppression:0x00000002a576f0 @gid=124, @sid=45544>] 
+2.1.2 :010 > a.flush
+ => true 
+```
+
+Filtering the Threshold Object can be achieved with common Array like methods. (ex. `reject` )
+
+```ruby
+require 'threshold'
+a = Threshold::Thresholds.new
+a.file = '/tmp/threshold.conf'
+a.loadfile
+a = a.reject{|t| t.gid==1}
+```
+
+## Contibuting
+
+* See [CONTRIBUTING.md](/CONTRIBUTING.md)
+
+## Credits
+
+* [Shadowbq](https://github.com/shadowbq)
+* [Yabbo](https://github.com/yabbo)
 
-https://github.com/jasonish/snort/blob/master/doc/README.filters

data/lib/threshold/event_filter.rb

@@ -121,7 +121,7 @@ module Threshold
         self.count = result["COUNT"].compact.first.to_i
         self.seconds = result["SECONDS"].compact.first.to_i
         if result.key?("COMMENT")
-          self.comment = result["COMMENT"].compact.first
+          self.comment = result["COMMENT"].compact.first.chomp
         end
         raise InvalidEventFilterObject unless self.valid?
       rescue

data/lib/threshold/rate_filter.rb

@@ -159,7 +159,7 @@ module Threshold
           self.apply_to = result["IPCIDR"].compact.first
         end
         if result.key?("COMMENT")
-          self.comment = result["COMMENT"].compact.first
+          self.comment = result["COMMENT"].compact.first.chomp
         end
         raise InvalidRateFilterObject unless self.valid?
       rescue

data/lib/threshold/suppression.rb

@@ -99,7 +99,7 @@ module Threshold
           self.ip = result["IP"].compact.first
         end
         if result.key?("COMMENT")
-          self.comment = result["COMMENT"].compact.first
+          self.comment = result["COMMENT"].compact.first.chomp
         end
         raise InvalidSuppressionObject unless self.valid?
       rescue

data/lib/threshold/thresholds.rb

@@ -6,10 +6,18 @@ module Threshold
   class MissingThresholdFileConfiguration < StandardError; end
   class ThresholdAtomicLockFailure < StandardError; end
 
-  class Thresholds < Array
+  class Thresholds
+
+    extend Forwardable
 
     attr_accessor :file, :readonly
 
+    def_delegators :@thresholds, :<<, :length, :push, :pop, :first, :last, :<=>, :==, :clear, :[], :[]=, :shift, :unshift, :each, :sort!, :shuffle!, :collect!, :map!, :reject!, :delete_if, :select!, :keep_if, :index, :include?
+
+    def initialize(thresholds = [])
+      @thresholds = thresholds
+    end
+
     # Write changes to the file
     def flush
       begin 
@@ -34,7 +42,7 @@ module Threshold
 
     # Clears current collection and Read in the thresholds.conf file 
     def loadfile!
-      self.clear
+      @thresholds.clear
       loadfile
     end
 
@@ -66,21 +74,7 @@ module Threshold
         return false
       end
     end
-
-    # This should transpose? back to a Thresholds class not return as an Array. (super)
-    def sort
-      raise InvalidThresholdsObject unless valid?
-      new_temp = super
-      temp = Thresholds.new
-      new_temp.each {|item| temp << item}
-      return temp
-    end
-
-    def sort!
-      raise InvalidThresholdsObject unless valid?
-      super
-    end
-
+    
     def to_s
       output = ""
 
@@ -95,6 +89,54 @@ module Threshold
     def stored_hash
       @stored_hash
     end
+    
+    ## Forwardable Corrections:
+    ## Corrected for forwardable due to Core Array returning new Arrays on the methods.
+
+    # Array(@thresholds) Creates a new Array on @threshold.sort so.. direct forwardable delegation fails.
+    
+    def sort
+      Thresholds.new(@thresholds.sort)
+    end
+
+    def reverse
+      Thresholds.new(@thresholds.reverse)
+    end
+
+    def shuffle
+      Thresholds.new(@thresholds.shuffle)
+    end
+
+    def reject(&blk)
+      if block_given? 
+        Thresholds.new(@thresholds.reject(&blk))
+      else
+        Thresholds.new(@thresholds.reject)
+      end   
+    end
+
+    def select(&blk)
+      if block_given? 
+        Thresholds.new(@thresholds.select(&blk))
+      else
+        Thresholds.new(@thresholds.select)
+      end   
+    end
+
+    #Uniques by default to printable output
+    def uniq(&blk)
+      if block_given? 
+        Thresholds.new(@thresholds.uniq(&blk))
+      else
+        Thresholds.new(@thresholds.uniq{ |lineitem| lineitem.to_s })
+      end   
+    end  
+
+    ## Complex Methods
+    ## &(union), | (intersect), + (concat) 
+
+    ## Should rework to perform to_s before comparison..
+    ## include?, index 
 
     private
 

data/lib/threshold/version.rb

@@ -1,4 +1,4 @@
   module Threshold
-    VERSION = '0.0.3'
+    VERSION = '0.1.0'
     SNORT_VERSION='~>2.9.3'
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: threshold
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.1.0
 platform: ruby
 authors:
 - Shadowbq
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-21 00:00:00.000000000 Z
+date: 2015-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: veto