invalid direction in a rule not caught about py-idstools HOT 5 CLOSED

This is kind of on purpose.. I don't want to the parser to break if Snort extends the rule syntax a little but keeps the general format the same. Just like all the option keywords are not validated to make sure they are know, or have the correct format (plus in the past, optional snort modules could extend the Snort rule syntax, so being strict could break valid rules).

For this case specifically, I think its safe to assume the direction parameters will not be extended. So I'll consider tightening up the regex for only valid directions.

from py-idstools.

Yes, snort is a bit of a "free for all" ... a mess really. I could always re-parse it and validate.
Or if idstools.rule.parse returned the direction as an attribute I could check that, maybe that is more flexible for any future changes.

Also, it sees comments as invalid, but I guess I could check for that before calling parse
... or maybe return the action attribute as "comment" ... not sure on this one as ruleman's goal is
to return a single file of enabled rules called snort.rules and drop everything else.

from py-idstools.

Yes, snort is a bit of a "free for all" ... a mess really. I could always re-parse it and validate.
Or if idstools.rule.parse returned the direction as an attribute I could check that, maybe that is more flexible for any future changes.

Good idea. I just pushed this change.

Also, it sees comments as invalid, but I guess I could check for that before calling parse
... or maybe return the action attribute as "comment" ... not sure on this one as ruleman's goal is
to return a single file of enabled rules called snort.rules and drop everything else.

The idea here is to parse a file of rules which may contain arbitrary comments. So comments are infact disable rules, so each and every line is evaluated to check to see if its a rule. If its a commented out line that parses as a rule, its returned as a rule, otherwise None should be returned.

from py-idstools.

So the change is only available on master and not 0.4.2 or 0.4.3 ?
That's ok, I'll do pip install git+https://github.com/jasonish/py-idstools.git.
Thanks

from py-idstools.

You'll need 0.4.3 which is now on PyPI.

On Fri, Dec 12, 2014 at 2:56 PM, chris [email protected] wrote:

So the change is only available on master and not 0.4.2 ?

—
Reply to this email directly or view it on GitHub
#11 (comment).

from py-idstools.