Class: Snort::Rule

Inherits:
Object
  • Object
show all
Defined in:
lib/snort/rule.rb,
lib/snort/rule/version.rb

Overview

This class stores and generates the features of a snort rule

Constant Summary collapse

VERSION = 
"1.5.3"

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(kwargs = {}) ⇒ Rule

Initializes the Rule

Parameters:

  • kwargs (Hash) (defaults to: {}) —

    The options to initialize the Rule with

  • kwargs[Array<Snort::RuleOption>] (Hash) —

    a customizable set of options

Options Hash (kwargs):

  • :enabled (String) —

    true or false

  • :action (String) —

    The action

  • :proto (String) —

    The protocol

  • :src (String) —

    The source IP

  • :sport (String) —

    The source Port

  • :dir (String) —

    The direction of traffic flow

  • :dst (String) —

    The destination IP

  • :dport (String) —

    The destination Port



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/snort/rule.rb', line 46

def initialize(kwargs={})
  @enabled = true
  if kwargs.has_key?(:enabled) and (not kwargs[:enabled] or ['false', 'no', 'off'].index(kwargs[:enabled].to_s.downcase))
    @enabled = false
  end
  @action = kwargs[:action] || 'alert'
  @proto = kwargs[:proto] || 'IP'
  @src = kwargs[:src] || 'any'
  @sport = kwargs[:sport] || 'any'
  @dir = kwargs[:dir] || '->'
  @dst = kwargs[:dst] || 'any'
  @dport = kwargs[:dport] || 'any'
  @options = []
  @options_hash = {}
  if kwargs[:options]
    kwargs[:options].each do |opt|
      add_option(opt)
    end
  end
end

Instance Attribute Details

#action ⇒ Object

Returns the value of attribute action.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def action
  @action
end

#dir ⇒ Object

Returns the value of attribute dir.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def dir
  @dir
end

#dport ⇒ Object

Returns the value of attribute dport.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def dport
  @dport
end

#dst ⇒ Object

Returns the value of attribute dst.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def dst
  @dst
end

#enabled ⇒ Object

Returns the value of attribute enabled.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def enabled
  @enabled
end

#options ⇒ Object (readonly)

Returns the value of attribute options.



32
33
34
 
# File 'lib/snort/rule.rb', line 32

def options
  @options
end

#options_hash ⇒ Object

Returns the value of attribute options_hash.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def options_hash
  @options_hash
end

#proto ⇒ Object

Returns the value of attribute proto.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def proto
  @proto
end

#sport ⇒ Object

Returns the value of attribute sport.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def sport
  @sport
end

#src ⇒ Object

Returns the value of attribute src.



31
32
33
 
# File 'lib/snort/rule.rb', line 31

def src
  @src
end

Class Method Details

.parse(string) ⇒ Object

Parse a snort rule to generate an object



151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/snort/rule.rb', line 151

def Rule::parse(string)
  rule = Snort::Rule.new
  rulestr = string.strip
  # If the string begins with /^#+\s*/, then the rule is disabled.
  # If disabled, let's scrub the disabling substring from the string.
  if rulestr.index(/^#/)
    rule.enabled = false
    rulestr.gsub!(/^#+\s*/,'')
  end
  rulepart, optspart = rulestr.split(/\s*\(\s*/,2)
  rule.action, rule.proto, rule.src, rule.sport, rule.dir, rule.dst, rule.dport = rulepart.split(/\s+/)
  if not ['<>', '<-', '->'].index(rule.dir)
    # most likely, I have a parse error, maybe it's just a random comment
    raise ArgumentError.new("Unable to parse rule, #{rulepart}")
  end
  optspart.gsub(/;\s*\).*$/,'').split(/\s*;\s*/).each do |x|
    if x =~ /(.*?):(.*)/
      k, v = x.split(/:/, 2)
      opt = Snort::RuleOption.new(k, v)
      rule.options << opt
      unless rule.options_hash[k]
        rule.options_hash[k] = []
      end
      rule.options_hash[k] << opt
    else
      rule.options.last.arguments << x
    end
  end if optspart
  rule
end

Instance Method Details

#add_option(option) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
 
# File 'lib/snort/rule.rb', line 90

def add_option(option)
  if option.class == Array
    option = Snort::RuleOption.new(option[0], option[1,100])
  end
  @options << option
  unless @options_hash[option.keyword]
    @options_hash[option.keyword] = []
  end
  @options_hash[option.keyword] << option
end

#clear_options ⇒ Object 



108
109
110
111
 
# File 'lib/snort/rule.rb', line 108

def clear_options()
  @options = []
  @options_hash = {}
end

#del_option(option) ⇒ Object 



101
102
103
104
105
106
 
# File 'lib/snort/rule.rb', line 101

def del_option(option)
  @options.delete(option)
  if @options_hash[option.keyword]
    @options_hash[option.keyword].delete(option)
  end
end

#disable ⇒ Object 



86
87
88
 
# File 'lib/snort/rule.rb', line 86

def disable
  @enabled = false
end

#enable ⇒ Object 



82
83
84
 
# File 'lib/snort/rule.rb', line 82

def enable
  @enabled = true
end

#get_option(option_name) ⇒ Object 



113
114
115
116
117
118
119
120
121
122
 
# File 'lib/snort/rule.rb', line 113

def get_option(option_name)
  if @options_hash[option_name]
    if @options_hash[option_name].length == 1
      if @options_hash[option_name][0].arguments.length == 1
        return @options_hash[option_name][0].arguments[0]
      end
    end
  end
  nil
end

#get_option_first(option_name) ⇒ Object 



128
129
130
131
132
133
134
135
136
137
 
# File 'lib/snort/rule.rb', line 128

def get_option_first(option_name)
  if @options_hash[option_name]
    if @options_hash[option_name].length > 0
      if @options_hash[option_name][0].arguments.length > 0
        return @options_hash[option_name][0].arguments[0]
      end
    end
  end
  nil
end

#get_option_last(option_name) ⇒ Object 



139
140
141
142
143
144
145
146
147
148
 
# File 'lib/snort/rule.rb', line 139

def get_option_last(option_name)
  if @options_hash[option_name]
    if @options_hash[option_name].length > 0
      if @options_hash[option_name].last.arguments.length > 0
        return @options_hash[option_name].last.arguments[0]
      end
    end
  end
  nil
end

#get_options(option_name) ⇒ Object 



124
125
126
 
# File 'lib/snort/rule.rb', line 124

def get_options(option_name)
  @options_hash[option_name]
end

#to_s(options_only = false) ⇒ Object

Output the current object into a snort rule



68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/snort/rule.rb', line 68

def to_s(options_only=false)
  rule = ""
  if not @enabled
    rule = "#"
  end
  rule += [@action, @proto, @src, @sport, @dir, @dst, @dport].join(" ") unless options_only
  if @options.any?
    rule += " (" unless options_only
    rule += @options.join(' ')
    rule += ")" unless options_only
  end
  rule
end