NAME Snort::Rule - Perl extension for dynamically building snort rules SYNOPSIS use Snort::Rule; $rule = Snort::Rule->new( -action => 'alert', -proto => 'tcp', -src => 'any', -sport => 'any', -dir => '->', -dst => '192.188.1.1', -dport => '44444', ); $rule->opts('msg','Test Rule"'); $rule->opts('threshold','type limit,track by_src,count 1,seconds 3600'); $rule->opts('sid','500000'); print $rule->string()."\n"; OR $rule = 'alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"BLEEDING-EDGE POLICY SMTP US Top Secret PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; classtype:policy-violation; sid:2002448; rev:1;)'; $rule = Snort::Rule->new(-parse => $rule); print $rule->string()."\n"; DESCRIPTION This is a very simple snort rule object. It was developed to allow for scripted dynamic rule creation. Ideally you could dynamically take a list of bad hosts and build an array of snort rule objects from that list. Then write that list using the string() method to a snort rules file. OBJECT METHODS new Reads in the initial headers to generate a rule and constructs the snort::rule object around it. Accepts: -action => [string] ? [alert|log|pass|...] : 'alert' -proto => [string] ? [ip|udp|tcp|...] : 'IP' -src => [string] ? [$strIp] : 'any' -sport => [int] ? [$sport] : 'any' -dir => [string] ? [->|<-|<>] : '->' -dst => [string] ? [$strIp] : 'any' -dport => [int] ? [$dport] : 'any' -opts => [hashref] ? [hashref] : ''; -parse => $strRule # for parsing an existing rule into the object Returns: OBJECTREF string Outputs the rule in string form. print $sr->string()."\n"; Prints "options only" string: print $sr->string(-optionsOnly => 1)."\n"; action Sets and returns the rule action [alert,log,pass,...] $rule->action('alert'); proto Sets and returns the protocol used in the rule [tcp,icmp,udp] $rule->proto('tcp'); src Sets and returns the source used in the rule. Make sure you use SINGLE QUOTES for variables!!! $rule->src('$EXTERNAL_NET'); sport Sets and returns the source port used in the rule $rule->sport(80); dir Sets and returns the direction operator used in the rule, -> <- or <> $rule->dir('->'); dst Sets and returns the destination used in the rule $rule->dst('$HOME_NET'); $rule->dst('192.168.1.1'); dport Sets and returns the destination port used in the rule $rule->dport(6667); opts Sets an option and a value used in the rule. This currently can only be done one set at a time, and is printed in the order it was set. $rule->opts(option,value); $rule->opts('msg','this is a test rule'); This will return a hashref: $hashref->{$keyOrderValue}->{option} and $hashref->{$keyOrderValue}->{value} my $hashref = $rule->opts(); There is a fixQuotes() function that reads through this information before setting it, just to ensure the right options are sane. It's a very very basic function, but it seems to get the job done. This method will also accept HASHREF's for easier use: $rule->opts({ msg => 'test1', rev => '222', content => 'Subject|3A|', nocase => '', }); By passing an option => '', the parser will set its value to "''". When $self->string() is called, the option will be written as: option; ex: nocase => '', will result in an option output of: ...., nocase; ... opt Gets the value of the first option with a given name. $rule->opt(option); print $rule->opt('sid') . ': ' . $rule->opt('msg'); COPYRIGHT AND LICENSE Copyright (C) 2006 by Wes Young This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.6 or, at your option, any later version of Perl 5 you may have available.