new ()

new ( )

Create an unpopulated object, that can be filled in using the individual rule element methods, or can be populated with the parse method.

new ( $rule_string )

Create an object based on a plain text Snort rule, all on one line. This module doesn't understand the UNIX style line continuations (a backslash at the end of the line) that Snort does.

  $rule_string = 'alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"perl 6 download detected\; may the world rejoice!";depth:150; offset:0; content:"perl-6.0.0"; nocase;)'
    

new ( $rule_element_hashref )

Create an object baesd on a prepared hash reference similar to the internal strucutre of the Parse::Snort object.

    $rule_element_hashref = {
        action    => 'alert',
        proto     => 'tcp',
        src       => '$EXTERNAL_NET',
        src_port  => 'any',
        direction => '->',
        dst       => '$HOME_NET',
        dst_port  => 'any',
        opts      => [
            ['msg'     => '"perl 6 download detected\; may the world rejoice!"'],
            ['depth'   => 150],
            ['offset'  => 0],
            ['content' => 'perl-6.0.0'],
            ['nocase'],
        ],
    };
    

parse( $rule_string )

  $rule->parse($rule_string);

state

METHODS FOR ACCESSING RULE ELEMENTS

action

The rule action. Generally one of the following: "alert", "pass", "drop", "sdrop", or "log".

proto

The protocol of the rule. Generally one of the following: "tcp", "udp", "ip", or "icmp".

src

The source IP address for the rule. Generally a dotted decimal IP address, Snort $HOME_NET variable, or CIDR block notation.

src_port

The source port for the rule. Generally a static port, or a contigious range of ports.

direction

The direction of the rule. One of the following: "->" "<>" or "<-".

dst

The destination IP address for the rule. Same format as "src"

dst_port

The destination port for the rule. Same format as "src"

opts ( $opts_array_ref )

opts ( $opts_string )

The opts method can be used to read existing options of a parsed rule, or set them. The method takes two forms of arguments, either an Array of Arrays, or a rule string.

HELPER METHODS FOR VARIOUS OPTIONS

sid

rev

msg

classtype

gid

metadata

flow

priority

The these methods allow direct access to the rule option of the same name

  my $sid = $rule_obj->sid(); # reads the sid of the rule
  $rule_obj->sid($sid); # sets the sid of the rule
  ... etc ...
    

references

The "references" method permits read-only access to the "reference:" options in the rule. This is in the form of an array of arrays, with each reference in the format

  [ 'reference_type' => 'reference_value' ]
    

To modify references, use the "opts" method to grab all the rule options, modify it to your needs, and use the "opts" method to save your changes back to the rule object.

  $references = $rule->references(); # just the references
  $no_references = grep { $_->[0] ne "reference" } @{ $rule->opts() }; # everything but the references
    

as_string

The "as_string" method returns a string that matches the normal Snort rule form of the object. This is what you want to use to write a rule to an output file that will be read by Snort.

clone

Returns a clone of the current rule object.

reset

Resets the internal state (deletes it!) of the current rule object, and returns the rule object itself. Useful for parsing multiple rules, one after another. Just call "$rule->reset()" after you're done with the current rule, and before you "$rule->parse()" or set new values via the accessor methods.