NAME

Parse::Snort::Strict - Parse Snort rules with validation of the rules

DESCRIPTION

Parse Snort rules with validation regarding rule action, protocol and direction. Look at Parse::Snort for more usage detail, as this is a subclass of it.

SYNOPSIS

    use Parse::Snort::Strict;
    use Try::Tiny;

    my $rule = Parse::Snort::Strict->new();
    try {
        $rule->parse($text);
    }
    catch {
        warn "Unable to parse rule: $_";
    };

METHODS

action

You can only have the following actions

alert: generate an alert using the selected alert method, and then
log: log the packet
pass: ignore the packet
activate: alert and then turn on another dynamic rule
dynamic: remain idle until activated by an activate rule , then act as a log rule
drop: block and log the packet
reject: block the packet, log it, and then send a TCP reset if the protocol is TCP or an ICMP port unreachable message if the protocol is UDP.
sdrop: block the packet but do not log it.

proto

You can only have the following protocols:

tcp
udp
ip
icmp

direction

You can Only have the following directions

"->"
"<>"
"<-"