diff mbox series

ids-functions.pl: Fixes bug#13203 - snort community rules not extracted

Message ID 20230731204617.1411345-1-adolf.belka@ipfire.org
State Dropped
Headers
Series ids-functions.pl: Fixes bug#13203 - snort community rules not extracted |

Commit Message

Adolf Belka July 31, 2023, 8:46 p.m. UTC 
  - The snort top level directory in the archive has been changed from community.rules
   to snort3-community.rules so the regex no longer finds the tarball to extract.
- Modified the regex to include the current snort naming for the top level archive directory

Fixes: Bug#13203
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/cfgroot/ids-functions.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Bernhard Bitsch Aug. 1, 2023, 10:10 a.m. UTC | #1 
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>

Am 31.07.2023 um 22:46 schrieb Adolf Belka:
> - The snort top level directory in the archive has been changed from community.rules
>     to snort3-community.rules so the regex no longer finds the tarball to extract.
> - Modified the regex to include the current snort naming for the top level archive directory
> 
> Fixes: Bug#13203
> Tested-by: Adolf Belka <adolf.belka@ipfire.org>
> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
> ---
>   config/cfgroot/ids-functions.pl | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
> index d97431b4a..f2b2ffc58 100644
> --- a/config/cfgroot/ids-functions.pl
> +++ b/config/cfgroot/ids-functions.pl
> @@ -572,7 +572,7 @@ sub extractruleset ($) {
>   			# Handle rules files.
>   			} elsif ($file =~ m/\.rules$/) {
>   				# Skip rule files which are not located in the rules directory or archive root.
> -				next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file !~ /\//));
> +				next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file =~ /^snort3-$provider-rules\//) || ($packed_file !~ /\//));
>   
>   				# Skip deleted.rules.
>   				#
Adolf Belka Aug. 1, 2023, 10:45 a.m. UTC | #2 
Hi All,

Please note that I have dropped this patch in Patchwork as on its own it 
does not fully solve the problem in bug#13203

It allows the snort community rules file to be extracted and placed into 
/var/lib/suricata and it can then be selected in the customise rules 
table. However every signature in this rules file then fails when parsed 
by suricata and so none of them end up loaded. So something else is 
different and an additional modification is still needed.

Regards,

Adolf.

On 01/08/2023 12:10, Bernhard Bitsch wrote:
> Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
> 
> Am 31.07.2023 um 22:46 schrieb Adolf Belka:
>> - The snort top level directory in the archive has been changed from 
>> community.rules
>>     to snort3-community.rules so the regex no longer finds the tarball 
>> to extract.
>> - Modified the regex to include the current snort naming for the top 
>> level archive directory
>>
>> Fixes: Bug#13203
>> Tested-by: Adolf Belka <adolf.belka@ipfire.org>
>> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
>> ---
>>   config/cfgroot/ids-functions.pl | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/config/cfgroot/ids-functions.pl 
>> b/config/cfgroot/ids-functions.pl
>> index d97431b4a..f2b2ffc58 100644
>> --- a/config/cfgroot/ids-functions.pl
>> +++ b/config/cfgroot/ids-functions.pl
>> @@ -572,7 +572,7 @@ sub extractruleset ($) {
>>               # Handle rules files.
>>               } elsif ($file =~ m/\.rules$/) {
>>                   # Skip rule files which are not located in the rules 
>> directory or archive root.
>> -                next unless(($packed_file =~ /^rules\//) || 
>> ($packed_file =~ /^$provider-rules\//) || ($packed_file !~ /\//));
>> +                next unless(($packed_file =~ /^rules\//) || 
>> ($packed_file =~ /^$provider-rules\//) || ($packed_file =~ 
>> /^snort3-$provider-rules\//) || ($packed_file !~ /\//));
>>                   # Skip deleted.rules.
>>                   #
diff mbox series

Patch

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index d97431b4a..f2b2ffc58 100644
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -572,7 +572,7 @@  sub extractruleset ($) {
 			# Handle rules files.
 			} elsif ($file =~ m/\.rules$/) {
 				# Skip rule files which are not located in the rules directory or archive root.
-				next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file !~ /\//));
+				next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file =~ /^snort3-$provider-rules\//) || ($packed_file !~ /\//));
 
 				# Skip deleted.rules.
 				#