lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-16 17:44:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

(IDS) add action to backend rule cache

Browse Source
This commit is contained in:
Ad Schellevis 2015-11-19 14:59:51 +00:00
parent bd2ca8021a
commit 8cb86cc72b
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/opnsense/scripts/suricata/lib/rulecache.py
View File

@ -43,7 +43,7 @@ class RuleCache(object):
def __init__(self):
# suricata rule settings, source directory and cache json file to use
self.cachefile = '%srules.sqlite' % rule_source_directory
self._rule_fields = ['sid', 'msg', 'classtype', 'rev', 'gid', 'source', 'enabled', 'reference']
self._rule_fields = ['sid', 'msg', 'classtype', 'rev', 'gid', 'source', 'enabled', 'reference', 'action']
self._rule_defaults = {'classtype': '##none##'}
@staticmethod
@ -67,6 +67,9 @@ class RuleCache(object):
record = {'enabled': True, 'source': filename.split('/')[-1]}
if rule.strip()[0] == '#':
record['enabled'] = False
record['action'] = rule.strip()[1:].split(' ')[0].replace('#', '')
else:
record['action'] = rule.strip().split(' ')[0]
rule_metadata = rule[rule.find('msg:'):-1]
for field in rule_metadata.split(';'):
@ -137,8 +140,8 @@ class RuleCache(object):
cur = db.cursor()
cur.execute('CREATE TABLE stats (timestamp number, files number)')
cur.execute("""CREATE TABLE rules (sid number, msg TEXT, classtype TEXT,
rev INTEGER, gid INTEGER,reference TEXT,
enabled BOOLEAN,source TEXT)""")
rev INTEGER, gid INTEGER, reference TEXT,
enabled BOOLEAN, action text, source TEXT)""")
last_mtime = 0
all_rule_files = self.list_local()