Re: Pulledpork doesn't disable some rules

[Y M <snort () outlook com>]

> Ok, I have applied the following solution posted in
> https://code.google.com/p/pulledpork/issues/detail?id=82, using
> modifysid option without luck.
 
This depends on how you are modifying  the rule in the modifysid.conf file, and if there are other rules that check if 
this particular flowbit is set. For example: Rule A --> sets --> flowbit 1Rule B --> checks (isset/isnotset) --> 
flowbit 1 In this case, if you disable Rule A, PulledPork will re-enable it since another rule (Rule B) is checking the 
same flowbit (flowbit 1). The order in which PulledPork will process the rules (modifysid.conf first) is already 
committed to PulledPork v0.7. Which means that if modify (pcre or so as documented) your rule in the modifysid.conf 
file by removing the flowbits setting, it will be processed first, hence, the dependency should be removed already 
before moving along.
YM 
> Date: Mon, 14 Apr 2014 09:29:42 +0000
> From: carlopmart () gmail com
> To: snort-users () lists sourceforge net; pulledpork-users () googlegroups com
> Subject: Re: [Snort-users] Pulledpork doesn't disable some rules
>
> On Mon, Apr 14, 2014 at 7:32 AM, C. L. Martinez <carlopmart () gmail com> wrote:
> > On Mon, Apr 14, 2014 at 6:22 AM, Y M <snort () outlook com> wrote:
> > > This is probably because of the existence of a flowbit in the rule. You
> > > disable it, however, PulledPork checks/verifies flowbits, and will re-enable
> > > rules based on that. Can you run your PulledPork command with -v to output
> > > in verbose mode? If there is a flowbit conflict with your rule disablement,
> > > it will show up in PulledPork output.
> > >
> > > YM
> >
> > Oops .. You are right YM:
> >
> > Cleanup....
> > removed 55 temporary snort files or directories from /tmp/tha_rules!
> > Processing /data/config/etc/idpsuricata02/pulledpork/disablesid.conf....
> > Disabled 1:2009005
> > Disabled 1:2011582
> > Modified 2 rules
> > Done
> > Setting Flowbit State....
> > WARN - 1:2011582 is re-enabled by a check of the
> > ET.http.javaclient.vulnerable flowbit!
> > Enabled 39 flowbits
> > Done
> > Writing rules to unique destination files....
> > Writing rules to /data/config/etc/idpsuricata02/rules/
> > Done
> > Generating sid-msg.map....
> > Done
> > Writing v1 /data/config/etc/idpsuricata02/sid-msg.map....
> > Done
> > Fly Piggy Fly!
> >
> > Uhmm .. How can I avoid this situation??

> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!