tweaked snort.lua and snort_defaults.lua

diff --git a/ChangeLog b/ChangeLog
index 34d295492f867dd6edfeeb7af529751f38f44698..9ebb43b69b2f64404fbedd6b3c1e55f71330ff19 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,7 @@
 -- updated stream_tcp counts
 -- fix -A log_null etc (ie w/o module)
 -- fixed --help-module format for asciidoc (again)
+-- tweaked snort.lua snort_defaults.lua
 
 121
 -- valgrind fixes

diff --git a/lua/snort.lua b/lua/snort.lua
index 7a886e3cdcd32aead90b28cb3122b05b07320b09..4456512a09ad139b3964559361ff61cdd5699d44 100644 (file)
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -1,5 +1,10 @@
 ---------------------------------------------------------------------------
 -- Snort++ prototype configuration
+---------------------------------------------------------------------------
+
+---------------------------------------------------------------------------
+-- setup environment
+---------------------------------------------------------------------------
 --
 -- let install_dir be a variable indicating where you installed Snort++.
 -- then do:
@@ -8,6 +13,10 @@
 -- export SNORT_LUA_PATH=$install_dir/conf/
 ---------------------------------------------------------------------------
 
+---------------------------------------------------------------------------
+-- setup the basics
+---------------------------------------------------------------------------
+
 require('snort_config')  -- for loading
 
 -- Setup the network addresses you are protecting
@@ -29,9 +38,13 @@ dofile(dir .. 'reference.lua')
 
 ---------------------------------------------------------------------------
 -- configure modules
+---------------------------------------------------------------------------
+--
 -- mod = { } uses internal defaults
 -- you can see them with --help-module mod
 -- comment or delete to disable mod functionality
+--
+-- you can also use default_ftp_server and default_wizard
 ---------------------------------------------------------------------------
 
 ppm = { }
@@ -65,18 +78,18 @@ stream_udp = { }
 
 react = { }
 reject = { }
-rewrite = { }
+--rewrite = { }
 
 wizard = default_wizard
 
 ---------------------------------------------------------------------------
--- ips rules and filters
+-- define / load rules and filters
 ---------------------------------------------------------------------------
 
 local_rules =
 [[
 # snort-classic comments, includes, and rules with $VARIABLES
-alert tcp any any -> any 80 ( http_method; content:"GET"; gid:1; sid:1000051)
+#alert tcp any any -> any 80 ( sid:1; http_method; content:"GET"; )
 ]]
 
 ips =
@@ -84,6 +97,6 @@ ips =
     --include = '../test.rules',
     --include = 'rules/active.rules',
     --rules = local_rules,
-    enable_builtin_rules = true
+    --enable_builtin_rules = true
 }
 

diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index a2726d1bc1e23319809daa85890e8142b71f4af4..e7b202267c574c34ab8360ca543d823ffd6c7690 100644 (file)
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -211,7 +211,7 @@ default_ftp_server =
 -- default wizard
 ---------------------------------------------------------------------------
 
-http_methods = { 'GIT', 'GET', 'POST', 'HEAD' } -- build from default_http_methods
+http_methods = { 'GET', 'POST', 'HEAD' } -- build from default_http_methods
 ftp_commands = { 'USER' } -- add others
 sip_methods = { 'INVITE', 'NOTIFY' } -- add others
 isakmp_hex = { '?????????????????|01|', '?????????????????|10|' }
@@ -283,3 +283,4 @@ default_wizard =
           to_server = telnet_commands, to_client = telnet_commands },
     }
 }
+