From: Russ Combs <rucombs@cisco.com>
Date: Wed, 1 Oct 2014 20:42:36 +0000 (-0400)
Subject: tweaked snort.lua and snort_defaults.lua
X-Git-Tag: 3.0.0-233~1397^2~36
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8d6215575ee6f28d18c0dd5520352dbeeeba494c;p=thirdparty%2Fsnort3.git

tweaked snort.lua and snort_defaults.lua
---

diff --git a/ChangeLog b/ChangeLog
index 34d295492..9ebb43b69 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,7 @@
 -- updated stream_tcp counts
 -- fix -A log_null etc (ie w/o module)
 -- fixed --help-module format for asciidoc (again)
+-- tweaked snort.lua snort_defaults.lua
 
 121
 -- valgrind fixes
diff --git a/lua/snort.lua b/lua/snort.lua
index 7a886e3cd..4456512a0 100644
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -1,5 +1,10 @@
 ---------------------------------------------------------------------------
 -- Snort++ prototype configuration
+---------------------------------------------------------------------------
+
+---------------------------------------------------------------------------
+-- setup environment
+---------------------------------------------------------------------------
 --
 -- let install_dir be a variable indicating where you installed Snort++.
 -- then do:
@@ -8,6 +13,10 @@
 -- export SNORT_LUA_PATH=$install_dir/conf/
 ---------------------------------------------------------------------------
 
+---------------------------------------------------------------------------
+-- setup the basics
+---------------------------------------------------------------------------
+
 require('snort_config')  -- for loading
 
 -- Setup the network addresses you are protecting
@@ -29,9 +38,13 @@ dofile(dir .. 'reference.lua')
 
 ---------------------------------------------------------------------------
 -- configure modules
+---------------------------------------------------------------------------
+--
 -- mod = { } uses internal defaults
 -- you can see them with --help-module mod
 -- comment or delete to disable mod functionality
+--
+-- you can also use default_ftp_server and default_wizard
 ---------------------------------------------------------------------------
 
 ppm = { }
@@ -65,18 +78,18 @@ stream_udp = { }
 
 react = { }
 reject = { }
-rewrite = { }
+--rewrite = { }
 
 wizard = default_wizard
 
 ---------------------------------------------------------------------------
--- ips rules and filters
+-- define / load rules and filters
 ---------------------------------------------------------------------------
 
 local_rules =
 [[
 # snort-classic comments, includes, and rules with $VARIABLES
-alert tcp any any -> any 80 ( http_method; content:"GET"; gid:1; sid:1000051)
+#alert tcp any any -> any 80 ( sid:1; http_method; content:"GET"; )
 ]]
 
 ips =
@@ -84,6 +97,6 @@ ips =
     --include = '../test.rules',
     --include = 'rules/active.rules',
     --rules = local_rules,
-    enable_builtin_rules = true
+    --enable_builtin_rules = true
 }
 
diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index a2726d1bc..e7b202267 100644
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -211,7 +211,7 @@ default_ftp_server =
 -- default wizard
 ---------------------------------------------------------------------------
 
-http_methods = { 'GIT', 'GET', 'POST', 'HEAD' } -- build from default_http_methods
+http_methods = { 'GET', 'POST', 'HEAD' } -- build from default_http_methods
 ftp_commands = { 'USER' } -- add others
 sip_methods = { 'INVITE', 'NOTIFY' } -- add others
 isakmp_hex = { '?????????????????|01|', '?????????????????|10|' }
@@ -283,3 +283,4 @@ default_wizard =
           to_server = telnet_commands, to_client = telnet_commands },
     }
 }
+