yebenjun / pulledpork

Automatically exported from code.google.com/p/pulledpork
GNU General Public License v2.0
0 stars 0 forks source link

Trying to disable a rule and it does not work (Newbie) #132

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. Running  
pulledpork.pl -vv -c /usr/local/etc/pulledpork/pulledpork.conf -l -T -k

I get the following over and over again:
Use of uninitialized value $filepath in concatenation (.) or string at 
/usr/local/bin/pulledpork.pl line 1029.
Use of uninitialized value $filepath in concatenation (.) or string at 
/usr/local/bin/pulledpork.pl line 1033.
Use of uninitialized value $filepath in concatenation (.) or string at 
/usr/local/bin/pulledpork.pl line 1035.
        Creating VRT-preprocessor.rules

2.
3.

What is the expected output? What do you see instead?
I am trying to disable sid:10065. In my disabled.conf, all I have is: 
10065

What version of the product are you using? On what operating system?
0.6.1 on CentOS 6.4

Please provide any additional information below.
Config File Variable Debug /usr/local/etc/pulledpork/pulledpork.conf
        snort_path = /usr/local/bin/snort
        enablesid = /etc/snort/enablesid.conf
        modifysid = /etc/snort/modifysid.conf
        rule_path = /etc/snort/rules/snort.rules
        ignore = deleted.rules,experimental.rules,local.rules
        state_order = disable,drop,enable
        rule_url = ARRAY(0x9289970)
        sid_changelog = /var/log/snort/sid_changes.log
        sid_msg = /etc/snort/sid-msg.map
        config_path = /etc/snort/snort.conf
        sostub_path = /etc/snort/rules/so_rules.rules
        temp_path = /tmp
        distro = Centos-5-4
        version = 0.6.0
        sorule_path = /usr/local/lib/snort_dynamicrules/
        disablesid = /etc/snort/disablesid.conf
        local_rules = /etc/snort/rules/local.rules
MISC (CLI and Autovar) Variable Debug:
        arch Def is: i386
        Config Path is: /usr/local/etc/pulledpork/pulledpork.conf
        Distro Def is: Centos-5-4
        Keep rulefiles flag is Set
        Disabled policy specified
        local.rules path is: /etc/snort/rules/local.rules
        Rules file is: /etc/snort/rules/snort.rules
        Path to disablesid file: /etc/snort/disablesid.conf
        Path to enablesid file: /etc/snort/enablesid.conf
        Path to modifysid file: /etc/snort/modifysid.conf
        sid changes will be logged to: /var/log/snort/sid_changes.log
        sid-msg.map Output Path is: /etc/snort/sid-msg.map
        Snort Version is: 2.9.4.6
        Snort Config File: /etc/snort/snort.conf
        Snort Path is: /usr/local/bin/snort
        Logging Flag is Set
        Text Rules only Flag is Set
        Extra Verbose Flag is Set
        Verbose Flag is Set

***snip***

Use of uninitialized value $rule_file_path in -d at 
/usr/local/bin/pulledpork.pl line 1832.
Cleanup....
        removed 154 temporary snort files or directories from /tmp/tha_rules!
Processing /etc/snort/disablesid.conf....
        Modified 0 rules
        Done
Processing /etc/snort/enablesid.conf....
        Modified 0 rules
        Done
Setting Flowbit State....

Original issue reported on code.google.com by monahb...@gmail.com on 4 Jul 2013 at 4:11

GoogleCodeExporter commented 8 years ago
Can you try 1:10065 in the disabled.conf file?

Original comment by jth...@gmail.com on 11 Jul 2013 at 11:22

GoogleCodeExporter commented 8 years ago
Thanks :) It worked,  now for my own knowledge, do I need to add a "1:" to 
every sid I need to disable?

Original comment by monahb...@gmail.com on 13 Jul 2013 at 2:57

GoogleCodeExporter commented 8 years ago
Did this work for you, or you still getting errors?
If you are, try the latest development checkout (version 0.7). Closing this for 
now. 

Original comment by shirk...@gmail.com on 26 Jul 2013 at 3:54

GoogleCodeExporter commented 8 years ago
hi

Original comment by saidwali...@gmail.com on 28 Mar 2015 at 6:35