yookd / pulledpork

Automatically exported from code.google.com/p/pulledpork
GNU General Public License v2.0
0 stars 0 forks source link

Cannot get rules as Snort registered user #164

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Copy my old oinkcode and paste it in the Pulledpork config-file
2. Try to update Snort rules

What is the expected output? What do you see instead?
- Rules must be updated without any errors. But there is a problem to get rules 
with config:
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<oinkcode>

What version of the product are you using? On what operating system?
- Version 0.7.0 on one of the latest Ubuntu

Please provide any additional information below.
- It's possible to comment out that line and run Pulledpork script, but link or 
script must be fixed to allow to download rules by Snort registered users

Original issue reported on code.google.com by alexo...@gmail.com on 24 Oct 2014 at 12:59

GoogleCodeExporter commented 9 years ago
Error shown by script:

Checking latest MD5 for snortrules-snapshot-2961.tar.gz....
    Error 422 when fetching https://www.snort.org/reg-rules/snortrules-snapshot-2961.tar.gz.md5 at pulledpork-0.7.0/pulledpork.pl line 463.
    main::md5file('xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', 'snortrules-snapshot-2961.tar.gz', '/tmp/', 'https://www.snort.org/reg-rules/') called at pulledpork-0.7.0/pulledpork.pl line 1847

Original comment by alexo...@gmail.com on 24 Oct 2014 at 1:02

GoogleCodeExporter commented 9 years ago
Found out that script is still trying to download rules snapshot nr. 2961, 
which is no more available. Why it's not downloading the newest 2970?

Original comment by alexo...@gmail.com on 24 Oct 2014 at 3:09

GoogleCodeExporter commented 9 years ago
It seems that that downloadable file name depends on the installed Snort 
version - why? Without Snort update rules will never be updated any more by 
Pulledpork?

Original comment by alexo...@gmail.com on 24 Oct 2014 at 3:41

GoogleCodeExporter commented 9 years ago
I had the same problem.

edited the pulledpork config file to 

rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-2970.tar.gz|<oinkc
ode>

Original comment by mt1...@gmail.com on 31 Oct 2014 at 4:21

GoogleCodeExporter commented 9 years ago
This is just a temporary solution, you will be using rules snapshot 2970 only. 
You could also add Snort version "2.9.7.0" to your pulledpork config file, but 
this is also temporary - with new Snort version this won't get new rules, 2971 
for example. So with every new Snort version we will have to edit pulledpork 
config file manually - not a good strategy to my opinion

Original comment by alexo...@gmail.com on 1 Nov 2014 at 9:00

GoogleCodeExporter commented 9 years ago
You do not have to include the <> characters in the line 

This is the wrong way to do it:
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<1230894719
437235872395487239457242>

This is the right way to do it:
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|12308947194
37235872395487239457242

Original comment by alberc...@gmail.com on 27 Feb 2015 at 8:42

GoogleCodeExporter commented 9 years ago
can you please tell me what this is? I would like to deepen
http://wdfshare.blogspot.com

Original comment by putuindr...@gmail.com on 18 Mar 2015 at 12:40

GoogleCodeExporter commented 9 years ago
Yes you are right YOU must omit/delete "<"  ">" these symbols!

Original comment by estatist...@gmail.com on 28 Mar 2015 at 4:32

GoogleCodeExporter commented 9 years ago
thank you
alberc...@gmail.com

Original comment by badawigh...@gmail.com on 6 May 2015 at 5:55

GoogleCodeExporter commented 9 years ago
Using the rule_url without "<" and ">" using the generic 
snortrules-snapshot.tar.gz still is trying to download the 2960 ruleset.

rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-2972.tar.gz|f5xxxx
xxxxxxxx
Result:
** GET 
https://www.snort.org/reg-rules/snortrules-snapshot-2972.tar.gz.md5/f5xxxxxxxxxx
xxxxx ==> 200 OK (1s)

rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|f5xxxxxxxxx
xxxxxxxxxx
Result
** GET 
https://www.snort.org/reg-rules/snortrules-snapshot-2960.tar.gz.md5/f5xxxxxxxxxx
xxxx ==> 422 Unprocessable Entity

Original comment by twellspr...@gmail.com on 8 May 2015 at 3:33