Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable modifications of rules #10

Open
NDietrich opened this issue Jul 3, 2021 · 0 comments
Open

Enable modifications of rules #10

NDietrich opened this issue Jul 3, 2021 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@NDietrich
Copy link
Collaborator

This is a major feature that's needed.
After all rules are downloaded, PP needs to have a mechanism for the rules to be modified based on user needs (changing 'alert' to 'drop' when the severity > 2 for a simple example).
This can be done with a DSL (domain specific language) and the Lark parser. Basically we create a grammar describing an individual rule, and have Lark parse each rule into a parse tree.
we then have a DSL that allows the user to write complex rules that will modify the ruleset rules. Some DSL rule examples:

disable ((gid != 1) and (metadata contains "community"))
modify (action = reject ) where (sid > 1000)
modify (dst_ports = 'https_ports' ) where ((dst_ports == "https_ports")   and (flow != "to_client" ) )

The user would create a file with these commands in them, and PP would use these DSL rules to modify the rules individually.

I have code that does this, but it's not ready for primetime yet (slow when it scales up, and there are a few edge cases in the grammar describing a rule which I need to handle.
I'll create a new branch for this feature so people can test it once I iron out a few bugs.

@NDietrich NDietrich added the enhancement New feature or request label Jul 3, 2021
@NDietrich NDietrich self-assigned this Jul 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant