Tidy up snort rules with ruletidy.pl

ruletidy.pl

#!/usr/bin/perl
# usage:
# cat local.rules | perl ruletidy.pl > local-tidy.rules
use strict;
use warnings;
use Parse::Snort;
use List::MoreUtils qw(firstidx);

my $parser = new Parse::Snort;

# move the rule message to the beginning
my @prefix = qw(msg);
# move these rule elements to the end
my @postfix = qw(classtype gid sid rev);

while (<>) {
  chomp;
  $parser->parse($_);
  my $opts = $parser->opts();
  my ($pre_options,$post_options);
  
  # pull out prefix elements
  foreach my $pre (@prefix) {
    my $index = firstidx { lc($_->[0]) eq lc($pre) } @$opts;
    next if ($index == -1);
    push @$pre_options, splice (@$opts,$index,1);
  } 
  
  # pull out postfix elements
  foreach my $post (@postfix) {
    my $index = firstidx { lc($_->[0]) eq lc($post) } @$opts;
    next if ($index == -1); 
    push @$post_options, splice (@$opts,$index,1);
  }

  # increment revision;
  my $rev_idx = firstidx { lc($_->[0]) eq "rev"} @$post_options;
  $post_options->[$rev_idx]->[1]++;
  
  my @rebuilt = (@$pre_options, @$opts, @$post_options);
  $parser->opts(\@rebuilt);
  print $parser->as_string,"\n";
}