Im currently writing a script for python that will enable users to easily configure snort, I have a rule to protect TCP port 23 from access called IoTProtect with the following syntax:
reject tcp any any -> 169.254.183.24 23 (msg:Unauthorized access to IoT device!; sid:00000000;rev:003; )
The issue is that I have added functionality so that a user can add an IP address and this rule will be applied for that IP as well, however, for the rule to work the SID must be incremented by one or be unique.
Currently the python script i've created is:
import fileinput
def incrementsid():
incremented = 0
added = incremented + 2
text = "sid:00000000"
new_text = "sid:0000000{}".format(added)
for line in fileinput.input("C:\\Users\\Admin\\Desktop\\Test\\IoTProtection.rules", inplace = 1):
if text in line:
print(line.replace(line,new_text))
print("Sid replaced!")
else:
print(line.strip())
incrementsid()
However what actually happens is I receive this output:
reject tcp any any -> 169.254.183.24 23 (msg:Unauthorized access to IoT device!; sid:00000000;rev:003; )
and inside my Test folder the IoTProtect.rules file now only says:
sid:00000002
Sid replaced!
where I actually need IoTProtect.rules to say:
reject tcp any any -> 169.254.183.24 23 (msg:Unauthorized access to IoT device!; sid:00000002;rev:003; )
Apologies if my code is garbage but would I would really appreciate any advice or feedback on how to get this functionality working.
Thanks!