Merge pull request #3 from simeonmiteff/add-reference

Parse reference options int Rule.References[] and expose classtype

option.go

@@ -9,6 +9,7 @@ const (
 	OptMsg       = "msg"
 	OptRev       = "rev"
 	OptSid       = "sid"
+	OptReference = "reference"
 )
 
 // Option stores parsed option from rule - https://suricata.readthedocs.io/en/latest/rules/intro.html#rule-options

reference.go

@@ -0,0 +1,23 @@
+package suricataparser
+
+import (
+	"errors"
+	"strings"
+)
+
+type Reference struct {
+	Type string
+	Ref  string
+}
+
+// ParseReference from raw string
+func ParseReference(reference string) (*Reference, error) {
+	if reference == "" {
+		return nil, errors.New("reference is never empty")
+	}
+	parts := strings.SplitN(reference, ",", 2)
+	if len(parts) != 2 {
+		return nil, errors.New("reference should be type,ref")
+	}
+	return &Reference{Type: parts[0], Ref: parts[1]}, nil
+}

rule.go

@@ -8,11 +8,12 @@ import (
 
 // Rule stores parsed suricata rule - https://suricata.readthedocs.io/en/latest/rules/intro.html#rules-format
 type Rule struct {
-	Enabled  bool
-	action   string
-	header   string
-	Options  []*Option
-	Metadata *Metadata
+	Enabled    bool
+	action     string
+	header     string
+	Options    []*Option
+	Metadata   *Metadata
+	References []*Reference
 
 	sid       int64
 	gid       int64
@@ -53,6 +54,11 @@ func (r *Rule) Rev() int64 {
 	return r.rev
 }
 
+// ClassType rule class type - https://docs.suricata.io/en/latest/rules/meta.html#classtype
+func (r *Rule) ClassType() string {
+	return r.classtype
+}
+
 // Header defines the protocol, IP addresses, ports and direction of the rule
 func (r *Rule) Header() string {
 	return r.header
@@ -103,6 +109,9 @@ func (r *Rule) fillFromOptions() {
 		if opt.Name == OptMetadata {
 			r.fillMetadata(opt.Value)
 		}
+		if opt.Name == OptReference {
+			r.addReference(opt.Value)
+		}
 	}
 }
 
@@ -111,6 +120,11 @@ func (r *Rule) fillMetadata(rawMetadata string) {
 	r.Metadata.Merge(*parsed)
 }
 
+func (r *Rule) addReference(rawReference string) {
+	parsed, _ := ParseReference(rawReference)
+	r.References = append(r.References, parsed)
+}
+
 func NewRule(enabled bool, action, header, raw string, options []*Option) *Rule {
 	rule := Rule{
 		Enabled:  enabled,