in reply to Inserting domain name into Snort rule

Here's one way to get the text string you want, then you just have to plug it in where you need it. 

#!/usr/bin/env perl
use Modern::Perl;

sub fix {
    return join '|', '', ( map { sprintf('%02d',length $_), $_ } split
+ /\./, shift ), '00', '';
}

say fix 'foo.com';
say fix 'foo.foobar.com';
say fix 'foo.foobar.foo.com';

[download]

Aaron B.
Available for small or large Perl jobs; see my home node.

Replies are listed 'Best First'.
Re^2: Inserting domain name into Snort rule
by miniperl (Initiate) on Oct 05, 2012 at 14:01 UTC

    Im probably doing something wrong but I pulled out the join statement and plugged it in to a while loop to read the csv file and all I get are a bunch of |00|.


    #!/usr/bin/perl

    $work = "/var/tmp/work";
    $input = "$work/domainlist.csv";

    open (IN,"$input");
    open (OUT,">domainlist.rules");
    while (<IN>) {
      chomp();
      $domain = $_;

        print join '|', '', ( map { sprintf('%02d',length $domain), $domain } split /\./, shift ), '00', '';

    }
[reply]
[d/l]
[select]

      That's because my code uses shift to get the first argument to the subroutine. If you take it out of the subroutine, you'll need to replace that shift with the variable that contains the value you want to split.

      Aaron B.
      Available for small or large Perl jobs; see my home node.

[reply]

        First of all; thank you very much for your help. I did what you said and its very close but doing some weird stuff.

        Here's what I have:
        #!/usr/bin/perl

        $work = "/var/tmp/work";
        $input = "$work/domainlist.csv";

        open (IN,"$input");
        open (OUT,">domainlist.rules");
        while (<IN>) {
          chomp();
          $domain = $_;

            $dns = join '|', '', ( map { sprintf('%02d',length $_), $_ } split /\./, $domain ), '00', '';
              print "$dns\n";
        }

        What I get is something like this:


        |00|foobar|09|foodomain|04|com

        |00|www|06|foobar|12|foobardomain|03|cc


        If puts the zeros on the front instead of the end and doesn't give a count

        then it counts the next sections correctly

        then it always adds an extra count for the last part, maybe its counting a space or something

[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom