IPBLACKLIST: /etc/snort/rules/iplists/default.blacklist not updated when -n option used

[marcindulak]

Fedora 23, I'm not sure this is the expected behavior. /etc/snort/rules/iplists/default.blacklist are not updated when -n option is used, /etc/snort/rules/snort.rules are updated.

# pulledpork -V
PulledPork v0.7.2 - E.Coli in your water bottle!

# rm -f /etc/snort/rules/snort.rules
# rm -rf /etc/snort/rules/iplists*
# mkdir /etc/snort/rules/iplists/

# grep -E 'black_list=|IPRVersion=' /etc/pulledpork/pulledpork.conf 
black_list=/etc/snort/rules/iplists/default.blacklist
IPRVersion=/etc/snort/rules/iplists

# grep '^rule_url=' /etc/pulledpork/pulledpork.conf 
rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community
rule_url=http://talosintelligence.com/feeds/ip-filter.blf|IPBLACKLIST|open

# pulledpork -PE -c /etc/pulledpork/pulledpork.conf
# wc -l /etc/snort/rules/snort.rules 
870 /etc/snort/rules/snort.rules
# wc -l /etc/snort/rules/iplists/default.blacklist 
2000 /etc/snort/rules/iplists/default.blacklist

# echo > /etc/snort/rules/snort.rules
# echo > /etc/snort/rules/iplists/default.blacklist

# pulledpork -PEn -c /etc/pulledpork/pulledpork.conf
# wc -l /etc/snort/rules/snort.rules 
870 /etc/snort/rules/snort.rules
# wc -l /etc/snort/rules/iplists/default.blacklist
1 /etc/snort/rules/iplists/default.blacklist

# rm -f /etc/snort/rules/iplistsIPRVersion.dat
# echo > /etc/snort/rules/iplists/default.blacklist
# pulledpork -PEn -c /etc/pulledpork/pulledpork.conf
# test -r /etc/snort/rules/iplistsIPRVersion.dat || echo missing
missing

# pulledpork -PE -c /etc/pulledpork/pulledpork.conf
# wc -l /etc/snort/rules/iplists/default.blacklist 
2000 /etc/snort/rules/iplists/default.blacklist

Maybe related to #129

[shirkdog]

I believe the original intent was to only reload Snort if there were in fact new IPs that need to be loaded into the running binary.

The check "!$NoDownload" achieves this, where the default is $NoDownload set to null, unless you pass -n on the command line.

[WarHead]

v0.7.4

Generating Stub Rules....
An error occurred: WARNING: ip4 normalizations disabled because not inline.

    An error occurred: WARNING: tcp normalizations disabled because not inline.

    An error occurred: WARNING: icmp4 normalizations disabled because not inline.

    An error occurred: WARNING: ip6 normalizations disabled because not inline.

    An error occurred: WARNING: icmp6 normalizations disabled because not inline.

    Done

Reading rules...
Writing Blacklist File /etc/snort/rules/iplists/default.blacklist....
Unable to open /etc/snort/rules/iplists/default.blacklist for writing! - No such file or directory
at /usr/local/bin/pulledpork.pl line 1334.
main::blacklist_write(HASH(0x555e2b562b90), "/etc/snort/rules/iplists/default.blacklist") called at /usr/local/bin/pulledpork.pl line 2347

the directory really doesn't exists on m< system with snort: snort-2.9.14.1.tar.gz