Filter the rules object for rules that comply with the given criteria :param rules: YARA rules JSON object :param sup_ver_string: the maximum YARA version that is supportted by the product :param sup_modules: the supported modules :param with_crypto: indicates if the product's Y
(rules, sup_ver_string, sup_modules=[], with_crypto=True)
| 113 | |
| 114 | |
| 115 | def filter_requirements(rules, sup_ver_string, sup_modules=[], with_crypto=True): |
| 116 | """ |
| 117 | Filter the rules object for rules that comply with the given criteria |
| 118 | :param rules: YARA rules JSON object |
| 119 | :param sup_ver_string: the maximum YARA version that is supportted by the product |
| 120 | :param sup_modules: the supported modules |
| 121 | :param with_crypto: indicates if the product's YARA has been compiled with OpenSSL |
| 122 | :return: list of filtered rules |
| 123 | """ |
| 124 | filtered_rules = [] |
| 125 | version_check = True |
| 126 | if sup_ver_string == "": |
| 127 | version_check = False |
| 128 | else: |
| 129 | sup_version = version.parse(sup_ver_string) |
| 130 | re_crypto = re.compile(REGEX_CRYPTO_FEATURES) |
| 131 | # Process the rules |
| 132 | for rule in rules: |
| 133 | # YARA version filter |
| 134 | if version_check: |
| 135 | # Filter rules that need versions that are not supported |
| 136 | if 'minimum_yara' in rule: |
| 137 | req_version = version.parse(rule['minimum_yara']) |
| 138 | # If required version is higher than supported version, skip the rule |
| 139 | if req_version > sup_version: |
| 140 | continue |
| 141 | # Crypto / OpenSSL filter |
| 142 | if not with_crypto: |
| 143 | if re_crypto.search(rule['content'], re.MULTILINE): |
| 144 | continue |
| 145 | # Module filter |
| 146 | if 'required_modules' in rule: |
| 147 | one_unsupported = False |
| 148 | for m in rule['required_modules']: |
| 149 | if m not in sup_modules: |
| 150 | one_unsupported = True |
| 151 | # If a single required module is unsupported, then skip the rule |
| 152 | if one_unsupported: |
| 153 | continue |
| 154 | filtered_rules.append(rule) |
| 155 | |
| 156 | return filtered_rules |
| 157 | |
| 158 | |
| 159 | def filter_tags(rules, tags=[]): |