IPS alerting disabled rules - part 2

[mnaiman]

Continuation of #4725

Software version used and hardware type if relevant, e.g.:

Steps to reproduce the behavior:

1. Install package os-intrusion-detection-content-snort-vrt
2. Configure rules
   
3. Enable all rules
4. Create policy
   
5. Verify, that rule is disabled by policy - ok
   
6. Wait for alerts
   

This should not happened. If it is disabled it should not appear at all.

Any idea?

[kulikov-a]

can confirm that policies with __target_action__=disable not commenting rules in opnsense.rules files out.
imho there is a typo when checking the status of the rule in the cache db

core/src/opnsense/scripts/suricata/installRules.py

Line 69 in 70f856b

if (rule_updates[rule_info_record['metadata']['sid']]['enabled']) == '0':

!= '1' works good for me

[AdSchellevis]

got it, looks like a type error

core/src/opnsense/scripts/suricata/lib/rulecache.py

Lines 105 to 110 in b465a41

	if configured_policies[policy_match]['__target_action__'] == 'disable':
	local_change['enabled'] = False
	elif configured_policies[policy_match]['__target_action__'] == 'default':
	local_change['enabled'] = rule['metadata']['enabled']
	else:
	local_change['enabled'] = True

[mnaiman]

wow, now it works as expected, thanks