'returns a lambda function that can be used to filter traffic and the alert message
this function will expect a Packet() object and return True or False'

def parseSnortRule(self, ruletext):

    KEYWORDS = ('msg', 'content')
    msg = ''
    f = []
    rule = ruletext.split('    ', 7)
    (a, proto, sip, sp, arrow, dip, dp) = rule[:7]
    if (len(rule) > 7):
        rule = rule[7]
    else:
        rule = None
    if (a != 'alert'):
        raise Exception('Must    be    alert    rule')
    f.append((('p.proto    ==    "' + proto.upper()) + '"'))
    if (sip != 'any'):
        f.append((('p.sip    ==    "' + sip) + '"'))
    if (dip != 'any'):
        f.append((('p.dip    ==    "' + dip) + '"'))
    if (sp != 'any'):
        f.append(('p.sport    ==    ' + sp))
    if (dp != 'any'):
        f.append(('p.dport    ==    ' + dp))
    f = [(('(' + '    and    '.join(f)) + ')')]
    if rule:
        rule = rule.strip('()').split(';')
    last = None
    while rule:
        try:
            (k, v) = rule.pop(0).strip().split(':', 1)
        except:
            continue
        if (k.lower() == 'content'):
            content = v.strip().strip('"')
            if (content.startswith('|') and content.endswith('|')):
                content = ''.join((('\\x' + c) for c in content.strip('|').split()))
            nocase = depth = offset = distance = within = None
            while rule:
                r = rule[0].strip()
                if (':' in r):
                    (k, v) = r.split(':', 1)
                else:
                    (k, v) = (r, None)
                k = k.lower()
                if (k in KEYWORDS):
                    break
                elif (k == 'nocase'):
                    nocase = True
                elif (k == 'depth'):
                    depth = int(v)
                elif (k == 'offset'):
                    offset = int(v)
                elif (k == 'distance'):
                    distance = int(v)
                elif (k == 'within'):
                    within = int(v)
                rule.pop(0)
            if nocase:
                nocase = '.lower()'
            else:
                nocase = ''
            (st, end) = (offset, depth)
            if last:
                if within:
                    (st, end) = (last, ((last + '+') + str(within)))
                if distance:
                    st = ((last + '+') + str(distance))
            last = ((((((((((('p.pkt' + nocase) + '.find(') + "'") + content) + "'") + nocase) + ',') + str(st)) + ',') + str(end)) + ')    !=    -1')
        if (k.lower() == 'msg'):
            msg = v.strip().strip('"')
    if last:
        f.append((('(' + last) + ')'))
    f = '    and    '.join(f)
    self.debug(('%s DCTB %s DCTB "%s"' % (ruletext, f, msg)))
    return (eval(('lambda(p):    ' + f)), msg)
