Suricata rule validator

It reads one rule per line and checks the header grammar: action, protocol, addresses and ports with variables, CIDR, ranges, lists and negation, and the -> or <> direction. Then the option chain: required sid, rev and msg, numeric sid and rev with sid 0 called out as reserved, duplicate sids across the whole pasted set, content modifiers (nocase, depth, within and friends) that must follow a content, sticky buffers like http.uri that reset that context, unknown keywords, unknown classtypes and reference keys against the default classification.config and reference.config, and unknown flow words. Unknown keywords stay warnings on purpose: new Suricata releases and plugins add them. What it does not do: run rules against traffic, resolve your variables, or judge whether a rule is a good idea.