fluent-plugin-aws_waf_ip_sets 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 90a886b4611ee28a83cb80adfb6f34f628a61dc2
+  data.tar.gz: d8410c97f37fd33d178da76266c0287cad0fe690
+SHA512:
+  metadata.gz: 60636815733336b62ff26078c67111f3ebcbd6371aef9c019110383a7747aded621ea4b5821bdfe47f7c3740c20afd832fd3d843bf1072fa7b5b78db827256ee
+  data.tar.gz: e367172e7de02baa09c4caface5569b79853aa7e1916d1a193df1380ad6a92e4ddef533650f3143b586178428632305b8fed53602130ce032e587f3c41fe2a08

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+README.md
+ChangeLog.md
+
+LICENSE.txt

data/.gitignore

@@ -0,0 +1,9 @@
+Gemfile.lock
+doc/
+pkg/
+tmp/
+**/*.gem
+.yardoc/
+.bundle/
+vendor/bundle/
+.tags

data/.rdoc_options

@@ -0,0 +1,16 @@
+--- !ruby/object:RDoc::Options
+encoding: UTF-8
+static_path: []
+rdoc_include:
+  - .
+charset: UTF-8
+exclude: 
+hyperlink_all: false
+line_numbers: false
+main_page: README.md
+markup: markdown
+show_hash: false
+tab_width: 8
+title: fluent-plugin-aws_waf_ip_sets Documentation
+visibility: :protected
+webcvs:

data/.travis.yml

@@ -0,0 +1,15 @@
+language: ruby
+
+rvm:
+  - 2.1
+  - 2.2
+  - 2.3
+  - 2.4
+
+os:
+  - linux
+
+gemfile:
+  - Gemfile
+
+script: 'bundle exec rake test'

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gemspec

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2017 Hiroshi Toyama
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,58 @@
+# fluent-plugin-aws_waf_ip_sets
+<!-- [![Build Status](https://secure.travis-ci.org/toyama0919/fluent-plugin-aws_waf_ip_sets.png?branch=master)](http://travis-ci.org/toyama0919/fluent-plugin-aws_waf_ip_sets) -->
+
+AWS waf ip_sets automation plugin for fluentd
+
+## Examples
+```
+<match lambda.**>
+  @type aws_waf_ip_sets
+  ip_address_key ip_address
+  dos_threshold 1000
+  ip_set_id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  white_list 192.168.0.1
+  buffer_path /tmp/test
+  time_slice_format %Y%m%d_%H%M
+  time_slice_wait 10s
+  buffer_type file
+</match>
+```
+
+## parameter
+
+* ip_address_key
+  * ip address key of record
+
+* dos_threshold
+  * threshold
+
+* ip_set_id
+  * AWS waf ip_set_id
+
+* white_list
+  * white list ip address (comma separated values)
+
+## Installation
+```
+fluent-gem install fluent-plugin-aws_waf_ip_sets
+```
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new [Pull Request](../../pull/new/master)
+
+## Information
+
+* [Homepage](https://github.com/toyama0919/fluent-plugin-aws_waf_ip_sets)
+* [Issues](https://github.com/toyama0919/fluent-plugin-aws_waf_ip_sets/issues)
+* [Documentation](http://rubydoc.info/gems/fluent-plugin-aws_waf_ip_sets/frames)
+* [Email](mailto:toyama0919@gmail.com)
+
+## Copyright
+
+Copyright (c) 2017 Hiroshi Toyama
+

data/Rakefile

@@ -0,0 +1,11 @@
+require 'bundler/gem_tasks'
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test
+

data/exsample/exsample.conf

@@ -0,0 +1,16 @@
+<source>
+  type forward
+  port 24224
+</source>
+
+<match lambda.**>
+  @type aws_waf_ip_sets
+  ip_address_key ip_address
+  dos_threshold 1000
+  ip_set_id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  white_list 192.168.0.1
+  buffer_path /tmp/test
+  time_slice_format %Y%m%d_%H%M
+  time_slice_wait 10s
+  buffer_type file
+</match>

data/fluent-plugin-aws_waf_ip_sets.gemspec

@@ -0,0 +1,25 @@
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |gem|
+  gem.name          = "fluent-plugin-aws_waf_ip_sets"
+  gem.version       = "0.0.1"
+  gem.summary       = %q{AWS waf ip_sets automation plugin for fluentd}
+  gem.description   = %q{AWS waf ip_sets automation plugin for fluentd}
+  gem.license       = "MIT"
+  gem.authors       = ["Hiroshi Toyama"]
+  gem.email         = "toyama0919@gmail.com"
+  gem.homepage      = "https://github.com/toyama0919/fluent-plugin-aws_waf_ip_sets"
+
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ['lib']
+
+  gem.add_runtime_dependency "aws-sdk"
+  gem.add_development_dependency 'bundler'
+  gem.add_development_dependency 'fluentd'
+  gem.add_development_dependency 'rake', '~> 10.3.2'
+  gem.add_development_dependency 'rdoc', '~> 4.0'
+  gem.add_development_dependency 'rubocop', '~> 0.24.1'
+  gem.add_development_dependency 'rubygems-tasks', '~> 0.2'
+end

data/lib/fluent/plugin/out_aws_waf_ip_sets.rb

@@ -0,0 +1,81 @@
+module Fluent
+  class AwsWafIPSetsOutput < TimeSlicedOutput
+    Fluent::Plugin.register_output('aws_waf_ip_sets', self)
+    config_param :ip_address_key, :string
+    config_param :dos_threshold, :integer
+    config_param :ip_set_id, :string
+    config_param :ip_set_type, :enum, list: [:IPV4, :IPV6], :default => 'IPV4'
+    config_param :white_list, :string, :default => '127.0.0.1'
+
+    def initialize
+      super
+      require 'aws-sdk'
+    end
+
+    def configure(conf)
+      super
+      @white_list = @white_list.split(',')
+      log.info("white list => #{@white_list}")
+    end
+
+    def start
+      super
+      @client =  Aws::WAFRegional::Client.new
+    end
+
+    def shutdown
+      super
+    end
+
+    def format(tag, time, record)
+      [tag, time, record].to_msgpack
+    end
+
+    def write(chunk)
+      counter = Hash.new{ |h,k| h[k] = 0 }
+      chunk.msgpack_each do |(tag, time, record)|
+        counter[record[ip_address_key]] += 1
+      end
+
+      counter.each do |ip_address, count|
+        if @dos_threshold < count
+          update_ip_set(ip_address)
+        end
+      end
+    end
+
+    private
+
+    def get_change_token
+      @client.get_change_token.change_token
+    end
+
+    def update_ip_set(ip_address)
+      if @white_list.include?(ip_address)
+        log.info("white list ip_address => [#{ip_address}]")
+        return
+      end
+
+      updates = [
+        {
+          action: 'INSERT',
+          ip_set_descriptor: {
+            type: @ip_set_type,
+            value: "#{ip_address}/32"
+          }
+        }
+      ]
+
+      begin
+        resp = @client.update_ip_set({
+          change_token: get_change_token,
+          ip_set_id: @ip_set_id,
+          updates: updates
+        })
+        log.info("INSERT block ip_address => [#{ip_address}]")
+      rescue => e
+        log.error("\n#{e.message}\n#{e.backtrace.join("\n")}")
+      end
+    end
+  end
+end

data/test/helper.rb

@@ -0,0 +1,18 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'test/unit'
+
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'fluent/test'
+require 'fluent/plugin/out_aws_waf_ip_sets'
+
+class Test::Unit::TestCase
+end

data/test/plugin/test_out_aws_waf_ip_sets.rb

@@ -0,0 +1,37 @@
+require 'helper'
+class AwsWafIPSetsOutputTest < Test::Unit::TestCase
+  def setup
+    Fluent::Test.setup
+  end
+
+  DEFAULT_CONFIG = %[
+
+  ]
+
+  def create_driver(conf = DEFAULT_CONFIG)
+    config = %[
+      apikey testkey
+      buffer_path tmp/buffer
+    ] + conf
+
+    Fluent::Test::BufferedOutputTestDriver.new(Fluent::AwsWafIPSetsOutput) do
+      def write(chunk)
+        chunk.instance_variable_set(:@key, @key)
+        super(chunk)
+      end
+    end.configure(config)
+  end
+
+  def test_configure
+    d = create_driver
+
+    {
+      :@apikey => 'testkey',
+      :@use_ssl => true,
+      :@auto_create_table => true,
+      :@buffer_type => 'file' 
+    }.each { |k, v|
+      assert_equal(d.instance.instance_variable_get(k), v)
+    }
+  end
+end

metadata

@@ -0,0 +1,156 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-aws_waf_ip_sets
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Hiroshi Toyama
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-07-11 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 10.3.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 10.3.2
+- !ruby/object:Gem::Dependency
+  name: rdoc
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.24.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.24.1
+- !ruby/object:Gem::Dependency
+  name: rubygems-tasks
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+description: AWS waf ip_sets automation plugin for fluentd
+email: toyama0919@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".document"
+- ".gitignore"
+- ".rdoc_options"
+- ".travis.yml"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- exsample/exsample.conf
+- fluent-plugin-aws_waf_ip_sets.gemspec
+- lib/fluent/plugin/out_aws_waf_ip_sets.rb
+- test/helper.rb
+- test/plugin/test_out_aws_waf_ip_sets.rb
+homepage: https://github.com/toyama0919/fluent-plugin-aws_waf_ip_sets
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.11
+signing_key: 
+specification_version: 4
+summary: AWS waf ip_sets automation plugin for fluentd
+test_files:
+- test/helper.rb
+- test/plugin/test_out_aws_waf_ip_sets.rb