fluent-plugin-nginx-nap-decode 0.1.0 → 0.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +3 -0
- data/fluent-plugin-nginx-nap-decode.gemspec +1 -1
- data/lib/fluent/plugin/filter_nginx_nap_decode.rb +84 -87
- metadata +3 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: '010867c0eee3e9fc2ef76c6d84050864f527321c7c84db81394d3fdd3eab17f8'
|
|
4
|
+
data.tar.gz: 76203ad83b452ef1b9244fda0d0994da2f7b5328065badb05873e3da4b144123
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: dbacb374827831eda39ab2fbfa72289cc416b9c0506fc1d3a42011f521e938c27dfe279e801b156b4abcfdacc06990cc5c1ef67f6caf088bdd35f6ad5fc3eb23
|
|
7
|
+
data.tar.gz: 41790deea3e148c03d6cd8b766a18b047d2b43613cdfa6dc10a5f93b48c464a235c93ee52af75d1060f4f99f1cbb033171bad84ced6101c974e4de4d67047318
|
data/.gitignore
ADDED
|
@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
|
3
3
|
|
|
4
4
|
Gem::Specification.new do |spec|
|
|
5
5
|
spec.name = "fluent-plugin-nginx-nap-decode"
|
|
6
|
-
spec.version = "0.
|
|
6
|
+
spec.version = "0.4.6"
|
|
7
7
|
spec.authors = ["Kostas Skenderidis"]
|
|
8
8
|
spec.email = ["skenderidis@gmail.com"]
|
|
9
9
|
|
|
@@ -26,93 +26,90 @@ module Fluent
|
|
|
26
26
|
def filter(tag, time, record)
|
|
27
27
|
|
|
28
28
|
case record['violations']['violation']['name']
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
#decoded_value = Base64.decode64(encoded_value)
|
|
114
|
-
#record[@output_key] = decoded_value
|
|
115
|
-
#end
|
|
29
|
+
|
|
30
|
+
when 'VIOL_ATTACK_SIGNATURE'
|
|
31
|
+
#Based on observedEntity we will determined if it is cookie/header/url/parameter/etc
|
|
32
|
+
if record['violations'].has_key?('observedEntity')
|
|
33
|
+
#If attack signature is found on cookies
|
|
34
|
+
|
|
35
|
+
if record['violations']['policyEntity'].has_key?('cookies')
|
|
36
|
+
record['violations']['context']='cookies'
|
|
37
|
+
record['violations']['snippet']['buffer-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['snippet']['buffer'])) #base64 decode
|
|
38
|
+
record['violations']['observedEntity']['value-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['value'])) #base64 decode
|
|
39
|
+
# If header is explicit then the NAP does NOT provide the "observedEntity". This
|
|
40
|
+
# This creates a problem with reporting later on, so we added the record "name"
|
|
41
|
+
# Notes: Why is parameters an array!!
|
|
42
|
+
if record['violations']['policyEntity']['cookies'][0]['type']=="wildcard"
|
|
43
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
44
|
+
else
|
|
45
|
+
record['violations']['observedEntity']['name-decode']=record['violations']['policyEntity']['cookies'][0]['name']
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
if record['violations']['policyEntity'].has_key?('headers')
|
|
49
|
+
record['violations']['context']='headers'
|
|
50
|
+
record['violations']['snippet']['buffer-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['snippet']['buffer'])) #base64 decode
|
|
51
|
+
record['violations']['observedEntity']['value-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['value'])) #base64 decode
|
|
52
|
+
# If header is explicit then the NAP does NOT provide the "observedEntity". This
|
|
53
|
+
# This creates a problem with reporting later on, so we added the record "name"
|
|
54
|
+
# Notes: Why is parameters an array!!
|
|
55
|
+
if record['violations']['policyEntity']['headers'][0]['type']=="wildcard"
|
|
56
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
57
|
+
else
|
|
58
|
+
record['violations']['observedEntity']['name-decode']=record['violations']['policyEntity']['headers'][0]['name']
|
|
59
|
+
end
|
|
60
|
+
end
|
|
61
|
+
if record['violations']['policyEntity'].has_key?('parameters')
|
|
62
|
+
record['violations']['context']='parameters'
|
|
63
|
+
record['violations']['snippet']['buffer-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['snippet']['buffer'])) #base64 decode
|
|
64
|
+
record['violations']['observedEntity']['value-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['value'])) #base64 decode
|
|
65
|
+
# If parameter is explicit then the NAP does NOT provide the "observedEntity". This
|
|
66
|
+
# This creates a problem with reporting later on, so we added the record "name"
|
|
67
|
+
# Notes: Why is parameters an array!!
|
|
68
|
+
if record['violations']['policyEntity']['parameters'][0]['type']=="wildcard"
|
|
69
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
70
|
+
else
|
|
71
|
+
record['violations']['observedEntity']['name-decode']=record['violations']['policyEntity']['parameters'][0]['name']
|
|
72
|
+
end
|
|
73
|
+
end
|
|
74
|
+
if record['violations']['policyEntity'].has_key?('urls')
|
|
75
|
+
record['violations']['context']='urls'
|
|
76
|
+
record['violations']['snippet']['buffer-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['snippet']['buffer'])) #base64 decode
|
|
77
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
78
|
+
end
|
|
79
|
+
else
|
|
80
|
+
record['violations']['context']='request'
|
|
81
|
+
record['violations']['snippet']['buffer-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['snippet']['buffer'])) #base64 decode
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
|
|
85
|
+
when 'VIOL_COOKIE_LENGTH', 'VIOL_HEADER_LENGTH', 'VIOL_URL_METACHAR'
|
|
86
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
87
|
+
|
|
88
|
+
when 'VIOL_PARAMETER_VALUE_METACHAR', 'VIOL_PARAMETER_DATA_TYPE', 'VIOL_PARAMETER_EMPTY_VALUE', 'VIOL_PARAMETER_NUMERIC_VALUE', 'VIOL_PARAMETER_VALUE_LENGTH'
|
|
89
|
+
record['violations']['observedEntity']['value-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['value'])) #base64 decode
|
|
90
|
+
# If parameter is explicit then the NAP does NOT provide the "observedEntity".
|
|
91
|
+
# For consistency we create the observedEntity.value
|
|
92
|
+
# This creates a problem with reporting later on, so we added the record "name"
|
|
93
|
+
# Notes: Why is parameters an array!!
|
|
94
|
+
if record['violations']['policyEntity']['parameters'][0]['type']=="wildcard"
|
|
95
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
96
|
+
else
|
|
97
|
+
record['violations']['observedEntity']['name-decode']=record['violations']['policyEntity']['parameters'][0]['name']
|
|
98
|
+
end
|
|
99
|
+
|
|
100
|
+
|
|
101
|
+
when 'VIOL_URL_LENGTH', 'VIOL_POST_DATA_LENGTH', 'VIOL_QUERY_STRING_LENGTH', 'VIOL_REQUEST_LENGTH'
|
|
102
|
+
record['violations']['observedEntity']['value-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['value'])) #base64 decode
|
|
103
|
+
# If filetype is explicit then the NAP does NOT provide the "observedEntity".
|
|
104
|
+
# For consistency we create the observedEntity.value
|
|
105
|
+
# This creates a problem with reporting later on, so we added the record "name"
|
|
106
|
+
# Notes: Why is filetypes an array!!
|
|
107
|
+
if record['violations']['policyEntity']['filetypes'][0]['type']=="wildcard"
|
|
108
|
+
record['violations']['observedEntity']['name-decode']=URI.encode_www_form_component(Base64.decode64(record['violations']['observedEntity']['name'])) #base64 decode
|
|
109
|
+
else
|
|
110
|
+
record['violations']['observedEntity']['name-decode']=record['violations']['policyEntity']['filetypes'][0]['name']
|
|
111
|
+
end
|
|
112
|
+
|
|
116
113
|
end
|
|
117
114
|
record
|
|
118
115
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: fluent-plugin-nginx-nap-decode
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.4.6
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Kostas Skenderidis
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2023-10-
|
|
11
|
+
date: 2023-10-20 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: fluentd
|
|
@@ -37,6 +37,7 @@ executables: []
|
|
|
37
37
|
extensions: []
|
|
38
38
|
extra_rdoc_files: []
|
|
39
39
|
files:
|
|
40
|
+
- ".gitignore"
|
|
40
41
|
- Gemfile
|
|
41
42
|
- LICENSE
|
|
42
43
|
- README.md
|