hpess-logstash-codec-cef 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2aa574df0f3ca9ed883f4baf424f9e1813ab4042
-  data.tar.gz: 1fa77dc3ea0a1bec0f49164484e00208bd952ee7
+  metadata.gz: 82aeade6d1d9b90d7989cd8a9e4d949c8a151d73
+  data.tar.gz: 9245659333045632c105bb6fd6a59d46a3a8df57
 SHA512:
-  metadata.gz: 6f2fe997e0a0ef22f9e74c01e5899e3bf1faa156455e6ec0cb127e56208b5ebed0a38fa06895b9c155f521cdb1565d0e80e4c17ae00ce055fb5169f9d11cbf79
-  data.tar.gz: 1bbe77325063c8804924e1bd49c7a7bccb5a9f819de417cd3be1842c87ab1d3eec09632f5b4becbc9a6b9d446f37e0b81b0b1a6eb0f026989be5514bd0ba9566
+  metadata.gz: 14621f3d0cea8d03006f81a4ce453a1adfc7e9e8cff23231090574b4be0da8215f297ab53be0765d1be6bdf123d0fd93ae59a7ca4ffccf537547d414969fca10
+  data.tar.gz: ed5045e928c7c15e08b59adaf5ad0f52df9841f8be3a88c3123f5fff77058943b8245ece880d7a7b5f01db923203ad4eb88f359715cc3d026c60befd349e3717

data/.gitignore

@@ -3,3 +3,5 @@ vendor
 tools
 .VERSION.mk
 *.gem
+*.lock
+*.swp

data/README.md

@@ -15,7 +15,16 @@ Logstash provides infrastructure to automatically generate documentation for thi
 
 Need help? Try #logstash on freenode IRC or the logstash-users@googlegroups.com mailing list.
 
-## Developing
+## Developing with Docker
+You can use a docker container with all of the requirements pre installed to save you installing the development environment on your host.
+
+### 1. Starting the container
+Simply type `docker-compose run devenv` and you'll be entered into the container.  Then you'll need to do `jruby -S bundle install` to get all the dependencies down.
+
+### 2. Running tests
+Once you've done #1 above, you can run your tests with `jruby -S bundle exec rspec`
+
+## Developing without Docker
 
 ### 1. Plugin Developement and Testing
 
@@ -83,4 +92,4 @@ Programming is not a required skill. Whatever you've seen about open source and
 
 It is more important to the community that you are able to contribute.
 
-For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.

data/docker-compose.yml

@@ -0,0 +1,5 @@
+devenv:
+  image: hpess/devenv-jruby:master
+  entrypoint: /bin/bash
+  volumes:
+    - ./:/storage

data/lib/logstash/codecs/cef.rb

@@ -2,11 +2,7 @@ require "logstash/codecs/base"
 
 class LogStash::Codecs::CEF < LogStash::Codecs::Base
   config_name "cef"
-
-
-  # Specify if the Syslog header will be expected
   config :syslog, :validate => :boolean, :default => false
-
   config :signature, :validate => :string, :default => "Logstash"
   config :name, :validate => :string, :default => "Logstash"
   config :sev, :validate => :number, :default => 6
@@ -20,7 +16,6 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
 
   public
   def decode(data)
-    # Need to break out the headers, then return the headers as individual fields, and the extension to be processed by a filter (ie: KV)
     # %{SYSLOGDATE} %{HOST} CEF:Version|Device Vendor|Device Product|Device Version|SignatureID|Name|Severity|Extension
     event = LogStash::Event.new()
     if @syslog
@@ -30,17 +25,13 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
     else 
       # We don't have syslog headers, so we just need to remove CEF:
       data.sub! /^CEF:/, ''
-    end #if @syslog
-
-    # Default any CEF unknown fields to unknown
-    data.gsub! '||', '|unknown|'
+    end 
 
-    # Now, break out the rest of the headers
-    event['cef_version'], event['cef_vendor'], event['cef_product'], event['cef_device_version'], event['cef_sigid'], event['cef_name'], event['cef_severity'], event['message'] =  data.scan /(?:[^\|\\]|\\.)+/
+    # Get the headers
+    event['cef_version'], event['cef_vendor'], event['cef_product'], event['cef_device_version'], event['cef_sigid'], event['cef_name'], event['cef_severity'], event['message'] =  data.split /(?<!\\)[\|]/
 
-    # Strip any leading or trailing spaces
-    message=event['message']
-    message=message.to_s.strip
+    # Strip any whitespace from the message 
+    message=event['message'].to_s.strip
     event['message']=message
 
     # Now, try to break out the Extension Dictionary

data/logstash-codec-cef.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'hpess-logstash-codec-cef'
-  s.version         = '0.1.5'
+  s.version         = '0.1.6'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "CEF codec to parse CEF formated logs"
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/cef_spec.rb

@@ -5,40 +5,67 @@ require "logstash/codecs/cef"
 require "logstash/event"
 
 describe LogStash::Codecs::CEF do
-  subject do
-    next LogStash::Codecs::CEF.new
-  end
-
-  context "#encode" do
-    it "should assert all header fields are present"
-  end
-
-  context "#decode" do
-    let (:message) { "CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" }
-
-    it "should parse the cef header" do
-      subject.decode(message) do |e|
-        insist { e.is_a?(LogStash::Event) }
-        insist { e["cef_version"] } == "0"
-        insist { e["cef_vendor"] } == "security"
-        insist { e["cef_product"] } == "threatmanager"
-        insist { e["cef_device_version"] } == "1.0"
-        insist { e["cef_sigid"] } == "100"
-        insist { e["cef_name"] } == "trojan successfully stopped"
-        insist { e["cef_severity"] } == "10"
-        insist { e["message"] } == "src=10.0.0.192 dst=12.121.122.82 spt=1232"
-      end
+    subject do
+        next LogStash::Codecs::CEF.new
     end
 
-    it "should parse the cef body" do
-      subject.decode(message) do |e|
-        insist { e["cef_ext_src"] } == "10.0.0.192"
-        insist { e["cef_ext_dst"] } == "12.121.122.82"
-        insist { e["cef_ext_spt"] } == "1232"
-      end
+    context "#encode" do
+        it "should assert all header fields are present"
     end
 
-    it "should handle values in the body that contain spaces"
-  end
+    context "#decode" do
+        let (:message) { "CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" }
+
+        def validate(e) 
+            insist { e.is_a?(LogStash::Event) }
+            insist { e["cef_version"] } == "0"
+            insist { e["cef_device_version"] } == "1.0"
+            insist { e["cef_sigid"] } == "100"
+            insist { e["cef_name"] } == "trojan successfully stopped"
+            insist { e["cef_severity"] } == "10"
+            insist { e["message"] } == "src=10.0.0.192 dst=12.121.122.82 spt=1232"
+        end
+
+        it "should parse the cef headers" do
+            subject.decode(message) do |e|
+                validate(e)
+                insist { e["cef_vendor"] } == "security"
+                insist { e["cef_product"] } == "threatmanager"
+            end
+        end
+
+        it "should parse the cef body" do
+            subject.decode(message) do |e|
+                insist { e["cef_ext_src"] } == "10.0.0.192"
+                insist { e["cef_ext_dst"] } == "12.121.122.82"
+                insist { e["cef_ext_spt"] } == "1232"
+            end
+        end
+
+        let (:missing_headers) { "CEF:0|||1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" }
+        it "should be OK with missing CEF headers (multiple pipes in sequence)" do
+            subject.decode(missing_headers) do |e|
+                validate(e)
+                insist { e["cef_vendor"] } == ""
+                insist { e["cef_product"] } == ""
+            end 
+        end
+
+        let (:leading_whitespace) { "CEF:0|security|threatmaager|1.0|100|trojan successfully stopped|10| src=10.0.0.192 dst=12.121.122.82 spt=1232" }
+        it "should strip leading whitespace from the message" do
+            subject.decode(leading_whitespace) do |e|
+                validate(e)
+            end 
+        end
+
+
+        let (:escaped_pipes) { 'CEF:0|||1.0|100|trojan successfully stopped|10|moo=this\|has an escaped pipe' }
+        it "should be OK with escaped pipes in the message" do
+            subject.decode(escaped_pipes) do |e|
+                insist { e["message"] } == 'moo=this\|has an escaped pipe'
+            end 
+        end
+
+    end
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hpess-logstash-codec-cef
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Elasticsearch
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-04-02 00:00:00.000000000 Z
+date: 2015-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core
@@ -58,6 +58,7 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- docker-compose.yml
 - lib/logstash/codecs/cef.rb
 - lib/logstash/version.rb
 - logstash-codec-cef.gemspec