logstash-codec-cef 6.0.0-java → 6.0.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30965bf1274a21adf481546aeef0435748e4ff33758d5dac3f02ff40191a0f88
-  data.tar.gz: f8860f9eeb553c05e960b75836a1a82aaa1dcd0559251c124434b07660964566
+  metadata.gz: dd13e0f9bfc0b86dcd6d9f3f9b062a10ecb14113bf4c2064d3fdee3067b1cca2
+  data.tar.gz: 62193bfe55ae9faebb85ddc6c734c80125df69a91fe5c7a922dd91e6f2785acd
 SHA512:
-  metadata.gz: 4d52df92912ea498c721d70e02619d879c3d900e721b67b215bbf87bcc14184655b7e4af6bbc52e3e2e79e73e54565e59ab11982734d931d80b810f568fdda35
-  data.tar.gz: d951daf3544ce79a61efef3fe2038c91f0eb219bd5874aeab0623c8225b4ca0bd9ed1a025a69001d9670e4f514a56cabbf58f16ef345c0f33021fd12a7dea5dc
+  metadata.gz: bd27d064fa1a760dbf1f8c9afe53d0c3b1d561c3d195c199ae2748b3c4067bff64b4abd838f6413811f863e4adcf7ec6403c215ae04d038741198f94ea325922
+  data.tar.gz: 6038f059336b2e5dd896716d577cae12a6798ff850b9b4ac7f28312e863de931f9fa4b1ab189a3230dba38a9373f3c7c68814b1c1acc19296462bda3c95de19f

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 6.0.1
+ - Fixed support for deep dot notation [#73](https://github.com/logstash-plugins/logstash-codec-cef/pull/73)
+
 ## 6.0.0
  - Removed obsolete `sev` and `deprecated_v1_fields` fields
 

data/lib/logstash/codecs/cef.rb

@@ -189,13 +189,16 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
   # commas, periods, and square-bracketed index offsets.
   #
   # To support this, we look for a specific sequence of characters that are followed by an equals sign. This pattern
-  # will correctly identify all strictly-legal keys, and will also match those that include a dot "subkey"
+  # will correctly identify all strictly-legal keys, and will also match those that include a dot-joined "subkeys" and
+  # square-bracketed array indexing
   #
   # That sequence must begin with one or more `\w` (word: alphanumeric + underscore), which _optionally_ may be followed
-  # by "subkey" sequence consisting of a literal dot (`.`) followed by a non-whitespace character, then one or more word
-  # characters, and then one or more characters that do not convey semantic meaning within CEF (e.g., literal-pipe (`|`),
-  # whitespace (`\s`), literal-dot (`.`), literal-equals (`=`), or literal-backslash ('\')).
-  EXTENSION_KEY_PATTERN = /(?:\w+(?:\.[^\s]\w+[^\|\s\.\=\\]+)?(?==))/
+  # by one or more "subkey" sequences and an optional square-bracketed index.
+  #
+  # To be understood by this implementation, a "subkey" sequence must consist of a literal dot (`.`) followed by one or
+  # more characters that do not convey semantic meaning within CEF (e.g., literal-dot (`.`), literal-equals (`=`),
+  # whitespace (`\s`), literal-pipe (`|`), literal-backslash ('\'), or literal-square brackets (`[` or `]`)).
+  EXTENSION_KEY_PATTERN = /(?:\w+(?:\.[^\.=\s\|\\\[\]]+)*(?:\[[0-9]+\])?(?==))/
 
   # Some CEF extension keys seen in the wild use an undocumented array-like syntax that may not be compatible with
   # the Event API's strict-mode FieldReference parser (e.g., `fieldname[0]`).

data/logstash-codec-cef.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-codec-cef'
-  s.version         = '6.0.0'
+  s.version         = '6.0.1'
   s.platform        = 'java'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Reads the ArcSight Common Event Format (CEF)."

data/spec/codecs/cef_spec.rb

@@ -555,6 +555,16 @@ describe LogStash::Codecs::CEF do
       end
     end
 
+    let (:dots_in_keys) {'CEF:0|Vendor|Device|Version|13|my message|5|dvchost=loghost cat=traffic deviceSeverity=notice ad.nn=TEST src=192.168.0.1 destinationPort=53'}
+    it "should be OK with dots in keys" do
+      decode_one(subject, dots_in_keys) do |e|
+        insist { e.get("deviceHostName") } == "loghost"
+        insist { e.get("ad.nn") } == 'TEST'
+        insist { e.get("sourceAddress") } == '192.168.0.1'
+        insist { e.get("destinationPort") } == '53'
+      end
+    end
+
     let (:allow_spaces_in_values) {'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82  spt=1232 dproc=InternetExplorer x.x.x.x'}
     it "should be OK to have one or more spaces in values" do
       decode_one(subject, allow_spaces_in_values) do |e|
@@ -580,6 +590,20 @@ describe LogStash::Codecs::CEF do
       end
     end
 
+    let(:preserve_complex_multiple_dot_notation_in_extension_fields) { 'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 additional.dotfieldName=new_value ad.Authentification=MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 ad.Error_,Code=3221225578 dst=12.121.122.82 ad.field[0]=field0 ad.foo.name[1]=new_name' }
+    it "should keep ad.fields" do
+      decode_one(subject, preserve_complex_multiple_dot_notation_in_extension_fields) do |e|
+        validate(e)
+        insist { e.get("sourceAddress") } == "10.0.0.192"
+        insist { e.get("destinationAddress") } == "12.121.122.82"
+        insist { e.get("[ad.field][0]") } == "field0"
+        insist { e.get("[ad.foo.name][1]") } == "new_name"
+        insist { e.get("ad.Authentification") } == "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
+        insist { e.get('ad.Error_,Code') } == "3221225578"
+        insist { e.get("additional.dotfieldName") } == "new_value"
+      end
+    end
+
     let (:preserve_random_values_key_value_pairs_alongside_with_additional_fields) {'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 cs4=401 random.user Admin 0 23041A10181C0000  23041810181C0000  /CN\=random.user/OU\=User Login End-Entity  /CN\=TEST/OU\=Login CA TEST 34 additional.dotfieldName=new_value ad.Authentification=MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 ad.Error_,Code=3221225578 dst=12.121.122.82 ad.field[0]=field0 ad.name[1]=new_name'}
     it "should correctly parse random values even with additional fields in message" do
       decode_one(subject, preserve_random_values_key_value_pairs_alongside_with_additional_fields) do |e|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-cef
 version: !ruby/object:Gem::Version
-  version: 6.0.0
+  version: 6.0.1
 platform: java
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-01-11 00:00:00.000000000 Z
+date: 2019-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement