logstash-codec-netflow 3.4.1 → 3.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +8 -0
  3. data/CONTRIBUTORS +1 -0
  4. data/lib/logstash/codecs/netflow/netflow.yaml +15 -0
  5. data/logstash-codec-netflow.gemspec +1 -1
  6. data/spec/codecs/netflow9_test_cisco_wlc_data261.dat +0 -0
  7. data/spec/codecs/netflow9_test_cisco_wlc_tpl.dat +0 -0
  8. data/spec/codecs/netflow_spec.rb +45 -0
  9. metadata +79 -73
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: e24cdd7142f243456a0979b80fee32122326f8a8
4
- data.tar.gz: 7957b0685a192b19c5c47e642fe0afdb8d53b25a
3
+ metadata.gz: 32f71436a65fa46010df46996c298d6ee3fd69c3
4
+ data.tar.gz: 3546a333cad653c94bc66a9eadc7a0b84169b2cf
5
5
  SHA512:
6
- metadata.gz: 95744daec1b4bdab27fc5632735d4c7d09f2de41826dedf7ba52e2f8e6f0a298cb1e952a5e9e9009268f2862e87fb9d47ce1a2edb6856edbd4aa769f3c9cbb87
7
- data.tar.gz: 572be553da4d2a93619df3f146c274d8b7babc85292b31ea676321c0e8320e420f5fad27010b826564a1b835f9537975af341f17fd29452da479016fc29cdf11
6
+ metadata.gz: 829dadfc0855a0185db386d859a81d151639b51ffd663ceb51bc6126ab870b0bf8a8f49fbd600f2dda17bb290a17ab469e98ae28e7039807a41b0dac4cc3c2e4
7
+ data.tar.gz: ef4c100952e730e612fb20c08dd624ad498e20f4de7b8e04602d93c2b162e844767d903c4554811db9e237d31512415bc19496a242cbeb1733834718d26239fc
data/CHANGELOG.md CHANGED
@@ -1,3 +1,11 @@
1
+ ## 3.5.0
2
+
3
+ - Added support for Cisco WLC (Netflow v9)
4
+
5
+ ## 3.4.0
6
+
7
+ - Added support for Cisco NBAR (Netflow v9)
8
+
1
9
  ## 3.3.0
2
10
 
3
11
  - Added support for Cisco ASR 9000 (Netflow v9)
data/CONTRIBUTORS CHANGED
@@ -20,6 +20,7 @@ Contributors:
20
20
  * Richard Pijnenburg (electrical)
21
21
  * Salvador Ferrer (salva-ferrer)
22
22
  * Will Rigby (wrigby)
23
+ * Yehonatan Devorkin (Devorkin)
23
24
  * Rojuinex
24
25
  * debadair
25
26
  * hkshirish
data/lib/logstash/codecs/netflow/netflow.yaml CHANGED
@@ -232,9 +232,15 @@
232
232
  96:
233
233
  - :string
234
234
  - :application_name
235
+ 98:
236
+ - :uint8
237
+ - :postIpDiffServCodePoint
235
238
  136:
236
239
  - :uint8
237
240
  - :flow_end_reason
241
+ 147:
242
+ - :string
243
+ - :wlanSSID
238
244
  148:
239
245
  - :uint32
240
246
  - :conn_id
@@ -325,6 +331,15 @@
325
331
  362:
326
332
  - :uint16
327
333
  - :postNATPortBlockEnd
334
+ 365:
335
+ - :mac_addr
336
+ - :staMacAddress
337
+ 366:
338
+ - :ip4_addr
339
+ - :staIPv4Address
340
+ 367:
341
+ - :mac_addr
342
+ - :wtpMacAddress
328
343
  8192:
329
344
  - :uint32
330
345
  - :streamcore_wan_rtt
data/logstash-codec-netflow.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-netflow'
4
- s.version = '3.4.1'
4
+ s.version = '3.5.0'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows."
7
7
  s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
data/spec/codecs/netflow_spec.rb CHANGED
@@ -1698,6 +1698,51 @@ describe LogStash::Codecs::Netflow do
1698
1698
  end
1699
1699
  end
1700
1700
 
1701
+ context "Netflow 9 Cisco WLC" do
1702
+ let(:data) do
1703
+ packets = []
1704
+ packets << IO.read(File.join(File.dirname(__FILE__), "netflow9_test_cisco_wlc_tpl.dat"), :mode => "rb")
1705
+ packets << IO.read(File.join(File.dirname(__FILE__), "netflow9_test_cisco_wlc_data261.dat"), :mode => "rb")
1706
+ end
1707
+
1708
+ let(:json_events) do
1709
+ events = []
1710
+ events << <<-END
1711
+ {
1712
+ "netflow": {
1713
+ "ip_dscp": 0,
1714
+ "in_pkts": 53362,
1715
+ "wtpMacAddress": "00:f6:63:cc:80:60",
1716
+ "staMacAddress": "34:02:86:75:c0:51",
1717
+ "flowset_id": 261,
1718
+ "version": 9,
1719
+ "application_id": "13:431",
1720
+ "flow_seq_num": 78,
1721
+ "in_bytes": 80973880,
1722
+ "postIpDiffServCodePoint": 0,
1723
+ "wlanSSID": "Test-env",
1724
+ "staIPv4Address": "192.168.20.121",
1725
+ "direction": 1
1726
+ },
1727
+ "@timestamp": "2017-06-22T06:31:14.000Z",
1728
+ "@version": "1"
1729
+ }
1730
+ END
1731
+ events.map{|event| event.gsub(/\s+/, "")}
1732
+ end
1733
+
1734
+ it "should decode raw data" do
1735
+ expect(decode.size).to eq(19)
1736
+ expect(decode[18].get("[netflow][application_id]")).to eq("13:431")
1737
+ end
1738
+
1739
+ it "should serialize to json" do
1740
+ expect(JSON.parse(decode[18].to_json)).to eq(JSON.parse(json_events[0]))
1741
+ end
1742
+ end
1743
+
1744
+
1745
+
1701
1746
  end
1702
1747
 
1703
1748
  describe LogStash::Codecs::Netflow, 'missing templates, no template caching configured' do
metadata CHANGED
@@ -1,102 +1,109 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-netflow
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.4.1
4
+ version: 3.5.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Elastic
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
11
  date: 2017-06-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
+ name: logstash-core-plugin-api
14
15
  requirement: !ruby/object:Gem::Requirement
15
16
  requirements:
16
- - - ">="
17
+ - - '>='
17
18
  - !ruby/object:Gem::Version
18
19
  version: '1.60'
19
- - - "<="
20
+ - - <=
20
21
  - !ruby/object:Gem::Version
21
22
  version: '2.99'
22
- name: logstash-core-plugin-api
23
- prerelease: false
24
23
  type: :runtime
24
+ prerelease: false
25
25
  version_requirements: !ruby/object:Gem::Requirement
26
26
  requirements:
27
- - - ">="
27
+ - - '>='
28
28
  - !ruby/object:Gem::Version
29
29
  version: '1.60'
30
- - - "<="
30
+ - - <=
31
31
  - !ruby/object:Gem::Version
32
32
  version: '2.99'
33
33
  - !ruby/object:Gem::Dependency
34
+ name: bindata
34
35
  requirement: !ruby/object:Gem::Requirement
35
36
  requirements:
36
- - - ">="
37
+ - - '>='
37
38
  - !ruby/object:Gem::Version
38
39
  version: 1.5.0
39
- name: bindata
40
- prerelease: false
41
40
  type: :runtime
41
+ prerelease: false
42
42
  version_requirements: !ruby/object:Gem::Requirement
43
43
  requirements:
44
- - - ">="
44
+ - - '>='
45
45
  - !ruby/object:Gem::Version
46
46
  version: 1.5.0
47
47
  - !ruby/object:Gem::Dependency
48
+ name: logstash-devutils
48
49
  requirement: !ruby/object:Gem::Requirement
49
50
  requirements:
50
- - - ">="
51
+ - - '>='
51
52
  - !ruby/object:Gem::Version
52
53
  version: 1.0.0
53
- name: logstash-devutils
54
- prerelease: false
55
54
  type: :development
55
+ prerelease: false
56
56
  version_requirements: !ruby/object:Gem::Requirement
57
57
  requirements:
58
- - - ">="
58
+ - - '>='
59
59
  - !ruby/object:Gem::Version
60
60
  version: 1.0.0
61
- description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
61
+ description: This gem is a Logstash plugin required to be installed on top of the
62
+ Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
63
+ gem is not a stand-alone program
62
64
  email: info@elastic.co
63
65
  executables: []
64
66
  extensions: []
65
67
  extra_rdoc_files: []
66
68
  files:
67
- - CHANGELOG.md
68
- - CONTRIBUTORS
69
- - Gemfile
70
- - LICENSE
71
- - NOTICE.TXT
72
- - README.md
73
- - docs/index.asciidoc
74
- - lib/logstash/codecs/netflow.rb
75
69
  - lib/logstash/codecs/netflow/iana2yaml.rb
76
70
  - lib/logstash/codecs/netflow/ipfix.yaml
77
- - lib/logstash/codecs/netflow/netflow.yaml
78
71
  - lib/logstash/codecs/netflow/util.rb
79
- - logstash-codec-netflow.gemspec
72
+ - lib/logstash/codecs/netflow/netflow.yaml
73
+ - lib/logstash/codecs/netflow.rb
80
74
  - spec/codecs/ipfix.dat
81
- - spec/codecs/ipfix_test_netscaler_data.dat
82
- - spec/codecs/ipfix_test_netscaler_tpl.dat
83
75
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
84
76
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
85
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
86
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
87
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
88
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
89
77
  - spec/codecs/netflow5.dat
90
78
  - spec/codecs/netflow5_test_invalid01.dat
91
79
  - spec/codecs/netflow5_test_invalid02.dat
92
80
  - spec/codecs/netflow5_test_juniper_mx80.dat
93
81
  - spec/codecs/netflow5_test_microtik.dat
94
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
95
82
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
96
83
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
97
84
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
98
85
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
99
86
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
87
+ - spec/codecs/netflow9_test_invalid01.dat
88
+ - spec/codecs/netflow9_test_macaddr_data.dat
89
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
90
+ - spec/codecs/netflow9_test_nprobe_data.dat
91
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
92
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
93
+ - spec/codecs/netflow9_test_valid01.dat
94
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
95
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
96
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
97
+ - spec/codecs/ipfix_test_netscaler_data.dat
98
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
99
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
100
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
101
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
102
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
103
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
104
+ - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
105
+ - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
106
+ - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
100
107
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
101
108
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
102
109
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -107,67 +114,77 @@ files:
107
114
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
108
115
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
109
116
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
110
- - spec/codecs/netflow9_test_invalid01.dat
111
- - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
112
- - spec/codecs/netflow9_test_macaddr_data.dat
113
- - spec/codecs/netflow9_test_macaddr_tpl.dat
114
- - spec/codecs/netflow9_test_nprobe_data.dat
115
- - spec/codecs/netflow9_test_nprobe_tpl.dat
116
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
117
- - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
118
- - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
119
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
120
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
121
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
122
- - spec/codecs/netflow9_test_valid01.dat
117
+ - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
118
+ - spec/codecs/netflow9_test_cisco_wlc_data261.dat
123
119
  - spec/codecs/netflow_spec.rb
120
+ - logstash-codec-netflow.gemspec
121
+ - CHANGELOG.md
122
+ - README.md
123
+ - CONTRIBUTORS
124
+ - Gemfile
125
+ - LICENSE
126
+ - NOTICE.TXT
127
+ - docs/index.asciidoc
124
128
  homepage: http://www.elastic.co/guide/en/logstash/current/index.html
125
129
  licenses:
126
130
  - Apache License (2.0)
127
131
  metadata:
128
132
  logstash_plugin: 'true'
129
133
  logstash_group: codec
130
- post_install_message:
134
+ post_install_message:
131
135
  rdoc_options: []
132
136
  require_paths:
133
137
  - lib
134
138
  required_ruby_version: !ruby/object:Gem::Requirement
135
139
  requirements:
136
- - - ">="
140
+ - - '>='
137
141
  - !ruby/object:Gem::Version
138
142
  version: '0'
139
143
  required_rubygems_version: !ruby/object:Gem::Requirement
140
144
  requirements:
141
- - - ">="
145
+ - - '>='
142
146
  - !ruby/object:Gem::Version
143
147
  version: '0'
144
148
  requirements: []
145
- rubyforge_project:
146
- rubygems_version: 2.4.8
147
- signing_key:
149
+ rubyforge_project:
150
+ rubygems_version: 2.0.14
151
+ signing_key:
148
152
  specification_version: 4
149
153
  summary: The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows.
150
154
  test_files:
151
155
  - spec/codecs/ipfix.dat
152
- - spec/codecs/ipfix_test_netscaler_data.dat
153
- - spec/codecs/ipfix_test_netscaler_tpl.dat
154
156
  - spec/codecs/ipfix_test_openbsd_pflow_data.dat
155
157
  - spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
156
- - spec/codecs/ipfix_test_vmware_vds_data264.dat
157
- - spec/codecs/ipfix_test_vmware_vds_data266.dat
158
- - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
159
- - spec/codecs/ipfix_test_vmware_vds_tpl.dat
160
158
  - spec/codecs/netflow5.dat
161
159
  - spec/codecs/netflow5_test_invalid01.dat
162
160
  - spec/codecs/netflow5_test_invalid02.dat
163
161
  - spec/codecs/netflow5_test_juniper_mx80.dat
164
162
  - spec/codecs/netflow5_test_microtik.dat
165
- - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
166
163
  - spec/codecs/netflow9_test_cisco_asa_1_data.dat
167
164
  - spec/codecs/netflow9_test_cisco_asa_1_tpl.dat
168
165
  - spec/codecs/netflow9_test_cisco_asa_2_data.dat
169
166
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_26x.dat
170
167
  - spec/codecs/netflow9_test_cisco_asa_2_tpl_27x.dat
168
+ - spec/codecs/netflow9_test_invalid01.dat
169
+ - spec/codecs/netflow9_test_macaddr_data.dat
170
+ - spec/codecs/netflow9_test_macaddr_tpl.dat
171
+ - spec/codecs/netflow9_test_nprobe_data.dat
172
+ - spec/codecs/netflow9_test_nprobe_tpl.dat
173
+ - spec/codecs/netflow9_test_softflowd_tpl_data.dat
174
+ - spec/codecs/netflow9_test_valid01.dat
175
+ - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
176
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
177
+ - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
178
+ - spec/codecs/ipfix_test_netscaler_data.dat
179
+ - spec/codecs/ipfix_test_netscaler_tpl.dat
180
+ - spec/codecs/ipfix_test_vmware_vds_data264.dat
181
+ - spec/codecs/ipfix_test_vmware_vds_data266.dat
182
+ - spec/codecs/ipfix_test_vmware_vds_data266_267.dat
183
+ - spec/codecs/ipfix_test_vmware_vds_tpl.dat
184
+ - spec/codecs/netflow9_test_0length_fields_tpl_data.dat
185
+ - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
186
+ - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
187
+ - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
171
188
  - spec/codecs/netflow9_test_cisco_asr9k_data256.dat
172
189
  - spec/codecs/netflow9_test_cisco_asr9k_data260.dat
173
190
  - spec/codecs/netflow9_test_cisco_asr9k_opttpl256.dat
@@ -178,17 +195,6 @@ test_files:
178
195
  - spec/codecs/netflow9_test_cisco_nbar_data262.dat
179
196
  - spec/codecs/netflow9_test_cisco_nbar_opttpl260.dat
180
197
  - spec/codecs/netflow9_test_cisco_nbar_tpl262.dat
181
- - spec/codecs/netflow9_test_invalid01.dat
182
- - spec/codecs/netflow9_test_juniper_srx_tplopt.dat
183
- - spec/codecs/netflow9_test_macaddr_data.dat
184
- - spec/codecs/netflow9_test_macaddr_tpl.dat
185
- - spec/codecs/netflow9_test_nprobe_data.dat
186
- - spec/codecs/netflow9_test_nprobe_tpl.dat
187
- - spec/codecs/netflow9_test_softflowd_tpl_data.dat
188
- - spec/codecs/netflow9_test_streamcore_tpl_data256.dat
189
- - spec/codecs/netflow9_test_streamcore_tpl_data260.dat
190
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
191
- - spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
192
- - spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
193
- - spec/codecs/netflow9_test_valid01.dat
198
+ - spec/codecs/netflow9_test_cisco_wlc_tpl.dat
199
+ - spec/codecs/netflow9_test_cisco_wlc_data261.dat
194
200
  - spec/codecs/netflow_spec.rb