logstash-filter-ip2proxy 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e06dd2b4873e4de15fa8260141958fcb92415c12eb801347715da64ca551a0cf
-  data.tar.gz: 9d318b3d4e6ce5fe14dbf9b5d68c744016fbe9ab858575eeec79ee1fe0076ae9
+  metadata.gz: 0cd5f61d6fad06e1ff71bf978ceee7bad7f5560736111f7f7c5dec57e25bf3d4
+  data.tar.gz: c14c6f57e737bac618f1bb119e349e701cc53b7af1be9f19e823591e40e1ea4a
 SHA512:
-  metadata.gz: aec338f4b51d512dff4d72aedcd906f83d22dd17cb31baa72d46e19ce35ca1b9ad9dac4193f08e0c33fb8e6406946712989ac4f75ff7ea783a40c06ec8200f5b
-  data.tar.gz: cfe7f6eaf01035ff854ce877734f70414d88a167e08afc4e68059c7d790006a6b723a102b8fc02d877462c8ac6bed733502697e4162a4fa56cf5b18cc5faad76
+  metadata.gz: 223f76de27c284c1f65d1215a6db74bd2303af244753cfce641e26ce96436c50e8990b4394d6d641511a483519270d52943d5b10127524bed6fbd4e4a406f021
+  data.tar.gz: 10c42d26f03161530e9b7e79273b7bbbe549c599df6f61e99342287cad1e3977b63376afa04933d8d90c2735eba6538b1555cd9e246a9d1e0fcc9a289425d33d

data/lib/logstash-filter-ip2proxy_jars.rb

@@ -1,3 +1,3 @@
 require 'jar_dependencies'
-require_jar('com.ip2proxy.ip2proxy', 'ip2proxy', '3.0.0')
-require_jar('org.logstash.filters', 'logstash-filter-ip2proxy', '2.0.0')
+require_jar('com.ip2proxy.ip2proxy', 'ip2proxy', '3.0.2')
+require_jar('org.logstash.filters', 'logstash-filter-ip2proxy', '2.1.0')

data/lib/logstash/filters/ip2proxy.rb

@@ -1,50 +1,154 @@
-# encoding: utf-8
-require "logstash/filters/base"
-require "logstash/namespace"
-
-require "logstash-filter-ip2proxy_jars"
-
-class LogStash::Filters::IP2Proxy < LogStash::Filters::Base
-  config_name "ip2proxy"
-
-  # The path to the IP2Proxy.BIN database file which Logstash should use.
-  # If not specified, this will default to the IP2PROXY-LITE-PX4.BIN database that embedded in the plugin.
-  config :database, :validate => :path
-
-  # The field containing the IP address.
-  # If this field is an array, only the first value will be used.
-  config :source, :validate => :string, :required => true
-
-  # The field used to define iplocation as target.
-  config :target, :validate => :string, :default => 'ip2proxy'
-
-  public
-  def register
-    if @database.nil?
-      @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2PROXY-LITE-PX1.BIN")).first
-
-      if @database.nil? || !File.exists?(@database)
-        raise "You must specify 'database => ...' in your ip2proxy filter (I looked for '#{@database}')"
-      end
-    end
-
-    @logger.info("Using ip2proxy database", :path => @database)
-    
-    @ip2proxyfilter = org.logstash.filters.IP2ProxyFilter.new(@source, @target, @database)
-  end
-
-  public
-  def filter(event)
-    return unless filter?(event)
-    if @ip2proxyfilter.handleEvent(event)
-      filter_matched(event)
-    else
-      tag_iplookup_unsuccessful(event)
-    end
-  end
-
-  def tag_iplookup_unsuccessful(event)
-    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
-  end
-
-end # class LogStash::Filters::IP2Proxy
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+
+require "logstash-filter-ip2proxy_jars"
+
+class LogStash::Filters::IP2Proxy < LogStash::Filters::Base
+  config_name "ip2proxy"
+
+  # The path to the IP2Proxy.BIN database file which Logstash should use.
+  # If not specified, this will default to the IP2PROXY-LITE-PX4.BIN database that embedded in the plugin.
+  config :database, :validate => :path
+
+  # The field containing the IP address.
+  # If this field is an array, only the first value will be used.
+  config :source, :validate => :string, :required => true
+
+  # The field used to define iplocation as target.
+  config :target, :validate => :string, :default => 'ip2proxy'
+
+  # The field used to define the size of the cache. It is not required and the default value is 10 000 
+  config :cache_size, :validate => :number, :required => false, :default => 10_000
+
+  public
+  def register
+    if @database.nil?
+      @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2PROXY-LITE-PX1.BIN")).first
+
+      if @database.nil? || !File.exists?(@database)
+        raise "You must specify 'database => ...' in your ip2proxy filter (I looked for '#{@database}')"
+      end
+    end
+
+    @logger.info("Using ip2proxy database", :path => @database)
+    
+    @ip2proxyfilter = org.logstash.filters.IP2ProxyFilter.new(@source, @target, @database)
+  end
+
+  public
+  def filter(event)
+    ip = event.get(@source)
+
+    return unless filter?(event)
+    if value = Cache.find(event, ip, @ip2proxyfilter, @cache_size).get('ip2proxy')
+      event.set('ip2proxy', value)
+      filter_matched(event)
+    else
+      tag_iplookup_unsuccessful(event)
+    end
+  end
+
+  def tag_iplookup_unsuccessful(event)
+    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
+  end
+
+end # class LogStash::Filters::IP2Proxy
+
+class OrderedHash
+  ONE = 1
+
+  attr_reader :times_queried # ip -> times queried
+  attr_reader :hash
+
+  def initialize
+    @times_queried = Hash.new(0) # ip -> times queried
+    @hash = {} # number of hits -> array of ips
+  end
+
+  def add(key)
+    hash[ONE] ||= []
+    hash[ONE] << key
+    times_queried[key] = ONE
+  end
+
+  def reorder(key)
+    number_of_queries = times_queried[key]
+
+    hash[number_of_queries].delete(key)
+    hash.delete(number_of_queries) if hash[number_of_queries].empty?
+
+    hash[number_of_queries + 1] ||= []
+    hash[number_of_queries + 1] << key
+  end
+
+  def increment(key)
+    add(key) unless times_queried.has_key?(key)
+    reorder(key)
+    times_queried[key] += 1
+  end
+
+  def delete_least_used
+    first_pile_with_something.shift.tap { |key| times_queried.delete(key) }
+  end
+
+  def first_pile_with_something
+    hash[hash.keys.min]
+  end
+end
+
+class Cache
+  ONE_DAY_IN_SECONDS = 86_400
+
+  @cache         = {}            # ip -> event
+  @timestamps    = {}            # ip -> time of caching
+  @times_queried = OrderedHash.new # ip -> times queried
+  @mutex         = Mutex.new
+
+  class << self
+    attr_reader :cache
+    attr_reader :timestamps
+    attr_reader :times_queried
+
+    def find(event, ip, filter, cache_size)
+      synchronize do
+        if cache.has_key?(ip)
+          refresh_event(event, ip, filter) if too_old?(ip)
+        else
+          if cache_full?(cache_size)
+            make_room
+          end
+          cache_event(event, ip, filter)
+        end
+        times_queried.increment(ip)
+        cache[ip]
+      end
+    end
+
+    def too_old?(ip)
+      timestamps[ip] < Time.now - ONE_DAY_IN_SECONDS
+    end
+
+    def make_room
+      key = times_queried.delete_least_used
+      cache.delete(key)
+      timestamps.delete(key)
+    end
+
+    def cache_full?(cache_size)
+      cache.size >= cache_size
+    end
+
+    def cache_event(event, ip, filter)
+      filter.handleEvent(event)
+      cache[ip] = event
+      timestamps[ip] = Time.now
+    end
+
+    def synchronize(&block)
+      @mutex.synchronize(&block)
+    end
+
+    alias_method :refresh_event, :cache_event
+  end
+end

data/logstash-filter-ip2proxy.gemspec

@@ -1,8 +1,8 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-ip2proxy'
-  s.version         = '2.0.0'
-  s.licenses        = ['Apache License (2.0)']
+  s.version         = '2.1.0'
+  s.licenses        = ['Apache-2.0']
   s.summary         = "Logstash filter IP2Proxy"
   s.description     = "IP2Proxy filter plugin for Logstash enables Logstash's users to reverse search of IP address to detect VPN servers, open proxies, web proxies, Tor exit nodes, search engine robots, data center ranges and residential proxies using IP2Proxy BIN database."
   s.authors         = ["IP2Location"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-ip2proxy
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - IP2Location
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-04 00:00:00.000000000 Z
+date: 2021-05-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -56,11 +56,11 @@ files:
 - spec/filters/ip2proxy_spec.rb
 - spec/spec_helper.rb
 - vendor/IP2PROXY-LITE-PX1.BIN
-- vendor/jar-dependencies/com/ip2proxy/ip2proxy/ip2proxy/3.0.0/ip2proxy-3.0.0.jar
-- vendor/jar-dependencies/org/logstash/filters/logstash-filter-ip2proxy/2.0.0/logstash-filter-ip2proxy-2.0.0.jar
+- vendor/jar-dependencies/com/ip2proxy/ip2proxy/ip2proxy/3.0.2/ip2proxy-3.0.2.jar
+- vendor/jar-dependencies/org/logstash/filters/logstash-filter-ip2proxy/2.1.0/logstash-filter-ip2proxy-2.1.0.jar
 homepage: https://www.ip2location.com
 licenses:
-- Apache License (2.0)
+- Apache-2.0
 metadata:
   logstash_plugin: 'true'
   logstash_group: filter