logstash-filter-opnsensefilter 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ddacf084f2d95af3787d44e004cc17cd62466e9e
+  data.tar.gz: db7311286a35778233dff4a53f66555d615106a9
+SHA512:
+  metadata.gz: 83831bf88377f3bf20eb3e2d1142360749c6464031bd076c69509f72f9eb44d82231e7f5a38b5225c98db3bd8067635fa52da9af8b1f1b6d32a08e1bce8028ba
+  data.tar.gz: 6b1aed38c70851ac507231430164c31d9f4c21dc790255ff3c2ae45af5d555d50483e1eea788893bd60a617775d5c9c6a0519c268cf14bbce2de00e0b138daeb

data/CONTRIBUTORS

@@ -0,0 +1,5 @@
+The following is a list of people who have contributed code to this plugin.
+
+Contributors:
+* Fabian Franz
+

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+gemspec
+

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (C) 2017 Fabian Franz
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, 
+   this list of conditions and the following disclaimer in the documentation 
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.

data/lib/logstash/filters/opnsensefilter.rb

@@ -0,0 +1,82 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+
+class LogStash::Filters::Opnsensefilter < LogStash::Filters::Base
+
+  config_name "opnsensefilter"
+
+  # Replace the message with this value.
+  config :prefix, :validate => :string, :default => ''
+  config :field_name, :validate => :string, :default => 'message'
+
+
+  public
+  def register
+    # Add instance variables
+  end # def register
+
+  public
+  def filter(event)
+
+    if @field_name
+      data = event.get(@field_name).split(",")
+      # meta
+      event.set("#{@prefix}rule", data[0].to_i)
+      event.set("#{@prefix}subrule", data[3].to_i)
+      event.set("#{@prefix}input_interface", data[4])
+      event.set("#{@prefix}reason", data[5])
+      event.set("#{@prefix}action", data[6])
+      event.set("#{@prefix}direction_of_traffic", data[7])
+      event.set("#{@prefix}ip_version", data[8].to_i)
+      if data[8].to_i == 4
+        # IPv4
+        ip_proto = true
+        proto_start = 20
+        protocol = data[16]
+        event.set("#{@prefix}tos", data[9].to_i(16))
+        event.set("#{@prefix}ecn", data[10])
+        event.set("#{@prefix}hop_limit", data[11].to_i)
+        event.set("#{@prefix}aid", data[12].to_i)
+        event.set("#{@prefix}myoffset", data[13].to_i)
+        event.set("#{@prefix}flags", data[14])
+        event.set("#{@prefix}protocol_id", data[15].to_i)
+        event.set("#{@prefix}protocol", data[16])
+        event.set("#{@prefix}length", data[17].to_i)
+        event.set("#{@prefix}source", data[18])
+        event.set("#{@prefix}destination", data[19])
+      elsif data[8].to_i == 6
+        # IPv6
+        ip_proto = true
+        proto_start = 17
+        protocol = data[12]
+        event.set("#{@prefix}klass", data[9].to_i(16))
+        event.set("#{@prefix}flow_label", data[10].to_i(16))
+        event.set("#{@prefix}hop_limit", data[11].to_i)
+        event.set("#{@prefix}protocol", data[12])
+        event.set("#{@prefix}protocol_id", data[13].to_i)
+        event.set("#{@prefix}length", data[14].to_i)
+        event.set("#{@prefix}source", data[15])
+        event.set("#{@prefix}destination", data[16])
+      end
+      if ip_proto
+        if protocol == "tcp" || protocol == "udp"
+          event.set("#{@prefix}spt", data[proto_start].to_i)
+          event.set("#{@prefix}dpt", data[proto_start + 1].to_i)
+          event.set("#{@prefix}length", data[proto_start + 2].to_i)
+        end
+        if protocol == "tcp"
+          event.set("#{@prefix}tcp_flags", data[proto_start + 3])
+          event.set("#{@prefix}sequence_number", data[proto_start + 4])
+          event.set("#{@prefix}ack_number", data[proto_start + 5].to_i)
+          event.set("#{@prefix}window", data[proto_start + 6].to_i)
+          event.set("#{@prefix}urgent_pointer", data[proto_start + 7])
+          event.set("#{@prefix}options", data[proto_start + 8])
+          entry[:protocol] = proto_data
+        end
+      end
+    end
+
+    filter_matched(event)
+  end # def filter
+end # class LogStash::Filters::Opnsensefilter

data/logstash-filter-opnsensefilter.gemspec

@@ -0,0 +1,22 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-filter-opnsensefilter'
+  s.version       = '1.0.0'
+  s.licenses      = ['BSD 2 Clause']
+  s.summary       = 'Convert CSV output of the filter of OPNsense to reasonable data.'
+  s.homepage      = 'https://github.com/fabianfrz'
+  s.authors       = ['Fabian Franz']
+  s.email         = 'franz.fabian.94@gmail.com'
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_development_dependency 'logstash-devutils'
+end

data/spec/filters/opnsensefilter_spec.rb

@@ -0,0 +1,6 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/opnsensefilter"
+
+describe LogStash::Filters::Opnsensefilter do
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,82 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-opnsensefilter
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Fabian Franz
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-08-10 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 
+email: franz.fabian.94@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CONTRIBUTORS
+- Gemfile
+- LICENSE
+- lib/logstash/filters/opnsensefilter.rb
+- logstash-filter-opnsensefilter.gemspec
+- spec/filters/opnsensefilter_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/fabianfrz
+licenses:
+- BSD 2 Clause
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.11
+signing_key: 
+specification_version: 4
+summary: Convert CSV output of the filter of OPNsense to reasonable data.
+test_files:
+- spec/filters/opnsensefilter_spec.rb
+- spec/spec_helper.rb