unified2 0.5.4 → 0.6.0

data/gemspec.yml

@@ -14,4 +14,5 @@ dependencies:
 development_dependencies:
   ore-tasks: ~> 0.5
   rspec: ~> 2.4
-  yard: ~> 0.6.0
+  yard: ~> 0.7
+  rdiscount: ~> 1.6

data/lib/unified2/classification.rb

@@ -1,3 +1,6 @@
+#
+# Unified2
+#
 module Unified2
   #
   # Classification
@@ -23,6 +26,15 @@ module Unified2
       @severity = classification[:severity]
     end
 
+    #
+    # String
+    #
+    # @return [String] Signature name
+    #
+    def to_s
+      @name
+    end
+
   end # class Classification
 
 end # module Unified2

data/lib/unified2/config_file.rb

@@ -1,3 +1,6 @@
+#
+# Unified2
+#
 module Unified2
   #
   # Configuration file
@@ -101,4 +104,4 @@ module Unified2
 
   end # class ConfigFile
 
-end # module Unified2
+end # module Unified2

data/lib/unified2/constructor/construct.rb

@@ -1,17 +1,27 @@
 require 'unified2/constructor/event_ip4'
 require 'unified2/constructor/event_ip6'
+require 'unified2/constructor/extra_construct'
+require 'unified2/constructor/extra_data'
+require 'unified2/constructor/legacy_event_ip4'
+require 'unified2/constructor/legacy_event_ip6'
 require 'unified2/constructor/record_header'
 require 'unified2/constructor/packet'
 
+#
+# Unified2
+#
 module Unified2
+
   #
   # Unified2 Constructor Namespace
   #
   module Constructor
+
     #
     # Unified2 Construction
     #
     class Construct < ::BinData::Record
+
       #
       # Rename record_header to header
       # to simplify and cut down on verbosity
@@ -21,13 +31,16 @@ module Unified2
       # 
       # Unified2 data types
       # 
-      # Currently rUnified2 only supports packet,
-      # event_ip4 and event_ip6.
-      # 
       choice :data, :selection => :type_selection do
         packet "packet"
+        
         event_ip4  "ev4"
         event_ip6 "ev6"
+
+        legacy_event_ip4  "lev4"
+        legacy_event_ip6 "lev6"
+
+        extra_construct "extra_data"
       end
 
       #
@@ -41,27 +54,60 @@ module Unified2
       # Deterime and call data type based on 
       # the unified2 type attribute
       # 
+      # SNORT DEFINES
+      # Long time ago...
+      # define UNIFIED2_EVENT               1
+      #
+      # CURRENT
+      # define UNIFIED2_PACKET              2
+      # define UNIFIED2_IDS_EVENT           7
+      # define UNIFIED2_IDS_EVENT_IPV6      72
+      # define UNIFIED2_IDS_EVENT_MPLS      99
+      # define UNIFIED2_IDS_EVENT_IPV6_MPLS 100
+      # define UNIFIED2_IDS_EVENT_VLAN      104
+      # define UNIFIED2_IDS_EVENT_IPV6_VLAN 105
+      # define UNIFIED2_EXTRA_DATA          110
+      #
       def type_selection
         case header.u2type.to_i
         when 1
+          # LEGACY
           # define UNIFIED2_EVENT 1
         when 2
           # define UNIFIED2_PACKET 2
           "packet"
         when 7
           # define UNIFIED2_IDS_EVENT 7
-          "ev4"
+          "lev4"
         when 66
+          # LEGACY
           # define UNIFIED2_EVENT_EXTENDED 66
         when 67
+          # LEGACY
           # define UNIFIED2_PERFORMANCE 67
         when 68
+          # LEGACY
           # define UNIFIED2_PORTSCAN 68
         when 72
           # define UNIFIED2_IDS_EVENT_IPV6 72
+          "lev6"
+        when 99
+          # define UNIFIED2_IDS_EVENT_MPLS 99
+          puts "99"
+        when 100
+          # define UNIFIED2_IDS_EVENT_IPV6_MPLS
+          puts "100"
+        when 104 
+          # define UNIFIED2_IDS_EVENT_VLAN 104
+          "ev4"
+        when 105
+          # define UNIFIED2_IDS_EVENT_IPV6_VLAN 105
           "ev6"
+        when 110
+          # define UNIFIED2_EXTRA_DATA 110
+          "extra_data"
         else
-          "unknown type #{header.u2type}"
+          raise "unknown type #{header.u2type}"
         end
       end
 
@@ -80,4 +126,4 @@ module Unified2
     
   end # module Construct
 
-end # module Unified2
+end # module Unified2

data/lib/unified2/constructor/event_ip4.rb

@@ -1,14 +1,18 @@
 require 'unified2/constructor/primitive/ipv4'
 
+#
+# Unified2
+#
 module Unified2
 
   module Constructor
+
     #
     # Event IP Version 4
     # 
     class EventIP4 < ::BinData::Record
 
-      endian :big
+      endian    :big
 
       uint32    :sensor_id
       
@@ -38,10 +42,21 @@ module Unified2
       
       uint8     :protocol
       
-      uint8     :packet_action
-      
+      uint8     :impact_flag
+
+      uint8     :impact
+
+      uint8     :blocked
+
+      uint32    :mpls_label
+
+      uint16    :vlanId
+
+      uint16    :pad2
+
     end # class EventIP4
 
   end # module Constructor
 
 end # module Unified2
+

data/lib/unified2/constructor/event_ip6.rb

@@ -1,11 +1,19 @@
+#
+# Unified2
+#
 module Unified2
   
+  #
+  # Constructor
+  #
   module Constructor
+
     #
     # Event IP Version 6
     #
     class EventIP6 < ::BinData::Record
-      endian :big
+      
+      endian    :big
 
       uint32    :sensor_id
       
@@ -35,10 +43,20 @@ module Unified2
       
       uint8     :protocol
       
-      uint8     :packet_action
-      
+      uint8     :impact_flag
+
+      uint8     :impact
+
+      uint8     :blocked
+
+      uint32    :mpls_label
+
+      uint16    :vlanId
+
+      uint16    :pad2
+
     end # class EventIP6
     
   end # module Constructor
   
-end # module Unified2
+end # module Unified2

data/lib/unified2/constructor/extra_construct.rb

@@ -0,0 +1,46 @@
+require 'unified2/constructor/extra_data'
+require 'unified2/constructor/extra_data_header'
+
+#
+# Unified2
+#
+module Unified2
+
+  #
+  # Unified2 Constructor Namespace
+  #
+  module Constructor
+
+    #
+    # Unified2 Construction
+    #
+    class ExtraConstruct < ::BinData::Record
+      
+      #
+      # Rename record_header to header
+      # to simplify and cut down on verbosity
+      # 
+      extra_data_header :header
+
+      # 
+      # Unified2 data types
+      # 
+      extra_data :data
+
+      #
+      # Sometimes the data needs extra padding
+      # 
+      def padding_length
+        if header.event_length > data.num_bytes
+          header.event_length - data.num_bytes
+        else
+          0
+        end
+      end
+
+    end # class ExtraConstruct
+    
+  end # module Construct
+
+end # module Unified2
+

data/lib/unified2/constructor/extra_data.rb

@@ -0,0 +1,37 @@
+#
+# Unified2
+#
+module Unified2
+  
+  #
+  # Constructor
+  #
+  module Constructor
+
+    #
+    # Event Packet
+    #
+    class ExtraData < ::BinData::Record
+      
+      endian :big
+
+      uint32 :sensor_id
+      
+      uint32 :event_id
+      
+      uint32 :event_second
+      
+      uint32 :extra_type
+      
+      uint32 :data_type
+      
+      uint32 :blob_length
+
+      string :blob, :read_length => lambda { blob_length - 8 }
+      
+    end # class ExtraData
+    
+  end # module Constructor
+  
+end # module Unified2
+

data/lib/unified2/constructor/extra_data_header.rb

@@ -0,0 +1,28 @@
+#
+# Unified2
+#
+module Unified2
+
+  #
+  # Constructor
+  #
+  module Constructor
+
+    #
+    # Extra Data Header
+    # 
+    class ExtraDataHeader < ::BinData::Record
+
+      endian :big
+
+      uint32 :event_type
+
+      uint32 :event_length
+
+    end # class ExtraDataHeader
+
+  end # module Constructor
+
+end # module Unified2
+
+

data/lib/unified2/constructor/legacy_event_ip4.rb

@@ -0,0 +1,54 @@
+require 'unified2/constructor/primitive/ipv4'
+
+#
+# Unified2
+#
+module Unified2
+
+  #
+  # Constructor
+  #
+  module Constructor
+
+    #
+    # Legacy Event IP Version 4
+    # 
+    class LegacyEventIP4 < ::BinData::Record
+
+      endian    :big
+
+      uint32    :sensor_id
+      
+      uint32    :event_id
+      
+      uint32    :event_second
+      
+      uint32    :event_microsecond
+      
+      uint32    :signature_id
+      
+      uint32    :generator_id
+      
+      uint32    :signature_revision
+      
+      uint32    :classification_id
+      
+      uint32    :priority_id
+      
+      ipv4      :ip_source
+      
+      ipv4      :ip_destination
+      
+      uint16    :sport_itype
+      
+      uint16    :dport_icode
+      
+      uint8     :protocol
+      
+      uint8     :packet_action
+      
+    end # class EventIP4
+
+  end # module Constructor
+
+end # module Unified2

data/lib/unified2/constructor/legacy_event_ip6.rb

@@ -0,0 +1,52 @@
+#
+# Unified2
+#
+module Unified2
+  
+  #
+  # Constructor
+  #
+  module Constructor
+
+    #
+    # Legacy Event IP Version 6
+    #
+    class LegacyEventIP6 < ::BinData::Record
+      
+      endian    :big
+
+      uint32    :sensor_id
+      
+      uint32    :event_id
+      
+      uint32    :event_second
+      
+      uint32    :event_microsecond
+      
+      uint32    :signature_id
+      
+      uint32    :generator_id
+      
+      uint32    :signature_revision
+      
+      uint32    :classification_id
+      
+      uint32    :priority_id
+      
+      uint128   :ip_source
+      
+      uint128   :ip_destination
+      
+      uint16    :sport_itype
+      
+      uint16    :dport_icode
+      
+      uint8     :protocol
+      
+      uint8     :packet_action
+      
+    end # class EventIP6
+    
+  end # module Constructor
+  
+end # module Unified2

data/lib/unified2/constructor/packet.rb

@@ -1,10 +1,18 @@
+#
+# Unified2
+#
 module Unified2
   
+  #
+  # Constructor
+  #
   module Constructor
+
     #
     # Event Packet
     #
     class Packet < ::BinData::Record
+      
       endian :big
 
       uint32 :sensor_id
@@ -27,4 +35,4 @@ module Unified2
     
   end # module Constructor
   
-end # module Unified2
+end # module Unified2

data/lib/unified2/constructor/primitive/ipv4.rb

@@ -1,14 +1,23 @@
+#
+# Unified2
+#
 module Unified2
 
+  #
+  # Constructor
+  #
   module Constructor
+
     #
     # Unified2 Primitive Namespace
     #
     module Primitive
+
       #
       # BinData Primitive IP4 Constructor
       #
       class IPV4 < ::BinData::Primitive
+
         array :octets, :type => :uint8, :initial_length => 4
         
         # IPV4#set

data/lib/unified2/constructor/record_header.rb

@@ -1,13 +1,22 @@
+#
+# Unified2
+#
 module Unified2
 
+  #
+  # Constructor
+  #
   module Constructor
+
     #
     # Unified2 Header
     #
     class RecordHeader < ::BinData::Record
+
       endian :big
 
       uint32 :u2type
+
       uint32 :u2length
       
     end # class RecordHeader

data/lib/unified2/constructor.rb

@@ -1 +1,2 @@
-require 'unified2/constructor/construct'
+require 'unified2/constructor/construct'
+require 'unified2/constructor/extra_construct'

data/lib/unified2/core_ext/string.rb

@@ -2,6 +2,7 @@
 # String monkeypatches
 #
 class String
+
   #
   # Blank?
   # 
@@ -13,4 +14,4 @@ class String
     false
   end
   
-end # class String
+end # class String