Merge pull request #551 from mozilla/add_filterlog_mq_plugin

Add filterlog firewall mq plugin

mq/plugins/filterlog.py

@@ -0,0 +1,94 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2017 Mozilla Corporation
+#
+# Contributors:
+# Brandon Myers bmyers@mozilla.com
+
+
+class message(object):
+    def __init__(self):
+        '''
+            Plugin used to parse a filterlog type firewall message
+        '''
+        self.registration = ['filterlog']
+        self.priority = 10
+
+    def onMessage(self, message, metadata):
+        if 'summary' not in message:
+            return (message, metadata)
+
+        if message['summary'].count(',') < 9:
+            return (message, metadata)
+
+        if 'details' not in message:
+            message['details'] = {}
+
+        summary_items = message['summary'].split(',')
+        message['details']['rule_number'] = summary_items[0]
+        message['details']['sub_rule_number'] = summary_items[1]
+        message['details']['anchor'] = summary_items[2]
+        message['details']['trackor'] = summary_items[3]
+        message['details']['interface'] = summary_items[4]
+        message['details']['reason'] = summary_items[5]
+        message['details']['action'] = summary_items[6]
+        message['details']['direction'] = summary_items[7]
+        message['details']['ip_version'] = summary_items[8]
+
+        ip_version = int(message['details']['ip_version'])
+        if ip_version == 4:
+            if 'ip' not in message['details']:
+                message['details']['ip'] = {}
+
+            message['details']['ip']['version'] = 4
+            message['details']['ip']['tos'] = summary_items[9]
+            message['details']['ip']['ecn'] = summary_items[10]
+            message['details']['ip']['ttl'] = summary_items[11]
+            message['details']['ip']['id'] = summary_items[12]
+            message['details']['ip']['offset'] = summary_items[13]
+            message['details']['ip']['flags'] = summary_items[14]
+            message['details']['ip']['protocol_id'] = summary_items[15]
+            message['details']['ip']['protocol_text'] = summary_items[16]
+            last_index = 16
+        elif ip_version == 6:
+            if 'ip' not in message['details']:
+                message['details']['ip'] = {}
+
+            message['details']['ip']['version'] = 6
+            message['details']['ip']['class'] = summary_items[9]
+            message['details']['ip']['flow_label'] = summary_items[10]
+            message['details']['ip']['hop_limit'] = summary_items[11]
+            message['details']['ip']['protocol'] = summary_items[12]
+            message['details']['ip']['protocol_id'] = summary_items[13]
+            last_index = 13
+
+        if ip_version == 4 or ip_version == 6:
+            message['details']['ip']['length'] = summary_items[last_index + 1]
+            message['details']['sourceipaddress'] = summary_items[last_index + 2]
+            message['details']['destinationipaddress'] = summary_items[last_index + 3]
+
+        proto_id = int(message['details']['ip']['protocol_id'])
+
+        if proto_id == 6:
+            if 'tcp' not in message['details']:
+                message['details']['tcp'] = {}
+
+            message['details']['tcp']['source_port'] = summary_items[last_index + 4]
+            message['details']['tcp']['destination_port'] = summary_items[last_index + 5]
+            message['details']['tcp']['data_length'] = summary_items[last_index + 6]
+            message['details']['tcp']['flags'] = summary_items[last_index + 7]
+            message['details']['tcp']['seq_number'] = summary_items[last_index + 8]
+            message['details']['tcp']['ack_number'] = summary_items[last_index + 9]
+            message['details']['tcp']['window'] = summary_items[last_index + 10]
+            message['details']['tcp']['urg'] = summary_items[last_index + 11]
+            message['details']['tcp']['options'] = summary_items[last_index + 12]
+        elif proto_id == 17:
+            if 'udp' not in message['details']:
+                message['details']['udp'] = {}
+
+            message['details']['udp']['source_port'] = summary_items[last_index + 4]
+            message['details']['udp']['destination_port'] = summary_items[last_index + 5]
+            message['details']['udp']['data_length'] = summary_items[last_index + 6]
+
+        return (message, metadata)

tests/mq/plugins/test_filterlog.py

@@ -0,0 +1,61 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2017 Mozilla Corporation
+#
+# Contributors:
+# Brandon Myers bmyers@mozilla.com
+
+import os
+import sys
+sys.path.append(os.path.join(os.path.dirname(__file__), "../../../mq/plugins"))
+from filterlog import message
+
+
+class TestFilterlog():
+    def setup(self):
+
+        self.plugin = message()
+        self.msg = {}
+        self.msg['summary'] = '9,,,1000000103,igb0,match,block,in,4,0x0,,6,60624,0,DF,17,udp,92,175.41.7.2,21.143.56.109,57434,33443,72'
+
+    def test_onMessage(self):
+        metadata = {}
+        metadata['doc_type'] = 'event'
+
+        expected_return_message = {
+            'details': {
+                'action': 'block',
+                'anchor': '',
+                'destinationipaddress': '21.143.56.109',
+                'direction': 'in',
+                'interface': 'igb0',
+                'ip': {
+                    'ecn': '',
+                    'flags': 'DF',
+                    'id': '60624',
+                    'length': '92',
+                    'offset': '0',
+                    'protocol_id': '17',
+                    'protocol_text': 'udp',
+                    'tos': '0x0',
+                    'ttl': '6',
+                    'version': 4
+                },
+                'ip_version': '4',
+                'reason': 'match',
+                'rule_number': '9',
+                'sourceipaddress': '175.41.7.2',
+                'sub_rule_number': '',
+                'trackor': '1000000103',
+                'udp': {
+                    'data_length': '72',
+                    'destination_port': '33443',
+                    'source_port': '57434'
+                }
+            },
+            'summary': '9,,,1000000103,igb0,match,block,in,4,0x0,,6,60624,0,DF,17,udp,92,175.41.7.2,21.143.56.109,57434,33443,72'
+        }
+
+        (retmessage, retmeta) = self.plugin.onMessage(self.msg, metadata)
+        assert retmessage == expected_return_message