| # This Source Code Form is subject to the terms of the Mozilla Public | |
| # License, v. 2.0. If a copy of the MPL was not distributed with this | |
| # file, You can obtain one at https://mozilla.org/MPL/2.0/. | |
| # Copyright (c) 2014 Mozilla Corporation | |
| import netaddr | |
| def isIPv4(ip): | |
| try: | |
| # netaddr on it's own considers 1 and 0 to be valid_ipv4 | |
| # so a little sanity check prior to netaddr. | |
| # Use IPNetwork instead of valid_ipv4 to allow CIDR | |
| if '.' in ip and len(ip.split('.'))==4: | |
| # some ips are quoted | |
| netaddr.IPNetwork(ip) | |
| return True | |
| else: | |
| return False | |
| except: | |
| return False | |
| class message(object): | |
| def __init__(self): | |
| '''register our criteria for being passed a message | |
| as a list of lower case strings or values to match with an event's dictionary of keys or values | |
| set the priority if you have a preference for order of plugins to run. 0 goes first, 100 is assumed/default if not sent | |
| ''' | |
| # get events that may include an unparsed IP in the summary | |
| self.registration = ['sshd', 'fail2ban'] | |
| self.priority = 5 | |
| def onMessage(self, message, metadata): | |
| # if we don't have a source IP address | |
| # look for words that are IP addresses, | |
| # move to details.sourceipaddress | |
| doSearch = False | |
| detailsExists = True | |
| foundIPv4 = '' | |
| if 'summary' in message: | |
| if 'details' in message and isinstance(message['details'], dict): | |
| if 'sourceipaddress' not in message['details']: | |
| doSearch = True | |
| else: | |
| doSearch = True | |
| detailsExists = False | |
| if doSearch: | |
| for word in message['summary'].strip().split(): | |
| # strip any surrounding quotes, commas, etc. | |
| saneword = word.strip().strip('"').strip("'").strip(",") | |
| if isIPv4(saneword): | |
| foundIPv4 = saneword | |
| break | |
| if len(foundIPv4): | |
| if not detailsExists: | |
| message['details'] = dict() | |
| message['details']['sourceipaddress'] = foundIPv4 | |
| return (message, metadata) | |