class Fluent::Plugin::GoAuditParserFilter

Constants

SYSCALLS
TYPES

Public Instance Methods

filter_with_time(tag, time, record) click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 558
def filter_with_time(tag, time, record)
  if record.key?('timestamp')
    timestamp = record.delete('timestamp').to_f
    time = Fluent::EventTime.from_time(Time.at(timestamp))
  end

  if record.key?('messages') && record.key?('uid_map')
    messages = record.delete('messages')
    uid_map  = record.delete('uid_map')

    new_messages = messages.each.with_object({}) do |message, new_messages|
      type, data = message.values_at('type', 'data')

      name = TYPES[type.to_i]
      hash = { 'type' => type.to_i }
      parseline(data).each do |key, val|
        case key
        when 'syscall'
          hash[key] = SYSCALLS[val.to_i]
        when 'msg'
          hash[key] = parseline(val)
        when 'saddr'
          hash[key] = sockaddr(val)
        when 'proctitle'
          hash[key] = packhex(val)
        when 'uid', 'euid', 'suid', 'ouid', 'fsuid', 'auid'
          hash[key] = uid(val, uid_map)
        when 'gid', 'egid', 'sgid', 'ogid', 'fsgid'
          hash[key] = val.to_i
        when 'exit', 'item', 'items', 'pid', 'ppid', 'ses', 'argc', 'inode'
          hash[key] = val.to_i
        else
          hash[key] = val
        end
      end

      name = "#{name}#{hash['item']}" if name == 'path'
      new_messages.update(name => hash)
    end

    record['messages']      = new_messages
    record['message_types'] = new_messages.keys
  end

  return time, record
end
packhex(text) click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 617
def packhex(text)
  [text].pack("H*").gsub(/[^[:print:]]/, ' ')
end
parseline(text) click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 605
def parseline(text)
  regex = /([^\s=]+)=('[^']*'|"[^"]*"|\S+)/
  text.scan(regex).each.with_object({}) do |(key, val), hash|
    val = val[1..-2] if val.start_with?('\'') || val.start_with?('"')
    hash[key] = val
  end
end
sockaddr(text) click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 621
def sockaddr(text)
  addr = {}

  case text[0, 2].hex + (256 * text[2, 2].hex)
  when 1
    pos = text.index('00', 4) - 4
    pos = text.size - 4 if pos < 0
    addr.update('family'    => 'local')
    addr.update('path'      => packhex(text[4, pos]))
    addr.update('unknown'   => text[pos+4..-1]) if text.size > pos + 5
  when 2
    addr.update('family'    => 'inet')
    addr.update('port'      => (text[4, 2].hex * 256) + text[6, 2].hex)
    addr.update('ip'        => text[8, 8].scan(/.{2}/).map{ |x| x.hex }.join("."))
    addr.update('unknown'   => text[16..-1]) if text.length > 16
  when 10
    addr.update('family'    => 'inet6')
    addr.update('port'      => (text[4, 2].hex * 256) + text[6, 2].hex)
    addr.update('flow_info' => text[8, 8])
    addr.update('ip'        => text[16, 32].scan(/.{4}/).map{ |x| x.downcase }.join(":"))
    addr.update('scope_id'  => text[48, 8])
    addr.update('unknown'   => text[56..-1]) if text.size > 56
  else
    addr.update('unknown' => text[4..-1])
  end

  addr
end
uid(id, uid_map) click to toggle source
# File lib/fluent/plugin/filter_go_audit_parser.rb, line 613
def uid(id, uid_map)
  { 'id' => id.to_i, 'name' => uid_map[id] }
end