Current File : //backups/router/usr/local/opnsense/scripts/suricata/lib/metadata.py
"""
Copyright (c) 2015-2019 Ad Schellevis <ad@opnsense.org>
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
--------------------------------------------------------------------------------------
shared module for suricata rule metadata
"""
import os
import syslog
import glob
import xml.etree.ElementTree
class Metadata(object):
def __init__(self):
self._rules_dir = '%s/../metadata/rules/' % (os.path.dirname(os.path.abspath(__file__)))
def _list_xml_sources(self, replace_tags = {}):
""" list all available rule xml files
:return: generator method returning all known rule xml files
"""
for filename in sorted(glob.glob('%s*.xml' % self._rules_dir), reverse=True):
try:
xml_data = open(filename, 'r').read()
for tag in replace_tags:
search_tag = '%%%%%s%%%%' % tag
if xml_data.find(search_tag) > -1:
xml_data = xml_data.replace(search_tag, replace_tags[tag])
rule_xml = xml.etree.ElementTree.fromstring(xml_data)
rule_xml.attrib['metadata_source'] = os.path.basename(filename)
yield rule_xml
except xml.etree.ElementTree.ParseError:
# unparsable metadata
syslog.syslog(syslog.LOG_ERR, 'suricata metadata unparsable @ %s' % filename)
continue
def list_rule_properties(self):
""" collect settable properties from installed ruleset
:return: dict unique properties
"""
result = dict()
for rule_xml in self._list_xml_sources():
if rule_xml.find('properties') is not None:
for rule_prop in rule_xml.find('properties'):
if 'name' in rule_prop.attrib:
result[rule_prop.attrib['name']] = {'default': None}
if 'default' in rule_prop.attrib:
result[rule_prop.attrib['name']]['default'] = rule_prop.attrib['default']
return result
def list_rules(self, replace_tags = {}):
""" list all available rules
:return: generator method returning all known rulefiles
"""
target_filenames = list()
for rule_xml in self._list_xml_sources(replace_tags):
src_location = rule_xml.find('location')
if src_location is None or 'url' not in src_location.attrib:
syslog.syslog(syslog.LOG_ERR, 'suricata metadata missing location @ %s' % filename)
else:
if rule_xml.find('files') is None:
syslog.syslog(syslog.LOG_ERR, 'suricata metadata missing files @ %s' % filename)
else:
http_headers = dict()
if rule_xml.find('headers') is not None:
for header in rule_xml.find('headers'):
http_headers[header.tag] = header.text.strip()
required_files = list()
for rule_filename in rule_xml.find('files'):
if 'documentation_url' in rule_filename.attrib:
documentation_url = rule_filename.attrib['documentation_url']
elif 'documentation_url' in rule_xml.attrib:
documentation_url = rule_xml.attrib['documentation_url']
else:
documentation_url = ""
metadata_record = {
'required': False,
'deprecated': False,
'metadata_source': rule_xml.attrib['metadata_source']
}
metadata_record['documentation_url'] = documentation_url
metadata_record['source'] = src_location.attrib
metadata_record['filename'] = rule_filename.text.strip()
metadata_record['http_headers'] = http_headers
# for an archive, define file to extract
metadata_record['url_filename'] = None
if 'url' in rule_filename.attrib and rule_filename.attrib['url'].startswith('inline::'):
metadata_record['url'] = (metadata_record['source']['url'])
metadata_record['url_filename'] = rule_filename.attrib['url'][8:]
elif 'url' in rule_filename.attrib:
metadata_record['url'] = (rule_filename.attrib['url'])
else:
metadata_record['url'] = ('%s/%s' % (metadata_record['source']['url'],
metadata_record['filename']))
if rule_xml.find('version') is not None and 'url' in rule_xml.find('version').attrib:
metadata_record['version_url'] = rule_xml.find('version').attrib['url']
else:
metadata_record['version_url'] = None
if 'prefix' in src_location.attrib:
description_prefix = "%s/" % src_location.attrib['prefix']
else:
description_prefix = ""
if 'description' in rule_filename.attrib:
metadata_record['description'] = '%s%s' % (description_prefix,
rule_filename.attrib['description'])
else:
metadata_record['description'] = '%s%s' % (description_prefix,
rule_filename.text)
if 'deprecated' in rule_filename.attrib \
and rule_filename.attrib['deprecated'].lower().strip() == 'true':
metadata_record['deprecated'] = True
if metadata_record['filename'] not in target_filenames:
if 'required' in rule_filename.attrib \
and rule_filename.attrib['required'].lower().strip() == 'true':
# collect required rules/files, flush when this metadata package is parsed
metadata_record['required'] = True
required_files.append(metadata_record)
else:
yield metadata_record
target_filenames.append(metadata_record['filename'])
# flush required files last, so we can skip required when there's nothing else in the set selected
for metadata_record in required_files:
yield metadata_record
Mini Shell