Merge branch 'master' into reframe_commit

Author: smoors

files/shorewall

@@ -1,5 +1,6 @@
-SHOREWALL_TCP .*?%{WORD:fwrule}\:%{WORD:fwtarget}\:IN\=%{WORD:fwin} OUT\=\s*MAC\=%{DATA:fwmac} SRC\=%{IPORHOST:fwsrc} DST\=%{IPORHOST:fwdst} .*? PROTO\=%{WORD:fwproto} SPT\=%{INT:fwspt:int} DPT\=%{INT:fwdpt:int} .*?
-SHOREWALL_UDP .*?%{WORD:fwrule}\:%{WORD:fwtarget}\:IN\=%{WORD:fwin} OUT\=%{WORD:fwout}.*?SRC\=%{IPORHOST:fwsrc} DST\=%{IPORHOST:fwdst} .*? PROTO\=%{WORD:fwproto} SPT\=%{INT:fwspt:int} DPT\=%{INT:fwdpt:int} .*?
-SHOREWALL_ICMP .*?%{WORD:fwrule}\:%{WORD:fwtarget}\:IN\=%{WORD:fwin} OUT\=%{WORD:fwout} SRC\=%{IPORHOST:fwsrc} DST\=%{IPORHOST:fwdst} .*? PROTO\=%{WORD:fwproto} .*?
+SHOREWALL_COMMON %{DATA:fwrule}\:%{DATA:fwtarget}\:IN\=%{DATA:fwin} OUT\=%{DATA:fwout} (?:MAC\=%{DATA:fwmac} )?SRC\=%{IPORHOST:fwsrc} DST\=%{IPORHOST:fwdst}
 
-SHOREWALL_MSG (?:%{SHOREWALL_TCP}|%{SHOREWALL_UDP}|%{SHOREWALL_ICMP})
+SHOREWALL_TCP_UDP .*?PROTO\=%{DATA:fwproto} SPT\=%{INT:fwspt:int} DPT\=%{INT:fwdpt:int} .*?
+SHOREWALL_ICMP .*?PROTO\=%{DATA:fwproto} TYPE=%{INT:icmp_type:int} CODE=%{INT:icmp_code:int} .*?
+
+SHOREWALL_MSG Shorewall:%{SHOREWALL_COMMON} (?:%{SHOREWALL_TCP_UDP}|%{SHOREWALL_ICMP})

files/ssh

@@ -10,7 +10,7 @@ SSH_SUBSYSTEM .*?subsystem request for (?<subsystem>.*)
 SSH_DISCONNECT_USER .*?Received disconnect from %{IPORHOST:ip}: %{NONNEGINT}: (?<reason>disconnected by user)$
 SSH_DISCONNECT_OTHER Disconnected from %{IPORHOST:ip} port %{NONNEGINT}
 SSH_DISCONNECT %{SSH_DISCONNECT_USER}|%{SSH_DISCONNECT_OTHER}
-SSH_VALID_INVALID .*?(?<status>Accepted|Failed|Invalid user)(?: %{WORD:method} for)? %{USERNAME_PAT} from %{IPORHOST:ip}(?: port %{NONNEGINT:port})?
+SSH_VALID_INVALID .*?(?<status>Accepted|Failed|Invalid user)(?: %{WORD:method} for)? %{USERNAME_PAT} from %{IPORHOST:ip}(?: port %{NONNEGINT:port:int})?(?: ssh2: %{NOTSPACE:ssh_key_type} %{GREEDYDATA:ssh_key_fingerprint})?
 SSH_INPUT_USERAUTH .*?input_userauth_request: (?<inputuserauth>invalid user %{USERNAME_PAT})
 SSH_AUTH_REFUSED .*?Authentication refused: bad ownership or modes for file %{PATH:ownerpath}
 

files/su

@@ -1,5 +1,5 @@
 SU_FAIL (?:(?<su_message>FAILED) SU )?\(to %{NOTSPACE:su_to}\) %{NOTSPACE:su_user} on %{NOTSPACE:su_tty}
 
-SU_SESSIONS pam_unix\(su(?:-l)?:session\): (?<su_message>session (?:opened|closed)) for user %{NOTSPACE:su_user}(?: by %{USERNAME_PAT}\(uid=%{NUMBER}\))?
+SU_SESSIONS pam_unix\(su(?:-l)?:session\): (?<su_message>session (?:opened|closed)) for user %{NOTSPACE:su_user}(?: by (?:%{USERNAME_PAT})?\(uid=%{NUMBER}\))?
 
 SU_MSG %{SU_FAIL}|%{SU_SESSIONS}

setup.py

@@ -32,7 +32,7 @@
 import glob
 
 setup(name="logstash-patterns",
-      version="1.2.6",
+      version="1.2.8",
       description="Grok patterns for logstash",
       long_description="""Grok patterns for parsing log messages with logstash.
 

tests/data/shorewall

@@ -21,8 +21,8 @@ data = [
            "fwsrc" : "10.0.0.2",
            "fwdst" : "10.0.0.1",
            "fwproto" : "UDP",
-           u"fwspt" : u"57002",
-           u"fwdpt" : u"53",
+           u"fwspt" : 57002,
+           u"fwdpt" : 53,
     }
 },
 {
@@ -39,4 +39,18 @@ data = [
            "fwdpt" : 22,
     }
 },
+{
+    "raw" : "<6>1 2021-02-11T10:06:22.340438+01:00 cerberus kernel: Shorewall:all-all:REJECT:IN=em3 OUT=p2p1 MAC=24:6e:96:78:50:02:94:57:a5:60:53:fb:08:00 SRC=10.148.12.200 DST=134.184.15.95 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=27802 SEQ=0",
+    "expected" : {
+           "fwrule" : "all-all",
+           "fwtarget" : "REJECT",
+           "fwin" : "em3",
+           "fwproto" : "ICMP",
+           "icmp_code": 0,
+           "icmp_type": 8,
+           "fwsrc": "10.148.12.200",
+           "fwdst": "134.184.15.95",
+           "fwmac": "24:6e:96:78:50:02:94:57:a5:60:53:fb:08:00",
+    }
+},
 ]

tests/data/ssh

@@ -25,7 +25,7 @@ data = [
     "expected" : {
         'method': 'publickey',
         'pid': '44668',
-        'port': '43493',
+        'port': 43493,
         'program': 'sshd',
         'status': 'Accepted',
         'syslog_abspri': '86',
@@ -107,7 +107,7 @@ data = [
     "expected" : {
         'method': 'publickey',
         'pid': '8245',
-        'port': '55141',
+        'port': 55141,
         'program': 'sshd',
         'status': 'Accepted',
         'syslog_abspri': '86',
@@ -132,4 +132,19 @@ data = [
         'username': 'oneadmin',
     }
 },
+{
+    "raw": "<86>1 2021-02-08T21:04:11.450531+01:00 login2 sshd[35227]: Accepted publickey for vsc10001 from 109.136.238.10 port 57465 ssh2: RSA SHA256:cz3lwY9mjGfznACfU23BOSY0iYjFFgnp1exj1ijBfQA",
+    "expected": {
+        'program': 'sshd',
+        'syslog_abspri': '86',
+        'username': 'vsc10001',
+        '@source_host': 'login2',
+        'method': 'publickey',
+        'port': 57465,
+        'status': 'Accepted',
+        'ssh_key_type': 'RSA',
+        'ssh_key_fingerprint': 'SHA256:cz3lwY9mjGfznACfU23BOSY0iYjFFgnp1exj1ijBfQA',
+        'ip': '109.136.238.10',
+    }
+},
 ]

tests/data/su

@@ -59,4 +59,13 @@ data = [
         'su_user': 'vsc43020',
     }
 },
+{
+    "raw": "<86>1 2021-02-11T09:58:36.638152+01:00 node056 su:  pam_unix(su:session): session opened for user vsc43020 by (uid=0)",
+    "expected": {
+        'program': 'su',
+        '@source_host': 'node056',
+        'su_message': 'session opened',
+        'su_user': 'vsc43020',
+    }
+},
 ]