Class: LogStash::Codecs::Nmap

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/codecs/nmap.rb

Overview

This codec may be used to decode (via inputs) only. It decodes nmap generated XML and outputs each host as its own event

Constant Summary collapse

EPOCH = 
LogStash::Timestamp.new(Time.at(0))

Instance Method Summary collapse

Instance Method Details

#de_keyword(value) ⇒ Object 



216
217
218
 
# File 'lib/logstash/codecs/nmap.rb', line 216

def de_keyword(value)
  value.is_a?(Symbol) ? value.to_s : value
end

#decode(data) ⇒ Object 



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/logstash/codecs/nmap.rb', line 24

def decode(data)
  xml = Nmap::XML.parse(data)
  scan_id = SecureRandom.uuid

  xml.hosts.each_with_index do |host,idx|
    # Convert the host to a 'base' host event
    # This will be used for the later port/hop types
    base = hashify_host(host, xml)

    # Add some scanner-wide attributes
    base['arguments'] = xml.scanner.arguments
    base['version'] = xml.scanner.version
    base['scan_id'] = scan_id

    # Pull out the detail
    ports = host.ports.map {|p| hashify_port(p)}
    traceroute = hashify_traceroute(host.traceroute)

    scan_host_id = scan_id + "-h#{idx}"

    if @emit_ports && ports
      ports.each.with_index do |port,idx|
        yield LogStash::Event.new(base.merge(
          'type' => 'nmap_port',
          'port' => port,
          'scan_host_id' => scan_host_id,
          'id' => scan_host_id+"-p#{idx}"
        ))
      end
    end

    if @emit_traceroute_links && traceroute && (hops = traceroute['hops'])
      hops.each_with_index do |hop,idx|
        next_hop = hops[idx+1]
        yield LogStash::Event.new(base.merge(
          'type' =>'nmap_traceroute_link',
          'from' => hop,
          'to' => next_hop,
          'rtt_diff' => (next_hop ? next_hop['rtt'] - hop['rtt'] : nil),
          'scan_host_id' => scan_host_id,
          'id' => scan_host_id+"-tl#{idx}"
        ))
      end
    end

    if @emit_hosts
      yield LogStash::Event.new(base.merge(
        'type' => 'nmap_host',
        'ports' => ports,
        'traceroute' => traceroute,
        'id' => scan_host_id
      ))
    end
  end
rescue StandardError => e
  @logger.warn("An unexpected error occurred parsing nmap XML",
               :input => data,
               :message => e.message,
               :class => e.class.name,
               :backtrace => e.backtrace)
end

#dequote(str) ⇒ Object

Some strings have quoted values, we may want to remove leading/trailing quotes



232
233
234
235
 
# File 'lib/logstash/codecs/nmap.rb', line 232

def dequote(str)
  return nil unless str
  str.gsub(/\A"|"\Z/, '')
end

#hashify_host(host, xml) ⇒ Object 



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
 
# File 'lib/logstash/codecs/nmap.rb', line 86

def hashify_host(host, xml)
  scan_start = timeify(xml.scanner.start_time)

  h = {}
  h['start_time'] = timeify(host.start_time, scan_start)
  h['end_time'] = timeify(host.end_time, scan_start)

  # These two are actually different.
  # Address may contain a MAC, addresses will not AFAICT
  h['addresses'] = hashify_structs(host.addresses)
  h['address'] = host.address # str

  h['ip'] = host.ip # str
  h['ipv4'] = host.ipv4 # str
  h['ipv6'] = host.ipv6 # str
  h['mac'] = host.mac # str
  h['status'] = hashify_status(host.status)
  h['hostname'] = hashify_hostname(host.hostname)
  h['uptime'] = hashify_uptime(host.uptime)
  h['os'] = hashify_os(host.os)

  h
end

#hashify_hostname(hostname) ⇒ Object 



119
120
121
122
123
124
125
126
 
# File 'lib/logstash/codecs/nmap.rb', line 119

def hashify_hostname(hostname)
  return unless hostname

  {
    'name' => hostname.name, # str
    'type' => hostname.type, # str
  }
end

#hashify_os(os) ⇒ Object 



128
129
130
131
132
133
134
135
136
137
 
# File 'lib/logstash/codecs/nmap.rb', line 128

def hashify_os(os)
  return unless os

  {
    'ports_used' => os.ports_used,
    'fingerprint' => os.fingerprint,
    'classes' => hashify_os_matches(os.classes),
    'matches' => hashify_structs(os_matches)
  }
end

#hashify_os_classes(classes) ⇒ Object 



139
140
141
142
143
144
145
146
147
148
149
150
151
 
# File 'lib/logstash/codecs/nmap.rb', line 139

def hashify_os_classes(classes)
  return if !classes || classes.empty?

  classes.each do |klass|
    {
      'type' => klass.type.to_s, # returned as sym originally
      'vendor' => klass.vendor.to_s,
      'family' => klass.family.to_s,
      'gen' => klass.gen.to_s,
      'accuracy' => klass.accuracy # int
    }
  end
end

#hashify_port(port) ⇒ Object 



178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/logstash/codecs/nmap.rb', line 178

def hashify_port(port)
  return unless port

  {
    'number' => port.number,
    'reason' => port.reason,
    'protocol' => port.protocol.to_s,
    'service' => hashify_service(port.service),
    'state' => port.state.to_s
  }
end

#hashify_service(service) ⇒ Object 



162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'lib/logstash/codecs/nmap.rb', line 162

def hashify_service(service)
  return unless service

  {
    'name' => service.name,
    'ssl' => service.ssl?,
    'protocol' => service.protocol,
    'product' => service.product,
    'hostname' => service.hostname, # This is just a string
    'device_type' => service.device_type,
    'fingerprint_method' => service.fingerprint_method.to_s,
    'fingerprint' => service.fingerprint,
    'confidence' => service.confidence
  }
end

#hashify_status(status) ⇒ Object 



110
111
112
113
114
115
116
117
 
# File 'lib/logstash/codecs/nmap.rb', line 110

def hashify_status(status)
  return unless status

  {
    'state' => status.state.to_s, # str
    'reason' => status.reason # str
  }
end

#hashify_struct(struct) ⇒ Object 



212
213
214
 
# File 'lib/logstash/codecs/nmap.rb', line 212

def hashify_struct(struct)
  Hash[struct.each_pair.map {|k,v| [k, de_keyword(v)]}]
end

#hashify_structs(structs) ⇒ Object 



208
209
210
 
# File 'lib/logstash/codecs/nmap.rb', line 208

def hashify_structs(structs)
  structs.map {|s| hashify_struct(s)}
end

#hashify_traceroute(traceroute) ⇒ Object 



190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/logstash/codecs/nmap.rb', line 190

def hashify_traceroute(traceroute)
  return unless traceroute

  {
    'port' => traceroute.port, # int
    'protocol' => traceroute.protocol.to_s,
    'hops' => traceroute.map.with_index do |hop, idx|
      {
        'address' => hop.addr, # str
        'hostname' => hop.host, # str
        'ttl' => hop.ttl.to_i, # int
        'rtt' => hop.rtt.to_i, # int
        'index' => idx # int (for searching by distance)
      }
    end
  }
end

#hashify_uptime(uptime) ⇒ Object 



153
154
155
156
157
158
159
160
 
# File 'lib/logstash/codecs/nmap.rb', line 153

def hashify_uptime(uptime)
  return unless uptime

  {
    'seconds' => uptime.seconds,
    'last_boot' => timeify(uptime.last_boot)
  }
end

#register ⇒ Object 



20
21
 
# File 'lib/logstash/codecs/nmap.rb', line 20

def register
end

#timeify(time, default = nil) ⇒ Object 



221
222
223
224
225
226
227
228
229
 
# File 'lib/logstash/codecs/nmap.rb', line 221

def timeify(time, default=nil)
  timestamp = time ? LogStash::Timestamp.new(time) : nil
  # Sometimes the nmap parser returns the epoch when there's no time...
  if (!timestamp || timestamp <= EPOCH)
    default
  else
    timestamp
  end
end