{"action":"created","comment":{"url":"https://api.github.com/repos/cea-sec/ivre/pulls/comments/167440180","pull_request_review_id":95660898,"id":167440180,"diff_hunk":"@@ -0,0 +1,81 @@\n+#! /usr/bin/env python\n+\n+# This file is part of IVRE.\n+# Copyright 2011 - 2018 Pierre LALET <pierre.lalet@cea.fr>\n+#\n+# IVRE is free software: you can redistribute it and/or modify it\n+# under the terms of the GNU General Public License as published by\n+# the Free Software Foundation, either version 3 of the License, or\n+# (at your option) any later version.\n+#\n+# IVRE is distributed in the hope that it will be useful, but WITHOUT\n+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY\n+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public\n+# License for more details.\n+#\n+# You should have received a copy of the GNU General Public License\n+# along with IVRE. If not, see <http://www.gnu.org/licenses/>.\n+#\n+# Maintainers:\n+#   - 2018 Francois CHENAIS <francois.chenais@cea.fr>\n+#\n+\n+\"\"\"Support for Iptables log from syslog files\n+\n+\n+Feb  4 05:30:11 pi01 kernel: [3240403.495065] IPTABLES/UDP/IN=enxb827eb8f8a4f OUT= MAC=ff:ff:ff:ff:ff:ff:18:62:2c:7e:45:d0:08:00:45:00:00:ec:00:00:40:00:40:11:df:e3 SRC=192.168.0.254 DST=192.168.0.255 LEN=236 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=216\n+\n+TODO:\n+ - the log does not contain the Year so it's necessary to set it using parameter\n+   or changing input with new field 'YEAR' or using current year.\n+ - The log contains mac addr from source and destination, is this inifo can be\n+   added to neo db ?\n+\n+\"\"\"\n+\n+import datetime\n+from builtins import zip\n+from ivre.parser import Parser\n+\n+\n+class Iptables(Parser):\n+    \"\"\"Iptables log generator from a syslog file descriptor\"\"\"\n+\n+    def __init__(self, fname, pcap_filter=None):\n+        super(Iptables, self).__init__(fname)\n+\n+\n+    @classmethod\n+    def parse_line(self, line):\n+        line = line.decode().rstrip('\\r\\n')\n+        if not line:\n+            return next(self)\n+\n+        fields={}\n+        # Converts the syslog iptables log into hash\n+        for i in line[line.find('IN='):].split():\n+            try:\n+                (k,v)=i.split('=')\n+                fields[k]=v\n+            except:\n+                fields[i]=''\n+\n+        # Because day of month can be on 1 or 2 char(s)\n+        try:\n+            fields['start_time'] = datetime.datetime.strptime(line[:15], '%b  %d %H:%M:%S')\n+        except:\n+            fields['start_time'] = datetime.datetime.strptime(line[:15], '%b %d %H:%M:%S')\n+\n+        # Rename fields according to flow2db specifications.\n+        fields['src'] = fields.pop('SRC')\n+        fields['dst'] = fields.pop('DST')\n+        fields['proto'] = fields.pop('PROTO').lower()\n+        if fields['proto'] in ('udp', 'tcp'):\n+            fields['sport'] = int(fields.pop('SPT'))\n+            fields['dport'] = int(fields.pop('DPT'))\n+\n+        # This data are mandatory but undefined in iptables logs, so make my/a choice.","path":"ivre/parser/iptables.py","position":77,"original_position":77,"commit_id":"685062e2bf5a67ff9178a9b0b23471b28beef1b8","original_commit_id":"685062e2bf5a67ff9178a9b0b23471b28beef1b8","user":{"login":"fccagou","id":353109,"avatar_url":"https://avatars1.githubusercontent.com/u/353109?v=4","gravatar_id":"","url":"https://api.github.com/users/fccagou","html_url":"https://github.com/fccagou","followers_url":"https://api.github.com/users/fccagou/followers","following_url":"https://api.github.com/users/fccagou/following{/other_user}","gists_url":"https://api.github.com/users/fccagou/gists{/gist_id}","starred_url":"https://api.github.com/users/fccagou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fccagou/subscriptions","organizations_url":"https://api.github.com/users/fccagou/orgs","repos_url":"https://api.github.com/users/fccagou/repos","events_url":"https://api.github.com/users/fccagou/events{/privacy}","received_events_url":"https://api.github.com/users/fccagou/received_events","type":"User","site_admin":false},"body":"Proto is used in IGMP example.","created_at":"2018-02-11T16:16:23Z","updated_at":"2018-02-11T16:16:23Z","html_url":"https://github.com/cea-sec/ivre/pull/477#discussion_r167440180","pull_request_url":"https://api.github.com/repos/cea-sec/ivre/pulls/477","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/comments/167440180"},"html":{"href":"https://github.com/cea-sec/ivre/pull/477#discussion_r167440180"},"pull_request":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/477"}},"in_reply_to_id":167437190},"pull_request":{"url":"https://api.github.com/repos/cea-sec/ivre/pulls/477","id":168449629,"html_url":"https://github.com/cea-sec/ivre/pull/477","diff_url":"https://github.com/cea-sec/ivre/pull/477.diff","patch_url":"https://github.com/cea-sec/ivre/pull/477.patch","issue_url":"https://api.github.com/repos/cea-sec/ivre/issues/477","number":477,"state":"open","locked":false,"title":"feat (parser): add parser for iptables sylog","user":{"login":"fccagou","id":353109,"avatar_url":"https://avatars1.githubusercontent.com/u/353109?v=4","gravatar_id":"","url":"https://api.github.com/users/fccagou","html_url":"https://github.com/fccagou","followers_url":"https://api.github.com/users/fccagou/followers","following_url":"https://api.github.com/users/fccagou/following{/other_user}","gists_url":"https://api.github.com/users/fccagou/gists{/gist_id}","starred_url":"https://api.github.com/users/fccagou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fccagou/subscriptions","organizations_url":"https://api.github.com/users/fccagou/orgs","repos_url":"https://api.github.com/users/fccagou/repos","events_url":"https://api.github.com/users/fccagou/events{/privacy}","received_events_url":"https://api.github.com/users/fccagou/received_events","type":"User","site_admin":false},"body":"New parser for iptables log.\r\n\r\nAt the begining of iptables.py, can you have a look to the questions in the 'TODO:' section.\r\nI will code it depending of your point of view for the next version of the code.\r\n\r\n++","created_at":"2018-02-11T11:40:32Z","updated_at":"2018-02-11T16:16:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"bb360dd90ec3feb26a07dccf4e0da58b425465b2","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/cea-sec/ivre/pulls/477/commits","review_comments_url":"https://api.github.com/repos/cea-sec/ivre/pulls/477/comments","review_comment_url":"https://api.github.com/repos/cea-sec/ivre/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cea-sec/ivre/issues/477/comments","statuses_url":"https://api.github.com/repos/cea-sec/ivre/statuses/685062e2bf5a67ff9178a9b0b23471b28beef1b8","head":{"label":"fccagou:parser-iptables","ref":"parser-iptables","sha":"685062e2bf5a67ff9178a9b0b23471b28beef1b8","user":{"login":"fccagou","id":353109,"avatar_url":"https://avatars1.githubusercontent.com/u/353109?v=4","gravatar_id":"","url":"https://api.github.com/users/fccagou","html_url":"https://github.com/fccagou","followers_url":"https://api.github.com/users/fccagou/followers","following_url":"https://api.github.com/users/fccagou/following{/other_user}","gists_url":"https://api.github.com/users/fccagou/gists{/gist_id}","starred_url":"https://api.github.com/users/fccagou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fccagou/subscriptions","organizations_url":"https://api.github.com/users/fccagou/orgs","repos_url":"https://api.github.com/users/fccagou/repos","events_url":"https://api.github.com/users/fccagou/events{/privacy}","received_events_url":"https://api.github.com/users/fccagou/received_events","type":"User","site_admin":false},"repo":{"id":32107234,"name":"ivre","full_name":"fccagou/ivre","owner":{"login":"fccagou","id":353109,"avatar_url":"https://avatars1.githubusercontent.com/u/353109?v=4","gravatar_id":"","url":"https://api.github.com/users/fccagou","html_url":"https://github.com/fccagou","followers_url":"https://api.github.com/users/fccagou/followers","following_url":"https://api.github.com/users/fccagou/following{/other_user}","gists_url":"https://api.github.com/users/fccagou/gists{/gist_id}","starred_url":"https://api.github.com/users/fccagou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fccagou/subscriptions","organizations_url":"https://api.github.com/users/fccagou/orgs","repos_url":"https://api.github.com/users/fccagou/repos","events_url":"https://api.github.com/users/fccagou/events{/privacy}","received_events_url":"https://api.github.com/users/fccagou/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/fccagou/ivre","description":"A Python network recon framework, based on Nmap, Bro & p0f with MongoDB backend.","fork":true,"url":"https://api.github.com/repos/fccagou/ivre","forks_url":"https://api.github.com/repos/fccagou/ivre/forks","keys_url":"https://api.github.com/repos/fccagou/ivre/keys{/key_id}","collaborators_url":"https://api.github.com/repos/fccagou/ivre/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/fccagou/ivre/teams","hooks_url":"https://api.github.com/repos/fccagou/ivre/hooks","issue_events_url":"https://api.github.com/repos/fccagou/ivre/issues/events{/number}","events_url":"https://api.github.com/repos/fccagou/ivre/events","assignees_url":"https://api.github.com/repos/fccagou/ivre/assignees{/user}","branches_url":"https://api.github.com/repos/fccagou/ivre/branches{/branch}","tags_url":"https://api.github.com/repos/fccagou/ivre/tags","blobs_url":"https://api.github.com/repos/fccagou/ivre/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/fccagou/ivre/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/fccagou/ivre/git/refs{/sha}","trees_url":"https://api.github.com/repos/fccagou/ivre/git/trees{/sha}","statuses_url":"https://api.github.com/repos/fccagou/ivre/statuses/{sha}","languages_url":"https://api.github.com/repos/fccagou/ivre/languages","stargazers_url":"https://api.github.com/repos/fccagou/ivre/stargazers","contributors_url":"https://api.github.com/repos/fccagou/ivre/contributors","subscribers_url":"https://api.github.com/repos/fccagou/ivre/subscribers","subscription_url":"https://api.github.com/repos/fccagou/ivre/subscription","commits_url":"https://api.github.com/repos/fccagou/ivre/commits{/sha}","git_commits_url":"https://api.github.com/repos/fccagou/ivre/git/commits{/sha}","comments_url":"https://api.github.com/repos/fccagou/ivre/comments{/number}","issue_comment_url":"https://api.github.com/repos/fccagou/ivre/issues/comments{/number}","contents_url":"https://api.github.com/repos/fccagou/ivre/contents/{+path}","compare_url":"https://api.github.com/repos/fccagou/ivre/compare/{base}...{head}","merges_url":"https://api.github.com/repos/fccagou/ivre/merges","archive_url":"https://api.github.com/repos/fccagou/ivre/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/fccagou/ivre/downloads","issues_url":"https://api.github.com/repos/fccagou/ivre/issues{/number}","pulls_url":"https://api.github.com/repos/fccagou/ivre/pulls{/number}","milestones_url":"https://api.github.com/repos/fccagou/ivre/milestones{/number}","notifications_url":"https://api.github.com/repos/fccagou/ivre/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/fccagou/ivre/labels{/name}","releases_url":"https://api.github.com/repos/fccagou/ivre/releases{/id}","deployments_url":"https://api.github.com/repos/fccagou/ivre/deployments","created_at":"2015-03-12T22:48:12Z","updated_at":"2016-08-24T19:46:42Z","pushed_at":"2018-02-11T11:35:25Z","git_url":"git://github.com/fccagou/ivre.git","ssh_url":"git@github.com:fccagou/ivre.git","clone_url":"https://github.com/fccagou/ivre.git","svn_url":"https://github.com/fccagou/ivre","homepage":"http://pierre.droids-corp.org/blog/html/tags/ivre.html","size":7699,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-3.0","name":"GNU General Public License v3.0","spdx_id":"GPL-3.0","url":"https://api.github.com/licenses/gpl-3.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"cea-sec:master","ref":"master","sha":"179db65aba62de5f50ae7febcc99c9d873cce301","user":{"login":"cea-sec","id":5071925,"avatar_url":"https://avatars2.githubusercontent.com/u/5071925?v=4","gravatar_id":"","url":"https://api.github.com/users/cea-sec","html_url":"https://github.com/cea-sec","followers_url":"https://api.github.com/users/cea-sec/followers","following_url":"https://api.github.com/users/cea-sec/following{/other_user}","gists_url":"https://api.github.com/users/cea-sec/gists{/gist_id}","starred_url":"https://api.github.com/users/cea-sec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cea-sec/subscriptions","organizations_url":"https://api.github.com/users/cea-sec/orgs","repos_url":"https://api.github.com/users/cea-sec/repos","events_url":"https://api.github.com/users/cea-sec/events{/privacy}","received_events_url":"https://api.github.com/users/cea-sec/received_events","type":"Organization","site_admin":false},"repo":{"id":23961941,"name":"ivre","full_name":"cea-sec/ivre","owner":{"login":"cea-sec","id":5071925,"avatar_url":"https://avatars2.githubusercontent.com/u/5071925?v=4","gravatar_id":"","url":"https://api.github.com/users/cea-sec","html_url":"https://github.com/cea-sec","followers_url":"https://api.github.com/users/cea-sec/followers","following_url":"https://api.github.com/users/cea-sec/following{/other_user}","gists_url":"https://api.github.com/users/cea-sec/gists{/gist_id}","starred_url":"https://api.github.com/users/cea-sec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cea-sec/subscriptions","organizations_url":"https://api.github.com/users/cea-sec/orgs","repos_url":"https://api.github.com/users/cea-sec/repos","events_url":"https://api.github.com/users/cea-sec/events{/privacy}","received_events_url":"https://api.github.com/users/cea-sec/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cea-sec/ivre","description":"Network recon framework.","fork":false,"url":"https://api.github.com/repos/cea-sec/ivre","forks_url":"https://api.github.com/repos/cea-sec/ivre/forks","keys_url":"https://api.github.com/repos/cea-sec/ivre/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cea-sec/ivre/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cea-sec/ivre/teams","hooks_url":"https://api.github.com/repos/cea-sec/ivre/hooks","issue_events_url":"https://api.github.com/repos/cea-sec/ivre/issues/events{/number}","events_url":"https://api.github.com/repos/cea-sec/ivre/events","assignees_url":"https://api.github.com/repos/cea-sec/ivre/assignees{/user}","branches_url":"https://api.github.com/repos/cea-sec/ivre/branches{/branch}","tags_url":"https://api.github.com/repos/cea-sec/ivre/tags","blobs_url":"https://api.github.com/repos/cea-sec/ivre/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cea-sec/ivre/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cea-sec/ivre/git/refs{/sha}","trees_url":"https://api.github.com/repos/cea-sec/ivre/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cea-sec/ivre/statuses/{sha}","languages_url":"https://api.github.com/repos/cea-sec/ivre/languages","stargazers_url":"https://api.github.com/repos/cea-sec/ivre/stargazers","contributors_url":"https://api.github.com/repos/cea-sec/ivre/contributors","subscribers_url":"https://api.github.com/repos/cea-sec/ivre/subscribers","subscription_url":"https://api.github.com/repos/cea-sec/ivre/subscription","commits_url":"https://api.github.com/repos/cea-sec/ivre/commits{/sha}","git_commits_url":"https://api.github.com/repos/cea-sec/ivre/git/commits{/sha}","comments_url":"https://api.github.com/repos/cea-sec/ivre/comments{/number}","issue_comment_url":"https://api.github.com/repos/cea-sec/ivre/issues/comments{/number}","contents_url":"https://api.github.com/repos/cea-sec/ivre/contents/{+path}","compare_url":"https://api.github.com/repos/cea-sec/ivre/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cea-sec/ivre/merges","archive_url":"https://api.github.com/repos/cea-sec/ivre/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cea-sec/ivre/downloads","issues_url":"https://api.github.com/repos/cea-sec/ivre/issues{/number}","pulls_url":"https://api.github.com/repos/cea-sec/ivre/pulls{/number}","milestones_url":"https://api.github.com/repos/cea-sec/ivre/milestones{/number}","notifications_url":"https://api.github.com/repos/cea-sec/ivre/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cea-sec/ivre/labels{/name}","releases_url":"https://api.github.com/repos/cea-sec/ivre/releases{/id}","deployments_url":"https://api.github.com/repos/cea-sec/ivre/deployments","created_at":"2014-09-12T13:34:56Z","updated_at":"2018-02-11T00:15:10Z","pushed_at":"2018-02-11T11:40:33Z","git_url":"git://github.com/cea-sec/ivre.git","ssh_url":"git@github.com:cea-sec/ivre.git","clone_url":"https://github.com/cea-sec/ivre.git","svn_url":"https://github.com/cea-sec/ivre","homepage":"https://ivre.rocks/","size":7696,"stargazers_count":1064,"watchers_count":1064,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":313,"mirror_url":null,"archived":false,"open_issues_count":17,"license":{"key":"gpl-3.0","name":"GNU General Public License v3.0","spdx_id":"GPL-3.0","url":"https://api.github.com/licenses/gpl-3.0"},"forks":313,"open_issues":17,"watchers":1064,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/477"},"html":{"href":"https://github.com/cea-sec/ivre/pull/477"},"issue":{"href":"https://api.github.com/repos/cea-sec/ivre/issues/477"},"comments":{"href":"https://api.github.com/repos/cea-sec/ivre/issues/477/comments"},"review_comments":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/477/comments"},"review_comment":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cea-sec/ivre/pulls/477/commits"},"statuses":{"href":"https://api.github.com/repos/cea-sec/ivre/statuses/685062e2bf5a67ff9178a9b0b23471b28beef1b8"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"fccagou"}}