view release on metacpan or  search on metacpan

src_bin/suricata_extract_submit  view on Meta::CPAN

								  'Ignore Listed WebACL, "'
								. $acl
								. '": src_ip="'
								. $file_json->{src_ip}
								. '", ua="'
								. $ua
								. '", path="'
								. $path
								. '"' );
					} else {
						$results = $webacl->check(
							apikey => $acl,
							ua     => $file_json->{http}{http_user_agent},
							path   => $file_json->{fileinfo}{filename},
							ip     => $file_json->{dest_ip},
						);
						if ($results) {
							$add_it = 0;
							$new_stats->{ignored_webacl}++;
							my $ua = '';
							if ( defined( $file_json->{http}{http_user_agent} ) ) {
								$ua = $file_json->{http}{http_user_agent};
								$ua =~ s/\"/\\\"/g;
							}
							my $path = '';
							if ( defined( $file_json->{http}{http_user_agent} ) ) {
								$path = $file_json->{fileinfo}{filename};
								$path =~ s/\"/\\\"/g;
							}
							log_something( 'info',
									  'Ignore Listed WebACL, "'
									. $acl
									. '": dest_ip="'
									. $file_json->{dest_ip}
									. '", ua="'
									. $ua
									. '", path="'
									. $path
									. '"' );
						} ## end if ($results)
					} ## end else [ if ($results) ]
				} ## end if ( $add_it && defined( $file_json->{http...}))
			} ## end foreach my $acl (@acls)
		} ## end if ($add_it)

		$name
			= $file_json->{src_ip} . '-'
			. $file_json->{src_port} . '-'
			. $file_json->{dest_ip} . '-'
			. $file_json->{dest_port} . '-'
			. $file_json->{proto} . '-'
			. $extUID . '-'
			. $slug . '-'
			. $t->epoch . '-'
			. $mime;

		# only add it if it is not white listed
		if ($add_it) {
			log_something( 'info', 'Name: ' . $name );

			# skip uploading it if it is zero sized
			if ( $data_size > 0 ) {

				# don't need to copy it if it is zero sized
				copy( $data_file, $name )
					or die 'Copy failed(' . $data_file . ' -> ' . $tempdir . '/' . $name . '): ' . $!;

				$file_json->{suricata_extract_submit} = {
					filename => $name,
					apikey   => $apikey,
					host     => hostname,
					to       => $config->{_}->{url},
					time     => time,
					md5      => $md5,
					sha256   => $sha256,
					sha1     => $sha1,
					slug     => $config->{_}->{slug},
				};
				my $res;
				eval {
					my $ua = LWP::UserAgent->new(
						ssl_opts => { verify_hostname => 0, SSL_verify_mode => 0 },
						timeout  => 30
					);
					# use HTTPS_PROXY/HTTP_PROXY from env if set to true
					if ($use_env_proxy) {
						$ua->env_proxy;
					}
					$res = $ua->request(
						POST $config->{_}->{url},
						Content_type => 'multipart/form-data',
						Content      => [
							apikey   => $apikey,
							filename => [$name],
							type     => 'suricata_extract',
							json     => encode_json($file_json),
						],
					);
				};

				# save error status for later
				my $sub_error = $@;

				# see if we can get a status line
				my $status_line;
				if ( defined($res) ) {
					eval { $status_line = $res->status_line; };

					# compute that status line stats
					if ( defined($status_line) ) {
						if ( $status_line =~ /^2\d\d/ ) {
							$new_stats->{sub_2xx}++;
						} elsif ( $status_line =~ /^3\d\d/ ) {
							$new_stats->{sub_3xx}++;
						} elsif ( $status_line =~ /^4\d\d/ ) {
							$new_stats->{sub_4xx}++;
						} elsif ( $status_line =~ /^5\d\d/ ) {
							$new_stats->{sub_5xx}++;
						}
					} ## end if ( defined($status_line) )
				} ## end if ( defined($res) )

				# handle submission errors
				if ($sub_error) {
					$new_stats->{sub_fail}++;

					# if this is defined, submission worked, but we got a sub error
					if ( defined($status_line) ) {
						my $error = "Failed to post... " . $res->status_line;
						push( @{ $new_stats->{last_errors} }, $error );
						die($error);
					}    # if we don't have a status line the submission eval never got that far
					else {
						$new_stats->{errors}++;
						my $error = "Failed to post... " . $sub_error;
						push( @{ $new_stats->{last_errors} }, $error );
						die($error);
					}
				} else {
					if ( $status_line =~ /^2\d\d/ ) {
						$new_stats->{sub}++;
						log_something( 'info', 'Uplodated Response Status: ' . $res->status_line );
					} else {
						$new_stats->{sub_fail}++;
						my $error = "Failed to post... " . $res->status_line;
						push( @{ $new_stats->{last_errors} }, $error );
						die($error);
					}
				} ## end else [ if ($sub_error) ]
			} else {
				$new_stats->{zero_sized}++;
				log_something( 'info', 'Not uploading as the sample is zero sized' );
			}
		} ## end if ($add_it)

		# rename the JSON file so we don't process it again
		move( $file, $file . '-processed' ) or die 'Appending "-processed" to the name of the JSON file...' . $!;
		if ($@) {
			my $error = 'Failed to rename ' . $file . ' ... ' . $@;
			$new_stats->{errors}++;
			push( @{ $new_stats->{last_errors} }, $error );
			log_something( 'err', $error );
		}
	};
	if ($@) {
		log_something( 'err', 'Processing failed... ' . $@ );
	}

	# only unlink the file if it exists... otherwise the copy failed
	if ( -f $name ) {

		# now that we are done with the tmp file, we can remove it
		unlink($name);
	}
} ## end foreach my $file (@files)

# update the stats
foreach my $item (@to_delta) {
	my $old = $stats->{$item};
	my $new = $new_stats->{$item};
	my $delta;
	# value was missing for some reason in the previous
	if ( !defined($old) ) {
		$delta = $new;
	}    # need to compute the delta as there was change
	elsif ( $new > $old ) {
		$delta = $new - $old;

		# roll it over if it is over 2G
		if ( $new > 2000000000 ) {
			$new_stats->{$item} = $delta;
		}
	}    # ran subsequently and rolled over? this should not happen in general usage... regard new as correct
	elsif ( $old > $new ) {
		$delta = $new;
	}    # none of the above, so zero
	else {
		$delta = 0;
	}
	$new_stats->{ $item . '_delta' } = $delta;
} ## end foreach my $item (@to_delta)

# set the timestamp for the when it was generated
$new_stats->{timestamp} = $t->epoch;

# write out the stats file
my $raw_stats = JSON->new->utf8->canonical(1)->encode($new_stats) . "\n";
log_something( 'info', 'Run Stats: ' . $raw_stats );
eval { write_file( $stats_file, $raw_stats ); };
if ($@) {
	log_something( 'err', 'Writing stats file, "' . $stats_file . '", failed... ' . $@ );
}