Algorithm-ToNumberMunger

 view release on metacpan or  search on metacpan

LICENSE  view on Meta::CPAN

    a) Accompany the combined library with a copy of the same work
    based on the Library, uncombined with any other library
    facilities.  This must be distributed under the terms of the
    Sections above.

    b) Give prominent notice with the combined library of the fact
    that part of it is a work based on the Library, and explaining
    where to find the accompanying uncombined form of the same work.

  8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License.  Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License.  However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.

  9. You are not required to accept this License, since you have not
signed it.  However, nothing else grants you permission to modify or
distribute the Library or its derivative works.  These actions are
prohibited by law if you do not accept this License.  Therefore, by

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

C<icmpv6> 58 (alias C<ipv6-icmp>), C<ospf> 89, C<pim> 103, C<sctp> 132,
C<udplite> 136. The map is frozen here rather than delegated to
C<getprotobyname> so a value munges to the same number on every host.

=head2 tls_version_enum

    { munger => 'tls_version_enum', default => -1 }

Named-map enum (lookup rules as L</dns_rcode_enum>) mapping a TLS/SSL protocol
version name to an B<ordinal>: C<SSLv2> 0, C<SSLv3> 1, C<TLSv1> 2, C<TLSv1.1>
3, C<TLSv1.2> 4, C<TLSv1.3> 5, with the common spelling variants (C<ssl3>,
C<tls1.2>, ...) accepted. Ordinal so "older than expected" is a monotone
feature a threshold split can express. Because these ordinals are this
module's invention rather than a wire encoding, numeric inputs are B<not>
passed through -- a C<1.2> would land on the wrong scale -- and croak like
any other unmapped value (or take the C<default>).

=head2 http_method_enum

    { munger => 'http_method_enum', default => -1 }

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

=head2 app_proto_enum

    { munger => 'app_proto_enum', default => -1 }

Named-map enum (lookup rules as L</dns_rcode_enum>) for Suricata's
C<app_proto> field -- the detected application-layer protocol on a flow or
alert (C<http>, C<dns>, C<tls>, C<ssh>, C<smtp>, C<dcerpc>, C<quic>, ...),
including C<failed> and C<unknown>, which are usually the very rows worth
keeping. These are unordered ordinals of this module's invention (Suricata
logs a string, not a number), so numeric inputs are B<not> passed through.
C<ssl> is accepted as an alias for C<tls> and C<ikev2> for C<ike>. This is
distinct from L</ip_proto_enum>, which numbers the L4 protocol
(C<tcp>/C<udp>/...) rather than the app layer riding on it.

=head2 tcp_state_enum

    { munger => 'tcp_state_enum', default => -1 }

Named-map enum (lookup rules as L</dns_rcode_enum>) mapping the TCP state
machine, as Suricata logs it under C<flow.tcp.state>, to an B<ordinal> along
the connection lifecycle: C<none> 0, C<syn_sent> 1, C<syn_recv> 2,

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

			'ipv6-icmp' => 58,
			ospf        => 89,
			pim         => 103,
			sctp        => 132,
			udplite     => 136,
		},
	},
	tls_version => {
		numeric => 0,
		map     => {
			sslv2     => 0,
			ssl2      => 0,
			sslv3     => 1,
			ssl3      => 1,
			tlsv1     => 2,
			'tlsv1.0' => 2,
			tls1      => 2,
			'tls1.0'  => 2,
			'tlsv1.1' => 3,
			'tls1.1'  => 3,
			'tlsv1.2' => 4,
			'tls1.2'  => 4,
			'tlsv1.3' => 5,
			'tls1.3'  => 5,

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

			# kept as their own classes -- an un-parsed app layer is often the
			# interesting row.
			do {
				my @order = qw(
					unknown failed http http2 ftp ftp-data smtp imap
					tls ssh smb dcerpc dns modbus enip dnp3 nfs ntp
					tftp ike krb5 quic dhcp snmp sip rfb mqtt rdp
					telnet pgsql ldap websocket bittorrent-dht
				);
				my %m = map { $order[$_] => $_ } 0 .. $#order;
				$m{ssl}   = $m{tls};    # Suricata's older spelling
				$m{ikev2} = $m{ike};
				%m;
			},
		},
	},
	tcp_state => {
		numeric => 0,
		map     => {
			# The TCP state machine (flow.tcp.state), numbered along the
			# connection lifecycle so the ordinal is meaningful.

t/mungers.t  view on Meta::CPAN

	like( $@, qr/not a non-negative integer \(hex\)/, 'bit base16 rejects non-hex, names the form' );
	eval { $M->build( { munger => 'bit', mask => 1, base => 2 } ) };
	like( $@, qr/'base' must be 10 or 16/, 'bit rejects an unsupported base' );
}

# ---- Suricata named enums ---------------------------------------------------
{
	my $ap = $M->build( { munger => 'app_proto_enum', default => -1 } );
	is( $ap->('http'),    2,  'app_proto http' );
	is( $ap->('TLS'),     $ap->('tls'), 'app_proto is case-insensitive' );
	is( $ap->('ssl'),     $ap->('tls'), 'app_proto ssl aliases tls' );
	is( $ap->('ikev2'),   $ap->('ike'), 'app_proto ikev2 aliases ike' );
	is( $ap->('unknown'), 0,  'app_proto keeps unknown as a class' );
	is( $ap->('failed'),  1,  'app_proto keeps failed as a class' );
	is( $ap->('wat'),     -1, 'app_proto default for unlisted' );
	eval { $M->build( { munger => 'app_proto_enum' } )->(6) };
	like( $@, qr/no mapping for '6'/, 'app_proto does not pass a number through' );

	my $ts = $M->build( { munger => 'tcp_state_enum' } );
	is( $ts->('none'),        0,  'tcp_state none' );
	is( $ts->('ESTABLISHED'), 3,  'tcp_state established (case-insensitive)' );