Merge pull request #375 from splunk/feature/brocade

Support Brocade switch fabric

docs/sources/Brocade/index.md

@@ -0,0 +1,47 @@
+# Vendor - Brocade
+
+
+## Product - Switches
+
+| Ref            | Link                                                                                                    |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| Splunk Add-on  | None                                    |
+| Product Manual | unknown   |
+
+
+### Sourcetypes
+
+| sourcetype     | notes                                                                                                   |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| brocade:syslog        | None                                                                                                    |
+
+### Sourcetype and Index Configuration
+
+| key            | sourcetype     | index          | notes          |
+|----------------|----------------|----------------|----------------|
+| brocade_syslog      | brocade:syslog       | netops          | none          |
+
+### Filter type
+
+Must be identified by host or ip assignment. Update the filter `f_brocade_syslog` or configure a dedicated port as required
+
+### Setup and Configuration
+
+Device setup unknown 
+
+### Options
+
+| Variable       | default        | description    |
+|----------------|----------------|----------------|
+| SC4S_LISTEN_BROCADE_TCP_PORT      | empty string      | Enable a TCP port for this specific vendor product using the number defined |
+| SC4S_LISTEN_BROCADE_UDP_PORT      | empty string      | Enable a UDP port for this specific vendor product using the number defined |
+| SC4S_ARCHIVE_BROCADE | no | Enable archive to disk for this specific source |
+| SC4S_DEST_BROCADE_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | 
+
+### Verification
+
+An active device will generate frequent events. Use the following search to validate events are present per source device
+
+```
+index=<asconfigured> sourcetype=brocade:syslog| stats count by host
+```

mkdocs.yml

@@ -13,6 +13,7 @@ nav:
   - Development: "developing/index.md"
   - Sources:
       - About: sources/index.md
+      - Brocade: sources/Brocade/index.md   
       - Checkpoint: sources/Checkpoint/index.md
       - Cisco: sources/Cisco/index.md
       - Citrix: sources/Citrix/index.md

package/etc/conf.d/filters/brocade/syslog.conf

@@ -0,0 +1,4 @@
+filter f_brocade {
+    match("^brocade_syslog", value("fields.sc4s_vendor_product"));
+
+};

package/etc/conf.d/log_paths/lp-brocade.conf.tmpl

@@ -0,0 +1,55 @@
+# BROCADE
+{{- /* The following provides a unique port source configuration if env var(s) are set */}}
+{{- $context := dict "port_id" "BROCADE" "parser" "rfc3164" }}
+{{- tmpl.Exec "t/source_network.t" $context }}
+
+log {
+    junction {
+{{- if or (or (getenv  (print "SC4S_LISTEN_BROCADE_TCP_PORT")) (getenv  (print "SC4S_LISTEN_BROCADE_UDP_PORT"))) (getenv  (print "SC4S_LISTEN_BROCADE_TLS_PORT")) }}
+        channel {
+        # Listen on the specified dedicated port(s) for BROCADE traffic
+            source (s_BROCADE);
+            flags (final);
+	    };
+{{- end}}
+        channel {
+        # Listen on the default port (typically 514) for BROCADE traffic
+            source (s_DEFAULT);
+            filter(f_is_rfc3164);
+            filter(f_brocade);
+            flags(final);
+        };
+    };
+
+
+    rewrite {
+        set("brocade_syslog", value("fields.sc4s_vendor_product"));
+        subst("^[^\t]+\t", "", value("MESSAGE"), flags("global"));
+        set("${PROGRAM}", value(".PROGRAM"));
+        subst('^\/(?:[^\/]+\/)+', "" , value(".PROGRAM"));
+        r_set_splunk_dest_default(sourcetype("brocade:syslog"), index("netops"), source("program:${.PROGRAM}"))
+    };
+    parser { p_add_context_splunk(key("brocade_syslog")); };
+
+
+    parser (compliance_meta_by_source);
+    rewrite { set("$(template ${.splunk.sc4s_template} $(template t_msg_only))" value("MSG")); };
+
+{{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_BROCADE_HEC" "no")) }}
+    destination(d_hec);
+{{- end}}
+
+{{- if or (conv.ToBool (getenv "SC4S_ARCHIVE_GLOBAL" "no")) (conv.ToBool (getenv "SC4S_ARCHIVE_BROCADE" "no")) }}
+    destination(d_archive);
+{{- end}}
+
+{{- if (print (getenv "SC4S_DEST_GLOBAL_ALTERNATES")) }}
+    {{ getenv "SC4S_DEST_GLOBAL_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n    destination(" }});
+{{- end }}
+
+{{- if (print (getenv "SC4S_DEST_BROCADE_ALTERNATES")) }}
+    {{ getenv "SC4S_DEST_BROCADE_ALTERNATES" | regexp.ReplaceLiteral "^" "destination(" | regexp.ReplaceLiteral "[, ]+" ");\n    destination(" }});
+{{- end }}
+
+    flags(flow-control,final);
+};

package/etc/context_templates/vendor_product_by_source.conf.example

@@ -6,6 +6,11 @@ filter f_catch_first {
    netmask(169.254.100.0/24)
 };
 
+filter f_brocade_syslog {
+    host("test_brocade-*" type(glob))
+    #or netmask(xxx.xxx.xxx.xxx/xx)
+};
+
 filter f_citrix_netscaler {
     host("test_ctitrixns-*" type(glob))
     #or netmask(xxx.xxx.xxx.xxx/xx)

package/etc/context_templates/vendor_product_by_source.csv.example

@@ -1,4 +1,5 @@
 f_test_test,sc4s_vendor_product,"test_test"
+f_brocade_syslog,sc4s_vendor_product,"brocade_syslog"
 f_catch_first,sc4s_vendor_product,"catch_first"
 f_cisco_meraki,sc4s_vendor_product,"cisco_meraki"
 f_citrix_netscaler,sc4s_vendor_product,"citrix_netscaler"

tests/test_brocade.py

@@ -0,0 +1,52 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+
+from jinja2 import Environment
+
+from .sendmessage import *
+from .splunkutils import *
+from .timeutils import *
+
+import pytest
+env = Environment()
+
+
+#
+#Mar 25 13:53:24 xxxxxx-xxxx STP: VLAN 125 Port 1/1/24 STP State -> FORWARDING (DOT1wTransition) 
+#Mar 25 13:53:25 xxxxx-xxxxx System: PoE: Power disabled on port 1/1/24 because of detection of non-PD. PD detection will be disabled on port. 
+#Mar 25 11:50:21 xxxxx-xxxxx Security: SSH terminated by uuuuuuu from src IP 10.1.1.1 from src MAC dddd.dddd.dddd from USER EXEC mode using RSA as Server Host Key. 
+testdata = [
+    "{{ mark }}{{ bsd }} {{ host }} STP: VLAN 125 Port 1/1/24 STP State -> FORWARDING (DOT1wTransition)",
+    "{{ mark }}{{ bsd }} {{ host }} System: PoE: Power disabled on port 1/1/24 because of detection of non-PD. PD detection will be disabled on port.",
+    "{{ mark }}{{ bsd }} {{ host }} Security: SSH terminated by uuuuuuu from src IP 10.1.1.1 from src MAC dddd.dddd.dddd from USER EXEC mode using RSA as Server Host Key. ",
+]
+
+@pytest.mark.parametrize("event", testdata)
+def test_brocade(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s, event):
+    host = "test_brocade-" + get_host_key
+
+    dt = datetime.datetime.now()
+    iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt)
+
+    # Tune time functions
+    epoch = epoch[:-7]
+
+    mt = env.from_string(event + "\n")
+    message = mt.render(mark="<166>", bsd=bsd, host=host)
+
+    sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
+
+    st = env.from_string(
+        "search index=netops _time={{ epoch }} sourcetype=\"brocade:syslog\" (host=\"{{ host }}\" OR \"{{ host }}\")")
+    search = st.render(epoch=epoch, host=host)
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1