[filtermod] Update Citrix to handle malformed AAA (#609)

CSVD · Aug 7, 2020 · b280749 · b280749
1 parent 22a0200
commit b280749
Show file tree

Hide file tree

Showing 3 changed files with 95 additions and 12 deletions.
diff --git a/package/etc/conf.d/filters/citrix/netscalersdx.conf.tmpl b/package/etc/conf.d/filters/citrix/netscalersdx.conf.tmpl
@@ -4,10 +4,21 @@ filter f_citrix_netscaler_sdx_message {
         flags(store-matches)
     );
 };
+filter f_citrix_netscaler_sdx_AAAmessage {
+    message(
+        '^(<\d{1,3}>) ?(\w{1,3} {1,2}\d{1,2} \d{2}:\d{2}:\d{2}) (\[\d+\]: AAA Message :.*)'
+        flags(store-matches)
+    );
+};
 
 rewrite r_citrix_netscaler_sdx_message {
     set("citrix_netscaler" value("fields.sc4s_syslog_format"));
     set("citrix_netscaler" value("fields.sc4s_vendor_product"));
     set("$5" value("HOST"));
     set("$3" value("MESSAGE"));
+};
+rewrite r_citrix_netscaler_sdx_AAAmessage {
+    set("citrix_netscaler" value("fields.sc4s_syslog_format"));
+    set("citrix_netscaler" value("fields.sc4s_vendor_product"));
+    set("$3" value("MESSAGE"));
 };
diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t
@@ -125,6 +125,13 @@ source s_{{ .port_id }} {
                 template("$2"));
             };
             rewrite(r_citrix_netscaler_sdx_message);        
+        } elif {
+            filter(f_citrix_netscaler_sdx_AAAmessage);
+            parser { 
+                date-parser-nofilter(format('%b %d %H:%M:%S')
+                template("$2"));
+            };
+            rewrite(r_citrix_netscaler_sdx_AAAmessage);        
         };
 {{ else if eq .parser "cisco_ucm" }}
         parser (p_cisco_ucm_date);
@@ -157,6 +164,13 @@ source s_{{ .port_id }} {
                 template("$2"));
             };
             rewrite(r_citrix_netscaler_sdx_message);        
+        } elif {
+            filter(f_citrix_netscaler_sdx_AAAmessage);
+            parser { 
+                date-parser-nofilter(format('%b %d %H:%M:%S')
+                template("$2"));
+            };
+            rewrite(r_citrix_netscaler_sdx_AAAmessage);                            
         } elif {
             filter(f_f5_bigip_message);
             rewrite{

diff --git a/tests/test_citrix_netscaler.py b/tests/test_citrix_netscaler.py
@@ -16,9 +16,11 @@
 
 env = Environment()
 
-#<12> 01/10/2001:01:01:01 GMT netscaler ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - -
+# <12> 01/10/2001:01:01:01 GMT netscaler ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - -
 def test_citrix_netscaler(record_property, setup_wordlist, setup_splunk, setup_sc4s):
-    host = "test-ctitrixns-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist))
+    host = "test-ctitrixns-{}-{}".format(
+        random.choice(setup_wordlist), random.choice(setup_wordlist)
+    )
     pid = random.randint(1000, 32000)
 
     dt = datetime.datetime.now()
@@ -28,12 +30,18 @@ def test_citrix_netscaler(record_property, setup_wordlist, setup_splunk, setup_s
     time = dt.strftime("%d/%m/%Y:%H:%M:%S")
     epoch = epoch[:-7]
 
-    mt = env.from_string("{{ mark }} {{ time }} {{ tzname }} {{ host }} ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - -\n")
-    message = mt.render(mark="<12>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid)
+    mt = env.from_string(
+        "{{ mark }} {{ time }} {{ tzname }} {{ host }} ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - -\n"
+    )
+    message = mt.render(
+        mark="<12>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid
+    )
 
     sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
 
-    st = env.from_string("search _time={{ epoch }} index=netfw host={{ host }} sourcetype=\"citrix:netscaler:syslog\"")
+    st = env.from_string(
+        'search _time={{ epoch }} index=netfw host={{ host }} sourcetype="citrix:netscaler:syslog"'
+    )
     search = st.render(epoch=epoch, host=host, pid=pid)
 
     resultCount, eventCount = splunk_single(setup_splunk, search)
@@ -45,9 +53,13 @@ def test_citrix_netscaler(record_property, setup_wordlist, setup_splunk, setup_s
     assert resultCount == 1
 
 
-#<134>Jun 18 18:18:42 svm_service: 1.1.1.1 18/06/2020:16:18:42 GMT : GUI CMD_EXECUTED : User nsroot - Remote_ip 10.55.1.100 - Command "login login tenant_name=Owner,password=***********,challenge_response=***********,token=1c81504d124245d,client_port=-1,cert_verified=false,sessionid=***********,session_timeout=900,permission=superuser" - Status "Done"
-def test_citrix_netscaler_sdx(record_property, setup_wordlist, setup_splunk, setup_sc4s):
-    host = "test-ctitrixns-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist))
+# <134>Jun 18 18:18:42 svm_service: 1.1.1.1 18/06/2020:16:18:42 GMT : GUI CMD_EXECUTED : User nsroot - Remote_ip 10.55.1.100 - Command "login login tenant_name=Owner,password=***********,challenge_response=***********,token=1c81504d124245d,client_port=-1,cert_verified=false,sessionid=***********,session_timeout=900,permission=superuser" - Status "Done"
+def test_citrix_netscaler_sdx(
+    record_property, setup_wordlist, setup_splunk, setup_sc4s
+):
+    host = "test-ctitrixns-{}-{}".format(
+        random.choice(setup_wordlist), random.choice(setup_wordlist)
+    )
     pid = random.randint(1000, 32000)
 
     dt = datetime.datetime.now()
@@ -57,12 +69,18 @@ def test_citrix_netscaler_sdx(record_property, setup_wordlist, setup_splunk, set
     time = dt.strftime("%d/%m/%Y:%H:%M:%S")
     epoch = epoch[:-7]
 
-    mt = env.from_string('{{ mark }}{{ bsd }} svm_service: {{ host }} {{ time }} GMT : GUI CMD_EXECUTED : User nsroot - Remote_ip 10.1.1.1 - Command "login login tenant_name=Owner,password=***********,challenge_response=***********,token=1c81504d124245d,client_port=-1,cert_verified=false,sessionid=***********,session_timeout=900,permission=superuser" - Status "Done"\n')
-    message = mt.render(mark="<12>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid)
+    mt = env.from_string(
+        '{{ mark }}{{ bsd }} svm_service: {{ host }} {{ time }} GMT : GUI CMD_EXECUTED : User nsroot - Remote_ip 10.1.1.1 - Command "login login tenant_name=Owner,password=***********,challenge_response=***********,token=1c81504d124245d,client_port=-1,cert_verified=false,sessionid=***********,session_timeout=900,permission=superuser" - Status "Done"\n'
+    )
+    message = mt.render(
+        mark="<12>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid
+    )
 
     sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
 
-    st = env.from_string("search _time={{ epoch }} index=netfw host={{ host }} sourcetype=\"citrix:netscaler:syslog\"")
+    st = env.from_string(
+        'search _time={{ epoch }} index=netfw host={{ host }} sourcetype="citrix:netscaler:syslog"'
+    )
     search = st.render(epoch=epoch, host=host, pid=pid)
 
     resultCount, eventCount = splunk_single(setup_splunk, search)
@@ -71,4 +89,44 @@ def test_citrix_netscaler_sdx(record_property, setup_wordlist, setup_splunk, set
     record_property("resultCount", resultCount)
     record_property("message", message)
 
-    assert resultCount == 1
+    assert resultCount == 1
+
+
+# [289]: AAA Message : In receive_ldap_user_search_event: ldap_first_entry returned null, user ssgconfig not found
+def test_citrix_netscaler_sdx_AAA(
+    record_property, setup_wordlist, setup_splunk, setup_sc4s
+):
+    host = "test-ctitrixns-{}-{}".format(
+        random.choice(setup_wordlist), random.choice(setup_wordlist)
+    )
+    pid = random.randint(1000, 32000)
+
+    dt = datetime.datetime.now()
+    iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt)
+
+    # Tune time functions
+    time = dt.strftime("%d/%m/%Y:%H:%M:%S")
+    epoch = epoch[:-7]
+
+    mt = env.from_string(
+        "{{ mark }}{{ bsd }} [289]: AAA Message : In receive_ldap_user_search_event: ldap_first_entry returned null, user {{ host }} not found\n"
+    )
+    message = mt.render(
+        mark="<12>", bsd=bsd, time=time, tzname=tzname, host=host, pid=pid
+    )
+
+    sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
+
+    st = env.from_string(
+        'search _time={{ epoch }} index=netfw {{ host }} sourcetype="citrix:netscaler:syslog"'
+    )
+    search = st.render(epoch=epoch, host=host, pid=pid)
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1
+