Skip to content

Commit 71f5c6a

Browse files
committed
Recreated repo to fix LFS issue
0 parents  commit 71f5c6a

File tree

11 files changed

+338
-0
lines changed

11 files changed

+338
-0
lines changed

.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

Gemfile

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source 'https://rubygems.org'
2+
3+
gemspec
4+
5+
logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
6+
use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
7+
8+
if Dir.exist?(logstash_path) && use_logstash_source
9+
gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
10+
gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
11+
end

LICENSE

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright (c) 2022 IP2Location.com
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.

README.md

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# IP2Proxy Filter Plugin
2+
This is IP2Proxy filter plugin for Logstash that enables Logstash's users to reverse search of IP address to detect VPN servers, open proxies, web proxies, Tor exit nodes, search engine robots, data center ranges and residential proxies using IP2Proxy BIN database. Other information available includes proxy type, country, state, city, ISP, domain name, usage type, AS number, AS name, threats, last seen date and provider names. The library took the proxy IP address from **IP2Proxy BIN Data** file.
3+
4+
For the methods to use IP2Proxy filter plugin with Elastic Stack (Elasticsearch, Filebeat, Logstash, and Kibana), please take a look on this [tutorial](https://blog.ip2location.com/knowledge-base/how-to-use-ip2proxy-filter-plugin-with-elastic-stack).
5+
6+
*Note: This plugin works in Logstash 7 and Logstash 8.*
7+
8+
9+
## Dependencies (IP2PROXY BIN DATA FILE)
10+
This plugin requires IP2Proxy BIN data file to function. You may download the BIN data file at
11+
* IP2Proxy LITE BIN Data (Free): https://lite.ip2location.com
12+
* IP2Proxy Commercial BIN Data (Commercial): https://www.ip2location.com
13+
14+
15+
## Installation
16+
Install this plugin by the following code:
17+
```
18+
bin/logstash-plugin install logstash-filter-ip2proxy
19+
```
20+
21+
22+
## Config File Example
23+
```
24+
input {
25+
beats {
26+
port => "5043"
27+
}
28+
}
29+
30+
filter {
31+
grok {
32+
match => { "message" => "%{COMBINEDAPACHELOG}"}
33+
}
34+
ip2proxy {
35+
source => "clientip"
36+
}
37+
}
38+
39+
output {
40+
elasticsearch {
41+
hosts => [ "localhost:9200" ]
42+
}
43+
}
44+
```
45+
46+
47+
## IP2Proxy Filter Configuration
48+
|Setting|Input type|Required|
49+
|---|---|---|
50+
|source|string|Yes|
51+
|database|a valid filesystem path|No|
52+
|use_memory_mapped|boolean|No|
53+
|use_cache|boolean|No|
54+
|hide_unsupported_fields|boolean|No|
55+
56+
* **source** field is a required setting that containing the IP address or hostname to get the ip information.
57+
* **database** field is an optional setting that containing the path to the IP2Proxy BIN database file.
58+
* **use_memory_mapped** field is an optional setting that used to allow user to enable the use of memory mapped file. Default value is false.
59+
* **use_cache** field is an optional setting that used to allow user to enable the use of cache. Default value is true.
60+
* **hide_unsupported_fields** field is an optional setting that used to allow user to hide unsupported fields. Default value is false.
61+
62+
63+
## Sample Output
64+
|Field|Description|
65+
|---|---|
66+
|ip2proxy.as|the autonomous system (AS) name of proxy's IP address or domain name|
67+
|ip2proxy.asn|the autonomous system number (ASN) of proxy's IP address or domain name|
68+
|ip2proxy.city|the city name of the proxy|
69+
|ip2proxy.country_long|the ISO3166-1 country name of the proxy|
70+
|ip2proxy.country_short|the ISO3166-1 country code (two-characters) of the proxy|
71+
|ip2proxy.domain|the domain name of proxy's IP address or domain name|
72+
|ip2proxy.is_proxy|Check whether if an IP address was a proxy. Returned value:<ul><li>-1 : errors</li><li>0 : not a proxy</li><li>1 : a proxy</li><li>2 : a data center IP address</li></ul>|
73+
|ip2proxy.isp|the ISP name of the proxy|
74+
|ip2proxy.last_seen|the last seen days ago value of proxy's IP address or domain name|
75+
|ip2proxy.provider|the VPN service provider name if available|
76+
|ip2proxy.proxy_type|the proxy type. Please visit <a href="https://www.ip2location.com/database/px11-ip-proxytype-country-region-city-isp-domain-usagetype-asn-lastseen-threat-residential-provider" target="_blank">IP2Location</a> for the list of proxy types supported|
77+
|ip2proxy.region|the ISO3166-2 region name of the proxy. Please visit <a href="https://www.ip2location.com/free/iso3166-2" target="_blank">ISO3166-2 Subdivision Code</a> for the information of ISO3166-2 supported|
78+
|ip2proxy.thread|the threat type of the proxy|
79+
|ip2proxy.usage_type|the usage type classification of the proxy. Please visit <a href="https://www.ip2location.com/database/px11-ip-proxytype-country-region-city-isp-domain-usagetype-asn-lastseen-threat-residential-provider" target="_blank">IP2Location</a> for the list of usage types supported|
80+
81+
82+
## Support
83+
Email: support@ip2location.com
84+
85+
URL: [https://www.ip2location.com](https://www.ip2location.com)
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
require 'jar_dependencies'
2+
require_jar('com.ip2proxy.ip2proxy', 'ip2proxy', '3.4.0')
3+
require_jar('org.logstash.filters', 'logstash-filter-ip2proxy', '2.3.2')

lib/logstash/filters/ip2proxy.rb

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# encoding: utf-8
2+
require "logstash/filters/base"
3+
require "logstash/namespace"
4+
5+
require "logstash-filter-ip2proxy_jars"
6+
7+
class LogStash::Filters::IP2Proxy < LogStash::Filters::Base
8+
config_name "ip2proxy"
9+
10+
# The path to the IP2Proxy.BIN database file which Logstash should use.
11+
# If not specified, this will default to the IP2PROXY-LITE-PX1.BIN database that embedded in the plugin.
12+
config :database, :validate => :path
13+
14+
# The field containing the IP address.
15+
# If this field is an array, only the first value will be used.
16+
config :source, :validate => :string, :required => true
17+
18+
# The field used to define iplocation as target.
19+
config :target, :validate => :string, :default => 'ip2proxy'
20+
21+
# The field used to allow user to enable the use of cache.
22+
config :use_cache, :validate => :boolean, :default => true
23+
24+
# The field used to allow user to enable the use of memory mapped file.
25+
config :use_memory_mapped, :validate => :boolean, :default => false
26+
27+
# The field used to allow user to hide unsupported fields.
28+
config :hide_unsupported_fields, :validate => :boolean, :default => false
29+
30+
# The field used to define the size of the cache. It is not required and the default value is 10 000
31+
config :cache_size, :validate => :number, :required => false, :default => 10_000
32+
33+
public
34+
def register
35+
if @database.nil?
36+
@database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2PROXY-LITE-PX1.BIN")).first
37+
38+
if @database.nil? || !File.exists?(@database)
39+
raise "You must specify 'database => ...' in your ip2proxy filter (I looked for '#{@database}')"
40+
end
41+
end
42+
43+
@logger.info("Using ip2proxy database", :path => @database)
44+
45+
@ip2proxyfilter = org.logstash.filters.IP2ProxyFilter.new(@source, @target, @database, @use_memory_mapped, @hide_unsupported_fields)
46+
end
47+
48+
public
49+
def filter(event)
50+
ip = event.get(@source)
51+
52+
return unless filter?(event)
53+
if @use_cache
54+
if value = IP2ProxyCache.find(event, ip, @ip2proxyfilter, @cache_size).get('ip2proxy')
55+
event.set('ip2proxy', value)
56+
filter_matched(event)
57+
else
58+
tag_iplookup_unsuccessful(event)
59+
end
60+
else
61+
if @ip2proxyfilter.handleEvent(event)
62+
filter_matched(event)
63+
else
64+
tag_iplookup_unsuccessful(event)
65+
end
66+
end
67+
end
68+
69+
def tag_iplookup_unsuccessful(event)
70+
@logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
71+
end
72+
73+
end # class LogStash::Filters::IP2Proxy
74+
75+
class IP2ProxyOrderedHash
76+
ONE = 1
77+
78+
attr_reader :times_queried # ip -> times queried
79+
attr_reader :hash
80+
81+
def initialize
82+
@times_queried = Hash.new(0) # ip -> times queried
83+
@hash = {} # number of hits -> array of ips
84+
end
85+
86+
def add(key)
87+
hash[ONE] ||= []
88+
hash[ONE] << key
89+
times_queried[key] = ONE
90+
end
91+
92+
def reorder(key)
93+
number_of_queries = times_queried[key]
94+
95+
hash[number_of_queries].delete(key)
96+
hash.delete(number_of_queries) if hash[number_of_queries].empty?
97+
98+
hash[number_of_queries + 1] ||= []
99+
hash[number_of_queries + 1] << key
100+
end
101+
102+
def increment(key)
103+
add(key) unless times_queried.has_key?(key)
104+
reorder(key)
105+
times_queried[key] += 1
106+
end
107+
108+
def delete_least_used
109+
first_pile_with_something.shift.tap { |key| times_queried.delete(key) }
110+
end
111+
112+
def first_pile_with_something
113+
hash[hash.keys.min]
114+
end
115+
end
116+
117+
class IP2ProxyCache
118+
ONE_DAY_IN_SECONDS = 86_400
119+
120+
@cache = {} # ip -> event
121+
@timestamps = {} # ip -> time of caching
122+
@times_queried = IP2ProxyOrderedHash.new # ip -> times queried
123+
@mutex = Mutex.new
124+
125+
class << self
126+
attr_reader :cache
127+
attr_reader :timestamps
128+
attr_reader :times_queried
129+
130+
def find(event, ip, filter, cache_size)
131+
synchronize do
132+
if cache.has_key?(ip)
133+
refresh_event(event, ip, filter) if too_old?(ip)
134+
else
135+
if cache_full?(cache_size)
136+
make_room
137+
end
138+
cache_event(event, ip, filter)
139+
end
140+
times_queried.increment(ip)
141+
cache[ip]
142+
end
143+
end
144+
145+
def too_old?(ip)
146+
timestamps[ip] < Time.now - ONE_DAY_IN_SECONDS
147+
end
148+
149+
def make_room
150+
key = times_queried.delete_least_used
151+
cache.delete(key)
152+
timestamps.delete(key)
153+
end
154+
155+
def cache_full?(cache_size)
156+
cache.size >= cache_size
157+
end
158+
159+
def cache_event(event, ip, filter)
160+
filter.handleEvent(event)
161+
cache[ip] = event
162+
timestamps[ip] = Time.now
163+
end
164+
165+
def synchronize(&block)
166+
@mutex.synchronize(&block)
167+
end
168+
169+
alias_method :refresh_event, :cache_event
170+
end
171+
end

logstash-filter-ip2proxy.gemspec

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
Gem::Specification.new do |s|
2+
3+
s.name = 'logstash-filter-ip2proxy'
4+
s.version = '2.3.2'
5+
s.licenses = ['Apache-2.0']
6+
s.summary = "Logstash filter IP2Proxy"
7+
s.description = "IP2Proxy filter plugin for Logstash enables Logstash's users to reverse search of IP address to detect VPN servers, open proxies, web proxies, Tor exit nodes, search engine robots, data center ranges and residential proxies using IP2Proxy BIN database."
8+
s.authors = ["IP2Location"]
9+
s.email = 'support@ip2location.com'
10+
s.homepage = "https://www.ip2location.com"
11+
s.require_paths = ["lib", "vendor/jar-dependencies"]
12+
13+
# Files
14+
s.files = Dir["lib/**/*",'spec/**/*',"vendor/**/*","vendor/jar-dependencies/**/*.jar","*.gemspec","*.md","Gemfile","LICENSE"]
15+
16+
# Tests
17+
s.test_files = s.files.grep(%r{^(test|spec|features)/})
18+
19+
# Special flag to let us know this is actually a logstash plugin
20+
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
21+
22+
# Gem dependencies
23+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
24+
s.add_development_dependency "logstash-devutils"
25+
end

spec/filters/ip2proxy_spec.rb

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# encoding: utf-8
2+
require_relative '../spec_helper'
3+
require "logstash/filters/ip2proxy"
4+
5+
IP2PROXYDB = ::Dir.glob(::File.expand_path("../../vendor/", ::File.dirname(__FILE__))+"/IP2PROXY-LITE-PX1.BIN").first
6+
7+
describe LogStash::Filters::IP2Proxy do
8+
9+
describe "normal test" do
10+
config <<-CONFIG
11+
filter {
12+
ip2proxy {
13+
source => "ip"
14+
#database => "#{IP2PROXYDB}"
15+
}
16+
}
17+
CONFIG
18+
19+
sample("ip" => "8.8.8.8") do
20+
expect(subject.get("ip2proxy")).not_to be_empty
21+
expect(subject.get("ip2proxy")["country_short"]).to eq("US")
22+
end
23+
end
24+
25+
end
26+
27+
end

spec/spec_helper.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# encoding: utf-8
2+
require "logstash/devutils/rspec/spec_helper"
Binary file not shown.

0 commit comments

Comments
 (0)