ET Pro Telemetry, make sure suricata HOME_NETs are considered local for anonymization

This commit is contained in:
Ad Schellevis
2019-03-13 13:50:26 +01:00
parent e59e392439
commit 428f8bf54f
2 changed files with 12 additions and 1 deletions
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= etpro-telemetry
PLUGIN_VERSION= 1.2
PLUGIN_VERSION= 1.3
#PLUGIN_REVISION= 1
PLUGIN_COMMENT= ET Pro Telemetry Edition
PLUGIN_MAINTAINER= ad@opnsense.org
@@ -100,6 +100,17 @@ class EventCollector(object):
""" collect local attached networks for anonymization purposes
:return: None
"""
if os.path.isfile('/usr/local/etc/suricata/suricata.yaml'):
# home nets are considered local
with open('/usr/local/etc/suricata/suricata.yaml') as f_in:
parts = f_in.read().split('HOME_NET:')
if len(parts) > 1:
for net in parts[1].split("\n")[0].strip('" [ ]').split(','):
try:
self._local_networks.append(netaddr.IPNetwork(net))
except netaddr.core.AddrFormatError:
pass
with tempfile.NamedTemporaryFile() as output_stream:
subprocess.call(['ifconfig', '-a'], stdout=output_stream, stderr=open(os.devnull, 'wb'))
output_stream.seek(0)