GOMOR / Onyphe-v4.19.0 / lib / OPP / Proc / Lookup.pm 

            

              
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
—
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

              
#
# $Id: Lookup.pm,v cfbea05b0bc4 2025/01/28 15:06:19 gomor $
#
package OPP::Proc::Lookup;
use strict;
use warnings;
use base qw(OPP::Proc);
__PACKAGE__->cgBuildIndices;
our $VERSION = '1.00';
use File::Slurp qw(read_file);
use Text::CSV_XS;
use Net::IPv4Addr qw(ipv4_in_network);
use Data::Dumper;
sub _load {
   my $self = shift;
   my ($file) = @_;
   my $csv = $self->state->value('csv', $self->idx);
   my $match_fields = $self->state->value('match_fields', $self->idx);
   my $lookup_field = $self->state->value('lookup_field', $self->idx);
   # Load CSV lookup:
   unless (defined($csv)) {
      my $csvxs = Text::CSV_XS->new({
         binary => 1,
         sep_char => ',',
         allow_loose_quotes => 1,
         allow_loose_escapes => 1,
         escape_char => '"',
      }) or die("lookup: cannot initiate Text::CSV_XS\n");
      #my @lines = read_file($file) or die("lookup: cannot read or empty file: $file\n");
      open(my $fd, '<', $file) or die("lookup: cannot open file: $file\n");
      # First line is considered the header
      my $header = $csvxs->getline($fd) or die("lookup: cannot get header\n");
      die("lookup: no line found\n") unless defined $header;
      #print STDERR Data::Dumper::Dumper($header)."\n";
      my $lookup = pop @$header;  # Last field is the data to add
      $lookup_field = $lookup;
      # Prepare for supporting matching with AND filters:
      $match_fields = [ sort { $a cmp $b } @$header ];
      $header = join('+', sort { $a cmp $b } @$header);
      while (my $line = $csvxs->getline($fd)) {
         my $last = pop @$line;  # Last field is the data to add
         my $key = join('+', sort { $a cmp $b } @$line);
         $csv->{$header}{lc($key)} = { $lookup_field => $last };
      }
      $self->state->add('csv', $csv, $self->idx);
      $self->state->add('match_fields', $match_fields, $self->idx);
      $self->state->add('lookup_field', $lookup_field, $self->idx);
      #print STDERR "match_fields[".Data::Dumper::Dumper($match_fields)."]\n";
      #print STDERR "lookup_field[$lookup_field]\n";
   }
   #print STDERR Data::Dumper::Dumper($csv)."\n";
   return [ $csv, $match_fields, $lookup_field ];
}
#
# echo domain,mytags > lookup.csv
# echo amazonaws.com,aws >> lookup.csv
#
# | lookup lookup.csv
#
# echo ip,mytags
# echo 8.8.8.0/24,google
#
# | lookup lookup.csv cidr=ip
#
sub process {
   my $self = shift;
   my ($input) = @_;
   my $options = $self->options;
   my $file = $options->{0};
   die("lookup: file not given\n") unless defined $file;
   die("lookup: file not found: $file\n") unless -f $file;
   my $cidr = $options->{cidr} || 'ip';  # Use ip field by default for cidr matches
   my $r = $self->_load($file);
   my $csv = $r->[0];
   my $match_fields = $r->[1];
   my $lookup_field = $r->[2];
   # Touch nothing when matching fields are not found in input:
   for my $field (@$match_fields) {
      my $values = $self->value($input, $field);
      unless (defined($values)) {  # Field not found here
         $self->output->add($input);
         return 1;
      }
   }
   # All fields to match against were found in input, we can search a match:
   for my $field (@$match_fields) {
      #print STDERR "field1[$field]\n";
      my $values = $self->value($input, $field) or next;
      if ($field eq $cidr) {  # CIDR match mode
         for my $v (@$values) {
            for my $this (keys %{$csv->{$cidr}}) {
               if (ipv4_in_network($this, $v)) {
                  for my $k (keys %{$csv->{$field}{$this}}) {
                     $self->set($input, $k, $csv->{$field}{$this}{$k}, 1);  # As ARRAY
                  }
               }
            }
         }
      }
      else {  # Exact match mode
         for my $v (@$values) {
            #print STDERR "field2[$field] v[$v]\n";
            if (defined($csv->{$field}) && defined($csv->{$field}{lc($v)})) {
               #print STDERR "match\n";
               for my $k (keys %{$csv->{$field}{lc($v)}}) {
                  #print STDERR "field[$field] v[$v] k[$k]\n";
                  $self->set($input, $k, $csv->{$field}{lc($v)}{$k}, 1); # As ARRAY
               }
            }
         }
      }
   }
   $self->output->add($input);
   return 1;
}
1;
__END__
=head1 NAME
OPP::Proc::Lookup - lookup processor
=head1 SYNOPSIS
=head1 DESCRIPTION
=head1 COPYRIGHT AND LICENSE
Copyright (c) 2025, ONYPHE SAS
You may distribute this module under the terms of The BSD 3-Clause License.
See LICENSE file in the source distribution archive.
=head1 AUTHOR
Patrice E<lt>GomoRE<gt> Auffret
=cut