diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 61dfc2f..6a71381 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -60,7 +60,7 @@ This plugin supports the following configuration options plus the <> |<>|No | <> | <>|No | <> |<>|No -| <> |<>, one of `["SHA1", "SHA256", "SHA384", "SHA512", "MD5", "MURMUR3", "IPV4_NETWORK", "UUID", "PUNCTUATION"]`|Yes +| <> |<>, one of `["SHA1", "SHA256", "SHA384", "SHA512", "MD5", "MURMUR3", "IPV4_NETWORK", "IPV6_NETWORK", "UUID", "PUNCTUATION"]`|Yes | <> |<>|No | <> |<>|No |======================================================================= @@ -167,14 +167,14 @@ See <> for detailed information. * Value type is <> * There is no default value for this setting. -When used with the `IPV4_NETWORK` method fill in the subnet prefix length. +When used with the `IPV4_NETWORK` or `IPV6_NETWORK` method fill in the subnet prefix length. With other methods, optionally fill in the HMAC key. [id="plugins-{type}s-{plugin}-method"] ===== `method` * This is a required setting. - * Value can be any of: `SHA1`, `SHA256`, `SHA384`, `SHA512`, `MD5`, `MURMUR3`, `IPV4_NETWORK`, `UUID`, `PUNCTUATION` + * Value can be any of: `SHA1`, `SHA256`, `SHA384`, `SHA512`, `MD5`, `MURMUR3`, `IPV4_NETWORK`, `IPV6_NETWORK`, `UUID`, `PUNCTUATION` * Default value is `"SHA1"` The fingerprint method to use. @@ -190,6 +190,11 @@ the hash value will be the masked-out address using the number of bits specified in the `key` option. For example, with "1.2.3.4" as the input and `key` set to 16, the hash becomes "1.2.0.0". +If set to `IPV6_NETWORK` the input data needs to be a IPv6 address and +the hash value will be the masked-out address using the number of bits +specified in the `key` option. For example, with "2001:db8:85a3::8a2e:370:7334" as the input +and `key` set to 112, the hash becomes "2001:db8:85a3::8a2e:370:0". + If set to `PUNCTUATION`, all non-punctuation characters will be removed from the input string. diff --git a/lib/logstash/filters/fingerprint.rb b/lib/logstash/filters/fingerprint.rb index a2faf1c..3b5da19 100644 --- a/lib/logstash/filters/fingerprint.rb +++ b/lib/logstash/filters/fingerprint.rb @@ -36,7 +36,7 @@ class LogStash::Filters::Fingerprint < LogStash::Filters::Base # Any current contents of that field will be overwritten. config :target, :validate => :string - # When used with the `IPV4_NETWORK` method fill in the subnet prefix length. + # When used with the `IPV4_NETWORK` or `IPV6_NETWORK` method fill in the subnet prefix length. # With other methods, optionally fill in the HMAC key. config :key, :validate => :string @@ -58,13 +58,18 @@ class LogStash::Filters::Fingerprint < LogStash::Filters::Base # specified in the `key` option. For example, with "1.2.3.4" as the input # and `key` set to 16, the hash becomes "1.2.0.0". # + # If set to `IPV6_NETWORK` the input data needs to be a IPv6 address and + # the hash value will be the masked-out address using the number of bits + # specified in the `key` option. For example, with "2001:db8:85a3::8a2e:370:7334" as the input + # and `key` set to 112, the hash becomes "2001:db8:85a3::8a2e:370:0". + # # If set to `PUNCTUATION`, all non-punctuation characters will be removed # from the input string. # # If set to `UUID`, a # https://en.wikipedia.org/wiki/Universally_unique_identifier[UUID] will # be generated. The result will be random and thus not a consistent hash. - config :method, :validate => ['SHA1', 'SHA256', 'SHA384', 'SHA512', 'MD5', "MURMUR3", "IPV4_NETWORK", "UUID", "PUNCTUATION"], :required => true, :default => 'SHA1' + config :method, :validate => ['SHA1', 'SHA256', 'SHA384', 'SHA512', 'MD5', "MURMUR3", "IPV4_NETWORK", "IPV6_NETWORK", "UUID", "PUNCTUATION"], :required => true, :default => 'SHA1' # When set to `true` and `method` isn't `UUID` or `PUNCTUATION`, the # plugin concatenates the names and values of all fields given in the @@ -90,7 +95,7 @@ def register # require any library and set the fingerprint function case @method - when :IPV4_NETWORK + when :IPV4_NETWORK, :IPV6_NETWORK if @key.nil? raise LogStash::ConfigurationError, I18n.t( "logstash.runner.configuration.invalid_plugin_register", diff --git a/spec/filters/fingerprint_spec.rb b/spec/filters/fingerprint_spec.rb index a4ffe8d..6a5e767 100644 --- a/spec/filters/fingerprint_spec.rb +++ b/spec/filters/fingerprint_spec.rb @@ -32,6 +32,16 @@ end end + describe "the IPV6_NETWORK method" do + let(:data) { {"clientip" => "2001:db8:85a3::8a2e:370:7334" } } + let(:fingerprint_method) { "IPV6_NETWORK" } + let(:config) { super().merge("key" => 112) } + + it "fingerprints the ip as the network" do + expect(fingerprint).to eq("2001:db8:85a3::8a2e:370:0") + end + end + describe "the MURMUR3 method" do let(:fingerprint_method) { "MURMUR3" }