99 lines
4.1 KiB
Python
99 lines
4.1 KiB
Python
import msgpack
|
|
from django.core.management.base import BaseCommand
|
|
from redis import StrictRedis
|
|
|
|
from core.lib.rules import rule_notify
|
|
from core.models import NotificationRule
|
|
from core.util import logs
|
|
|
|
log = logs.get_logger("processing")
|
|
|
|
|
|
def process_rules(data):
|
|
all_rules = NotificationRule.objects.filter(enabled=True, interval=0)
|
|
|
|
for index, index_messages in data.items():
|
|
for message in index_messages:
|
|
for rule in all_rules:
|
|
# Quicker helper to get the data without spinning
|
|
# up a NotificationRuleData object
|
|
parsed_rule = rule.parse()
|
|
matched = {}
|
|
# Rule is invalid, this shouldn't happen
|
|
if "index" not in parsed_rule:
|
|
continue
|
|
if "source" not in parsed_rule:
|
|
continue
|
|
rule_index = parsed_rule["index"]
|
|
rule_source = parsed_rule["source"]
|
|
# if not type(rule_index) == list:
|
|
# rule_index = [rule_index]
|
|
# if not type(rule_source) == list:
|
|
# rule_source = [rule_source]
|
|
if index not in rule_index:
|
|
# We don't care about this index, go to the next one
|
|
continue
|
|
if message["src"] not in rule_source:
|
|
# We don't care about this source, go to the next one
|
|
continue
|
|
|
|
matched["index"] = index
|
|
matched["source"] = message["src"]
|
|
|
|
rule_field_length = len(parsed_rule.keys())
|
|
matched_field_number = 0
|
|
for field, value in parsed_rule.items():
|
|
# if not type(value) == list:
|
|
# value = [value]
|
|
if field == "src":
|
|
# We already checked this
|
|
continue
|
|
if field == "tokens":
|
|
# Check if tokens are in the rule
|
|
# We only check if *at least one* token matches
|
|
for token in value:
|
|
if "tokens" in message:
|
|
if token in message["tokens"]:
|
|
matched_field_number += 1
|
|
matched[field] = token
|
|
# Break out of the token matching loop
|
|
break
|
|
# Continue to next field
|
|
continue
|
|
|
|
if field == "msg":
|
|
# Allow partial matches for msg
|
|
for msg in value:
|
|
if "msg" in message:
|
|
if msg.lower() in message["msg"].lower():
|
|
matched_field_number += 1
|
|
matched[field] = msg
|
|
# Break out of the msg matching loop
|
|
break
|
|
# Continue to next field
|
|
continue
|
|
if field in message and message[field] in value:
|
|
# Do exact matches for all other fields
|
|
matched_field_number += 1
|
|
matched[field] = message[field]
|
|
# Subtract 2, 1 for source and 1 for index
|
|
if matched_field_number == rule_field_length - 2:
|
|
meta = {"matched": matched, "total_hits": 1}
|
|
rule_notify(rule, index, message, meta=meta)
|
|
|
|
|
|
class Command(BaseCommand):
|
|
def handle(self, *args, **options):
|
|
r = StrictRedis(unix_socket_path="/var/run/socks/redis.sock", db=0)
|
|
p = r.pubsub()
|
|
p.psubscribe("messages")
|
|
for message in p.listen():
|
|
if message:
|
|
if message["channel"] == b"messages":
|
|
data = message["data"]
|
|
try:
|
|
unpacked = msgpack.unpackb(data, raw=False)
|
|
except TypeError:
|
|
continue
|
|
process_rules(unpacked)
|