[
https://issues.apache.org/jira/browse/METRON-984?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16080506#comment-16080506
]
ASF GitHub Bot commented on METRON-984:
---------------------------------------
GitHub user ottobackwards opened a pull request:
https://github.com/apache/metron/pull/642
METRON-984 Stellar functions to decode encoded fields or strings
This functionality involves ( as a start ) encodings based on the Apache
Commons Codec library ( binary )
Support exists for the following encodings:
* Base32
* Base32 as hex
* Base 64
* Binary
* Hex
The Stellar functions added:
* LIST_SUPPORTED_ENCODINGS : List the supported encodings
* IS_ENCODING : is this string encoded this way?
* DECODE : decode a string with a given encoding, optionally verify it is
in fact encoded that way
## Contributor Comments
[Please place any comments here. A description of the problem/enhancement,
how to reproduce the issue, your testing methodology, etc.]
### Testing
- Build and tests should run
- run the stellar shell
```bash
cd metron/metron-stellar/stellar-common
mvn -DskipTests package && mvn exec:java
-Dexec.mainClass="org.apache.metron.stellar.common.shell.StellarShell"
```
- execute the functions on some strings
> I think I will add in ENCODE as well, then you can round trip test
### For all changes:
- [x] Is there a JIRA ticket associated with this PR? If not one needs to
be created at [Metron
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
- [x] Does your PR title start with METRON-XXXX where XXXX is the JIRA
number you are trying to resolve? Pay particular attention to the hyphen "-"
character.
- [x] Has your PR been rebased against the latest commit within the target
branch (typically master)?
### For code changes:
- [na] Have you included steps to reproduce the behavior or problem that is
being changed or addressed?
- [x] Have you included steps or a guide to how the change may be verified
and tested manually?
- [x] Have you ensured that the full suite of tests and checks have been
executed in the root metron folder via:
```
mvn -q clean integration-test install && build_utils/verify_licenses.sh
```
- [x] Have you written or updated unit tests and or integration tests to
verify your changes?
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] Have you verified the basic functionality of the build by building
and running locally with Vagrant full-dev environment or the equivalent?
### For documentation related changes:
- [x] Have you ensured that format looks appropriate for the output in
which it is rendered by building and verifying the site-book? If not then run
the following commands and the verify changes via
`site-book/target/site/index.html`:
```
cd site-book
mvn site
```
#### Note:
Please ensure that once the PR is submitted, you check travis-ci for build
issues and submit an update to your PR as soon as possible.
It is also recommended that [travis-ci](https://travis-ci.org) is set up
for your personal repository such that your branches are built there before
submitting a pull request.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/ottobackwards/metron stellar_encoding
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/metron/pull/642.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #642
----
commit 633d314c1518c5907b7c96113595aafbae3b95d2
Author: Otto Fowler <[email protected]>
Date: 2017-07-09T18:17:15Z
Stellar encoding functionality
This functionality involves ( as a start ) encodings based on the Apache
Commons Codec library ( binary )
Support exists for the following encodings:
* Base32
* Base32 as hex
* Base 64
* Binary
* Hex
The Stellar functions added:
* LIST_SUPPORTED_ENCODINGS : List the supported encodings
* IS_ENCODING : is this string encoded this way?
* DECODE : decode a string with a given encoding, optionally verify it is
in fact encoded that way
----
> Create STELLAR Decoding Functions
> ---------------------------------
>
> Key: METRON-984
> URL: https://issues.apache.org/jira/browse/METRON-984
> Project: Metron
> Issue Type: Improvement
> Reporter: Jon Zeolla
> Assignee: Otto Fowler
>
> It is rather commonplace for malicious actors to obfuscate exploits or data
> transfers using encoding. In order to identify and prioritize responses to
> (or automatically mitigate) those attacks during threat triage we should have
> a method for decoding in Stellar. Some initial thoughts would be to handle
> percent/URL encoding, base64, base32, base16/hex, HTML encoding, etc.
> I would expect that something like DECODE(something, encoding_type,
> optional_failure_mode) would return the contents of field "something" after
> attempting to decode it via "encoding_type". If decoding fails,
> optional_failure_mode would indicate whether or not to fail the message and
> send it to the error topology, or to simply return the contents of the
> original field "something" (in this example).
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
