Integrate with firewall rules, perhaps via a plugin architecture? about maltrail HOT 2 OPEN

Using the plugin architecture, I have found a way to do this if a change to core/log.py is made.

1. In log_event(), move the check for plugin functions and the running of the plugin functions from their position after logging the event to the line before the check for "if not skip_write:"

       if config.plugin_functions:
           for _ in config.plugin_functions:
               skip_write = _(event_tuple, packet) or skip_write
       if not skip_write:
   

2. Write a plugin (in ../myplugins folder, which contains an empty

__init__.py

file) that either reads a list of dropped subnets (CIDR format) or dynamically reads iptables DROP rules and determines whether or not the source IP address (src_ip) from the sniffed packet would be dropped by the firewall; if it will, return True to prevent the logging of the maltrail event; if it won't, return False to log the event.

Call that plugin: filter_firewall.py

If there is a list of dropped subnets, it is in a file called /root/dropped_subnets (in CIDR format). If it doesn't find that, it tries to read the iptables entries for LOGGING or DROP targets and uses those subnets instead.

1. Run sensor.py as follows:

python sensor.py -p ../myplugins/filter_firewall.py &

I don't know python very well, and could not seem to make this very efficient -- it reads the file or parses the iptables information every time a packet is attempted to be logged.

from maltrail.

One key item that I missed -- besides not including my filter_firewall.py code -- is that in my implementation, the python-iptables package (so-named on Fedora 24, at least), must be installed for python to process the firewall rules in iptables.

from maltrail.