[jira] [Commented] (METRON-984) Create STELLAR Decoding Functions

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-984?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16080506#comment-16080506 ] 

ASF GitHub Bot commented on METRON-984:
---------------------------------------

GitHub user ottobackwards opened a pull request:

    https://github.com/apache/metron/pull/642

    METRON-984 Stellar functions to decode encoded fields or strings

    This functionality involves ( as a start ) encodings based on the Apache Commons Codec library ( binary )
    
    Support exists for the following encodings:
     * Base32
     * Base32 as hex
     * Base 64
     * Binary
     * Hex
    
    The Stellar functions added:
    * LIST_SUPPORTED_ENCODINGS : List the supported encodings
    * IS_ENCODING : is this string encoded this way?
    * DECODE : decode a string with a given encoding, optionally verify it is in fact encoded that way
    
    ## Contributor Comments
    [Please place any comments here.  A description of the problem/enhancement, how to reproduce the issue, your testing methodology, etc.]
    
    ### Testing
    - Build and tests should run
    - run the stellar shell
    ```bash
    cd metron/metron-stellar/stellar-common
    mvn -DskipTests package && mvn exec:java -Dexec.mainClass="org.apache.metron.stellar.common.shell.StellarShell"
    ```
    - execute the functions on some strings
    
    > I think I will add in ENCODE as well, then you can round trip test
    
    ### For all changes:
    - [x] Is there a JIRA ticket associated with this PR? If not one needs to be created at [Metron Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel). 
    - [x] Does your PR title start with METRON-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
    - [x] Has your PR been rebased against the latest commit within the target branch (typically master)?
    
    
    ### For code changes:
    - [na] Have you included steps to reproduce the behavior or problem that is being changed or addressed?
    - [x] Have you included steps or a guide to how the change may be verified and tested manually?
    - [x] Have you ensured that the full suite of tests and checks have been executed in the root metron folder via:
      ```
      mvn -q clean integration-test install && build_utils/verify_licenses.sh 
      ```
    
    - [x] Have you written or updated unit tests and or integration tests to verify your changes?
    - [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)? 
    - [ ] Have you verified the basic functionality of the build by building and running locally with Vagrant full-dev environment or the equivalent?
    
    ### For documentation related changes:
    - [x] Have you ensured that format looks appropriate for the output in which it is rendered by building and verifying the site-book? If not then run the following commands and the verify changes via `site-book/target/site/index.html`:
    
      ```
      cd site-book
      mvn site
      ```
    
    #### Note:
    Please ensure that once the PR is submitted, you check travis-ci for build issues and submit an update to your PR as soon as possible.
    It is also recommended that [travis-ci](https://travis-ci.org) is set up for your personal repository such that your branches are built there before submitting a pull request.


You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/ottobackwards/metron stellar_encoding

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/metron/pull/642.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #642
    
----
commit 633d314c1518c5907b7c96113595aafbae3b95d2
Author: Otto Fowler <ot...@gmail.com>
Date:   2017-07-09T18:17:15Z

    Stellar encoding functionality
    
    This functionality involves ( as a start ) encodings based on the Apache Commons Codec library ( binary )
    
    Support exists for the following encodings:
     * Base32
     * Base32 as hex
     * Base 64
     * Binary
     * Hex
    
    The Stellar functions added:
    * LIST_SUPPORTED_ENCODINGS : List the supported encodings
    * IS_ENCODING : is this string encoded this way?
    * DECODE : decode a string with a given encoding, optionally verify it is in fact encoded that way

----


> Create STELLAR Decoding Functions
> ---------------------------------
>
>                 Key: METRON-984
>                 URL: https://issues.apache.org/jira/browse/METRON-984
>             Project: Metron
>          Issue Type: Improvement
>            Reporter: Jon Zeolla
>            Assignee: Otto Fowler
>
> It is rather commonplace for malicious actors to obfuscate exploits or data transfers using encoding.  In order to identify and prioritize responses to (or automatically mitigate) those attacks during threat triage we should have a method for decoding in Stellar.  Some initial thoughts would be to handle percent/URL encoding, base64, base32, base16/hex, HTML encoding, etc.
> I would expect that something like DECODE(something, encoding_type, optional_failure_mode) would return the contents of field "something" after attempting to decode it via "encoding_type".  If decoding fails, optional_failure_mode would indicate whether or not to fail the message and send it to the error topology, or to simply return the contents of the original field "something" (in this example).



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)