class Fluent::AwsWafIPSetsOutput

Public Class Methods

new() click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 14
def initialize
  super
  require 'aws-sdk'
end

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 19
def configure(conf)
  super
  @white_list = @white_list.split(',')
  log.info("white list => #{@white_list}")
end
format(tag, time, record) click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 44
def format(tag, time, record)
  [tag, time, record].to_msgpack
end
shutdown() click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 40
def shutdown
  super
end
start() click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 25
def start
  super
  options = {}
  options[:region] = @aws_region if @aws_region
  options[:access_key_id] = @aws_access_key_id if @aws_access_key_id
  options[:secret_access_key] = @aws_secret_access_key if @aws_secret_access_key
  @client = if @api_type == 'waf'
    Aws::WAF::Client.new(options)
  elsif @api_type == 'waf_regional'
    Aws::WAFRegional::Client.new(options)
  else
    raise Fluent::ConfigError, "unknown @api_type => [#{@api_type}]"
  end
end
write(chunk) click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 48
def write(chunk)
  counter = Hash.new{ |h,k| h[k] = 0 }
  chunk.msgpack_each do |(tag, time, record)|
    counter[record[ip_address_key]] += 1
  end

  counter.each do |ip_address, count|
    if @dos_threshold < count
      update_ip_set(ip_address)
    end
  end
end

Private Instance Methods

get_change_token() click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 63
def get_change_token
  @client.get_change_token.change_token
end
update_ip_set(ip_address) click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 67
def update_ip_set(ip_address)
  if @white_list.include?(ip_address)
    log.info("white list ip_address => [#{ip_address}]")
    return
  end

  updates = [
    {
      action: 'INSERT',
      ip_set_descriptor: {
        type: @ip_set_type,
        value: "#{ip_address}/32"
      }
    }
  ]

  begin
    resp = @client.update_ip_set({
      change_token: get_change_token,
      ip_set_id: @ip_set_id,
      updates: updates
    })
    log.info("INSERT block ip_address => [#{ip_address}]")
  rescue => e
    log.error("\n#{e.message}\n#{e.backtrace.join("\n")}")
  end
end