Develop snort IDS and content inspect service

- Initial commit to show potential structure of a sample service
- This wil be part of a larger sample application currently dubbed
Service Delivery Controller
- Docker container needs to be built and employs open-source Linux packages
- Service is deployable in Istio service mesh using provided yaml
- Control snort daemon and add custom rules with GRPC messaging
- Process snort alerts actively and send to redis and upstream service
mesh components
- Integrates a web server for better HTTP signature detection

- Improved build script for CI with variables
- Render k8s yaml snort manifest dynamically with command
line options
- Improve snort_client sample script for runtime modifications
including passing args on CLI, error checking
- Update nginx proxy interface
- Added logging to snort server and alert process

Change-Id: Ic56f9fcd9ed21f64b84b85ac8ee280d69af7b7c9
Signed-off-by: Eddie Arrage <eddie.arrage@huawei.com>

1 files changed, 57 insertions, 0 deletions

diff --git a/samples/services/snort_ids/docker/grpc/snort_alerts.py b/samples/services/snort_ids/docker/grpc/snort_alerts.py
new file mode 100644
index 0000000..eda2bd6
--- /dev/null
+++ b/samples/services/snort_ids/docker/grpc/snort_alerts.py
@@ -0,0 +1,57 @@
+# Copyright (c) Authors of Clover
+#
+# All rights reserved. This program and the accompanying materials
+# are made available under the terms of the Apache License, Version 2.0
+# which accompanies this distribution, and is available at
+# http://www.apache.org/licenses/LICENSE-2.0
+
+import redis
+import logging
+import grpc
+import nginx_pb2
+import nginx_pb2_grpc
+from idstools import unified2
+
+
+HOST_IP = 'redis'
+PROXY_GRPC = 'http-proxy:50054'
+
+logging.basicConfig(filename='alert.log', level=logging.DEBUG)
+
+connect = False
+while not connect:
+    try:
+        r = redis.StrictRedis(host=HOST_IP, port=6379, db=0)
+        r.delete('snort_events')
+        connect = True
+    except Exception as e:
+        logging.debug(e)
+        connect = False
+
+reader = unified2.SpoolRecordReader("/var/log/snort",
+                                    "", follow=True)
+
+
+def sendGrpcAlert(event_id, redis_key):
+    try:
+        channel = grpc.insecure_channel(PROXY_GRPC)
+        stub = nginx_pb2_grpc.ControllerStub(channel)
+        stub.ProcessAlerts(nginx_pb2.AlertMessage(
+            event_id=event_id, redis_key=redis_key))
+    except Exception as e:
+        logging.debug(e)
+
+
+for record in reader:
+    try:
+        if isinstance(record, unified2.Event):
+            snort_event = "snort_event:" + str(record['event-id'])
+            r.sadd('snort_events', str(record['event-id']))
+            r.hmset(snort_event, record)
+            sendGrpcAlert(str(record['event-id']), 'snort_events')
+        # elif isinstance(record, unified2.Packet):
+            # print("Packet:")
+        # elif isinstance(record, unified2.ExtraData):
+            # print("Extra-Data:")
+    except Exception as e:
+        logging.debug(e)