NAME

ThreatNet::Filter::Network - Filter events within a set of IP ranges

SYNOPSIS

  # Filter for IPs in our broadband customers' range
  my $Broadband = ThreatNet::Filter::Network->new( keep => '123.123.0.0/16' );
  
  # Create a filter for "local" and other things we want to discard
  # (including our own personal broadband IP in the above network)
  my $NotLocal = ThreatNet::Filter::Network->new( discard => qw{
      123.123.123.123
      LOCAL
      111.245.76.248/29
      222.234.52.192/29
      } );
  
  sub boot_zombies {
        my $Msg = shift;
        if ( $Broadband->keep($Msg) and $NotLocal->keep($Msg) ) {
                my $account = $RadiusServer->ip_to_account($Msg->ip);
                $account->disable();
                $account->disconnect();
                $account->add_support_note("You are infected with a virus");
        }
  }

DESCRIPTION

ThreatNet::Filter::Network is a filter class for creating network filters.

That is, for filtering event streams to just those events that did (or did not) occur within a particular network.

The objects only check in two modes.

The keep keyword as first argument indicates events should be kept if they match any of the networks.

The discard keyword as first argument indicates events should be kept only if they do not match any of networks.

For more complex network masks, see the ThreatNet::Filter::Chain class for chaining groups of keep and discard filters together.

Specifying the Networks

The actual matching is done using the Net::IP::Match::XS module. Any values that can be used by it can also be used with it can thus also be used with ThreatNet::Filter::Network.

Keyword Expansion

In addition to the normal IP specification above, ThreatNet::Filter::Network also supports keyword expansion for a number of standard sets of network masks.

When specified by name, they will be expanded into a list of IP ranges.

Thus you can do something like the following.

  my $Remove = ThreatNet::Filter::Network->new(
      discard => 'RFC1918', '123.123.123.0/24'
      );

This will filter out the three standard "local" IP blocks specified by RFC1918, plus the addition range 123.123.123.0 - 123.123.123.255.

All keywords are case-insensitive.

RFC1918

The RFC1918 keyword is expanded to the three network blocks reserved for local intranets. This specifically does NOT include the localhost address space.

RFC3330

The RFC3330 keyword is expanded to a larger set of network blocks restricted for various purposes as identifier in RFC3330. This includes those from RFC1918, the localhost block, and several additional blocks reserved for benchmarking, IP 6to4 identifiers and various other blocks that should not appear in threat messages.

Where correctness is a factor, such as posting to a non-tolerant channel, this filter should be applied before issuing messages, as they are highly likely to be fraudulent or technically nonsensical.

LOCAL

The LOCAL keyword is expanded to represent the most common interpretation of a "local" address, which is the RFC1918 addresses, plus the 127.0.0.0/8 localhost block.

Message Compatibility

Please note that because the module on which this filter is based only supports IPv4 ranges, this filter class is only capable of processing ThreatNet::Message::IPv4 (or subclass) objects.

Any other message types passed to keep will be returns undef, and thus will act as a null filter in most configurations.

METHODS

new ('keep' | 'discard'), $network, ...

The new constructor takes a param of either keep or discard, followed by a list of one or more values which are either an expandable keyword or an ip ranges compatible with Net::IP::Match::XS.

A ThreatNet filter is created which limits a message stream to events either inside or outside of the resulting network.

Returns a new ThreatNet::Filter::Network object, or undef if given invalid params.

type

The type accessor returns the type of the network filter.

Returns either 'keep' or 'discard'.

network

The network accessor returns the list of ip ranges as provided to the constructor.

keep $Message

The keep method takes a ThreatNet::Message::IPv4 message as per the ThreatNet::Filter specification, and checks it against the network specification and keep|discard type.

Returns true if the message should be kept, false if not, or undef on error.

SUPPORT

All bugs should be filed via the bug tracker at

http://rt.cpan.org/NoAuth/ReportBug.html?Queue=ThreatNet-Filter

For other issues, or commercial enhancement and support, contact the author

AUTHORS

Adam Kennedy <adamk@cpan.org>

SEE ALSO

http://ali.as/devel/threatnetwork.html, ThreatNet::Filter, ThreatNet::Message::IPv4.

COPYRIGHT

Copyright (c) 2005 Adam Kennedy. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.

cpanm ThreatNet

perl -MCPAN -e shell
install ThreatNet