I added on more additional patch to be applied after the original patch
i had forgoten to update assessment.impact.description on rule id=1900

you are correct and there is a later rule which uses a regex already to handles ipv6 the problem is the behavior of ssh is to map all ipv4 addresses as ipv6 in this manner when the user connected using ipv4 it also maps this way if ipv6 is used even if the user who connects uses standard hex notation to connect. this can confus an operator who is not familiar with ipv6.

though this is probably more of an issue to take up with open ssh
maybe we change modify the rule so it reports both ipv4 and ipv6 version of the address in this case.

either way rule 1909 needs to be corrected
it is the existing ipv6 rule for user authentication and the fact that it reports all non root users as root is a major bug

Replying to [comment:3 prmarino1@gmail.com]:

you are correct and there is a later rule which uses a regex already to handles ipv6 the problem is the behavior of ssh is to map all ipv4 addresses as ipv6 in this manner when the user connected using ipv4 it also maps this way if ipv6 is used even if the user who connects uses standard hex notation to connect. this can confus an operator who is not familiar with ipv6.

I agree, although another solution would be to use the Prelude-Manager normalization plugin to fix the problem, since other products could exhibit the same behavior as [[OpenSSH]]. Then maybe we should fix Normalize so that it always remap IPv6 mapped IPv4 address to IPv4.

though this is probably more of an issue to take up with open ssh
maybe we change modify the rule so it reports both ipv4 and ipv6 version of the address in this case.

In the attached patch, all the rule now use (\S+), allowing to merge IPv4 and IPv6 rules together, and let the Normalization plugin set the address.category member.

either way rule 1909 needs to be corrected
it is the existing ipv6 rule for user authentication and the fact that it reports all non root users as root is a major bug

This is also ported in the attached file.

I like the idea of having the prelude-manager nomalize the addresses because you are right I've looked through my logs and found cfengine also does this too. the only reservation I have is ([A-Fa-f\d:\.]+) should be used instead of (\S+) followed by an identical rule using (\S+) but maps to source(0).node.name because I have seen implementations in the past that use hostnames where avalable instead of addresses this way we can catch the ones that match ip addresses first and any thing that does not match an ip address can be cought by the second rule as a hostname

Replying to [comment:5 prmarino1@gmail.com]:

I like the idea of having the prelude-manager nomalize the addresses because you are right I've looked through my logs and found cfengine also does this too. the only reservation I have is ([A-Fa-f\d:\.]+) should be used instead of (\S+) followed by an identical rule using (\S+) but maps to source(0).node.name because I have seen implementations in the past that use hostnames where avalable instead of addresses this way we can catch the ones that match ip addresses first and any thing that does not match an ip address can be cought by the second rule as a hostname

The normalize plugin for Prelude-Manager should be able to handle this, and handle it in a more consistent manner than a bunch of different rules. The more rules you make for the end-sensors, the more complex the ruleset becomes and the more difficult it is to maintain. If, instead, you let Prelude-Manager handle this, you get a more comprehensive solution that takes into account all of the sensors (including sensors that haven't even been written yet), instead of a single sensor at a time.

I don't like the idea of having the Normalizer moving entry from node.address.address to node.name, since it would encourage bad ruleset/alert writing behavior.

Original, IPv4 and IPv6 compliant version:

regex=Accepted (\S+) for root from ([A-Fa-f\d:\.]+) port (\d+); \ 
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \ 

Version that can handle IPv4, IPv6, as well as hostname:

regex=Accepted (\S+) for root from (([A-Fa-f\d:\.]+)|(\S+)) port (\d+); \ 
 source(0).node.address(0).address=$3; \
 source(0).node.name = $4; \ 
 source(0).service.port=$5; \ 

Using multiple regular expression to capture different type of input work, but it make rules difficult to understand. Paradoxically, it make it more clear to the experienced reader what is currently going on by exclusively relying on PCRE.

Another solution would be to create some kind of PCRE macro:

regex=Accepted (\S+) for root from $get_name_or_address($host1, $addr1) port (\d+); \ 
 source(0).node.address(0).address=$addr1; \
 source(0).node.name = $host1; \ 
 source(0).service.port=$2; \ 

Or:

regex=Accepted (\S+) for root from $get_name_or_address(source(0).node.name, source(0).node.address(0).address) port (\d+); \ 
 source(0).service.port=$2; \ 

Comments?

(In r9659) Improve IPv4 / IPv6 address normalization.

IPv4 mapped IPv6 addresses are now mapped back to IPv4.
Additionally, the Normalize plugin now provide two additionals option:

- ipv6-only: Map any incoming IPv4 address to IPv6.
- keep-ipv4-mapped-ipv6: do not map IPv4 mapped IPv6 addresses back to IPv4.

refs #232.