Node modify only on hostname defined

inverse-inc · Dec 25, 2024 · 9c5c337 · 9c5c337
1 parent ab983c4
commit 9c5c337
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 13 deletions.
diff --git a/go/detectparser/fortigate_dhcp.go b/go/detectparser/fortigate_dhcp.go
@@ -48,8 +48,7 @@ func (s *FortiGateDhcpParser) Parse(line string) ([]ApiCall, error) {
 	if err := s.NotRateLimited(mac + ":" + ip); err != nil {
 		return nil, err
 	}
-
-	return []ApiCall{
+	apiCall := []ApiCall{
 		&PfqueueApiCall{
 			Method: "update_ip4log",
 			Params: []interface{}{
@@ -58,15 +57,17 @@ func (s *FortiGateDhcpParser) Parse(line string) ([]ApiCall, error) {
 				"lease_length", lease,
 			},
 		},
-		&PfqueueApiCall{
+	}
+	if hostname != "N/A" {
+		apiCall = append(apiCall, &PfqueueApiCall{
 			Method: "modify_node",
 			Params: []interface{}{
 				"mac", mac,
 				"computername", hostname,
 			},
-		},
-	}, nil
-
+		})
+	}
+	return apiCall, nil
 }
 
 func NewFortiGateDhcpParser(config *PfdetectConfig) (Parser, error) {

diff --git a/go/detectparser/fortigate_dhcp_test.go b/go/detectparser/fortigate_dhcp_test.go
@@ -8,21 +8,27 @@ func TestFortiGateDhcpParse(t *testing.T) {
 	parser, _ := NewFortiGateDhcpParser(nil)
 	var parseTests = []ParseTest{
 		{
-			Line: `date=2024-12-24 time=11:56:25 devname="FGT50E3U16014289" devid="FGT50E3U16014289" logid="0100026001" type="event" subtype="system" level="information" vd="root" eventtime=1735059387564643583 tz="-0500" logdesc="DHCP Ack log" interface="VLAN_41" dhcp_msg="Ack" mac="B0:2A:43:C1:97:DC" ip=192.168.41.249 lease=300 hostname="N/A" msg="DHCP server sends a DHCPACK"`,
+			Line: `date=2024-12-24 time=11:56:25 devname="FGT50E3U16014289" devid="FGT50E3U16014289" logid="0100026001" type="event" subtype="system" level="information" vd="root" eventtime=1735059387564643583 tz="-0500" logdesc="DHCP Ack log" interface="VLAN_41" dhcp_msg="Ack" mac="B0:2A:43:C1:97:DC" ip=192.168.41.249 lease=300 hostname="Laptop" msg="DHCP server sends a DHCPACK"`,
 			Calls: []ApiCall{
 				&PfqueueApiCall{
-					Method: "event_add",
+					Method: "update_ip4log",
 					Params: []interface{}{
-						"srcip", "172.21.5.11",
-						"events", map[string]interface{}{
-							"detect": "0316013057",
-						},
+						"mac", "B0:2A:43:C1:97:DC",
+						"ip", "192.168.41.249",
+						"lease_length", "300",
+					},
+				},
+				&PfqueueApiCall{
+					Method: "modify_node",
+					Params: []interface{}{
+						"mac", "B0:2A:43:C1:97:DC",
+						"computername", "Laptop",
 					},
 				},
 			},
 		},
 		{
-			Line:  `date=2024-12-24 time=11:56:25 devname="FGT50E3U16014289" devid="FGT50E3U16014289" logid="0100026001" type="event" subtype="system" level="information" vd="root" eventtime=1735059387564643583 tz="-0500" logdesc="DHCP Ack log" interface="VLAN_41" dhcp_msg="Ack" mac="B0:2A:43:C1:97:DC" ip=192.168.41.249 lease=300 hostname="N/A" msg="DHCP server sends a DHCPACK"`,
+			Line:  `date=2024-12-24 time=11:56:25 devname="FGT50E3U16014289" devid="FGT50E3U16014289" logid="0100026001" type="event" subtype="system" level="information" vd="root" eventtime=1735059387564643583 tz="-0500" logdesc="DHCP Ack log" interface="VLAN_41" dhcp_msg="Ack" mac="B0:2A:43:C1:97:DC" ip=192.168.41.249 lease=300 hostname="Laptop" msg="DHCP server sends a DHCPACK"`,
 			Calls: nil,
 		},
 	}