From 856e73ca036e88d4ce77a4b755247680f0236694 Mon Sep 17 00:00:00 2001
From: Pavel Valach <pavel.valach@cesnet.cz>
Date: Wed, 10 Jul 2024 14:08:51 +0000
Subject: [PATCH] cowrie/wardenfiler: Replace lstrip with startswith and
slicing
---
cowrie/wardenfiler.py | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/cowrie/wardenfiler.py b/cowrie/wardenfiler.py
index 642ef81..9adb65d 100644
--- a/cowrie/wardenfiler.py
+++ b/cowrie/wardenfiler.py
@@ -156,9 +156,10 @@ class Output(cowrie.core.output.Output):
if self.test_mode:
event["Category"].append("Test")
- entry["src_ip"] = entry["src_ip"].lstrip("::ffff:")
- if entry.get("dst_ip"):
- entry["dst_ip"] = entry["dst_ip"].lstrip("::ffff:")
+ if entry["src_ip"].startswith("::ffff:"):
+ entry["src_ip"] = entry["src_ip"][7:]
+ if entry.get("dst_ip") and entry["dst_ip"].startswith("::ffff:"):
+ entry["dst_ip"] = entry["dst_ip"][7:]
# detect IPv4 or IPv6
src_af = "IP4" if not ':' in entry["src_ip"] else "IP6"
--
GitLab