CiscoSecurity/fp-05-firepower-cef-connector-arcsight

Python3 CEF Adapater struct.unpack requires bytes-like object

Amorik opened this issue · 0 comments

Use of the python3 branch and the CEF codec results in the following error:

Traceback (most recent call last):
  File "/opt/eNcore/estreamer/baseproc.py", line 208, in receiveInput
    self.onReceive( item )
  File "/opt/eNcore/estreamer/baseproc.py", line 313, in onReceive
    self.onEvent( item )
  File "/opt/eNcore/estreamer/pipeline.py", line 397, in onEvent
    data = transform( item, self.settings )
  File "/opt/eNcore/estreamer/pipeline.py", line 205, in transform
    output = adapters[ index ].dumps( event['record'] )
  File "/opt/eNcore/estreamer/adapters/cef.py", line 820, in dumps
    return cefAdapter.dumps()
  File "/opt/eNcore/estreamer/adapters/cef.py", line 810, in dumps
    self.__convert()
  File "/opt/eNcore/estreamer/adapters/cef.py", line 735, in __convert
    self.output[target] = function( self.record )
  File "/opt/eNcore/estreamer/adapters/cef.py", line 147, in <lambda>
    'cs1': lambda rec: __packetData( rec['packetData'] )
  File "/opt/eNcore/estreamer/adapters/cef.py", line 115, in __packetData
    payload = packet.getPayloadAsAscii()
  File "/opt/eNcore/estreamer/common/packet.py", line 95, in getPayloadAsAscii
    asciiPayload = self.getPayloadAsBytes().decode( 'ascii', 'ignore' )
  File "/opt/eNcore/estreamer/common/packet.py", line 85, in getPayloadAsBytes
    self.__getLayer3HeaderLength() +
  File "/opt/eNcore/estreamer/common/packet.py", line 55, in __getLayer3HeaderLength
    self.__getNyble( ipOffsetNyble ) *
  File "/opt/eNcore/estreamer/common/packet.py", line 41, in __getNyble
    byte = struct.unpack( '>B', self.data[byteIndex] )[0]
TypeError: a bytes-like object is required, not 'int'

Python2 handled the conversion to bytes when using struct.unpack, Python3 does not.

byte = struct.unpack( '>B', self.data[byteIndex] )[0]

Can be resolved by updating line to include bytes conversion:

byte = struct.unpack( '>B', bytes(self.data[byteIndex]) )[0]