[FR] Add IPv6 Support to CidrMatch using ipaddress lib

[eric-forte-elastic]

Summary

Relates https://github.com/elastic/ia-trade-team/issues/196

Alternative to #77 where the ipaddres library is used instead.

Testing

The majority of the testing can be performed via the new ipv6 labeled unit tests in test_python_engine.py and test_cidrmatch in test_functions.py. However, additional testing can be performed by calling the functions directly from a python script.

Example Python Script

from eql.functions import CidrMatch

# create a list of CIDR blocks to match against
cidr_blocks = ["192.168.0.0/24", "2001:db8::/32"]

# create an instance of the CidrMatch class
cidr_matcher = CidrMatch()


# call the run method with an IP address and the list of CIDR blocks
ip_address = "192.168.0.1"
result = cidr_matcher.run(ip_address, *cidr_blocks)

# print the result
print(result)  # True


# create a list of CIDR blocks to match against
cidr_blocks = ["2001:0db8:0000:0000:0000:0000:0000:0000/32", "fe80::/10"]

# create an instance of the CidrMatch class
cidr_matcher = CidrMatch()

# call the run method with an IPv6 address and the list of CIDR blocks
ipv6_address = "2001:0db8:0000:0000:0000:0000:0000:0001"
ipv6_address = "2001:db8::1"
ipv6_address = "fe80::1"
print(ipv6_address)
result = cidr_matcher.run(ipv6_address, *cidr_blocks)
print(result)

ipv6_address = CidrMatch.expand_ipv6_address(ipv6_address)
print(ipv6_address)
result = cidr_matcher.run(ipv6_address, *cidr_blocks)

# print the result
print(result)  # True

🔴 Important 🔴

The testing MUST be performed on both Python 3.7 and Python 2.7 as eql needs to be able to support both. Some editors such VSCode do not support debugging in Python 2.7 so one will have to run the unit tests via another method.

To install eql in a Python2 test environment you can follow the following steps (there are other ways to test too, but this can help get started)

1. Build virtualenv: virtualenv --python=python2.7 test_two_venv
2. Activate virtualenv: source /test_two_venv/bin/activate
3. Install setuptools (as Makefile does as well) pip install setuptools -U
4. [Optional] if you have a py3 pypirc, you may need to move it temporarily e.g. mv /home/forteea1/.pypirc ~/pypirc
5. Install new eql version (check that it says 0.9.19) python setup.py install
6. Run your test script (example above) python test.py

[Mikaayenson]

A few small nits, but LGTM.

[brokensound77]

A few comments otherwise, LGTM 👍