Cymru parser_cap_program invalid hostname filtering

[ClevenL]

In some Team-Cymru payloads the optional_information entry includes hostname: parameter with an IP address. This is parsed in intelmq.bots.parsers.cymru.parser_cap_program bot into source.fqdn field, which does not allow IP entries.

There should be check to filter out IP hostnames, since we already have that data included in source.ip field.

The fix can be equivalent to PR #2144. Including FQDN.is_valid check seems overkill in this case, but I included it in the example below.

elif key == 'hostname':
    # some hostnames are IP and not valid fqdn
    if not FQDN.is_valid(value) and value == ip:
        continue
    event['source.fqdn'] = value

[gethvi]

Perhaps cleaner way:

event.add("source.fqdn", value, raise_failure=False)

[sebix]

Perhaps cleaner way:

event.add("source.fqdn", value, raise_failure=False)

But that could possibly hide other errors as well (e.g. other kind of data, wrong parsing, etc.)

So I prefer @ClevenL's solution.

[gethvi]

But that could possibly hide other errors as well (e.g. other kind of data, wrong parsing, etc.)

Would it make sense to modify the add function with logging the error instead of just returning False?

intelmq/intelmq/lib/message.py

Lines 259 to 264 in 6e1c1bf

	valid_value = self.__is_valid_value(key, value)
	if not valid_value[0]:
	if raise_failure:
	raise exceptions.InvalidValue(key, value, reason=valid_value[1], object=bytes(json.dumps(self.iterable), 'utf-8'))
	else:
	return False