mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-11 20:36:12 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

cscli: remove global dbClient (#2985)

Browse source 
* cscli: remove global dbClient

* lint (whitespace, errors)
This commit is contained in:
mmetc 2024-05-06 12:33:54 +02:00 • committed by GitHub
parent 659feec496
commit a2dcc0ef9a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 94 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

68
pkg/leakybucket/overflows.go
View file

@ -1,6 +1,7 @@
package leakybucket
import (
"errors"
"fmt"
"net"
"sort"
@ -22,9 +23,7 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
/*if it's already an overflow, we have properly formatted sources.
we can just twitch them to reflect the requested scope*/
if evt.Type == types.OVFLW {
for k, v := range evt.Overflow.Sources {
/*the scopes are already similar, nothing to do*/
if leaky.scopeType.Scope == *v.Scope {
srcs[k] = v
@ -46,20 +45,25 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
src.Scope = new(string)
*src.Scope = leaky.scopeType.Scope
*src.Value = ""
if v.Range != "" {
*src.Value = v.Range
}
if leaky.scopeType.RunTimeFilter != nil {
retValue, err := exprhelpers.Run(leaky.scopeType.RunTimeFilter, map[string]interface{}{"evt": &evt}, leaky.logger, leaky.BucketConfig.Debug)
if err != nil {
return srcs, fmt.Errorf("while running scope filter: %w", err)
}
value, ok := retValue.(string)
if !ok {
value = ""
}
src.Value = &value
}
if *src.Value != "" {
srcs[*src.Value] = src
} else {
@ -71,50 +75,64 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
}
}
}
return srcs, nil
}
src := models.Source{}
switch leaky.scopeType.Scope {
case types.Range, types.Ip:
v, ok := evt.Meta["source_ip"]
if !ok {
return srcs, fmt.Errorf("scope is %s but Meta[source_ip] doesn't exist", leaky.scopeType.Scope)
}
if net.ParseIP(v) == nil {
return srcs, fmt.Errorf("scope is %s but '%s' isn't a valid ip", leaky.scopeType.Scope, v)
}
src.IP = v
src.Scope = &leaky.scopeType.Scope
if v, ok := evt.Enriched["ASNumber"]; ok {
src.AsNumber = v
} else if v, ok := evt.Enriched["ASNNumber"]; ok {
src.AsNumber = v
}
if v, ok := evt.Enriched["IsoCode"]; ok {
src.Cn = v
}
if v, ok := evt.Enriched["ASNOrg"]; ok {
src.AsName = v
}
if v, ok := evt.Enriched["Latitude"]; ok {
l, err := strconv.ParseFloat(v, 32)
if err != nil {
log.Warningf("bad latitude %s : %s", v, err)
}
src.Latitude = float32(l)
}
if v, ok := evt.Enriched["Longitude"]; ok {
l, err := strconv.ParseFloat(v, 32)
if err != nil {
log.Warningf("bad longitude %s : %s", v, err)
}
src.Longitude = float32(l)
}
if v, ok := evt.Meta["SourceRange"]; ok && v != "" {
_, ipNet, err := net.ParseCIDR(v)
if err != nil {
return srcs, fmt.Errorf("Declared range %s of %s can't be parsed", v, src.IP)
return srcs, fmt.Errorf("declared range %s of %s can't be parsed", v, src.IP)
}
if ipNet != nil {
src.Range = ipNet.String()
leaky.logger.Tracef("Valid range from %s : %s", src.IP, src.Range)
@ -124,6 +142,7 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
src.Value = &src.IP
} else if leaky.scopeType.Scope == types.Range {
src.Value = &src.Range
if leaky.scopeType.RunTimeFilter != nil {
retValue, err := exprhelpers.Run(leaky.scopeType.RunTimeFilter, map[string]interface{}{"evt": &evt}, leaky.logger, leaky.BucketConfig.Debug)
if err != nil {
@ -134,14 +153,17 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
if !ok {
value = ""
}
src.Value = &value
}
}
srcs[*src.Value] = src
default:
if leaky.scopeType.RunTimeFilter == nil {
return srcs, fmt.Errorf("empty scope information")
return srcs, errors.New("empty scope information")
}
retValue, err := exprhelpers.Run(leaky.scopeType.RunTimeFilter, map[string]interface{}{"evt": &evt}, leaky.logger, leaky.BucketConfig.Debug)
if err != nil {
return srcs, fmt.Errorf("while running scope filter: %w", err)
@ -151,30 +173,34 @@ func SourceFromEvent(evt types.Event, leaky *Leaky) (map[string]models.Source, e
if !ok {
value = ""
}
src.Value = &value
src.Scope = new(string)
*src.Scope = leaky.scopeType.Scope
srcs[*src.Value] = src
}
return srcs, nil
}
// EventsFromQueue iterates the queue to collect & prepare meta-datas from alert
func EventsFromQueue(queue *types.Queue) []*models.Event {
events := []*models.Event{}
for _, evt := range queue.Queue {
if evt.Meta == nil {
continue
}
meta := models.Meta{}
//we want consistence
// we want consistence
skeys := make([]string, 0, len(evt.Meta))
for k := range evt.Meta {
skeys = append(skeys, k)
}
sort.Strings(skeys)
for _, k := range skeys {
v := evt.Meta[k]
subMeta := models.MetaItems0{Key: k, Value: v}
@ -185,12 +211,13 @@ func EventsFromQueue(queue *types.Queue) []*models.Event {
ovflwEvent := models.Event{
Meta: meta,
}
//either MarshaledTime is present and is extracted from log
// either MarshaledTime is present and is extracted from log
if evt.MarshaledTime != "" {
tmpTimeStamp := evt.MarshaledTime
ovflwEvent.Timestamp = &tmpTimeStamp
} else if !evt.Time.IsZero() { //or .Time has been set during parse as time.Now().UTC()
} else if !evt.Time.IsZero() { // or .Time has been set during parse as time.Now().UTC()
ovflwEvent.Timestamp = new(string)
raw, err := evt.Time.MarshalText()
if err != nil {
log.Warningf("while marshaling time '%s' : %s", evt.Time.String(), err)
@ -203,6 +230,7 @@ func EventsFromQueue(queue *types.Queue) []*models.Event {
events = append(events, &ovflwEvent)
}
return events
}
@ -218,17 +246,21 @@ func alertFormatSource(leaky *Leaky, queue *types.Queue) (map[string]models.Sour
if err != nil {
return nil, "", fmt.Errorf("while extracting scope from bucket %s: %w", leaky.Name, err)
}
for key, src := range srcs {
if source_type == types.Undefined {
source_type = *src.Scope
}
if *src.Scope != source_type {
return nil, "",
fmt.Errorf("event has multiple source types : %s != %s", *src.Scope, source_type)
}
sources[key] = src
}
}
return sources, source_type, nil
}
@ -244,10 +276,12 @@ func NewAlert(leaky *Leaky, queue *types.Queue) (types.RuntimeAlert, error) {
if err != nil {
log.Warningf("failed to marshal start ts %s : %s", leaky.First_ts.String(), err)
}
stop_at, err := leaky.Ovflw_ts.MarshalText()
if err != nil {
log.Warningf("failed to marshal ovflw ts %s : %s", leaky.First_ts.String(), err)
}
capacity := int32(leaky.Capacity)
EventsCount := int32(leaky.Total_count)
leakSpeed := leaky.Leakspeed.String()
@ -266,19 +300,20 @@ func NewAlert(leaky *Leaky, queue *types.Queue) (types.RuntimeAlert, error) {
Simulated: &leaky.Simulated,
}
if leaky.BucketConfig == nil {
return runtimeAlert, fmt.Errorf("leaky.BucketConfig is nil")
return runtimeAlert, errors.New("leaky.BucketConfig is nil")
}
//give information about the bucket
// give information about the bucket
runtimeAlert.Mapkey = leaky.Mapkey
//Get the sources from Leaky/Queue
// Get the sources from Leaky/Queue
sources, source_scope, err := alertFormatSource(leaky, queue)
if err != nil {
return runtimeAlert, fmt.Errorf("unable to collect sources from bucket: %w", err)
}
runtimeAlert.Sources = sources
//Include source info in format string
// Include source info in format string
sourceStr := "UNKNOWN"
if len(sources) > 1 {
sourceStr = fmt.Sprintf("%d sources", len(sources))
@ -290,19 +325,22 @@ func NewAlert(leaky *Leaky, queue *types.Queue) (types.RuntimeAlert, error) {
}
*apiAlert.Message = fmt.Sprintf("%s %s performed '%s' (%d events over %s) at %s", source_scope, sourceStr, leaky.Name, leaky.Total_count, leaky.Ovflw_ts.Sub(leaky.First_ts), leaky.Last_ts)
//Get the events from Leaky/Queue
// Get the events from Leaky/Queue
apiAlert.Events = EventsFromQueue(queue)
var warnings []error
apiAlert.Meta, warnings = alertcontext.EventToContext(leaky.Queue.GetQueue())
for _, w := range warnings {
log.Warningf("while extracting context from bucket %s : %s", leaky.Name, w)
}
//Loop over the Sources and generate appropriate number of ApiAlerts
// Loop over the Sources and generate appropriate number of ApiAlerts
for _, srcValue := range sources {
newApiAlert := apiAlert
srcCopy := srcValue
newApiAlert.Source = &srcCopy
if v, ok := leaky.BucketConfig.Labels["remediation"]; ok && v == true {
newApiAlert.Remediation = true
}
@ -312,6 +350,7 @@ func NewAlert(leaky *Leaky, queue *types.Queue) (types.RuntimeAlert, error) {
log.Errorf("->%s", spew.Sdump(newApiAlert))
log.Fatalf("error : %s", err)
}
runtimeAlert.APIAlerts = append(runtimeAlert.APIAlerts, newApiAlert)
}
@ -322,5 +361,6 @@ func NewAlert(leaky *Leaky, queue *types.Queue) (types.RuntimeAlert, error) {
if leaky.Reprocess {
runtimeAlert.Reprocess = true
}
return runtimeAlert, nil
}