mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-11 04:15:54 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

local api (#482)

Browse source 
Co-authored-by: AlteredCoder
Co-authored-by: erenJag
This commit is contained in:
Thibault "bui" Koechlin 2020-11-30 10:37:17 +01:00 • committed by GitHub
parent 5f339ab312
commit dbb420f79e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
563 changed files with 64363 additions and 10714 deletions
Download patch file Download diff file Expand all files Collapse all files

76
pkg/parser/unix_parser.go
View file

@ -2,15 +2,14 @@ package parser
import (
"io/ioutil"
"fmt"
"github.com/crowdsecurity/crowdsec/pkg/csconfig"
"github.com/crowdsecurity/crowdsec/pkg/types"
"github.com/logrusorgru/grokky"
"github.com/prometheus/common/log"
log "github.com/sirupsen/logrus"
)
type UnixParser struct {
}
type UnixParserCtx struct {
Grok grokky.Host
Stages []string
@ -18,11 +17,17 @@ type UnixParserCtx struct {
DataFolder string
}
func (u UnixParser) IsParsable(ctx interface{}, l types.Line) (bool, error) {
return true, nil
type Parsers struct {
Ctx *UnixParserCtx
Povfwctx *UnixParserCtx
StageFiles []Stagefile
PovfwStageFiles []Stagefile
Nodes []Node
Povfwnodes []Node
EnricherCtx []EnricherCtx
}
func (u UnixParser) Init(c map[string]interface{}) (*UnixParserCtx, error) {
func Init(c map[string]interface{}) (*UnixParserCtx, error) {
r := UnixParserCtx{}
r.Grok = grokky.NewBase()
files, err := ioutil.ReadDir(c["patterns"].(string))
@ -31,11 +36,64 @@ func (u UnixParser) Init(c map[string]interface{}) (*UnixParserCtx, error) {
}
r.DataFolder = c["data"].(string)
for _, f := range files {
log.Debugf("Loading %s", f.Name())
if err := r.Grok.AddFromFile(c["patterns"].(string) + f.Name()); err != nil {
log.Errorf("failed to load pattern %s : %v", f.Name(), err)
return nil, err
}
}
log.Debugf("Loaded %d pattern files", len(files))
return &r, nil
}
func LoadParsers(cConfig *csconfig.GlobalConfig, parsers *Parsers) (*Parsers, error) {
var err error
log.Infof("Loading grok library %s", cConfig.Crowdsec.ConfigDir+string("/patterns/"))
/* load base regexps for two grok parsers */
parsers.Ctx, err = Init(map[string]interface{}{"patterns": cConfig.Crowdsec.ConfigDir + string("/patterns/"),
"data": cConfig.Crowdsec.DataDir})
if err != nil {
return parsers, fmt.Errorf("failed to load parser patterns : %v", err)
}
parsers.Povfwctx, err = Init(map[string]interface{}{"patterns": cConfig.Crowdsec.ConfigDir + string("/patterns/"),
"data": cConfig.Crowdsec.DataDir})
if err != nil {
return parsers, fmt.Errorf("failed to load postovflw parser patterns : %v", err)
}
/*
Load enrichers
*/
log.Infof("Loading enrich plugins")
parsers.EnricherCtx, err = Loadplugin(cConfig.Crowdsec.DataDir)
if err != nil {
return parsers, fmt.Errorf("Failed to load enrich plugin : %v", err)
}
/*
Load the actual parsers
*/
log.Infof("Loading parsers %d stages", len(parsers.StageFiles))
parsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)
if err != nil {
return parsers, fmt.Errorf("failed to load parser config : %v", err)
}
log.Infof("Loading postoverflow Parsers")
parsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.Povfwctx, parsers.EnricherCtx)
if err != nil {
return parsers, fmt.Errorf("failed to load postoverflow config : %v", err)
}
if cConfig.Prometheus != nil && cConfig.Prometheus.Enabled {
parsers.Ctx.Profiling = true
parsers.Povfwctx.Profiling = true
}
return parsers, nil
}