beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

update

Browse source
This commit is contained in:
alteredCoder 2021-10-07 18:21:08 +02:00
parent ab141f7f3a
commit 11b1843070
4 changed files with 36 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmd/crowdsec-cli/decisions.go
View file

@ -25,9 +25,10 @@ var Client *apiclient.ApiClient
func DecisionsToTable(alerts *models.GetAlertsResponse) error { func DecisionsToTable(alerts *models.GetAlertsResponse) error {
/*here we cheat a bit : to make it more readable for the user, we dedup some entries*/ /*here we cheat a bit : to make it more readable for the user, we dedup some entries*/
var spamLimit map[string]bool = make(map[string]bool) var spamLimit map[string]bool = make(map[string]bool)
/*process in reverse order to keep the latest item only*/
/*process in reverse order to keep the latest item only*/ /*process in reverse order to keep the latest item only*/
for aIdx := len(*alerts) - 1; aIdx >= 0; aIdx-- { for aIdx := 0; aIdx < len(*alerts); aIdx++ {
alertItem := (*alerts)[aIdx] alertItem := (*alerts)[aIdx]
newDecisions := make([]*models.Decision, 0) newDecisions := make([]*models.Decision, 0)
for _, decisionItem := range alertItem.Decisions { for _, decisionItem := range alertItem.Decisions {
@ -227,7 +228,6 @@ cscli decisions list -t ban
if err != nil { if err != nil {
log.Fatalf("Unable to list decisions : %v", err.Error()) log.Fatalf("Unable to list decisions : %v", err.Error())
} }
err = DecisionsToTable(alerts) err = DecisionsToTable(alerts)
if err != nil { if err != nil {
log.Fatalf("unable to list decisions : %v", err.Error()) log.Fatalf("unable to list decisions : %v", err.Error())

2
pkg/apiserver/apic.go
View file

@ -91,7 +91,7 @@ func AlertToSignal(alert *models.Alert, scenarioTrust string, keepDecisions bool
ScenarioTrust: &scenarioTrust, ScenarioTrust: &scenarioTrust,
} }
if keepDecisions { if keepDecisions {
log.Printf("Keeping decisions to send to CAPI") log.Debugf("Keeping decisions to send to CAPI")
signal.Decisions = alert.Decisions signal.Decisions = alert.Decisions
} }
return signal return signal

9
pkg/apiserver/controllers/v1/alerts.go
View file

@ -150,22 +150,25 @@ func (c *Controller) CreateAlert(gctx *gin.Context) {
} }
} }
alerts, err := c.DBClient.CreateAlert(machineID, input) alertsID, alertsToSend, err := c.DBClient.CreateAlert(machineID, input)
if err != nil { if err != nil {
c.HandleDBErrors(gctx, err) c.HandleDBErrors(gctx, err)
return return
} }
for _, alert := range alertsToSend {
alert.MachineID = machineID
}
if c.CAPIChan != nil { if c.CAPIChan != nil {
select { select {
case c.CAPIChan <- input: case c.CAPIChan <- alertsToSend:
log.Debug("alert sent to CAPI channel") log.Debug("alert sent to CAPI channel")
default: default:
log.Warning("Cannot send alert to Central API channel") log.Warning("Cannot send alert to Central API channel")
} }
} }
gctx.JSON(http.StatusCreated, alerts) gctx.JSON(http.StatusCreated, alertsID)
return return
} }

48
pkg/database/alerts.go
View file

@ -90,28 +90,31 @@ func formatAlertAsString(machineId string, alert *models.Alert) []string {
return retStr return retStr
} }
func (c *Client) CreateAlert(machineID string, alertList []*models.Alert) ([]string, error) { func (c *Client) CreateAlert(machineID string, alertList []*models.Alert) ([]string, []*models.Alert, error) {
pageStart := 0 pageStart := 0
pageEnd := bulkSize pageEnd := bulkSize
ret := []string{} ret := []string{}
alertListRet := make([]*models.Alert, 0)
for { for {
if pageEnd >= len(alertList) { if pageEnd >= len(alertList) {
results, err := c.CreateAlertBulk(machineID, alertList[pageStart:]) results, alerts, err := c.CreateAlertBulk(machineID, alertList[pageStart:])
if err != nil { if err != nil {
return []string{}, fmt.Errorf("unable to create alerts: %s", err) return []string{}, alertListRet, fmt.Errorf("unable to create alerts: %s", err)
} }
ret = append(ret, results...) ret = append(ret, results...)
alertListRet = append(alertListRet, alerts...)
break break
} }
results, err := c.CreateAlertBulk(machineID, alertList[pageStart:pageEnd]) results, alerts, err := c.CreateAlertBulk(machineID, alertList[pageStart:pageEnd])
if err != nil { if err != nil {
return []string{}, fmt.Errorf("unable to create alerts: %s", err) return []string{}, alertListRet, fmt.Errorf("unable to create alerts: %s", err)
} }
ret = append(ret, results...) ret = append(ret, results...)
alertListRet = append(alertListRet, alerts...)
pageStart += bulkSize pageStart += bulkSize
pageEnd += bulkSize pageEnd += bulkSize
} }
return ret, nil return ret, alertListRet, nil
} }
/*We can't bulk both the alert and the decision at the same time. With new consensus, we want to bulk a single alert with a lot of decisions.*/ /*We can't bulk both the alert and the decision at the same time. With new consensus, we want to bulk a single alert with a lot of decisions.*/
@ -278,7 +281,7 @@ func (c *Client) UpdateCommunityBlocklist(alertItem *models.Alert) (int, int, in
return alertRef.ID, inserted, deleted, nil return alertRef.ID, inserted, deleted, nil
} }
func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([]string, error) { func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([]string, []*models.Alert, error) {
ret := []string{} ret := []string{}
bulkSize := 20 bulkSize := 20
@ -293,19 +296,19 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
owner, err := c.QueryMachineByID(machineId) owner, err := c.QueryMachineByID(machineId)
if err != nil { if err != nil {
if errors.Cause(err) != UserNotExists { if errors.Cause(err) != UserNotExists {
return []string{}, errors.Wrapf(QueryFail, "machine '%s': %s", alertItem.MachineID, err) return []string{}, alertList, errors.Wrapf(QueryFail, "machine '%s': %s", alertItem.MachineID, err)
} }
c.Log.Debugf("CreateAlertBulk: Machine Id %s doesn't exist", machineId) c.Log.Debugf("CreateAlertBulk: Machine Id %s doesn't exist", machineId)
owner = nil owner = nil
} }
startAtTime, err := time.Parse(time.RFC3339, *alertItem.StartAt) startAtTime, err := time.Parse(time.RFC3339, *alertItem.StartAt)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(ParseTimeFail, "start_at field time '%s': %s", *alertItem.StartAt, err) return []string{}, alertList, errors.Wrapf(ParseTimeFail, "start_at field time '%s': %s", *alertItem.StartAt, err)
} }
stopAtTime, err := time.Parse(time.RFC3339, *alertItem.StopAt) stopAtTime, err := time.Parse(time.RFC3339, *alertItem.StopAt)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(ParseTimeFail, "stop_at field time '%s': %s", *alertItem.StopAt, err) return []string{}, alertList, errors.Wrapf(ParseTimeFail, "stop_at field time '%s': %s", *alertItem.StopAt, err)
} }
/*display proper alert in logs*/ /*display proper alert in logs*/
for _, disp := range formatAlertAsString(machineId, alertItem) { for _, disp := range formatAlertAsString(machineId, alertItem) {
@ -321,11 +324,11 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
for i, eventItem := range alertItem.Events { for i, eventItem := range alertItem.Events {
ts, err := time.Parse(time.RFC3339, *eventItem.Timestamp) ts, err := time.Parse(time.RFC3339, *eventItem.Timestamp)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(ParseTimeFail, "event timestamp '%s' : %s", *eventItem.Timestamp, err) return []string{}, alertList, errors.Wrapf(ParseTimeFail, "event timestamp '%s' : %s", *eventItem.Timestamp, err)
} }
marshallMetas, err := json.Marshal(eventItem.Meta) marshallMetas, err := json.Marshal(eventItem.Meta)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(MarshalFail, "event meta '%v' : %s", eventItem.Meta, err) return []string{}, alertList, errors.Wrapf(MarshalFail, "event meta '%v' : %s", eventItem.Meta, err)
} }
//the serialized field is too big, let's try to progressively strip it //the serialized field is too big, let's try to progressively strip it
@ -343,7 +346,7 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
marshallMetas, err = json.Marshal(eventItem.Meta) marshallMetas, err = json.Marshal(eventItem.Meta)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(MarshalFail, "event meta '%v' : %s", eventItem.Meta, err) return []string{}, alertList, errors.Wrapf(MarshalFail, "event meta '%v' : %s", eventItem.Meta, err)
} }
if event.SerializedValidator(string(marshallMetas)) == nil { if event.SerializedValidator(string(marshallMetas)) == nil {
valid = true valid = true
@ -372,7 +375,7 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
} }
events, err = c.Ent.Event.CreateBulk(eventBulk...).Save(c.CTX) events, err = c.Ent.Event.CreateBulk(eventBulk...).Save(c.CTX)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(BulkError, "creating alert events: %s", err) return []string{}, alertList, errors.Wrapf(BulkError, "creating alert events: %s", err)
} }
} }
@ -385,7 +388,7 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
} }
metas, err = c.Ent.Meta.CreateBulk(metaBulk...).Save(c.CTX) metas, err = c.Ent.Meta.CreateBulk(metaBulk...).Save(c.CTX)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(BulkError, "creating alert meta: %s", err) return []string{}, alertList, errors.Wrapf(BulkError, "creating alert meta: %s", err)
} }
} }
@ -402,14 +405,14 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
duration, err := time.ParseDuration(*decisionItem.Duration) duration, err := time.ParseDuration(*decisionItem.Duration)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(ParseDurationFail, "decision duration '%v' : %s", decisionItem.Duration, err) return []string{}, alertList, errors.Wrapf(ParseDurationFail, "decision duration '%v' : %s", decisionItem.Duration, err)
} }
/*if the scope is IP or Range, convert the value to integers */ /*if the scope is IP or Range, convert the value to integers */
if strings.ToLower(*decisionItem.Scope) == "ip" || strings.ToLower(*decisionItem.Scope) == "range" { if strings.ToLower(*decisionItem.Scope) == "ip" || strings.ToLower(*decisionItem.Scope) == "range" {
sz, start_ip, start_sfx, end_ip, end_sfx, err = types.Addr2Ints(*decisionItem.Value) sz, start_ip, start_sfx, end_ip, end_sfx, err = types.Addr2Ints(*decisionItem.Value)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(ParseDurationFail, "invalid addr/range %s : %s", *decisionItem.Value, err) return []string{}, alertList, errors.Wrapf(ParseDurationFail, "invalid addr/range %s : %s", *decisionItem.Value, err)
} }
} }
decisionBulk[i] = c.Ent.Decision.Create(). decisionBulk[i] = c.Ent.Decision.Create().
@ -428,9 +431,12 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
} }
decisions, err = c.Ent.Decision.CreateBulk(decisionBulk...).Save(c.CTX) decisions, err = c.Ent.Decision.CreateBulk(decisionBulk...).Save(c.CTX)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(BulkError, "creating alert decisions: %s", err) return []string{}, alertList, errors.Wrapf(BulkError, "creating alert decisions: %s", err)
} }
for i, decisionItem := range alertItem.Decisions {
decisionItem.ID = int64(decisions[i].ID)
}
} }
alertB := c.Ent.Alert. alertB := c.Ent.Alert.
@ -466,7 +472,7 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
if len(bulk) == bulkSize { if len(bulk) == bulkSize {
alerts, err := c.Ent.Alert.CreateBulk(bulk...).Save(c.CTX) alerts, err := c.Ent.Alert.CreateBulk(bulk...).Save(c.CTX)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(BulkError, "bulk creating alert : %s", err) return []string{}, alertList, errors.Wrapf(BulkError, "bulk creating alert : %s", err)
} }
for _, alert := range alerts { for _, alert := range alerts {
ret = append(ret, strconv.Itoa(alert.ID)) ret = append(ret, strconv.Itoa(alert.ID))
@ -482,14 +488,14 @@ func (c *Client) CreateAlertBulk(machineId string, alertList []*models.Alert) ([
alerts, err := c.Ent.Alert.CreateBulk(bulk...).Save(c.CTX) alerts, err := c.Ent.Alert.CreateBulk(bulk...).Save(c.CTX)
if err != nil { if err != nil {
return []string{}, errors.Wrapf(BulkError, "leftovers creating alert : %s", err) return []string{}, alertList, errors.Wrapf(BulkError, "leftovers creating alert : %s", err)
} }
for _, alert := range alerts { for _, alert := range alerts {
ret = append(ret, strconv.Itoa(alert.ID)) ret = append(ret, strconv.Itoa(alert.ID))
} }
return ret, nil return ret, alertList, nil
} }
func BuildAlertRequestFromFilter(alerts *ent.AlertQuery, filter map[string][]string) (*ent.AlertQuery, error) { func BuildAlertRequestFromFilter(alerts *ent.AlertQuery, filter map[string][]string) (*ent.AlertQuery, error) {