beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Multiple fixes (#1006)

Browse source 
* fix #1005 : timestamp in trigger timemachine buckets

* attempt at consistent bucket order for hubtest
This commit is contained in:
Thibault "bui" Koechlin 2021-10-12 14:09:17 +02:00 committed by GitHub
parent 2961a0ed02
commit 1bd6b8f7b9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pkg/cstest/scenario_assert.go
View file

@ -7,6 +7,7 @@ import (
"os"
"regexp"
"sort"
"strings"
"github.com/antonmedv/expr"
"github.com/antonmedv/expr/vm"
@ -220,7 +221,8 @@ func (b BucketResults) Len() int {
}
func (b BucketResults) Less(i, j int) bool {
return b[i].Overflow.Alert.GetScenario() > b[j].Overflow.Alert.GetScenario()
return b[i].Overflow.Alert.GetScenario()+strings.Join(b[i].Overflow.GetSources(), "@") > b[j].Overflow.Alert.GetScenario()+strings.Join(b[i].Overflow.GetSources(), "@")
}
func (b BucketResults) Swap(i, j int) {

20
pkg/leakybucket/trigger.go
View file

@ -4,6 +4,7 @@ import (
"time"
"github.com/crowdsecurity/crowdsec/pkg/types"
log "github.com/sirupsen/logrus"
)
type Trigger struct {
@ -14,9 +15,24 @@ func (t *Trigger) OnBucketPour(b *BucketFactory) func(types.Event, *Leaky) *type
// Pour makes the bucket overflow all the time
// TriggerPour unconditionnaly overflows
return func(msg types.Event, l *Leaky) *types.Event {
if l.Mode == TIMEMACHINE {
var d time.Time
err := d.UnmarshalText([]byte(msg.MarshaledTime))
if err != nil {
log.Warningf("Failed unmarshaling event time (%s) : %v", msg.MarshaledTime, err)
d = time.Now()
}
l.logger.Debugf("yay timemachine overflow time : %s --> %s", d, msg.MarshaledTime)
l.Last_ts = d
l.First_ts = d
l.Ovflw_ts = d
} else {
l.Last_ts = time.Now()
l.First_ts = time.Now()
l.Ovflw_ts = time.Now()
}
l.Total_count = 1
l.First_ts = time.Now()
l.Ovflw_ts = time.Now()
l.logger.Infof("Bucket overflow")
l.Queue.Add(msg)
l.Out <- l.Queue