beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

up

Browse source
This commit is contained in:
bui 2021-04-30 08:49:35 +02:00
parent 30229627cd
commit 52934934b1
6 changed files with 49 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
cmd/crowdsec/main.go
View file

@ -146,21 +146,35 @@ func LoadAcquisition(cConfig *csconfig.Config) error {
tmpCfg.Mode = configuration.CAT_MODE
tmpCfg.Labels = map[string]string{"type": flags.SingleFileType}
/*if flags.SingleFilePath != "" {
tmpCfg.Filename = flags.SingleFilePath
var craftConf []byte
var acquisType string
if flags.SingleFilePath != "" {
acquisType = "file"
craftConf = []byte(fmt.Sprintf(`
filename: %s
labels:
type: %s
type: file
mode: cat`, flags.SingleFilePath, flags.SingleFileType))
} else if flags.SingleJournalctlFilter != "" {
tmpCfg.JournalctlFilters = strings.Split(flags.SingleJournalctlFilter, " ")
}*/
log.Fatalf("fixme tko")
acquisType = "journald"
craftConf = []byte(fmt.Sprintf(`
journalctl_filter: %s
labels:
type: %s
type: journald
mode: cat`, flags.SingleJournalctlFilter, flags.SingleFileType))
}
tmpCfg.Type = acquisType
// datasrc, err := acquisition.DataSourceConfigure([]byte(""), "file")
// if err != nil {
// return fmt.Errorf("while configuring specified file datasource : %s", err)
// }
// if dataSources == nil {
// dataSources = make([]acquisition.DataSource, 0)
// }
// dataSources = append(dataSources, *datasrc)
datasrc, err := acquisition.DataSourceConfigure(craftConf, tmpCfg)
if err != nil {
return fmt.Errorf("while configuring specified file datasource : %s", err)
}
if dataSources == nil {
dataSources = make([]acquisition.DataSource, 0)
}
dataSources = append(dataSources, *datasrc)
} else {
dataSources, err = acquisition.LoadAcquisitionFromFile(cConfig.Crowdsec)
if err != nil {

2
go.mod
View file

@ -69,7 +69,7 @@ require (
gopkg.in/natefinch/lumberjack.v2 v2.0.0
gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637
gopkg.in/yaml.v2 v2.4.0
gotest.tools/v3 v3.0.3 // indirect
gotest.tools/v3 v3.0.3
)
replace golang.org/x/time/rate => github.com/crowdsecurity/crowdsec/pkg/time/rate v0.0.0

6
pkg/acquisition/acquisition.go
View file

@ -67,6 +67,7 @@ type DataSource interface {
Configure([]byte, *log.Entry) error // Configure the datasource
GetMode() string // Get the mode (TAIL, CAT or SERVER)
SupportedModes() []string // Returns the mode supported by the datasource
SupportedURIPrefixes() []string // Returns the list of supported URI schemes (file:// s3:// ...)
OneShotAcquisition(chan types.Event, *tomb.Tomb) error // Start one shot acquisition(eg, cat a file)
LiveAcquisition(chan types.Event, *tomb.Tomb) error // Start live acquisition (eg, tail a file)
CanRun() error // Whether the datasource can run or not (eg, journalctl on BSD is a non-sense)
@ -197,10 +198,7 @@ func LoadAcquisitionFromFile(config *csconfig.CrowdsecServiceCfg) ([]DataSource,
if guessType := detectBackwardCompatAcquis(inBytes); guessType != "" {
sub.Type = guessType
}
// default mode is tail
if sub.Mode == "" {
sub.Mode = configuration.TAIL_MODE
}
if GetDataSourceIface(sub.Type) == nil {
return nil, fmt.Errorf("unknown data source %s in %s", sub.Type, sub.ConfigFile)
}

6
pkg/acquisition/acquisition_test.go
View file

@ -24,6 +24,7 @@ type MockSource struct {
}
func (f *MockSource) Configure(cfg []byte, logger *log.Entry) error {
f.SetDefaults()
f.logger = logger
if err := yaml.UnmarshalStrict(cfg, &f); err != nil {
return errors.Wrap(err, "while unmarshaling to reader specific config")
@ -40,6 +41,7 @@ func (f *MockSource) LiveAcquisition(chan types.Event, *tomb.Tomb) error { re
func (f *MockSource) CanRun() error { return nil }
func (f *MockSource) GetMetrics() []prometheus.Collector { return nil }
func (f *MockSource) Dump() interface{} { return f }
func (f *MockSource) SupportedURIPrefixes() []string { return []string{"mock://"} }
//func (f *MockSource) New() DataSource { return &MockSource{} }
@ -308,6 +310,7 @@ type MockCat struct {
}
func (f *MockCat) Configure(cfg []byte, logger *log.Entry) error {
f.SetDefaults()
f.logger = logger
return nil
}
@ -327,6 +330,7 @@ func (f *MockCat) LiveAcquisition(chan types.Event, *tomb.Tomb) error {
func (f *MockCat) CanRun() error { return nil }
func (f *MockCat) GetMetrics() []prometheus.Collector { return nil }
func (f *MockCat) Dump() interface{} { return f }
func (f *MockCat) SupportedURIPrefixes() []string { return []string{"mock://"} }
//----
@ -336,6 +340,7 @@ type MockTail struct {
}
func (f *MockTail) Configure(cfg []byte, logger *log.Entry) error {
f.SetDefaults()
f.logger = logger
return nil
}
@ -358,6 +363,7 @@ func (f *MockTail) LiveAcquisition(out chan types.Event, t *tomb.Tomb) error {
func (f *MockTail) CanRun() error { return nil }
func (f *MockTail) GetMetrics() []prometheus.Collector { return nil }
func (f *MockTail) Dump() interface{} { return f }
func (f *MockTail) SupportedURIPrefixes() []string { return []string{"mock://"} }
//func StartAcquisition(sources []DataSource, output chan types.Event, AcquisTomb *tomb.Tomb) error {

8
pkg/acquisition/configuration/configuration.go
View file

@ -13,6 +13,14 @@ type DataSourceCommonCfg struct {
//logger *log.Entry `yaml:"-"`
}
func (d *DataSourceCommonCfg) SetDefaults() error {
// default mode is tail
if d.Mode == "" {
d.Mode = TAIL_MODE
}
return nil
}
var TAIL_MODE = "tail"
var CAT_MODE = "cat"
var SERVER_MODE = "server" // No difference with tail, just a bit more verbose

5
pkg/acquisition/modules/file/file.go
View file

@ -39,7 +39,12 @@ type FileSource struct {
files []string
}
func (f *FileSource) SupportedURIPrefixes() []string {
return []string{"file://"}
}
func (f *FileSource) Configure(Config []byte, logger *log.Entry) error {
f.config.SetDefaults()
fileConfig := FileConfiguration{}
f.logger = logger
f.watchedDirectories = make(map[string]bool)