Commit graph

344 commits

Author SHA1 Message Date
Håvard Moen 42ff269bc8
add back dialect to handle pgx correctly (#1376) 2022-03-23 09:29:22 +01:00
AlteredCoder 411baa4dcf
Improve cscli metrics units (#1374)
* Improve cscli metrics units
2022-03-21 12:13:36 +01:00
Shivam Sandbhor c5566e92f3
Fix 1262 pgsql conflict resolve (#1363)
* Fix api for all dbs (#1310)
* DB agnostic lapi sanitize

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

* Update ent

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

* Fix go dep mess.

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-17 14:12:13 +01:00
Shivam Sandbhor 023ac9e138
Add trusted IPs which have admin API access (#1352)
* Add trusted IPs which have admin API access
2022-03-16 17:28:34 +01:00
Shivam Sandbhor 42a1bc0260
Add query param to filter decisions by scenarios and origin (#1294)
* Add query param to filter decisions by scenarios
2022-03-16 14:37:42 +01:00
Shivam Sandbhor bb30a3f966
Don't omit fields of bouncer in json (#1354)
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-16 09:40:34 +01:00
Thibault "bui" Koechlin a74a41dac5
fix #1357 (#1358) 2022-03-16 09:40:00 +01:00
Shivam Sandbhor 76e97303a5
Deprecate pid_file config (#1346)
* Deprecate pid_file config

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

* Fix unit test

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

* Impl review suggestions.

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-16 09:23:49 +01:00
j-k 2cd3248431
refactor: use runtime rather than ldflags for go details (#1302) 2022-03-14 11:29:34 +01:00
mmetc 4e6b9597f8
fix for https://staticcheck.io/docs/checks#SA2002 (#1334) 2022-03-10 13:53:33 +01:00
mmetc 7c0593c659
noop code removal, typos and lint fixes (#1329) 2022-03-09 16:15:18 +01:00
mmetc 10ce45c054
allow notification plugins to work on freebsd and non-root functional tests (#1253)
* random uuid for all platforms
* check group writable and setgid; don't check group ownership
* allow user to run plugins without changing desired user/group (set them to "")
2022-03-09 12:09:50 +01:00
Thibault "bui" Koechlin 5a15f9b39b
bailout on incompatible duration format (#1326) 2022-03-08 18:18:36 +01:00
mmetc e35efc5b2d
fix check uid, gid values (#1309) 2022-03-07 10:16:34 +01:00
Thibault "bui" Koechlin b66366c28c
Revert "Handle decisions with varying expiry for same IP (#1262)" (#1308)
This reverts commit e4f6cdfc14.
2022-03-04 10:17:31 +01:00
mmetc c5dda0ffba
fix: deny copy folder to itself or subpath (#1299) 2022-03-02 11:30:04 +01:00
Shivam Sandbhor c3dbe0080c
Exit syslog acquis only after server is dead (#1288) 2022-03-01 11:32:28 +01:00
blotus fb74b2fda7
Improve LAPI performance when under high load (#1273) 2022-02-17 17:52:04 +01:00
Shivam Sandbhor e4f6cdfc14
Handle decisions with varying expiry for same IP (#1262)
* Upgrade ent and add sql/modifier in codegen

* update db wrappers to sanitize LAPI

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-16 15:19:14 +01:00
mmetc 9bc7e6ffcf
Refactor unit tests to reduce line count (#1264) 2022-02-15 12:50:33 +01:00
Shivam Sandbhor 43d5690432
Detect missing plugin binary wrt profiles (#1252)
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-14 17:45:03 +01:00
AlteredCoder 8b90f4b2b2
Upgrade download datafiles if doesn't exist (#1254) 2022-02-14 16:51:06 +01:00
AlteredCoder 5a0843852a
add IpToRange helpers and allows to have an expression with scope Range (#1260)
* add IpToRange helpers and allows to have an expression with scope Range
2022-02-14 16:50:52 +01:00
mmetc 40ab8fa738
Atoi() -> ParseInt() (#1256) 2022-02-14 14:00:42 +01:00
Shivam Sandbhor 76e3612088
Check log level before dumping resp (#1243)
* Check log level before dumping resp
* Sleep longer in func tests

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-08 15:40:01 +01:00
mmetc 5c7c12c62d
define cwversion.System (Platform) in "make static" too; show it with --version (#1238) 2022-02-04 13:02:45 +01:00
Thibault "bui" Koechlin dd53d19777
Make whitelist by expr debug level (#1236)
* fix #616 : simply make it at debug level, so that the user can set his node to debug level if he really wants to see this. Otherwise it can be too spammy
2022-02-03 17:04:18 +01:00
mmetc ad28a979e9
local control flow cleanup (#1215)
removed redundant/unreachable returns, else branches, type declarations, unused variables
2022-02-01 22:08:06 +01:00
mmetc 35eea39db7
allow Makefile to override /etc/crowdsec and /var/lib/crowdsec/data (#1221) 2022-02-01 10:34:53 +01:00
mmetc 8310c10ce3
console_config.yaml -> console.yaml (#1195) 2022-01-21 11:52:23 +01:00
mmetc 240e5ad3ab
remove trailing carriage return (#1194) 2022-01-21 11:35:21 +01:00
blotus 19323ba4aa
fix crash on upgrade with nil last push field (#1191) 2022-01-20 18:10:40 +01:00
AlteredCoder b93b8d9a2e
Support PGX (#1186)
* Support PGX

* support sslmode
2022-01-20 11:17:21 +01:00
Shivam Sandbhor 59a537514f
Check for errors before modifying proc attrs (#1181)
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-19 15:34:09 +01:00
Thibault "bui" Koechlin cc1ab8c50d
switch to utc time everywhere (#1167)
* switch to utc time everywhere


Co-authored-by: alteredCoder <kevin@crowdsec.net>
2022-01-19 14:56:05 +01:00
AlteredCoder b1a7ffb92f
fix postgreSQL count fail (#1184) 2022-01-19 14:50:53 +01:00
Thibault "bui" Koechlin c81fc87d4e
fix #1168 (#1179)
* fix #1168
2022-01-19 11:34:40 +01:00
Thibault "bui" Koechlin a88848009a
fix default perms for log file (#1177)
* fix default perms
2022-01-18 16:54:02 +01:00
Thibault "bui" Koechlin a17f150e5d
fix #1170 : display full message in debug mode when syslog cannot parse (#1176)
* fix #1170 : display full message in debug mode when syslog cannot parse
2022-01-18 09:54:01 +01:00
Thibault "bui" Koechlin 40ed810c0b
Gin upgrade (#1174)
* upgrade gin / gin-jwt, and add a new 'trusted_proxies' option to provide trusted CIDRs
2022-01-17 17:18:12 +01:00
Thibault "bui" Koechlin 6e92da76ad
lapi to capi : allow push of tainted/custom/manual decisions (#1154)
* add console command to control signal sharing
* modify metrics endpoint to add lastpush

Co-authored-by: alteredCoder <kevin@crowdsec.net>
2022-01-13 16:46:16 +01:00
blotus cc72800f50
Update LAPI swagger (#1155) 2022-01-11 16:45:34 +01:00
Thibault "bui" Koechlin 3bca25fd6d
lists support from central api (#1074)
* lists support from central api

Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
2022-01-11 14:31:51 +01:00
blotus 4a11060930
Kinesis datasource (#1147) 2022-01-11 14:19:43 +01:00
Thibault "bui" Koechlin 6c676c4869
fix #1131 : complain when validating unknown machine (#1146) 2022-01-05 13:50:04 +01:00
Shivam Sandbhor ba71c55492
Fix cscli inpsect json output (#1145)
* Fix cscli inpsect json output
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-05 10:42:27 +01:00
Thibault "bui" Koechlin 8e3004ebb3
fix race condition on repetitive trigger buckets creation (#1144) 2022-01-04 14:02:07 +01:00
Shivam Sandbhor 6c4ec64ca9
Fix json output of cscli hub list (#1143)
* Fix json output of cscli hub list
* Fix functional tests.

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-04 11:49:23 +01:00
blotus f86ec1c389
Docker api version negotiation (#1135) 2021-12-30 12:21:49 +01:00
blotus 3105897f37
Allow to configure log rotation (#1130) 2021-12-28 11:59:03 +01:00
mmetc 7126f8f0ff
replaced &nbsp; (#1129) 2021-12-28 10:32:46 +01:00
AlteredCoder f86e0c0a5a
don't send decisions with negative duration to bouncers (#1117) 2021-12-21 10:23:30 +01:00
Sykursen 6a3adcff0e
Upgrade metabase to v41.5 (#1109) 2021-12-17 10:29:48 +01:00
Thibault "bui" Koechlin 106254f020
support for cancel_on (#1105)
* cancel_on filter

* tests
2021-12-17 09:56:02 +01:00
AlteredCoder d913ac160e
fix create alert bulk for decisions insertion (#1107)
* fix create alert bulk for decisions insertion
2021-12-16 18:26:19 +01:00
AlteredCoder 88d06260d7
add cscli decisions import (#1038)
* add cscli decisions import

Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: bui <thibault@crowdsec.net>
2021-12-15 11:39:37 +01:00
AlteredCoder 458dcd1979
add more helpers (#1091)
* add more exprhelpers
2021-12-14 11:07:40 +01:00
Thibault "bui" Koechlin e5204bc1b1
fix #1083 : do not update/overwrite 'not installed' collections sub-items on 'cscli XX upgrade' (#1089)
* fix #1083 : do not update/overwrite 'not installed' collections sub-items on 'cscli XX upgrade'
2021-12-13 19:31:16 +01:00
mmetc c7fb6a1428
enabled -> enabling (#1090) 2021-12-13 13:14:29 +01:00
Manuel Sabban 4e6f6fe3a2
log4j vuln fix for metabase (#1082)
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2021-12-13 10:19:20 +01:00
mmetc 7dee103b6e
typos of various nature (#1072) 2021-12-06 17:29:23 +01:00
AlteredCoder 4917aa23c9
Docker datasource (#1064)
* add docker datasource
2021-12-02 15:55:50 +01:00
blotus dd03d07355
optimize the flush function by deleting alerts based on their id (#1054) 2021-11-17 10:15:38 +01:00
he2ss 0652e9ed08
feature cscli|crowdsec add additional labels on crowdsec dsn run (#1053)
* feature cscli|crowdsec add additional labels on crowdsec dsn run
2021-11-17 10:08:46 +01:00
Thibault "bui" Koechlin 3c768490ba
fix #873 without breaking backward (#1052) 2021-11-15 14:16:18 +01:00
Kerma Gérald 37c2a10e21
Use math.MaxInt32 instead of math.MaxUint32 (#980)
To fix 32 bits compilation in v1.2.0
https://github.com/crowdsecurity/crowdsec/issues/979

Signed-off-by: Kerma Gérald <gandalf@gk2.net>
2021-11-15 12:14:04 +01:00
Thibault "bui" Koechlin 7362828a3b
add --failures to explain feature : only display failed lines (#1048)
* add --failures to explain feature : only display failed lines

* no error no problem
2021-11-08 18:01:43 +01:00
Thibault "bui" Koechlin 8b0527bf9d
add evt. (#1045) 2021-11-03 15:17:48 +01:00
AlteredCoder fb54388e93
Fix issue 1033 (#1034)
* Fix issue 1033
2021-11-02 12:16:33 +01:00
Thibault "bui" Koechlin d1ce543440
Improve explain (#1039)
* improve explain feature

* nicer display for details, --verbose in favor of --debug for details
2021-11-02 12:06:01 +01:00
Shivam Sandbhor cbada3d435
Allow using cloudwatch using iam role instead of hardcoded tokens (#1035) 2021-11-02 10:25:35 +01:00
mmetc f10187bd6d
typos (#1036) 2021-11-02 09:19:22 +01:00
Thibault "bui" Koechlin 2b2a11fec7
Extra syslog debug (#1030)
* extra logging
2021-11-01 20:55:03 +01:00
AlteredCoder cf57c89177
add name and alias in cscli console enroll (#950)
* add name and alias in cscli console enroll
2021-10-26 15:33:17 +02:00
blotus 25a2d528b0
Alerts flush: Optimization of the flush mechanism (batch and limit to one job) + add cscli alerts flush command (#1024)
- Don't allow running more than one alert flush job at a time to prevent runaway CPU usage in some case. (fix High CPU after Upgrade to 1.2.0 #1022)
 - Add a cscli alerts flush command to manually flush the alerts in the database (fixes Improvement/Manual flush mechanism #1023 ).
 - Enable cascading deletion on alerts as we upgraded ent: Deleting an alert in the database will automatically delete all related decisions, events and meta
 - Add an index on alerts.id to try to improve flush performance with very big sqlite database.
- Flush alert now operates in batch
2021-10-26 13:33:45 +02:00
Thibault "bui" Koechlin 3f99330b3d
Entgo 0.9 (#1018)
* update entgo & sqlite to latest version

* schema update
2021-10-22 16:15:57 +02:00
Shivam Sandbhor a7b1c02bd5
Fix bugs in cloudwatch acq (#991)
* Fix bugs in cloudwatch acq

- Fix concurrent writes to map streamIndexes
- Fix multiple cases of modifying while iterating on slice.
- Fix order of fetching cloudwatch events.
- Remove `startup` hack.

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

* Fix cloudwatch tests

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-10-22 10:35:05 +02:00
Thibault "bui" Koechlin 3bb2128bf4
fix sort :/ (#1007) 2021-10-12 19:16:24 +02:00
Thibault "bui" Koechlin 1bd6b8f7b9
Multiple fixes (#1006)
* fix #1005 : timestamp in trigger timemachine buckets

* attempt at consistent bucket order for hubtest
2021-10-12 14:09:17 +02:00
Thibault "bui" Koechlin 2961a0ed02
ensure machineID is included early enough into the alert (#1004) 2021-10-11 15:02:16 +02:00
blotus 2bc9f33e12
add ParseUri() expr helper (#994) 2021-10-08 16:50:31 +02:00
AlteredCoder 0ccc69696b
Break on success when alert already has decision (#997) (#999)
* Break on success when alert already has decision (#997)

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-10-05 11:30:34 +02:00
Thibault "bui" Koechlin af4bb350c0
hubtests revamp + cscli explain (#988)
* New hubtest CI for scenarios/parsers from the hub
 * New `cscli explain` command to visualize parsers/scenarios pipeline

Co-authored-by: alteredCoder <kevin@crowdsec.net>
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: he2ss <hamza.essahely@gmail.com>
Co-authored-by: Cristian Nitescu <cristian@crowdsec.net>
2021-10-04 17:14:52 +02:00
Thibault "bui" Koechlin c2fd173d1e
fix node success logic (#993)
* fix node success logic : only fail node on child failure if mother node has no successfull grok
2021-09-28 17:58:07 +02:00
he2ss fb308d5596
fix plugins logging in right level (#990) 2021-09-28 14:44:21 +02:00
he2ss db5ffb0040
Update test env (#987)
* update test_env
2021-09-24 18:06:30 +02:00
blotus f0db3742de
fix usage of regex.Match in cloudwatch module (#986) 2021-09-23 13:52:05 +02:00
Shivam Sandbhor cca76da2d6
Fix crash if plugin config is broken (#964)
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-09-10 14:25:34 +02:00
he2ss e651379964
add jsonExtractUnescape Helper (#962)
* add jsonExtractUnescape Helper
2021-09-10 12:43:11 +02:00
AlteredCoder 5ae69aa293
fix stacktrace when mmdb file are not present (#935)
* fix stacktrace when mmdb file are not present
2021-09-09 16:27:30 +02:00
blotus 7a1b955ad1
use our fork of grokky (#953) 2021-09-09 14:46:16 +02:00
Shivam Sandbhor b8e24a1e0b
Make plugin runner configurable and run only registered plugins (#944)
* Make plugin runner configurable and run only registered plugins
2021-09-08 11:36:42 +02:00
Thibault "bui" Koechlin 0ad6165ed2
fix release drafter + readme + remove dead readme for acquis (#933) 2021-09-03 09:07:24 +02:00
Manuel Sabban d7d591ff84
update to use cdn for hub (#920)
* update to use cdn for hub
* add cdn for version
* fix unit tests accodingly with new cdn

Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2021-09-02 15:17:37 +02:00
Thibault "bui" Koechlin bed90a832e
fix #919 : display error message (#929)
* fix #919

* fix tests
2021-09-02 12:46:32 +02:00
Thibault "bui" Koechlin 589cb72d41
enforce a bit more parsing for resillience (#928) 2021-09-02 12:34:20 +02:00
Shivam Sandbhor b40fd36607
Add plugin interface code in protobufs package (#921)
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-08-31 14:40:17 +02:00
Thibault "bui" Koechlin 68c11dd827
don't try to send/don't notify if plugin chan is nil (#923) 2021-08-31 14:39:32 +02:00
blotus b5d0d56a11
add support for --since in journalctl DSN (#917) 2021-08-31 12:40:22 +02:00
ThinkChaos 448a227079
Minor changes to specific logs (#900)
- Minor changes to specific logs
- Fix LAPI to not push signals to CAPI when disabled #907
2021-08-25 18:30:05 +02:00