setup

type AcquisitionSpec ¶

type AcquisitionSpec struct {
	Filename   string
	Datasource DatasourceConfig
}

AcquisitionSpec contains the datasource configuration to support a detected service. The configuration is copied as is, after some static validation depending on the datasource type.

func (a *AcquisitionSpec) AddHeader(content []byte) []byte

func (a *AcquisitionSpec) Open(toDir string) (*os.File, error)

func (a *AcquisitionSpec) Path(toDir string) (string, error)

func (a *AcquisitionSpec) ToYAML() ([]byte, error)

func (a *AcquisitionSpec) Validate() error

type DatasourceConfig ¶

type DatasourceConfig map[string]any

func (d DatasourceConfig) Validate() error

type DetectConfig ¶

type DetectConfig struct {
	Detect map[string]ServiceProfile `yaml:"detect"`
}

DetectConfig contains a set of supported service profiles, loaded from detect.yaml.

func NewDetectConfig(detectReader io.Reader) (*DetectConfig, error)

func (d *DetectConfig) ListSupportedServices() []string

type DetectOptions ¶

type DetectOptions struct {
	ForcedUnits     []string // slice of unit names that we want to force-detect.
	ForcedProcesses []string // slice of process names that we want to force-detect.
	ForcedOS        ExprOS   // override OS identification, useful for unsupported platforms or to generate setup.yaml for another machine.
	SkipServices    []string // slice of service specs that will be ignored. detection will happen anyway to spot possible errors.
	SkipSystemd     bool     // ignore all systemd services. the others can still be detected by process name lookup or other mechanism.
}

DetectOptions contains additional options for the detection process.

type Executor ¶

type Executor func(ctx context.Context, name string, args ...string) *exec.Cmd

type ExprEnvironment ¶

type ExprEnvironment struct {
	OS      ExprOS
	Path    ExprPath
	Systemd *ExprSystemd
	System  *ExprSystem
	Windows *ExprWindows

	Ctx context.Context //nolint:containedctx
}

ExprEnvironment is used to expose functions and values to the rule engine. It can cache the results of service detection commands, like systemctl etc.

type ExprOS ¶

type ExprOS struct {
	Family     string
	ID         string
	RawVersion string
}

ExprOS contains the detected (or forced) OS fields available to the rule engine.

func DetectOS(forcedOS ExprOS, logger logrus.FieldLogger) (ExprOS, error)

func (os ExprOS) VersionAtLeast(constraint string) (bool, error)

func (os ExprOS) VersionCheck(constraint string) (bool, error)

func (os ExprOS) VersionIsLower(version string) (bool, error)

type ExprPath ¶

type ExprPath interface {
	Exists(ctx context.Context, path string) bool
	Glob(ctx context.Context, glob string) []string
}

type ExprSystem ¶

type ExprSystem struct {
	// contains filtered or unexported fields
}

func NewExprSystem(runningProcesses ProcessMap, forcedProcesses []string) *ExprSystem

func (e *ExprSystem) ProcessRunning(ctx context.Context, processName string) (bool, error)

type ExprSystemd ¶

type ExprSystemd struct {
	// contains filtered or unexported fields
}

func NewExprSystemd(installedUnits UnitMap, forcedUnits []string) *ExprSystemd

func (e *ExprSystemd) UnitEnabled(ctx context.Context, unitName string) (bool, error)

type ExprWindows ¶

type ExprWindows struct{}

func NewExprWindows() (*ExprWindows, error)

func (e *ExprWindows) ServiceEnabled(serviceName string) (bool, error)

type HubSpec ¶

type HubSpec map[string][]string

HubSpec is a map of hub_type -> slice of item names. Most of the times, the hub_type is "collection". All the items in the slice are installed with their dependencies and data files.

type InstallRecommendation ¶

type InstallRecommendation struct {
	HubSpec         HubSpec         `yaml:"hub_spec,omitempty"`
	AcquisitionSpec AcquisitionSpec `yaml:"acquisition_spec,omitempty"`
}

InstallRecommendation contains the items and acquisition configuration that should be installed to support a service.

type OSExprPath ¶

type OSExprPath struct{}

func (OSExprPath) Exists(_ context.Context, path string) bool

func (OSExprPath) Glob(_ context.Context, pattern string) []string

type ProcessMap ¶

type ProcessMap map[string]struct{}

func DetectProcesses(ctx context.Context, additionalProcesses []string, logger logrus.FieldLogger) (ProcessMap, error)

type ServicePlan ¶

type ServicePlan struct {
	Name                  string `yaml:"detected_service"`
	InstallRecommendation `yaml:",inline"`
}

ServicePlan describes the actions to perform for a detected service.

type ServiceProfile ¶

type ServiceProfile struct {
	// The conditions are evaluated in order, they must all be true for the service to be detected, and there is no short-circuiting.
	When []string `yaml:"when"`

	InstallRecommendation `yaml:",inline"`
	// contains filtered or unexported fields
}

ServiceProfile contains the rules to detect a running service and the suggested configuration to support it from CrowdSec. The same software can have multiple profiles, for example, a service running on a systemd unit and another one running as a simple process. They will be detected by different rules, will need the same hub items but possibly different acquisition configuration (journalctl vs log file).

func (s *ServiceProfile) Compile() error

func (s *ServiceProfile) Evaluate(env *ExprEnvironment, logger logrus.FieldLogger) (bool, error)

type Setup ¶

type Setup struct {
	Plans []ServicePlan `yaml:"setup"`
}

Setup corresponds to the setup.yaml file. It is used as an intermediary step between "detect" and "install hub/acquisition".

func BuildSetup(ctx context.Context, detectConfig *DetectConfig, opts DetectOptions, exprPath ExprPath, installedUnits UnitMap, runningProcesses ProcessMap, logger logrus.FieldLogger) (*Setup, error)

func ParseSetupYAML(input io.Reader, showSource bool, wantColor bool) (*Setup, error)

func (s *Setup) CollectAcquisitionSpecs() []AcquisitionSpec

func (s *Setup) CollectHubSpecs() []HubSpec

func (s *Setup) DetectedServices() []string

func (s *Setup) ToYAML(outYaml bool) ([]byte, error)

type UnitMap ¶

type UnitMap map[string]struct{}

func DetectSystemdUnits(ctx context.Context, executor Executor, additionalUnits []string) (UnitMap, error)