cscli explain: add crowdsec path option (#1983)

cmd/crowdsec-cli/explain.go

@@ -15,30 +15,46 @@ import (
 	"github.com/crowdsecurity/crowdsec/pkg/types"
 )
 
-func NewExplainCmd() *cobra.Command {
+func runExplain(cmd *cobra.Command, args []string) error {
-	/* ---- HUB COMMAND */
+	flags := cmd.Flags()
-	var logFile string
+
-	var dsn string
+	logFile, err := flags.GetString("file")
-	var logLine string
+	if err != nil {
-	var logType string
+		return err
-	var opts hubtest.DumpOpts
+	}
-	var err error
+
+	dsn, err := flags.GetString("dsn")
+	if err != nil {
+		return err
+	}
+
+	logLine, err := flags.GetString("log")
+	if err != nil {
+		return err
+	}
+
+	logType, err := flags.GetString("type")
+	if err != nil {
+		return err
+	}
+
+	opts := hubtest.DumpOpts{}
+
+	opts.Details, err = flags.GetBool("verbose")
+	if err != nil {
+		return err
+	}
+
+	opts.SkipOk, err = flags.GetBool("failures")
+	if err != nil {
+		return err
+	}
+
+	crowdsec, err := flags.GetString("crowdsec")
+	if err != nil {
+		return err
+	}
 
-	var cmdExplain = &cobra.Command{
-		Use:   "explain",
-		Short: "Explain log pipeline",
-		Long: `
-Explain log pipeline 
-		`,
-		Example: `
-cscli explain --file ./myfile.log --type nginx 
-cscli explain --log "Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4" --type syslog
-cscli explain --dsn "file://myfile.log" --type nginx
-tail -n 5 myfile.log | cscli explain --type nginx -f -
-		`,
-		Args:              cobra.ExactArgs(0),
-		DisableAutoGenTag: true,
-		Run: func(cmd *cobra.Command, args []string) {
 	fileInfo, _ := os.Stdin.Stat()
 
 	if logType == "" || (logLine == "" && logFile == "" && dsn == "") {
@@ -87,7 +103,7 @@ tail -n 5 myfile.log | cscli explain --type nginx -f -
 			}
 		}
 		f.Close()
-				//this is the file that was going to be read by crowdsec anyway
+		// this is the file that was going to be read by crowdsec anyway
 		logFile = tmpFile
 	}
 
@@ -108,7 +124,7 @@ tail -n 5 myfile.log | cscli explain --type nginx -f -
 	}
 
 	cmdArgs := []string{"-c", ConfigFilePath, "-type", logType, "-dsn", dsn, "-dump-data", "./", "-no-api"}
-			crowdsecCmd := exec.Command("crowdsec", cmdArgs...)
+	crowdsecCmd := exec.Command(crowdsec, cmdArgs...)
 	crowdsecCmd.Dir = dir
 	output, err := crowdsecCmd.CombinedOutput()
 	if err != nil {
@@ -136,14 +152,37 @@ tail -n 5 myfile.log | cscli explain --type nginx -f -
 	}
 
 	hubtest.DumpTree(*parserDump, *bucketStateDump, opts)
-		},
+
+	return nil
+}
+
+func NewExplainCmd() *cobra.Command {
+	cmdExplain := &cobra.Command{
+		Use:   "explain",
+		Short: "Explain log pipeline",
+		Long: `
+Explain log pipeline 
+		`,
+		Example: `
+cscli explain --file ./myfile.log --type nginx 
+cscli explain --log "Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4" --type syslog
+cscli explain --dsn "file://myfile.log" --type nginx
+tail -n 5 myfile.log | cscli explain --type nginx -f -
+		`,
+		Args:              cobra.ExactArgs(0),
+		DisableAutoGenTag: true,
+		RunE:              runExplain,
 	}
-	cmdExplain.PersistentFlags().StringVarP(&logFile, "file", "f", "", "Log file to test")
+
-	cmdExplain.PersistentFlags().StringVarP(&dsn, "dsn", "d", "", "DSN to test")
+	flags := cmdExplain.Flags()
-	cmdExplain.PersistentFlags().StringVarP(&logLine, "log", "l", "", "Log line to test")
+
-	cmdExplain.PersistentFlags().StringVarP(&logType, "type", "t", "", "Type of the acquisition to test")
+	flags.StringP("file", "f", "", "Log file to test")
-	cmdExplain.PersistentFlags().BoolVarP(&opts.Details, "verbose", "v", false, "Display individual changes")
+	flags.StringP("dsn", "d", "", "DSN to test")
-	cmdExplain.PersistentFlags().BoolVar(&opts.SkipOk, "failures", false, "Only show failed lines")
+	flags.StringP("log", "l", "", "Log line to test")
+	flags.StringP("type", "t", "", "Type of the acquisition to test")
+	flags.BoolP("verbose", "v", false, "Display individual changes")
+	flags.Bool("failures", false, "Only show failed lines")
+	flags.String("crowdsec", "crowdsec", "Path to crowdsec")
 
 	return cmdExplain
 }

tests/bats/01_base.bats

@@ -274,3 +274,8 @@ declare stderr
     run -0 cscli support dump -f "$BATS_TEST_TMPDIR"/dump.zip
     assert_file_exist "$BATS_TEST_TMPDIR"/dump.zip
 }
+
+@test "cscli explain" {
+    rune -0 cscli explain --log "Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4" --type syslog --crowdsec "$CROWDSEC"
+    assert_output - <"$BATS_TEST_DIRNAME"/testdata/explain/explain-log.txt
+}

tests/bats/testdata/explain/explain-log.txt

@@ -0,0 +1,14 @@
+line: Sep 19 18:33:22 scw-d95986 sshd[24347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4
+	├ s00-raw
+	|	└ 🟢 crowdsecurity/syslog-logs (first_parser)
+	├ s01-parse
+	|	└ 🟢 crowdsecurity/sshd-logs (+8 ~1)
+	├ s02-enrich
+	|	├ 🟢 crowdsecurity/dateparse-enrich (+2 ~1)
+	|	└ 🟢 crowdsecurity/geoip-enrich (+10)
+	├-------- parser success 🟢
+	├ Scenarios
+		├ 🟢 crowdsecurity/ssh-bf
+		├ 🟢 crowdsecurity/ssh-bf_user-enum
+		├ 🟢 crowdsecurity/ssh-slow-bf
+		└ 🟢 crowdsecurity/ssh-slow-bf_user-enum