beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

propagate request_id/runner_id in more places for logging

Browse source
This commit is contained in:
Sebastien Blot 2023-12-06 11:21:54 +01:00
parent c9e4aebd00
commit 0c61726971
No known key found for this signature in database
GPG key ID: DFC2902F40449F6A
3 changed files with 17 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
pkg/acquisition/modules/appsec/appsec.go
View file

@ -197,11 +197,12 @@ func (w *AppsecSource) Configure(yamlConfig []byte, logger *log.Entry) error {
appsecRunnerUUID := uuid.New().String()
//we copy AppsecRutime for each runner
wrt := *w.AppsecRuntime
wrt.Logger = w.logger.Dup().WithField("runner_uuid", appsecRunnerUUID)
runner := AppsecRunner{
inChan: w.InChan,
UUID: appsecRunnerUUID,
logger: w.logger.WithFields(log.Fields{
"uuid": appsecRunnerUUID,
"runner_uuid": appsecRunnerUUID,
}),
AppsecRuntime: &wrt,
Labels: w.config.Labels,
@ -310,7 +311,6 @@ func (w *AppsecSource) IsAuth(apiKey string) bool {
// should this be in the runner ?
func (w *AppsecSource) appsecHandler(rw http.ResponseWriter, r *http.Request) {
w.logger.Debugf("Received request from '%s' on %s", r.RemoteAddr, r.URL.Path)
apiKey := r.Header.Get(appsec.APIKeyHeaderName)
@ -343,6 +343,11 @@ func (w *AppsecSource) appsecHandler(rw http.ResponseWriter, r *http.Request) {
}
parsedRequest.AppsecEngine = w.config.Name
logger := w.logger.WithFields(log.Fields{
"request_uuid": parsedRequest.UUID,
"client_ip": parsedRequest.ClientIP,
})
AppsecReqCounter.With(prometheus.Labels{"source": parsedRequest.RemoteAddrNormalized, "appsec_engine": parsedRequest.AppsecEngine}).Inc()
w.InChan <- parsedRequest
@ -352,12 +357,12 @@ func (w *AppsecSource) appsecHandler(rw http.ResponseWriter, r *http.Request) {
AppsecBlockCounter.With(prometheus.Labels{"source": parsedRequest.RemoteAddrNormalized, "appsec_engine": parsedRequest.AppsecEngine}).Inc()
}
appsecResponse := w.AppsecRuntime.GenerateResponse(response)
appsecResponse := w.AppsecRuntime.GenerateResponse(response, logger)
rw.WriteHeader(appsecResponse.HTTPStatus)
body, err := json.Marshal(BodyResponse{Action: appsecResponse.Action})
if err != nil {
log.Errorf("unable to marshal response: %s", err)
logger.Errorf("unable to marshal response: %s", err)
rw.WriteHeader(http.StatusInternalServerError)
} else {
rw.Write(body)

8
pkg/acquisition/modules/appsec/appsec_runner.go
View file

@ -290,7 +290,9 @@ func (r *AppsecRunner) handleOutBandInterrupt(request *appsec.ParsedRequest) {
}
func (r *AppsecRunner) handleRequest(request *appsec.ParsedRequest) {
r.logger.Debugf("Requests handled by runner %s", request.UUID)
r.AppsecRuntime.Logger = r.AppsecRuntime.Logger.WithField("request_uuid", request.UUID)
logger := r.logger.WithField("request_uuid", request.UUID)
logger.Debug("Request received in runner")
r.AppsecRuntime.ClearResponse()
request.IsInBand = true
@ -302,7 +304,7 @@ func (r *AppsecRunner) handleRequest(request *appsec.ParsedRequest) {
//inband appsec rules
err := r.ProcessInBandRules(request)
if err != nil {
r.logger.Errorf("unable to process InBand rules: %s", err)
logger.Errorf("unable to process InBand rules: %s", err)
return
}
@ -325,7 +327,7 @@ func (r *AppsecRunner) handleRequest(request *appsec.ParsedRequest) {
err = r.ProcessOutOfBandRules(request)
if err != nil {
r.logger.Errorf("unable to process OutOfBand rules: %s", err)
logger.Errorf("unable to process OutOfBand rules: %s", err)
return
}

6
pkg/appsec/appsec.go
View file

@ -556,7 +556,7 @@ type BodyResponse struct {
HTTPStatus int `json:"http_status"`
}
func (w *AppsecRuntimeConfig) GenerateResponse(response AppsecTempResponse) BodyResponse {
func (w *AppsecRuntimeConfig) GenerateResponse(response AppsecTempResponse, logger *log.Entry) BodyResponse {
resp := BodyResponse{}
//if there is no interrupt, we should allow with default code
if !response.InBandInterrupt {
@ -568,12 +568,12 @@ func (w *AppsecRuntimeConfig) GenerateResponse(response AppsecTempResponse) Body
if resp.Action == "" {
resp.Action = w.Config.DefaultRemediation
}
w.Logger.Debugf("action is %s", resp.Action)
logger.Debugf("action is %s", resp.Action)
resp.HTTPStatus = response.HTTPResponseCode
if resp.HTTPStatus == 0 {
resp.HTTPStatus = w.Config.BlockedHTTPCode
}
w.Logger.Debugf("http status is %d", resp.HTTPStatus)
logger.Debugf("http status is %d", resp.HTTPStatus)
return resp
}