beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Whitelist reason (#2439)

Browse source 
* Update node.go

Dont update whitelist reason if event is whitelisted

* oops
This commit is contained in:
Laurence Jones 2023-08-23 14:51:37 +01:00 committed by GitHub
parent b4d9223625
commit 86d9384954
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
pkg/parser/node.go
View file

@ -211,9 +211,6 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
} }
} }
if isWhitelisted {
p.Whitelisted = true
}
/* run whitelist expression tests anyway */ /* run whitelist expression tests anyway */
for eidx, e := range n.Whitelist.B_Exprs { for eidx, e := range n.Whitelist.B_Exprs {
output, err := expr.Run(e.Filter, cachedExprEnv) output, err := expr.Run(e.Filter, cachedExprEnv)
@ -237,7 +234,8 @@ func (n *Node) process(p *types.Event, ctx UnixParserCtx, expressionEnv map[stri
log.Errorf("unexpected type %t (%v) while running '%s'", output, output, n.Whitelist.Exprs[eidx]) log.Errorf("unexpected type %t (%v) while running '%s'", output, output, n.Whitelist.Exprs[eidx])
} }
} }
if isWhitelisted { if isWhitelisted && !p.Whitelisted {
p.Whitelisted = true
p.WhitelistReason = n.Whitelist.Reason p.WhitelistReason = n.Whitelist.Reason
/*huglily wipe the ban order if the event is whitelisted and it's an overflow */ /*huglily wipe the ban order if the event is whitelisted and it's an overflow */
if p.Type == types.OVFLW { /*don't do this at home kids */ if p.Type == types.OVFLW { /*don't do this at home kids */