From b789fbe5cec5d5a2ff9854b44597fdbebf55a2cd Mon Sep 17 00:00:00 2001 From: Javier Marcos Date: Sun, 15 Sep 2019 13:18:13 -0700 Subject: [PATCH 1/4] A lot of changes everywhere --- cmd/admin/handlers-get.go | 2 + cmd/admin/json-queries.go | 1 + cmd/admin/main.go | 7 +- cmd/admin/settings.go | 24 + .../templates/components/page-sidebar.html | 12 + cmd/admin/templates/node.html | 38 +- cmd/admin/templates/queries-logs.html | 14 +- cmd/admin/templates/queries.html | 2 +- cmd/admin/templates/table.html | 2 + cmd/admin/utils.go | 22 +- cmd/cli/environment.go | 39 +- cmd/cli/main.go | 22 +- cmd/tls/main.go | 8 +- cmd/tls/plugins.go | 15 +- cmd/tls/scripts/quick-add.sh | 6 +- cmd/tls/utils.go | 2 +- .../osquery/data/{3.3.2.json => 4.0.1.json} | 813 ++++++++++++------ deploy/provision.sh | 5 +- docker/admin/Dockerfile | 2 +- docker/nodes/centos6/Dockerfile | 2 +- docker/nodes/centos7/Dockerfile | 2 +- docker/nodes/debian8/Dockerfile | 2 +- docker/nodes/debian9/Dockerfile | 2 +- docker/nodes/ubuntu16/Dockerfile | 2 +- docker/nodes/ubuntu18/Dockerfile | 2 +- go.mod | 22 +- pkg/queries/go.mod | 2 +- pkg/settings/settings.go | 43 +- pkg/types/go.mod | 2 +- plugins/db_logging/go.mod | 2 +- plugins/graylog_logging/go.mod | 2 +- plugins/logging_dispatcher/go.mod | 4 +- plugins/logging_dispatcher/logging.go | 63 ++ plugins/logging_dispatcher/splunk.go | 8 +- plugins/splunk_logging/go.mod | 4 +- 35 files changed, 860 insertions(+), 340 deletions(-) rename deploy/osquery/data/{3.3.2.json => 4.0.1.json} (95%) diff --git a/cmd/admin/handlers-get.go b/cmd/admin/handlers-get.go index 5383dd1b..09c50c54 100644 --- a/cmd/admin/handlers-get.go +++ b/cmd/admin/handlers-get.go @@ -850,6 +850,8 @@ func nodeHandler(w http.ResponseWriter, r *http.Request) { funcMap := template.FuncMap{ "pastTimeAgo": pastTimeAgo, "jsonRawIndent": jsonRawIndent, + "statusLogsLink": statusLogsLink, + "resultLogsLink": resultLogsLink, } // Prepare template t, err := template.New("node.html").Funcs(funcMap).ParseFiles( diff --git a/cmd/admin/json-queries.go b/cmd/admin/json-queries.go index f83354be..54dcc61c 100644 --- a/cmd/admin/json-queries.go +++ b/cmd/admin/json-queries.go @@ -85,6 +85,7 @@ func jsonQueryHandler(w http.ResponseWriter, r *http.Request) { data := make(QueryData) data["query"] = q.Query data["name"] = q.Name + data["link"] = queryResultLink(q.Name) // Preparing query targets ts, _ := queriesmgr.GetTargets(q.Name) _ts := []QueryTarget{} diff --git a/cmd/admin/main.go b/cmd/admin/main.go index c2f4f874..c4079a7f 100644 --- a/cmd/admin/main.go +++ b/cmd/admin/main.go @@ -31,7 +31,7 @@ const ( // Service name serviceName string = projectName + "-" + settings.ServiceAdmin // Service version - serviceVersion string = "0.1.6" + serviceVersion string = "0.1.7" // Service description serviceDescription string = "Admin service for osctrl" // Application description @@ -51,7 +51,7 @@ const ( // Default SAML configuration file samlConfigurationFile string = "config/saml.json" // osquery version to display tables - osqueryTablesVersion string = "3.3.2" + osqueryTablesVersion string = "4.0.1" // JSON file with osquery tables data osqueryTablesFile string = "data/" + osqueryTablesVersion + ".json" // Static files folder @@ -104,7 +104,8 @@ var validAuth = map[string]bool{ settings.AuthJSON: true, } var validLogging = map[string]bool{ - settings.LoggingDB: true, + settings.LoggingDB: true, + settings.LoggingSplunk: true, } // Function to load the configuration file diff --git a/cmd/admin/settings.go b/cmd/admin/settings.go index 058e00f4..089d81bb 100644 --- a/cmd/admin/settings.go +++ b/cmd/admin/settings.go @@ -33,6 +33,28 @@ func loadingMetrics() { } } +// Function to load the logging settings +func loadingLogging() { + // Check if logging settings for query results link is ready + if !settingsmgr.IsValue(settings.ServiceAdmin, settings.QueryResultLink) { + if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.QueryResultLink, settings.QueryLink); err != nil { + log.Fatalf("Failed to add %s to settings: %v", settings.QueryResultLink, err) + } + } + // Check if logging settings for status logs link is ready + if !settingsmgr.IsValue(settings.ServiceAdmin, settings.StatusLogsLink) { + if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.StatusLogsLink, settings.StatusLink); err != nil { + log.Fatalf("Failed to add %s to settings: %v", settings.DebugHTTP, err) + } + } + // Check if logging settings for result logs link is ready + if !settingsmgr.IsValue(settings.ServiceAdmin, settings.ResultLogsLink) { + if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.ResultLogsLink, settings.ResultsLink); err != nil { + log.Fatalf("Failed to add %s to settings: %v", settings.DebugHTTP, err) + } + } +} + // Function to load all settings for the service func loadingSettings() { // Check if service settings for debug service is ready @@ -71,6 +93,8 @@ func loadingSettings() { } // Metrics loadingMetrics() + // Logging + loadingLogging() // Write JSON config to settings if err := settingsmgr.SetAllJSON(settings.ServiceAdmin, adminConfig.Listener, adminConfig.Port, adminConfig.Host, adminConfig.Auth, adminConfig.Logging); err != nil { log.Fatalf("Failed to add JSON values to configuration: %v", err) diff --git a/cmd/admin/templates/components/page-sidebar.html b/cmd/admin/templates/components/page-sidebar.html index 1b480e9e..4ff27c2d 100644 --- a/cmd/admin/templates/components/page-sidebar.html +++ b/cmd/admin/templates/components/page-sidebar.html @@ -92,6 +92,9 @@ {{if eq $e "opensuse"}} {{end}} + {{if eq $e "arch"}} + + {{end}} {{if eq $e "unknown"}} {{end}} @@ -128,6 +131,9 @@ {{if eq $e "opensuse"}} {{end}} + {{if eq $e "arch"}} + + {{end}} {{if eq $e "unknown"}} {{end}} @@ -161,6 +167,9 @@ {{if eq $e "freebsd"}} {{end}} + {{if eq $e "arch"}} + + {{end}} {{if eq $e "opensuse"}} {{end}} @@ -197,6 +206,9 @@ {{if eq $e "freebsd"}} {{end}} + {{if eq $e "arch"}} + + {{end}} {{if eq $e "opensuse"}} {{end}} diff --git a/cmd/admin/templates/node.html b/cmd/admin/templates/node.html index 26439bf1..15904368 100644 --- a/cmd/admin/templates/node.html +++ b/cmd/admin/templates/node.html @@ -59,14 +59,12 @@
  • Metadata
    • - {{ if eq $template.Logs "db" }}
  • Status Logs
  • Result Logs
    • - {{ end }}
    @@ -122,6 +120,7 @@ {{if eq .Platform "windows"}} windows{{end}} {{if eq .Platform "freebsd"}} freebsd{{end}} {{if eq .Platform "opensuse"}} opensuse{{end}} + {{if eq .Platform "arch"}} arch{{end}} {{if eq .Platform "unknown"}} unknown{{end}} - {{ .PlatformVersion }}

    @@ -315,6 +314,19 @@ + {{ else }} +
    +
    +
    + See status logs for node {{ .UUID }} +
    +
    + + See status logs in {{ $template.Logs }} + +
    +
    +
    {{ end }} {{ if eq $template.Logs "db" }} @@ -348,6 +360,19 @@ + {{ else }} +
    +
    +
    + See result logs for node {{ .UUID }} +
    +
    + + See result logs in {{ $template.Logs }} + +
    +
    +
    {{ end }} @@ -377,7 +402,6 @@ - {{ if eq .Logs "db" }} {{ with .Node }} {{ end }} - {{ end }} diff --git a/cmd/admin/templates/queries-logs.html b/cmd/admin/templates/queries-logs.html index 23c715bd..8bf5f562 100644 --- a/cmd/admin/templates/queries-logs.html +++ b/cmd/admin/templates/queries-logs.html @@ -20,7 +20,11 @@ {{ with .Query }}
    - Results for {{ .Name }} + {{ if .Completed }} + [ COMPLETED ] - Results for {{ .Name }} + {{ else }} + [ ACTIVE ] - Results for {{ .Name }} + {{ end }}