bitbucket.org/Aishee/synsec@v0.0.0-20210414005726-236fc01a153d/pkg/leakybucket/blackhole.go (about)

     1  package leakybucket
     2  
     3  import (
     4  	"fmt"
     5  	"time"
     6  
     7  	"bitbucket.org/Aishee/synsec/pkg/types"
     8  )
     9  
    10  type HiddenKey struct {
    11  	key        string
    12  	expiration time.Time
    13  }
    14  
    15  type Blackhole struct {
    16  	duration   time.Duration
    17  	hiddenKeys []HiddenKey
    18  	DumbProcessor
    19  }
    20  
    21  func NewBlackhole(bucketFactory *BucketFactory) (*Blackhole, error) {
    22  
    23  	var duration time.Duration
    24  	if d, err := time.ParseDuration(bucketFactory.Blackhole); err != nil {
    25  		bucketFactory.logger.Warning("Blackhole duration not valid, using 1h")
    26  		return nil, fmt.Errorf("blackhole duration not valid '%s'", bucketFactory.Blackhole)
    27  	} else {
    28  		duration = d
    29  	}
    30  	return &Blackhole{
    31  		duration:      duration,
    32  		hiddenKeys:    []HiddenKey{},
    33  		DumbProcessor: DumbProcessor{},
    34  	}, nil
    35  }
    36  
    37  func (bl *Blackhole) OnBucketOverflow(bucketFactory *BucketFactory) func(*Leaky, types.RuntimeAlert, *Queue) (types.RuntimeAlert, *Queue) {
    38  	return func(leaky *Leaky, alert types.RuntimeAlert, queue *Queue) (types.RuntimeAlert, *Queue) {
    39  		var blackholed bool = false
    40  		var tmp []HiddenKey
    41  		// search if we are blackholed and refresh the slice
    42  		for _, element := range bl.hiddenKeys {
    43  
    44  			if element.key == leaky.Mapkey {
    45  				if element.expiration.After(leaky.Ovflw_ts) {
    46  					leaky.logger.Debugf("Overflow discarded, still blackholed for %s", element.expiration.Sub(leaky.Ovflw_ts))
    47  					blackholed = true
    48  				}
    49  			}
    50  
    51  			if element.expiration.After(leaky.Ovflw_ts) {
    52  				tmp = append(tmp, element)
    53  			} else {
    54  				leaky.logger.Debugf("%s left blackhole %s ago", element.key, leaky.Ovflw_ts.Sub(element.expiration))
    55  
    56  			}
    57  		}
    58  		bl.hiddenKeys = tmp
    59  
    60  		if blackholed {
    61  			leaky.logger.Tracef("Event is blackholed (%s)", leaky.First_ts)
    62  			return types.RuntimeAlert{
    63  				Mapkey: leaky.Mapkey,
    64  			}, nil
    65  		}
    66  		bl.hiddenKeys = append(bl.hiddenKeys, HiddenKey{leaky.Mapkey, leaky.Ovflw_ts.Add(bl.duration)})
    67  		leaky.logger.Debugf("Adding overflow to blackhole (%s)", leaky.First_ts)
    68  		return alert, queue
    69  	}
    70  
    71  }