github.com/crowdsecurity/crowdsec@v1.6.1/pkg/leakybucket/blackhole.go (about)

     1  package leakybucket
     2  
     3  import (
     4  	"fmt"
     5  	"time"
     6  
     7  	"github.com/crowdsecurity/crowdsec/pkg/types"
     8  )
     9  
    10  type HiddenKey struct {
    11  	key        string
    12  	expiration time.Time
    13  }
    14  
    15  type Blackhole struct {
    16  	duration   time.Duration
    17  	hiddenKeys []HiddenKey
    18  	DumbProcessor
    19  }
    20  
    21  func NewBlackhole(bucketFactory *BucketFactory) (*Blackhole, error) {
    22  	duration, err := time.ParseDuration(bucketFactory.Blackhole)
    23  	if err != nil {
    24  		bucketFactory.logger.Warning("Blackhole duration not valid, using 1h")
    25  		return nil, fmt.Errorf("blackhole duration not valid '%s'", bucketFactory.Blackhole)
    26  	}
    27  	return &Blackhole{
    28  		duration:      duration,
    29  		hiddenKeys:    []HiddenKey{},
    30  		DumbProcessor: DumbProcessor{},
    31  	}, nil
    32  }
    33  
    34  func (bl *Blackhole) OnBucketOverflow(bucketFactory *BucketFactory) func(*Leaky, types.RuntimeAlert, *types.Queue) (types.RuntimeAlert, *types.Queue) {
    35  	return func(leaky *Leaky, alert types.RuntimeAlert, queue *types.Queue) (types.RuntimeAlert, *types.Queue) {
    36  		var blackholed = false
    37  		var tmp []HiddenKey
    38  		// search if we are blackholed and refresh the slice
    39  		for _, element := range bl.hiddenKeys {
    40  
    41  			if element.key == leaky.Mapkey {
    42  				if element.expiration.After(leaky.Ovflw_ts) {
    43  					leaky.logger.Debugf("Overflow discarded, still blackholed for %s", element.expiration.Sub(leaky.Ovflw_ts))
    44  					blackholed = true
    45  				}
    46  			}
    47  
    48  			if element.expiration.After(leaky.Ovflw_ts) {
    49  				tmp = append(tmp, element)
    50  			} else {
    51  				leaky.logger.Debugf("%s left blackhole %s ago", element.key, leaky.Ovflw_ts.Sub(element.expiration))
    52  
    53  			}
    54  		}
    55  		bl.hiddenKeys = tmp
    56  
    57  		if blackholed {
    58  			leaky.logger.Tracef("Event is blackholed (%s)", leaky.First_ts)
    59  			return types.RuntimeAlert{
    60  				Mapkey: leaky.Mapkey,
    61  			}, nil
    62  		}
    63  		bl.hiddenKeys = append(bl.hiddenKeys, HiddenKey{leaky.Mapkey, leaky.Ovflw_ts.Add(bl.duration)})
    64  		leaky.logger.Debugf("Adding overflow to blackhole (%s)", leaky.First_ts)
    65  		return alert, queue
    66  	}
    67  
    68  }