-
Notifications
You must be signed in to change notification settings - Fork 44
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
basic PF prometheus metrics (packets, bytes, banned ip count) (#349)
- Loading branch information
Showing
8 changed files
with
190 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| package pf | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "regexp" | ||
| "slices" | ||
| "strconv" | ||
| "strings" | ||
| "time" | ||
|
|
||
| log "github.com/sirupsen/logrus" | ||
|
|
||
| "github.com/crowdsecurity/cs-firewall-bouncer/pkg/metrics" | ||
| ) | ||
|
|
||
| type counter struct { | ||
| packets int | ||
| bytes int | ||
| } | ||
|
|
||
| var ( | ||
| // table names can contain _ or - characters. | ||
| rexpTable = regexp.MustCompile(`^block .* from <(?P<table>[^ ]+)> .*"$`) | ||
| rexpMetrics = regexp.MustCompile(`^\s+\[.*Packets: (?P<packets>\d+)\s+Bytes: (?P<bytes>\d+).*\]$`) | ||
| ) | ||
|
|
||
| func parseMetrics(reader *strings.Reader, tables []string) map[string]counter { | ||
| ret := make(map[string]counter) | ||
|
|
||
| // scan until we find a table name between <> | ||
| scanner := bufio.NewScanner(reader) | ||
| for scanner.Scan() { | ||
| line := scanner.Text() | ||
| // parse the line and extract the table name | ||
| match := rexpTable.FindStringSubmatch(line) | ||
| if len(match) == 0 { | ||
| continue | ||
| } | ||
|
|
||
| table := match[1] | ||
| // if the table is not in the list of tables we want to parse, skip it | ||
| if !slices.Contains(tables, table) { | ||
| continue | ||
| } | ||
|
|
||
| // parse the line with the actual metrics | ||
| if !scanner.Scan() { | ||
| break | ||
| } | ||
|
|
||
| line = scanner.Text() | ||
|
|
||
| match = rexpMetrics.FindStringSubmatch(line) | ||
| if len(match) == 0 { | ||
| log.Errorf("failed to parse metrics: %s", line) | ||
| continue | ||
| } | ||
|
|
||
| packets, err := strconv.Atoi(match[1]) | ||
| if err != nil { | ||
| log.Errorf("failed to parse metrics - dropped packets: %s", err) | ||
|
|
||
| packets = 0 | ||
| } | ||
|
|
||
| bytes, err := strconv.Atoi(match[2]) | ||
| if err != nil { | ||
| log.Errorf("failed to parse metrics - dropped bytes: %s", err) | ||
|
|
||
| bytes = 0 | ||
| } | ||
|
|
||
| ret[table] = counter{ | ||
| packets: packets, | ||
| bytes: bytes, | ||
| } | ||
| } | ||
|
|
||
| return ret | ||
| } | ||
|
|
||
| // countIPs returns the number of IPs in a table. | ||
| func (pf *pf) countIPs(table string) int { | ||
| cmd := execPfctl("", "-T", "show", "-t", table) | ||
|
|
||
| out, err := cmd.Output() | ||
| if err != nil { | ||
| log.Errorf("failed to run 'pfctl -T show -t %s': %s", table, err) | ||
| return 0 | ||
| } | ||
|
|
||
| // one IP per line | ||
| return strings.Count(string(out), "\n") | ||
| } | ||
|
|
||
| // CollectMetrics collects metrics from pfctl. | ||
| // In pf mode the firewall rules are not controlled by the bouncer, so we can only | ||
| // trust they are set up correctly, and retrieve stats from the pfctl tables. | ||
| func (pf *pf) CollectMetrics() { | ||
| droppedPackets := float64(0) | ||
| droppedBytes := float64(0) | ||
|
|
||
| tables := []string{} | ||
|
|
||
| if pf.inet != nil { | ||
| tables = append(tables, pf.inet.table) | ||
| } | ||
|
|
||
| if pf.inet6 != nil { | ||
| tables = append(tables, pf.inet6.table) | ||
| } | ||
|
|
||
| t := time.NewTicker(metrics.MetricCollectionInterval) | ||
|
|
||
| for range t.C { | ||
| cmd := execPfctl("", "-v", "-sr") | ||
|
|
||
| out, err := cmd.Output() | ||
| if err != nil { | ||
| log.Errorf("failed to run 'pfctl -v -sr': %s", err) | ||
| continue | ||
| } | ||
|
|
||
| reader := strings.NewReader(string(out)) | ||
| stats := parseMetrics(reader, tables) | ||
| bannedIPs := 0 | ||
|
|
||
| for _, table := range tables { | ||
| st, ok := stats[table] | ||
| if !ok { | ||
| continue | ||
| } | ||
|
|
||
| droppedPackets += float64(st.packets) | ||
| droppedBytes += float64(st.bytes) | ||
|
|
||
| bannedIPs += pf.countIPs(table) | ||
| } | ||
|
|
||
| metrics.TotalDroppedPackets.Set(droppedPackets) | ||
| metrics.TotalDroppedBytes.Set(droppedBytes) | ||
| metrics.TotalActiveBannedIPs.Set(float64(bannedIPs)) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package pf | ||
|
|
||
| import ( | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestParseMetrics(t *testing.T) { | ||
| metricsInput := `block drop in quick inet from <crowdsec_blacklists> to any label "CrowdSec IPv4" | ||
| [ Evaluations: 1519 Packets: 16 Bytes: 4096 States: 0 ] | ||
| [ Inserted: uid 0 pid 14219 State Creations: 0 ] | ||
| block drop in quick inet6 from <crowdsec6_blacklists> to any label "CrowdSec IPv6" | ||
| [ Evaluations: 914 Packets: 8 Bytes: 2048 States: 0 ] | ||
| [ Inserted: uid 0 pid 14219 State Creations: 0 ]` | ||
|
|
||
| reader := strings.NewReader(metricsInput) | ||
| tables := []string{"crowdsec_blacklists", "crowdsec6_blacklists"} | ||
|
|
||
| metrics := parseMetrics(reader, tables) | ||
|
|
||
| require.Contains(t, metrics, "crowdsec_blacklists") | ||
| require.Contains(t, metrics, "crowdsec6_blacklists") | ||
|
|
||
| ip4Metrics := metrics["crowdsec_blacklists"] | ||
| assert.Equal(t, 16, ip4Metrics.packets) | ||
| assert.Equal(t, 4096, ip4Metrics.bytes) | ||
|
|
||
| ip6Metrics := metrics["crowdsec6_blacklists"] | ||
| assert.Equal(t, 8, ip6Metrics.packets) | ||
| assert.Equal(t, 2048, ip6Metrics.bytes) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters