Adding upstream version 1.34.4.
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
parent
e393c3af3f
commit
4978089aab
GPG key ID:
FBB4F0E80A80222F
4963 changed files with 677545 additions and 0 deletions
53
plugins/processors/port_name/README.md
Normal file
53
plugins/processors/port_name/README.md
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# Port Name Lookup Processor Plugin
|
||||
|
||||
Use the `port_name` processor to convert a tag or field containing a well-known
|
||||
port number to the registered service name.
|
||||
|
||||
Tag or field can contain a number ("80") or number and protocol separated by
|
||||
slash ("443/tcp"). If protocol is not provided it defaults to tcp but can be
|
||||
changed with the default_protocol setting. An additional tag or field can be
|
||||
specified for the protocol.
|
||||
|
||||
If the source was found in tag, the service name will be added as a tag. If the
|
||||
source was found in a field, the service name will also be a field.
|
||||
|
||||
Telegraf minimum version: Telegraf 1.15.0
|
||||
|
||||
## Global configuration options <!-- @/docs/includes/plugin_config.md -->
|
||||
|
||||
In addition to the plugin-specific configuration settings, plugins support
|
||||
additional global and plugin configuration settings. These settings are used to
|
||||
modify metrics, tags, and field or create aliases and configure ordering, etc.
|
||||
See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
|
||||
|
||||
[CONFIGURATION.md]: ../../../docs/CONFIGURATION.md#plugins
|
||||
|
||||
## Configuration
|
||||
|
||||
```toml @sample.conf
|
||||
# Given a tag/field of a TCP or UDP port number, add a tag/field of the service name looked up in the system services file
|
||||
[[processors.port_name]]
|
||||
## Name of tag holding the port number
|
||||
# tag = "port"
|
||||
## Or name of the field holding the port number
|
||||
# field = "port"
|
||||
|
||||
## Name of output tag or field (depending on the source) where service name will be added
|
||||
# dest = "service"
|
||||
|
||||
## Default tcp or udp
|
||||
# default_protocol = "tcp"
|
||||
|
||||
## Tag containing the protocol (tcp or udp, case-insensitive)
|
||||
# protocol_tag = "proto"
|
||||
|
||||
## Field containing the protocol (tcp or udp, case-insensitive)
|
||||
# protocol_field = "proto"
|
||||
```
|
||||
|
||||
## Example
|
||||
|
||||
```diff
|
||||
- measurement,port=80 field=123 1560540094000000000
|
||||
+ measurement,port=80,service=http field=123 1560540094000000000
|
||||
```
|
||||
214
plugins/processors/port_name/port_name.go
Normal file
214
plugins/processors/port_name/port_name.go
Normal file
|
|
@ -0,0 +1,214 @@
|
|||
//go:generate ../../../tools/readme_config_includer/generator
|
||||
package port_name
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
_ "embed"
|
||||
"io"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/influxdata/telegraf"
|
||||
"github.com/influxdata/telegraf/plugins/processors"
|
||||
)
|
||||
|
||||
//go:embed sample.conf
|
||||
var sampleConfig string
|
||||
|
||||
type sMap map[string]map[int]string // "https" == services["tcp"][443]
|
||||
|
||||
var services sMap
|
||||
|
||||
type PortName struct {
|
||||
SourceTag string `toml:"tag"`
|
||||
SourceField string `toml:"field"`
|
||||
Dest string `toml:"dest"`
|
||||
DefaultProtocol string `toml:"default_protocol"`
|
||||
ProtocolTag string `toml:"protocol_tag"`
|
||||
ProtocolField string `toml:"protocol_field"`
|
||||
|
||||
Log telegraf.Logger `toml:"-"`
|
||||
}
|
||||
|
||||
func readServicesFile() {
|
||||
file, err := os.Open(servicesPath())
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
services = readServices(file)
|
||||
}
|
||||
|
||||
// Read the services file into a map.
|
||||
//
|
||||
// This function takes a similar approach to parsing as the go
|
||||
// standard library (see src/net/port_unix.go in golang source) but
|
||||
// maps protocol and port number to service name, not protocol and
|
||||
// service to port number.
|
||||
func readServices(r io.Reader) sMap {
|
||||
services = make(sMap)
|
||||
scanner := bufio.NewScanner(r)
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
// "http 80/tcp www www-http # World Wide Web HTTP"
|
||||
if i := strings.Index(line, "#"); i >= 0 {
|
||||
line = line[:i]
|
||||
}
|
||||
f := strings.Fields(line)
|
||||
if len(f) < 2 {
|
||||
continue
|
||||
}
|
||||
service := f[0] // "http"
|
||||
portProto := f[1] // "80/tcp"
|
||||
portProtoSlice := strings.SplitN(portProto, "/", 2)
|
||||
if len(portProtoSlice) < 2 {
|
||||
continue
|
||||
}
|
||||
port, err := strconv.Atoi(portProtoSlice[0]) // "80"
|
||||
if err != nil || port <= 0 {
|
||||
continue
|
||||
}
|
||||
proto := portProtoSlice[1] // "tcp"
|
||||
proto = strings.ToLower(proto)
|
||||
|
||||
protoMap, ok := services[proto]
|
||||
if !ok {
|
||||
protoMap = make(map[int]string)
|
||||
services[proto] = protoMap
|
||||
}
|
||||
protoMap[port] = service
|
||||
}
|
||||
return services
|
||||
}
|
||||
|
||||
func (*PortName) SampleConfig() string {
|
||||
return sampleConfig
|
||||
}
|
||||
|
||||
func (pn *PortName) Apply(metrics ...telegraf.Metric) []telegraf.Metric {
|
||||
for _, m := range metrics {
|
||||
var portProto string
|
||||
var fromField bool
|
||||
|
||||
if len(pn.SourceTag) > 0 {
|
||||
if tag, ok := m.GetTag(pn.SourceTag); ok {
|
||||
portProto = tag
|
||||
}
|
||||
}
|
||||
if len(pn.SourceField) > 0 {
|
||||
if field, ok := m.GetField(pn.SourceField); ok {
|
||||
switch v := field.(type) {
|
||||
default:
|
||||
pn.Log.Errorf("Unexpected type %t in source field; must be string or int", v)
|
||||
continue
|
||||
case int64:
|
||||
portProto = strconv.FormatInt(v, 10)
|
||||
case uint64:
|
||||
portProto = strconv.FormatUint(v, 10)
|
||||
case string:
|
||||
portProto = v
|
||||
}
|
||||
fromField = true
|
||||
}
|
||||
}
|
||||
|
||||
if len(portProto) == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
portProtoSlice := strings.SplitN(portProto, "/", 2)
|
||||
l := len(portProtoSlice)
|
||||
|
||||
if l == 0 {
|
||||
// Empty tag
|
||||
pn.Log.Errorf("empty port tag: %v", pn.SourceTag)
|
||||
continue
|
||||
}
|
||||
|
||||
var port int
|
||||
if l > 0 {
|
||||
var err error
|
||||
val := portProtoSlice[0]
|
||||
port, err = strconv.Atoi(val)
|
||||
if err != nil {
|
||||
// Can't convert port to string
|
||||
pn.Log.Errorf("error converting port to integer: %v", val)
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
proto := pn.DefaultProtocol
|
||||
if l > 1 && len(portProtoSlice[1]) > 0 {
|
||||
proto = portProtoSlice[1]
|
||||
}
|
||||
if len(pn.ProtocolTag) > 0 {
|
||||
if tag, ok := m.GetTag(pn.ProtocolTag); ok {
|
||||
proto = tag
|
||||
}
|
||||
}
|
||||
if len(pn.ProtocolField) > 0 {
|
||||
if field, ok := m.GetField(pn.ProtocolField); ok {
|
||||
switch v := field.(type) {
|
||||
default:
|
||||
pn.Log.Errorf("Unexpected type %t in protocol field; must be string", v)
|
||||
continue
|
||||
case string:
|
||||
proto = v
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
proto = strings.ToLower(proto)
|
||||
|
||||
protoMap, ok := services[proto]
|
||||
if !ok {
|
||||
// Unknown protocol
|
||||
//
|
||||
// Protocol is normally tcp or udp. The services file
|
||||
// normally has entries for both, so our map does too. If
|
||||
// not, it's very likely the source tag or the services
|
||||
// file doesn't make sense.
|
||||
pn.Log.Errorf("protocol not found in services map: %v", proto)
|
||||
continue
|
||||
}
|
||||
|
||||
service, ok := protoMap[port]
|
||||
if !ok {
|
||||
// Unknown port
|
||||
//
|
||||
// Not all ports are named so this isn't an error, but
|
||||
// it's helpful to know when debugging.
|
||||
pn.Log.Debugf("port not found in services map: %v", port)
|
||||
continue
|
||||
}
|
||||
|
||||
if fromField {
|
||||
m.AddField(pn.Dest, service)
|
||||
} else {
|
||||
m.AddTag(pn.Dest, service)
|
||||
}
|
||||
}
|
||||
|
||||
return metrics
|
||||
}
|
||||
|
||||
func (*PortName) Init() error {
|
||||
services = make(sMap)
|
||||
readServicesFile()
|
||||
return nil
|
||||
}
|
||||
|
||||
func init() {
|
||||
processors.Add("port_name", func() telegraf.Processor {
|
||||
return &PortName{
|
||||
SourceTag: "port",
|
||||
SourceField: "port",
|
||||
Dest: "service",
|
||||
DefaultProtocol: "tcp",
|
||||
ProtocolTag: "proto",
|
||||
ProtocolField: "proto",
|
||||
}
|
||||
})
|
||||
}
|
||||
457
plugins/processors/port_name/port_name_test.go
Normal file
457
plugins/processors/port_name/port_name_test.go
Normal file
|
|
@ -0,0 +1,457 @@
|
|||
package port_name
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/influxdata/telegraf"
|
||||
"github.com/influxdata/telegraf/metric"
|
||||
"github.com/influxdata/telegraf/testutil"
|
||||
)
|
||||
|
||||
var fakeServices = `
|
||||
http 80/tcp www # WorldWideWeb HTTP
|
||||
https 443/tcp # http protocol over TLS/SSL
|
||||
tftp 69/udp`
|
||||
|
||||
func TestReadServicesFile(t *testing.T) {
|
||||
readServicesFile()
|
||||
require.NotEmpty(t, services)
|
||||
}
|
||||
|
||||
func TestFakeServices(t *testing.T) {
|
||||
r := strings.NewReader(fakeServices)
|
||||
m := readServices(r)
|
||||
require.Equal(t, sMap{"tcp": {80: "http", 443: "https"}, "udp": {69: "tftp"}}, m)
|
||||
}
|
||||
|
||||
func TestTable(t *testing.T) {
|
||||
var tests = []struct {
|
||||
name string
|
||||
tag string
|
||||
field string
|
||||
dest string
|
||||
prot string
|
||||
protField string
|
||||
protTag string
|
||||
input []telegraf.Metric
|
||||
expected []telegraf.Metric
|
||||
}{
|
||||
{
|
||||
name: "ordinary tcp default",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "tcp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "443",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "443",
|
||||
"service": "https",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "force udp default",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "udp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "69",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "69",
|
||||
"service": "tftp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "override default protocol",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "foobar",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80/tcp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80/tcp",
|
||||
"service": "http",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "multiple metrics, multiple protocols",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "tcp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "69/udp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80",
|
||||
"service": "http",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "69/udp",
|
||||
"service": "tftp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "rename source and destination tags",
|
||||
tag: "foo",
|
||||
dest: "bar",
|
||||
prot: "tcp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"foo": "80",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"foo": "80",
|
||||
"bar": "http",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "unknown port",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "tcp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "9999",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "9999",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "don't mix up protocols",
|
||||
tag: "port",
|
||||
dest: "service",
|
||||
prot: "udp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"port": "80",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "read from field instead of tag",
|
||||
field: "foo",
|
||||
dest: "bar",
|
||||
prot: "tcp",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{},
|
||||
map[string]interface{}{
|
||||
"foo": "80",
|
||||
},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{},
|
||||
map[string]interface{}{
|
||||
"foo": "80",
|
||||
"bar": "http",
|
||||
},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "read proto from field",
|
||||
field: "foo",
|
||||
dest: "bar",
|
||||
prot: "udp",
|
||||
protField: "proto",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{},
|
||||
map[string]interface{}{
|
||||
"foo": "80",
|
||||
"proto": "tcp",
|
||||
},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{},
|
||||
map[string]interface{}{
|
||||
"foo": "80",
|
||||
"bar": "http",
|
||||
"proto": "tcp",
|
||||
},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "read proto from tag",
|
||||
tag: "foo",
|
||||
dest: "bar",
|
||||
prot: "udp",
|
||||
protTag: "proto",
|
||||
input: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"foo": "80",
|
||||
"proto": "tcp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
expected: []telegraf.Metric{
|
||||
testutil.MustMetric(
|
||||
"meas",
|
||||
map[string]string{
|
||||
"foo": "80",
|
||||
"bar": "http",
|
||||
"proto": "tcp",
|
||||
},
|
||||
map[string]interface{}{},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
r := strings.NewReader(fakeServices)
|
||||
services = readServices(r)
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := PortName{
|
||||
SourceTag: tt.tag,
|
||||
SourceField: tt.field,
|
||||
Dest: tt.dest,
|
||||
DefaultProtocol: tt.prot,
|
||||
ProtocolField: tt.protField,
|
||||
ProtocolTag: tt.protTag,
|
||||
Log: testutil.Logger{},
|
||||
}
|
||||
|
||||
actual := p.Apply(tt.input...)
|
||||
|
||||
testutil.RequireMetricsEqual(t, tt.expected, actual)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTracking(t *testing.T) {
|
||||
// Setup raw input and expected output
|
||||
inputRaw := []telegraf.Metric{
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "80/tcp",
|
||||
},
|
||||
map[string]interface{}{"value": uint64(3)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "69/udp",
|
||||
},
|
||||
map[string]interface{}{"value": int64(4)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "443",
|
||||
},
|
||||
map[string]interface{}{"value": float64(5.5)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
}
|
||||
|
||||
expected := []telegraf.Metric{
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "80/tcp",
|
||||
"service": "http",
|
||||
},
|
||||
map[string]interface{}{"value": uint64(3)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "69/udp",
|
||||
"service": "tftp",
|
||||
},
|
||||
map[string]interface{}{"value": int64(4)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
metric.New(
|
||||
"test",
|
||||
map[string]string{
|
||||
"port": "443",
|
||||
"service": "https",
|
||||
},
|
||||
map[string]interface{}{"value": float64(5.5)},
|
||||
time.Unix(0, 0),
|
||||
),
|
||||
}
|
||||
|
||||
// Create fake notification for testing
|
||||
var mu sync.Mutex
|
||||
delivered := make([]telegraf.DeliveryInfo, 0, len(inputRaw))
|
||||
notify := func(di telegraf.DeliveryInfo) {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
delivered = append(delivered, di)
|
||||
}
|
||||
|
||||
// Convert raw input to tracking metric
|
||||
input := make([]telegraf.Metric, 0, len(inputRaw))
|
||||
for _, m := range inputRaw {
|
||||
tm, _ := metric.WithTracking(m, notify)
|
||||
input = append(input, tm)
|
||||
}
|
||||
|
||||
// Prepare and start the plugin
|
||||
plugin := &PortName{
|
||||
SourceTag: "port",
|
||||
Dest: "service",
|
||||
DefaultProtocol: "tcp",
|
||||
Log: testutil.Logger{},
|
||||
}
|
||||
|
||||
// Process expected metrics and compare with resulting metrics
|
||||
actual := plugin.Apply(input...)
|
||||
testutil.RequireMetricsEqual(t, expected, actual)
|
||||
|
||||
// Simulate output acknowledging delivery
|
||||
for _, m := range actual {
|
||||
m.Accept()
|
||||
}
|
||||
|
||||
// Check delivery
|
||||
require.Eventuallyf(t, func() bool {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
return len(input) == len(delivered)
|
||||
}, time.Second, 100*time.Millisecond, "%d delivered but %d expected", len(delivered), len(expected))
|
||||
}
|
||||
18
plugins/processors/port_name/sample.conf
Normal file
18
plugins/processors/port_name/sample.conf
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# Given a tag/field of a TCP or UDP port number, add a tag/field of the service name looked up in the system services file
|
||||
[[processors.port_name]]
|
||||
## Name of tag holding the port number
|
||||
# tag = "port"
|
||||
## Or name of the field holding the port number
|
||||
# field = "port"
|
||||
|
||||
## Name of output tag or field (depending on the source) where service name will be added
|
||||
# dest = "service"
|
||||
|
||||
## Default tcp or udp
|
||||
# default_protocol = "tcp"
|
||||
|
||||
## Tag containing the protocol (tcp or udp, case-insensitive)
|
||||
# protocol_tag = "proto"
|
||||
|
||||
## Field containing the protocol (tcp or udp, case-insensitive)
|
||||
# protocol_field = "proto"
|
||||
12
plugins/processors/port_name/services_path.go
Normal file
12
plugins/processors/port_name/services_path.go
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
//go:build windows
|
||||
|
||||
package port_name
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
func servicesPath() string {
|
||||
return filepath.Join(os.Getenv("WINDIR"), "system32", "drivers", "etc", "services")
|
||||
}
|
||||
24
plugins/processors/port_name/services_path_notwindows.go
Normal file
24
plugins/processors/port_name/services_path_notwindows.go
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
//go:build !windows
|
||||
|
||||
package port_name
|
||||
|
||||
import (
|
||||
"os"
|
||||
)
|
||||
|
||||
// servicesPath tries to find the `services` file at the common
|
||||
// place(s) on most systems and returns its path. If it can't
|
||||
// find anything, it returns the common default `/etc/services`
|
||||
func servicesPath() string {
|
||||
var files = []string{
|
||||
"/etc/services",
|
||||
"/usr/etc/services", // fallback on OpenSuSE
|
||||
}
|
||||
|
||||
for i := range files {
|
||||
if _, err := os.Stat(files[i]); err == nil {
|
||||
return files[i]
|
||||
}
|
||||
}
|
||||
return files[0]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue