[feature] Ability to set user-agent variable for http_output #1850

yoshi314 · 2022-01-12T10:18:54Z

/kind feature

/area engine

What this PR does / why we need it:

This allows to identify falco's datastream sent via http_output on the receiving end.

In my particular case that is logstash with its http listener.

Since I have multiple processes submitting via http from the same machine, I need a way to distinguish falco's events from other incoming data streams for further parsing and processing.

Which issue(s) this PR fixes:

Fixes #1831

Does this PR introduce a user-facing change?:

A config entry of user_agent: "some string" is now supported under http_output. If not provided, the value defaults to "falcosecurity/falco".

Setting it to "" ought to restore previous behaviour (that field appears to be present in http headers, but with blank value).

new: add ability to set User-Agent http header when sending http output. Provide default value of 'falcosecurit/falco'.

Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

poiana · 2022-01-12T10:20:07Z

Welcome @yoshi314! It looks like this is your first PR to falcosecurity/falco 🎉

FedeDP · 2022-01-12T10:48:34Z

userspace/falco/outputs_http.cpp

@@ -34,11 +34,14 @@ void falco::outputs::output_http::output(const message *msg)
 		} else {
 			slist1 = curl_slist_append(slist1, "Content-Type: text/plain");
 		}
+        slist1 = curl_slist_append(slist1, m_oc.options["user_agent"].c_str());


FedeDP · 2022-01-12T10:50:34Z

Hi! Thank you for opening this PR!
This is very useful IMO!
Note that all your commits must be signed with dco, see https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md#developer-certificate-of-origin.
Moreover, commits message must obey to conventional commits: https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md#commit-convention

It would be great if you could force-push with these changes in place!

FedeDP

Apart from a single (small) comment, LGTM!
Thanks!

jasondellaluce · 2022-01-12T13:06:03Z

On top of @FedeDP's comments, I would also add an http_output.user_agent in falco.yaml too for better visibility.

yoshi314 · 2022-01-12T13:09:23Z

ok, i'll see to it later today. Now trying to figure out how to sign the past commits.

FedeDP · 2022-01-12T13:13:19Z

Hi!
It is just as simple as rebasing interactively latest N commits (2 in your case) and add the "Signed-off-by ..." bit to each commit message :)
Then, force-push!

yoshi314 · 2022-01-13T09:20:28Z

I hope that fixed it. Also, what exactly is that remark with spacing about? A case of tabs/spaces or something else?

jasondellaluce · 2022-01-13T09:53:23Z

Yeah, it looks like it worked (You can see your sign-off on the commit message).

The spacing issue seems to be that outputs_http.cpp uses tabs for indentation, whereas the new changes use spacing. If you can fix that, and also add an entry for the new config field in falco.yaml, I would proceed and approve!

yoshi314 · 2022-01-13T14:01:14Z

It appears vim can be deceiving with indentation. Should be fixed now.

add sample config entry for user-agent variable Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

jasondellaluce · 2022-01-13T17:15:04Z

userspace/falco/outputs_http.cpp

@@ -34,11 +34,14 @@ void falco::outputs::output_http::output(const message *msg)
 		} else {
 			slist1 = curl_slist_append(slist1, "Content-Type: text/plain");
 		}
+		slist1 = curl_slist_append(slist1, m_oc.options["user_agent"].c_str());


By testing it locally, I was not able to get the user agent header (but maybe it was me). Either way, not setting the user-agent: prefix properly would result in an invalid header I think. Would it be better to use this instead?

curl_easy_setopt(curl, CURLOPT_USERAGENT, m_oc.options["user_agent"].c_str());

i'll have to retest this in my setup. I was pretty sure that worked on my case, when checking logs on remote end.

Oh, i think i missd the "User-Agent:" string from the header, since i used a predefined string before.

So now it only passes the variable without that prefix.

yeah, your proposal looks better. I'll try to go with that. Somehow i missed this option.

jasondellaluce · 2022-01-13T17:43:12Z

@yoshi314 new changes look good. Please sign-off the last commit and we should be good to go!

…itched to dedicated curl's method to do this Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

jasondellaluce

/approve

Thanks for your contribution! 🥳

poiana · 2022-01-14T08:26:09Z

LGTM label has been added.

Git tree hash: c2fb4965c77ef5daef745b789eef6fb297c7e6ed

leogr · 2022-01-17T14:49:29Z

/milestone 0.31.0

leogr

LGTM

@yoshi314 thank you for this PR!

/approve

poiana · 2022-01-18T08:49:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jasondellaluce, leogr, yoshi314

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [jasondellaluce,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

add useragent string to output

14d11b9

Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

poiana added size/XS release-note dco-signoff: no labels Jan 12, 2022

poiana requested review from fntlnz and krisnova January 12, 2022 10:19

poiana added kind/feature area/engine labels Jan 12, 2022

FedeDP reviewed Jan 12, 2022

View reviewed changes

yoshi314 force-pushed the useragent_variable_2 branch from 22418d2 to 14d11b9 Compare January 13, 2022 09:18

poiana added dco-signoff: yes and removed dco-signoff: no labels Jan 13, 2022

fix indentation in outputs_http.cpp

2ea6411

add sample config entry for user-agent variable Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

poiana added size/S and removed size/XS labels Jan 13, 2022

jasondellaluce requested changes Jan 13, 2022

View reviewed changes

poiana assigned jasondellaluce Jan 13, 2022

poiana added dco-signoff: no and removed dco-signoff: yes labels Jan 13, 2022

yoshi314 force-pushed the useragent_variable_2 branch from 9491557 to 278defd Compare January 14, 2022 06:54

poiana added dco-signoff: yes and removed dco-signoff: no labels Jan 14, 2022

yoshi314 force-pushed the useragent_variable_2 branch from 278defd to 9491557 Compare January 14, 2022 06:57

poiana added dco-signoff: no and removed dco-signoff: yes labels Jan 14, 2022

yoshi314 force-pushed the useragent_variable_2 branch from 9491557 to 2cc626c Compare January 14, 2022 06:59

poiana added dco-signoff: yes and removed dco-signoff: no labels Jan 14, 2022

fix setting the variable of User-Agent, it was missing the prefix. Sw…

2cc626c

…itched to dedicated curl's method to do this Signed-off-by: Marcin Kowalski <marcin.kowalski@assecobs.pl>

jasondellaluce approved these changes Jan 14, 2022

View reviewed changes

poiana added the lgtm label Jan 14, 2022

poiana added the approved label Jan 14, 2022

poiana added this to the 0.31.0 milestone Jan 17, 2022

leogr approved these changes Jan 18, 2022

View reviewed changes

poiana assigned leogr Jan 18, 2022

poiana merged commit a9e7512 into falcosecurity:master Jan 18, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[feature] Ability to set user-agent variable for http_output #1850

[feature] Ability to set user-agent variable for http_output #1850

yoshi314 commented Jan 12, 2022 •

edited by jasondellaluce

Loading

poiana commented Jan 12, 2022

FedeDP Jan 12, 2022

FedeDP commented Jan 12, 2022

FedeDP left a comment

jasondellaluce commented Jan 12, 2022

yoshi314 commented Jan 12, 2022

FedeDP commented Jan 12, 2022 •

edited

Loading

yoshi314 commented Jan 13, 2022

jasondellaluce commented Jan 13, 2022

yoshi314 commented Jan 13, 2022

jasondellaluce Jan 13, 2022

yoshi314 Jan 13, 2022

yoshi314 Jan 13, 2022 •

edited

Loading

jasondellaluce commented Jan 13, 2022

jasondellaluce left a comment

poiana commented Jan 14, 2022

leogr commented Jan 17, 2022

leogr left a comment

poiana commented Jan 18, 2022

[feature] Ability to set user-agent variable for http_output #1850

[feature] Ability to set user-agent variable for http_output #1850

Conversation

yoshi314 commented Jan 12, 2022 • edited by jasondellaluce Loading

poiana commented Jan 12, 2022

FedeDP Jan 12, 2022

Choose a reason for hiding this comment

FedeDP commented Jan 12, 2022

FedeDP left a comment

Choose a reason for hiding this comment

jasondellaluce commented Jan 12, 2022

yoshi314 commented Jan 12, 2022

FedeDP commented Jan 12, 2022 • edited Loading

yoshi314 commented Jan 13, 2022

jasondellaluce commented Jan 13, 2022

yoshi314 commented Jan 13, 2022

jasondellaluce Jan 13, 2022

Choose a reason for hiding this comment

yoshi314 Jan 13, 2022

Choose a reason for hiding this comment

yoshi314 Jan 13, 2022 • edited Loading

Choose a reason for hiding this comment

jasondellaluce commented Jan 13, 2022

jasondellaluce left a comment

Choose a reason for hiding this comment

poiana commented Jan 14, 2022

leogr commented Jan 17, 2022

leogr left a comment

Choose a reason for hiding this comment

poiana commented Jan 18, 2022

yoshi314 commented Jan 12, 2022 •

edited by jasondellaluce

Loading

FedeDP commented Jan 12, 2022 •

edited

Loading

yoshi314 Jan 13, 2022 •

edited

Loading