Files
Naomi Kramer b923c39e2d Update configuration (#78)
* Update on config structure, functionality, and tests

Co-Authored-By: Naomi Kramer <naomiagoddard@gmail.com>

* Extend subnet type to read/write from db, update tests

Co-Authored-By: Liza Tsibur <liza@activecountermeasures.com>

* updated read file config test and subnet tests

* fixed config and util tests, updated subnet related functions

Co-Authored-By: Naomi Kramer <naomiagoddard@gmail.com>

* Remove error return from GetDefaultConfig

Co-Authored-By: Liza Tsibur <liza@activecountermeasures.com>

* added json tags to database struct

* Updated beacon weights validation for config

* updates to score thresholds validation tags

* changes to config subnet validation and testing

* Update subnet.go

* Write missing host entries to http to populate http_proto

* Updating some fields to uint64

* WIP update some field types

* Update zeek count types and fix tests

* Add clickhouse credentials

* Misc fixes

* Update pointer

* Add ability to mark datasets as sample datasets

* fix column name

* Fix datasets exiting import if hour is empty

* Fix zeek count parsing from TSV files

* Remove storing dns conns in arrays, Fix historical first seen dns lag

* Remove unused columns

* Update config.hjson

* Update config.hjson

* updated impact category score functions to use float64

Co-Authored-By: Naomi Kramer <naomiagoddard@gmail.com>

* Update subnet.go

* Store import version in imports table

* Fix duplicated SNI/IP long connections

* Update subnet_test.go

* Cleanup output

* Rolling files updates (#39)

* Limit number of days to import for rolling datasets

* Fix breaking imports when import was interrupted

* Remove debug output

---------

Co-authored-by: Naomi Kramer <naomi@activecountermeasures.com>

* Omit parts of env from output

* Set max for threat intel datasize

* Remove SELinux neutering for QA

* Add network size column

* Fix http_proto for missing host, update tests for missing host fixes

* Add online feeds to default config

* Update sshprep (#45)

* Update sshprep

Co-Authored-By: William Stearns <3538265+william-stearns@users.noreply.github.com>

* Update sshprep

Add Bradley's suggestion of using head -1 to limit to a single address.

---------

Co-authored-by: Naomi Kramer <naomi@activecountermeasures.com>
Co-authored-by: William Stearns <3538265+william-stearns@users.noreply.github.com>

* Installer Behavior Tweaks (#41)

* Add --yes flag to add-apt-repository command

* Add missing sudo flags, make sure we're using the SUDO variable instead

* Add ability to perform zone transfers (#48)

* Store zone transfer records

Co-Authored-By: moth <25512187+0x6d6f7468@users.noreply.github.com>

* Update config

* Add tests

* Tests, connectivity test

* Update tests

---------

Co-authored-by: moth <25512187+0x6d6f7468@users.noreply.github.com>

* Support RedHat/RHEL as a valid target (#47)

* Update sshprep

Co-Authored-By: William Stearns <3538265+william-stearns@users.noreply.github.com>

* Supporrt RedHat/RHEL as a valid target

---------

Co-authored-by: Naomi Kramer <naomi@activecountermeasures.com>
Co-authored-by: William Stearns <3538265+william-stearns@users.noreply.github.com>
Co-authored-by: moth <moth@blackhillsinfosec.com>

* Fix tests (#49)

* Fix tests

* Update WalkFiles to use UTC

* fixed issue with rolling datasets over 24hours old not getting historical first seen timestamp set (#52)

* Change values from float32 to float64 (#50)

* Switch float32 to float64

* Update threat category calculation to match CalculateBucketedScore (#51)

---------

Co-authored-by: Liza Tsibur <liza@activecountermeasures.com>

* Bump max query execution time default value

* Use string instead of error for ZoneTransferConnectivityErrors struct fields (#61)

* Upgrade Golang to version 1.24 (#59) (#60)

* Replace get_url with shell and curl (#58)

* Update sshprep

Co-Authored-By: William Stearns <3538265+william-stearns@users.noreply.github.com>

* Replace get_url with shell and curl

* Use get_url by default, fall back to curl if it fails

---------

Co-authored-by: Naomi Kramer <naomi@activecountermeasures.com>
Co-authored-by: William Stearns <3538265+william-stearns@users.noreply.github.com>
Co-authored-by: moth <moth@blackhillsinfosec.com>

* add automated log transfer, AC-Hunter issue 135 (#62)

* Update sshprep

Co-Authored-By: William Stearns <3538265+william-stearns@users.noreply.github.com>

* add automated log transfer, PR135

* cron requires non-executable permission

* Specify suggested YAML plugin and config in VSCode workspace

* Linting and light cleanup

* Update generate_installer.sh

Download zeek_log_transport.sh to send to the sensor.

* Create cron file if remote zeek installation

* Only run zeek log import steps for remote sensor installations

---------

Co-authored-by: Naomi Kramer <naomi@activecountermeasures.com>
Co-authored-by: William Stearns <3538265+william-stearns@users.noreply.github.com>
Co-authored-by: moth <moth@blackhillsinfosec.com>

* Temporarily disable RITA/Zeek log transport until installer is modular (#66)

* Uniform -y flag usage for repo management/package installation; Uniform SUDO variable usage (#68)

* Resolve Installer Side Effects and Formalize RHEL Support (#73)

* Add missing necessary wildcards for RHEL versions

* Remove Ansible task replacing python3-requests to avoid RHEL distro installation side effects

* Update supported distros in README

* Update scoring defaults

* Resolve Ansible Reboot Errors (#75)

* Clean up conditionals; Fix reboot step for Ubuntu

* Suppress erroneous error output on RPM systems, ignore errors on reboot necessity checks

* Ignore missing host rows for openhttp (#76)

* Fix integration tests due to prevalence (#77)

---------

Co-authored-by: Liza Tsibur <liza@activecountermeasures.com>
Co-authored-by: moth <moth@blackhillsinfosec.com>
Co-authored-by: William Stearns <william.l.stearns@gmail.com>
Co-authored-by: William Stearns <3538265+william-stearns@users.noreply.github.com>
Co-authored-by: moth <25512187+0x6d6f7468@users.noreply.github.com>
2025-09-22 16:21:05 -04:00

245 lines
7.7 KiB
Go

package database
import (
"context"
"sync"
"github.com/activecm/rita/v5/config"
zlog "github.com/activecm/rita/v5/logger"
clickhouse "github.com/ClickHouse/clickhouse-go/v2"
"github.com/ClickHouse/clickhouse-go/v2/lib/driver"
"golang.org/x/sync/errgroup"
"golang.org/x/time/rate"
)
type (
Data any
// Interface to allow creating a BulkWriter from a DB or a serverConn
Database interface {
getConn() driver.Conn
GetContext() context.Context
QueryParameters(clickhouse.Parameters) context.Context
}
BulkWriter struct {
db Database
conf *config.Config
WriteChannel chan Data
ProgChannel chan int
WriteWg *errgroup.Group // wait for writing to finish
writerName string // used in error reporting
batchSize int
query string
limiter *rate.Limiter
withProgress bool
database string
closed bool
ctx context.Context
numWorkers int
batches []int
mu sync.Mutex
cond *sync.Cond
}
)
// NewBulkWriter creates a new writer object to write output data to collections
func NewBulkWriter(db Database, conf *config.Config, numWorkers int, database string, writerName string, query string, limiter *rate.Limiter, withProgress bool) *BulkWriter {
analysisErrGroup, ctx := errgroup.WithContext(context.Background())
writer := &BulkWriter{
db: db,
conf: conf,
database: database,
WriteChannel: make(chan Data),
ProgChannel: make(chan int),
WriteWg: analysisErrGroup,
writerName: writerName,
batchSize: int(conf.RITA.BatchSize),
query: query,
limiter: limiter,
withProgress: withProgress,
numWorkers: numWorkers,
ctx: ctx,
batches: make([]int, numWorkers), // keeps track of the batch count for each worker
}
writer.cond = sync.NewCond(&writer.mu)
return writer
}
// shouldReadData returns whether or not the thread with the passed in ID should read data from the write channel
func (w *BulkWriter) shouldReadData(id int, empty bool) bool {
if w.numWorkers == 1 {
return true
}
var numInProgress int
for i, b := range w.batches {
if i != id {
// batch is in progress if it has at least 1 item, but less than the batch size
if b > 0 && b < w.batchSize {
numInProgress++
}
}
}
// we don't want a worker that's not currently in progress to read the rest of the items from the channel after it's closed
// because then the leftover data will get distributed between all of the workers, making 5 or so tiny batches, which is really bad
if w.closed {
// allow any worker to pass through the cond wait if the channel is empty
if empty {
return true
}
// if the channel isn't empty yet, allow any in progress workers to keep going, or a new one if none are processing
return w.batches[id] > 0 || numInProgress == 0
}
// a worker should start reading if there are no other workers currently reading in data
// or keep reading if it's already in progress
return numInProgress == 0 || w.batches[id] > 0
}
// Close waits for the write threads to finish
func (w *BulkWriter) Close() {
logger := zlog.GetLogger()
// tell workers that no more data will be sent on this channel
close(w.WriteChannel)
// mark the channel as closed
w.closed = true
// notify workers that the channel is closed
w.cond.Broadcast()
// wait for the errgroup
if err := w.WriteWg.Wait(); err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "close_writer").Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
close(w.ProgChannel)
}
// Start kicks off a new write thread
func (w *BulkWriter) Start(id int) {
w.WriteWg.Go(func() error {
logger := zlog.GetLogger()
conn := w.db.getConn()
chCtx := w.db.QueryParameters(clickhouse.Parameters{
"database": w.database,
})
batchCount := 0
var items []Data
// loop over input channel
for {
w.mu.Lock()
// check to see if this thread should take in data
for !w.shouldReadData(id, len(w.WriteChannel) == 0) {
// wait for other threads to process data if it isn't supposed to read in data yet
w.cond.Wait()
}
// check if any other workers errored out and made the context finish
select {
case <-w.ctx.Done():
return w.ctx.Err()
default:
}
// attempt to read data from the channel
change, ok := <-w.WriteChannel
// if the channel is closed, unlock the mutex and break out of the loop
if !ok {
w.mu.Unlock()
break // Exit if the channel is closed
}
// increment batch count
w.batches[id]++
batchCount++
// unlock mutex
w.mu.Unlock()
// add this data to the batch buffer
items = append(items, change)
// if batch size limit reached, write out batch of records
if batchCount >= w.batchSize {
// alert other workers that this worker is sending the batch so that
// a free worker can be allowed to start making a new batch
w.cond.Broadcast()
// initialize batch
batch, err := conn.PrepareBatch(chCtx, w.query)
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "prepare").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
// add each item in batch to this batch
for _, item := range items {
err := batch.AppendStruct(item)
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "append").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
}
// wait for the rate limiter so that not too many batches are inserted at a time
// ClickHouse recommends to send 1 batch per second, but it appears to work just fine for 5 batches per second
if err := w.limiter.Wait(w.db.GetContext()); err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "limiter").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
// send batch
err = batch.Send()
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "send").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
// if progress updates are enabled, send the number of records
// this batch handled on the progress channel
if w.withProgress {
w.ProgChannel <- batchCount
}
// update worker state batch count and alert other workers that this
// worker is empty
w.mu.Lock()
w.batches[id] = 0
w.cond.Broadcast()
w.mu.Unlock()
// reset count and items slice
batchCount = 0
items = nil
}
}
// handle batch when number of items is less than the batch size
if batchCount > 0 {
batch, err := conn.PrepareBatch(chCtx, w.query)
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "final_prepare").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
for _, item := range items {
err := batch.AppendStruct(item)
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "final_append").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
}
err = batch.Send()
if err != nil {
logger.Fatal().Err(err).Str("database", w.writerName).Str("stage", "final_send").Int("batch_size", w.batches[id]).Msg("Encountered an unrecoverable issue when trying to write to the database, exiting")
}
if w.withProgress {
w.ProgChannel <- batchCount
}
}
return nil
})
}