add syslog output

Author: hdm

cmd/capture.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
+	syslog "github.com/RackSec/srslog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -192,6 +193,18 @@ func setupOutput(outputs []string) *flamingo.RecordWriter {
 			continue
 		}
 
+		if strings.HasPrefix(output, "syslog:") || output == "syslog" {
+			writer, cleaner, err := getSyslogWriter(output)
+			if err != nil {
+				log.Fatalf("failed to configure output %s: %s", output, err)
+			}
+			rw.OutputWriters = append(rw.OutputWriters, writer)
+			if cleaner != nil {
+				rw.OutputCleaners = append(rw.OutputCleaners, cleaner)
+			}
+			continue
+		}
+
 		// Assume anything else is a file output
 		writer, cleaner, err := getFileWriter(output)
 		if err != nil {
@@ -252,6 +265,65 @@ func getWebhookWriter(url string) (flamingo.OutputWriter, flamingo.OutputCleaner
 	}, flamingo.OutputCleanerNoOp, nil
 }
 
+func getSyslogWriter(url string) (flamingo.OutputWriter, flamingo.OutputCleaner, error) {
+
+	var syslogWriter *syslog.Writer
+	var err error
+
+	// Supported formats
+	// - syslog:unix:/dev/log
+	// - syslog:host:port
+	// - syslog:udp:host
+	// - syslog:udp:host:port
+	// - syslog:tcp:host:port
+
+	bits := strings.Split(url, ":")
+	switch len(bits) {
+	case 1:
+		syslogWriter, err = syslog.Dial("", "", syslog.LOG_ALERT, "flamingo")
+	case 2:
+		syslogWriter, err = syslog.Dial("udp", fmt.Sprintf("%s:514", bits[1]), syslog.LOG_ALERT, "flamingo")
+	case 3:
+		switch bits[1] {
+		case "unix":
+			syslogWriter, err = syslog.Dial("", bits[2], syslog.LOG_ALERT, "flamingo")	
+		case "udp", "tcp", "tcp+tls":
+			syslogWriter, err = syslog.Dial(bits[1], fmt.Sprintf("%s:514", bits[2]), syslog.LOG_ALERT, "flamingo")	
+		default:
+			syslogWriter, err = syslog.Dial("udp", fmt.Sprintf("%s:%s", bits[1], bits[2]), syslog.LOG_ALERT, "flamingo")
+		}
+			
+	case 4:
+		switch bits[1] {
+		case "unix":
+			syslogWriter, err = syslog.Dial("", bits[2], syslog.LOG_ALERT, "flamingo")	
+		case "udp", "tcp", "tcp+tls":
+			syslogWriter, err = syslog.Dial(bits[1], fmt.Sprintf("%s:%s", bits[2], bits[3]), syslog.LOG_ALERT, "flamingo")	
+		default:
+			err = fmt.Errorf("unsupported syslog transport %s", bits[1])	
+		}
+	default:
+		err = fmt.Errorf("unsupported syslog destination %s", url)	
+	}
+
+	if err != nil {
+		return flamingo.OutputWriterNoOp, flamingo.OutputCleanerNoOp, err
+	}
+
+	err = syslogWriter.Debug("flamingo is starting up")
+	if err != nil {
+		return flamingo.OutputWriterNoOp, flamingo.OutputCleanerNoOp, err
+	}
+
+	return func(rec map[string]string) error {
+		bytes, err := json.Marshal(rec)
+		if err != nil {
+			return err
+		}
+		return sendSyslog(syslogWriter, string(bytes))
+	},  func() { syslogWriter.Close() }, nil
+}
+
 func setupTLS() {
 	tlsCertData := ""
 	tlsKeyData := ""
@@ -510,3 +582,7 @@ func sendWebhook(url string, msg string) error {
 
 	return nil
 }
+
+func sendSyslog(w *syslog.Writer, msg string) error {
+	return w.Alert(msg)
+}

go.mod

@@ -3,6 +3,7 @@ module github.com/atredispartners/flamingo
 go 1.13
 
 require (
+	github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91
 	github.com/audibleblink/go-ntlm v0.0.0-20190308023621-c1bc43845e23
 	github.com/golang/mock v1.4.0 // indirect
 	github.com/hdm/gosnmp v0.0.0-20191201190541-fbffabc0d968

go.sum

@@ -1,4 +1,6 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91 h1:vX+gnvBc56EbWYrmlhYbFYRaeikAke1GL84N4BEYOFE=
+github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91/go.mod h1:cDLGBht23g0XQdLjzn6xOGXDkLK182YfINAaZEQLCHQ=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/audibleblink/go-ntlm v0.0.0-20190308023621-c1bc43845e23 h1:2LStrPaZzohiCtPXvfyHgwHovqBfB3RU0/CtH1N0isk=
 github.com/audibleblink/go-ntlm v0.0.0-20190308023621-c1bc43845e23/go.mod h1:zJPIj8bkusLxnNA2qIcUQdcNqSHN9HISRCIiVhGPIbA=