Closed cborla closed 1 month ago
It has been identified the code in the wazuh/wazuh
repository.
Folder | File(s) | Keep | Notes |
---|---|---|---|
architecture | syscollector | ✅ | |
src/config | wmodules-syscollector.c | ❌ | Config will be migrated to TOML |
src/headers & src/shared | agent_messages_adapter.h/agent_messages_adapter.c | ✅ | |
logging_helper.h/logging_helper.c | ✅ | ||
sym_load.h/sym_load.c | 🟡 | Remove unused functions | |
src/shared_modules | utils/hashHelper.h | ✅ | |
utils/abstractLocking.hpp | ✅ | dbsync | |
utils/builder.hpp | ✅ | dbsync | |
utils/cjsonSmartDeleter.hpp | ✅ | dbsync | |
utils/customDeleter.hpp | ✅ | dbsync | |
utils/mapWrapperSafe.h | ✅ | dbsync | |
utils/pipelineNodesImp.h | ✅ | dbsync | |
utils/pipelinePattern.h | ✅ | dbsync | |
dbsync | ✅ | ||
src/wazuh_modules | syscollector | ✅ | The full directory is kept |
wm_syscollector.h/wm_syscollector.c | ✅ | ||
tests/integration | test_syscollector | ✅ |
Once this code has been migrated to the wazuh/wazuh-agent
repository, it must be refactored to fit the new repository structure, as follows:
wazuh-agent/
├── src/
│ ├── CMakeLists.txt
│ ├── vcpkg.json
│ ├── modules/
│ │ ├── inventory/
│ │ │ ├── CMakeLists.txt
│ │ │ ├── include/
│ │ │ │ ├── inventory.hpp
│ │ │ │ └── ...
│ │ │ ├── src/
│ │ │ │ ├── inventory.cpp
│ │ │ │ └── ...
│ │ │ └── tests/
│ │ │ ├── CMakeLists.txt
│ │ │ └── test_inventory.cpp
│ │ └── [additional modules...]
│ ├── common/
│ │ ├── dbsync/
│ │ └── [additional modules...]
│ └── build/
│ └── [build output...]
├── etc/
│ ├── config/
│ ├── selinux/
│ └── ruleset/
│ ├── sca/
│ └── rootcheck/
├── packages/
│ └── installers/
│ ├── unix/ (former init folder, including upgrade.sh and install.sh)
│ └── win32/
└── bump-version.sh
As a prerequisite for the Inventory or any other module implementation, the wmodule class needs to be implemented.
Analysis of different approaches is being performed.
A simple interface implementation as:
could be enough, leaving the implementation of every method specifically to each module.
Although this is a flexible approach, maintenance of every module will be required in such a scenario.
Another approach could be by implementing all module's behaviour in the parent class:
A mixed solution can also be implemented, where default behaviour is implemented in the parent class, but provides the means to extend every method behaviour in case a module needs it:
Although the extension is applied after the generic behaviour in this example, both pre & post extensions could be implemented, if necessary.
Although the 1st approach is much simpler at first, it delegates its implementation (and therefore its complexity) to every module that will be implemented. This gives a great deal of flexibility to a module implementation but effectively increases maintenance efforts.
The second approach improves maintenance effort requirements but at the expense of dramatically reducing flexibility. It removes all implementations from modules, not allowing the implementation of specific behaviours.
The third approach tries to accommodate both 1st and 2nd implementation limitations by allowing the extension of generic behaviours with specific behaviours:
Feature | Approach 1 | Approach 2 | Approach 3 |
---|---|---|---|
Simplicity | High | Medium | Medium |
Flexibility | High | Low | High |
Maintenance | Harder | Medium | Lower |
Manageable | Limited | Simple | Simple |
Based on this, I have created the base class Modules
and a first iteration of the Inventory
module, adapting the example to the structure of the new repository and using wrapper and concepts.
Output:
$ ./Modules
[Inventory] is running
[Inventory] query: Hello World!
[Inventory] stopped
Branch: https://github.com/wazuh/wazuh-agent/compare/master...17-migrate-syscollector-module-to-new-agent
Migrating dbsync:
Migrating dbsync:
Migrating inventory (fka syscollector):
Migrating dbsync:
Update 2024/07/12
Migrating syscollector:
Migrating syscollector (inventory) to new agent:
CMakeLists
files in order to build the projects with the new repository structure: https://github.com/wazuh/wazuh-agent/tree/enhancement/17-migrate-syscollector-refactor-cmake-files Update 2024/07/15
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent:
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Update 2024/07/30 Migrating syscollector (inventory) to new agent: https://github.com/wazuh/wazuh-agent/pull/45
Solving dependency issues. Migrating inventory start function to C++
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
nbertoldo@nbertoldo:~/workspace/wazuh/wazuh-agent/src/build/modules$ ./modules
Invoke: inventory
2024/08/07 19:14:10 modules:inventory:inventoryImp.cpp (1511) : INFO: Module started.
2024/08/07 19:14:10 modules:inventory:inventoryImp.cpp (1466) : INFO: Starting evaluation.
2024/08/07 19:14:10 modules:inventory:inventoryImp.cpp (1477) : INFO: Evaluation finished.
2024/08/07 19:14:20 modules:inventory:inventoryImp.cpp (1466) : INFO: Starting evaluation.
2024/08/07 19:14:20 modules:inventory: ERROR: {"data":[{"board_serial":" ","checksum":"8d1c166086c9454098751722d409fd7d1a682973","cpu_cores":16,"cpu_mhz":3879.0,"cpu_name":"AMD Ryzen 7 5800X 8-Core Processor","ram_free":22747800,"ram_total":32792608,"ram_usage":31}],"exception":"bad_function_call","table":"dbsync_hwinfo"}
2024/08/07 19:14:20 modules:inventory: ERROR: {"data":[{"architecture":"x86_64","checksum":"1723068860943662857","hostname":"nbertoldo-X570-AORUS-ELITE-WIFI","os_codename":"jammy","os_major":"22","os_minor":"04","os_name":"Ubuntu","os_patch":"3","os_platform":"ubuntu","os_version":"22.04.3 LTS (Jammy Jellyfish)","release":"6.5.0-44-generic","sysname":"Linux","version":"#44~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 18 14:36:16 UTC 2"}],"exception":"bad_function_call","table":"dbsync_osinfo"}
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Migrating syscollector (inventory) to new agent: #45
Testing:
Inventory migration
Inventory migration
Testing:
Parent issue:
Description
Migrate Syscollector and DBsync code from the
wazuh/wazuh
repository to thewazuh/wazuh-agent
repository.Tasks
wazuh/wazuh
repository.wazuh/wazuh-agent
repository.Implementation Constraints
Dependencies
Migration spike: https://github.com/wazuh/wazuh/issues/24037
Subtasks
Initial tasks
wazuh-agent
repository.libdb
,pacman
,procps
,rpm
.data-provider
dbsync
rsync
.src/common/
) used by inventory.wm_syscollector.c
module definition code based onstruct wm_context
.[x] Investigate how to add missing dependencies to vcpkg:
libdb
,pacman
,procps
, andrpm
to vcpkg.make
instead ofcmake
. We may need help from Octa or the team who originally worked on it.[x] Integrate with the Queue:
inventory
,data-provider
, anddbsync
.pool.cpp
) and decide if this will be the final name.[x] Compile Windows with MSVC
[x] Replace to new Logger
[ ] Clean up code for unsupported operating systems.
[x] Analyze if
http-request
(urlrequest) used bydata-provider
can be removed.Nice to have