Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Auditbeat] Package dataset: Make librpm code compatible across CentOS 6.x, 7.x, and Fedora 29 #10796

Merged
merged 4 commits into from
Feb 20, 2019

Conversation

cwurm
Copy link
Contributor

@cwurm cwurm commented Feb 18, 2019

Librpm version 4.14.2.1 on Fedora 29 no longer contains the headerGetEntry method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like rpm_tag_t/rpmTag/rpmTagVal.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

  1. Use headerGetString/headerGetNumber instead of headerGetEntry.
  2. Use int32_t instead of rpm_tag_t/rpmTag/rpmTagVal. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with #10694 this will hopefully allow RPM package collection to work well.

@cwurm cwurm added review needs_backport PR is waiting to be backported to other branches. Auditbeat SecOps labels Feb 18, 2019
@cwurm cwurm requested a review from a team as a code owner February 18, 2019 12:11
@elasticmachine
Copy link
Collaborator

Pinging @elastic/secops

@cwurm cwurm changed the title [Auditbeat] Package dataset: Make librpm code compatible across CentOS 6.x, 7.x, and Fedora 20 [Auditbeat] Package dataset: Make librpm code compatible across CentOS 6.x, 7.x, and Fedora 29 Feb 18, 2019
adriansr
adriansr previously approved these changes Feb 18, 2019
Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(wrong PR)

Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, 2 minor comments about making some code simpler.

x-pack/auditbeat/module/system/package/rpm_linux.go Outdated Show resolved Hide resolved
x-pack/auditbeat/module/system/package/rpm_linux.go Outdated Show resolved Hide resolved
@cwurm cwurm force-pushed the package_librpm_remove_deprecated branch from 65797ee to 64cf6a0 Compare February 19, 2019 15:21
@cwurm cwurm force-pushed the package_librpm_remove_deprecated branch from 64cf6a0 to 45350b3 Compare February 19, 2019 15:24
@cwurm cwurm merged commit e7ea5d7 into elastic:master Feb 20, 2019
@cwurm cwurm deleted the package_librpm_remove_deprecated branch February 20, 2019 11:59
cwurm pushed a commit to cwurm/beats that referenced this pull request Feb 20, 2019
…S 6.x, 7.x, and Fedora 29 (elastic#10796)

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with elastic#10694 this will hopefully allow RPM package collection to work well.

(cherry picked from commit e7ea5d7)
@cwurm cwurm added v7.2.0 and removed needs_backport PR is waiting to be backported to other branches. labels Feb 20, 2019
cwurm pushed a commit to cwurm/beats that referenced this pull request Feb 20, 2019
…S 6.x, 7.x, and Fedora 29 (elastic#10796)

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with elastic#10694 this will hopefully allow RPM package collection to work well.

(cherry picked from commit e7ea5d7)
@cwurm cwurm added the v7.0.0 label Feb 20, 2019
@cwurm cwurm added the v6.7.0 label Feb 22, 2019
cwurm pushed a commit to cwurm/beats that referenced this pull request Feb 22, 2019
…S 6.x, 7.x, and Fedora 29 (elastic#10796)

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with elastic#10694 this will hopefully allow RPM package collection to work well.

(cherry picked from commit e7ea5d7)
cwurm pushed a commit that referenced this pull request Feb 25, 2019
…ode compatible across CentOS 6.x, 7.x, and Fedora 29 (#10907)

Cherry-pick of PR #10796 to 6.7 branch. Original message: 

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with #10694 this will hopefully allow RPM package collection to work well.
cwurm pushed a commit that referenced this pull request Feb 25, 2019
…S 6.x, 7.x, and Fedora 29 (#10796) (#10843)

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with #10694 this will hopefully allow RPM package collection to work well.

(cherry picked from commit e7ea5d7)
cwurm pushed a commit that referenced this pull request Feb 25, 2019
…ode compatible across CentOS 6.x, 7.x, and Fedora 29 (#10842)

Cherry-pick of PR #10796 to 7.x branch. Original message: 

Librpm version 4.14.2.1 on Fedora 29 no longer contains the `headerGetEntry` method we are currently using. It was deprecated and then removed in version 4.14 (rpm-software-management/rpm@c68fa9a).

Also, the much older version 4.8.0 of librpm on CentOS 6.10 (Final) does not yet contain newer data structures for tags like `rpm_tag_t/rpmTag/rpmTagVal`.

This PR makes two changes that should allow this code to work on all three distros (CentOS 6.x, 7.x, Fedora 29 - and hopefully anything in between):

1. Use `headerGetString/headerGetNumber` instead of `headerGetEntry`.
2. Use `int32_t` instead of `rpm_tag_t/rpmTag/rpmTagVal`. Luckily, this seems to work on all three distros. I'd prefer something like a typedef, but unfortunately, C99 does not allow repeating a typedef (C11 does) and so backporting them is not easily possible.

It also makes the code more lenient with errors during data collection: Only when no package name can be found do we return an error.

Together with #10694 this will hopefully allow RPM package collection to work well.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants