From 6566f2b2d1d764d0d9867cdfffd9fcca11828d2b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 10:32:14 -0500 Subject: [PATCH 001/174] New CI --- docker-compose.yml | 1 + package/Dockerfile | 71 ++----------------------- package/etc/conf.d/sources/startup.conf | 4 +- package/sbin/entrypoint.sh | 6 +-- test-with-compose.sh | 5 +- 5 files changed, 14 insertions(+), 73 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 81191cb..d0dab92 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,6 +10,7 @@ version: "3.7" services: test: build: ./tests + links: - splunk - sc4s diff --git a/package/Dockerfile b/package/Dockerfile index 75a9c62..905d8d1 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -6,66 +6,11 @@ # #You should have received a copy of the CC0 legalcode along with this #work. If not, see . -FROM centos:centos8 +FROM docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:3.25.1 +COPY --from=hairyhenderson/gomplate:v3.5.0 /gomplate /usr/local/bin/gomplate -ENV CONFIGURE_FLAGS="--prefix=/opt/syslog-ng --with-ivykis=system --with-jsonc=system --disable-env-wrapper --disable-memtrace --disable-tcp-wrapper --disable-linux-caps --disable-man-pages --enable-all-modules --enable-force-gnu99 --enable-json --enable-native --enable-python --enable-http --disable-kafka --disable-java --disable-java-modules --disable-spoof_source --disable-sun_streams --disable-sql --disable-pacct --disable-mongodb --disable-amqp --disable-stomp --disable-redis --disable-systemd --disable-geoip --disable-geoip2 --disable-riemann --disable-smtp --disable-snmp_dest --with-python=3 --enable-dynamic-linking" - -ENV DISTCHECK_CONFIGURE_FLAGS="--prefix=/opt/syslog-ng --with-ivykis=system --with-jsonc=system --disable-env-wrapper --disable-memtrace --disable-tcp-wrapper --disable-linux-caps --disable-man-pages --enable-all-modules --enable-force-gnu99 --enable-json --enable-native --enable-python --enable-http --disable-kafka --disable-java --disable-java-modules --disable-spoof_source --disable-sun_streams --disable-sql --disable-pacct --disable-mongodb --disable-amqp --disable-stomp --disable-redis --disable-systemd --disable-geoip --disable-geoip2 --disable-riemann --disable-smtp --disable-snmp_dest --with-python=3 --enable-dynamic-linking" - -RUN dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -y ;\ - dnf install 'dnf-command(config-manager)' -y ;\ - dnf config-manager --set-enabled PowerTools -y; \ - dnf update -y ;\ - dnf upgrade - -RUN dnf group install "Development Tools" -y ;\ - dnf install findutils autoconf \ - autoconf automake ca-certificates git libtool pkgconfig bison byacc file \ - flex pcre-devel glib2-devel openssl-devel libcurl-devel \ - python3 python3-devel \ - net-snmp-devel \ - libuuid-devel cmake make libxslt gcc-c++ tzdata libxml2 sqlite \ - gnupg wget curl which bzip2 libsecret ivykis-devel autoconf-archive json-c-devel -y - - -RUN CRITERION_VERSION=2.3.3 ;\ - cd /tmp/;\ - wget https://github.com/Snaipe/Criterion/releases/download/v${CRITERION_VERSION}/criterion-v${CRITERION_VERSION}.tar.bz2 ;\ - tar xvf /tmp/criterion-v${CRITERION_VERSION}.tar.bz2;cd /tmp/criterion-v${CRITERION_VERSION} ;\ - cmake -DCMAKE_INSTALL_PREFIX=/usr . ;\ - make install ;\ - ldconfig ;\ - rm -rf /tmp/criterion.tar.bz2 /tmp/criterion-v${CRITERION_VERSION} - - -COPY syslog-ng /work - -RUN cd /work;\ - pip3 install -r requirements.txt ;\ - ./autogen.sh ;\ - ./configure $CONFIGURE_FLAGS ;\ - make -j -l 2.5 install - - -FROM registry.access.redhat.com/ubi8/ubi - -RUN cd /tmp ;\ - dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -y; \ - dnf update -y ;\ - dnf install wget gcc tzdata libdbi libsecret libxml2 sqlite \ - python3 libcurl ivykis scl-utils curl wget openssl -y - -ENV DEBCONF_NONINTERACTIVE_SEEN=true - -RUN curl -fsSL https://goss.rocks/install | GOSS_VER=v0.3.7 sh -COPY goss.yaml /etc/goss.yaml - -COPY --from=0 /opt/syslog-ng /opt/syslog-ng - -RUN curl -o /usr/local/bin/gomplate -sSL https://github.com/hairyhenderson/gomplate/releases/download/v3.5.0/gomplate_linux-amd64-slim && \ - chmod 755 /usr/local/bin/gomplate - +COPY goss.yaml goss.yaml COPY etc/syslog-ng.conf /opt/syslog-ng/etc/syslog-ng.conf COPY etc/conf.d /opt/syslog-ng/etc/conf.d @@ -74,15 +19,9 @@ COPY etc/context_templates /opt/syslog-ng/etc/context_templates COPY etc/local_config /opt/syslog-ng/etc/local_config COPY sbin/entrypoint.sh / -RUN mkdir -p /opt/syslog-ng/var/data/disk-buffer -RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -V COPY VERSION / -EXPOSE 514 -EXPOSE 601/tcp -EXPOSE 6514/tcp - -ENTRYPOINT ["/entrypoint.sh", "-F"] +RUN /opt/syslog-ng/sbin/syslog-ng -V -HEALTHCHECK --start-period=15s --interval=30s --timeout=6s CMD goss -g /etc/goss.yaml validate \ No newline at end of file +#USER [syslog] \ No newline at end of file diff --git a/package/etc/conf.d/sources/startup.conf b/package/etc/conf.d/sources/startup.conf index 00fbce7..e4de003 100644 --- a/package/etc/conf.d/sources/startup.conf +++ b/package/etc/conf.d/sources/startup.conf @@ -1,12 +1,12 @@ source s_startup_out { - file("/var/log/syslog-ng.out" + file("/opt/syslog-ng/var/log/syslog-ng.out" program-override("syslog-ng-config") flags(no-hostname,no-parse,assume-utf8) ); }; source s_startup_err { - file("/var/log/syslog-ng.err" + file("/opt/syslog-ng/var/log/syslog-ng.err" program-override("syslog-ng-config") flags(no-hostname,no-parse,assume-utf8) ); diff --git a/package/sbin/entrypoint.sh b/package/sbin/entrypoint.sh index 66bdb51..e68bf47 100755 --- a/package/sbin/entrypoint.sh +++ b/package/sbin/entrypoint.sh @@ -20,11 +20,11 @@ mkdir -p /opt/syslog-ng/etc/conf.d/local/config/ cp /opt/syslog-ng/etc/context_templates/* /opt/syslog-ng/etc/conf.d/local/context/ for file in /opt/syslog-ng/etc/conf.d/local/context/*.example ; do cp --verbose -n $file ${file%.example}; done cp --verbose -R /opt/syslog-ng/etc/local_config/* /opt/syslog-ng/etc/conf.d/local/config/ - +mkdir -p /opt/syslog-ng/var/log echo syslog-ng checking config echo sc4s version=$(cat /VERSION) -echo sc4s version=$(cat /VERSION) >/var/log/syslog-ng.out -/opt/syslog-ng/sbin/syslog-ng -s >>/var/log/syslog-ng.out 2>/var/log/syslog-ng.err +echo sc4s version=$(cat /VERSION) >/opt/syslog-ng/var/log/syslog-ng.out +/opt/syslog-ng/sbin/syslog-ng -s >>/opt/syslog-ng/var/log/syslog-ng.out 2>/opt/syslog-ng/var/log/syslog-ng.err echo syslog-ng starting exec /opt/syslog-ng/sbin/syslog-ng $@ diff --git a/test-with-compose.sh b/test-with-compose.sh index 25eeb4f..6ae13ba 100755 --- a/test-with-compose.sh +++ b/test-with-compose.sh @@ -22,11 +22,12 @@ docker container create --name dummy \ docker cp ./splunk/etc/* dummy:/work/splunk-etc/ docker rm dummy -docker-compose -f $compose pull +docker-compose -f $compose pull splunk +docker-compose -f $compose build docker-compose -f $compose up -d splunk docker-compose -f $compose up -d sc4s sleep 60 -docker-compose -f $compose build + docker-compose -f $compose up --abort-on-container-exit --exit-code-from $WAITON docker container create --name dummy \ From da973aecdf71f9144aa309b16a1280938d9b6c28 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 16:24:41 -0500 Subject: [PATCH 002/174] Use test fixtures for port map --- pytest.ini | 8 ++ tests/conftest.py | 167 ++++++++++++++++++++++++++-- tests/docker-compose.yml | 78 +++++++++++++ tests/requirements.txt | 6 +- tests/test_checkpoint.py | 28 ++--- tests/test_cisco_acs.py | 10 +- tests/test_cisco_asa.py | 12 +- tests/test_cisco_ios.py | 4 +- tests/test_cisco_ise.py | 14 +-- tests/test_cisco_meraki.py | 4 +- tests/test_cisco_nx_os.py | 6 +- tests/test_common.py | 32 +++--- tests/test_cyberark.py | 12 +- tests/test_forcepoint_web.py | 4 +- tests/test_fortinet_ngfw.py | 12 +- tests/test_imperva.py | 4 +- tests/test_infoblox.py | 8 +- tests/test_juniper_junos_rfc3164.py | 12 +- tests/test_juniper_junos_rfc5124.py | 12 +- tests/test_juniper_legacy.py | 20 ++-- tests/test_juniper_sslvpn.py | 4 +- tests/test_linux_syslog.py | 16 +-- tests/test_microfocus_arcsight.py | 20 ++-- tests/test_palo_alto.py | 16 +-- tests/test_pfsense.py | 12 +- tests/test_plugin_example.py | 4 +- tests/test_proofpoint.py | 8 +- tests/test_symantec_brightmail.py | 8 +- tests/test_symantec_proxy.py | 4 +- tests/test_ubiquiti_unifi.py | 16 +-- tests/test_vmware.py | 12 +- tests/test_zscaler_proxy.py | 8 +- 32 files changed, 411 insertions(+), 170 deletions(-) create mode 100644 pytest.ini create mode 100644 tests/docker-compose.yml diff --git a/pytest.ini b/pytest.ini new file mode 100644 index 0000000..36a1996 --- /dev/null +++ b/pytest.ini @@ -0,0 +1,8 @@ +[pytest] +testpaths = tests +#addopts = --tb=long +# --force-flaky --max-runs=3 --min-passes=1 +filterwarnings = + ignore::DeprecationWarning +#[pytest] +#junit_family = xunit2 diff --git a/tests/conftest.py b/tests/conftest.py index 7777889..0af909b 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -5,9 +5,11 @@ # https://opensource.org/licenses/BSD-2-Clause import os import random +import socket from time import sleep import pytest +import requests import splunklib.client as client @@ -30,16 +32,167 @@ def get_host_key(setup_wordlist): return host -@pytest.fixture -def setup_splunk(): +def pytest_addoption(parser): + group = parser.getgroup('splunk-addon') + + group.addoption( + '--splunk_app', + action='store', + dest='splunk_app', + default='package', + help='Path to Splunk app' + ) + group.addoption( + '--splunk_type', + action='store', + dest='splunk_type', + default='docker', + help='Type of Splunk' + ) + group.addoption( + '--splunk_host', + action='store', + dest='splunk_host', + default='127.0.0.1', + help='Address of the Splunk Server' + ) + group.addoption( + '--splunk_port', + action='store', + dest='splunk_port', + default='8089', + help='Splunk rest port' + ) + group.addoption( + '--splunk_user', + action='store', + dest='splunk_user', + default='admin', + help='Splunk login user' + ) + group.addoption( + '--splunk_password', + action='store', + dest='splunk_password', + default='changeme', + help='Splunk password' + ) + group.addoption( + '--splunk_version', + action='store', + dest='splunk_version', + default='latest', + help='Splunk password' + ) + + +def is_responsive(url): + try: + response = requests.get(url) + if response.status_code != 500: + return True + except ConnectionError: + return False + + +def is_responsive_splunk(splunk): + try: + client.connect(username=splunk['username'], password=splunk['password'], host=splunk['host'], + port=splunk['port']) + return True + except Exception: + return False + + +@pytest.fixture(scope="session") +def splunk(request): + if request.config.getoption('splunk_type') == 'external': + request.fixturenames.append('splunk_external') + splunk = request.getfixturevalue("splunk_external") + elif request.config.getoption('splunk_type') == 'docker': + os.environ['splunk_version'] = request.config.getoption('splunk_version') + request.fixturenames.append('splunk_docker') + splunk = request.getfixturevalue("splunk_docker") + else: + raise Exception + + yield splunk + + +@pytest.fixture(scope="session") +def sc4s(request): + if request.config.getoption('splunk_type') == 'external': + request.fixturenames.append('sc4s_external') + splunk = request.getfixturevalue("sc4s_external") + elif request.config.getoption('splunk_type') == 'docker': + request.fixturenames.append('sc4s_docker') + splunk = request.getfixturevalue("sc4s_docker") + else: + raise Exception + + yield splunk + + +@pytest.fixture(scope="session") +def splunk_docker(request, docker_services, docker_ip): + port = docker_services.port_for("splunk", 8089) + + splunk = { + 'host': docker_ip, + 'port': port, + 'username': request.config.getoption('splunk_user'), + 'password': request.config.getoption('splunk_password'), + } + + docker_services.wait_until_responsive( + timeout=180.0, pause=0.5, check=lambda: is_responsive_splunk(splunk) + ) + + return splunk + + +@pytest.fixture(scope="session") +def splunk_external(request): + splunk = { + 'host': request.config.getoption('splunk_host'), + 'port': request.config.getoption('splunk_port'), + 'username': request.config.getoption('splunk_user'), + 'password': request.config.getoption('splunk_password'), + } + return splunk + + +@pytest.fixture(scope="session") +def sc4s_docker(request, docker_services, docker_ip): + ports = { 514: docker_services.port_for("sc4s", 514) } + for x in range(5000, 5050): + ports.update({ x: docker_services.port_for("splunk", 8089)}) + + return docker_ip, ports + + +@pytest.fixture(scope="session") +def sc4s_external(request): + ports = {514: 514} + for x in range(5000, 5050): + ports.update({x: x}) + + return request.config.getoption('sc4s_host'), ports + + +@pytest.fixture() +def setup_sc4s(sc4s): + return sc4s + + +@pytest.fixture(scope="session") +def setup_splunk(splunk): tried = 0 - username = os.getenv('SPLUNK_USER', "admin") - password = os.getenv('SPLUNK_PASSWORD', "Changed@11") - host = os.getenv('SPLUNK_HOST', "splunk") - port = os.getenv('SPLUNK_PORT', "8089") + while True: try: - c = client.connect(username=username, password=password, host=host, port=port) + c = client.connect(username=splunk['username'], password=splunk['password'], host=splunk['host'], + port=splunk['port']) break except ConnectionRefusedError: tried += 1 diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml new file mode 100644 index 0000000..5701d92 --- /dev/null +++ b/tests/docker-compose.yml @@ -0,0 +1,78 @@ +#Splunk Connect for Syslog (SC4S) by Splunk, Inc. +# +#To the extent possible under law, the person who associated CC0 with +#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights +#to Splunk Connect for Syslog (SC4S). +# +#You should have received a copy of the CC0 legalcode along with this +#work. If not, see . +version: "3.7" +services: + test: + build: . + + links: + - splunk + - sc4s + environment: + - SPLUNK_USER=admin + - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} + - SPLUNK_HOST=splunk + - SYSLOG_HOST=sc4s + + sc4s: + build: + context: ../package + hostname: sc4s + #When this is enabled test_common will fail + # command: -det + ports: + - "514" + - "601" + - "514/udp" + - "5000-5050" + - "5000-5200/udp" + - "6514" + stdin_open: true + tty: true + links: + - splunk + environment: + - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SC4S_SOURCE_TLS_ENABLE=no + - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no + # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 + # - SC4S_LISTEN_DEFAULT_UDP_PORT=514 + # - SC4S_LISTEN_DEFAULT_TLS_PORT=6514 + - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 + - SC4S_LISTEN_CISCO_ASA_TCP_PORT=5001 + - SC4S_LISTEN_CISCO_IOS_TCP_PORT=5002 + - SC4S_LISTEN_CISCO_MERAKI_TCP_PORT=5003 + - SC4S_LISTEN_JUNIPER_IDP_TCP_PORT=5004 + - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 + - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 + - SC4S_ARCHIVE_GLOBAL=yes + # - SC4S_SOURCE_STORE_RAWMSG=yes + volumes: + - ./tls:/opt/syslog-ng/tls + splunk: + image: splunk/splunk:latest + hostname: splunk + ports: + - "8000" + - "8088" + - "8089" + environment: + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} + - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} + - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} + - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} + - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} + volumes: + - splunk-etc:/opt/splunk/etc + +volumes: + splunk-etc: + external: true diff --git a/tests/requirements.txt b/tests/requirements.txt index df09269..9eb0109 100644 --- a/tests/requirements.txt +++ b/tests/requirements.txt @@ -13,5 +13,7 @@ splunk-sdk flake8 pytz flaky -#pytest-randomly -pytest-parallel +pytest +pytest-docker +pathlib2 +psutil \ No newline at end of file diff --git a/tests/test_checkpoint.py b/tests/test_checkpoint.py index c9adef0..bd5e13f 100644 --- a/tests/test_checkpoint.py +++ b/tests/test_checkpoint.py @@ -14,14 +14,14 @@ # #Oct 8 15:00:25 DEVICENAME time=1570561225|hostname=devicename|severity=Informational|confidence_level=Unknown|product=IPS|action=Drop|ifdir=inbound|ifname=bond2|loguid={0x5d9cdcc9,0x8d159f,0x5f19f392,0x1897a828}|origin=1.1.1.1|time=1570561225|version=1|attack=Streaming Engine: TCP Segment Limit Enforcement|attack_info=TCP segment out of maximum allowed sequence. Packet dropped.|chassis_bladed_system=[ 1_3 ]|dst=10.10.10.10|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|performance_impact=0|protection_id=tcp_segment_limit|protection_name=TCP Segment Limit Enforcement|protection_type=settings_tcp|proto=6|rule=393|rule_name=10.384_..|rule_uid={9F77F944-8DD5-4ADF-803A-785D03B3A2E8}|s_port=46455|service=443|smartdefense_profile=Recommended_Protection_ded9e8d8ee89d|src=1.1.1.2| -def test_checkpoint_splunk_ips(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_ips(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} time={% now 'utc', '%s' %}|hostname={{ host }}|severity=Informational|confidence_level=Unknown|product=IPS|action=Drop|ifdir=inbound|ifname=bond2|loguid={0x5d9cdcc9,0x8d159f,0x5f19f392,0x1897a828}|origin=1.1.1.1|time={% now 'utc', '%s' %}|version=1|attack=Streaming Engine: TCP Segment Limit Enforcement|attack_info=TCP segment out of maximum allowed sequence. Packet dropped.|chassis_bladed_system=[ 1_3 ]|dst=10.10.10.10|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|performance_impact=0|protection_id=tcp_segment_limit|protection_name=TCP Segment Limit Enforcement|protection_type=settings_tcp|proto=6|rule=393|rule_name=10.384_..|rule_uid={9F77F944-8DD5-4ADF-803A-785D03B3A2E8}|s_port=46455|service=443|smartdefense_profile=Recommended_Protection_ded9e8d8ee89d|src=1.1.1.2|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -35,14 +35,14 @@ def test_checkpoint_splunk_ips(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #$Oct 8 15:48:31 DEVICENAME time=1570564111|hostname=devicename|product=Firewall|action=Drop|ifdir=inbound|ifname=bond1|loguid={0x5d9ce80f,0x8d0555,0x5f19f392,0x18982828}|origin=1.1.1.1|time=1570564111|version=1|chassis_bladed_system=[ 1_1 ]|dst=10.10.10.10|inzone=External|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|outzone=Internal|proto=6|rule=402|rule_name=11_..|rule_uid={C8CD796E-7BD5-47B6-90CA-B250D062D5E5}|s_port=33687|service=23|src=1.1.1.2| -def test_checkpoint_splunk_firewall(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_firewall(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} time={% now 'utc', '%s' %}|hostname={{ host }}|product=Firewall|action=Drop|ifdir=inbound|ifname=bond1|loguid={0x5d9ce80f,0x8d0555,0x5f19f392,0x18982828}|origin=1.1.1.1|time={% now 'utc', '%s' %}|version=1|chassis_bladed_system=[ 1_1 ]|dst=10.10.10.10|inzone=External|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|outzone=Internal|proto=6|rule=402|rule_name=11_..|rule_uid={C8CD796E-7BD5-47B6-90CA-B250D062D5E5}|s_port=33687|service=23|src=1.1.1.2|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -56,14 +56,14 @@ def test_checkpoint_splunk_firewall(record_property, setup_wordlist, setup_splun assert resultCount == 1 #Oct 9 12:01:16 DEVICENAME |hostname=DEVICENAME|product=mds-query-tool|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time=1570641309|version=5|administrator=localhost|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login| -def test_checkpoint_splunk_mds(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_mds(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} |hostname={{ host }}|time={% now 'utc', '%s' %}|product=mds-query-tool|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time={% now 'utc', '%s' %}|version=5|administrator=localhost|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -77,14 +77,14 @@ def test_checkpoint_splunk_mds(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #Oct 9 12:01:16 DEVICENAME|hostname=DEVICENAME|product=CPMI Client|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time=1570641173|version=5|administrator=localhost|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login -def test_checkpoint_splunk_cpmi(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_cpmi(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} |hostname={{ host }}|product=CPMI Client|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time={% now 'utc', '%s' %}|version=5|administrator=localhost|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -98,14 +98,14 @@ def test_checkpoint_splunk_cpmi(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #Oct 9 12:01:16 DEVICENAME |hostname=DEVICENAME|product=WEB_API|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time=1570640578|version=5|administrator=tufinapi|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login -def test_checkpoint_splunk_web_api(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_web_api(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} |hostname={{ host }}|product=WEB_API|action=Accept|ifdir=outbound|origin=1.1.1.1|2.2.2.2|originsicname=cn\=cp_mgmt,o\=DEVICENAME.domain.com.p7fdbt|sequencenum=1|time={% now 'utc', '%s' %}|version=5|administrator=tufinapi|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log Out|operation_number=12|subject=Administrator Login\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -119,14 +119,14 @@ def test_checkpoint_splunk_web_api(record_property, setup_wordlist, setup_splunk assert resultCount == 1 #Oct 9 11:05:15 DEVICENAME time=1570633513|hostname=DEVICENAME|product=SmartConsole|action=Accept|ifdir=outbound|origin=1.1.1.1|4.4.4.4|sequencenum=1|time=1570633513|version=5|additional_info=Authentication method: Password based application token|administrator=psanadhya|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log In|operation_number=10|subject=Administrator Login| -def test_checkpoint_splunk_smartconsole(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_smartconsole(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} time={% now 'utc', '%s' %}|hostname={{ host }}|product=SmartConsole|action=Accept|ifdir=outbound|origin=1.1.1.1|4.4.4.4|sequencenum=1|time={% now 'utc', '%s' %}|version=5|additional_info=Authentication method: Password based application token|administrator=psanadhya|client_ip=3.3.3.3|machine=DEVICENAME|operation=Log In|operation_number=10|subject=Administrator Login|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) @@ -141,7 +141,7 @@ def test_checkpoint_splunk_smartconsole(record_property, setup_wordlist, setup_s #<6>kernel: sd 2:0:0:0: SCSI error: return code = 0x00040000 -def test_checkpoint_splunk_os(record_property, setup_wordlist, setup_splunk): +def test_checkpoint_splunk_os(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) @@ -150,7 +150,7 @@ def test_checkpoint_splunk_os(record_property, setup_wordlist, setup_splunk): "{{ mark }}kernel: sd 2:0:0:0: SCSI error: return code = 0x{{pid}}\n") message = mt.render(mark="<6>", pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=osnix \"0x{{ pid }}\" sourcetype=\"nix:syslog\" | head 2") search = st.render(pid=pid) diff --git a/tests/test_cisco_acs.py b/tests/test_cisco_acs.py index 29bf81f..190e985 100644 --- a/tests/test_cisco_acs.py +++ b/tests/test_cisco_acs.py @@ -13,13 +13,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) -def test_cisco_acs_single(record_property, setup_wordlist, setup_splunk): +def test_cisco_acs_single(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CSCOacs_Passed_Authentications 0765855540 1 0 2019-10-24 21:01:05.028 +00:00 0178632943 5202 NOTICE Device-Administration: Command Authorization succeeded, ACSVersion=acs-5.8.1.4-B.462.x86_64, ConfigVersionId=16489, Device IP Address=10.0.0.93, DestinationIPAddress=10.0.0.10, DestinationPort=49, UserName=nsdevman, CmdSet=[ CmdAV=show CmdArgAV=vpn-sessiondb CmdArgAV=full CmdArgAV=ra-ikev2-ipsec ], Protocol=Tacacs, MatchedCommandSet=fw3, RequestLatency=11, Type=Authorization, Privilege-Level=15, Authen-Type=ASCII, Service=None, User=nsdevman, Port=443, Remote-Address=10.0.0.15, Authen-Method=TacacsPlus, Service-Argument=shell, AcsSessionID=mnsvdcfpiuac03/359448835/9871764, AuthenticationIdentityStore=AD1, AuthenticationMethod=Lookup, SelectedAccessService=Default Device Admin, SelectedCommandSet=fw3, IdentityGroup=IdentityGroup:All Groups:SystemID, Step=13005 , Step=15008 , Step=15004 , Step=15012 , Step=15041 , Step=15004 , Step=15013 , Step=24210 , Step=24212 , Step=24432 , Step=24325 , Step=24313 , Step=24319 , Step=24323 , Step=24420 , Step=24355 , Step=24416 , Step=22037 , Step=15044 , Step=15035 , Step=15042 , Step=15036 , Step=15004 , Step=15018 , Step=13024 , Step=13034 , SelectedAuthenticationIdentityStores=Internal Users, NetworkDeviceName=devicenamehere, NetworkDeviceGroups=Device Type:All Device Types:Firewall:Cisco Systems:Firewall:ASA5545, NetworkDeviceGroups=Location:All Locations:MN, ServiceSelectionMatchedRule=TACACS, IdentityPolicyMatchedRule=Firewall, AuthorizationPolicyMatchedRule=nsdevman, AD-User-Candidate-Identities=nsdevman@ent.example.corp, AD-User-DNS-Domain=ent.example.corp, AD-User-NetBios-Name=AD-ENT, AD-User-Resolved-Identities=nsdevman@ent.example.corp, AD-User-Join-Point=ENT.example.CORP, AD-User-Resolved-DNs=CN=nsdevman\,OU=Service Accounts\,OU=CAO\,OU=ENT\,DC=ent\,DC=wfb\,DC=example\,DC=corp, StepData=10=nsdevman, StepData=11=ent.example.corp, StepData=12=example.corp, StepData=15=ent.example.corp, AD-Domain=ent.example.corp, IdentityAccessRestricted=false, UserIdentityGroup=IdentityGroup:All Groups:SystemID, Cisco-Firewall=Superuser, Firewall=Superuser, NetSec-CSM=User, NetSec-Logging=Engineer, Response={Type=Authorization; Author-Reply-Status=PassAdd; ExternalIdentityStoreName=AD1; }\n") message = mt.render(mark="<165>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cisco:acs\" | head 11") search = st.render(host=host) @@ -32,18 +32,18 @@ def test_cisco_acs_single(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_cisco_acs_multi(record_property, setup_wordlist, setup_splunk): +def test_cisco_acs_multi(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CSCOacs_Passed_Authentications 0000000002 2 0 2011-08-01 22:32:53.032 +00:00 0000008450 5203 NOTICE Device-Administration: Session Authorization succeeded, ACSVersion=acs-5.2.0.26-B.3075, ConfigVersionId=117, Device IP Address=192.168.26.137, UserName=edward, CmdSet=[ CmdAV= ], Protocol=Tacacs, RequestLatency=10, NetworkDeviceName=switch, Type=Authorization, Privilege-Level=1, Authen-Type=ASCII, Service=Login, User=edward, Port=tty2, Remote-Address=10.78.167.190, Authen-Method=TacacsPlus, Service-Argument=shell, AcsSessionID=ACS41/101085887/112, AuthenticationIdentityStore=Internal Users, AuthenticationMethod=Lookup, SelectedAccessService=Default Device Admin, SelectedShellProfile=Permit Access, IdentityGroup=IdentityGroup:All Groups, Step=13005 , Step=15008 , Step=15004 , Step=15012 , Step=15041 , Step=15006 , Step=15013 , Step=24210 , Step=24212 , Step=22037 , Step=15044 , Step=15035 , Step=15042 , Step=15036 , Step=15004 , Step=15017 , Step=13034 ,\n") message = mt.render(mark="<165>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CSCOacs_Passed_Authentications 0000000002 2 1 Step=13015 , SelectedAuthenticationIdentityStores=Internal Users, NetworkDeviceGroups=s1Migrated_NDGs:All s1Migrated_NDGs, NetworkDeviceGroups=Device Type:All Device Types, NetworkDeviceGroups=Location:All Locations, ServiceSelectionMatchedRule=Rule-2, IdentityPolicyMatchedRule=Default, AuthorizationPolicyMatchedRule=Rule-0, Action=Login, Privilege-Level=1, Authen-Type=ASCII, Service=Login, Remote-Address=10.78.167.190, UserIdentityGroup=IdentityGroup:All\n") message = mt.render(mark="<165>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cisco:acs\" \"Step=13015\" | head 11") search = st.render(host=host) diff --git a/tests/test_cisco_asa.py b/tests/test_cisco_asa.py index 6bcd920..edc2389 100644 --- a/tests/test_cisco_asa.py +++ b/tests/test_cisco_asa.py @@ -16,14 +16,14 @@ # Apr 15 2017 00:21:14 192.168.12.1 : %ASA-5-111010: User 'john', running 'CLI' from IP 0.0.0.0, executed 'dir disk0:/dap.xml' # Apr 15 2017 00:22:27 192.168.12.1 : %ASA-4-313005: No matching connection for ICMP error message: icmp src outside:81.24.28.226 dst inside:72.142.17.10 (type 3, code 0) on outside interface. Original IP payload: udp src 72.142.17.10/40998 dst 194.153.237.66/53. # Apr 15 2017 00:22:42 192.168.12.1 : %ASA-3-710003: TCP access denied by ACL from 179.236.133.160/8949 to outside:72.142.18.38/23 -def test_cisco_asa_traditional(record_property, setup_wordlist, setup_splunk): +def test_cisco_asa_traditional(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} : %ASA-3-003164: TCP access denied by ACL from 179.236.133.160/3624 to outside:72.142.18.38/23\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"cisco:asa\" \"%ASA-3-003164\" | head 2") search = st.render(host=host) @@ -37,14 +37,14 @@ def test_cisco_asa_traditional(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 # <164>Jan 31 2020 17:24:03: %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0C190BF9, sequence number= 0x598243) from 192.0.0.1 (user= 192.0.0.1) to 192.0.0.2 that failed anti-replay checking. -def test_cisco_asa_traditional_nohost(record_property, setup_wordlist, setup_splunk): +def test_cisco_asa_traditional_nohost(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %}: %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0C190BF9, sequence number= 0x598243) from {host} (user= 192.0.0.1) to 192.0.0.2 that failed anti-replay checking.\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw sourcetype=\"cisco:asa\" \"%ASA-4-402119\" \"{host}\" | head 2") search = st.render(host=host) @@ -59,14 +59,14 @@ def test_cisco_asa_traditional_nohost(record_property, setup_wordlist, setup_spl # <166>2018-06-27T12:17:46Z asa : %ASA-3-710003: TCP access denied by ACL from 179.236.133.160/8949 to outside:72.142.18.38/23 -def test_cisco_asa_rfc5424(record_property, setup_wordlist, setup_splunk): +def test_cisco_asa_rfc5424(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%SZ' %} {{ host }} : %ASA-3-005424: TCP access denied by ACL from 179.236.133.160/5424 to outside:72.142.18.38/23\n") message = mt.render(mark="<166>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"cisco:asa\" \"%ASA-3-005424\"| head 2") search = st.render(host=host) diff --git a/tests/test_cisco_ios.py b/tests/test_cisco_ios.py index 13ec3f5..f3c3046 100644 --- a/tests/test_cisco_ios.py +++ b/tests/test_cisco_ios.py @@ -13,14 +13,14 @@ # <190>30: foo: *Apr 29 13:58:46.411: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.1.239 stopped - CLI initiated -def test_cisco_ios(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_cisco_ios(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }}{{ seq }}: {{ host }}: *{% now 'utc', '%b %d %H:%M:%S' %}.100: CET: %SEC-6-IPACCESSLOGP: list 110 denied tcp 54.122.123.124(8932) -> 10.1.0.1(22), 1 packet\n") message = mt.render(mark="<166>", seq=20, host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cisco:ios\" | head 2") search = st.render(host=host) diff --git a/tests/test_cisco_ise.py b/tests/test_cisco_ise.py index 0093686..000e5fb 100644 --- a/tests/test_cisco_ise.py +++ b/tests/test_cisco_ise.py @@ -17,28 +17,28 @@ #<165>Apr 24 15:00:48 ICDC-ISE03 CISE_Passed_Authentications 0001939187 4 2 PostureAssessmentStatus=NotApplicable, EndPointMatchedProfile=Unknown, DeviceRegistrationStatus=notRegistered, ISEPolicySetName=Wired MAB, IdentitySelectionMatchedRule=Default, StepData=5= Aruba.Aruba-Essid-Name, StepData=6= DEVICE.Device Type, StepData=8=Internal Endpoints, StepData=14= EndPoints.LogicalProfile, StepData=15= Network Access.Protocol, allowEasyWiredSession=false, DTLSSupport=Unknown, HostIdentityGroup=Endpoint Identity Groups:Unknown, Network Device Profile=Cisco, Location=Location#All Locations#Provo, Device Type=Device Type#All Device Types#Switches, Migrated NDGs=Migrated NDGs#All Migrated NDGs, Name=Endpoint Identity Groups:Unknown, #<165>Apr 24 15:00:48 ICDC-ISE03 CISE_Passed_Authentications 0001939187 4 3 Response={UserName=90:1B:0E:34:EA:92; User-Name=90-1B-0E-34-EA-92; State=ReauthSession:0A06400F000006AA6F83C371; Class=CACS:0A06400F000006AA6F83C371:ICDC-ISE03/341048949/1407358; Session-Timeout=300; Idle-Timeout=240; Termination-Action=RADIUS-Request; cisco-av-pair=url-redirect-acl=ACL-WEBAUTH-REDIRECT; cisco-av-pair=url-redirect=https://ICDC-ISE03.example.com:8443/portal/gateway?sessionId=0A06400F000006AA6F83C371&portal=c5a76cb0-6150-11e5-b062-0050568d954e&action=cwa&type=drw&token=6ded1943789b345f7afdd09e91549047; cisco-av-pair=profile-name=Unknown; LicenseTypes=1; }, -def test_cisco_ise(record_property, setup_wordlist, setup_splunk): +def test_cisco_ise(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CISE_Passed_Authentications 0001939187 4 0 {% now 'utc', '%Y-%m-%d %H:%M:%S' %}.610 +00:00 0042009748 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=128, Device IP Address=10.6.64.15, DestinationIPAddress=10.16.20.23, DestinationPort=1812, UserName=90-1B-0E-34-EA-92, Protocol=Radius, RequestLatency=8, NetworkDeviceName=ICPAV2-SW15, User-Name=901b0e34ea92, NAS-IP-Address=10.6.64.15, NAS-Port=50104, Service-Type=Call Check, Framed-IP-Address=10.6.226.138, Framed-MTU=1500, Called-Station-ID=B0-FA-EB-11-70-04, Calling-Station-ID=90-1B-0E-34-EA-92, NAS-Port-Type=Ethernet, NAS-Port-Id=GigabitEthernet0/4, EAP-Key-Name=, cisco-av-pair=service-type=Call Check, cisco-av-pair=audit-session-id=0A06400F000006AA6F83C371, cisco-av-pair=method=mab, OriginalUserName=901b0e34ea92, NetworkDeviceProfileName=Cisco, NetworkDeviceProfileId=b2652f13-5b3f-41ba-ada2-8385c8870809, IsThirdPartyDeviceFlow=false, RadiusFlowType=WiredMAB, SSID=B0-FA-EB-11-70-04,\n") message = mt.render(mark="<165>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CISE_Passed_Authentications 0001939187 4 1 AcsSessionID=ICDC-ISE03/341048949/1407358, AuthenticationIdentityStore=Internal Endpoints, AuthenticationMethod=Lookup, SelectedAccessService=Default Network Access, SelectedAuthorizationProfiles=WIRED_GUEST_REDIRECT, UseCase=Host Lookup, IdentityGroup=Endpoint Identity Groups:Unknown, Step=11001, Step=11017, Step=11027, Step=15049, Step=15008, Step=15048, Step=15048, Step=15041, Step=15013, Step=24209, Step=24211, Step=22037, Step=24715, Step=15036, Step=15048, Step=15048, Step=15016, Step=11002, SelectedAuthenticationIdentityStores=Internal Endpoints, AuthenticationStatus=AuthenticationPassed, NetworkDeviceGroups=Location#All Locations#Provo, NetworkDeviceGroups=Device Type#All Device Types#Switches, NetworkDeviceGroups=Migrated NDGs#All Migrated NDGs, IdentityPolicyMatchedRule=Default, AuthorizationPolicyMatchedRule=Guest Web Auth, UserType=Host, CPMSessionID=0A06400F000006AA6F83C371, EndPointMACAddress=90-1B-0E-34-EA-92,\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CISE_Passed_Authentications 0001939187 4 2 PostureAssessmentStatus=NotApplicable, EndPointMatchedProfile=Unknown, DeviceRegistrationStatus=notRegistered, ISEPolicySetName=Wired MAB, IdentitySelectionMatchedRule=Default, StepData=5= Aruba.Aruba-Essid-Name, StepData=6= DEVICE.Device Type, StepData=8=Internal Endpoints, StepData=14= EndPoints.LogicalProfile, StepData=15= Network Access.Protocol, allowEasyWiredSession=false, DTLSSupport=Unknown, HostIdentityGroup=Endpoint Identity Groups:Unknown, Network Device Profile=Cisco, Location=Location#All Locations#Provo, Device Type=Device Type#All Device Types#Switches, Migrated NDGs=Migrated NDGs#All Migrated NDGs, Name=Endpoint Identity Groups:Unknown,\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CISE_Passed_Authentications 0001939187 4 3 Response={UserName=90:1B:0E:34:EA:92; User-Name=90-1B-0E-34-EA-92; State=ReauthSession:0A06400F000006AA6F83C371; Class=CACS:0A06400F000006AA6F83C371:ICDC-ISE03/341048949/1407358; Session-Timeout=300; Idle-Timeout=240; Termination-Action=RADIUS-Request; cisco-av-pair=url-redirect-acl=ACL-WEBAUTH-REDIRECT; cisco-av-pair=url-redirect=https://ICDC-ISE03.example.com:8443/portal/gateway?sessionId=0A06400F000006AA6F83C371&portal=c5a76cb0-6150-11e5-b062-0050568d954e&action=cwa&type=drw&token=6ded1943789b345f7afdd09e91549047; cisco-av-pair=profile-name=Unknown; LicenseTypes=1; },\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cisco:ise:syslog\" | head 11") search = st.render(host=host) @@ -52,13 +52,13 @@ def test_cisco_ise(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<181>Oct 24 21:00:02 ciscohost CISE_RADIUS_Accounting 0006028545 1 0 2019-10-24 21:00:02.879 +00:00 0088472694 3002 NOTICE Radius-Accounting: RADIUS Accounting watchdog update, ConfigVersionId=336, Device IP Address=10.0.0.3, RequestLatency=3, NetworkDeviceName=nc-aaa-aaa1, User-Name=U100000.ent.corp, NAS-IP-Address=10.0.0.3, NAS-Port=50047, Service-Type=Framed, Framed-IP-Address=10.0.0.80, Class=CACS:0AEF12345677832097B3F362:ncsilsepsuie212/356139633/9969901, Called-Station-ID=00-08-00-00-1B-AF, Calling-Station-ID=00-00-00-00-A0-7E, Acct-Status-Type=Interim-Update, Acct-Delay-Time=0, Acct-Input-Octets=653293631, Acct-Output-Octets=1497972244, Acct-Session-Id=00000B68, Acct-Authentic=RADIUS, Acct-Session-Time=241598, Acct-Input-Packets=2656224, Acct-Output-Packets=7614179, Acct-Input-Gigawords=0, Acct-Output-Gigawords=1, NAS-Port-Type=Ethernet, NAS-Port-Id=FastEthernet0/47, undefined-151=31D7AADD, cisco-av-pair=audit-session-id=0AEF10030000032097B3F362, cisco-av-pair=connect-progress=Auth Open, AcsSessionID=ncsilsepsuie205/359238109/4017186, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=22094, Step=11005, NetworkDeviceGroups=Location#All Locations#NC, NetworkDeviceGroups=Device Type#All Device Types#Switch#2960-Switches, NetworkDeviceGroups=All Network Device Groups#All Network Device Groups, CPMSessionID=0AEF10030000032097B3F362, AllowedProtocolMatchedRule=EAP-TLS, All Network Device Groups=All Network Device Groups#All Network Device Groups, Location=Location#All Locations#NC, Device Type=Device Type#All Device Types#Switch#2960-Switches, Network Device Profile=Cisco, -def test_cisco_ise_single(record_property, setup_wordlist, setup_splunk): +def test_cisco_ise_single(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CISE_RADIUS_Accounting 0006028545 1 0 2019-10-24 21:00:02.879 +00:00 0088472694 3002 NOTICE Radius-Accounting: RADIUS Accounting watchdog update, ConfigVersionId=336, Device IP Address=10.0.0.3, RequestLatency=3, NetworkDeviceName=nc-aaa-aaa1, User-Name=U100000.ent.corp, NAS-IP-Address=10.0.0.3, NAS-Port=50047, Service-Type=Framed, Framed-IP-Address=10.0.0.80, Class=CACS:0AEF12345677832097B3F362:ncsilsepsuie212/356139633/9969901, Called-Station-ID=00-08-00-00-1B-AF, Calling-Station-ID=00-00-00-00-A0-7E, Acct-Status-Type=Interim-Update, Acct-Delay-Time=0, Acct-Input-Octets=653293631, Acct-Output-Octets=1497972244, Acct-Session-Id=00000B68, Acct-Authentic=RADIUS, Acct-Session-Time=241598, Acct-Input-Packets=2656224, Acct-Output-Packets=7614179, Acct-Input-Gigawords=0, Acct-Output-Gigawords=1, NAS-Port-Type=Ethernet, NAS-Port-Id=FastEthernet0/47, undefined-151=31D7AADD, cisco-av-pair=audit-session-id=0AEF10030000032097B3F362, cisco-av-pair=connect-progress=Auth Open, AcsSessionID=ncsilsepsuie205/359238109/4017186, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=22094, Step=11005, NetworkDeviceGroups=Location#All Locations#NC, NetworkDeviceGroups=Device Type#All Device Types#Switch#2960-Switches, NetworkDeviceGroups=All Network Device Groups#All Network Device Groups, CPMSessionID=0AEF10030000032097B3F362, AllowedProtocolMatchedRule=EAP-TLS, All Network Device Groups=All Network Device Groups#All Network Device Groups, Location=Location#All Locations#NC, Device Type=Device Type#All Device Types#Switch#2960-Switches, Network Device Profile=Cisco,\n") message = mt.render(mark="<165>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cisco:ise:syslog\" | head 11") search = st.render(host=host) diff --git a/tests/test_cisco_meraki.py b/tests/test_cisco_meraki.py index 920714a..34adcbc 100644 --- a/tests/test_cisco_meraki.py +++ b/tests/test_cisco_meraki.py @@ -13,14 +13,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<134>1 1563249630.774247467 devicename security_event ids_alerted signature=1:28423:1 priority=1 timestamp=1468531589.810079 dhost=98:5A:EB:E1:81:2F direction=ingress protocol=tcp/ip src=151.101.52.238:80 dst=192.168.128.2:53023 message: EXPLOIT-KIT Multiple exploit kit single digit exe detection -def test_cisco_meraki_security_event(record_property, setup_wordlist, setup_splunk): +def test_cisco_meraki_security_event(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}1 {% now 'utc', '%s' %}.123456789 testcm-{{ host }} security_event ids_alerted signature=1:28423:1 priority=1 timestamp={% now 'utc', '%s' %}.123456 dhost=98:5A:EB:E1:81:2F direction=ingress protocol=tcp/ip src=151.101.52.238:80 dst=192.168.128.2:53023 message: EXPLOIT-KIT Multiple exploit kit single digit exe detection\n") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"testcm-{{ host }}\" sourcetype=\"meraki\" | head 2") search = st.render(host=host) diff --git a/tests/test_cisco_nx_os.py b/tests/test_cisco_nx_os.py index 27b1155..f9c267d 100644 --- a/tests/test_cisco_nx_os.py +++ b/tests/test_cisco_nx_os.py @@ -12,14 +12,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) # Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online -def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} csconx-{{ host }} %MODULE-5-MOD_OK: Module 1 is online") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"csconx-{{ host }}\" sourcetype=\"cisco:ios\" | head 2") search = st.render(host=host) @@ -34,7 +34,7 @@ def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk # Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online # @pytest.mark.xfail -#def test_cisco_nx_os_singleport(record_property, setup_wordlist, get_host_key, setup_splunk): +#def test_cisco_nx_os_singleport(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): # host = get_host_key # # mt = env.from_string( diff --git a/tests/test_common.py b/tests/test_common.py index 11912b5..ea82d77 100644 --- a/tests/test_common.py +++ b/tests/test_common.py @@ -14,13 +14,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) -def test_defaultroute(record_property, setup_wordlist, setup_splunk): +def test_defaultroute(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} test something else\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"sc4s:fallback\" PROGRAM=\"test\" | head 2") search = st.render(host=host) @@ -33,13 +33,13 @@ def test_defaultroute(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_internal(record_property, setup_wordlist, setup_splunk): +def test_internal(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} sc4sdefault[0]: test\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main NOT host=\"{{ host }}\" sourcetype=\"sc4s:events\" | head 1") search = st.render(host=host) @@ -52,13 +52,13 @@ def test_internal(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_fallback(record_property, setup_wordlist, setup_splunk): +def test_fallback(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} testvp-{{ host }} test\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"testvp-{{ host }}\" sourcetype=\"sc4s:fallback\" | head 2") search = st.render(host=host) @@ -72,7 +72,7 @@ def test_fallback(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 # -def test_metrics(record_property, setup_wordlist, setup_splunk): +def test_metrics(record_property, setup_wordlist, setup_splunk, setup_sc4s): st = env.from_string('mcatalog values(metric_name) WHERE metric_name="syslogng.d_*#0" AND ("index"="*" OR "index"="_*") BY index | fields index') search = st.render() @@ -83,7 +83,7 @@ def test_metrics(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_tz_guess(record_property, setup_wordlist, setup_splunk): +def test_tz_guess(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) @@ -91,7 +91,7 @@ def test_tz_guess(record_property, setup_wordlist, setup_splunk): "{{ mark }} {% now 'America/Los_Angeles', '%b %d %H:%M:%S' %} {{ host }} : %ASA-3-003164: TCP access denied by ACL from 179.236.133.160/3624 to outside:72.142.18.38/23\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"cisco:asa\" \"%ASA-3-003164\" | head 2") search = st.render(host=host) @@ -105,7 +105,7 @@ def test_tz_guess(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_tz_fix_hst(record_property, setup_wordlist, setup_splunk): +def test_tz_fix_hst(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) @@ -114,7 +114,7 @@ def test_tz_fix_hst(record_property, setup_wordlist, setup_splunk): "{{ mark }} {{ dt }} tzfhst-{{ host }} : %ASA-3-003164: TCP access denied by ACL from 179.236.133.160/3624 to outside:72.142.18.38/23\n") message = mt.render(mark="<111>", host=host, dt=dt.strftime('%b %d %H:%M:%S')) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"tzfhst-{{ host }}\" sourcetype=\"cisco:asa\"") search = st.render(host=host) @@ -127,7 +127,7 @@ def test_tz_fix_hst(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_tz_fix_ny(record_property, setup_wordlist, setup_splunk): +def test_tz_fix_ny(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) @@ -137,7 +137,7 @@ def test_tz_fix_ny(record_property, setup_wordlist, setup_splunk): "{{ mark }} {{ dt }} tzfny-{{ host }} : %ASA-3-003164: TCP access denied by ACL from 179.236.133.160/3624 to outside:72.142.18.38/23\n") message = mt.render(mark="<111>", host=host, dt=dt.strftime('%b %d %H:%M:%S')) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"tzfny-{{ host }}\" sourcetype=\"cisco:asa\"") search = st.render(host=host) @@ -151,7 +151,7 @@ def test_tz_fix_ny(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_check_config_version(record_property, setup_wordlist, setup_splunk): +def test_check_config_version(record_property, setup_wordlist, setup_splunk, setup_sc4s): st = env.from_string("search index=main sourcetype=\"sc4s:events:startup:err\" \"Configuration file format is too old\" ") search = st.render() @@ -162,7 +162,7 @@ def test_check_config_version(record_property, setup_wordlist, setup_splunk): assert resultCount == 0 -def test_check_config_version_multiple(record_property, setup_wordlist, setup_splunk): +def test_check_config_version_multiple(record_property, setup_wordlist, setup_splunk, setup_sc4s): st = env.from_string("search index=main sourcetype=\"sc4s:events:startup:err\" \"you have multiple @version directives\" ") search = st.render() @@ -173,7 +173,7 @@ def test_check_config_version_multiple(record_property, setup_wordlist, setup_sp assert resultCount == 0 -def test_check_sc4s_version(record_property, setup_wordlist, setup_splunk): +def test_check_sc4s_version(record_property, setup_wordlist, setup_splunk, setup_sc4s): st = env.from_string("search index=main sourcetype=\"sc4s:events:startup:out\" \"sc4s version=\" NOT \"UNKNOWN\"") search = st.render() diff --git a/tests/test_cyberark.py b/tests/test_cyberark.py index c8ac7ba..5380d92 100644 --- a/tests/test_cyberark.py +++ b/tests/test_cyberark.py @@ -13,14 +13,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<5>1 2020-01-24T22:53:03Z REDACTEDHOSTNAME CEF:0|Cyber-Ark|Vault|10.9.0000|22|CPM Verify Password|5|act="CPM Verify Password" suser=PasswordManager fname=Root\Operating System-OBO-ISSO-Windows-Domain-Account-redacted dvc= shost=10.0.0.10 dhost= duser=redacted externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2="re-dact-ted" cs3Label="Device Type" cs3="Operating System" cs4Label="Database" cs4= cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2="VerificationPeriod" msg="VerificationPeriod" -def test_cyberark_epv_5424(record_property, setup_wordlist, setup_splunk): +def test_cyberark_epv_5424(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}1 {% now 'utc', '%Y-%m-%dT%H:%M:%S' %}Z {{ host }} CEF:0|Cyber-Ark|Vault|9.20.0000|7|Logon|5|act=\"Logon\" suser=##USER_NAME## fname= dvc= shost=##SOURCE_IP## dhost= duser= externalId= app= reason= cs1Label=\"Affected User Name\" cs1= cs2Label=\"Safe Name\" cs2= cs3Label=\"Device Type\" cs3=11111 cs4Label=\"Database\" cs4=222222 cs5Label=\"Other info\" cs5= cn1Label=\"Request Id\" cn1= cn2Label=\"Ticket Id\" cn2= msg=\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cyberark:epv:cef\"| head 2") search = st.render(host=host) @@ -34,14 +34,14 @@ def test_cyberark_epv_5424(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<190>Jul 27 23:31:58 VAULT CEF:0|Cyber-Ark|Vault|9.20.0000|7|Logon|5|act="Logon" suser=##USER_NAME## fname= dvc= shost=##SOURCE_IP## dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2= cs3Label="Device Type" cs3=11111 cs4Label="Database" cs4=222222 cs5Label="Other info" cs5= cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2= msg= -def test_cyberark_epv(record_property, setup_wordlist, setup_splunk): +def test_cyberark_epv(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CEF:0|Cyber-Ark|Vault|9.20.0000|7|Logon|5|act=\"Logon\" suser=##USER_NAME## fname= dvc= shost=##SOURCE_IP## dhost= duser= externalId= app= reason= cs1Label=\"Affected User Name\" cs1= cs2Label=\"Safe Name\" cs2= cs3Label=\"Device Type\" cs3=11111 cs4Label=\"Database\" cs4=222222 cs5Label=\"Other info\" cs5= cn1Label=\"Request Id\" cn1= cn2Label=\"Ticket Id\" cn2= msg=\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netauth host=\"{{ host }}\" sourcetype=\"cyberark:epv:cef\"| head 2") search = st.render(host=host) @@ -55,14 +55,14 @@ def test_cyberark_epv(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<190>Jul 12 23:44:25 10.0.0.1 CEF:0|CyberArk|PTA|2.6.1|20|Privileged account anomaly|8|cs1Label=incidentId cs1=55a32ed8e4b0e4a90114e12c start=1436755482000 deviceCustomDate1Label=detectionDate deviceCustomDate1=1436759065017 msg=Incident updated. Now contains 7 anomalies cs2Label=link cs2=https://10.0.0.1/incidents/55a32ed8e4b0e4a90114e12c -def test_cyberark_pta(record_property, setup_wordlist, setup_splunk): +def test_cyberark_pta(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} CEF:0|CyberArk|PTA|2.6.1|20|Privileged account anomaly|8|cs1Label=incidentId cs1=55a32ed8e4b0e4a90114e12c start=1436755482000 deviceCustomDate1Label=detectionDate deviceCustomDate1=1436759065017 msg=Incident updated. Now contains 7 anomalies cs2Label=link cs2=https://10.0.0.1/incidents/55a32ed8e4b0e4a90114e12c\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cyberark:pta:cef\"| head 2") search = st.render(host=host) diff --git a/tests/test_forcepoint_web.py b/tests/test_forcepoint_web.py index 7ecf4cb..4f4a410 100644 --- a/tests/test_forcepoint_web.py +++ b/tests/test_forcepoint_web.py @@ -13,14 +13,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<134>Oct 16 12:13:06 sourcehost2 vendor=Websense 9f product=Security product_version=7.7.0 action=permitted severity=7 category=755 user=LDAP://user7 OU=Users,OU=Beijing,DC=com/TEST\, TEST_NAME src_host=10.0.0.4 src_port=61435 dst_host=HOST-013 dst_ip=10.0.0.19 dst_port=25404 bytes_out=4074 bytes_in=12328 http_response=200 http_method=POST http_content_type=image/gif;charset=UTF-8 http_user_agent=Mozilla/3.0 (Windows; U; Windows NT 6.1; es-def; rv:1.7.0.11) Gecko/2009060215 Firefox/8.0.11 (.NET CLR 8.5.30729) http_proxy_status_code=200 reason=- disposition=2573 policy=role-8**Default role=4 duration=63 url=http://test_web.com/contents/content1.jpg -def test_forcepoint_webprotect_kv(record_property, setup_wordlist, setup_splunk): +def test_forcepoint_webprotect_kv(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} vendor=Websense 9f product=Security product_version=7.7.0 action=permitted severity=7 category=755 user=LDAP://user7 OU=Users,OU=Beijing,DC=com/TEST\, TEST_NAME src_host=10.0.0.4 src_port=61435 dst_host=HOST-013 dst_ip=10.0.0.19 dst_port=25404 bytes_out=4074 bytes_in=12328 http_response=200 http_method=POST http_content_type=image/gif;charset=UTF-8 http_user_agent=Mozilla/3.0 (Windows; U; Windows NT 6.1; es-def; rv:1.7.0.11) Gecko/2009060215 Firefox/8.0.11 (.NET CLR 8.5.30729) http_proxy_status_code=200 reason=- disposition=2573 policy=role-8**Default role=4 duration=63 url=http://test_web.com/contents/content1.jpg unknownfield=-\n") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netproxy host=\"{{ host }}\" sourcetype=\"websense:cg:kv\" | head 2") search = st.render(host=host) diff --git a/tests/test_fortinet_ngfw.py b/tests/test_fortinet_ngfw.py index f68f13a..892f87d 100644 --- a/tests/test_fortinet_ngfw.py +++ b/tests/test_fortinet_ngfw.py @@ -13,14 +13,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<111> Aug 17 00:00:00 fortigate date=2015-08-11 time=19:19:43 devname=Nosey devid=FG800C3912801080 logid=0004000017 type=traffic subtype=sniffer level=notice vd=root srcip=fe80::20c:29ff:fe77:20d4 srcintf="port3" dstip=ff02::1:ff77:20d4 dstintf="port3" sessionid=408903 proto=58 action=accept policyid=2 dstcountry="Reserved" srccountry="Reserved" trandisp=snat transip=:: transport=0 service="icmp6/131/0" duration=36 sentbyte=0 rcvdbyte=40 sentpkt=0 rcvdpkt=0 appid=16321 app="IPv6.ICMP" appcat="Network.Service" apprisk=elevated applist="sniffer-profile" appact=detected utmaction=allow countapp=1 -def test_fortinet_fgt_event(record_property, setup_wordlist, setup_splunk): +def test_fortinet_fgt_event(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}date={% now 'utc', '%Y-%m-%d' %} time={% now 'utc', '%H:%M:%S' %} devname={{ host }} devid=FGT60D4614044725 logid=0100040704 type=event subtype=system level=notice vd=root logdesc=\"System performance statistics\" action=\"perf-stats\" cpu=2 mem=35 totalsession=61 disk=2 bandwidth=158/138 setuprate=2 disklograte=0 fazlograte=0 msg=\"Performance statistics: average CPU: 2, memory: 35, concurrent sessions: 61, setup-rate: 2\"\n") message = mt.render(mark="<13>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"fgt_event\" | head 2") search = st.render(host=host) @@ -34,13 +34,13 @@ def test_fortinet_fgt_event(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<111> Aug 17 00:00:00 fortigate date=2015-08-11 time=19:19:43 devname=Nosey devid=FG800C3912801080 logid=0004000017 type=traffic subtype=sniffer level=notice vd=root srcip=fe80::20c:29ff:fe77:20d4 srcintf="port3" dstip=ff02::1:ff77:20d4 dstintf="port3" sessionid=408903 proto=58 action=accept policyid=2 dstcountry="Reserved" srccountry="Reserved" trandisp=snat transip=:: transport=0 service="icmp6/131/0" duration=36 sentbyte=0 rcvdbyte=40 sentpkt=0 rcvdpkt=0 appid=16321 app="IPv6.ICMP" appcat="Network.Service" apprisk=elevated applist="sniffer-profile" appact=detected utmaction=allow countapp=1 -def test_fortinet_fgt_traffic(record_property, setup_wordlist, setup_splunk): +def test_fortinet_fgt_traffic(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}date={% now 'utc', '%Y-%m-%d' %} time={% now 'utc', '%H:%M:%S' %} devname={{ host }} devid=FG800C3912801080 logid=0004000017 type=traffic subtype=sniffer level=notice vd=root srcip=fe80::20c:29ff:fe77:20d4 srcintf=\"port3\" dstip=ff02::1:ff77:20d4 dstintf=\"port3\" sessionid=408903 proto=58 action=accept policyid=2 dstcountry=\"Reserved\" srccountry=\"Reserved\" trandisp=snat transip=:: transport=0 service=\"icmp6/131/0\" duration=36 sentbyte=0 rcvdbyte=40 sentpkt=0 rcvdpkt=0 appid=16321 app=\"IPv6.ICMP\" appcat=\"Network.Service\" apprisk=elevated applist=\"sniffer-profile\" appact=detected utmaction=allow countapp=1\n") message = mt.render(mark="<13>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"fgt_traffic\" | head 2") search = st.render(host=host) @@ -54,13 +54,13 @@ def test_fortinet_fgt_traffic(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<111> Aug 17 00:00:00 fortigate date=2015-08-11 time=19:21:40 logver=52 devname=US-Corp_Main1 devid=FGT37D4613800138 logid=0317013312 type=utm subtype=webfilter eventtype=ftgd_allow level=notice vd=root sessionid=1490845588 user="" srcip=172.30.16.119 srcport=53235 srcintf="Internal" dstip=114.112.67.75 dstport=80 dstintf="External-SDC" proto=6 service=HTTP hostname="popo.wan.ijinshan.com" profile="scan" action=passthrough reqtype=direct url="/popo/launch?c=cHA9d29vZHMxOTgyQGhvdG1haWwuY29tJnV1aWQ9NDBiNDkyZDRmNzdhNjFmOTNlMjQwMjhiYjE3ZGRlYTYmY29tcGl" sentbyte=525 rcvdbyte=325 direction=outgoing msg="URL belongs to an allowed category in policy" method=domain cat=52 catdesc="Information Technology" -def test_fortinet_fgt_utm(record_property, setup_wordlist, setup_splunk): +def test_fortinet_fgt_utm(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}date={% now 'utc', '%Y-%m-%d' %} time={% now 'utc', '%H:%M:%S' %} devname={{ host }} devid=FGT37D4613800138 logid=0317013312 type=utm subtype=webfilter eventtype=ftgd_allow level=notice vd=root sessionid=1490845588 user=\"\" srcip=172.30.16.119 srcport=53235 srcintf=\"Internal\" dstip=114.112.67.75 dstport=80 dstintf=\"External-SDC\" proto=6 service=HTTP hostname=\"popo.wan.ijinshan.com\" profile=\"scan\" action=passthrough reqtype=direct url=\"/popo/launch?c=cHA9d29vZHMxOTgyQGhvdG1haWwuY29tJnV1aWQ9NDBiNDkyZDRmNzdhNjFmOTNlMjQwMjhiYjE3ZGRlYTYmY29tcGl\" sentbyte=525 rcvdbyte=325 direction=outgoing msg=\"URL belongs to an allowed category in policy\" method=domain cat=52 catdesc=\"Information Technology\"\n") message = mt.render(mark="<13>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"fgt_utm\" | head 2") search = st.render(host=host) diff --git a/tests/test_imperva.py b/tests/test_imperva.py index 9a0005c..a3ec535 100644 --- a/tests/test_imperva.py +++ b/tests/test_imperva.py @@ -12,14 +12,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) -def test_imperva_incapsula(record_property, setup_wordlist, setup_splunk): +def test_imperva_incapsula(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|Incapsula|SIEMintegration|1|1|Illegal Resource Access|3| fileid=3412341160002518171 sourceServiceName=site123.abcd.info siteid=1509732 suid=50005477 requestClientApplication=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 deviceFacility=mia cs2=true cs2Label=Javascript Support cs3=true cs3Label=CO Support src=12.12.12.12 caIP=13.13.13.13 ccode=IL tag=www.elvis.com cn1=200 in=54 xff=44.44.44.44 cs1=NOT_SUPPORTED cs1Label=Cap Support cs4=c2e72124-0e8a-4dd8-b13b-3da246af3ab2 cs4Label=VID cs5=de3c633ac428e0678f3aac20cf7f239431e54cbb8a17e8302f53653923305e1835a9cd871db32aa4fc7b8a9463366cc4 cs5Label=clappsigdproc=Browser cs6=Firefox cs6Label=clapp ccode=IL cicode=Rehovot cs7=31.8969 cs7Label=latitude cs8=34.8186 cs8Label=longitude Customer=CEFcustomer123 ver=TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 start=1453290121336 request=site123.abcd.info/ requestmethod=GET qstr=p\=%2fetc%2fpasswd app=HTTP act=REQ_CHALLENGE_CAPTCHA deviceExternalID=33411452762204224 cpt=443 filetype=30037,1001, filepermission=2,1, cs9=Block Malicious User,High Risk Resources, cs9Label=Rule name' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netwaf host=\"{{ host }}\" sourcetype=\"cef\" source=\"Imperva:Incapsula\" | head 2") search = st.render(host=host) diff --git a/tests/test_infoblox.py b/tests/test_infoblox.py index f7da9c7..f9f29ef 100644 --- a/tests/test_infoblox.py +++ b/tests/test_infoblox.py @@ -16,14 +16,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<142>Oct 25 13:08:00 161.231.218.156 named[6597]: FORMERR resolving 'www.google.com/AAAA/IN': 209.2.230.6#53 -def test_infoblox_dns(record_property, setup_wordlist, setup_splunk): +def test_infoblox_dns(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "vib-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} named[{{ pid }}]: FORMERR resolving 'www.google.com/AAAA/IN': 209.2.230.6#53\n") message = mt.render(mark="<111>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netdns host={{ host }} sourcetype=\"infoblox:dns\" | head 2") search = st.render(host=host, pid=pid) @@ -37,14 +37,14 @@ def test_infoblox_dns(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<150>Oct 24 21:09:00 162.101.157.246 dhcpd[28922]: DHCPREQUEST for 10.130.151.62 from 80:ce:62:9c:0e:70 (DTCCE0826E00C97) via eth2 TransID 802c562c uid 01:80:ce:62:9c:0e:70 (RENEW) -def test_infoblox_dhcp(record_property, setup_wordlist, setup_splunk): +def test_infoblox_dhcp(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "vib-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} dhcpd[{{ pri }}]: DHCPREQUEST for 10.00.00.62 from 80:00:00:00:0e:70 (EXAMPLE) via eth2 TransID 802c562c uid 01:80:00:00:00:00:70 (RENEW)\n") message = mt.render(mark="<150>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netipam host={{ host }} sourcetype=\"infoblox:dhcp\" | head 2") search = st.render(host=host, pid=pid) diff --git a/tests/test_juniper_junos_rfc3164.py b/tests/test_juniper_junos_rfc3164.py index b127814..9bac164 100644 --- a/tests/test_juniper_junos_rfc3164.py +++ b/tests/test_juniper_junos_rfc3164.py @@ -11,14 +11,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) # <23> Mar 18 17:56:52 RT_UTM: WEBFILTER_URL_PERMITTED: WebFilter: ACTION="URL Permitted" 192.168.32.1(62054)->1.1.1.1(443) CATEGORY="Enhanced_Information_Technology" REASON="BY_PRE_DEFINED" PROFILE="UTM-Wireless-Profile" URL=ent-shasta-rrs.symantec.com OBJ=/ username N/A roles N/A -def test_juniper_utm_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_utm_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} RT_UTM: WEBFILTER_URL_PERMITTED: WebFilter: ACTION=\"URL Permitted\" 192.168.32.1(62054)->1.1.1.1(443) CATEGORY=\"Enhanced_Information_Technology\" REASON=\"BY_PRE_DEFINED\" PROFILE=\"UTM-Wireless-Profile\" URL=ent-shasta-rrs.symantec.com OBJ=/ username N/A roles N/A") message = mt.render(mark="<23>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"juniper:junos:firewall\" | head 2") search = st.render(host=host) @@ -32,14 +32,14 @@ def test_juniper_utm_standard(record_property, setup_wordlist, get_host_key, set assert resultCount == 1 # <23> Nov 18 09:56:58 INTERNET-ROUTER RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.102/58662->8.8.8.8/53 junos-dns-udp 68.144.1.1/55893->8.8.8.8/53 TRUST-INET-ACCESS None 17 OUTBOUND-INTERNET-ACCESS TRUST INTERNET 6316 N/A(N/A) vlan.192 -def test_juniper_firewall_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_firewall_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.1.102/58662->8.8.8.8/53 junos-dns-udp 68.144.1.1/55893->8.8.8.8/53 TRUST-INET-ACCESS None 17 OUTBOUND-INTERNET-ACCESS TRUST INTERNET 6316 N/A(N/A) vlan.192") message = mt.render(mark="<23>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"juniper:junos:firewall\" | head 2") search = st.render(host=host) @@ -52,14 +52,14 @@ def test_juniper_firewall_standard(record_property, setup_wordlist, get_host_key assert resultCount == 1 -def test_juniper_idp_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_idp_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} RT_IDP: IDP_ATTACK_LOG_EVENT: IDP: at 1303673404, ANOMALY Attack log <64.1.2.1/48397->198.87.233.110/80> for TCP protocol and service HTTP application NONE by rule 3 of rulebase IPS in policy Recommended. attack: repeat=0, action=DROP, threat-severity=HIGH, name=HTTP:INVALID:MSNG-HTTP-VER, NAT <46.0.3.254:55870->0.0.0.0:0>, time-elapsed=0, inbytes=0, outbytes=0, inpackets=0, outpackets=0, intf:trust:fe-0/0/2.0->untrust:fe-0/0/3.0, packet-log-id: 0 and misc-message -") message = mt.render(mark="<23>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"juniper:junos:idp\" | head 2") search = st.render(host=host) diff --git a/tests/test_juniper_junos_rfc5124.py b/tests/test_juniper_junos_rfc5124.py index 2e0b4e1..188e99f 100644 --- a/tests/test_juniper_junos_rfc5124.py +++ b/tests/test_juniper_junos_rfc5124.py @@ -13,14 +13,14 @@ # <165>1 2007-02-15T09:17:15.719Z router1 mgd 3046 UI_DBASE_LOGOUT_EVENT [junos@2636.1.1.1.2.18 username="user"] User 'user' exiting configuration mode # @pytest.mark.xfail -def test_juniper_junos_structured(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_junos_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%S' %}.700Z {{ host }} mgd 3046 UI_DBASE_LOGOUT_EVENT [junos@2636.1.1.1.2.18 username=\"user\"] User 'user' exiting configuration mode\n") message = mt.render(mark="<165>1", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"juniper:structured\" | head 2") search = st.render(host=host) @@ -35,14 +35,14 @@ def test_juniper_junos_structured(record_property, setup_wordlist, get_host_key, # <165>1 2007-02-15T09:17:15.719Z idp1 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.135 epoch-time="1507845354" message-type="SIG" source-address="183.78.180.27" source-port="45610" destination-address="118.127.xx.xx" destination-port="80" protocol-name="TCP" service-name="SERVICE_IDP" application-name="HTTP" rule-name="9" rulebase-name="IPS" policy-name="Recommended" export-id="15229" repeat-count="0" action="DROP" threat-severity="HIGH" attack-name="TROJAN:ZMEU-BOT-SCAN" nat-source-address="0.0.0.0" nat-source-port="0" nat-destination-address="172.xx.xx.xx" nat-destination-port="0" elapsed-time="0" inbound-bytes="0" outbound-bytes="0" inbound-packets="0" outbound-packets="0" source-zone-name="sec-zone-name-internet" source-interface-name="reth0.XXX" destination-zone-name="dst-sec-zone1-outside" destination-interface-name="reth1.xxx" packet-log-id="0" alert="no" username="N/A" roles="N/A" message="-"] # @pytest.mark.xfail -def test_juniper_junos_idp_structured(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_junos_idp_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%S' %}.700Z {{ host }} RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.135 epoch-time=\"1507845354\" message-type=\"SIG\" source-address=\"183.78.180.27\" source-port=\"45610\" destination-address=\"118.127.xx.xx\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"SERVICE_IDP\" application-name=\"HTTP\" rule-name=\"9\" rulebase-name=\"IPS\" policy-name=\"Recommended\" export-id=\"15229\" repeat-count=\"0\" action=\"DROP\" threat-severity=\"HIGH\" attack-name=\"TROJAN:ZMEU-BOT-SCAN\" nat-source-address=\"0.0.0.0\" nat-source-port=\"0\" nat-destination-address=\"172.xx.xx.xx\" nat-destination-port=\"0\" elapsed-time=\"0\" inbound-bytes=\"0\" outbound-bytes=\"0\" inbound-packets=\"0\" outbound-packets=\"0\" source-zone-name=\"sec-zone-name-internet\" source-interface-name=\"reth0.XXX\" destination-zone-name=\"dst-sec-zone1-outside\" destination-interface-name=\"reth1.xxx\" packet-log-id=\"0\" alert=\"no\" username=\"N/A\" roles=\"N/A\" message=\"-\"]") message = mt.render(mark="<165>1", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"juniper:junos:idp:structured\" | head 2") search = st.render(host=host) @@ -57,14 +57,14 @@ def test_juniper_junos_idp_structured(record_property, setup_wordlist, get_host_ # <134> Aug 02 14:45:04 10.0.0.1 65.197.254.193 20090320, 17331, 2009/03/20 14:47:45, 2009/03/20 14:47:50, global, 53, [FW NAME], [FW IP], traffic, traffic log, trust, (NULL), 10.1.1.20, 1725, 82.2.19.2, 2383, untrust, (NULL), 84.5.78.4, 80, 84.53.178.64, 80, tcp, global, 53, [FW NAME], fw/vpn, 4, accepted, info, no, Creation, (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 1, no, 0, Not Set, sos # @pytest.mark.xfail -def test_juniper_junos_fw_structured(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_junos_fw_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%S' %}.700Z {{ host }} RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.26 logical-system-name=\"test-lsys\" source-address=\"10.10.10.100\" source-port=\"4206\" destination-address=\"10.20.20.15\" destination-port=\"445\" service-name=\"junos-smb\" nat-source-address=\"10.10.10.100\" nat-source-port=\"4206\" nat-destination-address=\"10.20.20.15\" nat-destination-port=\"445\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"123\" source-zone-name=\"TEST1\" destination-zone-name=\"TEST2\" session-id-32=\"14285714\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth1.100\"]") message = mt.render(mark="<23>1", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"juniper:junos:firewall:structured\" | head 2") search = st.render(host=host) diff --git a/tests/test_juniper_legacy.py b/tests/test_juniper_legacy.py index cd9cbcc..f9696d9 100644 --- a/tests/test_juniper_legacy.py +++ b/tests/test_juniper_legacy.py @@ -13,14 +13,14 @@ # <134> Aug 02 14:45:04 10.0.0.1 65.197.254.193 20090320, 17331, 2009/03/20 14:47:45, 2009/03/20 14:47:50, global, 53, [FW NAME], [FW IP], traffic, traffic log, trust, (NULL), 10.1.1.20, 1725, 82.2.19.2, 2383, untrust, (NULL), 84.5.78.4, 80, 84.53.178.64, 80, tcp, global, 53, [FW NAME], fw/vpn, 4, accepted, info, no, Creation, (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 1, no, 0, Not Set, sos -def test_juniper_nsm_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_nsm_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} jnpnsm-{{ host }} 65.197.254.193 20090320, 17331, 2009/03/20 14:47:45, 2009/03/20 14:47:50, global, 53, [FW NAME], [FW IP], traffic, traffic log, trust, (NULL), 10.1.1.20, 1725, 82.2.19.2, 2383, untrust, (NULL), 84.5.78.4, 80, 84.53.178.64, 80, tcp, global, 53, [FW NAME], fw/vpn, 4, accepted, info, no, Creation, (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 1, no, 0, Not Set, sos") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"jnpnsm-{{ host }}\" sourcetype=\"juniper:nsm\" | head 2") search = st.render(host=host) @@ -35,14 +35,14 @@ def test_juniper_nsm_standard(record_property, setup_wordlist, get_host_key, set # THE LOG SAMPLE BELOW IS IMPLIED FROM THE JUNIPER DOCS; need to obtain a real sample. # <134> Aug 02 14:45:04 10.0.0.1 65.197.254.193 20090320, 17331, 2009/03/20 14:47:45, 2009/03/20 14:47:50, global, 53, [IDP NAME], [IDP IP], predefined, rule, trust, (NULL), 10.1.1.20, 1725, 82.2.19.2, 2383, untrust, (NULL), 84.5.78.4, 80, 84.53.178.64, 80, tcp, global, 53, [IDP NAME], fw/vpn, 4, accepted, info, no, Creation, (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 1, no, 0, Not Set, sos -def test_juniper_nsm_idp_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_nsm_idp_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} jnpnsmidp-{{ host }} 65.197.254.193 20090320, 17331, 2009/03/20 14:47:45, 2009/03/20 14:47:50, global, 53, [IDP NAME], [IDP IP], predefined, rule, trust, (NULL), 10.1.1.20, 1725, 82.2.19.2, 2383, untrust, (NULL), 84.5.78.4, 80, 84.53.178.64, 80, tcp, global, 53, [IDP NAME], fw/vpn, 4, accepted, info, no, Creation, (NULL), (NULL), (NULL), 0, 0, 0, 0, 0, 0, 0, 1, no, 0, Not Set, sos") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"jnpnsmidp-{{ host }}\" sourcetype=\"juniper:nsm:idp\" | head 2") search = st.render(host=host) @@ -57,14 +57,14 @@ def test_juniper_nsm_idp_standard(record_property, setup_wordlist, get_host_key, # <23> Apr 24 12:30:05 cs-loki3 RT_IDP: IDP_ATTACK_LOG_EVENT: IDP: at 1303673404, ANOMALY Attack log <64.1.2.1/48397->198.87.233.110/80> for TCP protocol and service HTTP application NONE by rule 3 of rulebase IPS in policy Recommended. attack: repeat=0, action=DROP, threat-severity=HIGH, name=HTTP:INVALID:MSNG-HTTP-VER, NAT <46.0.3.254:55870->0.0.0.0:0>, time-elapsed=0, inbytes=0, outbytes=0, inpackets=0, outpackets=0, intf:trust:fe-0/0/2.0->untrust:fe-0/0/3.0, packet-log-id: 0 and misc-message - # <23> Mar 18 17:56:52 [FW IP] [FW Model]: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time="2009-03-18 16:07:06" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 -def test_juniper_netscreen_fw(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_netscreen_fw(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} jnpns-{{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1\n") message = mt.render(mark="<23>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"jnpns-{{ host }}\" sourcetype=\"netscreen:firewall\" | head 2") search = st.render(host=host) @@ -82,14 +82,14 @@ def test_juniper_netscreen_fw(record_property, setup_wordlist, get_host_key, set # # # @pytest.mark.xfail -def test_juniper_idp_structured(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_idp_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%S' %}.700Z {{ host }} Jnpr Syslog 23414 [syslog@juniper.net dayId=\"20100623\" recordId=\"0\" timeRecv=\"2010/06/23 18:05:55\" timeGen=\"2010/06/23 18:05:51\" domain=\"\" devDomVer2=\"0\" device_ip=\"10.209.83.9\" cat=\"Config\" attack=\"\" srcZn=\"NULL\" srcIntf=\"\" srcAddr=\"0.0.0.0\" srcPort=\"0\" natSrcAddr=\"NULL\" natSrcPort=\"0\" dstZn=\"NULL\" dstIntf=\"NULL\" dstAddr=\"0.0.0.0\" dstPort=\"0\" natDstAddr=\"NULL\" natDstPort=\"0\" protocol=\"IP\" ruleDomain=\"\" ruleVer=\"0\" policy=\"\" rulebase=\"NONE\" ruleNo=\"0\" action=\"NONE\" severity=\"INFO\" alert=\"no\" elaspedTime=\"0\" inbytes=\"0\" outbytes=\"0\" totBytes=\"0\" inPak=\"0\" outPak=\"0\" totPak=\"0\" repCount=\"0\" packetData=\"no\" varEnum=\"0\" misc=\"Interaface eth2,eth3 is in Normal State\" user=\"NULL\" app=\"NULL\" uri=\"NULL\"]") message = mt.render(mark="<165>1", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"juniper:idp\" | head 2") search = st.render(host=host) @@ -104,14 +104,14 @@ def test_juniper_idp_structured(record_property, setup_wordlist, get_host_key, s # <23> Apr 24 12:30:05 cs-loki3 RT_IDP: IDP_ATTACK_LOG_EVENT: IDP: at 1303673404, ANOMALY Attack log <64.1.2.1/48397->198.87.233.110/80> for TCP protocol and service HTTP application NONE by rule 3 of rulebase IPS in policy Recommended. attack: repeat=0, action=DROP, threat-severity=HIGH, name=HTTP:INVALID:MSNG-HTTP-VER, NAT <46.0.3.254:55870->0.0.0.0:0>, time-elapsed=0, inbytes=0, outbytes=0, inpackets=0, outpackets=0, intf:trust:fe-0/0/2.0->untrust:fe-0/0/3.0, packet-log-id: 0 and misc-message - # <23> Mar 18 17:56:52 [FW IP] [FW Model]: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time="2009-03-18 16:07:06" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 -def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 singleport=5000\n") message = mt.render(mark="<23>", host=host) - sendsingle(message, port=5000) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5000]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"netscreen:firewall\" | head 2") search = st.render(host=host) diff --git a/tests/test_juniper_sslvpn.py b/tests/test_juniper_sslvpn.py index e301be1..867a082 100644 --- a/tests/test_juniper_sslvpn.py +++ b/tests/test_juniper_sslvpn.py @@ -13,14 +13,14 @@ # <23> Feb 27 15:00:00 vpn-001 Juniper: 2013-02-27 15:00:00 - ive - [000.000.000.000] SAMPLE::xxx@xxx.xxx(Users)[] - Session timed out for xxx@xxx.xxx.xxx/Users (session:00000000) due to inactivity (last access at 13:59:31 2013/02/27). Idle session identified during routine system scan. # <23> Feb 27 15:00:00 vpn-001 Juniper: 2013-02-27 15:00:00 - ive - [000.000.000.000] SAMPLE::xxx@xxx.xxx(Users)[User_Role] - Remote address for user xxx@xxx.xxx/Users changed from 000.000.000.000 to 000.000.000.000. Access denied. -def test_juniper_sslvpn_standard(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_juniper_sslvpn_standard(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} Juniper: {% now 'utc', '%Y-%m-%d %H:%M:%S' %} - ive - [000.000.000.000] SAMPLE::xxx@xxx.xxx(Users)[User_Role] - Remote address for user xxx@xxx.xxx/Users changed from 000.000.000.000 to 000.000.000.000. Access denied.") message = mt.render(mark="<23>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"juniper:sslvpn\" | head 2") search = st.render(host=host) diff --git a/tests/test_linux_syslog.py b/tests/test_linux_syslog.py index 9297929..e467eea 100644 --- a/tests/test_linux_syslog.py +++ b/tests/test_linux_syslog.py @@ -16,14 +16,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<78>Oct 25 09:10:00 /usr/sbin/cron[54928]: (root) CMD (/usr/libexec/atrun) -def test_linux__nohost_program_as_path(record_property, setup_wordlist, setup_splunk): +def test_linux__nohost_program_as_path(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} /usr/sbin/cron[{{ pid }}]: (root) CMD (/usr/libexec/atrun)\n") message = mt.render(mark="<111>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=osnix \"[{{ pid }}]\" sourcetype=\"nix:syslog\" | head 2") search = st.render(host=host, pid=pid) @@ -36,14 +36,14 @@ def test_linux__nohost_program_as_path(record_property, setup_wordlist, setup_sp assert resultCount == 1 -def test_linux__host_program_as_path(record_property, setup_wordlist, setup_splunk): +def test_linux__host_program_as_path(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} /usr/sbin/cron[{{ pid }}]: (root) CMD (/usr/libexec/atrun)\n") message = mt.render(mark="<111>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=osnix \"[{{ pid }}]\" host={{ host }} sourcetype=\"nix:syslog\" | head 2") search = st.render(host=host, pid=pid) @@ -56,14 +56,14 @@ def test_linux__host_program_as_path(record_property, setup_wordlist, setup_splu assert resultCount == 1 -def test_linux__nohost_program_conforms(record_property, setup_wordlist, setup_splunk): +def test_linux__nohost_program_conforms(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} cron[{{ pid }}]: (root) CMD (/usr/libexec/atrun)\n") message = mt.render(mark="<111>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=osnix \"[{{ pid }}]\" sourcetype=\"nix:syslog\" | head 2") search = st.render(host=host, pid=pid) @@ -76,14 +76,14 @@ def test_linux__nohost_program_conforms(record_property, setup_wordlist, setup_s assert resultCount == 1 -def test_linux__host_program_conforms(record_property, setup_wordlist, setup_splunk): +def test_linux__host_program_conforms(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} cron[{{ pid }}]: (root) CMD (/usr/libexec/atrun)\n") message = mt.render(mark="<111>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=osnix \"[{{ pid }}]\" host={{ host }} sourcetype=\"nix:syslog\" | head 2") search = st.render(host=host, pid=pid) diff --git a/tests/test_microfocus_arcsight.py b/tests/test_microfocus_arcsight.py index 507db99..0825d05 100644 --- a/tests/test_microfocus_arcsight.py +++ b/tests/test_microfocus_arcsight.py @@ -16,14 +16,14 @@ # Mar 19 15:19:15 syslog1 CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:016|Device connection up|Low| eventId=30 msg=Connected to Host mrt=1539321123071 categorySignificance=/Normal categoryBehavior=/Access/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application art=1539321124967 cat=/Agent/Connection/Device?Success deviceSeverity=Warning rt=1539321123071 dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\=\= # Mar 19 15:19:15 root CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:030|Agent [PAN1_WUC_UDP8000] type [windowsfg] started|Low| eventId=26 mrt=1539321122832 categorySignificance=/Normal categoryBehavior=/Execute/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application/Service art=1539321124967 cat=/Agent/Started deviceSeverity=Warning rt=1539321122832 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\=\= # Mar 19 15:19:15 syslog1 CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:016|Device connection up|Low| eventId=77 msg=Connected to Host mrt=1539321047341 categorySignificance=/Normal categoryBehavior=/Access/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application art=1539321049259 cat=/Agent/Connection/Device?Success deviceSeverity=Warning rt=1539321047341 dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\=\= -def test_microfocus_arcsight_ts_rt(record_property, setup_wordlist, setup_splunk): +def test_microfocus_arcsight_ts_rt(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:016|Device connection up|Low| eventId=77 msg=Connected to Host mrt=1539321047341 categorySignificance=/Normal categoryBehavior=/Access/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application art=1539321049259 cat=/Agent/Connection/Device?Success deviceSeverity=Warning rt=' + "{% now 'utc', '%s' %}" + ' dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\\=\\=' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cef\" source=ArcSight:ArcSight | head 2") search = st.render(host=host) @@ -36,14 +36,14 @@ def test_microfocus_arcsight_ts_rt(record_property, setup_wordlist, setup_splunk assert resultCount == 1 -def test_microfocus_arcsight_ts_end(record_property, setup_wordlist, setup_splunk): +def test_microfocus_arcsight_ts_end(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:016|Device connection up|Low| eventId=77 msg=Connected to Host mrt=1539321047341 categorySignificance=/Normal categoryBehavior=/Access/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application art=1539321049259 cat=/Agent/Connection/Device?Success deviceSeverity=Warning end=' + "{% now 'utc', '%s' %}" + ' dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\\=\\=' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cef\" source=ArcSight:ArcSight| head 2") search = st.render(host=host) @@ -56,14 +56,14 @@ def test_microfocus_arcsight_ts_end(record_property, setup_wordlist, setup_splun assert resultCount == 1 -def test_microfocus_arcsight_ts_syslog(record_property, setup_wordlist, setup_splunk): +def test_microfocus_arcsight_ts_syslog(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|ArcSight|ArcSight|7.9.0.8084.0|agent:016|Device connection up|Low| eventId=77 msg=Connected to Host mrt=1539321047341 categorySignificance=/Normal categoryBehavior=/Access/Start categoryDeviceGroup=/Application catdt=Security Management categoryOutcome=/Success categoryObject=/Host/Application art=1539321049259 cat=/Agent/Connection/Device?Success deviceSeverity=Warning dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 fileType=Agent cs2= cs2Label=Configuration Resource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=win-pan1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dvcmac=00-0C-29-98-8D-D7 dtz=Asia/Riyadh _cefVer=0.1 aid=3o0OiZmYBABCACGN9CiyuGQ\\=\\=' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cef\" source=ArcSight:ArcSight | head 2") search = st.render(host=host) @@ -76,14 +76,14 @@ def test_microfocus_arcsight_ts_syslog(record_property, setup_wordlist, setup_sp assert resultCount == 1 -def test_microfocus_arcsight_windows(record_property, setup_wordlist, setup_splunk): +def test_microfocus_arcsight_windows(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4634|An account was logged off.|Low| eventId=1 externalId=4634 msg=Network: A user or computer logged on to this computer from the network. rawEvent=EventlogType\=Security&&EventIndex\=1031&&WindowsVersion\=Windows Server 2012 R2&&WindowsKeyMapFamily\=Windows 2012 R2&&WindowsParserFamily\=Windows 2012 R2|2012|8&&DetectTime\=2018-10-12 7:25:11&&EventSource\=Microsoft-Windows-Security-Auditing&&EventID\=4634&&EventType\=Audit_success&&EventCategory\=12545&&User\=null&&ComputerName\=WIN-PAN1&&Description\=An account was logged off.&&Message\=This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.&&Subject:Security ID\=S-1-5-21-750061412-3179291162-3140434184-500&&Subject:Account Name\=Administrator&&Subject:Account Domain\=WIN-PAN1&&Subject:Logon ID\=0x373c2&&Logon Type\=3 categorySignificance=/Informational categoryBehavior=/Access/Stop categoryDeviceGroup=/Operating System catdt=Operating System categoryOutcome=/Success categoryObject=/Host/Operating System art=1539321047369 cat=Security deviceSeverity=Audit_success rt=' + "{% now 'utc', '%s' %}" + ' dhost=WIN-PAN1 dst=192.168.13.152 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dntdom=WIN-PAN1 duser=Administrator duid=0x373c2 cs2=Logon/Logoff:Logoff cn1=3 cs1Label=Accesses cs2Label=EventlogCategory cs4Label=Reason or Error Code cs5Label=Authentication Package Name cn1Label=LogonType cn2Label=CrashOnAuditFail cn3Label=Count ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=WIN-PAN1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 deviceNtDomain=WIN-PAN1 dtz=Asia/Riyadh _cefVer=0.1 ad.WindowsVersion=Windows Server 2012 R2 ad.WindowsParserFamily=Windows 2012 R2|2012|8 ad.WindowsKeyMapFamily=Windows 2012 R2 ad.EventIndex=1031 aid=3o0OiZmYBABCACGN9CiyuGQ\=\=' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=oswinsec host=\"{{ host }}\" sourcetype=\"cef\" source=\"CEFEventLog:Microsoft Windows\" | head 2") search = st.render(host=host) @@ -96,14 +96,14 @@ def test_microfocus_arcsight_windows(record_property, setup_wordlist, setup_splu assert resultCount == 1 -def test_microfocus_arcsight_windows_system(record_property, setup_wordlist, setup_splunk): +def test_microfocus_arcsight_windows_system(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} " + 'CEF:0|Microsoft|System or Application Event||Software Protection Platform Service:902|Software Protection Platform Service|Unknown| eventId=39 externalId=902 rawEvent=EventlogType\=Application&&EventIndex\=1604&&WindowsVersion\=Windows Server 2012 R2&&WindowsKeyMapFamily\=Windows 2012 R2&&WindowsParserFamily\=Windows 2012 R2|2012|8&&DetectTime\=2018-10-12 8:12:31&&EventSource\=Software Protection Platform Service&&EventID\=902&&EventType\=null&&EventCategory\=0&&User\=null&&ComputerName\=WIN-PAN1&&Key[0]\=6.3.9600.16384 art=1539321151610 cat=Application rt=' + "{% now 'utc', '%s' %}" + ' cs2=0 cs3=Software Protection Platform Service cs2Label=EventlogCategory cs3Label=EventSource ahost=win-pan1 agt=192.168.13.152 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 amac=00-0C-29-98-8D-D7 av=7.9.0.8084.0 atz=Asia/Riyadh at=windowsfg dvchost=WIN-PAN1 dvc=192.168.13.152 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255 dtz=Asia/Riyadh _cefVer=0.1 ad.WindowsVersion=Windows Server 2012 R2 ad.WindowsParserFamily=Windows 2012 R2|2012|8 ad.WindowsKeyMapFamily=Windows 2012 R2 ad.Key[0]=6.3.9600.16384 ad.EventIndex=1604 aid=3o0OiZmYBABCACGN9CiyuGQ\=\=' + "\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=oswin host=\"{{ host }}\" sourcetype=\"cef\" source=\"CEFEventLog:System or Application Event\" | head 2") search = st.render(host=host) diff --git a/tests/test_palo_alto.py b/tests/test_palo_alto.py index 6211590..400442a 100644 --- a/tests/test_palo_alto.py +++ b/tests/test_palo_alto.py @@ -14,14 +14,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<190>Jan 28 01:28:35 PA-VM300-goran1 1,2014/01/28 01:28:35,007200001056,TRAFFIC,end,1,2014/01/28 01:28:34,192.168.41.30,192.168.41.255,10.193.16.193,192.168.41.255,allow-all,,,netbios-ns,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:34,8720,1,137,137,11637,137,0x400000,udp,allow,276,276,0,3,2014/01/28 01:28:02,2,any,0,2076326,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,3,0 -def test_palo_alto_traffic(record_property, setup_wordlist, setup_splunk): +def test_palo_alto_traffic(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} 1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},007200001056,TRAFFIC,end,1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},192.168.41.30,192.168.41.255,10.193.16.193,192.168.41.255,allow-all,,,netbios-ns,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:34,8720,1,137,137,11637,137,0x400000,udp,allow,276,276,0,3,2014/01/28 01:28:02,2,any,0,2076326,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,3,0\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"pan:traffic\" | head 2") search = st.render(host=host) @@ -36,14 +36,14 @@ def test_palo_alto_traffic(record_property, setup_wordlist, setup_splunk): # <190>Oct 30 09:46:17 1,2012/10/30 09:46:17,01606001116,THREAT,url,1,2012/04/10 04:39:55,192.168.0.2,204.232.231.46,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:57,22860,1,59303,80,0,0,0x208000,tcp,alert,"litetopdetect.cn/index.php",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html -def test_palo_alto_threat(record_property, setup_wordlist, setup_splunk): +def test_palo_alto_threat(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} 1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},01606001116,THREAT,url,1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},192.168.0.2,204.232.231.46,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:57,22860,1,59303,80,0,0,0x208000,tcp,alert,\"litetopdetect.cn/index.php\",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netproxy host=\"{{ host }}\" sourcetype=\"pan:threat\" | head 2") search = st.render(host=host) @@ -56,14 +56,14 @@ def test_palo_alto_threat(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_palo_alto_traffic_badietf(record_property, setup_wordlist, setup_splunk): +def test_palo_alto_traffic_badietf(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}1 {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} 1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},007200001056,TRAFFIC,end,1,{% now 'utc', '%Y/%m/%d %H:%M:%S' %},192.168.41.30,192.168.41.255,10.193.16.193,192.168.41.255,allow-all,,,netbios-ns,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:34,8720,1,137,137,11637,137,0x400000,udp,allow,276,276,0,3,2014/01/28 01:28:02,2,any,0,2076326,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,3,0\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"pan:traffic\" | head 2") search = st.render(host=host) @@ -78,14 +78,14 @@ def test_palo_alto_traffic_badietf(record_property, setup_wordlist, setup_splunk @mark.skip() -def test_palo_alto_traffic_mstime(record_property, setup_wordlist, setup_splunk): +def test_palo_alto_traffic_mstime(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} 1,{% now 'utc', '%Y/%m/%d %H:%M:%S.%f' %},007200001056,TRAFFIC,end,1,{% now 'utc', '%Y/%m/%d %H:%M:%S.%f' %},192.168.41.30,192.168.41.255,10.193.16.193,192.168.41.255,allow-all,,,netbios-ns,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:34,8720,1,137,137,11637,137,0x400000,udp,allow,276,276,0,3,{% now 'utc', '%Y/%m/%d %H:%M:%S.%f' %},2,any,0,2076326,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,3,0\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"pan:traffic\" | head 2") search = st.render(host=host) diff --git a/tests/test_pfsense.py b/tests/test_pfsense.py index a5cc41b..2f8ee6a 100644 --- a/tests/test_pfsense.py +++ b/tests/test_pfsense.py @@ -12,13 +12,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<27>Jan 25 01:58:06 filterlog: 82,,,1000002666,mvneta2,match,pass,out,6,0x00,0x00000,64,ICMPv6,58,8,fe80::208:a2ff:fe0f:cb66,fe80::56a6:5cff:fe7d:1d43, -def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk): +def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} filterlog: 82,,,1000002666,mvneta2,match,pass,out,6,0x00,0x00000,64,ICMPv6,58,8,{{key}},\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, port=5006) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netfw sourcetype=pfsense:filterlog \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -32,13 +32,13 @@ def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<27>Jan 25 01:58:06 kqueue error: unknown -def test_pfsense_other(record_property, setup_wordlist, setup_splunk): +def test_pfsense_other(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} kqueue error: {{key}}\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, port=5006) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netops sourcetype=pfsense:* \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -52,13 +52,13 @@ def test_pfsense_other(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<27>Jan 25 01:58:06 syslogd: restart -def test_pfsense_syslogd(record_property, setup_wordlist, setup_splunk): +def test_pfsense_syslogd(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} syslogd: restart {{key}}\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, port=5006) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netops sourcetype=pfsense:syslogd \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) diff --git a/tests/test_plugin_example.py b/tests/test_plugin_example.py index 852dec5..b510ca8 100644 --- a/tests/test_plugin_example.py +++ b/tests/test_plugin_example.py @@ -12,13 +12,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) -def test_plugin_local_example(record_property, setup_wordlist, setup_splunk): +def test_plugin_local_example(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} sc4splugin[0]: test\n") message = mt.render(mark="<111>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"sc4s:local_example\" | head 2") search = st.render(host=host) diff --git a/tests/test_proofpoint.py b/tests/test_proofpoint.py index 4b04935..512a406 100644 --- a/tests/test_proofpoint.py +++ b/tests/test_proofpoint.py @@ -13,14 +13,14 @@ # Apr 17 18:33:26 aplegw01 filter_instance1[195529]: rprt s=2hdryp02r6 m=1 x=2hdryp02r6-1 cmd=send profile=mail qid=w3HMWjG3039079 rcpts=rfaircloth@splunk.com -def test_proofpoint_pps_filter(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_proofpoint_pps_filter(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} filter_instance1[195529]: rprt s=2hdryp02r6 m=1 x=2hdryp02r6-1 cmd=send profile=mail qid=w3HMWjG3039079 rcpts=rfaircloth@splunk.com\n") message = mt.render(mark="<166>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=email host=\"{{ host }}\" sourcetype=\"pps_filter_log\" | head 2") search = st.render(host=host) @@ -34,14 +34,14 @@ def test_proofpoint_pps_filter(record_property, setup_wordlist, get_host_key, se assert resultCount == 1 # Apr 17 18:35:26 aplegw02 sendmail[56106]: w3HMZPVT056101: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, tls_verify=FAIL, pri=133527, relay=mx1.splunk.iphmx.com. [216.71.153.223], dsn=2.0.0, stat=Sent (ok: Message 22675962 accepted) -def test_proofpoint_pps_mail(record_property, setup_wordlist, get_host_key, setup_splunk): +def test_proofpoint_pps_mail(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s): host = get_host_key mt = env.from_string( "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} pps-{{ host }} sendmail[195529]: w3HMZPVT056101: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, tls_verify=FAIL, pri=133527, relay=mx1.splunk.iphmx.com. [216.71.153.223], dsn=2.0.0, stat=Sent (ok: Message 22675962 accepted)\n") message = mt.render(mark="<166>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=email host=\"pps-{{ host }}\" sourcetype=\"pps_mail_log\" | head 2") search = st.render(host=host) diff --git a/tests/test_symantec_brightmail.py b/tests/test_symantec_brightmail.py index 6e877f9..d73bae8 100644 --- a/tests/test_symantec_brightmail.py +++ b/tests/test_symantec_brightmail.py @@ -13,13 +13,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) # <141>Oct 24 21:05:43 smg-1 conduit: [Brightmail] (NOTICE:7500.3119331456): [12066] 'BrightSig3 Newsletter Rules' were updated successfully. -def test_symantec_brightmail(record_property, setup_wordlist, setup_splunk): +def test_symantec_brightmail(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{host}} conduit: [Brightmail] (NOTICE:7500.3119331456): [12066] 'BrightSig3 Newsletter Rules' were updated successfully.") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=email host=\"{{ host }}\" sourcetype=\"symantec:smg\" | head 2") search = st.render(host=host) @@ -32,7 +32,7 @@ def test_symantec_brightmail(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 -def test_symantec_brightmail_msg(record_property, setup_wordlist, setup_splunk): +def test_symantec_brightmail_msg(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) msgid = uuid.uuid4() @@ -55,7 +55,7 @@ def test_symantec_brightmail_msg(record_property, setup_wordlist, setup_splunk): {{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{host}} bmserver: 1576195988|{{ MSGID }}|SOURCE|external\n {{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{host}} bmserver: 1576195987|{{ MSGID }}|VERDICT||connection_class_1|default|static connection class 1\n""") message = mt.render(mark="<1>", host=host, MSGID=msgid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=email host=\"{{ host }}\" sourcetype=\"symantec:smg:mail\" | head 2") search = st.render(host=host) diff --git a/tests/test_symantec_proxy.py b/tests/test_symantec_proxy.py index 0dddfac..8f29a59 100644 --- a/tests/test_symantec_proxy.py +++ b/tests/test_symantec_proxy.py @@ -12,13 +12,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) # <134>1 2019-08-21T17:42:08.000z "sample_logs bluecoat[0]:SPLV5.1 c-ip=192.0.0.6 cs-bytes=6269 cs-categories="unavailable" cs-host=gg.hhh.iii.com cs-ip=192.0.0.6 cs-method=GET cs-uri-path=/Sample/abc-xyz-01.pqr_sample_Internal.crt/MFAwTqADAgEAMEcwRTBDMAkGBSsOAwIaBQAEFOoaVMtyzC9gObESY9g1eXf1VM8VBBTl1mBq2WFf4cYqBI6c08kr4S302gIKUCIZdgAAAAAnQA%3D%3D cs-uri-port=8000 cs-uri-scheme=http cs-User-Agent="ocspd/1.0.3" cs-username=user4 clientduration=0 rs-status=0 s-action=TCP_HIT s-ip=10.0.0.6 serveripservice.name="Explicit HTTP" service.group="Standard" s-supplier-ip=10.0.0.6 s-supplier-name=gg.hhh.iii.com sc-bytes=9469 sc-filter-result=OBSERVED sc-status=200 time-taken=20 x-bluecoat-appliance-name="10.0.0.6-sample_logs" x-bluecoat-appliance-primary-address=10.0.0.6 x-bluecoat-proxy-primary-address=10.0.0.6 x-bluecoat-transaction-uuid=35d24c931c0erecta-0003000012161a77e70-00042100041002145cc859ed c-url="http://randomserver:8000/en-US/app/examples/" -def test_bluecoatproxySG_kv(record_property, setup_wordlist, setup_splunk): +def test_bluecoatproxySG_kv(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{ mark }} {% now 'utc', '%Y-%m-%dT%H:%M:%SZ' %} {{host}} bluecoat[0]: SPLV5.1 c-ip=192.0.0.6 cs-bytes=6269 cs-categories=\"unavailable\" cs-host=gg.hhh.iii.com cs-ip=192.0.0.6 cs-method=GET cs-uri-path=/Sample/abc-xyz-01.pqr_sample_Internal.crt/MFAwTqADAgEAMEcwRTBDMAkGBSsOAwIaBQAEFOoaVMtyzC9gObESY9g1eXf1VM8VBBTl1mBq2WFf4cYqBI6c08kr4S302gIKUCIZdgAAAAAnQA%3D%3D cs-uri-port=8000 cs-uri-scheme=http cs-User-Agent=\"ocspd/1.0.3\" cs-username=user4 clientduration=0 rs-status=0 s-action=TCP_HIT s-ip=10.0.0.6 serveripservice.name=\"Explicit HTTP\" service.group=\"Standard\" s-supplier-ip=10.0.0.6 s-supplier-name=gg.hhh.iii.com sc-bytes=9469 sc-filter-result=OBSERVED sc-status=200 time-taken=20 x-bluecoat-appliance-name=\"10.0.0.6-sample_logs\" x-bluecoat-appliance-primary-address=10.0.0.6 x-bluecoat-proxy-primary-address=10.0.0.6 x-bluecoat-transaction-uuid=35d24c931c0erecta-0003000012161a77e70-00042100041002145cc859ed c-url=\"http://randomserver:8000/en-US/app/examples/\"") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netproxy host=\"{{ host }}\" sourcetype=\"bluecoat:proxysg:access:kv\" | head 2") search = st.render(host=host) diff --git a/tests/test_ubiquiti_unifi.py b/tests/test_ubiquiti_unifi.py index 0a69280..3298a58 100644 --- a/tests/test_ubiquiti_unifi.py +++ b/tests/test_ubiquiti_unifi.py @@ -13,13 +13,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #<27>Nov 8 17:28:43 US8P60,18e8294876c3,v4.0.66.10832 switch: DOT1S: dot1sBpduReceive(): Discarding the BPDU on port 0/7, since it is an invalid BPDU type -def test_ubiquiti_unifi_us8p60(record_property, setup_wordlist, setup_splunk): +def test_ubiquiti_unifi_us8p60(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} US8P60,18e8294876c3,v4.0.66.10832 switch: DOT1S: dot1sBpduReceive(): Discarding the BPDU on port 0/7, since it is an invalid BPDU type {{key}}") message = mt.render(mark="<27>", key=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops sourcetype=ubnt:switch \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -33,13 +33,13 @@ def test_ubiquiti_unifi_us8p60(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<29>Nov 10 20:46:02 US24P250,f09fc26f4419,v4.0.54.10625 switch: TRAPMGR: Cold Start: Unit: 0 -def test_ubiquiti_unifi_switch_us24p250(record_property, setup_wordlist, setup_splunk): +def test_ubiquiti_unifi_switch_us24p250(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} US24P250,f09fc26f4419,v4.0.54.10625 switch: TRAPMGR: Cold Start: Unit: {{key}}") message = mt.render(mark="<27>", key=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops sourcetype=ubnt:switch \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -53,13 +53,13 @@ def test_ubiquiti_unifi_switch_us24p250(record_property, setup_wordlist, setup_s assert resultCount == 1 #<30>Nov 10 11:49:46 U7PG2,788a2056b181,v4.0.66.10832: logread[5495]: Logread connected to 10.2.0.9:514 -def test_ubiquiti_unifi_ap_u7pg2(record_property, setup_wordlist, setup_splunk): +def test_ubiquiti_unifi_ap_u7pg2(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} U7PG2,788a2056b181,v4.0.66.10832: logread[5495]: Logread connected to 10.2.0.9:514") message = mt.render(mark="<27>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netops sourcetype=ubnt:wireless earliest=-2m | head 2") search = st.render(host=host) @@ -73,13 +73,13 @@ def test_ubiquiti_unifi_ap_u7pg2(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<4>Nov 10 23:04:06 USG kernel: [LAN_LOCAL-default-A]IN=eth0.2004 OUT= MAC= SRC=10.254.3.1 DST=224.0.0.251 LEN=348 TOS=0x00 PREC=0x00 TTL=255 ID=32463 DF PROTO=UDP SPT=5353 DPT=5353 LEN=328 -def test_ubiquiti_unifi_usg(record_property, setup_wordlist, setup_splunk): +def test_ubiquiti_unifi_usg(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} usg-{{host}} kernel: [LAN_LOCAL-default-A]IN=eth0.2004 OUT= MAC= SRC=10.254.3.1 DST=224.0.0.251 LEN=348 TOS=0x00 PREC=0x00 TTL=255 ID=32463 DF PROTO=UDP SPT=5353 DPT=5353 LEN=328") message = mt.render(mark="<27>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netfw sourcetype=ubnt:fw host=usg-{{host}} | head 2") search = st.render(host=host) diff --git a/tests/test_vmware.py b/tests/test_vmware.py index 235798b..8649ade 100644 --- a/tests/test_vmware.py +++ b/tests/test_vmware.py @@ -16,14 +16,14 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #vpxd 123 - - Event [3481177] [1-1] [2019-05-23T09:03:36.213922Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\svc-vcenter-user] [] [3481177] [User VSPHERE.LOCAL\svc-vcenter-user@192.168.10.10 logged in as pyvmomi Python/2.7.13 (Linux; 4.9.0-7-amd64; x86_64)] -def test_linux_vmware(record_property, setup_wordlist, setup_splunk): +def test_linux_vmware(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "testvmw-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }}1 {% now 'utc', '%Y-%m-%dT%H:%M:%SZ' %} {{ host }} vpxd {{ pid }} - - Event [3481177] [1-1] [2019-05-23T09:03:36.213922Z] [vim.event.UserLoginSessionEvent] [info] [VSPHERE.LOCAL\svc-vcenter-user] [] [3481177] [User VSPHERE.LOCAL\svc-vcenter-user@192.168.10.10 logged in as pyvmomi Python/2.7.13 (Linux; 4.9.0-7-amd64; x86_64)]\n") message = mt.render(mark="<144>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main {{ pid }} sourcetype=\"vmware:vsphere:esx\" | head 2") search = st.render(host=host, pid=pid) @@ -37,14 +37,14 @@ def test_linux_vmware(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 #<46>1 2019-10-24T21:00:02.403Z {{ host }} NSXV 5996 - [nsxv@6876 comp="nsx-manager" subcomp="manager"] Invoking EventHistoryCollector.readNext on session[52db61bf-9c30-1e1f-5a26-8cd7e6f9f552]52032c51-240a-7c30-cd84-4b4246508dbe, operationID=opId-688ef-9725704 -def test_linux_vmware_nsx_ietf(record_property, setup_wordlist, setup_splunk): +def test_linux_vmware_nsx_ietf(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "testvmw-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }}1 {% now 'utc', '%Y-%m-%dT%H:%M:%SZ' %} {{ host }} NSX - SYSTEM [nsx@6876 comp=\"nsx-manager\" errorCode=\"MP4039\" subcomp=\"manager\"] Connection verification failed for broker '10.160.108.196'. Marking broker unhealthy.\n") message = mt.render(mark="<144>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host={{ host }} sourcetype=\"vmware:vsphere:nsx\" | head 2") search = st.render(host=host, pid=pid) @@ -58,14 +58,14 @@ def test_linux_vmware_nsx_ietf(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 # -def test_linux_vmware_nsx_fw(record_property, setup_wordlist, setup_splunk): +def test_linux_vmware_nsx_fw(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "testvmw-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) pid = random.randint(1000, 32000) mt = env.from_string("{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} dfwpktlogs: {{ pid }} INET match PASS domain-c7/1001 IN 60 TCP 10.33.24.50/45926->10.33.24.9/8140 S\n") message = mt.render(mark="<144>", host=host, pid=pid) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=main host={{ host }} {{ pid }} sourcetype=\"vmware:vsphere:nsx\" | head 2") search = st.render(host=host, pid=pid) diff --git a/tests/test_zscaler_proxy.py b/tests/test_zscaler_proxy.py index e0f7fb1..e5581bb 100644 --- a/tests/test_zscaler_proxy.py +++ b/tests/test_zscaler_proxy.py @@ -13,13 +13,13 @@ env = Environment(extensions=['jinja2_time.TimeExtension']) #Note the long white space is a \t #2019-10-16 15:44:36 reason=Allowed event_id=6748427317914894361 protocol=HTTPS action=Allowed transactionsize=663 responsesize=65 requestsize=598 urlcategory=UK_ALLOW_Pharmacies serverip=216.58.204.70 clienttranstime=0 requestmethod=CONNECT refererURL=None useragent=Windows Windows 10 Enterprise ZTunnel/1.0 product=NSS location=UK_Wynyard_VPN->other ClientIP=192.168.0.38 status=200 user=first.last@example.com url=4171764.fls.doubleclick.net:443 vendor=Zscaler hostname=4171764.fls.doubleclick.net clientpublicIP=213.86.221.94 threatcategory=None threatname=None filetype=None appname=DoubleClick pagerisk=0 department=Procurement, Generics urlsupercategory=User-defined appclass=Sales and Marketing dlpengine=None urlclass=Bandwidth Loss threatclass=None dlpdictionaries=None fileclass=None bwthrottle=NO servertranstime=0 md5=None -def test_zscaler_proxy(record_property, setup_wordlist, setup_splunk): +def test_zscaler_proxy(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{% now 'utc', '%Y-%m-%d %H:%M:%S' %}\treason=Allowed\tevent_id=6748427317914894361\tprotocol=HTTPS\taction=Allowed\ttransactionsize=663\tresponsesize=65\trequestsize=598\turlcategory=UK_ALLOW_Pharmacies\tserverip=216.58.204.70\tclienttranstime=0\trequestmethod=CONNECT\trefererURL=None\tuseragent=Windows Windows 10 Enterprise ZTunnel/1.0\tproduct=NSS\tlocation=UK_Wynyard_VPN->other\tClientIP=192.168.0.38\tstatus=200\tuser=first.last@example.com\turl=4171764.fls.doubleclick.net:443\tvendor=Zscaler\thostname={{host}}.fls.doubleclick.net\tclientpublicIP=213.86.221.94\tthreatcategory=None\tthreatname=None\tfiletype=None\tappname=DoubleClick\tpagerisk=0\tdepartment=Procurement, Generics\turlsupercategory=User-defined\tappclass=Sales and Marketing\tdlpengine=None\turlclass=Bandwidth Loss\tthreatclass=None\tdlpdictionaries=None\tfileclass=None\tbwthrottle=NO\tservertranstime=0\tmd5=None") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netproxy sourcetype=\"zscalernss-web\" hostname={{host}}.fls.doubleclick.net | head 2") search = st.render(host=host) @@ -33,13 +33,13 @@ def test_zscaler_proxy(record_property, setup_wordlist, setup_splunk): assert resultCount == 1 # -def test_zscaler_proxy_pri(record_property, setup_wordlist, setup_splunk): +def test_zscaler_proxy_pri(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( "{{mark}}{% now 'utc', '%Y-%m-%d %H:%M:%S' %}\treason=Allowed\tevent_id=6748427317914894362\tprotocol=HTTPS\taction=Allowed\ttransactionsize=663\tresponsesize=65\trequestsize=598\turlcategory=UK_ALLOW_Pharmacies\tserverip=216.58.204.70\tclienttranstime=0\trequestmethod=CONNECT\trefererURL=None\tuseragent=Windows Windows 10 Enterprise ZTunnel/1.0\tproduct=NSS\tlocation=UK_Wynyard_VPN->other\tClientIP=192.168.0.38\tstatus=200\tuser=first.last@example.com\turl=4171764.fls.doubleclick.net:443\tvendor=Zscaler\thostname={{host}}.fls.doubleclick.net\tclientpublicIP=213.86.221.94\tthreatcategory=None\tthreatname=None\tfiletype=None\tappname=DoubleClick\tpagerisk=0\tdepartment=Procurement, Generics\turlsupercategory=User-defined\tappclass=Sales and Marketing\tdlpengine=None\turlclass=Bandwidth Loss\tthreatclass=None\tdlpdictionaries=None\tfileclass=None\tbwthrottle=NO\tservertranstime=0\tmd5=None") message = mt.render(mark="<134>", host=host) - sendsingle(message) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netproxy sourcetype=\"zscalernss-web\" hostname={{host}}.fls.doubleclick.net | head 2") search = st.render(host=host) From 774c7457aa6a43536277f82cfca1862ee260867b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 16:42:29 -0500 Subject: [PATCH 003/174] Update requirements.txt --- tests/requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/requirements.txt b/tests/requirements.txt index 9eb0109..a160322 100644 --- a/tests/requirements.txt +++ b/tests/requirements.txt @@ -16,4 +16,5 @@ flaky pytest pytest-docker pathlib2 -psutil \ No newline at end of file +psutil +requests \ No newline at end of file From d3ec262e25d8b69df63ac75c7127b84adf40a7ea Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 16:54:36 -0500 Subject: [PATCH 004/174] cleanup --- docker-compose-ci.yml | 4 ---- tests/requirements.txt | 1 - 2 files changed, 5 deletions(-) diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml index 1bd512b..7c1a4e6 100644 --- a/docker-compose-ci.yml +++ b/docker-compose-ci.yml @@ -12,10 +12,6 @@ services: build: ./tests entrypoint: - /entrypoint.sh - - --workers - - auto - - --tests-per-worker - - auto links: - splunk - sc4s diff --git a/tests/requirements.txt b/tests/requirements.txt index a160322..7e40d01 100644 --- a/tests/requirements.txt +++ b/tests/requirements.txt @@ -13,7 +13,6 @@ splunk-sdk flake8 pytz flaky -pytest pytest-docker pathlib2 psutil From 1a062846d81827074b2b99ce06d3ffacb07ac1c0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:01:29 -0500 Subject: [PATCH 005/174] Update docker-compose-ci.yml --- docker-compose-ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml index 7c1a4e6..794ec8b 100644 --- a/docker-compose-ci.yml +++ b/docker-compose-ci.yml @@ -12,6 +12,8 @@ services: build: ./tests entrypoint: - /entrypoint.sh + - --splunk_type=external + - --splunk_host=splunk links: - splunk - sc4s From 7bfb56fbeec1fb7903e585d90e2070d295d74127 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:11:58 -0500 Subject: [PATCH 006/174] CI work --- .github/workflows/test_matrix.yml | 33 +++++++++++++++++++++++++++++++ docker-compose-ci.yml | 3 +-- 2 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/test_matrix.yml diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml new file mode 100644 index 0000000..0841a45 --- /dev/null +++ b/.github/workflows/test_matrix.yml @@ -0,0 +1,33 @@ +name: Test Matrix + +on: [push] + +jobs: + build: + + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + syslog-version: [3.25.1,master] + splunk-version: [7.2,7.3,8.0,edge] + + steps: + - name: Checkout private tools + uses: actions/checkout@v2 + - name: Set up Python + uses: actions/setup-python@v1 + with: + python-version: 3.7 + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install -r tests/requirements.txt + - name: Test with pytest + run: | + pip install pytest + pytest -v \ + --rootdir=$(pwd) \ + --splunk_type=docker \ + --splunk_version=${{ matrix.splunk-version }} \ + --splunk_password=Changed@11 diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml index 794ec8b..a095a9f 100644 --- a/docker-compose-ci.yml +++ b/docker-compose-ci.yml @@ -14,13 +14,12 @@ services: - /entrypoint.sh - --splunk_type=external - --splunk_host=splunk + - --splunk_password=${SPLUNK_PASSWORD} links: - splunk - sc4s volumes: - sc4s-results:/work/test-results - environment: - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} sc4s: image: ${REGISTRY}/${CI_IMAGE}:${CIRCLE_SHA1} From ce5812e0efeaff5c74137e1a4ae2e575950ffd73 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:15:26 -0500 Subject: [PATCH 007/174] updates --- .circleci/config.yml | 2 -- docker-compose-ci.yml | 7 ++----- splunk/Dockerfile | 6 ++++++ tests/docker-compose.yml | 9 +++------ 4 files changed, 11 insertions(+), 13 deletions(-) create mode 100644 splunk/Dockerfile diff --git a/.circleci/config.yml b/.circleci/config.yml index 353c0ff..d7f9b02 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -115,10 +115,8 @@ jobs: docker container create --name dummy \ -v sc4s-tests:/work/tests \ -v sc4s-results:/work/test-results \ - -v splunk-etc:/work/splunk-etc \ registry.access.redhat.com/ubi7/ubi docker cp tests/ dummy:/work/tests/ - docker cp ./splunk/etc/* dummy:/work/splunk-etc/ docker rm dummy - run: name: Docker Compose build diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml index a095a9f..7bf9b87 100644 --- a/docker-compose-ci.yml +++ b/docker-compose-ci.yml @@ -45,7 +45,8 @@ services: - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 splunk: - image: splunk/splunk:latest + build: + context: splunk hostname: splunk ports: - "8000:8000" @@ -58,10 +59,6 @@ services: - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} - volumes: - - splunk-etc:/opt/splunk/etc volumes: sc4s-results: external: true - splunk-etc: - external: true diff --git a/splunk/Dockerfile b/splunk/Dockerfile new file mode 100644 index 0000000..b5d2d73 --- /dev/null +++ b/splunk/Dockerfile @@ -0,0 +1,6 @@ +ARG SPLUNK_VERSION=latest +FROM splunk/splunk:$SPLUNK_VERSION +ARG SPLUNK_APP=TA_UNKNOWN +ARG SOURCE_PACKAGE=package + +COPY etc/apps/ /opt/splunk/etc/apps/ \ No newline at end of file diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 5701d92..d30f959 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -57,7 +57,9 @@ services: volumes: - ./tls:/opt/syslog-ng/tls splunk: - image: splunk/splunk:latest + build: + context: ../splunk + hostname: splunk ports: - "8000" @@ -70,9 +72,4 @@ services: - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} - volumes: - - splunk-etc:/opt/splunk/etc -volumes: - splunk-etc: - external: true From 01b13c78e8171fe6a461becbab5107e73748bd42 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:18:41 -0500 Subject: [PATCH 008/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 0841a45..3ba0110 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -15,6 +15,12 @@ jobs: steps: - name: Checkout private tools uses: actions/checkout@v2 + - uses: azure/docker-login@v1 + with: + login-server: docker.pkg.github.com + username: ${{ secrets.GitHub_User }} + password: ${{ secrets.GitHub_PAT }} + - name: Set up Python uses: actions/setup-python@v1 with: From 88c9d3ba8fa2df15144b0bb24a7f1a6803d52e09 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:19:18 -0500 Subject: [PATCH 009/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 3ba0110..c925855 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -15,11 +15,11 @@ jobs: steps: - name: Checkout private tools uses: actions/checkout@v2 - - uses: azure/docker-login@v1 - with: - login-server: docker.pkg.github.com - username: ${{ secrets.GitHub_User }} - password: ${{ secrets.GitHub_PAT }} + - uses: azure/docker-login@v1 + with: + login-server: docker.pkg.github.com + username: ${{ secrets.GitHub_User }} + password: ${{ secrets.GitHub_PAT }} - name: Set up Python uses: actions/setup-python@v1 From 962ef472463f4e461711977ea1c67421bb4b2a0c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:22:01 -0500 Subject: [PATCH 010/174] Update docker-compose-ci.yml --- docker-compose-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml index 7bf9b87..39ac90f 100644 --- a/docker-compose-ci.yml +++ b/docker-compose-ci.yml @@ -15,6 +15,7 @@ services: - --splunk_type=external - --splunk_host=splunk - --splunk_password=${SPLUNK_PASSWORD} + - --sc4s_host=sc4s links: - splunk - sc4s From e39f9fff811c89e09cf6dd76dd0979f3595807f2 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:26:22 -0500 Subject: [PATCH 011/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index c925855..deab846 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -36,4 +36,8 @@ jobs: --rootdir=$(pwd) \ --splunk_type=docker \ --splunk_version=${{ matrix.splunk-version }} \ - --splunk_password=Changed@11 + --splunk_password=${{ secrets.GitHub_PAT }}@11 + env: + SPLUNKBASE_PASSWORD: ${{ secrets.SPLUNKBASE_PASSWORD }} + SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} + SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} From dbf88d8e069544eb65ccc432d3b3b857f8cc9052 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:32:06 -0500 Subject: [PATCH 012/174] Update conftest.py --- tests/conftest.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/conftest.py b/tests/conftest.py index 0af909b..d749d1c 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -35,6 +35,14 @@ def get_host_key(setup_wordlist): def pytest_addoption(parser): group = parser.getgroup('splunk-addon') + group.addoption( + '--sc4s_host', + action='store', + dest='sc4s_host', + default='127.0.0.1', + help='Address of the sc4s Server' + ) + group.addoption( '--splunk_app', action='store', From c812c60cc2926fffd6277615234b4c626d4a35f9 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:34:59 -0500 Subject: [PATCH 013/174] updates --- .github/workflows/test_matrix.yml | 3 ++- tests/conftest.py | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index deab846..2db1634 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -10,7 +10,8 @@ jobs: fail-fast: false matrix: syslog-version: [3.25.1,master] - splunk-version: [7.2,7.3,8.0,edge] + #splunk-version: [7.2,7.3,8.0,edge] + splunk-version: [7.3,8.0] steps: - name: Checkout private tools diff --git a/tests/conftest.py b/tests/conftest.py index d749d1c..9498ec7 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -173,7 +173,7 @@ def splunk_external(request): @pytest.fixture(scope="session") def sc4s_docker(request, docker_services, docker_ip): ports = { 514: docker_services.port_for("sc4s", 514) } - for x in range(5000, 5050): + for x in range(4999, 5050): ports.update({ x: docker_services.port_for("splunk", 8089)}) return docker_ip, ports @@ -182,7 +182,7 @@ def sc4s_docker(request, docker_services, docker_ip): @pytest.fixture(scope="session") def sc4s_external(request): ports = {514: 514} - for x in range(5000, 5050): + for x in range(4999, 5050): ports.update({x: x}) return request.config.getoption('sc4s_host'), ports From 2055d30d8342404c43961c3ea0d5739993bd69ef Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:44:04 -0500 Subject: [PATCH 014/174] updates --- .github/workflows/test_matrix.yml | 3 +++ tests/conftest.py | 2 +- tests/test_juniper_legacy.py | 2 +- tests/test_pfsense.py | 4 ++-- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 2db1634..3a6e462 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -30,6 +30,9 @@ jobs: run: | python -m pip install --upgrade pip pip install -r tests/requirements.txt + - name: Build + run: | + docker-compose -f test/docker-compose.yml build - name: Test with pytest run: | pip install pytest diff --git a/tests/conftest.py b/tests/conftest.py index 9498ec7..82a62d2 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -153,7 +153,7 @@ def splunk_docker(request, docker_services, docker_ip): } docker_services.wait_until_responsive( - timeout=180.0, pause=0.5, check=lambda: is_responsive_splunk(splunk) + timeout=300.0, pause=1.0, check=lambda: is_responsive_splunk(splunk) ) return splunk diff --git a/tests/test_juniper_legacy.py b/tests/test_juniper_legacy.py index f9696d9..afe147e 100644 --- a/tests/test_juniper_legacy.py +++ b/tests/test_juniper_legacy.py @@ -111,7 +111,7 @@ def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_ho "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 singleport=5000\n") message = mt.render(mark="<23>", host=host) - sendsingle(message, setup_sc4s[0], setup_sc4s[1][5000]) + sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5000]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"netscreen:firewall\" | head 2") search = st.render(host=host) diff --git a/tests/test_pfsense.py b/tests/test_pfsense.py index 2f8ee6a..e2d027b 100644 --- a/tests/test_pfsense.py +++ b/tests/test_pfsense.py @@ -18,7 +18,7 @@ def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk, setup_ mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} filterlog: 82,,,1000002666,mvneta2,match,pass,out,6,0x00,0x00000,64,ICMPv6,58,8,{{key}},\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) + sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) st = env.from_string("search index=netfw sourcetype=pfsense:filterlog \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -58,7 +58,7 @@ def test_pfsense_syslogd(record_property, setup_wordlist, setup_splunk, setup_sc mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} syslogd: restart {{key}}\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) + sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) st = env.from_string("search index=netops sourcetype=pfsense:syslogd \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) From 5761a90b604f076f41e5b22f1cbdeb876a7c1234 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 17:45:43 -0500 Subject: [PATCH 015/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 3a6e462..5080398 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -32,7 +32,7 @@ jobs: pip install -r tests/requirements.txt - name: Build run: | - docker-compose -f test/docker-compose.yml build + docker-compose -f tests/docker-compose.yml build - name: Test with pytest run: | pip install pytest From f7bf3de4a1c42c29207b8c9c03ffb8a0856cd966 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:12:34 -0500 Subject: [PATCH 016/174] updates --- tests/docker-compose.yml | 2 +- tests/sendmessage.py | 4 ++-- tests/test_checkpoint.py | 2 +- tests/test_juniper_legacy.py | 2 +- tests/test_pfsense.py | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index d30f959..ea5d212 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -38,7 +38,7 @@ services: links: - splunk environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} + - SPLUNK_HEC_URL=https://splunk:8088 - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no diff --git a/tests/sendmessage.py b/tests/sendmessage.py index 122381f..7618b97 100644 --- a/tests/sendmessage.py +++ b/tests/sendmessage.py @@ -9,8 +9,8 @@ import os def sendsingle(message, - host=os.getenv('SYSLOG_HOST', "sc4s"), - port=514): + host, + port): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_address = (host, port) diff --git a/tests/test_checkpoint.py b/tests/test_checkpoint.py index bd5e13f..9e1a9a0 100644 --- a/tests/test_checkpoint.py +++ b/tests/test_checkpoint.py @@ -21,7 +21,7 @@ def test_checkpoint_splunk_ips(record_property, setup_wordlist, setup_splunk, se "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} time={% now 'utc', '%s' %}|hostname={{ host }}|severity=Informational|confidence_level=Unknown|product=IPS|action=Drop|ifdir=inbound|ifname=bond2|loguid={0x5d9cdcc9,0x8d159f,0x5f19f392,0x1897a828}|origin=1.1.1.1|time={% now 'utc', '%s' %}|version=1|attack=Streaming Engine: TCP Segment Limit Enforcement|attack_info=TCP segment out of maximum allowed sequence. Packet dropped.|chassis_bladed_system=[ 1_3 ]|dst=10.10.10.10|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|performance_impact=0|protection_id=tcp_segment_limit|protection_name=TCP Segment Limit Enforcement|protection_type=settings_tcp|proto=6|rule=393|rule_name=10.384_..|rule_uid={9F77F944-8DD5-4ADF-803A-785D03B3A2E8}|s_port=46455|service=443|smartdefense_profile=Recommended_Protection_ded9e8d8ee89d|src=1.1.1.2|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][514]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) diff --git a/tests/test_juniper_legacy.py b/tests/test_juniper_legacy.py index afe147e..f9696d9 100644 --- a/tests/test_juniper_legacy.py +++ b/tests/test_juniper_legacy.py @@ -111,7 +111,7 @@ def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_ho "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 singleport=5000\n") message = mt.render(mark="<23>", host=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5000]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5000]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"netscreen:firewall\" | head 2") search = st.render(host=host) diff --git a/tests/test_pfsense.py b/tests/test_pfsense.py index e2d027b..2f8ee6a 100644 --- a/tests/test_pfsense.py +++ b/tests/test_pfsense.py @@ -18,7 +18,7 @@ def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk, setup_ mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} filterlog: 82,,,1000002666,mvneta2,match,pass,out,6,0x00,0x00000,64,ICMPv6,58,8,{{key}},\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netfw sourcetype=pfsense:filterlog \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -58,7 +58,7 @@ def test_pfsense_syslogd(record_property, setup_wordlist, setup_splunk, setup_sc mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} syslogd: restart {{key}}\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netops sourcetype=pfsense:syslogd \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) From aac930c59e054fe783a592503aeae7e8b5cab29a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:25:50 -0500 Subject: [PATCH 017/174] Update docker-compose.yml --- tests/docker-compose.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index ea5d212..f9f9381 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -66,10 +66,8 @@ services: - "8088" - "8089" environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} - - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} + - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 + - SPLUNK_PASSWORD=Changed@11 + - SPLUNK_START_ARGS=--accept-license + From 13d54dc878d7149ee383063bcc7beb3830498705 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:37:26 -0500 Subject: [PATCH 018/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 5080398..0aa5a0f 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -33,6 +33,13 @@ jobs: - name: Build run: | docker-compose -f tests/docker-compose.yml build + - name: Build + run: | + docker-compose -f tests/docker-compose.yml up + env: + SPLUNKBASE_PASSWORD: ${{ secrets.SPLUNKBASE_PASSWORD }} + SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} + SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} - name: Test with pytest run: | pip install pytest From 1094ea31a9c47dc6605acc411677c13d6ad2e2e7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:46:52 -0500 Subject: [PATCH 019/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 0aa5a0f..0e1b202 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -9,9 +9,9 @@ jobs: strategy: fail-fast: false matrix: - syslog-version: [3.25.1,master] + syslog-version: [3.25.1] #splunk-version: [7.2,7.3,8.0,edge] - splunk-version: [7.3,8.0] + splunk-version: [8.0] steps: - name: Checkout private tools From c0a9ae3b030fcde939268d9f80ead26dd989f465 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:53:41 -0500 Subject: [PATCH 020/174] Update docker-compose.yml --- tests/docker-compose.yml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index f9f9381..9986541 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -8,17 +8,6 @@ #work. If not, see . version: "3.7" services: - test: - build: . - - links: - - splunk - - sc4s - environment: - - SPLUNK_USER=admin - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_HOST=splunk - - SYSLOG_HOST=sc4s sc4s: build: @@ -39,7 +28,7 @@ services: - splunk environment: - SPLUNK_HEC_URL=https://splunk:8088 - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 From 95d49506e7ea1f69041cfb6523ca18fbe76b5f6b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:57:08 -0500 Subject: [PATCH 021/174] Update docker-compose.yml --- tests/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 9986541..446ecd4 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -27,7 +27,7 @@ services: links: - splunk environment: - - SPLUNK_HEC_URL=https://splunk:8088 + - SPLUNK_HEC_URL=http://splunk:8088 - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no From b16442bb7769bea3462779a5094e0675e908ef90 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:29:27 -0500 Subject: [PATCH 022/174] Update docker-compose.yml --- tests/docker-compose.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 446ecd4..a2b0ffc 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -12,7 +12,10 @@ services: sc4s: build: context: ../package - hostname: sc4s + networks: + new: + aliases: + - sc4s #When this is enabled test_common will fail # command: -det ports: @@ -27,7 +30,7 @@ services: links: - splunk environment: - - SPLUNK_HEC_URL=http://splunk:8088 + - SPLUNK_HEC_URL=https://splunk:8088 - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no @@ -49,7 +52,10 @@ services: build: context: ../splunk - hostname: splunk + networks: + new: + aliases: + - splunk ports: - "8000" - "8088" @@ -58,5 +64,7 @@ services: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SPLUNK_PASSWORD=Changed@11 - SPLUNK_START_ARGS=--accept-license + networks: + new: From 1b2dc0f9b8ad5d063bbe114fb4722a3bf0fc196f Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:31:17 -0500 Subject: [PATCH 023/174] Update docker-compose.yml --- tests/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index a2b0ffc..ce537e3 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -8,6 +8,8 @@ #work. If not, see . version: "3.7" services: + networks: + new: sc4s: build: @@ -64,7 +66,5 @@ services: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SPLUNK_PASSWORD=Changed@11 - SPLUNK_START_ARGS=--accept-license - networks: - new: From 90f7115d1e8b66dc50cd342a099278683b5e84e7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:35:17 -0500 Subject: [PATCH 024/174] Update docker-compose.yml --- tests/docker-compose.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index ce537e3..60e0ae4 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -8,16 +8,11 @@ #work. If not, see . version: "3.7" services: - networks: - new: sc4s: build: context: ../package - networks: - new: - aliases: - - sc4s + container_name: sc4s #When this is enabled test_common will fail # command: -det ports: @@ -54,10 +49,11 @@ services: build: context: ../splunk + container_name: splunk networks: new: aliases: - - splunk + - database ports: - "8000" - "8088" @@ -66,5 +62,7 @@ services: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SPLUNK_PASSWORD=Changed@11 - SPLUNK_START_ARGS=--accept-license + networks: + new: From 8784c3d32c0a1afa2ff76e730a6aece4f524f193 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:37:17 -0500 Subject: [PATCH 025/174] Update docker-compose.yml --- tests/docker-compose.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 60e0ae4..9a18b34 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -62,7 +62,4 @@ services: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SPLUNK_PASSWORD=Changed@11 - SPLUNK_START_ARGS=--accept-license - networks: - new: - From 5a837065036fba801dc83210669b679c15720799 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:39:52 -0500 Subject: [PATCH 026/174] Update docker-compose.yml --- tests/docker-compose.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 9a18b34..80b527c 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -50,10 +50,7 @@ services: context: ../splunk container_name: splunk - networks: - new: - aliases: - - database + ports: - "8000" - "8088" From 39856e7e0526ce595ee74e66ea26e4e316d4c19a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:43:15 -0500 Subject: [PATCH 027/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 0e1b202..7476a54 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -33,13 +33,6 @@ jobs: - name: Build run: | docker-compose -f tests/docker-compose.yml build - - name: Build - run: | - docker-compose -f tests/docker-compose.yml up - env: - SPLUNKBASE_PASSWORD: ${{ secrets.SPLUNKBASE_PASSWORD }} - SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} - SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} - name: Test with pytest run: | pip install pytest From 609df447f63beb3cd516c90df47d5195398799ef Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 19:59:39 -0500 Subject: [PATCH 028/174] updates --- .github/workflows/test_matrix.yml | 2 +- splunk/Dockerfile | 3 +-- tests/conftest.py | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 7476a54..f37806c 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -40,7 +40,7 @@ jobs: --rootdir=$(pwd) \ --splunk_type=docker \ --splunk_version=${{ matrix.splunk-version }} \ - --splunk_password=${{ secrets.GitHub_PAT }}@11 + --splunk_password=${{ secrets.GitHub_PAT }} env: SPLUNKBASE_PASSWORD: ${{ secrets.SPLUNKBASE_PASSWORD }} SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} diff --git a/splunk/Dockerfile b/splunk/Dockerfile index b5d2d73..7f1f8c0 100644 --- a/splunk/Dockerfile +++ b/splunk/Dockerfile @@ -1,6 +1,5 @@ ARG SPLUNK_VERSION=latest FROM splunk/splunk:$SPLUNK_VERSION -ARG SPLUNK_APP=TA_UNKNOWN -ARG SOURCE_PACKAGE=package + COPY etc/apps/ /opt/splunk/etc/apps/ \ No newline at end of file diff --git a/tests/conftest.py b/tests/conftest.py index 82a62d2..d79fc73 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -90,7 +90,7 @@ def pytest_addoption(parser): action='store', dest='splunk_version', default='latest', - help='Splunk password' + help='Splunk version' ) From e047d8d490c0350520721e5f4ca3347f84b9c6b2 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 20:25:53 -0500 Subject: [PATCH 029/174] Update docker-compose.yml --- tests/docker-compose.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 80b527c..ad37c4b 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -7,9 +7,17 @@ #You should have received a copy of the CC0 legalcode along with this #work. If not, see . version: "3.7" + +networks: + hostnet: + external: true + name: host + services: sc4s: + networks: + hostnet: {} build: context: ../package container_name: sc4s @@ -46,6 +54,8 @@ services: volumes: - ./tls:/opt/syslog-ng/tls splunk: + networks: + hostnet: {} build: context: ../splunk From 9501b4270590d3cf6143b3de74ce47b8a1766593 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 20:32:20 -0500 Subject: [PATCH 030/174] Update docker-compose.yml --- tests/docker-compose.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index ad37c4b..dc1f9fb 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -8,16 +8,18 @@ #work. If not, see . version: "3.7" -networks: - hostnet: - external: true - name: host +networks: + app_net: + ipam: + driver: bridge + config: + - subnet: "172.16.238.0/24" services: sc4s: networks: - hostnet: {} + app_net: {} build: context: ../package container_name: sc4s @@ -55,7 +57,7 @@ services: - ./tls:/opt/syslog-ng/tls splunk: networks: - hostnet: {} + app_net: {} build: context: ../splunk From 5356724a8274f933ef9ce1708e923c92e48ce538 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 20:38:26 -0500 Subject: [PATCH 031/174] Update docker-compose.yml --- tests/docker-compose.yml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index dc1f9fb..b8b1a29 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -9,20 +9,11 @@ version: "3.7" -networks: - app_net: - ipam: - driver: bridge - config: - - subnet: "172.16.238.0/24" services: sc4s: - networks: - app_net: {} build: context: ../package - container_name: sc4s #When this is enabled test_common will fail # command: -det ports: @@ -56,12 +47,9 @@ services: volumes: - ./tls:/opt/syslog-ng/tls splunk: - networks: - app_net: {} build: context: ../splunk - container_name: splunk ports: - "8000" From eac6567ad4f8208f989b6ad47ba51668af991fc7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:12:49 -0500 Subject: [PATCH 032/174] Update docker-compose.yml --- tests/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index b8b1a29..c42250e 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -54,7 +54,7 @@ services: ports: - "8000" - "8088" - - "8089" + - "8089:8089" environment: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - SPLUNK_PASSWORD=Changed@11 From d5af1eee28ba32ae05475ff2c62115b053b87e0c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:22:22 -0500 Subject: [PATCH 033/174] Update docker-compose.yml --- tests/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index c42250e..000be3b 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -53,7 +53,7 @@ services: ports: - "8000" - - "8088" + - "8088:8088" - "8089:8089" environment: - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 From 230254afed43b8d47b8f3ad155cdcb8bb55df26e Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:34:19 -0500 Subject: [PATCH 034/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index f37806c..8e420d7 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -33,12 +33,18 @@ jobs: - name: Build run: | docker-compose -f tests/docker-compose.yml build + - name: Build + run: | + docker-compose -f tests/docker-compose.yml -d up + sleep 80 - name: Test with pytest run: | pip install pytest pytest -v \ --rootdir=$(pwd) \ - --splunk_type=docker \ + --splunk_type=external \ + --splunk_host=splunk \ + --splunk_port=8089 \ --splunk_version=${{ matrix.splunk-version }} \ --splunk_password=${{ secrets.GitHub_PAT }} env: From 505c43b4a458f4dc06fec7a88d7f0074845a8814 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:40:35 -0500 Subject: [PATCH 035/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 8e420d7..22533bb 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -35,8 +35,9 @@ jobs: docker-compose -f tests/docker-compose.yml build - name: Build run: | - docker-compose -f tests/docker-compose.yml -d up + docker-compose -f tests/docker-compose.yml up -d sleep 80 + docker-compose -f tests/docker-compose.yml logs - name: Test with pytest run: | pip install pytest From 4e5f0c1aa333ae015b3bbc2b51c8362ac86742fa Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:53:24 -0500 Subject: [PATCH 036/174] updates --- .github/workflows/test_matrix.yml | 2 +- tests/docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 22533bb..46627ca 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -44,7 +44,7 @@ jobs: pytest -v \ --rootdir=$(pwd) \ --splunk_type=external \ - --splunk_host=splunk \ + --splunk_host=127.0.0.1 \ --splunk_port=8089 \ --splunk_version=${{ matrix.splunk-version }} \ --splunk_password=${{ secrets.GitHub_PAT }} diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 000be3b..ee6b801 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -42,7 +42,7 @@ services: - SC4S_LISTEN_JUNIPER_IDP_TCP_PORT=5004 - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - - SC4S_ARCHIVE_GLOBAL=yes + - SC4S_ARCHIVE_GLOBAL=no # - SC4S_SOURCE_STORE_RAWMSG=yes volumes: - ./tls:/opt/syslog-ng/tls From 56bd7ae205ef7148fa9615fafe7274479d54a121 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 21:58:56 -0500 Subject: [PATCH 037/174] update --- .github/workflows/test_matrix.yml | 8 ++++++-- tests/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 46627ca..6cdda08 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -38,6 +38,10 @@ jobs: docker-compose -f tests/docker-compose.yml up -d sleep 80 docker-compose -f tests/docker-compose.yml logs + env: + SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} + SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} + SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} - name: Test with pytest run: | pip install pytest @@ -47,8 +51,8 @@ jobs: --splunk_host=127.0.0.1 \ --splunk_port=8089 \ --splunk_version=${{ matrix.splunk-version }} \ - --splunk_password=${{ secrets.GitHub_PAT }} + --splunk_password=${{ secrets.SPLUNK_PASSWORD }} env: - SPLUNKBASE_PASSWORD: ${{ secrets.SPLUNKBASE_PASSWORD }} + SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index ee6b801..08076a7 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -29,7 +29,7 @@ services: - splunk environment: - SPLUNK_HEC_URL=https://splunk:8088 - - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 @@ -56,7 +56,7 @@ services: - "8088:8088" - "8089:8089" environment: - - SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 - - SPLUNK_PASSWORD=Changed@11 + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_START_ARGS=--accept-license From bfdddca8cf89553035051b5e909e45ccb58ee515 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 22:06:49 -0500 Subject: [PATCH 038/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 6cdda08..327a476 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -9,9 +9,8 @@ jobs: strategy: fail-fast: false matrix: - syslog-version: [3.25.1] - #splunk-version: [7.2,7.3,8.0,edge] - splunk-version: [8.0] + syslog-version: [3.25.1,master] + splunk-version: [7.2,7.3,8.0,edge] steps: - name: Checkout private tools From b3647a2a7b5b714714211708ac74ca2b83516f20 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 09:24:32 -0500 Subject: [PATCH 039/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 327a476..9f1d052 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -9,8 +9,10 @@ jobs: strategy: fail-fast: false matrix: - syslog-version: [3.25.1,master] - splunk-version: [7.2,7.3,8.0,edge] +# syslog-version: [3.25.1,master] +# splunk-version: [7.2,7.3,8.0,edge] + syslog-version: [3.25.1] + splunk-version: [8.0] steps: - name: Checkout private tools @@ -37,6 +39,8 @@ jobs: docker-compose -f tests/docker-compose.yml up -d sleep 80 docker-compose -f tests/docker-compose.yml logs + ping splunk + ping sc4s env: SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} From 16435f5453368321ca81d0c70bfd45cb4b3e7c4e Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:00:07 -0500 Subject: [PATCH 040/174] updates --- .github/workflows/test_matrix.yml | 2 -- tests/docker-compose.yml | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 9f1d052..62dfc88 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -39,8 +39,6 @@ jobs: docker-compose -f tests/docker-compose.yml up -d sleep 80 docker-compose -f tests/docker-compose.yml logs - ping splunk - ping sc4s env: SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 08076a7..93be669 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -29,7 +29,7 @@ services: - splunk environment: - SPLUNK_HEC_URL=https://splunk:8088 - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_HEC_TOKEN=3533e4bd-3eeb-4c57-aa6b-3151116a01d9 - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 @@ -56,7 +56,7 @@ services: - "8088:8088" - "8089:8089" environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_HEC_TOKEN=3533e4bd-3eeb-4c57-aa6b-3151116a01d9 - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_START_ARGS=--accept-license From 29f162515c3d6b256f4541c686511cb379106bf7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:17:09 -0500 Subject: [PATCH 041/174] Update docker-compose.yml --- tests/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 93be669..26ccd0a 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -17,9 +17,9 @@ services: #When this is enabled test_common will fail # command: -det ports: - - "514" + - "514:514" - "601" - - "514/udp" + - "514:514/udp" - "5000-5050" - "5000-5200/udp" - "6514" From 4b595d1896369e8d7a2be112434d14864f926925 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:35:21 -0500 Subject: [PATCH 042/174] update --- .github/workflows/test_matrix.yml | 42 ++++--------------------------- package/Dockerfile | 3 ++- 2 files changed, 7 insertions(+), 38 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 62dfc88..f6fe6a3 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -9,10 +9,7 @@ jobs: strategy: fail-fast: false matrix: -# syslog-version: [3.25.1,master] -# splunk-version: [7.2,7.3,8.0,edge] - syslog-version: [3.25.1] - splunk-version: [8.0] + syslog-version: [3.25.1,master] steps: - name: Checkout private tools @@ -23,37 +20,8 @@ jobs: username: ${{ secrets.GitHub_User }} password: ${{ secrets.GitHub_PAT }} - - name: Set up Python - uses: actions/setup-python@v1 - with: - python-version: 3.7 - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install -r tests/requirements.txt - - name: Build - run: | - docker-compose -f tests/docker-compose.yml build - - name: Build + - name: Build for ${{ matrix.version }} run: | - docker-compose -f tests/docker-compose.yml up -d - sleep 80 - docker-compose -f tests/docker-compose.yml logs - env: - SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} - SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} - SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} - - name: Test with pytest - run: | - pip install pytest - pytest -v \ - --rootdir=$(pwd) \ - --splunk_type=external \ - --splunk_host=127.0.0.1 \ - --splunk_port=8089 \ - --splunk_version=${{ matrix.splunk-version }} \ - --splunk_password=${{ secrets.SPLUNK_PASSWORD }} - env: - SPLUNK_PASSWORD: ${{ secrets.SPLUNK_PASSWORD }} - SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} - SPLUNK_START_ARGS: ${{ secrets.SPLUNK_START_ARGS }} + docker build --build-arg BRANCH=${{ matrix.version }} package \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.version }}-${{ github.sha }} + diff --git a/package/Dockerfile b/package/Dockerfile index 905d8d1..464a22c 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -6,7 +6,8 @@ # #You should have received a copy of the CC0 legalcode along with this #work. If not, see . -FROM docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:3.25.1 +ARG BRANCH=master +FROM docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:${BRANCH} COPY --from=hairyhenderson/gomplate:v3.5.0 /gomplate /usr/local/bin/gomplate From 96070911bb5d2be788021f6913d3fd2a582aff8c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:36:29 -0500 Subject: [PATCH 043/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index f6fe6a3..4fd511f 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -20,8 +20,8 @@ jobs: username: ${{ secrets.GitHub_User }} password: ${{ secrets.GitHub_PAT }} - - name: Build for ${{ matrix.version }} + - name: Build for ${{ matrix.syslog-version }} run: | docker build --build-arg BRANCH=${{ matrix.version }} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.version }}-${{ github.sha }} + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} From 272bf208da6581713a490ffa1a1911b8b0b1b0f7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:37:13 -0500 Subject: [PATCH 044/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 4fd511f..d5b052a 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -22,6 +22,6 @@ jobs: - name: Build for ${{ matrix.syslog-version }} run: | - docker build --build-arg BRANCH=${{ matrix.version }} package \ + docker build --build-arg BRANCH=${{ matrix.syslog-version }} package \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} From 98191b0e15f380ac6c500552d645c07ad1a731dc Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:40:59 -0500 Subject: [PATCH 045/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index d5b052a..4c5a33e 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -3,7 +3,7 @@ name: Test Matrix on: [push] jobs: - build: + build-sc4s: runs-on: ubuntu-latest strategy: @@ -24,4 +24,7 @@ jobs: run: | docker build --build-arg BRANCH=${{ matrix.syslog-version }} package \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + - name: Push stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + From 26238fd9dec715a8272676e3996be9a843319507 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:42:51 -0500 Subject: [PATCH 046/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 4c5a33e..cf35021 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -28,3 +28,26 @@ jobs: run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + build-splunk: + + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + splunk-version: [7.2,7.3,8.0] + + steps: + - name: Checkout private tools + uses: actions/checkout@v2 + - uses: azure/docker-login@v1 + with: + login-server: docker.pkg.github.com + username: ${{ secrets.GitHub_User }} + password: ${{ secrets.GitHub_PAT }} + + - name: Build for ${{ matrix.splunk-version }} + run: | + docker build --build-arg SPLUNK_VERSION=${{ matrix.splunk-version }} splunk \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} + - name: Push stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} + run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} \ No newline at end of file From 7842e58b7356fcaa6c331ec44dba45f35054d286 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:44:47 -0500 Subject: [PATCH 047/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index cf35021..a895b55 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -34,7 +34,7 @@ jobs: strategy: fail-fast: false matrix: - splunk-version: [7.2,7.3,8.0] + splunk-version: [7.2, 7.3, 8.0] steps: - name: Checkout private tools From 2dd98912ea14da5ed8f2f24bb5157a0c8e8de122 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:45:49 -0500 Subject: [PATCH 048/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index a895b55..a0920bf 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -9,7 +9,7 @@ jobs: strategy: fail-fast: false matrix: - syslog-version: [3.25.1,master] + syslog-version: ['3.25.1','master' ] steps: - name: Checkout private tools @@ -34,7 +34,7 @@ jobs: strategy: fail-fast: false matrix: - splunk-version: [7.2, 7.3, 8.0] + splunk-version: ['7.2', '7.3', '8.0', 'latest'] steps: - name: Checkout private tools From ef83293d54242a8ecacd9332524fefa4d141d183 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 10:52:07 -0500 Subject: [PATCH 049/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 32 ++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index a0920bf..6115422 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -50,4 +50,34 @@ jobs: docker build --build-arg SPLUNK_VERSION=${{ matrix.splunk-version }} splunk \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - name: Push stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} \ No newline at end of file + run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} + + test: + needs: [build-sc4s, build-splunk] + + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + splunk-version: ['7.2', '7.3', '8.0', 'latest'] + syslog-version: ['3.25.1','master' ] + + services: + splunk: + image: docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} + # Map port 8080 on the Docker host to port 80 on the nginx container + ports: + - 8089:8089 + - 8088:8088 + - 8000:8000 + sc4s: + image: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + # Map TCP port 6379 on Docker host to a random free port on the Redis container + ports: + - 514:514/tcp + - 514:514/udp + + steps: + - name: Checkout private tools + uses: actions/checkout@v2 + From c127efbccdac76ba55f76d9ba23272f0a0c3ea6b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:04:40 -0500 Subject: [PATCH 050/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 6115422..fe54dec 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -19,14 +19,24 @@ jobs: login-server: docker.pkg.github.com username: ${{ secrets.GitHub_User }} password: ${{ secrets.GitHub_PAT }} - + - uses: azure/docker-login@v1 + with: + login-server: hub.docker.com + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Build for ${{ matrix.syslog-version }} run: | docker build --build-arg BRANCH=${{ matrix.syslog-version }} package \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - name: Push stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - + - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + run: | + docker tag docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:${{ github.sha }} \ + rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + - name: push rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + run: | + docker push rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} build-splunk: From 876c3f699f48e493fe28b0deba75c4dcf78abf8c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:19:51 -0500 Subject: [PATCH 051/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index fe54dec..1dbe93f 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -19,17 +19,17 @@ jobs: login-server: docker.pkg.github.com username: ${{ secrets.GitHub_User }} password: ${{ secrets.GitHub_PAT }} - - uses: azure/docker-login@v1 - with: - login-server: hub.docker.com - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Build for ${{ matrix.syslog-version }} run: | docker build --build-arg BRANCH=${{ matrix.syslog-version }} package \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - name: Push stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + - uses: azure/docker-login@v1 + with: + login-server: hub.docker.com + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | docker tag docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:${{ github.sha }} \ From 7f73400f169f1bc14aa82c716c3b4059d72aa3d5 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:21:54 -0500 Subject: [PATCH 052/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 1dbe93f..f2696af 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -32,7 +32,7 @@ jobs: password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | - docker tag docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:${{ github.sha }} \ + docker tag docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} \ rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - name: push rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | From 6f14c6d24ebb5c93c2f07aff3fada38033c890c9 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:24:45 -0500 Subject: [PATCH 053/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index f2696af..9a8e044 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -27,7 +27,7 @@ jobs: run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - uses: azure/docker-login@v1 with: - login-server: hub.docker.com + login-server: docker.io username: ${{ secrets.DOCKER_HUB_USER }} password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} From a321154f31fd012647f7b472312fd6bc687236ed Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:30:47 -0500 Subject: [PATCH 054/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 9a8e044..9275e0d 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -33,10 +33,10 @@ jobs: - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | docker tag docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} \ - rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - - name: push rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + rfaircloth/stg-sc4s::sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + - name: push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | - docker push rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + docker push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} build-splunk: From b858165aa0c2a951b46b987715ad01ee7070d7aa Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:34:13 -0500 Subject: [PATCH 055/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index 9275e0d..a9db21d 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -33,7 +33,7 @@ jobs: - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | docker tag docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} \ - rfaircloth/stg-sc4s::sc4s-${{ matrix.syslog-version }}-${{ github.sha }} + rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - name: push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: | docker push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} From b38302fbe2dfcd377621533674f10da5474d68cf Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 11:44:42 -0500 Subject: [PATCH 056/174] Update test_matrix.yml --- .github/workflows/test_matrix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index a9db21d..b15309c 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -27,7 +27,7 @@ jobs: run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - uses: azure/docker-login@v1 with: - login-server: docker.io + login-server: index.docker.io username: ${{ secrets.DOCKER_HUB_USER }} password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} From 802b150d5a1115c59bf0528005527502b373afdd Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:20:46 -0500 Subject: [PATCH 057/174] updates --- .circleci/config.yml | 418 +----------------------------- .github/workflows/test_matrix.yml | 12 - 2 files changed, 10 insertions(+), 420 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index d7f9b02..abd5a4f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -12,414 +12,16 @@ orbs: go: circleci/go@0.2.0 snyk: snyk/snyk@0.0.8 versioning: kollex/versioning@1.0.0 -jobs: - build: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - run: git submodule update --init --recursive - - run: mkdir /tmp/workspace - - - versioning/define_version - - versioning/create_version_file: - version_file_path: /tmp/workspace/VERSION - - run: - name: Record version - command: | - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - echo $DOCKER_TAG-${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:7}>package/VERSION - - docker/install-docker - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - docker/build: - image: $CI_IMAGE - registry: $REGISTRY - path: package - - - docker/install-goss: - version: v0.3.7 - - run: - name: Test Docker - command: | - mkdir -p /tmp/test-results - # Don't forget path! - export PATH=$PATH:~/bin - pushd package - GOSS_VER=v0.3.7 GOSS_FMT_OPTIONS="perfdata verbose" GOSS_FILES_STRATEGY=cp GOSS_OPTS="--max-concurrent=1 --format junit" dgoss run -t $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 3>&1 1>&2 2>&3 > /tmp/goss.tmp || true ; cat /tmp/goss.tmp | grep -v "<" - popd - cat /tmp/goss.tmp | grep "[<\>]" > /tmp/test-results/goss.xml - - - docker/push: - registry: $REGISTRY - image: $CI_IMAGE - - - run: | - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$CI_IMAGE:$DOCKER_TAG - docker push $REGISTRY/$CI_IMAGE:$DOCKER_TAG - - run: - name: Docker Save - command: | - docker save $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 | gzip -c > /tmp/workspace/oci_container.tar.gz - - run: - name: BYOE Config - command: | - tar rvf /tmp/workspace/baremetal.tar -C package/etc . - tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - - store_test_results: - path: /tmp/test-results/goss.xml - - - persist_to_workspace: - root: /tmp - paths: - - workspace - - test-unit: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - run: git submodule sync - - run: git submodule update --init --recursive - - #- docker/install-docker-tools - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: - name: Setup test volume - command: | - mkdir /tmp/test-results - docker volume create sc4s-tests - docker volume create sc4s-results - - docker container create --name dummy \ - -v sc4s-tests:/work/tests \ - -v sc4s-results:/work/test-results \ - registry.access.redhat.com/ubi7/ubi - docker cp tests/ dummy:/work/tests/ - docker rm dummy - - run: - name: Docker Compose build - command: | - docker-compose build test - - run: - name: Docker Compose up - command: | - export IMAGE_NAME=$CIRCLE_PROJECT_REPONAME - docker-compose -f ./docker-compose-ci.yml up -d splunk - sleep 70 - docker-compose -f ./docker-compose-ci.yml up --abort-on-container-exit - - run: - name: Collect test results from Docker Compose - command: | - docker container create --name dummy \ - -v sc4s-tests:/work/tests \ - -v sc4s-results:/work/test-results \ - registry.access.redhat.com/ubi7/ubi - - docker cp dummy:/work/test-results/functional /tmp/test-results - docker rm dummy - when: always - - store_test_results: - path: /tmp/test-results - test-scan-synk: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - run: git submodule sync - - run: git submodule update --init --recursive - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - snyk/scan: - docker-image-name: $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - target-file: package/Dockerfile - project: '${CIRCLE_PROJECT_REPONAME}/${CIRCLE_BRANCH}-container' +shared: &shared + docker: + - image: circleci/buildpack-deps:18.04 + steps: + - setup_remote_docker: + docker_layer_caching: true + - checkout - test-scan-synk-nomonitor: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - run: git submodule sync - - run: git submodule update --init --recursive - - snyk/scan: - docker-image-name: $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - target-file: package/Dockerfile - project: '${CIRCLE_PROJECT_REPONAME}/${CIRCLE_BRANCH}-container' - monitor-on-build: false - - publish-branch: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - REGISTRY_PUBLIC: docker.pkg.github.com - PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases - - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - run: | - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - echo docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 -t $REGISTRY_PUBLIC/$PUBLIC_IMAGE:$DOCKER_TAG - docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY_PUBLIC/$PUBLIC_IMAGE:$DOCKER_TAG - docker push $REGISTRY_PUBLIC/$PUBLIC_IMAGE:$DOCKER_TAG - - publish-edge: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - REGISTRY_PUBLIC: docker.pkg.github.com - PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$PUBLIC_IMAGE:edge - - docker/push: - registry: $REGISTRY - image: $PUBLIC_IMAGE - tag: edge - - docker/check: - docker-username: DOCKER_USER - docker-password: DOCKER_PASS - - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 splunk/scs:edge - - docker/push: - image: splunk/scs - tag: edge - - go/install - - attach_workspace: - at: /tmp - - run: - name: "Publish edge on GitHub" - command: | - PATH=$PATH:/usr/local/go/bin - go get -v -u github.com/tcnksm/ghr - $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -prerelease -delete edge /tmp/workspace/ - - store_artifacts: - path: /tmp/workspace/ - - publish-latest: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - REGISTRY_PUBLIC: docker.pkg.github.com - PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases - - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$PUBLIC_IMAGE:latest - - docker/push: - registry: $REGISTRY - image: $PUBLIC_IMAGE - tag: latest - - docker/check: - docker-username: DOCKER_USER - docker-password: DOCKER_PASS - - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 splunk/scs:latest - - docker/push: - image: splunk/scs - tag: latest - - - go/install - - attach_workspace: - at: /tmp - - run: - name: "Publish edge on GitHub" - command: | - PATH=$PATH:/usr/local/go/bin - go get -v -u github.com/tcnksm/ghr - $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -delete latest /tmp/workspace/ - - store_artifacts: - path: /tmp/workspace/ - - publish-tag: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - REGISTRY_PUBLIC: docker.pkg.github.com - PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases - - steps: - - setup_remote_docker: - docker_layer_caching: true - - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN - - run: docker pull $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 - - - run: | - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$PUBLIC_IMAGE:$DOCKER_TAG - docker push $REGISTRY/$PUBLIC_IMAGE:$DOCKER_TAG - - docker/check: - docker-username: DOCKER_USER - docker-password: DOCKER_PASS - - run: | - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 splunk/scs:$DOCKER_TAG - docker push splunk/scs:$DOCKER_TAG - - - go/install - - attach_workspace: - at: /tmp - - run: - name: "Publish edge on GitHub" - command: | - PATH=$PATH:/usr/local/go/bin - go get -v -u github.com/tcnksm/ghr - CIRCLE_BRANCH_CLEAN=$(echo ${CIRCLE_BRANCH} | sed 's/[^a-zA-Z0-9\._-]//g') - if [ -n "${CIRCLE_TAG}" ]; then DOCKER_TAG=${CIRCLE_TAG}; else DOCKER_TAG="${CIRCLE_BRANCH_CLEAN}"; fi - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${CIRCLE_BRANCH_CLEAN}@${CIRCLE_SHA1:0:6}"; fi - $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -delete $VERSION /tmp/workspace/ - - store_artifacts: - path: /tmp/workspace/ +jobs: + build: + <<: *shared -workflows: - version: 2 - build-branches: - jobs: - - build - - test-unit: - requires: - - build - - test-scan-synk: - requires: - - build - filters: - branches: - only: - - master - - test-scan-synk-nomonitor: - requires: - - build - filters: - branches: - ignore: - - master - - publish-branch: - requires: - - build - - publish-edge: - requires: - - build - - test-unit - filters: - branches: - only: - - develop - - publish-latest: - requires: - - build - - test-unit - filters: - branches: - only: - - master - build-tags: - jobs: - - build: - filters: - tags: - only: /^\d*\.\d*\.\d*.*$/ - branches: - ignore: /.*/ - - test-unit: - filters: - tags: - only: /^\d*\.\d*\.\d*.*$/ - branches: - ignore: /.*/ - requires: - - build - - test-scan-synk: - filters: - tags: - only: /^\d*\.\d*\.\d*.*$/ - branches: - ignore: /.*/ - requires: - - build - - publish-tag: - requires: - - build - - test-unit - #- test-scan-synk - filters: - tags: - only: /^\d*\.\d*\.\d*.*$/ - branches: - ignore: /.*/ diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml index b15309c..2ffcbb1 100644 --- a/.github/workflows/test_matrix.yml +++ b/.github/workflows/test_matrix.yml @@ -25,18 +25,6 @@ jobs: -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - name: Push stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - - uses: azure/docker-login@v1 - with: - login-server: index.docker.io - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} - - name: Tag rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - run: | - docker tag docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} \ - rfaircloth/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - - name: push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - run: | - docker push ${{ secrets.DOCKER_HUB_USER }}/stg-sc4s:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} build-splunk: From 6418b2f6e43f3eaddfa14692f939cb8116627e10 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:27:32 -0500 Subject: [PATCH 058/174] Update config.yml --- .circleci/config.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index abd5a4f..3ba382f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -20,8 +20,18 @@ shared: &shared - setup_remote_docker: docker_layer_caching: true - checkout + - name: Build for ${{ matrix.syslog-version }} + command: | + docker build --build-arg BRANCH=${{ BRANCH }} package \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} jobs: - build: + 'build-sc4s-3.25.1': <<: *shared + environment: + BRANCH: 3.25.1 + + + + From f3d6e992b3240ce8d3385f76c1cc4b16cb536bb7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:39:33 -0500 Subject: [PATCH 059/174] Update config.yml --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 3ba382f..5d66620 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -28,8 +28,8 @@ shared: &shared jobs: 'build-sc4s-3.25.1': <<: *shared - environment: - BRANCH: 3.25.1 + environment: + BRANCH: 3.25.1 From 317c6585eaf8e44f35148e16eeaa2600a9a37919 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:47:05 -0500 Subject: [PATCH 060/174] Update config.yml --- .circleci/config.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 5d66620..4548cf3 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -14,8 +14,7 @@ orbs: versioning: kollex/versioning@1.0.0 shared: &shared - docker: - - image: circleci/buildpack-deps:18.04 + steps: - setup_remote_docker: docker_layer_caching: true @@ -28,6 +27,8 @@ shared: &shared jobs: 'build-sc4s-3.25.1': <<: *shared + docker: + - image: circleci/buildpack-deps:18.04 environment: BRANCH: 3.25.1 From 4a2c5bacb0118fb21e556536e371efce76a16bb0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:55:05 -0500 Subject: [PATCH 061/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 4548cf3..d1f7629 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -25,7 +25,7 @@ shared: &shared -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} jobs: - 'build-sc4s-3.25.1': + build-sc4s-3.25.1: <<: *shared docker: - image: circleci/buildpack-deps:18.04 From 27e52823553270072dba9b5d1aff4077551bdcfe Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 12:59:35 -0500 Subject: [PATCH 062/174] Update config.yml --- .circleci/config.yml | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index d1f7629..8c03d24 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -7,30 +7,32 @@ #You should have received a copy of the CC0 legalcode along with this #work. If not, see . version: 2.1 -orbs: - docker: circleci/docker@0.5.20 - go: circleci/go@0.2.0 - snyk: snyk/snyk@0.0.8 - versioning: kollex/versioning@1.0.0 shared: &shared steps: + - checkout - setup_remote_docker: docker_layer_caching: true - - checkout - - name: Build for ${{ matrix.syslog-version }} + - name: Build command: | docker build --build-arg BRANCH=${{ BRANCH }} package \ -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} +orbs: + docker: circleci/docker@0.5.20 + go: circleci/go@0.2.0 + snyk: snyk/snyk@0.0.8 + versioning: kollex/versioning@1.0.0 + + jobs: - build-sc4s-3.25.1: - <<: *shared + build-sc4s-3-25-1: docker: - image: circleci/buildpack-deps:18.04 environment: BRANCH: 3.25.1 + <<: *shared From 51d1a633254bcc63d5700cb8440a373e30f042da Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 13:03:37 -0500 Subject: [PATCH 063/174] Update config.yml --- .circleci/config.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 8c03d24..3d3206d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -37,4 +37,8 @@ jobs: - +workflows: + version: 2 + build_and_deploy: + jobs: + - build-sc4s-3-25-1 From 81e7527199f0726b355ac04b1d48f7f4fe935470 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:24:04 -0500 Subject: [PATCH 064/174] Update config.yml --- .circleci/config.yml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 3d3206d..06f0c12 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -9,15 +9,11 @@ version: 2.1 shared: &shared - steps: - - checkout + - checkout: - setup_remote_docker: docker_layer_caching: true - - name: Build - command: | - docker build --build-arg BRANCH=${{ BRANCH }} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} + orbs: docker: circleci/docker@0.5.20 @@ -36,7 +32,6 @@ jobs: - workflows: version: 2 build_and_deploy: From 0e4f66f578a5a08503b1ba389af8d3ef491d482c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:25:12 -0500 Subject: [PATCH 065/174] Update config.yml --- .circleci/config.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 06f0c12..dfed521 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -10,10 +10,13 @@ version: 2.1 shared: &shared steps: - - checkout: + - checkout - setup_remote_docker: docker_layer_caching: true - + - name: Build + run: | + docker build --build-arg BRANCH=${{ BRANCH }} package \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} orbs: docker: circleci/docker@0.5.20 From 4894612e310f371bc94fa54426936b154ca0d548 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:29:45 -0500 Subject: [PATCH 066/174] Update config.yml --- .circleci/config.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index dfed521..914d941 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -13,10 +13,11 @@ shared: &shared - checkout - setup_remote_docker: docker_layer_caching: true - - name: Build - run: | - docker build --build-arg BRANCH=${{ BRANCH }} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} + - run: + name: Build + command: | + docker build --build-arg BRANCH=${{ BRANCH }} package \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} orbs: docker: circleci/docker@0.5.20 From 049174557fa71a845a6b1281a70c44a09d77c742 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:32:10 -0500 Subject: [PATCH 067/174] Update config.yml --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 914d941..1092168 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -16,8 +16,8 @@ shared: &shared - run: name: Build command: | - docker build --build-arg BRANCH=${{ BRANCH }} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ BRANCH }}-${{ github.sha }} + docker build --build-arg BRANCH=${BRANCH} package \ + -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${BRANCH}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 From 228aa5500012cab2f492fb416cbd3ab554cb9812 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:35:03 -0500 Subject: [PATCH 068/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1092168..1aa7029 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -17,7 +17,7 @@ shared: &shared name: Build command: | docker build --build-arg BRANCH=${BRANCH} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${BRANCH}-<< pipeline.id >> + -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${BRANCH}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 From 98901f6c157b3cc2a51535306a56e7c7c7ae96ca Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:37:43 -0500 Subject: [PATCH 069/174] Update config.yml --- .circleci/config.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1aa7029..44fe032 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -16,9 +16,8 @@ shared: &shared - run: name: Build command: | - docker build --build-arg BRANCH=${BRANCH} package \ - -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${BRANCH}-<< pipeline.id >> - + docker build --build-arg BRANCH=${SYSLOG} package \ + -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 go: circleci/go@0.2.0 @@ -31,7 +30,7 @@ jobs: docker: - image: circleci/buildpack-deps:18.04 environment: - BRANCH: 3.25.1 + SYSLOG: 3.25.1 <<: *shared From 2dd5f566d6bedaf152b4f79a0dfb8204f5558291 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:40:08 -0500 Subject: [PATCH 070/174] Update config.yml --- .circleci/config.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 44fe032..6459d8f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -14,7 +14,7 @@ shared: &shared - setup_remote_docker: docker_layer_caching: true - run: - name: Build + name: Build SC4S command: | docker build --build-arg BRANCH=${SYSLOG} package \ -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> @@ -32,6 +32,12 @@ jobs: environment: SYSLOG: 3.25.1 <<: *shared + build-sc4s-master: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: master + <<: *shared From 6cefa133f32499907bbfaa7a4da6e4001cd7145b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:40:37 -0500 Subject: [PATCH 071/174] Update config.yml --- .circleci/config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6459d8f..f4ecd96 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -46,3 +46,4 @@ workflows: build_and_deploy: jobs: - build-sc4s-3-25-1 + - build-sc4s-master From 24c4bc664af3f7300c6e502985d64e0003c064ec Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 14:48:30 -0500 Subject: [PATCH 072/174] Update config.yml --- .circleci/config.yml | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index f4ecd96..2e28882 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -8,7 +8,7 @@ #work. If not, see . version: 2.1 -shared: &shared +build-sc4s: &build-sc4s steps: - checkout - setup_remote_docker: @@ -18,6 +18,18 @@ shared: &shared command: | docker build --build-arg BRANCH=${SYSLOG} package \ -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + +build-splunk: &build-splunk + steps: + - checkout + - setup_remote_docker: + docker_layer_caching: true + - run: + name: Build SC4S + command: | + docker build --build-arg BRANCH=${SYSLOG} package \ + -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + orbs: docker: circleci/docker@0.5.20 go: circleci/go@0.2.0 @@ -31,13 +43,33 @@ jobs: - image: circleci/buildpack-deps:18.04 environment: SYSLOG: 3.25.1 - <<: *shared + <<: *build-sc4s build-sc4s-master: docker: - image: circleci/buildpack-deps:18.04 environment: SYSLOG: master - <<: *shared + <<: *build-sc4s + build-splunk-7-2: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SPLUNK: 7.2 + <<: *build-splunk + + build-splunk-7-3: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SPLUNK: 7.3 + <<: *build-splunk + + build-splunk-8-0: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SPLUNK: 8.0 + <<: *build-splunk @@ -47,3 +79,6 @@ workflows: jobs: - build-sc4s-3-25-1 - build-sc4s-master + - build-splunk-7-2 + - build-splunk-7-3 + - build-splunk-8-0 From 0041e6aa61c5fbc8446421c67f7e058975dff4d5 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:08:31 -0500 Subject: [PATCH 073/174] Update config.yml --- .circleci/config.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 2e28882..5e697de 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -25,10 +25,10 @@ build-splunk: &build-splunk - setup_remote_docker: docker_layer_caching: true - run: - name: Build SC4S + name: Build Splunk command: | - docker build --build-arg BRANCH=${SYSLOG} package \ - -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + docker build --build-arg SPLUNK_VERSION=${SYSLOG} splunk \ + -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 From 7266e410bf6368e0bcdd29ed29ea6d9162ffd071 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:09:30 -0500 Subject: [PATCH 074/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 5e697de..6638be7 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -27,7 +27,7 @@ build-splunk: &build-splunk - run: name: Build Splunk command: | - docker build --build-arg SPLUNK_VERSION=${SYSLOG} splunk \ + docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> orbs: From 274bf99ef653247321235d65dbae098ab7367060 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:10:33 -0500 Subject: [PATCH 075/174] Update config.yml --- .circleci/config.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6638be7..5cb4cbc 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -42,33 +42,33 @@ jobs: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: 3.25.1 + SYSLOG: '3.25.1' <<: *build-sc4s build-sc4s-master: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: master + SYSLOG: 'master' <<: *build-sc4s build-splunk-7-2: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: 7.2 + SPLUNK: '7.2' <<: *build-splunk build-splunk-7-3: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: 7.3 + SPLUNK: '7.3' <<: *build-splunk build-splunk-8-0: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: 8.0 + SPLUNK: '8.0' <<: *build-splunk From 95e15219666446364efc848a42bfe8de8c6bf35a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:15:23 -0500 Subject: [PATCH 076/174] Update config.yml --- .circleci/config.yml | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 5cb4cbc..9a26fdd 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -13,22 +13,42 @@ build-sc4s: &build-sc4s - checkout - setup_remote_docker: docker_layer_caching: true + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: name: Build SC4S command: | docker build --build-arg BRANCH=${SYSLOG} package \ -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + - run: + name: Push SC4S + command: | + docker push \ + docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> build-splunk: &build-splunk steps: - checkout - setup_remote_docker: docker_layer_caching: true + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: name: Build Splunk command: | docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + - run: + name: Push Splunk + command: | + docker push \ + docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 @@ -38,6 +58,7 @@ orbs: jobs: +#JOB SC4S build-sc4s-3-25-1: docker: - image: circleci/buildpack-deps:18.04 @@ -50,20 +71,19 @@ jobs: environment: SYSLOG: 'master' <<: *build-sc4s +#JOB SPLUNK build-splunk-7-2: docker: - image: circleci/buildpack-deps:18.04 environment: SPLUNK: '7.2' <<: *build-splunk - build-splunk-7-3: docker: - image: circleci/buildpack-deps:18.04 environment: SPLUNK: '7.3' <<: *build-splunk - build-splunk-8-0: docker: - image: circleci/buildpack-deps:18.04 @@ -71,8 +91,6 @@ jobs: SPLUNK: '8.0' <<: *build-splunk - - workflows: version: 2 build_and_deploy: From fc9d35d39082afb2296a2faaf5e7dcec3ea673dc Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:17:19 -0500 Subject: [PATCH 077/174] Update config.yml --- .circleci/config.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 9a26fdd..cec364c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -22,12 +22,12 @@ build-sc4s: &build-sc4s name: Build SC4S command: | docker build --build-arg BRANCH=${SYSLOG} package \ - -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> - run: name: Push SC4S command: | docker push \ - docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> build-splunk: &build-splunk steps: @@ -43,12 +43,12 @@ build-splunk: &build-splunk name: Build Splunk command: | docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ - -t docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> orbs: docker: circleci/docker@0.5.20 From debf000aff54e9d70479efee5bb6468c1eb6c2d8 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:27:44 -0500 Subject: [PATCH 078/174] updates --- .circleci/config.yml | 36 ++++++++++++++++++++++++++++++++++++ tests/docker-compose.yml | 19 ++++++++----------- 2 files changed, 44 insertions(+), 11 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index cec364c..60fe175 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -50,6 +50,30 @@ build-splunk: &build-splunk docker push \ docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + +test: &test + steps: + - checkout + - setup_remote_docker: + docker_layer_caching: true + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com + - run: + name: Setup for testing + command: | + pip3 -r tests/requirements.txt + - run: + name: test + command: | + pytest --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} + env: + IMAGE_SC4S: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + IMAGE_SPLUNK: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + + orbs: docker: circleci/docker@0.5.20 go: circleci/go@0.2.0 @@ -90,6 +114,13 @@ jobs: environment: SPLUNK: '8.0' <<: *build-splunk + test-sc4s-3-25-1-splunk-8-0: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: '3.25.1' + SPLUNK: '8.0' + <<: *build-splunk workflows: version: 2 @@ -100,3 +131,8 @@ workflows: - build-splunk-7-2 - build-splunk-7-3 - build-splunk-8-0 + - test-sc4s-3-25-1-splunk-8-0: + requires: + - build-sc4s-3-25-1 + - build-splunk-8-0 + diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 26ccd0a..f4fdca8 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -12,14 +12,13 @@ version: "3.7" services: sc4s: - build: - context: ../package + image: ${IMAGE_SC4S} #When this is enabled test_common will fail # command: -det ports: - - "514:514" + - "514" - "601" - - "514:514/udp" + - "514/udp" - "5000-5050" - "5000-5200/udp" - "6514" @@ -29,7 +28,7 @@ services: - splunk environment: - SPLUNK_HEC_URL=https://splunk:8088 - - SPLUNK_HEC_TOKEN=3533e4bd-3eeb-4c57-aa6b-3151116a01d9 + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 @@ -47,16 +46,14 @@ services: volumes: - ./tls:/opt/syslog-ng/tls splunk: - build: - context: ../splunk - + image: ${IMAGE_SPLUNK} ports: - "8000" - - "8088:8088" - - "8089:8089" + - "8088" + - "8089" environment: - - SPLUNK_HEC_TOKEN=3533e4bd-3eeb-4c57-aa6b-3151116a01d9 + - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_START_ARGS=--accept-license From 542a37c0f6ca1ff69490198a30238c623380fa1c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:33:18 -0500 Subject: [PATCH 079/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 60fe175..c5e3f0f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -120,7 +120,7 @@ jobs: environment: SYSLOG: '3.25.1' SPLUNK: '8.0' - <<: *build-splunk + <<: *test workflows: version: 2 From e74eed4f41d8df3fe2416153fe2b8d6657972dbd Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:39:20 -0500 Subject: [PATCH 080/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index c5e3f0f..957eb3c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -110,7 +110,7 @@ jobs: <<: *build-splunk build-splunk-8-0: docker: - - image: circleci/buildpack-deps:18.04 + - image: circleci/python:3.7 environment: SPLUNK: '8.0' <<: *build-splunk From a0c37117474ff5bf487b5759323963ce837354b8 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:40:45 -0500 Subject: [PATCH 081/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 957eb3c..145df48 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -64,7 +64,7 @@ test: &test - run: name: Setup for testing command: | - pip3 -r tests/requirements.txt + pip -r tests/requirements.txt - run: name: test command: | From 2d5f04890b68ef19a9616f460f4f9110c53b2f9f Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:43:35 -0500 Subject: [PATCH 082/174] Update config.yml --- .circleci/config.yml | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 145df48..333c5f2 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -110,7 +110,7 @@ jobs: <<: *build-splunk build-splunk-8-0: docker: - - image: circleci/python:3.7 + - image: circleci/buildpack-deps:18.04 environment: SPLUNK: '8.0' <<: *build-splunk @@ -121,6 +121,20 @@ jobs: SYSLOG: '3.25.1' SPLUNK: '8.0' <<: *test + test-sc4s-3-25-1-splunk-7-3: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: '3.25.1' + SPLUNK: '7.3' + <<: *test + test-sc4s-3-25-1-splunk-7-2: + docker: + - image: circleci/python:3.7 + environment: + SYSLOG: '3.25.1' + SPLUNK: '7-2' + <<: *test workflows: version: 2 @@ -135,4 +149,15 @@ workflows: requires: - build-sc4s-3-25-1 - build-splunk-8-0 - + - test-sc4s-master-splunk-8-0: + requires: + - build-sc4s-master + - build-splunk-8-0 + - test-sc4s-3-25-1-splunk-7-3: + requires: + - build-sc4s-3-25-1 + - build-splunk-7-3 + - test-sc4s-3-25-1-splunk-7-2: + requires: + - build-sc4s-3-25-1 + - build-splunk-7-2 From a2d793aa32570b29679d33bbd25b7497af661658 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:44:51 -0500 Subject: [PATCH 083/174] Update config.yml --- .circleci/config.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 333c5f2..021aad2 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -121,6 +121,13 @@ jobs: SYSLOG: '3.25.1' SPLUNK: '8.0' <<: *test + test-sc4s-master-splunk-8-0: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: 'master' + SPLUNK: '8.0' + <<: *test test-sc4s-3-25-1-splunk-7-3: docker: - image: circleci/buildpack-deps:18.04 From f3a8065f4444f0cc8314bd270dc41b3876e47ad9 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:47:09 -0500 Subject: [PATCH 084/174] Update config.yml --- .circleci/config.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 021aad2..78a4977 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -116,21 +116,21 @@ jobs: <<: *build-splunk test-sc4s-3-25-1-splunk-8-0: docker: - - image: circleci/buildpack-deps:18.04 + - image: circleci/python:3.7 environment: SYSLOG: '3.25.1' SPLUNK: '8.0' <<: *test test-sc4s-master-splunk-8-0: docker: - - image: circleci/buildpack-deps:18.04 + - image: circleci/python:3.7 environment: SYSLOG: 'master' SPLUNK: '8.0' <<: *test test-sc4s-3-25-1-splunk-7-3: docker: - - image: circleci/buildpack-deps:18.04 + - image: circleci/python:3.7 environment: SYSLOG: '3.25.1' SPLUNK: '7.3' From 5d4f0f985c10ba7d0cf5f84e84a70b0d910f2733 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:49:06 -0500 Subject: [PATCH 085/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 78a4977..9fd6877 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -64,7 +64,7 @@ test: &test - run: name: Setup for testing command: | - pip -r tests/requirements.txt + pip install -r tests/requirements.txt - run: name: test command: | From d6de0e981bb5d5db568cb4d725d82e217d49884a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:53:32 -0500 Subject: [PATCH 086/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 9fd6877..4755e1c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -69,7 +69,7 @@ test: &test name: test command: | pytest --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} - env: + environment: IMAGE_SC4S: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> IMAGE_SPLUNK: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> From 27c9e9e64f2c594cff1051759d3056eb9a414bbe Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 15:58:14 -0500 Subject: [PATCH 087/174] update --- .circleci/config.yml | 8 +++----- tests/docker-compose.yml | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 4755e1c..3160d60 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -43,12 +43,12 @@ build-splunk: &build-splunk name: Build Splunk command: | docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> test: &test @@ -69,9 +69,7 @@ test: &test name: test command: | pytest --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} - environment: - IMAGE_SC4S: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> - IMAGE_SPLUNK: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SYSLOG}-<< pipeline.id >> + no_output_timeout: 1h orbs: diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index f4fdca8..8bcfd30 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -12,7 +12,7 @@ version: "3.7" services: sc4s: - image: ${IMAGE_SC4S} + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} #When this is enabled test_common will fail # command: -det ports: @@ -46,7 +46,7 @@ services: volumes: - ./tls:/opt/syslog-ng/tls splunk: - image: ${IMAGE_SPLUNK} + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} ports: - "8000" From e79a7fce0042e050de204aa74c2dada37d72a3b1 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 16:08:20 -0500 Subject: [PATCH 088/174] Update config.yml --- .circleci/config.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 3160d60..476630e 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -65,10 +65,14 @@ test: &test name: Setup for testing command: | pip install -r tests/requirements.txt + mkdir test-reports - run: name: test command: | - pytest --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} + pytest \ + -v \ + --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} + --junitxml=test-reports/apptest-${SYSLOG}-${SPLUNK}.xml no_output_timeout: 1h From a07af0113c547925ad8ba86966b63d396e4aede3 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 17:22:03 -0500 Subject: [PATCH 089/174] updates --- tests/conftest.py | 4 ++-- tests/docker-compose.yml | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index d79fc73..a57974a 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -173,8 +173,8 @@ def splunk_external(request): @pytest.fixture(scope="session") def sc4s_docker(request, docker_services, docker_ip): ports = { 514: docker_services.port_for("sc4s", 514) } - for x in range(4999, 5050): - ports.update({ x: docker_services.port_for("splunk", 8089)}) + for x in range(5000, 5050): + ports.update({ x: docker_services.port_for("sc4s", x)}) return docker_ip, ports diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 8bcfd30..8dc536e 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -12,6 +12,8 @@ version: "3.7" services: sc4s: + build: + context: ../package image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} #When this is enabled test_common will fail # command: -det @@ -31,9 +33,6 @@ services: - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no - # - SC4S_LISTEN_DEFAULT_TCP_PORT=514 - # - SC4S_LISTEN_DEFAULT_UDP_PORT=514 - # - SC4S_LISTEN_DEFAULT_TLS_PORT=6514 - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 - SC4S_LISTEN_CISCO_ASA_TCP_PORT=5001 - SC4S_LISTEN_CISCO_IOS_TCP_PORT=5002 @@ -42,10 +41,11 @@ services: - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no - # - SC4S_SOURCE_STORE_RAWMSG=yes volumes: - ./tls:/opt/syslog-ng/tls splunk: + build: + context: ../splunk image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} ports: From f123b677fa61058bcc113f2f61ae3fb9eb2d6c55 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 17:38:03 -0500 Subject: [PATCH 090/174] updates --- tests/conftest.py | 3 +-- tests/docker-compose.yml | 3 ++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index a57974a..59c1b9b 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -118,7 +118,6 @@ def splunk(request): request.fixturenames.append('splunk_external') splunk = request.getfixturevalue("splunk_external") elif request.config.getoption('splunk_type') == 'docker': - os.environ['splunk_version'] = request.config.getoption('splunk_version') request.fixturenames.append('splunk_docker') splunk = request.getfixturevalue("splunk_docker") else: @@ -153,7 +152,7 @@ def splunk_docker(request, docker_services, docker_ip): } docker_services.wait_until_responsive( - timeout=300.0, pause=1.0, check=lambda: is_responsive_splunk(splunk) + timeout=180.0, pause=1.0, check=lambda: is_responsive_splunk(splunk) ) return splunk diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 8dc536e..ca06853 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -15,6 +15,7 @@ services: build: context: ../package image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} + hostname: sc4s #When this is enabled test_common will fail # command: -det ports: @@ -47,7 +48,7 @@ services: build: context: ../splunk image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} - + hostname: splunk ports: - "8000" - "8088" From d9340cf8c2901cc2c4b4526b27af7057a5c8e292 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 17:46:47 -0500 Subject: [PATCH 091/174] Update config.yml --- .circleci/config.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 476630e..6188f71 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -65,15 +65,24 @@ test: &test name: Setup for testing command: | pip install -r tests/requirements.txt - mkdir test-reports + mkdir test-results - run: name: test command: | pytest \ -v \ --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} - --junitxml=test-reports/apptest-${SYSLOG}-${SPLUNK}.xml + --junitxml=test-results/apptest-${SYSLOG}-${SPLUNK}.xml no_output_timeout: 1h + - run: + name: get logs + command: docker-compose -f test/docker-compose.yml + when: always + - store_artifacts: + path: test-results + destination: apptest-${SYSLOG}-${SPLUNK} + - store_test_results: + path: test-results orbs: From 9a8cec58910d28f27c213d20604e173aca37b5e8 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 17:53:24 -0500 Subject: [PATCH 092/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6188f71..8bf76fb 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -76,7 +76,7 @@ test: &test no_output_timeout: 1h - run: name: get logs - command: docker-compose -f test/docker-compose.yml + command: docker-compose -f test/docker-compose.yml logs when: always - store_artifacts: path: test-results From 22780b16b72303f76eb79fd0001715fbe6e9f6eb Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 17:57:33 -0500 Subject: [PATCH 093/174] Update config.yml --- .circleci/config.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 8bf76fb..e9fd552 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -54,8 +54,7 @@ build-splunk: &build-splunk test: &test steps: - checkout - - setup_remote_docker: - docker_layer_caching: true + - run: name: Docker Login command: | @@ -147,8 +146,11 @@ jobs: SPLUNK: '7.3' <<: *test test-sc4s-3-25-1-splunk-7-2: - docker: - - image: circleci/python:3.7 + machine: + image: ubuntu-1604:201903-01 + docker_layer_caching: true +# docker: +# - image: circleci/python:3.7 environment: SYSLOG: '3.25.1' SPLUNK: '7-2' From 4b08d1fad952397095b118cf0047c89ab51deb9c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 18:01:52 -0500 Subject: [PATCH 094/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index e9fd552..74d687d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -54,7 +54,7 @@ build-splunk: &build-splunk test: &test steps: - checkout - + - setup_remote_docker - run: name: Docker Login command: | From 14cfa6c074d60f16d5dab32e5fba6ab7578a7cad Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 18:09:15 -0500 Subject: [PATCH 095/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 74d687d..d3791b9 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -54,7 +54,7 @@ build-splunk: &build-splunk test: &test steps: - checkout - - setup_remote_docker + - docker/install-docker-tools - run: name: Docker Login command: | From 34d24eec1c090906020ff45f891fd34092c39360 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 18:19:01 -0500 Subject: [PATCH 096/174] Update config.yml --- .circleci/config.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index d3791b9..12c4c89 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -54,7 +54,8 @@ build-splunk: &build-splunk test: &test steps: - checkout - - docker/install-docker-tools + - setup_remote_docker: + docker_layer_caching: true - run: name: Docker Login command: | @@ -146,11 +147,9 @@ jobs: SPLUNK: '7.3' <<: *test test-sc4s-3-25-1-splunk-7-2: - machine: - image: ubuntu-1604:201903-01 - docker_layer_caching: true -# docker: -# - image: circleci/python:3.7 + + docker: + - image: circleci/python:3.7 environment: SYSLOG: '3.25.1' SPLUNK: '7-2' From dfa89450e2cb38a53970990424cbf90ee3f394f1 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 18:55:30 -0500 Subject: [PATCH 097/174] info --- .circleci/config.yml | 41 ++++++++++++++++++++++++++++++++-------- tests/docker-compose.yml | 16 ++++++++++++++++ tests/entrypoint.sh | 26 +++++-------------------- 3 files changed, 54 insertions(+), 29 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 12c4c89..a39f491 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -51,6 +51,7 @@ build-splunk: &build-splunk docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> + test: &test steps: - checkout @@ -69,15 +70,9 @@ test: &test - run: name: test command: | - pytest \ - -v \ - --splunk_type=docker --splunk_password=${SPLUNK_PASSWORD} - --junitxml=test-results/apptest-${SYSLOG}-${SPLUNK}.xml + docker-compose -f tests/docker-compose.yml up --abort-on-container-exit + docker cp results/* test-results/ no_output_timeout: 1h - - run: - name: get logs - command: docker-compose -f test/docker-compose.yml logs - when: always - store_artifacts: path: test-results destination: apptest-${SYSLOG}-${SPLUNK} @@ -93,6 +88,31 @@ orbs: jobs: + build-tests: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: '3.25.1' + steps: + - checkout + - setup_remote_docker: + docker_layer_caching: true + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com + - run: + name: Build Splunk + command: | + docker build tests \ + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-<< pipeline.id >> + - run: + name: Push Splunk + command: | + docker push \ + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-<< pipeline.id >> + #JOB SC4S build-sc4s-3-25-1: docker: @@ -159,6 +179,7 @@ workflows: version: 2 build_and_deploy: jobs: + - build-tests - build-sc4s-3-25-1 - build-sc4s-master - build-splunk-7-2 @@ -168,15 +189,19 @@ workflows: requires: - build-sc4s-3-25-1 - build-splunk-8-0 + - build-tests - test-sc4s-master-splunk-8-0: requires: - build-sc4s-master - build-splunk-8-0 + - build-tests - test-sc4s-3-25-1-splunk-7-3: requires: - build-sc4s-3-25-1 - build-splunk-7-3 + - build-tests - test-sc4s-3-25-1-splunk-7-2: requires: - build-sc4s-3-25-1 - build-splunk-7-2 + - build-tests diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index ca06853..865678f 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -10,6 +10,19 @@ version: "3.7" services: + test: + build: ./tests + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} + links: + - splunk + - sc4s + environment: + - SPLUNK_USER=admin + - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} + - SPLUNK_HOST=splunk + - SYSLOG_HOST=sc4s + volumes: + - results:/work/test-results sc4s: build: @@ -58,3 +71,6 @@ services: - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_START_ARGS=--accept-license +volumes: + results: + external: false \ No newline at end of file diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh index 6128096..723342b 100755 --- a/tests/entrypoint.sh +++ b/tests/entrypoint.sh @@ -1,23 +1,7 @@ #!/bin/sh -echo Check for sc4s -wait-for sc4s:514 -t 0 -- echo scs is up -echo check for splunk web -wait-for splunk:8000 -t 0 -- echo splunkweb is up -echo check for splunk mgmt -wait-for splunk:8089 -t 0 -- echo splunkmgmt is up -echo check for splunk hec -wait-for splunk:8088 -t 0 -- echo splunkhec is up -sleep 30 - -echo Check for sc4s -wait-for sc4s:514 -t 0 -- echo scs is up -echo check for splunk web -wait-for splunk:8000 -t 0 -- echo splunkweb is up -echo check for splunk mgmt -wait-for splunk:8089 -t 0 -- echo splunkmgmt is up -echo check for splunk hec -wait-for splunk:8088 -t 0 -- echo splunkhec is up - - -cd /work;python -m pytest --junitxml=/work/test-results/functional/functional.xml $@ +cd /work +pytest -v \ + --splunk_test=external \ + --splunk_password=${SPLUNK_PASSWORD} \ + --junitxml=/work/test-results/functional/functional.xml $@ From 84392070482c51215d338805bcf4826b0f64e204 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:03:03 -0500 Subject: [PATCH 098/174] updates --- .circleci/config.yml | 2 +- tests/docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index a39f491..c86557b 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -71,7 +71,7 @@ test: &test name: test command: | docker-compose -f tests/docker-compose.yml up --abort-on-container-exit - docker cp results/* test-results/ + docker cp results:/* test-results/ no_output_timeout: 1h - store_artifacts: path: test-results diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 865678f..1b723c1 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -11,7 +11,7 @@ version: "3.7" services: test: - build: ./tests + build: . image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} links: - splunk From b1358fb313e2635aecd7a18bbcd90511d7580d31 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:26:17 -0500 Subject: [PATCH 099/174] updates --- .circleci/config.yml | 1 + tests/conftest.py | 2 +- tests/docker-compose.yml | 2 +- tests/entrypoint.sh | 4 +++- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index c86557b..7576efc 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -70,6 +70,7 @@ test: &test - run: name: test command: | + docker-compose -f tests/docker-compose.yml pull docker-compose -f tests/docker-compose.yml up --abort-on-container-exit docker cp results:/* test-results/ no_output_timeout: 1h diff --git a/tests/conftest.py b/tests/conftest.py index 59c1b9b..cc7194d 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -181,7 +181,7 @@ def sc4s_docker(request, docker_services, docker_ip): @pytest.fixture(scope="session") def sc4s_external(request): ports = {514: 514} - for x in range(4999, 5050): + for x in range(5000, 5050): ports.update({x: x}) return request.config.getoption('sc4s_host'), ports diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 1b723c1..b49d5a5 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -20,7 +20,7 @@ services: - SPLUNK_USER=admin - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_HOST=splunk - - SYSLOG_HOST=sc4s + - docke=sc4s volumes: - results:/work/test-results diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh index 723342b..fc6a258 100755 --- a/tests/entrypoint.sh +++ b/tests/entrypoint.sh @@ -2,6 +2,8 @@ cd /work pytest -v \ - --splunk_test=external \ + --splunk_type=external \ --splunk_password=${SPLUNK_PASSWORD} \ + --sc4s_host=sc4s + --splunk_host=splunk --junitxml=/work/test-results/functional/functional.xml $@ From 9b3427cf52a117a4139050b29fff8bf8920c61c1 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:37:09 -0500 Subject: [PATCH 100/174] test --- tests/conftest.py | 6 +++--- tests/entrypoint.sh | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index cc7194d..dfec407 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -130,14 +130,14 @@ def splunk(request): def sc4s(request): if request.config.getoption('splunk_type') == 'external': request.fixturenames.append('sc4s_external') - splunk = request.getfixturevalue("sc4s_external") + sc4s = request.getfixturevalue("sc4s_external") elif request.config.getoption('splunk_type') == 'docker': request.fixturenames.append('sc4s_docker') - splunk = request.getfixturevalue("sc4s_docker") + sc4s = request.getfixturevalue("sc4s_docker") else: raise Exception - yield splunk + yield sc4s @pytest.fixture(scope="session") diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh index fc6a258..8559e00 100755 --- a/tests/entrypoint.sh +++ b/tests/entrypoint.sh @@ -4,6 +4,6 @@ cd /work pytest -v \ --splunk_type=external \ --splunk_password=${SPLUNK_PASSWORD} \ - --sc4s_host=sc4s - --splunk_host=splunk + --sc4s_host=sc4s \ + --splunk_host=splunk \ --junitxml=/work/test-results/functional/functional.xml $@ From 81f545c0a1f5e266796aa733fc8a7e58cdd5c0b0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:47:59 -0500 Subject: [PATCH 101/174] Update config.yml --- .circleci/config.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 7576efc..7a4b185 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -18,9 +18,12 @@ build-sc4s: &build-sc4s command: | docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com + - semver-rob/export-tag - run: name: Build SC4S command: | + echo $SEMVER_VERSION + echo $SEMVER_VERSION >package/VERSION docker build --build-arg BRANCH=${SYSLOG} package \ -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> - run: @@ -86,7 +89,7 @@ orbs: go: circleci/go@0.2.0 snyk: snyk/snyk@0.0.8 versioning: kollex/versioning@1.0.0 - + semver-orb: tv2norge/semver-orb@0.0.1 jobs: build-tests: From 727409f5519d7197a0623ddbc72e3867c1e50832 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:48:25 -0500 Subject: [PATCH 102/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 7a4b185..323dc9b 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -18,7 +18,7 @@ build-sc4s: &build-sc4s command: | docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - semver-rob/export-tag + - semver-orb/export-tag - run: name: Build SC4S command: | From 14e443896eb8359258a3b3600cb2ba74fc761de1 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:52:21 -0500 Subject: [PATCH 103/174] Create semtag --- semtag | 625 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 625 insertions(+) create mode 100755 semtag diff --git a/semtag b/semtag new file mode 100755 index 0000000..d000e3c --- /dev/null +++ b/semtag @@ -0,0 +1,625 @@ +#!/usr/bin/env bash + +PROG=semtag +PROG_VERSION="v0.1.0" + +SEMVER_REGEX="^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$" +IDENTIFIER_REGEX="^\-([0-9A-Za-z-]+)\.([0-9A-Za-z-]+)*$" + +# Global variables +FIRST_VERSION="v0.0.0" +finalversion=$FIRST_VERSION +lastversion=$FIRST_VERSION +hasversiontag="false" +scope="patch" +displayonly="false" +forcetag="false" +forcedversion= +versionname= +identifier= + +HELP="\ +Usage: + $PROG + $PROG getlast + $PROG getfinal + $PROG (final|alpha|beta|candidate) [-s (major|minor|patch|auto) | -o] + $PROG --help + $PROG --version +Options: + -s The scope that must be increased, can be major, minor or patch. + The resulting version will match X.Y.Z(-PRERELEASE)(+BUILD) + where X, Y and Z are positive integers, PRERELEASE is an optionnal + string composed of alphanumeric characters describing if the build is + a release candidate, alpha or beta version, with a number. + BUILD is also an optional string composed of alphanumeric + characters and hyphens. + Setting the scope as 'auto', the script will chose the scope between + 'minor' and 'patch', depending on the amount of lines added (<10% will + choose patch). + -v Specifies manually the version to be tagged, must be a valid semantic version + in the format X.Y.Z where X, Y and Z are positive integers. + -o Output the version only, shows the bumped version, but doesn't tag. + -f Forces to tag, even if there are unstaged or uncommited changes. +Commands: + --help Print this help message. + --version Prints the program's version. + get Returns both current final version and last tagged version. + getlast Returns the latest tagged version. + getfinal Returns the latest tagged final version. + getcurrent Returns the current version, based on the latest one, if there are uncommited or + unstaged changes, they will be reflected in the version, adding the number of + pending commits, current branch and commit hash. + final Tags the current build as a final version, this only can be done on the master branch. + candidate Tags the current build as a release candidate, the tag will contain all + the commits from the last final version. + alpha Tags the current build as an alpha version, the tag will contain all + the commits from the last final version. + beta Tags the current build as a beta version, the tag will contain all + the commits from the last final version." + +# Commands and options +ACTION="getlast" +ACTION="$1" +shift + +# We get the parameters +while getopts "v:s:of" opt; do + case $opt in + v) + forcedversion="$OPTARG" + ;; + s) + scope="$OPTARG" + ;; + o) + displayonly="true" + ;; + f) + forcetag="true" + ;; + \?) + echo "Invalid option: -$OPTARG" >&2 + exit 1 + ;; + :) + echo "Option -$OPTARG requires an argument." >&2 + exit 1 + ;; + esac +done + +# Gets a string with the version and returns an array of maximum size of 5 with all the parts of the sematinc version +# $1 The string containing the version in semantic format +# $2 The variable to store the result array: +# position 0: major number +# position 1: minor number +# position 2: patch number +# position 3: identifier (or prerelease identifier) +# position 4: build info +function explode_version { + local __version=$1 + local __result=$2 + if [[ $__version =~ $SEMVER_REGEX ]] ; then + local __major=${BASH_REMATCH[1]} + local __minor=${BASH_REMATCH[2]} + local __patch=${BASH_REMATCH[3]} + local __prere=${BASH_REMATCH[4]} + local __build=${BASH_REMATCH[5]} + eval "$__result=(\"$__major\" \"$__minor\" \"$__patch\" \"$__prere\" \"$__build\")" + else + eval "$__result=" + fi +} + +# Compare two versions and returns -1, 0 or 1 +# $1 The first version to compare +# $2 The second version to compare +# $3 The variable where to store the result +function compare_versions { + local __first + local __second + explode_version $1 __first + explode_version $2 __second + local lv=$3 + + # Compares MAJOR, MINOR and PATCH + for i in 0 1 2; do + local __numberfirst=${__first[$i]} + local __numbersecond=${__second[$i]} + case $(($__numberfirst - $__numbersecond)) in + 0) + ;; + -[0-9]*) + eval "$lv=-1" + return 0 + ;; + [0-9]*) + eval "$lv=1" + return 0 + ;; + esac + done + + # Identifiers should compare with the ASCII order. + local __identifierfirst=${__first[3]} + local __identifiersecond=${__second[3]} + if [[ -n "$__identifierfirst" ]] && [[ -n "$__identifiersecond" ]]; then + if [[ "$__identifierfirst" > "$__identifiersecond" ]]; then + eval "$lv=1" + return 0 + elif [[ "$__identifierfirst" < "$__identifiersecond" ]]; then + eval "$lv=-1" + return 0 + fi + elif [[ -z "$__identifierfirst" ]] && [[ -n "$__identifiersecond" ]]; then + eval "$lv=1" + return 0 + elif [[ -n "$__identifierfirst" ]] && [[ -z "$__identifiersecond" ]]; then + eval "$lv=-1" + return 0 + fi + + eval "$lv=0" +} + +# Returns the last version of two +# $1 The first version to compare +# $2 The second version to compare +# $3 The variable where to store the last one +function get_latest_of_two { + local __first=$1 + local __second=$2 + local __result + local __latest=$3 + compare_versions $__first $__second __result + case $__result in + 0) + eval "$__latest=$__second" + ;; + -1) + eval "$__latest=$__second" + ;; + 1) + eval "$__latest=$__first" + ;; + esac +} + +# Assigns a 2 size array with the identifier, having the identifier at pos 0, and the number in pos 1 +# $1 The identifier in the format -id.# +# $2 The vferiable where to store the 2 size array +function explode_identifier { + local __identifier=$1 + local __result=$2 + if [[ $__identifier =~ $IDENTIFIER_REGEX ]] ; then + local __id=${BASH_REMATCH[1]} + local __number=${BASH_REMATCH[2]} + if [[ -z "$__number" ]]; then + __number=1 + fi + eval "$__result=(\"$__id\" \"$__number\")" + else + eval "$__result=" + fi +} + +# Gets a list of tags and assigns the base and latest versions +# Receives an array with the tags containing the versions +# Assigns to the global variables finalversion and lastversion the final version and the latest version +function get_latest { + local __taglist=("$@") + local __tagsnumber=${#__taglist[@]} + local __current + case $__tagsnumber in + 0) + finalversion=$FIRST_VERSION + lastversion=$FIRST_VERSION + ;; + 1) + __current=${__taglist[0]} + explode_version $__current ver + if [ -n "$ver" ]; then + if [ -n "${ver[3]}" ]; then + finalversion=$FIRST_VERSION + else + finalversion=$__current + fi + lastversion=$__current + else + finalversion=$FIRST_VERSION + lastversion=$FIRST_VERSION + fi + ;; + *) + local __lastpos=$(($__tagsnumber-1)) + for i in $(seq 0 $__lastpos) + do + __current=${__taglist[i]} + explode_version ${__taglist[i]} ver + if [ -n "$ver" ]; then + if [ -z "${ver[3]}" ]; then + get_latest_of_two $finalversion $__current finalversion + get_latest_of_two $lastversion $finalversion lastversion + else + get_latest_of_two $lastversion $__current lastversion + fi + fi + done + ;; + esac + + if git rev-parse -q --verify "refs/tags/$lastversion" >/dev/null; then + hasversiontag="true" + else + hasversiontag="false" + fi +} + +# Gets the next version given the provided scope +# $1 The version that is going to be bumped +# $2 The scope to bump +# $3 The variable where to stoer the result +function get_next_version { + local __exploded + local __fromversion=$1 + local __scope=$2 + local __result=$3 + explode_version $__fromversion __exploded + case $__scope in + major) + __exploded[0]=$((${__exploded[0]}+1)) + __exploded[1]=0 + __exploded[2]=0 + ;; + minor) + __exploded[1]=$((${__exploded[1]}+1)) + __exploded[2]=0 + ;; + patch) + __exploded[2]=$((${__exploded[2]}+1)) + ;; + esac + + eval "$__result=v${__exploded[0]}.${__exploded[1]}.${__exploded[2]}" +} + +function bump_version { + ## First we try to get the next version based on the existing last one + if [ "$scope" == "auto" ]; then + get_scope_auto scope + fi + + local __candidatefromlast=$FIRST_VERSION + local __explodedlast + explode_version $lastversion __explodedlast + if [[ -n "${__explodedlast[3]}" ]]; then + # Last version is not final + local __idlast + explode_identifier ${__explodedlast[3]} __idlast + + # We get the last, given the desired id based on the scope + __candidatefromlast="v${__explodedlast[0]}.${__explodedlast[1]}.${__explodedlast[2]}" + if [[ -n "$identifier" ]]; then + local __nextid="$identifier.1" + if [ "$identifier" == "${__idlast[0]}" ]; then + # We target the same identifier as the last so we increase one + __nextid="$identifier.$(( ${__idlast[1]}+1 ))" + __candidatefromlast="$__candidatefromlast-$__nextid" + else + # Different identifiers, we make sure we are assigning a higher identifier, if not, we increase the version + __candidatefromlast="$__candidatefromlast-$__nextid" + local __comparedwithlast + compare_versions $__candidatefromlast $lastversion __comparedwithlast + if [ "$__comparedwithlast" == -1 ]; then + get_next_version $__candidatefromlast $scope __candidatefromlast + __candidatefromlast="$__candidatefromlast-$__nextid" + fi + fi + fi + fi + + # Then we try to get the version based on the latest final one + local __candidatefromfinal=$FIRST_VERSION + get_next_version $finalversion $scope __candidatefromfinal + if [[ -n "$identifier" ]]; then + __candidatefromfinal="$__candidatefromfinal-$identifier.1" + fi + + # Finally we compare both candidates + local __resultversion + local __result + compare_versions $__candidatefromlast $__candidatefromfinal __result + case $__result in + 0) + __resultversion=$__candidatefromlast + ;; + -1) + __resultversion="$__candidatefromfinal" + ;; + 1) + __resultversion=$__candidatefromlast + ;; + esac + + eval "$1=$__resultversion" +} + +function increase_version { + local __version= + + if [ -z $forcedversion ]; then + bump_version __version + else + if [[ $forcedversion =~ $SEMVER_REGEX ]] ; then + compare_versions $forcedversion $lastversion __result + if [ $__result -le 0 ]; then + echo "Version can't be lower than last version: $lastversion" + exit 1 + fi + else + echo "Non valid version to bump" + exit 1 + fi + __version=$forcedversion + fi + + if [ "$displayonly" == "true" ]; then + echo "$__version" + else + if [ "$forcetag" == "false" ]; then + check_git_dirty_status + fi + local __commitlist + if [ "$finalversion" == "$FIRST_VERSION" ] || [ "$hasversiontag" != "true" ]; then + __commitlist="$(git log --pretty=oneline | cat)" + else + __commitlist="$(git log --pretty=oneline $finalversion... | cat)" + fi + + # If we are forcing a bump, we add bump to the commit list + if [[ -z $__commitlist && "$forcetag" == "true" ]]; then + __commitlist="bump" + fi + + if [[ -z $__commitlist ]]; then + echo "No commits since the last final version, not bumping version" + else + if [[ -z $versionname ]]; then + versionname=$(date -u +"%Y-%m-%dT%H:%M:%SZ") + fi + local __message="$versionname +$__commitlist" + + # We check we have info on the user + local __username=$(git config user.name) + if [ -z "$__username" ]; then + __username=$(id -u -n) + git config user.name $__username + fi + local __useremail=$(git config user.email) + if [ -z "$__useremail" ]; then + __useremail=$(hostname) + git config user.email "$__username@$__useremail" + fi + + git tag -a $__version -m "$__message" + + # If we have a remote, we push there + local __remotes=$(git remote) + if [[ -n $__remotes ]]; then + for __remote in $__remotes; do + git push $__remote $__version > /dev/null + if [ $? -eq 0 ]; then + echo "$__version pushed to $__remote" + else + echo "Error pushing the tag $__version to $__remote" + exit 1 + fi + done + else + echo "$__version" + fi + fi + fi +} + +function check_git_dirty_status { + local __repostatus= + get_work_tree_status __repostatus + + if [ "$__repostatus" == "uncommitted" ]; then + echo "ERROR: You have uncommitted changes" + git status --porcelain + exit 1 + fi + + if [ "$__repostatus" == "unstaged" ]; then + echo "ERROR: You have unstaged changes" + git status --porcelain + exit 1 + fi +} + +# Get the total amount of lines of code in the repo +function get_total_lines { + local __empty_id="$(git hash-object -t tree /dev/null)" + local __changes="$(git diff --numstat $__empty_id | cat)" + local __added_deleted=$1 + get_changed_lines "$__changes" $__added_deleted +} + +# Get the total amount of lines of code since the provided tag +function get_sincetag_lines { + local __sincetag=$1 + local __changes="$(git diff --numstat $__sincetag | cat)" + local __added_deleted=$2 + get_changed_lines "$__changes" $__added_deleted +} + +function get_changed_lines { + local __changes_numstat=$1 + local __result=$2 + IFS=$'\n' read -rd '' -a __changes_array <<<"$__changes_numstat" + local __diff_regex="^([0-9]+)[[:space:]]+([0-9]+)[[:space:]]+.+$" + + local __total_added=0 + local __total_deleted=0 + for i in "${__changes_array[@]}" + do + if [[ $i =~ $__diff_regex ]] ; then + local __added=${BASH_REMATCH[1]} + local __deleted=${BASH_REMATCH[2]} + __total_added=$(( $__total_added+$__added )) + __total_deleted=$(( $__total_deleted+$__deleted )) + fi + done + eval "$2=( $__total_added $__total_deleted )" +} + +function get_scope_auto { + local __verbose=$2 + local __total=0 + local __since=0 + local __scope= + + get_total_lines __total + get_sincetag_lines $finalversion __since + + local __percentage=0 + if [ "$__total" != "0" ]; then + local __percentage=$(( 100*$__since/$__total )) + if [ $__percentage -gt "10" ]; then + __scope="minor" + else + __scope="patch" + fi + fi + + eval "$1=$__scope" + if [[ -n "$__verbose" ]]; then + echo "[Auto Scope] Percentage of lines changed: $__percentage" + echo "[Auto Scope] : $__scope" + fi +} + +function get_work_tree_status { + # Update the index + git update-index -q --ignore-submodules --refresh > /dev/null + eval "$1=" + + if ! git diff-files --quiet --ignore-submodules -- > /dev/null + then + eval "$1=unstaged" + fi + + if ! git diff-index --cached --quiet HEAD --ignore-submodules -- > /dev/null + then + eval "$1=uncommitted" + fi +} + +function get_current { + if [ "$hasversiontag" == "true" ]; then + local __commitcount="$(git rev-list $lastversion.. --count)" + else + local __commitcount="$(git rev-list --count HEAD)" + fi + local __status= + get_work_tree_status __status + + if [ "$__commitcount" == "0" ] && [ -z "$__status" ]; then + eval "$1=$lastversion" + else + local __buildinfo="$(git rev-parse --short HEAD)" + local __currentbranch="$(git rev-parse --abbrev-ref HEAD)" + if [ "$__currentbranch" != "master" ]; then + __buildinfo="$__currentbranch.$__buildinfo" + fi + + local __suffix= + if [ "$__commitcount" != "0" ]; then + if [ -n "$__suffix" ]; then + __suffix="$__suffix." + fi + __suffix="$__suffix$__commitcount" + fi + if [ -n "$__status" ]; then + if [ -n "$__suffix" ]; then + __suffix="$__suffix." + fi + __suffix="$__suffix$__status" + fi + + __suffix="$__suffix+$__buildinfo" + if [ "$lastversion" == "$finalversion" ]; then + scope="patch" + identifier= + local __bumped= + bump_version __bumped + eval "$1=$__bumped-dev.$__suffix" + else + eval "$1=$lastversion.$__suffix" + fi + fi +} + +function init { + git fetch > /dev/null + TAGS="$(git tag)" + IFS=$'\n' read -rd '' -a TAG_ARRAY <<<"$TAGS" + + get_latest ${TAG_ARRAY[@]} + currentbranch="$(git rev-parse --abbrev-ref HEAD)" +} + +case $ACTION in + --help) + echo -e "$HELP" + ;; + --version) + echo -e "${PROG}: $PROG_VERSION" + ;; + final) + init + diff=$(git diff master | cat) + if [ "$forcetag" == "false" ]; then + if [ -n "$diff" ]; then + echo "ERROR: Branch must be updated with master for final versions" + exit 1 + fi + fi + increase_version + ;; + alpha|beta) + init + identifier="$ACTION" + increase_version + ;; + candidate) + init + identifier="rc" + increase_version + ;; + getlast) + init + echo "$lastversion" + ;; + getfinal) + init + echo "$finalversion" + ;; + getcurrent) + init + get_current current + echo "$current" + ;; + get) + init + echo "Current final version: $finalversion" + echo "Last tagged version: $lastversion" + ;; + *) + echo "'$ACTION' is not a valid command, see --help for available commands." + ;; +esac \ No newline at end of file From b410d4c93b0c38cac1c9ad999724ac73437d85b4 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 19:59:20 -0500 Subject: [PATCH 104/174] Update config.yml --- .circleci/config.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 323dc9b..6f67501 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -32,6 +32,17 @@ build-sc4s: &build-sc4s docker push \ docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + - run: + name: Docker Save + command: | + mkdir -p /tmp/workspace-${SYSLOG} + docker save $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 | gzip -c > /tmp/workspace-${SYSLOG}/oci_container.tar.gz + + - persist_to_workspace: + root: /tmp + paths: + - workspace-${SYSLOG} + build-splunk: &build-splunk steps: - checkout @@ -92,6 +103,24 @@ orbs: semver-orb: tv2norge/semver-orb@0.0.1 jobs: + build-byoe: + docker: + - image: circleci/buildpack-deps:18.04 + environment: + SYSLOG: '3.25.1' + steps: + - checkout + - run: + name: BYOE Config + command: | + mkdir -p /tmp/workspace-byoe/ + tar rvf /tmp/workspace-byoe/baremetal.tar -C package/etc . + tar rvf /tmp/workspace-byoe/baremetal.tar -C package/sbin entrypoint.sh + - persist_to_workspace: + root: /tmp + paths: + - workspace-byoe + build-tests: docker: - image: circleci/buildpack-deps:18.04 From 64fb4c3f35a0268ab1192a2386080c0664fa5fac Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:02:41 -0500 Subject: [PATCH 105/174] Update config.yml --- .circleci/config.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6f67501..6302949 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -86,7 +86,7 @@ test: &test command: | docker-compose -f tests/docker-compose.yml pull docker-compose -f tests/docker-compose.yml up --abort-on-container-exit - docker cp results:/* test-results/ + docker volume ls no_output_timeout: 1h - store_artifacts: path: test-results @@ -212,6 +212,7 @@ workflows: version: 2 build_and_deploy: jobs: + - build-byoe - build-tests - build-sc4s-3-25-1 - build-sc4s-master From d7897a22e7086556009ab72e65753b21510a0274 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:31:48 -0500 Subject: [PATCH 106/174] Update config.yml --- .circleci/config.yml | 89 ++++++++++++++++++++++++++++---------------- 1 file changed, 57 insertions(+), 32 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6302949..fdc6e01 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -32,17 +32,6 @@ build-sc4s: &build-sc4s docker push \ docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> - - run: - name: Docker Save - command: | - mkdir -p /tmp/workspace-${SYSLOG} - docker save $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 | gzip -c > /tmp/workspace-${SYSLOG}/oci_container.tar.gz - - - persist_to_workspace: - root: /tmp - paths: - - workspace-${SYSLOG} - build-splunk: &build-splunk steps: - checkout @@ -64,8 +53,6 @@ build-splunk: &build-splunk docker push \ docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> - - test: &test steps: - checkout @@ -95,6 +82,41 @@ test: &test path: test-results +publish: &publish + steps: + - setup_remote_docker: + docker_layer_caching: true + - checkout + - docker/check: + registry: $REGISTRY + docker-username: GITHUB_USER + docker-password: GITHUB_TOKEN + - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + - run: + name: Docker Save + command: | + mkdir -p /tmp/workspace/ + docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> | gzip -c > /tmp/workspace/oci_container.tar.gz + - run: + name: BYOE Config + command: | + tar rvf /tmp/workspace/baremetal.tar -C package/etc . + tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh + + - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$PUBLIC_IMAGE:${DOCKER_TAG} + - docker/push: + image: splunk/scs + tag: $DOCKER_TAG + - go/install + - run: + name: "Publish edge on GitHub" + command: | + PATH=$PATH:/usr/local/go/bin + go get -v -u github.com/tcnksm/ghr + $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} ${GHR_FLAGS} -delete ${DOCKER_TAG} /tmp/workspace/ + - store_artifacts: + path: /tmp/workspace/ + orbs: docker: circleci/docker@0.5.20 go: circleci/go@0.2.0 @@ -103,24 +125,6 @@ orbs: semver-orb: tv2norge/semver-orb@0.0.1 jobs: - build-byoe: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SYSLOG: '3.25.1' - steps: - - checkout - - run: - name: BYOE Config - command: | - mkdir -p /tmp/workspace-byoe/ - tar rvf /tmp/workspace-byoe/baremetal.tar -C package/etc . - tar rvf /tmp/workspace-byoe/baremetal.tar -C package/sbin entrypoint.sh - - persist_to_workspace: - root: /tmp - paths: - - workspace-byoe - build-tests: docker: - image: circleci/buildpack-deps:18.04 @@ -208,11 +212,24 @@ jobs: SPLUNK: '7-2' <<: *test + publish-edge: + + docker: + - image: circleci/python:3.7 + environment: + SYSLOG: '3.25.1' + SPLUNK: '7-2' + REGISTRY: docker.pkg.github.com + CI_IMAGE: splunk/splunk-connect-for-syslog/ci + REGISTRY_PUBLIC: docker.pkg.github.com + PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases + DOCKER_TAG: edge + GHR_FLAGS: -prerelease + <<: *publish workflows: version: 2 build_and_deploy: jobs: - - build-byoe - build-tests - build-sc4s-3-25-1 - build-sc4s-master @@ -239,3 +256,11 @@ workflows: - build-sc4s-3-25-1 - build-splunk-7-2 - build-tests + - publish-edge: + requires: + - test-sc4s-3-25-1-splunk-8-0 +# filters: +# branches: +# only: +# - develop + From 65ce63151f11155a9b3b6a4d5fc87955929bd7d6 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:32:44 -0500 Subject: [PATCH 107/174] Update config.yml --- .circleci/config.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index fdc6e01..e67107d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -258,7 +258,8 @@ workflows: - build-tests - publish-edge: requires: - - test-sc4s-3-25-1-splunk-8-0 + - build-sc4s-3-25-1 + #- test-sc4s-3-25-1-splunk-8-0 # filters: # branches: # only: From 42c78472c7827b063710c4052db8b6e6579b509e Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:36:49 -0500 Subject: [PATCH 108/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index e67107d..f84b1bd 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -103,7 +103,7 @@ publish: &publish tar rvf /tmp/workspace/baremetal.tar -C package/etc . tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - run: docker tag $REGISTRY/$CI_IMAGE:$CIRCLE_SHA1 $REGISTRY/$PUBLIC_IMAGE:${DOCKER_TAG} + - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> $REGISTRY/$PUBLIC_IMAGE:${DOCKER_TAG} - docker/push: image: splunk/scs tag: $DOCKER_TAG From 3f49b4ff92a5208481bb5273a27d0cf573339306 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:41:13 -0500 Subject: [PATCH 109/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index f84b1bd..fd1780d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -103,7 +103,7 @@ publish: &publish tar rvf /tmp/workspace/baremetal.tar -C package/etc . tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> $REGISTRY/$PUBLIC_IMAGE:${DOCKER_TAG} + - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >>splunk/scs:${DOCKER_TAG} - docker/push: image: splunk/scs tag: $DOCKER_TAG From 22f16f0d958bb2379be14eb4c470f3730c9137fd Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:45:16 -0500 Subject: [PATCH 110/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index fd1780d..1394107 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -103,7 +103,7 @@ publish: &publish tar rvf /tmp/workspace/baremetal.tar -C package/etc . tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >>splunk/scs:${DOCKER_TAG} + - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> splunk/scs:${DOCKER_TAG} - docker/push: image: splunk/scs tag: $DOCKER_TAG From 2e8938c461e16121d234a52e5c0f214fa2aef860 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:48:28 -0500 Subject: [PATCH 111/174] Update config.yml --- .circleci/config.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1394107..49857e0 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -22,7 +22,6 @@ build-sc4s: &build-sc4s - run: name: Build SC4S command: | - echo $SEMVER_VERSION echo $SEMVER_VERSION >package/VERSION docker build --build-arg BRANCH=${SYSLOG} package \ -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> @@ -87,10 +86,11 @@ publish: &publish - setup_remote_docker: docker_layer_caching: true - checkout - - docker/check: - registry: $REGISTRY - docker-username: GITHUB_USER - docker-password: GITHUB_TOKEN + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> - run: name: Docker Save From 93693417d6ca5dabc19f0712a696d77b52ddb33d Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 20:57:24 -0500 Subject: [PATCH 112/174] Update config.yml --- .circleci/config.yml | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 49857e0..f72176e 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -218,14 +218,19 @@ jobs: - image: circleci/python:3.7 environment: SYSLOG: '3.25.1' - SPLUNK: '7-2' - REGISTRY: docker.pkg.github.com - CI_IMAGE: splunk/splunk-connect-for-syslog/ci - REGISTRY_PUBLIC: docker.pkg.github.com - PUBLIC_IMAGE: splunk/splunk-connect-for-syslog/releases + SPLUNK: '8.0' DOCKER_TAG: edge GHR_FLAGS: -prerelease <<: *publish + publish-latest: + + docker: + - image: circleci/python:3.7 + environment: + SYSLOG: '3.25.1' + SPLUNK: '8.0' + DOCKER_TAG: latest + <<: *publish workflows: version: 2 build_and_deploy: @@ -256,12 +261,16 @@ workflows: - build-sc4s-3-25-1 - build-splunk-7-2 - build-tests - - publish-edge: + - publish-pre-gh-develop: + type: approval requires: - - build-sc4s-3-25-1 - #- test-sc4s-3-25-1-splunk-8-0 + - test-sc4s-3-25-1-splunk-8-0 # filters: # branches: # only: # - develop + - publish-edge: + requires: + - publish-pre-gh-develop + From d6999d44f9797e96cb23944c0df6ee8fbd6b30b7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:00:03 -0500 Subject: [PATCH 113/174] Update config.yml --- .circleci/config.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index f72176e..c231a60 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -264,7 +264,8 @@ workflows: - publish-pre-gh-develop: type: approval requires: - - test-sc4s-3-25-1-splunk-8-0 + - build-sc4s-3-25-1 +# - test-sc4s-3-25-1-splunk-8-0 # filters: # branches: # only: From 5e52a54cc4760c0e391706cdd89018b3bacbbd52 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:03:03 -0500 Subject: [PATCH 114/174] Update config.yml --- .circleci/config.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index c231a60..66d03dc 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -265,13 +265,24 @@ workflows: type: approval requires: - build-sc4s-3-25-1 -# - test-sc4s-3-25-1-splunk-8-0 -# filters: -# branches: -# only: -# - develop - - publish-edge: + #- test-sc4s-3-25-1-splunk-8-0 + filters: + branches: + only: + - develop + - publish-develop: requires: - publish-pre-gh-develop + - publish-pre-gh-latest: + type: approval + requires: + - test-sc4s-3-25-1-splunk-8-0 + filters: + branches: + only: + - master + - publish-latest: + requires: + - publish-pre-gh-latest From 8eb423b005e2bd0399a61887418204c6c5d814d0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:13:46 -0500 Subject: [PATCH 115/174] Update config.yml --- .circleci/config.yml | 43 ++++++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 66d03dc..09e06e5 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -102,8 +102,10 @@ publish: &publish command: | tar rvf /tmp/workspace/baremetal.tar -C package/etc . tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - - run: docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> splunk/scs:${DOCKER_TAG} + - run: + command: | + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi + docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> splunk/scs:${VERSION} - docker/push: image: splunk/scs tag: $DOCKER_TAG @@ -113,7 +115,9 @@ publish: &publish command: | PATH=$PATH:/usr/local/go/bin go get -v -u github.com/tcnksm/ghr - $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} ${GHR_FLAGS} -delete ${DOCKER_TAG} /tmp/workspace/ + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi + $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} ${GHR_FLAGS} -delete ${VERSION} /tmp/workspace/ + - store_artifacts: path: /tmp/workspace/ @@ -219,7 +223,7 @@ jobs: environment: SYSLOG: '3.25.1' SPLUNK: '8.0' - DOCKER_TAG: edge + VERSION_TAG: edge GHR_FLAGS: -prerelease <<: *publish publish-latest: @@ -229,7 +233,15 @@ jobs: environment: SYSLOG: '3.25.1' SPLUNK: '8.0' - DOCKER_TAG: latest + VERSION_TAG: latest + <<: *publish + publish-tag: + + docker: + - image: circleci/python:3.7 + environment: + SYSLOG: '3.25.1' + SPLUNK: '8.0' <<: *publish workflows: version: 2 @@ -261,16 +273,15 @@ workflows: - build-sc4s-3-25-1 - build-splunk-7-2 - build-tests - - publish-pre-gh-develop: + - publish-pre-gh-edge: type: approval requires: - - build-sc4s-3-25-1 - #- test-sc4s-3-25-1-splunk-8-0 + - test-sc4s-3-25-1-splunk-8-0 filters: branches: only: - develop - - publish-develop: + - publish-edge: requires: - publish-pre-gh-develop - publish-pre-gh-latest: @@ -284,5 +295,15 @@ workflows: - publish-latest: requires: - publish-pre-gh-latest - - + - publish-pre-gh-tag: + type: approval + requires: + - test-sc4s-3-25-1-splunk-8-0 + filters: + tags: + only: /^\d*\.\d*\.\d*.*$/ + branches: + ignore: /.*/ + - publish-tag: + requires: + - publish-pre-gh-tag \ No newline at end of file From 7da7e123047bf624785634958081b3fdb04d0c37 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:14:53 -0500 Subject: [PATCH 116/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 09e06e5..f134efa 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -283,7 +283,7 @@ workflows: - develop - publish-edge: requires: - - publish-pre-gh-develop + - publish-pre-gh-edge - publish-pre-gh-latest: type: approval requires: From 3296800f12a86904b1b839abad28136fc3567c7b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:16:34 -0500 Subject: [PATCH 117/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index f134efa..c803fa5 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -72,7 +72,7 @@ test: &test command: | docker-compose -f tests/docker-compose.yml pull docker-compose -f tests/docker-compose.yml up --abort-on-container-exit - docker volume ls + docker cp tests_results:/* test-results/ no_output_timeout: 1h - store_artifacts: path: test-results From 35c5a2a08e9c102d2f86d8911f96303cf40e5dcc Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:22:49 -0500 Subject: [PATCH 118/174] Update .gitmodules --- .gitmodules | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.gitmodules b/.gitmodules index fd4c8a0..e69de29 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +0,0 @@ -[submodule "package/syslog-ng"] - path = package/syslog-ng - url = https://github.com/balabit/syslog-ng.git - branch = syslog-ng-3.25.1 -# - From 62decc2b6ad62dc11cfb97b82f69ef5d4f22b145 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:23:32 -0500 Subject: [PATCH 119/174] Delete syslog-ng --- package/syslog-ng | 1 - 1 file changed, 1 deletion(-) delete mode 160000 package/syslog-ng diff --git a/package/syslog-ng b/package/syslog-ng deleted file mode 160000 index b880087..0000000 --- a/package/syslog-ng +++ /dev/null @@ -1 +0,0 @@ -Subproject commit b880087c95ce44e3d33722a825e895b9351aca58 From 1e41ab6f22904190feed0aff62b71c36e180ea29 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Wed, 5 Feb 2020 21:47:47 -0500 Subject: [PATCH 120/174] Update config.yml --- .circleci/config.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index c803fa5..b107337 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -72,8 +72,14 @@ test: &test command: | docker-compose -f tests/docker-compose.yml pull docker-compose -f tests/docker-compose.yml up --abort-on-container-exit - docker cp tests_results:/* test-results/ no_output_timeout: 1h + - run: + name: collect results + command: | + docker container create --name dummy \ + -v sc4s-tests_results:/work/test-results \ + registry.access.redhat.com/ubi7/ubi + docker cp dummy:/* test-results/ - store_artifacts: path: test-results destination: apptest-${SYSLOG}-${SPLUNK} From 4a5bc79261097086dbdad9d17b6ed682881c75f8 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 07:19:59 -0500 Subject: [PATCH 121/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index b107337..554ac41 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -79,7 +79,7 @@ test: &test docker container create --name dummy \ -v sc4s-tests_results:/work/test-results \ registry.access.redhat.com/ubi7/ubi - docker cp dummy:/* test-results/ + docker cp dummy:/work/test-results test-results/ - store_artifacts: path: test-results destination: apptest-${SYSLOG}-${SPLUNK} From b3d42a5ad13ebd0695572e56941c7d63e1f9f204 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 07:20:17 -0500 Subject: [PATCH 122/174] Delete test_matrix.yml --- .github/workflows/test_matrix.yml | 81 ------------------------------- 1 file changed, 81 deletions(-) delete mode 100644 .github/workflows/test_matrix.yml diff --git a/.github/workflows/test_matrix.yml b/.github/workflows/test_matrix.yml deleted file mode 100644 index 2ffcbb1..0000000 --- a/.github/workflows/test_matrix.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Test Matrix - -on: [push] - -jobs: - build-sc4s: - - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - syslog-version: ['3.25.1','master' ] - - steps: - - name: Checkout private tools - uses: actions/checkout@v2 - - uses: azure/docker-login@v1 - with: - login-server: docker.pkg.github.com - username: ${{ secrets.GitHub_User }} - password: ${{ secrets.GitHub_PAT }} - - name: Build for ${{ matrix.syslog-version }} - run: | - docker build --build-arg BRANCH=${{ matrix.syslog-version }} package \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - - name: Push stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - - build-splunk: - - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - splunk-version: ['7.2', '7.3', '8.0', 'latest'] - - steps: - - name: Checkout private tools - uses: actions/checkout@v2 - - uses: azure/docker-login@v1 - with: - login-server: docker.pkg.github.com - username: ${{ secrets.GitHub_User }} - password: ${{ secrets.GitHub_PAT }} - - - name: Build for ${{ matrix.splunk-version }} - run: | - docker build --build-arg SPLUNK_VERSION=${{ matrix.splunk-version }} splunk \ - -t docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - - name: Push stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - run: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - - test: - needs: [build-sc4s, build-splunk] - - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - splunk-version: ['7.2', '7.3', '8.0', 'latest'] - syslog-version: ['3.25.1','master' ] - - services: - splunk: - image: docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:splunk-${{ matrix.splunk-version }}-${{ github.sha }} - # Map port 8080 on the Docker host to port 80 on the nginx container - ports: - - 8089:8089 - - 8088:8088 - - 8000:8000 - sc4s: - image: docker push docker.pkg.github.com/${GITHUB_REPOSITORY}/stg-splunk-connect-for-syslog:sc4s-${{ matrix.syslog-version }}-${{ github.sha }} - # Map TCP port 6379 on Docker host to a random free port on the Redis container - ports: - - 514:514/tcp - - 514:514/udp - - steps: - - name: Checkout private tools - uses: actions/checkout@v2 - From 2bfaf7f2314af58dd70bc1e7a9744acb02139779 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 07:24:54 -0500 Subject: [PATCH 123/174] Update config.yml --- .circleci/config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 554ac41..9aeeb0c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -75,6 +75,7 @@ test: &test no_output_timeout: 1h - run: name: collect results + when: always command: | docker container create --name dummy \ -v sc4s-tests_results:/work/test-results \ From 66738d82302d179807c2ff1ee30d4647e440a7b1 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 07:45:57 -0500 Subject: [PATCH 124/174] update --- .circleci/config.yml | 4 ++-- tests/entrypoint.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 9aeeb0c..57dcdbe 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -78,9 +78,9 @@ test: &test when: always command: | docker container create --name dummy \ - -v sc4s-tests_results:/work/test-results \ + -v tests_results:/work/test-results \ registry.access.redhat.com/ubi7/ubi - docker cp dummy:/work/test-results test-results/ + docker cp dummy:/work/test-results/test.xml test-results/ - store_artifacts: path: test-results destination: apptest-${SYSLOG}-${SPLUNK} diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh index 8559e00..0dc3697 100755 --- a/tests/entrypoint.sh +++ b/tests/entrypoint.sh @@ -6,4 +6,4 @@ pytest -v \ --splunk_password=${SPLUNK_PASSWORD} \ --sc4s_host=sc4s \ --splunk_host=splunk \ - --junitxml=/work/test-results/functional/functional.xml $@ + --junitxml=/work/test-results/test.xml $@ From 050bb95065af4412cd00ae5fb08b5b0ddcc1ca1d Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 08:24:06 -0500 Subject: [PATCH 125/174] Cleanup --- .circleci/config.yml | 2 +- demo-with-compose.sh | 34 ++++------------------ docker-compose.yml | 63 ++++++++++++++-------------------------- test-with-compose.sh | 34 +--------------------- tests/docker-compose.yml | 2 +- 5 files changed, 30 insertions(+), 105 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 57dcdbe..7720f07 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -83,7 +83,7 @@ test: &test docker cp dummy:/work/test-results/test.xml test-results/ - store_artifacts: path: test-results - destination: apptest-${SYSLOG}-${SPLUNK} + destination: test-results - store_test_results: path: test-results diff --git a/demo-with-compose.sh b/demo-with-compose.sh index 3e0f693..cba338c 100755 --- a/demo-with-compose.sh +++ b/demo-with-compose.sh @@ -4,35 +4,13 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -WAITON=${1:-test} -compose=${2:-docker-compose-demo.yml} -echo $WAITON $compose -mkdir test-results -docker-compose down -docker volume rm sc4s-results -docker volume rm splunk-etc +export SPLUNK=8.0 +export SYSLOG=3.25.1 -docker volume create sc4s-results -docker volume create splunk-etc - -docker container create --name dummy \ - -v sc4s-results:/work/test-results \ - -v splunk-etc:/work/splunk-etc \ - registry.access.redhat.com/ubi7/ubi -docker cp ./splunk/etc/* dummy:/work/splunk-etc/ -docker rm dummy - -docker-compose -f $compose pull -docker-compose -f $compose up -d splunk -docker-compose -f $compose up -d sc4s +docker-compose build +docker-compose up -d splunk +docker-compose up -d sc4s sleep 60 -docker-compose -f $compose build -docker-compose -f $compose up - -docker container create --name dummy \ - -v sc4s-results:/work/test-results \ - registry.access.redhat.com/ubi7/ubi +docker-compose up -docker cp dummy:/work/test-results/functional test-results -docker rm dummy EXIT=$0 diff --git a/docker-compose.yml b/docker-compose.yml index d0dab92..0c106f2 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,10 +7,11 @@ #You should have received a copy of the CC0 legalcode along with this #work. If not, see . version: "3.7" + + services: test: - build: ./tests - + build: tests links: - splunk - sc4s @@ -18,34 +19,30 @@ services: - SPLUNK_USER=admin - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_HOST=splunk - - SYSLOG_HOST=sc4s + - docke=sc4s sc4s: - image: splunk/scs:latest build: - context: ./package + context: package hostname: sc4s -#When this is enabled test_common will fail -# command: -det + #When this is enabled test_common will fail + # command: -det ports: - - "514:514" - - "601:601" - - "514:514/udp" - - "5000" - - "5000:5000/udp" - - "6514:6514" + - "514" + - "601" + - "514/udp" + - "5000-5050" + - "5000-5200/udp" + - "6514" stdin_open: true tty: true links: - splunk environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} + - SPLUNK_HEC_URL=https://splunk:8088 - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no -# - SC4S_LISTEN_DEFAULT_TCP_PORT=514 -# - SC4S_LISTEN_DEFAULT_UDP_PORT=514 -# - SC4S_LISTEN_DEFAULT_TLS_PORT=6514 - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 - SC4S_LISTEN_CISCO_ASA_TCP_PORT=5001 - SC4S_LISTEN_CISCO_IOS_TCP_PORT=5002 @@ -53,36 +50,18 @@ services: - SC4S_LISTEN_JUNIPER_IDP_TCP_PORT=5004 - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - - SC4S_ARCHIVE_GLOBAL=yes -# - SC4S_SOURCE_STORE_RAWMSG=yes + - SC4S_ARCHIVE_GLOBAL=no volumes: - ./tls:/opt/syslog-ng/tls splunk: - image: splunk/splunk:latest + build: + context: splunk hostname: splunk ports: - - "8000:8000" - - "8088:8088" - - "8089:8089" + - "8000" + - "8088" + - "8089" environment: - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} - - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} - volumes: - - splunk-etc:/opt/splunk/etc - pcapreplay: - build: - context: ./utility/pcapreplay - entrypoint: tail -f /dev/null - links: - - splunk - - sc4s - volumes: - - ./replay:/work - -volumes: - splunk-etc: - external: true + - SPLUNK_START_ARGS=--accept-license diff --git a/test-with-compose.sh b/test-with-compose.sh index 6ae13ba..27a367e 100755 --- a/test-with-compose.sh +++ b/test-with-compose.sh @@ -4,36 +4,4 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -WAITON=${1:-test} -compose=${2:-docker-compose.yml} -echo $WAITON $compose -mkdir test-results -docker-compose down -docker volume rm sc4s-results -docker volume rm splunk-etc - -docker volume create sc4s-results -docker volume create splunk-etc - -docker container create --name dummy \ - -v sc4s-results:/work/test-results \ - -v splunk-etc:/work/splunk-etc \ - registry.access.redhat.com/ubi7/ubi -docker cp ./splunk/etc/* dummy:/work/splunk-etc/ -docker rm dummy - -docker-compose -f $compose pull splunk -docker-compose -f $compose build -docker-compose -f $compose up -d splunk -docker-compose -f $compose up -d sc4s -sleep 60 - -docker-compose -f $compose up --abort-on-container-exit --exit-code-from $WAITON - -docker container create --name dummy \ - -v sc4s-results:/work/test-results \ - registry.access.redhat.com/ubi7/ubi - -docker cp dummy:/work/test-results/functional test-results -docker rm dummy -EXIT=$0 +SPLUNK=8.0;SYSLOG=3.25.1 pytest --splunk_password=Changed@11 diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index b49d5a5..63f10dc 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -63,7 +63,7 @@ services: image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} hostname: splunk ports: - - "8000" + - "8000:8000" - "8088" - "8089" environment: From 4ec38b70f3385ac3c2d1f8b2c7323eff545e61e0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 10:20:16 -0500 Subject: [PATCH 126/174] cleanup --- clair-scan.sh | 68 ---------------------------------- clair-whitelist.yml | 24 ------------ clair_to_junit_parser.py | 80 ---------------------------------------- docker-compose.yml | 3 +- 4 files changed, 1 insertion(+), 174 deletions(-) delete mode 100755 clair-scan.sh delete mode 100644 clair-whitelist.yml delete mode 100644 clair_to_junit_parser.py diff --git a/clair-scan.sh b/clair-scan.sh deleted file mode 100755 index e890ce3..0000000 --- a/clair-scan.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/usr/bin/env bash - - set -e - - REPORT_DIR=clair-reports - mkdir $REPORT_DIR || true - - #DB=$(docker run -p 5432:5432 -d arminc/clair-db:latest) - docker run -p 5432:5432 -d --rm --name db arminc/clair-db:latest - #CLAIR=$(docker run -p 6060:6060 --link "$DB":postgres -d arminc/clair-local-scan:latest)' - sleep 30 - docker run -p 6060:6060 --link db:postgres -d --rm --name clair arminc/clair-local-scan:latest - #CLAIR_SCANNER=$(docker run -v /var/run/docker.sock:/var/run/docker.sock --link clair:clair --name clairscanner --rm -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null) - - CLAIR_SCANNER=$(docker run --link clair:clair --name clairscanner --rm -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null) - - #clair_ip=$(docker exec -it "$CLAIR" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+') - #scanner_ip=$(docker exec -it "$CLAIR_SCANNER" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+') - - docker cp "clair-whitelist.yml" "$CLAIR_SCANNER:/whitelist.yml" - WHITELIST="-w /whitelist.yml" - - function scan() { - echo Scanning $1 - local image=$1 - # replace forward-slashes and colons with underscores - munged_image=$(echo "$image" | sed 's/\//_/g' | sed 's/:/_/g') - sanitised_image_filename="${munged_image}.json" - local ret=0 - #--ip "$scanner_ip" \ - # - local docker_cmd=(docker exec -it "$CLAIR_SCANNER" clair-scanner \ - --clair=http://clair:6060 \ - -t "high" \ - --report "$REPORT_DIR/$sanitised_image_filename" \ - --log "$REPORT_DIR/log.json" --whitelist=${WHITELIST:+"-x"} - --reportAll=true \ - --exit-when-no-features=false \ - "$image") - - docker pull "$image" - - "${docker_cmd[@]}" 2>&1 || ret=$? - if [ $ret -eq 0 ]; then - echo "No unapproved vulnerabilities" - elif [ $ret -eq 1 ]; then - echo "Unapproved vulnerabilities found" - EXIT_STATUS=1 - elif [ $ret -eq 5 ]; then - echo "Image was not scanned, not supported." - EXIT_STATUS=1 - else - echo "Unknown clair-scanner return code $ret." - EXIT_STATUS=1 - fi - - docker cp "$CLAIR_SCANNER:/$sanitised_image_filename" "$REPORT_DIR/$sanitised_image_filename" || true - } - - EXIT_STATUS=0 - - scan "$IMAGE_NAME:$CIRCLE_SHA1" - - docker kill clairscanner - docker kill clair - docker kill db - - exit $EXIT_STATUS \ No newline at end of file diff --git a/clair-whitelist.yml b/clair-whitelist.yml deleted file mode 100644 index 586bcb7..0000000 --- a/clair-whitelist.yml +++ /dev/null @@ -1,24 +0,0 @@ -#Splunk Connect for Syslog (SC4S) by Splunk, Inc. -# -#To the extent possible under law, the person who associated CC0 with -#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights -#to Splunk Connect for Syslog (SC4S). -# -#You should have received a copy of the CC0 legalcode along with this -#work. If not, see . -generalwhitelist: - RHSA-2019:1619: False Positive - RHSA-2018:0654: False Positive - RHSA-2018:1967: False Positive - RHSA-2017:0372: False Positive - RHSA-2018:0502: False Positive - RHSA-2018:2772: False Positive - RHSA-2018:1374: False Positive - RHSA-2018:0180: False Positive - RHSA-2019:2029: False Positive - RHSA-2019:1873: False Positive - - - -images: - scs: diff --git a/clair_to_junit_parser.py b/clair_to_junit_parser.py deleted file mode 100644 index 7dbc220..0000000 --- a/clair_to_junit_parser.py +++ /dev/null @@ -1,80 +0,0 @@ -#Copyright 2019 Splunk, Inc. -# -#Use of this source code is governed by a BSD-2-clause-style -#license that can be found in the LICENSE-BSD2 file or at -#https://opensource.org/licenses/BSD-2-Clause -import json -from junit_xml import TestSuite, TestCase -import os -import argparse -import logging - -logger = logging.getLogger('clair_scanner_converter') -logger.setLevel(logging.WARN) -console_logger = logging.StreamHandler() -console_logger.setLevel(logging.WARN) -formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s') -console_logger.setFormatter(formatter) -logger.addHandler(console_logger) - -def parse_args(): - parser = argparse.ArgumentParser(description="Process Json File") - parser.add_argument("clairfile", type=str, default=None, help="Location of clair scanner ouptut file to convert to cucumber.json") - parser.add_argument("--output", type=str, default=None, help="name of output file to store in new format. Defaults to clair inputfile") - args = parser.parse_args() - if not args.output: - logger.warning("No output file specified, replacing input file.") - args.output = args.clairfile - return args - -def main(): - cwd = os.getcwd() - args = parse_args() - try: - if os.path.exists(args.clairfile): - with open(args.clairfile) as clairfile: - clair_parsed_file = json.load(clairfile) - if os.path.exists(os.path.join("clair-scanner-logs", "/clair_setup_errors.log")): - with open(os.path.join("clair-scanner-logs", "/clair_setup_errors.log"), 'r') as clairfile_errors: - clair_parsed_error_file = clairfile_errors.readlines() - else: - clair_parsed_error_file = None - except: - logger.exception("Failed to parse clair / clair_error file. Exiting.") - - current_sorted_level = None - current_suite = None - test_suites = [] - if clair_parsed_error_file: - current_suite = TestSuite("SetupError") - new_step = TestCase(name="SetupError", classname="SetupError", status="unapproved", stderr=clair_parsed_error_file) - new_step.log = clair_parsed_error_file - new_step.category = "SetupError" - new_step.failure_type = "unapproved" - new_step.failure_message = "Please have the following security issue reviewed by Splunk: {}".format(vuln["link"]) - new_step.failure_output = clair_parsed_error_file - current_suite.test_cases.append(new_step) - test_suites.append(current_suite) - for vuln in clair_parsed_file["vulnerabilities"]: - if current_sorted_level != vuln["severity"]: - if current_suite: - test_suites.append(current_suite) - current_suite = TestSuite(name=vuln["severity"]) - current_sorted_level = vuln["severity"] - new_step = TestCase(name=vuln["vulnerability"], classname=vuln["severity"], status="unapproved", url=vuln["link"], stderr=vuln["description"]) - new_step.log = vuln - new_step.category = vuln["severity"] - new_step.failure_type = "unapproved" - new_step.failure_message = "Please have the following security issue reviewed by Splunk: {}".format(vuln["link"]) - new_step.failure_output = vuln["description"] - current_suite.test_cases.append(new_step) - # try to write new file - try: - with open(args.output, 'w') as outfile: - outfile.write(TestSuite.to_xml_string(test_suites)) - except: - logger.exception("Filed saving file.") - - -if __name__ == "__main__": - main() \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 0c106f2..db9f4e5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -19,7 +19,6 @@ services: - SPLUNK_USER=admin - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_HOST=splunk - - docke=sc4s sc4s: build: @@ -58,7 +57,7 @@ services: context: splunk hostname: splunk ports: - - "8000" + - "8000:8000" - "8088" - "8089" environment: From b834abc3ae671fe2cdc987e6659067bcf00858b7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:36:55 -0500 Subject: [PATCH 127/174] Create review-secrets.yml --- .github/workflows/review-secrets.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/workflows/review-secrets.yml diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml new file mode 100644 index 0000000..fbbfe46 --- /dev/null +++ b/.github/workflows/review-secrets.yml @@ -0,0 +1,10 @@ +name: Review Secrets +on: + pull_request: + types: [assigned, unassigned] + +jobs: + review_secrets: + + - name: Trufflehog Actions Scan + uses: edplato/trufflehog-actions-scan@v0.9f-beta From f1daf3b83b75167c1d81e398873656f70d2e233f Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:38:15 -0500 Subject: [PATCH 128/174] Update review-secrets.yml --- .github/workflows/review-secrets.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml index fbbfe46..702fc57 100644 --- a/.github/workflows/review-secrets.yml +++ b/.github/workflows/review-secrets.yml @@ -5,6 +5,5 @@ on: jobs: review_secrets: - - - name: Trufflehog Actions Scan - uses: edplato/trufflehog-actions-scan@v0.9f-beta + - name: Trufflehog Actions Scan + uses: edplato/trufflehog-actions-scan@v0.9f-beta From 76a15fc036e4c0f8787be4eb45e63e0732db4247 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:40:41 -0500 Subject: [PATCH 129/174] Update review-secrets.yml --- .github/workflows/review-secrets.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml index 702fc57..5bae67a 100644 --- a/.github/workflows/review-secrets.yml +++ b/.github/workflows/review-secrets.yml @@ -5,5 +5,8 @@ on: jobs: review_secrets: - - name: Trufflehog Actions Scan - uses: edplato/trufflehog-actions-scan@v0.9f-beta + steps: + - name: Checkout + uses: actions/checkout@v1 + - name: Trufflehog Actions Scan + uses: edplato/trufflehog-actions-scan@v0.9f-beta From 41f6eb77e6aa3d82a85ccf53ec1a3f7f6349b9f4 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:41:22 -0500 Subject: [PATCH 130/174] Update review-secrets.yml --- .github/workflows/review-secrets.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml index 5bae67a..7f2b555 100644 --- a/.github/workflows/review-secrets.yml +++ b/.github/workflows/review-secrets.yml @@ -9,4 +9,4 @@ jobs: - name: Checkout uses: actions/checkout@v1 - name: Trufflehog Actions Scan - uses: edplato/trufflehog-actions-scan@v0.9f-beta + uses: edplato/trufflehog-actions-scan@v0.9f-beta From 4cc3c75b0d02b4e6e521215f2475e2bd665c312a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:41:46 -0500 Subject: [PATCH 131/174] Update review-secrets.yml --- .github/workflows/review-secrets.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml index 7f2b555..5bae67a 100644 --- a/.github/workflows/review-secrets.yml +++ b/.github/workflows/review-secrets.yml @@ -9,4 +9,4 @@ jobs: - name: Checkout uses: actions/checkout@v1 - name: Trufflehog Actions Scan - uses: edplato/trufflehog-actions-scan@v0.9f-beta + uses: edplato/trufflehog-actions-scan@v0.9f-beta From dcf48d62c74a685aef6c2d1dbd11ee74c27eb1a7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 6 Feb 2020 22:43:20 -0500 Subject: [PATCH 132/174] Update review-secrets.yml --- .github/workflows/review-secrets.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/review-secrets.yml b/.github/workflows/review-secrets.yml index 5bae67a..bc0c84c 100644 --- a/.github/workflows/review-secrets.yml +++ b/.github/workflows/review-secrets.yml @@ -1,12 +1,12 @@ name: Review Secrets -on: - pull_request: - types: [assigned, unassigned] +on: [push] jobs: review_secrets: + runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v1 - name: Trufflehog Actions Scan uses: edplato/trufflehog-actions-scan@v0.9f-beta + From 0ee7ebbce6b1d5421fc38ade6f00c1b0ecfd48dd Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 10:20:36 -0500 Subject: [PATCH 133/174] updates --- demo-with-compose.sh | 10 ++---- pytest.ini | 8 ++--- test-with-compose.sh | 5 ++- tests/Dockerfile | 3 +- tests/conftest.py | 19 +++++++++- tests/docker-compose-ci.yml | 69 +++++++++++++++++++++++++++++++++++++ tests/docker-compose.yml | 22 ++---------- tests/pytest-ci.ini | 11 ++++++ tests/pytest.ini | 5 --- 9 files changed, 112 insertions(+), 40 deletions(-) create mode 100644 tests/docker-compose-ci.yml create mode 100644 tests/pytest-ci.ini delete mode 100644 tests/pytest.ini diff --git a/demo-with-compose.sh b/demo-with-compose.sh index cba338c..15eb88a 100755 --- a/demo-with-compose.sh +++ b/demo-with-compose.sh @@ -4,13 +4,7 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -export SPLUNK=8.0 -export SYSLOG=3.25.1 - -docker-compose build -docker-compose up -d splunk -docker-compose up -d sc4s -sleep 60 -docker-compose up +docker-compose -f tests/docker-compose-ci.yml build +docker-compose -f tests/docker-compose-ci.yml up EXIT=$0 diff --git a/pytest.ini b/pytest.ini index 36a1996..01ff4c6 100644 --- a/pytest.ini +++ b/pytest.ini @@ -1,8 +1,8 @@ [pytest] testpaths = tests -#addopts = --tb=long -# --force-flaky --max-runs=3 --min-passes=1 +addopts = + -v --tb=long + --splunk_type=docker filterwarnings = ignore::DeprecationWarning -#[pytest] -#junit_family = xunit2 +junit_family = xunit1 diff --git a/test-with-compose.sh b/test-with-compose.sh index 27a367e..50e25b9 100755 --- a/test-with-compose.sh +++ b/test-with-compose.sh @@ -4,4 +4,7 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -SPLUNK=8.0;SYSLOG=3.25.1 pytest --splunk_password=Changed@11 +docker-compose -f tests/docker-compose-ci.yml up --abort-on-container-exit + +EXIT=$0 + diff --git a/tests/Dockerfile b/tests/Dockerfile index 285d52c..56537b2 100644 --- a/tests/Dockerfile +++ b/tests/Dockerfile @@ -10,12 +10,13 @@ FROM python:3.7 COPY requirements.txt / RUN pip3 install -r /requirements.txt +RUN pip3 install pytest-xdist RUN mkdir -p /work/tests RUN mkdir -p /work/test-results/functional COPY entrypoint.sh / COPY wait-for /bin/ COPY ./* /work/tests/ -COPY pytest.ini /work +COPY pytest-ci.ini /work/pytest.ini COPY ./data /work/tests/data #WORKDIR /work CMD /entrypoint.sh diff --git a/tests/conftest.py b/tests/conftest.py index dfec407..a2fc51e 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -6,6 +6,7 @@ import os import random import socket +import uuid from time import sleep import pytest @@ -82,9 +83,16 @@ def pytest_addoption(parser): '--splunk_password', action='store', dest='splunk_password', - default='changeme', + default='Changed@11', help='Splunk password' ) + group.addoption( + '--splunk_hec_token', + action='store', + dest='splunk_hec_token', + default=str(uuid.uuid1()), + help='Splunk HEC token' + ) group.addoption( '--splunk_version', action='store', @@ -112,12 +120,21 @@ def is_responsive_splunk(splunk): return False +@pytest.fixture(scope="session") +def docker_compose_file(pytestconfig): + """Get an absolute path to the `docker-compose.yml` file. Override this + fixture in your tests if you need a custom location.""" + + return os.path.join(str(pytestconfig.invocation_dir), "tests", "docker-compose.yml") + @pytest.fixture(scope="session") def splunk(request): if request.config.getoption('splunk_type') == 'external': request.fixturenames.append('splunk_external') splunk = request.getfixturevalue("splunk_external") elif request.config.getoption('splunk_type') == 'docker': + os.environ['SPLUNK_PASSWORD'] = request.config.getoption('splunk_password') + os.environ['SPLUNK_HEC_TOKEN'] = request.config.getoption('splunk_hec_token') request.fixturenames.append('splunk_docker') splunk = request.getfixturevalue("splunk_docker") else: diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml new file mode 100644 index 0000000..b3ffd08 --- /dev/null +++ b/tests/docker-compose-ci.yml @@ -0,0 +1,69 @@ +#Splunk Connect for Syslog (SC4S) by Splunk, Inc. +# +#To the extent possible under law, the person who associated CC0 with +#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights +#to Splunk Connect for Syslog (SC4S). +# +#You should have received a copy of the CC0 legalcode along with this +#work. If not, see . +version: "3.7" + + +services: + test: + build: . + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} + links: + - splunk + - sc4s + volumes: + - results:/work/test-results + + sc4s: + build: + context: ../package + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} + hostname: sc4s + #When this is enabled test_common will fail + # command: -det + ports: + - "514" + - "601" + - "514/udp" + - "5000-5050" + - "5000-5050/udp" + - "6514" + stdin_open: true + tty: true + links: + - splunk + environment: + - SPLUNK_HEC_URL=https://splunk:8088 + - SPLUNK_HEC_TOKEN=70b6ae71-76b3-4c38-9597-0c5b37ad9630 + - SC4S_SOURCE_TLS_ENABLE=no + - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no + - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 + - SC4S_LISTEN_CISCO_ASA_TCP_PORT=5001 + - SC4S_LISTEN_CISCO_IOS_TCP_PORT=5002 + - SC4S_LISTEN_CISCO_MERAKI_TCP_PORT=5003 + - SC4S_LISTEN_JUNIPER_IDP_TCP_PORT=5004 + - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 + - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 + - SC4S_ARCHIVE_GLOBAL=no + splunk: + build: + context: ../splunk + image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} + hostname: splunk + ports: + - "8000" + - "8088" + - "8089" + environment: + - SPLUNK_HEC_TOKEN=70b6ae71-76b3-4c38-9597-0c5b37ad9630 + - SPLUNK_PASSWORD=Changed@11 + - SPLUNK_START_ARGS=--accept-license + +volumes: + results: + external: false \ No newline at end of file diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 63f10dc..e6ec6c7 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -10,24 +10,9 @@ version: "3.7" services: - test: - build: . - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} - links: - - splunk - - sc4s - environment: - - SPLUNK_USER=admin - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_HOST=splunk - - docke=sc4s - volumes: - - results:/work/test-results - sc4s: build: context: ../package - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} hostname: sc4s #When this is enabled test_common will fail # command: -det @@ -36,7 +21,7 @@ services: - "601" - "514/udp" - "5000-5050" - - "5000-5200/udp" + - "5000-5050/udp" - "6514" stdin_open: true tty: true @@ -55,15 +40,12 @@ services: - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no - volumes: - - ./tls:/opt/syslog-ng/tls splunk: build: context: ../splunk - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} hostname: splunk ports: - - "8000:8000" + - "8000" - "8088" - "8089" environment: diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini new file mode 100644 index 0000000..def1d4a --- /dev/null +++ b/tests/pytest-ci.ini @@ -0,0 +1,11 @@ +[pytest] +addopts = -v + --splunk_type=external + --splunk_password=Changed@11 + --splunk_hec_token=70b6ae71-76b3-4c38-9597-0c5b37ad9630 + --splunk_host=splunk + --sc4s_host=sc4s + --maxfail=5 + -n 4 +filterwarnings = + ignore::DeprecationWarning diff --git a/tests/pytest.ini b/tests/pytest.ini deleted file mode 100644 index ce9083e..0000000 --- a/tests/pytest.ini +++ /dev/null @@ -1,5 +0,0 @@ -[pytest] -addopts = -# --force-flaky --max-runs=3 --min-passes=1 -filterwarnings = - ignore::DeprecationWarning From 58719b60f8aa9ba7779261303a43e9b49985b9d2 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 10:28:02 -0500 Subject: [PATCH 134/174] cleanup --- .env.template | 15 ----- demo-with-compose.sh | 4 +- docker-compose-ci.yml | 65 ------------------ docker-compose-debug.yml | 53 --------------- docker-compose-demo.yml | 66 ------------------- test-with-compose.sh | 3 +- tests/docker-compose-ci.yml | 5 -- .../docker-compose-script.yml | 28 ++++---- 8 files changed, 18 insertions(+), 221 deletions(-) delete mode 100644 .env.template delete mode 100644 docker-compose-ci.yml delete mode 100644 docker-compose-debug.yml delete mode 100644 docker-compose-demo.yml rename docker-compose.yml => tests/docker-compose-script.yml (78%) diff --git a/.env.template b/.env.template deleted file mode 100644 index b795fde..0000000 --- a/.env.template +++ /dev/null @@ -1,15 +0,0 @@ -#Splunk Connect for Syslog (SC4S) by Splunk, Inc. -# -#To the extent possible under law, the person who associated CC0 with -#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights -#to Splunk Connect for Syslog (SC4S). -# -#You should have received a copy of the CC0 legalcode along with this -#work. If not, see . -SPLUNK_HEC_TOKEN=a778f63a-5dff-4e3c-a72c-a03183659e94 -SPLUNK_PASSWORD=Changed@11 -SPLUNK_START_ARGS=--accept-license -SPLUNK_HEC_URL=https://splunk:8088/services/collector/event -#SPLUNK_APPS_URL=https://splunkbase.splunk.com/app/2757/release/6.1.1/download,https://splunkbase.splunk.com/app/3245/release/1.0/download,https://splunkbase.splunk.com/app/1620/release/3.4.0/download,https://splunkbase.splunk.com/app/1467/release/2.5.8/download,https://splunkbase.splunk.com/app/2846/release/1.6.0/download,https://splunkbase.splunk.com/app/2847/release/1.2.0/download -#SPLUNKBASE_USERNAME=username -#SPLUNKBASE_PASSWORD=password diff --git a/demo-with-compose.sh b/demo-with-compose.sh index 15eb88a..804ee8e 100755 --- a/demo-with-compose.sh +++ b/demo-with-compose.sh @@ -4,7 +4,7 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -docker-compose -f tests/docker-compose-ci.yml build -docker-compose -f tests/docker-compose-ci.yml up +docker-compose -f tests/docker-compose-script.yml build +docker-compose -f tests/docker-compose-script.yml up EXIT=$0 diff --git a/docker-compose-ci.yml b/docker-compose-ci.yml deleted file mode 100644 index 39ac90f..0000000 --- a/docker-compose-ci.yml +++ /dev/null @@ -1,65 +0,0 @@ -#Splunk Connect for Syslog (SC4S) by Splunk, Inc. -# -#To the extent possible under law, the person who associated CC0 with -#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights -#to Splunk Connect for Syslog (SC4S). -# -#You should have received a copy of the CC0 legalcode along with this -#work. If not, see . -version: "3.7" -services: - test: - build: ./tests - entrypoint: - - /entrypoint.sh - - --splunk_type=external - - --splunk_host=splunk - - --splunk_password=${SPLUNK_PASSWORD} - - --sc4s_host=sc4s - links: - - splunk - - sc4s - volumes: - - sc4s-results:/work/test-results - - sc4s: - image: ${REGISTRY}/${CI_IMAGE}:${CIRCLE_SHA1} - hostname: sc4s - ports: - - "514" - - "601" - - "514/udp" - - "5000" - - "5000/udp" - stdin_open: true - tty: true - links: - - splunk - environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_CONNECT_METHOD=${SPLUNK_CONNECT_METHOD} - - SPLUNK_DEFAULT_INDEX=${SPLUNK_DEFAULT_INDEX} - - SPLUNK_METRICS_INDEX=${SPLUNK_DEFAULT_INDEX} - - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no - - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 - - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - - splunk: - build: - context: splunk - hostname: splunk - ports: - - "8000:8000" - - "8088:8088" - - "8089:8089" - environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} - - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} -volumes: - sc4s-results: - external: true diff --git a/docker-compose-debug.yml b/docker-compose-debug.yml deleted file mode 100644 index ee8d0e0..0000000 --- a/docker-compose-debug.yml +++ /dev/null @@ -1,53 +0,0 @@ -#Splunk Connect for Syslog (SC4S) by Splunk, Inc. -# -#To the extent possible under law, the person who associated CC0 with -#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights -#to Splunk Connect for Syslog (SC4S). -# -#You should have received a copy of the CC0 legalcode along with this -#work. If not, see . -version: "3.2" -services: - - sc4s: - image: splunk/scs:latest - build: - context: ./package - entrypoint: - - "tail" - - "-f" - - "/dev/null" - hostname: sc4s - ports: - - "514" - - "601" - - "514/udp" - - "5514" - - "5514/udp" - stdin_open: true - tty: true - links: - - splunk - environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_CONNECT_METHOD=${SPLUNK_CONNECT_METHOD} - - SPLUNK_DEFAULT_INDEX=${SPLUNK_DEFAULT_INDEX} - - SPLUNK_METRICS_INDEX=${SPLUNK_DEFAULT_INDEX} - - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no - splunk: - image: splunk/splunk:latest - hostname: splunk - ports: - - "8000:8000" - - "8088:8088" - - "8089:8089" - environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} - - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} - volumes: - - ./splunk/SA-syslog-ng:/opt/splunk/etc/apps/SA-syslog-ng diff --git a/docker-compose-demo.yml b/docker-compose-demo.yml deleted file mode 100644 index 3934fe1..0000000 --- a/docker-compose-demo.yml +++ /dev/null @@ -1,66 +0,0 @@ -#Splunk Connect for Syslog (SC4S) by Splunk, Inc. -# -#To the extent possible under law, the person who associated CC0 with -#Splunk Connect for Syslog (SC4S) has waived all copyright and related or neighboring rights -#to Splunk Connect for Syslog (SC4S). -# -#You should have received a copy of the CC0 legalcode along with this -#work. If not, see . -version: "3.2" -services: - test: - build: ./tests - links: - - splunk - - sc4s - volumes: - - sc4s-tests:/work/tests - - sc4s-results:/work/test-results - environment: - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - sc4s: - image: splunk/scs:latest - hostname: sc4s - ports: - - "514" - - "601" - - "514/udp" - - "5514" - - "5514/udp" - stdin_open: true - tty: true - links: - - splunk - environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_CONNECT_METHOD=${SPLUNK_CONNECT_METHOD} - - SPLUNK_DEFAULT_INDEX=${SPLUNK_DEFAULT_INDEX} - - SPLUNK_METRICS_INDEX=${SPLUNK_DEFAULT_INDEX} - - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no - - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 - splunk: - image: splunk/splunk:latest - hostname: splunk - ports: - - "8000:8000" - - "8088:8088" - - "8089:8089" - environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_START_ARGS=${SPLUNK_START_ARGS} - - SPLUNK_APPS_URL=${SPLUNK_APPS_URL} - - SPLUNKBASE_USERNAME=${SPLUNKBASE_USERNAME} - - SPLUNKBASE_PASSWORD=${SPLUNKBASE_PASSWORD} - volumes: - - splunk-etc:/opt/splunk/etc - -volumes: - sc4s-tests: - external: true - sc4s-results: - external: true - splunk-etc: - external: true diff --git a/test-with-compose.sh b/test-with-compose.sh index 50e25b9..47911fb 100755 --- a/test-with-compose.sh +++ b/test-with-compose.sh @@ -4,7 +4,8 @@ #Use of this source code is governed by a BSD-2-clause-style #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause -docker-compose -f tests/docker-compose-ci.yml up --abort-on-container-exit +docker-compose -f tests/docker-compose-script.yml build +docker-compose -f tests/docker-compose-script.yml up --abort-on-container-exit EXIT=$0 diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml index b3ffd08..e6aae72 100644 --- a/tests/docker-compose-ci.yml +++ b/tests/docker-compose-ci.yml @@ -11,7 +11,6 @@ version: "3.7" services: test: - build: . image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} links: - splunk @@ -20,8 +19,6 @@ services: - results:/work/test-results sc4s: - build: - context: ../package image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} hostname: sc4s #When this is enabled test_common will fail @@ -51,8 +48,6 @@ services: - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no splunk: - build: - context: ../splunk image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} hostname: splunk ports: diff --git a/docker-compose.yml b/tests/docker-compose-script.yml similarity index 78% rename from docker-compose.yml rename to tests/docker-compose-script.yml index db9f4e5..7bd4de2 100644 --- a/docker-compose.yml +++ b/tests/docker-compose-script.yml @@ -11,18 +11,16 @@ version: "3.7" services: test: - build: tests + build: . links: - splunk - sc4s - environment: - - SPLUNK_USER=admin - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - - SPLUNK_HOST=splunk + volumes: + - results:/work/test-results sc4s: build: - context: package + context: ../package hostname: sc4s #When this is enabled test_common will fail # command: -det @@ -31,7 +29,7 @@ services: - "601" - "514/udp" - "5000-5050" - - "5000-5200/udp" + - "5000-5050/udp" - "6514" stdin_open: true tty: true @@ -39,7 +37,7 @@ services: - splunk environment: - SPLUNK_HEC_URL=https://splunk:8088 - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} + - SPLUNK_HEC_TOKEN=70b6ae71-76b3-4c38-9597-0c5b37ad9630 - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no - SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT=5000 @@ -50,17 +48,19 @@ services: - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no - volumes: - - ./tls:/opt/syslog-ng/tls splunk: build: - context: splunk + context: ../splunk hostname: splunk ports: - - "8000:8000" + - "8000" - "8088" - "8089" environment: - - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} + - SPLUNK_HEC_TOKEN=70b6ae71-76b3-4c38-9597-0c5b37ad9630 + - SPLUNK_PASSWORD=Changed@11 - SPLUNK_START_ARGS=--accept-license + +volumes: + results: + external: false \ No newline at end of file From 1e7c4edd9c32aad6e1874f46831b0ec8499e44ca Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 10:31:58 -0500 Subject: [PATCH 135/174] Update config.yml --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 7720f07..42c6fe0 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -70,8 +70,8 @@ test: &test - run: name: test command: | - docker-compose -f tests/docker-compose.yml pull - docker-compose -f tests/docker-compose.yml up --abort-on-container-exit + docker-compose -f tests/docker-compose-ci.yml pull + docker-compose -f tests/docker-compose-ci.yml up --abort-on-container-exit no_output_timeout: 1h - run: name: collect results From 956505ddee6ef45532e9b9d3cd148e5c94c6bea0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 10:43:51 -0500 Subject: [PATCH 136/174] Update config.yml --- .circleci/config.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 42c6fe0..ddb1be6 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -24,12 +24,12 @@ build-sc4s: &build-sc4s command: | echo $SEMVER_VERSION >package/VERSION docker build --build-arg BRANCH=${SYSLOG} package \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 - run: name: Push SC4S command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 build-splunk: &build-splunk steps: @@ -45,12 +45,12 @@ build-splunk: &build-splunk name: Build Splunk command: | docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-$CIRCLE_SHA1 - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-$CIRCLE_SHA1 test: &test steps: @@ -98,12 +98,12 @@ publish: &publish command: | docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> + - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 - run: name: Docker Save command: | mkdir -p /tmp/workspace/ - docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> | gzip -c > /tmp/workspace/oci_container.tar.gz + docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 | gzip -c > /tmp/workspace/oci_container.tar.gz - run: name: BYOE Config command: | @@ -112,7 +112,7 @@ publish: &publish - run: command: | if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi - docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-<< pipeline.id >> splunk/scs:${VERSION} + docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 splunk/scs:${VERSION} - docker/push: image: splunk/scs tag: $DOCKER_TAG @@ -154,12 +154,12 @@ jobs: name: Build Splunk command: | docker build tests \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-<< pipeline.id >> + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-$CIRCLE_SHA1 - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-<< pipeline.id >> + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-$CIRCLE_SHA1 #JOB SC4S build-sc4s-3-25-1: From 122862728934adbeb808a5b052e07a4edbc12480 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 11:16:20 -0500 Subject: [PATCH 137/174] update --- pytest.ini | 2 +- tests/pytest-ci.ini | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/pytest.ini b/pytest.ini index 01ff4c6..8d7aa27 100644 --- a/pytest.ini +++ b/pytest.ini @@ -5,4 +5,4 @@ addopts = --splunk_type=docker filterwarnings = ignore::DeprecationWarning -junit_family = xunit1 +junit_family=xunit1 \ No newline at end of file diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index def1d4a..b362753 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -7,5 +7,6 @@ addopts = -v --sc4s_host=sc4s --maxfail=5 -n 4 +junit_family=xunit1 filterwarnings = ignore::DeprecationWarning From a188beaf8aa606a6f07cd177f677d180f16b369f Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 11:27:45 -0500 Subject: [PATCH 138/174] Update pytest-ci.ini --- tests/pytest-ci.ini | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index b362753..edff8eb 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -6,7 +6,6 @@ addopts = -v --splunk_host=splunk --sc4s_host=sc4s --maxfail=5 - -n 4 junit_family=xunit1 filterwarnings = ignore::DeprecationWarning From 7a4787404a30d0fe91b0170fbb642c7fc8de5aa3 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 11:46:49 -0500 Subject: [PATCH 139/174] Update pytest-ci.ini --- tests/pytest-ci.ini | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index edff8eb..df69bcb 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -1,7 +1,6 @@ [pytest] addopts = -v --splunk_type=external - --splunk_password=Changed@11 --splunk_hec_token=70b6ae71-76b3-4c38-9597-0c5b37ad9630 --splunk_host=splunk --sc4s_host=sc4s From fba591f7c63f7d6b4b86bccae5e35ce9f568679d Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 11:56:51 -0500 Subject: [PATCH 140/174] updates --- demo-with-compose.sh | 4 ++++ tests/entrypoint.sh | 7 +------ tests/pytest-ci.ini | 1 + 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/demo-with-compose.sh b/demo-with-compose.sh index 804ee8e..9e5dbac 100755 --- a/demo-with-compose.sh +++ b/demo-with-compose.sh @@ -5,6 +5,10 @@ #license that can be found in the LICENSE-BSD2 file or at #https://opensource.org/licenses/BSD-2-Clause docker-compose -f tests/docker-compose-script.yml build +docker-compose -f tests/docker-compose-script.yml up -d splunk +sleep 60 +docker-compose -f tests/docker-compose-script.yml up -d sc4s +sleep 5 docker-compose -f tests/docker-compose-script.yml up EXIT=$0 diff --git a/tests/entrypoint.sh b/tests/entrypoint.sh index 0dc3697..157ddcc 100755 --- a/tests/entrypoint.sh +++ b/tests/entrypoint.sh @@ -1,9 +1,4 @@ #!/bin/sh cd /work -pytest -v \ - --splunk_type=external \ - --splunk_password=${SPLUNK_PASSWORD} \ - --sc4s_host=sc4s \ - --splunk_host=splunk \ - --junitxml=/work/test-results/test.xml $@ +pytest $@ diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index df69bcb..b20b9c4 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -5,6 +5,7 @@ addopts = -v --splunk_host=splunk --sc4s_host=sc4s --maxfail=5 + --junitxml=/work/test-results/test.xml junit_family=xunit1 filterwarnings = ignore::DeprecationWarning From 656a045c2837bc8ab82a727e38d9b9a17473c980 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 11:58:04 -0500 Subject: [PATCH 141/174] Update pytest-ci.ini --- tests/pytest-ci.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index b20b9c4..0154d25 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -6,6 +6,7 @@ addopts = -v --sc4s_host=sc4s --maxfail=5 --junitxml=/work/test-results/test.xml + -n=6 junit_family=xunit1 filterwarnings = ignore::DeprecationWarning From d3c1313ac2342de76e22d0118da577efedefb144 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 12:40:30 -0500 Subject: [PATCH 142/174] update --- .circleci/config.yml | 18 +++++++++--------- tests/pytest-ci.ini | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index ddb1be6..279c8b4 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -24,12 +24,12 @@ build-sc4s: &build-sc4s command: | echo $SEMVER_VERSION >package/VERSION docker build --build-arg BRANCH=${SYSLOG} package \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - run: name: Push SC4S command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} build-splunk: &build-splunk steps: @@ -45,12 +45,12 @@ build-splunk: &build-splunk name: Build Splunk command: | docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-$CIRCLE_SHA1 + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-$CIRCLE_SHA1 + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} test: &test steps: @@ -98,12 +98,12 @@ publish: &publish command: | docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 + - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - run: name: Docker Save command: | mkdir -p /tmp/workspace/ - docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 | gzip -c > /tmp/workspace/oci_container.tar.gz + docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} | gzip -c > /tmp/workspace/oci_container.tar.gz - run: name: BYOE Config command: | @@ -112,7 +112,7 @@ publish: &publish - run: command: | if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi - docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-$CIRCLE_SHA1 splunk/scs:${VERSION} + docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} splunk/scs:${VERSION} - docker/push: image: splunk/scs tag: $DOCKER_TAG @@ -154,12 +154,12 @@ jobs: name: Build Splunk command: | docker build tests \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-$CIRCLE_SHA1 + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} - run: name: Push Splunk command: | docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-$CIRCLE_SHA1 + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} #JOB SC4S build-sc4s-3-25-1: diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index 0154d25..fc33ec0 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -1,5 +1,5 @@ [pytest] -addopts = -v +addopts = -v --tb=long --splunk_type=external --splunk_hec_token=70b6ae71-76b3-4c38-9597-0c5b37ad9630 --splunk_host=splunk From 2ec67966b7d8c97a0e43b0434819f322158ae679 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 12:48:54 -0500 Subject: [PATCH 143/174] Update docker-compose-ci.yml --- tests/docker-compose-ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml index e6aae72..e0d5e58 100644 --- a/tests/docker-compose-ci.yml +++ b/tests/docker-compose-ci.yml @@ -11,7 +11,7 @@ version: "3.7" services: test: - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} + build: tests links: - splunk - sc4s @@ -19,7 +19,7 @@ services: - results:/work/test-results sc4s: - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} + build: package hostname: sc4s #When this is enabled test_common will fail # command: -det @@ -48,7 +48,7 @@ services: - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no splunk: - image: docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} + build: splunk hostname: splunk ports: - "8000" From e983dbc51395eebe2f5f2d65397c44148f05f7d7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 12:51:00 -0500 Subject: [PATCH 144/174] Update docker-compose-ci.yml --- tests/docker-compose-ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml index e0d5e58..cb5f09d 100644 --- a/tests/docker-compose-ci.yml +++ b/tests/docker-compose-ci.yml @@ -11,7 +11,7 @@ version: "3.7" services: test: - build: tests + build: . links: - splunk - sc4s @@ -19,7 +19,7 @@ services: - results:/work/test-results sc4s: - build: package + build: ../package hostname: sc4s #When this is enabled test_common will fail # command: -det @@ -48,7 +48,7 @@ services: - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no splunk: - build: splunk + build: ../splunk hostname: splunk ports: - "8000" From a34fc1a26b807ac0cecb9e464257308c65e464c5 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 12:54:00 -0500 Subject: [PATCH 145/174] Update pytest-ci.ini --- tests/pytest-ci.ini | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index fc33ec0..9bcb6f8 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -4,7 +4,6 @@ addopts = -v --tb=long --splunk_hec_token=70b6ae71-76b3-4c38-9597-0c5b37ad9630 --splunk_host=splunk --sc4s_host=sc4s - --maxfail=5 --junitxml=/work/test-results/test.xml -n=6 junit_family=xunit1 From 0abe7a85194a796a27090c7c81bb917d1e7c92e9 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Fri, 7 Feb 2020 13:38:17 -0500 Subject: [PATCH 146/174] Add VS Code project config --- .vscode/launch.json | 25 +++++++++++++++++++++++++ .vscode/settings.json | 5 +++++ 2 files changed, 30 insertions(+) create mode 100644 .vscode/launch.json create mode 100644 .vscode/settings.json diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 0000000..f965872 --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,25 @@ +{ + // Use IntelliSense to learn about possible attributes. + // Hover to view descriptions of existing attributes. + // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 + "version": "0.2.0", + "configurations": [ + { + "name": "Setup Project", + "type": "python", + "request": "launch", + "module": "venv", + "args": ["venv"] + }, + { + "name": "Setup Requirements", + "type": "python", + "request": "launch", + "module": "pip", + "args": [ + "install", + "-r", + "requirements.txt"] + } + ] +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..09e2786 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,5 @@ +{ + "python.pythonPath": "venv/bin/python3", + "python.testing.pytestEnabled": true, + "python.testing.autoTestDiscoverOnSaveEnabled": true +} \ No newline at end of file From 30fd0f21cee94bcd0395cfad3d90de1a4fa0d87f Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Sat, 8 Feb 2020 09:17:04 -0500 Subject: [PATCH 147/174] updates --- .circleci/config.yml | 2 +- docs/developing/gh_clone.png | Bin 0 -> 17417 bytes docs/developing/gh_fork.png | Bin 0 -> 32009 bytes docs/developing/index.md | 43 ++++++++++++++++++++++++++++++++++ docs/developing/vsc_debug.png | Bin 0 -> 73250 bytes docs/developing/vsc_run.png | Bin 0 -> 23843 bytes mkdocs.yml | 1 + package/Dockerfile | 2 +- pytest.ini | 1 + 9 files changed, 47 insertions(+), 2 deletions(-) create mode 100644 docs/developing/gh_clone.png create mode 100644 docs/developing/gh_fork.png create mode 100644 docs/developing/index.md create mode 100644 docs/developing/vsc_debug.png create mode 100644 docs/developing/vsc_run.png diff --git a/.circleci/config.yml b/.circleci/config.yml index 279c8b4..1792d17 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -166,7 +166,7 @@ jobs: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: '3.25.1' + SYSLOG: 'syslog-ng-3.25.1' <<: *build-sc4s build-sc4s-master: docker: diff --git a/docs/developing/gh_clone.png b/docs/developing/gh_clone.png new file mode 100644 index 0000000000000000000000000000000000000000..a654aadf298c5d8d0664743474e19e3a5a462d3c GIT binary patch literal 17417 zcmdVCWl&vB_b-^>?(Xgu+#$GY65KtwI|K=?!GgO5cXxL<1a~{Q+rjV2^W=T+zv|9> zn5wC%8a^C$?_Socd++XE{aZU+MM)YNfdJv%yLZU4G7@U<-n}0MUq{2ifPZ-!`P;!a z#I3}|Rb<7*$yA)|&8=+A-o2xXH!(ECkY%D9HZn3a9G+mLM{sgi3k!=DG*)jZ!8Wzp`?tJC7hEXbZ< z;+W$y;^8=hE}`Qp5`w9+V){dt5g}G%MoJ|S& zMu_QFk^6ixEORNyzUw`DOhwKq0n@vwCOyZhZc zK@WcLrLCEZ5t)arjh!>UhY-a-6#U@pKet&a$o?U5u@<7xR8%1ow|6ol<6_}tVWSX6 zAR{9abTT#PSCf$X%MLCHQCPaTIPkNwy1ToxxO1@BJ6W)P;N#U{lws&e< z{-fsqsQKT9{tr&g|INwC#rr=w|3}UL;QV6=zp|5+8Q4jGTp_OE1X!$4~#m zZ~u16KX<{sB8(u&`rjTFMqvD{eE#m8=sQ`7kDol=pX$LHev-s|1<1;XA;RZUk`Y@0 z(g9^Tfq{UsZ^VqRIRGXyGQGkuEJ;xbsE=MrEC6Vv4q8z-YSCU1j`MX#K9&@y9}eVo zao+YDXOokDI_4H`_d-nqyE#heDo|MOB}Kvih$uGCE=q+z{ilre{-Y>#Ave@Nm0+4~ zcnAi%%y0Q0Bfe4Oz|lcOd_$14h5T;;6Y7%+|9k16ztXVYV<#@d{I@_0SCZob5d%XH zX8VVmfvy4hkBol`N@yw{521*V)&8UVlgd}Z{~DG-mJlkMbZ-ha6Z_#w{D?BFh@!ZvNR z)P>FqOb?1k?UWF72{ir{LDqs679KuuIcu@GpWajWy)aEbp=>ZI=3jZDKhQ2N9Hg_R ziJCE7xnvL31ZojRe@p3JtN*LMnxeaxo%=3k?mU8rfljaHOCs%Gcc%O?d+gJ9_Pl>v zwHfipLj&5XS$}<|3j_8bi#qmb*k98bDZp;PwwCn#>m>(#u*X{!KGRYD^70^uP4@UnA(94J zrDHT<-oh&%P7nc37cREjeb%r4)gLwYVCVaE!%O7mU8NGb3@W%??Ni#XUeBh#tJE>8 zZcj`LyL+7vG)xAvKN;bpqX*1dOy;Td3~lc0m=s!hi)TypZN0sUPfn|V9v+rpgf4us zIy(FhuRfRDyD&pRfkfDZs4pzZ*{=5=D5zRKF)=N@X-`e64L@P$;j-%Y(?9mBWv#ZL z|yy8XJojSg1XAD9O`Ie@Cj@k7Bi<-ZRSvY-} z)U+Er0(yAd4r=l;8Ht$FY;u&(qpNc`yT*5C zfkAyC!Y=zQ`Vyk3dKG?kFrSaxXun|;eVxODj?23BgkR?v0M*DZ*-aAQOGRY626m86 zM@(=D*K`lEGJ^N5C-ENRmn3e3A|J{2$48y8sP=6#wtxSGbsKXxf*mR#{?{6D1 zj~_mn$-fzNza9`83j6DG1x4W1?uh!A)~CDEl&7<`);yb3T9raMv+ ziOu~4M98R7F(~qOB6bKUJW1F(X}QMZyVD^eo0tz;wl0j=n<`8b9ocxYmHlOFWwp`0}+4HRj zJL_%f{1mtJtkf-4)YA}n1a8m1bwfeG%S0cxqDDihuY^7u=kVi3HNtyebwDj zM4yo~o6|TCMlu@dBw)R-Kv;$g>PSS7LrMScl{Y|1aMf+mtbogH1wO5-tA^$EJhz!f zKgK&DnPlDL-k*Xheb&5X@HYw1bHn%GJ_r=4#ds5t$3@EK2yxRb*-^U4_#^%`?ko9L zyhdKN_qm@|ko{aOK7)`}OtKVr(0A+k^3+SY1r&@}TJJT1rn;h~w)1!M$&=~Aupp)!svo(phAuj4ojd@9DW?k#V!tNd!`lb(H(V@f>|DI+bZm3^ruDLa zFkehrcK?yeT{qjTD&BrOX#Hg}%W55|&HcP*w{*6Db@V--({6YF<=`N>wM1LG(y6{g z-QexsVfL7YJT2+NfaozWsHB9>VaP^4aCZK(+~;YdZF;M4-s3Kn1|u42*%|s^z6!-@wTf2urD`Ci%N?PG!(#HM zX~n{vY3gS9#^!s{>D}rQK?}v$3jC8rub%mzvOAqWj<1>1e>C2e3hr}Tw#JH_L_R-U zh28J5bXZX|!()#Mkl3&}u^BZ+ z(x}s;q+%cCnhE*7*29fJKwss1&eCw!35SU!GYyOp^Bb*CiIA%oiG~(#rq&(C5DBm} zarmWK3uA1#?hGP-kkldtAg4qUryQGYe!_l+4oLPl~KJ|cu4l-zu- zznv?D4a!Q8;8+^?2}5PJ-F1h>8;p?-Spk~S{S4~y@Hq&Id{So&5^DdS89IoQs@Un6dXsGc8DA;m$S# z*so31Cfwnbr{71zZrT0s?jGT=-jbA z*`!qmCqYBT!R;D-{7InM#CMR##@IL|lXFNR+4hO({!%Pkuxo}2dgLw{5X~?@KgT@RZ0V9R1 z@u-I|IFbDwRi944{1Srd%0AHdRGX{j>jOr)UQ<>wk+Io??^5j^04P49W_)h95fkq! ztD|0FOT_*Csx`ZUV}Zqlj#+@Us#!dI_(7v&W3H9(o?b+ACYwEOp=9iT0rRzf9K?#PvO8BPa#IdLNoD&7G+mNiYVIMfVeJ1aLX_K8VPb2%9Do%p4do%%K zl|~)K2dimDa>lP7^1@XWi>F{-q#u7g1i$=uFG3iEO$?PwhRtJ>x^tK-Yuqep#QI%vMmo?wpp7c#Kd`@ya|01iS()G~d<6 z?blvQ@z1sz)39Hg8BGb=uf6hkFeekISS_6S8sl*9tQa&*EmHn?er;orzM56y!P3$M z7EX?H*x(4CU|{?pqNU>14BkBx@}4P`cUJ%b1zb*FBW!-ttB{F&oi9-e5>+A~LU3|v z2Rw0&rwX7N`0x>_7r&5AX^XsN=wd#W>ec;%+n%yaKykNQAD+H$a5u9k^VR0&x!gdl z0~*f!*mLS`f9qzwn16ya?PgchZ0D|h>;4!;A_9+lNK|y_v2TdWZ_t`PUMn4&jdsn1 z`c8OVSSAeB!bZ|hu1Fv>y6c0LdMlrHSP#2zTuPrT%uP{Ukt26+}W3pgvwyZVQ>$qJ&YC7>2 ziEc7rFFz%0uwK$Hmi>fvug-$0EY}is$#=?eNuJ;{B_vFf;}d;%6XJUyhZ9@pw-5GNhmKjQ4{9$Dt5l2n zwac^0Y*sVY*MxpI&VO``<8!82+P&a`S6|QRyX1&_C_X3bh)bBKePCvIrpexT)07f` z*Px`~hM|rSjydL(-L$KP(E|3hXCP1L@I1wWlvouTBBViL3Cf|N+^aHG}*3$qq+E;O$cUn zn;aA1$kyj3Vpe$W;q7L9%12cRvXHJ;$~=OINE5a**A=cwzaFo;gP6sUkA}2Yee4h7Dni< z+XD4wUdF3vKehkPeuR6rzhL7dKsT7QVJBX!viIr9(|fr$z;oK4^qnFw@d>Y-zJyyJ z$1qqi<1l?k%oWZmDBKEkwyRq0`f-$J=^6aJG2f?!xz2OWk9dw7^~tBj{&JU#ehk^F zWr_$%Afy-iYFTVs?H;^a{>7h&|Id~kKnhXGLgyOI{?Z`JT=RGPj{)9cr$SY8{`y;f z6c>dydn|MQ{~N&t)51$SmBd2HKcNIFR*03Z!w)2 zfm&pPBX&Vs%d{yo56AwnuZb}#GZueC5E0*?|HOT;{$Ggucv!-jUf%|`wOL0}ECA1P zKWCbk{~Ica1He_sJ-5oyK|n&P^OwQqoj3Zwy$Ya8e8gn@PekcH;GOjkCMt0;u`^27 zBWlMsahBWK*^K|#6;S^jy!W5|;!EH3*YeUR@CNl0jBefE$c>B+IBub!b6dE|@UP4Q zc5v`S9p7Q%Z^(?ymOLkr-F7a;sqC*=qklNey14}Y4e|WZfiPPC*v^8b4yHa$;3@DdWb5(+j*n?RW1efmR$M}@*iJycXXGHq!nF@}28kwB4! zGz8BU2mfn_d(ruFtvK)k$j%qORk>O%kt}klS?VyX&UCcSSyRUDS0ax*%L_?gW1p}qc?ObXEgSw$o#_iIFocdU*hMTR^ zlY;=fd;cEWK}6#}D$;fVjk7=88KSp&uqI@N3ko za%*L^%M`kp7+_XCm}|;o@o=ueahhK)ll#|8_W|s>urM4v%0~~0;LGlj^T28|hp`iA z9%Y`@aB8T-b0sF~9Ifa_Y}BW_P2d*I>GzdrMgezJWmJ6E68z)OWDd4OQD2>GNl23# z3pB6e4C}eg&e%M+;&ElKFR*# zcl2`gC9026Yl`9J8CdNWRP92-S?NF5oOfO7FYz0o%)N`dAYxLTU@fHZ9OaMwU|+BY zm3F8?Sp1NKgmUCABv>+JMO>&x__=(ik!z6hqcmigB|KLA8IydX%jd4`tpcIpoMgit zFAsDZPPsFz)r^U=96yczAX;{9>C#y#Z0o1XZcA?^|E1pyZ_FBLK7^;AUjieyx2lDj z+jH8*^8;GYCz^k4BwfaRls;zqyj*Uq$Uaq6F#;zo(qy;R8vqIGaJtNe#iWU*Rcjj1 z*0v|pXhy8YDf1&5kU|&zh%Y}t*?HG}yij>k;7aJ+*=9qt+a*W5+aHbzFyj3zc1e1B zagfea<9hsMJd-DuTd?17=?WVJOt*)gPAFC~n%NdX!^gLR27SDgQ5;v!68t{U|7J$` znn3y1@pOl%M-oOnBjEbTiSzm@aCfrwXUFODI>7e)bl!#GetX2VSnHa;nl6GGQCfF1 z*-LbJM)%sZ;U|4++){l^x5^YM)UncJFaN~nagoCnVf&c=`>s)CC7tIS*UEcLqr6+9 z?zB*4?E~dlDH9|tO8<1O_y;QhRk?l#0j+XYe&?yr+hUjBsQs0mi!G1Kulu6X zDrd;e^S_#0V&sltB0gOa70YUNcp+axBT8eS6;EXh)LV(bB}dInPYDmzpZm*v@gr*d z;AJ_L&f!0#l&M<#8#9pEKt7QvI;-kNYWx)MnavmG6=Wj&SCzs^Pu6Fdflb(_gqbNXM!)ke+I4!lVkAU z>KTmAB2Dd;v-&;VRGy(0Tzz=6z2=m~er?uopi>uGk}iKkbmskgn( zGeeUh5*qBob0HeCc+cTAu32xn1mWlB2a#O|f}fEeahPu=;IRvy5_yY4aD@#DMe1cv zJ8biwo*^9D{Gt0miyfrN*YB2ssARuFhbcK#gcTk^s!SLW^xk`zFR#hy1qMEy-wXpm z@D5M1Rb0#$@|ojNYbMd^U_Y zA&uOWguTlwjAa!`_?hpJf66tupN)*(wjS35X;usT=sDOE7RD==ZR*D~9z6YUY_n9m zb+tFf>kN!~uK5B_%Hweg7i_Tp&SU>FRJk(hB2VPp(4hHYhHT6>$g+7RY3(mwkS+`c$cl4JrHzrK*uf^@`2De;L(m zxAthce1ebO+9cbj30e{J;jyYUoa^vLy>u1;zY|E8-4DXlICbo2uC&T^nkGv`}HFYrJ{(wH*K6T`XJ$5e3;A>vA5-n#AQu>{;70NBII~;pqe{dH^kUWItwr01Qjh~ zZLaw31sv+dc=Ifkvu5QraI#M`&8Noux}xd3aC((a!`J9S|5vM^(w-?>K;B>!F|Cht`c7*n zhU@3;%r1xbK`jcu@3Ooru{&uiIQ275K${-2;nsQm$F8>eKJQrpqz2#zmf5BGWR-gU6Ys81SRrDn^IT(%74*bkhJdw1sb9diH_zL#NDgP^CVp4gG3 zfX~KHu_K}RWg`fPqd7Tbv)=avzOYTN9Z_RrN}JE9unu0!!Wr3@tiAh0QoC1}&5g18 zDW3Fc3iUN~2Pv?zu)9MOi#jDuzc@Mx!i%umk zq(uoK`}bwRbZrfd_HCV?FMoGGeR-Wpu<2%;k%0Z2E8=8E)uBqA* zvnl65{9G%HE=|eKMLp?`zgLrTwW#R%Ea7QdAjs>(vR4yu1!@_UfwzyZi%IHC^;1}i ztuE`S0)<|A?bYBiFRHxHxOl@eswwO7@%eJZ9KKMciF(;Ix+eO}!QdNCd<#VAS~;GG zcdGjJ(vj%w7#&V`q>L$-XJ6siYT+Lg_jOUto%^yCeCAc(UnV7pP?pe9+mMk?uk^NE zrFlu0UW)fh5rtX|Z&X!Z&=&|x`vq$`@K&?=2esuWf z45@s|Yk*drx!mHzHLirmi&S8xWTZtLwKEPoWAl2dFjIN>V!=}_VrOUP!OFef2cEU> zi<>-5CvY^%Sz?E4D)~~#T3rvf3((se4c55pzW2VnE-c>osNzcnffcDm;kxZ%`tu&E z%DaI`+?1R&E^7*dP9Ni5AeW;Z zZ6u!?vg+~VW^Zh$12EK=m*<+S*MfAgkeU|Fi8rX+`V2)ROmnPz5?jNRR(7xqA_KC#HLiL>!r#Jqqmy@LFnF2O?5h?G77!cK-KVRpdNCwD#e`TOjt*>{;&B8aHl z_NFcO=o#dUue=S(5hRh^p6O&&21+CL9;xo}BaH9%?Ig&i#|&sV#k5C_rg<)ZMDr$J z;qSFiIgE63`5zEbXFJwrWEA*eXTL#AOfF%w=*lpB1hQadFECOG%@~z0PW*g@bOMgb z3aqcPrEo%#oV28pJDjbs>U-Uek=YO4J zSQLenS!uLI%MjA6htCqaKYii`pKC@uKU{CkX&4kMa;|hkMvS0dPn~^WUqU9lgLduK zv{`RYg#vlGoGwEn;=ZzM*>^tBuv<)0aX77e^oivd4w08_BMC^R^LaLBY%DG*c49tdy8mg(LoZ_+3Wqs%nH!Bg_ z8_O0EN!sGFS!pFsV$eu*WEOs&xRRX=FXxb@EG#5Nocg2{66#+#iPXMm3hG0hJ;>}L zfrCSegP+6(pi$>ik9e_%I}!U_jl8R;vIP~UECb%HiLzCEs`>GodV&7@Tf56;t!j3` ztww&J4gs$W8=+?|FTf%hFvWwuc4 zvCh=2^_XC_pE?qZZD&Bq=1Q280PMMnhzIn;c8CV2UB86$0G_`>q+KKo7TQOT?PYvU z-5JGRH=Y;dy}D#hPI5&5iuv{can+&f@=4R(yRm?Gu~7$_IfV{4mm($(SId0pBw#|( zF!wJQ+?)YhejgvO$8Hwa1e4vl2Fqy>ZLZMREt|IVY!Ek?x6}%gZnr5)`-6xvu;X;>FcO6;7YP-AM zV0;5l2(c?{o=QggJUakwgDiu_88kb_FUNKAwe_9;S=Ns(%cSJ1JNhdO&{RC3vmyWB ztAIKn9R!FwoMz=DMt6+2_~c}~YC7n&Gdy*Se&TVj7ekaQh42KrNmQ)ivwBf0QR7YL zTH>;tmZ=1yPBq`3tW%oTb-lf=_}F9y=#Wk$TQ~#9tvqi=XtS4L;)|N1$35%wqcW2m z6B06#TdwgRysBHJRKUtH89Fy_^^}rrHO$sc2eEty2 z)V-utSF=8BV*Ty5=5`QH#P>03)yGC7q~a3{dSWtY-ZbVpCW~)#Bss*j4{2ZNeUp`Q z_?#BSmlBm8et5di5#|lMnthyzV>6RkTp$bE?3bRN9<_~jj^vkiao5$w%RpSu0Z09} z7hD=p3X9&dT$OH%lhjJ}u6>JU-^7ji>*d45-RG{4;?`K5Minu%7VYYd%A_U})%47` z4#bbJpbct5<=3l4Ej$ZjQl(gr-kGY6&}31buc3wGmh+&D#3$K#CN26Clq=xaSgfVq z6OPrjz;35#00c%ht>G7oYy&|*>B|IwKa*+2^YT-waJt?@>{AMTM#TfoHgK{Kk7%)7 z;}wD(dRr0X zID&JKX#P%9)&8Eufkz$`!id$LPK6{7CtL(DK#tcaiR(#bbYh9 z!uwJ-K&z3!hIK{N??DgGslT3ERj(VwgZKg1(+j(k5IgU+R6*H#vf&)h>2Ay$=}vRm zrBzNz5d0;Gwzz?pm522=Ql+TV1acd^1!b22XA5uS^Q#R)ahR^9ys(K(No|+%Oo}3g z6LFnC{~%EgTOMUR^X2Jf?fnq>wiwCIgkUny)igqdp-!O8^%0+J)r zbG~~pkij$RUS4evkke~-vRIS%;P|RAw6+$MwLUTRZhbfumV9=~YKauf6z=(R*%v^L zRJu5m3+R}hgybwQlS%tVz}JgOEEpGY3%sOrbV_72m?Rg*kP&ge<^Xja^MJOLv1(=PvWY1s;k2AabMT$a6bP-q z9WPNYW+`kB67;-+gD$c*HYT}cd%4@&f*Oy-w>!o)PIjpC^?f>(2)8#r558IP=nCVw*eG@4}F`l#3JP> zo9_JJlWTG4)g(BLvp!v3b#L_8C$R3F_-Y7DGM(6Q` zf&D@1nI&m^2W>wR=#-2f;$1veJr?>6AcPV2;5Y%!4p-Ek=5wTD%l zD5$`{#N?@4EU1uX{wmelc8F@grvx0gq020VbCWm`AFvrLNU);me{0W|pQ$mFZ@=;& z+&W%?tdmr6qX$33jw2(tYIa2fle<%N;afan2PvaIz-8#m>Iy^WM^59t!%TJRo8EPqYVuNoLKOMQ z>j*KYqC~*Y}KO;|95ka?-||{ z=)3qzH{lfCz%xc-^UhGLG-oQj#&kTiTYJp-mY|`N?-kjo*oX`G;MkdApO7F;Jebis zyKyqhe}zr@-rPq&eaH18^|w+)e9_qP4|c~VKLoGaBjz^tr`ux-<}$vL^h3qv$>+&l zUSBov@SP~L^~(Br>1EdCM>+$n2~p$b$ntE6wikAG+XI=e$Sb^UMT==z34x4*$YNNbrgl0>p}Yc71yaDQ;Xrg7OtgjA$$`W(0lW>!VOl@9Bu^13|W$(eC+ za>6`hUqDibl2BGy`|QQWC)G>nSMA((@FsOLUBcP$U$F|cpsYo7lR4h^nw%nM&ZgTdzOnL$`^6F3@;aqKsK+-ZhYuTw+2aw!!k3SHm52h$@pm^z{GC^k zQ9IXdEp6d6H#5?23D?oOG&mVmoy)Mq0&bju86b|M!l+o4cdQ++V(5@`6dw7ComH(m2}vMP{6veoNk;t@Z4COHcQQ5;s-(k;We;fcCgXa_h@l zZC4uAXoSDsfP-%8(;cps+t|gZROr@|*$Wzdc3BrOyZN=Q{IyAu&fDd0XA{=x5#|4^H-L_K%F3EVQKv}PSw$)^cuQ4ISxzSR% zXgz5Z2CTt5&)=_k{m+OdXEq+LZ=^MZVS0mHYk7a^Og*~<7kHuRAKbDZC6?0f8P0A7 zj2U@Y&!WxfDtsK*COr>3ue(%_ssxZKfB%BR&9d4YMq>RWuRAD1WJL=Fy=5k7glyS= zMo*Vr0W}JnB+*6dMZpiGu@d5Nh~kog#RuRW!;?Ty{lWIEDD)3rh z!2Xm_A--2pBxP2qg0VCp`M|I9nh>e-f`%bs+M+y0moMP?{oo^gC?N>rWBOI>`U|A{46nyxh(PZc zfn6yha0WYbrLe>rX1Twlq3^@J(z8aT#0+{Yqbb3t)nVM^4o4b~*iBjfif1e7r_nc)gJHWhuhWbnMjB5Do}ix7~3dIUBT{{y;0u z+Y~Ot?>`6}DFEzf`CekQGv2U-gy%YPJmSD7CYU0_Ni>pin`|f=RA{@hC(P$6@{=Oc zbo#jfqhWPvZ8zC%MK5WYS7sA}E0BS!M)p6x9PacTE8I8I>!+JPHa@Hrb#3r>d?c(q zi*xI!V7YFhXq@|i> zfCR~|Q)c-x^Pf$T0lg_yMZcM-b|Og)Uhgg+&^$y%yM>;qxI2V83LZWZ*wBm$IC>2A zq|B{-T$a*5S87bJXR`zH^6az13-6DgG!| z2GlmR);b%P_zV`a_Vx>$g#9+N_uUEmjDYfff>t%nd<(2MWwqd`L!&7tV3q-;^huK{?(M&OsduzX%V#Q>yg6Z>sYeM4z@kb?CJ!CcXWJRv_79fO`Q{KePAVFu^^7e~mSR+KdJGVu?328g*H=f@$ zDo90{$3A=1u~N6kVO%56+A^A8+98fT#KDw-PeuKhKCqcfZ%r4u@+-#iu&9sA=NW#ZK zRt=G=&G@}rAcZu0pPhj99EM!h%I7-id(q=84@qOi=AW?O+M-Z5sv& z6S?Q68+8_mmfw#Sk$%8nLkXR>c>6E`c?Gdl92-?GUHVrU#&%J$3nF;Q85B|pGOzfN z#0D|;)QAun^V#y7p{d$gol1}-`bQTta$JctigTXL4u~Rd_wzYR=Ns=SI2z6{7E*zT z9YL##$IJ0y-6WLflu?8!h4v7IbZwc0L`KPZM*AyOqGsX?{su+?y?mFwWz}^66+~@_ zC3@JF%kN&VlfYn#bXo9_7-AurHccCcxb*Ah=8{{fx6=|tSK-HdO%mUH!n4X*FT#7 z)%5fIIbb?k1PF7`mQO5e39^EdjHK$6T&-9M5FMEBd zC-y_F2yKUEJexNAn)sZ!z$|p&TM>X=N4b;Gb1|+o^i4);v_+tGSaX;GYvY>qtt5L( zX2WB8?E0l0H2m|Jf6BQYpNxtM)|Vqzr@moLo3F9njGW6^_+5H&sYCJ{X2ESh~S zC%;mSbil<3JEKBtk*pTA=&?jPNuKPM=pvQuLE4un)aXDyE3DDBwP?{IRwT*f2C>`PlHugU1N zm64~}c4NiSAKw>n3@ypZ;4s8xr*84t_v)uONP!GiCjNds@XC>lFl1ZYo&7+ox&* z#zJ-XNs2=6^$onmPYSWKV?1~CmZ}%8FD$SC#`yZBThT4IumYstfe~A=qSUQl(Lo6c zKHr3M`yRo18eo!G!Fmj#1W`kX)v2%ous(iUpbs+(b)eST(Nzb;Cv+e+#7KLUfD$WAG{&lymLf5xv7OLPa_edr%-ZR|An31+w5F4O%lf{Z=} z>~^eBO^&~rgfe4);9X-4#qEDd3V8nj!ibC~{w5oeG5>*gF)w6YRsIEpZU5nL4C8|Q z4gPraLqmj9T-ISHEUzfD-gpbJDBuBjh=$`^0w+iWg)%FR;C8Yc`6q1%oKNMnKmH!) zhkvDRap2X~C)vQ3&h@$-A;;!PAPWd`ic7=D6P4HMBB1k_3;9c0?ehTzTPVzeIdWDq z#Fg(7U_eqPjT!~%BE`Z?4x5LR`iYC-h#|R3JE+)tLG)XfNaHyO_Cw7Fk6NE4(<#OZ zjEu``2yhOd!*FM*Vpj15*D(*RwkCVWSPEr)0*!PhK09y0ONp?c*ESXc?(lK#fO<5* ztV{}DJ{GQ;27Df+AKv?wz~_9r?1NSqzmt%`Y2-y%MlupDkRNc5%nm&s@p-#5bT za>ts(Bv|0}4PRcWGtQ;ezveL3=*O(uUU(!xE z?I9)6JzN0?CvUK>Nk7PbK5Tk z2;S(eBw5eTelx(#TxlA3hK{UuxXcb~CHOAb;*>kZsMq6D-6no?QJ-2@V?3w*_*H`G z>q1FL6#k108`02{uK{MR-{yw+!JCmm_>@TgpdX~c22!3`jsJe75Xf%SC5=~C6sV9o zU1@9msZ1?CDEM{Nz_0Jfl~A&dnH4spTAYC zycOLZTVfS(R-qS><5V;|$1cnqEde!aZKx+Rgd)|bBX^?Lh1j;*N*ASyuEBYUmM^Ou zB{!ygBl~0MCh_S#9#B-PL z-}o-p?Q`unI+9>TYTwFwkg*8)cNylb(=S+2q!H|-of74>O7##k9S(6>iD1d__GVy|~JohU`e@$Sk zt2!S~=vBaU;s^d3e?tN<*RL;P`zZHcJurSMi0E1X3x?1~j(O~4gf6tJJIa)vqlq6{ z;ABw&!+ualp)B9fGp~* zJ{DfyVJ*&?1I-}6PBV`73m?RAop|mqzBeN(@kY0_0JuNK2AAm6X^DO`uVmMXAY$bai!fhQ_HV;Ov~`LP8?sbi8}I`nnJU><}_Shx;L; zKtZ{ANf79;&^=lQx?u7Er+#C4+>QEPo_)bbrJKoaE?A^>I%UG38Wg4d!@SQ($i<{z zJ}1)A(G`I#kL;5`5;#G}(8xhJe2(FQ?vo0xVewfKMZQO=NsA#cCU}90p^3?eg<I+(d2V098F8u+AGC&Fk3ZWqmMJ`%N4mv&Y1ey3F_4q3ZTvV5gnBwJ_ z_`<9#9RnSMjt)p5o8a9c_EwF-=Uv{Aeb6_(11JM(!4Q&69i1gv$Xh2GehEhsaQ_@| z@Lui?zrH-dW^l~T+Rw#bvH6zPR=;AZ6u*6Zux0rAYR3C+U)+6scw2vbd|WU?g zAV7D3f*7i49VT{n+=76BL7FP4IH*WUulxCzSlR&94FbaH!VY}2G<47< zaIv(ovS)YUBKk)TcHr}0uK`2^|H$HC&PAjmDMKJ&ZD&ZpOv^+|N5l4)vj6ta zO8#Fxf`<0`cBVECrq)&jf7Pq2XYJ^~MMU&hL;v&hPdN=;O#lCutnB~p7O;bWzfu77 zv~++!6>~5(`Y*-)O8IB8fAs60&2j!!8M}QR(SJ$$m!f}(!Y*xRY6#TQU%KE1HuoRz{?5+{_)Ag$qPTyK%0J!$ zhlLxC6YxJn%ne6#hvx}L^v1+k<*$cU=N&KmiC^?P1CcKW@BYEJ z2jkeNC=d{!e7wlWfBFhpgIQ~F^^YTymZI0|BLHBKdTI&(#t=P+{I5ljA;1W??w;?= zjlA`s!eT)FTh+k!e1{@^zDTrbwY#DJQYUQu@+S%Y77Hf8=gV39CEEWftQrhCK96j< z=nU5X(I_ZEj>l`rKr{l>f6tVM2R1TCb;2yJMhpW3=I28|@Taew3=VjN|Caby30Wl2 z>BmqvPf8lp|K2si940RVNx;`n|Gg$bE{FvCLzY|8lSYaELn2-#;jY!6d0!m70$xK8 z^!d^N|4ZsELNMhjja&}ri|NzF>JYt4jyvo&`ImO}QQMF$lu?eN;C9ry;r6yRa?v>A z1X4-0Xt<~e{cmkA2)HC~0}n*u4>^~=t8?xXg})duN#lI8T5Goc&EqmONlxgM_oNbY z0RO)<<>CWEdJoX*C}=R9kvUtkJ+r6gT8yiVe1Jtnghs+Git7(|o1!Ajz9o6MYBXP* zGqx+=lXk$vM#-I|gDcp4b;Va+)Db+Y&bd__(ms~0?o(&6mbu;=ep>$Q-!{cb=$WTQ zCLaF3r!M~&-;duLg-oTXx1nglnIhgoiItxoVtNQ2+^0Q{H#RmBzFVrbIA3JF^m$R_ zy)4xrD3FsTcrh!iUe>;6qP-sW#z&s-_GSNQ3z5^RX*oIUN?{&K!Y+!%g-s)9pkk}otw zyZ}cSMF`-c+d+pB%%cVip5V%zJk&1oH_i?a!^Y?Glmz!~mJomMz}~wCXm;>39@6Hd zvsgp^LXc+gV%;Tj%yP;4j?;W0`aOC^tK*G76a4U(!|5+!R}$MxWS8q#W=SnC{}nI$ zqz$ZlK;?@5Iv$UUG2+XbE`3sOhoYU(Kl)9C1opj77+cKbS~$vb1&T0Oc<(F9JM*W| z+FJJqtLuGyAqA0y;FUm!O;)N&{LrDsL)Z!I?-n@^8>hVID~>sL*xxA~V!gpHItO(r zJ-B*$5uK$^tZ|gf;;zZWzHQ+$8cDQo86;SlI9RS-iA$Tl2dyg5iE~nB&}fD9UTzIj zr8T{OUvGJcdsikkjTzajamB7wZ3$iQ|YQtWf9L8K+*1?^prm|Qi(#ToI<;r zqT6YuPy(GUQKwyHVlZrWC7vvGJH8?co+tL2J(Q!xQAft>y25<1z0qWth9|bhRu5a} zyjS{1FMk@RDOkLnb&2LnltN^+riTBGw@TOcF1o5Q!s44*<13vwerR>A4IX9e$?b-X z+-F|%2ICQttDQhjdh|rw@Da<_ zn@jY@m-`H}oiQ!dQYTn*h;?(XU-w;%2L2RI*#wKu=vU@xnCQRSArUX(GKcoL70u?xl}w?FTBuO{VXjoI z@B-6oQ0o~SC59~`xg@c#+fSa&uwNp7Sap8`&}@l-`%EpN{?n>HyYp&QvP5eA`Ci}n zE}hx@yXET7al1EYL>!A>?NKKeaQMN;T$uDMRvQI~nJsen8c!wzW2*NV1RiNk76OGM z3OT5Sqq3(z&yOe8b6P2DzML75k?Z#^-9O!YSrXS8Q`4Pzo(LfciSO{_Db(v1mrE?0 zKR$O(o3ZYEx4I|?hen#YHDx@S&KFJ^VO$s-d5SzfPi(5G_voiATfC&9RPSIwr`Z+& zck%eT9y?dH%6multnh&WP&Lann2dLsvF;82REWiFE?>Fgm|D_k`VLaO-5V@Bp62-4 zqk029zr_P55CwguUZaCTsZtWsVpQ9I#A1AlSfh%m(R#D zv(w{{tl4VSH*{L1u&~5i*~L}hoZ%u@jSC_L+h{JKgZaUa=L25ka7NIpOP~{;yT~O)0*k&znG!KdV_BSEBbx=Of+ksJF}N|lJT$lR&jwqQnL2ET z+a5HrOeT!Rl7tLylN7a5trd9Yvx;@+Y$!nUn6|gx)Pk(*5J!>Z%QX0N!{Kg&Y}$3V5>6b z$K;`AQTqoskx38n4!w^T-W&s0q1cW!nBy*Oak_V)t#`>xu9V>oNx}9-QB%6u`P&2i zU5cGnruTI5a^eTs*2qP)0)w&#)*@T{I`#PMPujIt{BaG>_z7F@euF9!>j4+00!cT@ zSVk|OAYBceF}%*(fUI_x{O1zO#=W_AFSD@mlpdbRi`9#z8-$&Xubq4Bch*Tsl;{!$ zNGul-Pj6V2Yo3#MoF3DPX)V{Jcjj?PWf)R|0GEj9*K@4O%l7gChN@UF56e&c?0y7( zU40cZ#bhqO7Fd{C1cdM&oK0vRly@HKhn+RJ-IphvoNzovzCE@L(sC<``j|%Mg_cUr zfBsCSgiyx4McnknJWrLF0M#U63^*8TG@diN{p!fsAPH5b$VvZ;a&-AF60D*@KHH_c zXqCzQQ?%~y`n9h+GOH&P6nr=U#}CnTY782@1bMQ=%D=r%a0m-D$}Gxf(}`A&jT+l; zzD&M8TTkar+7z-q0V_h`GsZ)_g|~=iB!spD}ol+ij{86iNeYF{>(}v30JZm zf?Dk!qV%q%SDGCil;c_psHF;}L|k64DNE(>2E)`gmUqfwSo}5lyCTpEaM` zXD)!>swBG;{+_uZ6ELc&yto9?QN;T`mc^E-Hy9?Vxp^Vl&ix$VWVO0iClQK(4bi5v zLn5S=3;vzS%a6!%AVb#69(CX*FQ_nn#`69P<9+n$oY|PFyKPE|CEG18TXi5(e4Xpl z!T9x|wsYykRy=2{a&j$K`^K+HK~xw&b&Vp~7`$!c)IJ|huX{DzXgx49FzFUT0#shG zyDYERckXwQz|@be22HZ;V#C(oanipb=Bk41XP{j@AAT1%+wRtw=^5F}o?!NY;N1FA zgC2v+L3xE2RWyq>rY3;0f%9R8l;XP(t?ItAt$07z5~0&>ct{aIaKFFji5(sxy3oG)y_{2Re2;DZHQVnkt1*BL5N^E z$jXaBa}(VsxbIO(B<$rsa(peJ&V~|8t+zKcWB*=u2WHI z06phcfo_b(>}<$Z?mzED#6x$%^HA45>4X1#na)#P+LH6}`U_htFFF1uNj~^@Nt?8(wVuIOr8A-nWP_v1n$>5oTgM-2(Y@R_pIG0aN zmaA1!O&3e0QPH?ORZ-#$u>me7V2-CNnIj1_(w@&A{8R6|E~847itHu`jTXydnTP#1 zhfKbr0V9d!l#xNOXrwdi?yt6iv*u6xi<>1vk!o}I?M}B3+7*^QFi}W}mE5K2=c)C^ zr5ei&4L0u?AQZ9>g`-JSAEJ^QRubds%(8+#fQnDxe$)zm;M6(oGrr7iZg=l7MK!6L zNbnd?Wiv=;EJh=9rgP{`5LI}m&_}&E}-TQ0r zsTIqR$1{ag+nAn>j-yH^E9ai1sH3vk($6z|CYd&mWs2n`R_#y$H~i&>?`==M6Nh!x zwnXrDfz{!N=PNVG+6V;<+=Zp~gNT%0UbXnLZd3w-q{PyKX&;# zbKhK3_Iwd=Scjsb7lg!MN{bre;WzXRN$r9v_ayjXg*OW6nAHHCch_ZtWv5*(bL0sn4 zg=4=~NY&|P3%Np+>CV*7g8>cb<}Hmb^O+g!lZGh-zoI1cW5$~}A{1UMiSyVWcUQ@k zv*i^>>0c#y`M9sdgWoP%jElhIZ)RCC8Fpk)sKHhAhp44p@5*a&8Oz@1i9Zho`%8>q z_G_wtu-&A1ZRjzodxX<>t3283NR6Zo6h+<*SA>^+B9N}>!GYMte)|>3T(LosEfHvG zM1+QAs{K<;y7P9js^{_$o_pg_(W>llfbXW{{;NXvX#}`>f&3Fz?W`?wASQOq!)bBe z8`{n61-KpgIYof)SinNMtdI4$Ua08+w5rL*;QRO40j7aB0EU)q@G$B?fq*>RRH|yA z3Ed*Dr?Zdpyg#^uNhu!_eG%g0B%F47kzB0B6$Od8tty51A+uHGPc+Br0NRsqbC20Y z*Am!=z=2_vsxuTK^#(PwWX}^^k^>uG}=Ty-X8E9Js&g+_w9ovkCE`X^LFS_UM?nZpKoU;Vbb{9 z-5>Jug`=m3V)I$E8fD9sm5=KTN5z=S7G+-S56AOUEl3jq)>>vuHNGp^gJ|BKUJ`xY zuUEoln&lYT7oR_UWtZ5Wy(-yMAf=$Qr5WS7!GH*od|ll=Spw9qeiF$xl_!;*F#!F7 z^J|Q1h#zk6VR2*rQM1+RrR(^oO*EQ{Id+ZT0rXf<#R#3$OXtU%Gzm*oJ8;=fJ>480 zdoDD9xcabdxSwz2ul=%@KNw4;06dTt*zJ#;JR(MidvVfk-3vsASI;+ZAsHayPZx?O zo7^7JbA|%SM|ib%pEU5lEwt~A#rktU*L*P#A1sheZ<>nH{YDOI{%yWeUfpnDDe&?4 zisZccJV}b@Tiem13^7{81NI4XaAO(oJGJh$6|#1x8~lv%caHtvTlcTX1I1bZC^qW(Uu<<6n1Cn#40YD8P!ba@KJ`B8(O-a~`Xbo9bu)^R3l7tB(VSreQXFL1*^c5# zOEpH;s!>5T{~6Jma*6jE12!fmAEbtQr|ddYo$d-4LFfY2{=J3}SYDIHuI<`|J=xgT zV�Mxs35Gf@~J)K{X2F`FF?#Qt$z_wMKNyV4bxnJx0C=fe7pr72QA@WO6#(fZ?o# zYv0mbEkndTwCg-v>D00M)as}7F2f!4X*{nat|!X^VGA8cLJUZo&qP6qSj0x^ixXJ7>q=pF=J55zl#56X8knCL}Jm ziy_~_*!dZaA=3*%jgj?Q)|3=2-gFD8HH&P`8#AZ;X8gQn79UwGPJ+!<9^$3GssDX7 zHweSq35j2q!&B{``AENawxj_zQ_2ZSWU>F%XpvH>uzxfu_Z5dzcL3sv!2Gw#+uJ?v z%2gOY&lJzgL%EHKcUL#S1FTZ5k-rey)c$S7F|8kMA-!n{A5oe%cUrzghVW#nw!Q2F z-TXsleAr9Pt6b0G$ekn>w9RF`BJTrHWvDL}ljD9LR@=<>m;EJ``F% zEmTccB2rlkKA)Aex;2)WX}<^XfNh)*1!WRyj}Z}u^U8RPJ6vA&M(mSN>QaF8 zW0yQJ`X;F06VB86a3){dAI45*dy*{1?`gc;prxZ0h|eUN^LEAk5+J%Ge0enM12R>B z)H70lAB|x-P!#Q7A6WhMTP@@V4}n+C4}A>DXCDX5fp@2fnLtl8(|Q8^$J%4aVs3W4p zO#)AlS(@FH3bPWj0fZrZDlmL*?KeAS8M())ZaA%py%`$pY1wXGJtCSa8f2ardF3o9 z02CO0@kEU1}+a~9+I#u$LS#=^B|)vH8qW^;#mEe1-}7i1oSweL8W z+9-Lk(UEKQa!FOmf2}hX)m>ruhO`D9iTqAJk+8qRDk{8P)=m{nK}loTHNHe#=N8K5dbqAMS@ZCrfvn(B#1-e{ z{RpoEq;s_q&1sd%uNE=;-ZC0_NK+|S$))j;e*xns_jy#rQG;w$Nf*wpHmXd^i1_xl z6AMj@6vg+>o5j8VfYRxbDS^U?!)kfrkXQt~f;N*Y+Z{j7#4R7|evD@-J%-Hor~ylUaAW!cvI3?27oQFZ4T;r5bOY#A2yr`hvtWuY80(8#%rjLGNYU})u&W8`@^Ydp0~b^bjp(2yir;8&evJvF&Iu-t@=P;ZI4|3K+9#E3?vkbPTEc$1M_*a^-6CNx_irrPFiEh~a z^xPY-RDGJT52-IKz0$HzV)CrkJm5*IW*8sEz%B!Cl)Z~Bps zMhCCXO@;P{6>t5nvJ)MAagC>u7J`hZi5})Kw4k0ItgRqv2@IL{EB6LOSiix1S=TY$ z#0xAMvr?b)q*r5vyWiux8peT#$>i^=rvy^86?k6?I0>~dFPnt7jz@D^0$RScl%*v| zR|o8@dU;Lhy+%fv=9uPMFfB$Kqcf>3ssrr%a=p(cO+LsBA5+x;OmP~U=2M9XVw~qL z^3Wye1dK;&1~CgBPLzWajIFB5Xq8?_unhacX!DQmGh{W!$6P$Xr$d(HQn;E+GI}&m zqY9ghG3nI-Rg`Bp5d$oIp|-I{Ui)G4-xHc)qDzgv_EZe8Pc~99c9;47r^@2uJe7FJ zwu`^pbiju0(NWb{R$N=>>l{+ufa_wQe1&ste6Yo08SbC)GghH4r_DX<)7O+n&voIJ zu0fkMxNG6j6ng#RcmJ0&w0z=plL~{#j6|{c-S;iuQi^v0;S`SMg;-EHttz)Sgj_Ry|rz4iux#dWXV zGKpAO`}**K#jKDf{%$gy zxhnLWgJXOgi$RRnPoMZ++>jDKb~U7d34vhk2~_gMcog+Lny+$b z-Y~1DtH(!5DS{9lxjK=pU!pG3+uUuqwRR#Oi`PlXWQ%wAuHaztNkiwV;pm9*fs%8gDVy$PYIB(XBpkA0nU5}GNvQu9k&|HN8aI$NJwpTyDz3r?Ht zEo0$PA^-2N1AR~Fg!!;Vql4eSq;DQy)jQZo^_Uq)?PX%bYN2qH4%MbIm8pADzT3=!&U$7sc%t(ur}JkdiZ!nFni?BR)sGZIJ&T@dq*r#! zE$;5-KsG!WT$4GUm;fW>1}_KPn&%AJiUdQ6XwUNVfTv816i|MBI52x&Mj`f0i@y;E z8Q*l$-JS+HID&)*r*Z{MF1G+K^Ho$MeCC~Ao)j$733T4z-C)_2A^rrG^JR)}MNYn> z0IjxWxPYgmabx6IB#xm>2E#D8U?Y&dW5(5+kLmnD3)G$R5JL3r2QvMEh}$n5CP53l ziIj>kSlsYSrGTMQFi5!T>$zT6*ORofh@Wlr>9d~pFRitv$+aj4F3y8e(gyTk0sPmAxYe4ZUP8#EsJIz-1aKkQkzzh0!G)e6jzuR*v-Oa?&YO*)F-<>En_CL}UFAiSq z^ymKw$Dru3-s+l!b@hJQS5B-B+dNUBkY5=q_If@xUf^~QZfwwqhSx;eRmzqQ{>8Cy zoMD+u!C?9Pa5j2?z`<%Ifw3Cc53( zyxG%TqKf0iQh747nF5OR=ubJz_C`0ts@Ax;N3RF3_W^us!zsf>?MNTuf$-=GUY;1# zud<0oOtlDlS8+5D$d`Vz)tE+&vB=~qVLHLJ>npAZ;6qR;p*nYDG=?tyv?h|gTU7nz zJWp)%^ST7V1SuNqaR^=oC`$GWa7jCeQC*7?{0nW5`}JpHH~ItsbwslH34@Dwf66ii z(N*}+dItgTHvU9c*YhInY$Y_ql(f4olAT73=w%PseVs-k2_3!&T@o4^f?^!eB8A%X z?oIk!2pt8_S7w>!7sRV)i8>OzIFJ zP?a`�=@aG8FaFi$K9BLCnUxuv$9_4VCnDKgus#SNNW#4D}@~@ILDw;!;k(q&(+l zi``IKtL4-NzVq?Cbs@HG!^50UAGlmP7DAT$v8fkI727sd4v=ahv%)QwM|3w$0OKqQ ztOIB`RM5g$pWc)s6;rA#$%Q-7)k`R?P;HT2E2b$yYOe)f5NlVVVW~+m&AW}oX^TWktfgHuj zT4DUTdTq8l%*XwT7?D>8BqWlvOQ}nzyvll4VxTIN=XzC5#4zf^pxh&!6E_s!->MkGnXc_MoKdc;NB1=6v+?)A2f+Cu!?!rz@_Bd7kB>l ze6RbdK7KA&Ub!*hg~Ph@hd=ZunIF8Z#%D*>iQh#BC)Q2w*PhIN{FK67QRfO2KIXJ6 zmf|tl(sB3RW_MbU7Kt{8-0}WYiXFsWrBKSiarj&6vLC|lk(~n{pUdcTdK-Q1PO|h} z`V(LEf5q3ZMMy^1gr!4G}|#e0{yIWz;vxe$4WaSdHRT zAf;6~QH3Y9vUk~W3-cWPyyw6X#jQ|8Lg#7w(@eo>fyfu?lad+bK#|=1^5iJg`%ZQ8 zk3~ahM|iR}v{s|M2UkY`wQjqogI1$h>@UvE^%rub3Y7$!@NwEToa*SC+5@y#T;DPB znVXPndxr$F5`wQ&??@kq)#v`4Fuif>k6$6<-5$4Xi9^7R2#9igeeng;lh{UfO;xb8 z`ptk>Z^!M{lVvv!nBGxI2qVV}jSEXssU;);l&BWPGv~D`3cs8D%1rasjNGstjhRVOu5Sd)vIX=9 z;30a7Cy;l?UzLSjiuUbAV;Jx2UpMORx~+y@@lPH;+}|6W!+h6gXxkc$LJL*~OY5S7 z2WeCBco&&^=e9D=?8aQIM2?&*k069M8op)tZVR;lEJUr^azg;pnP{Fw>AqW=Tl9gu10j z6^e#G7~p;O@`N=`0HqsHDLm#lKTd^K^Yu)+wo!P6^*5|cr zRPhbGZ?`MYL0=A~GyF^)uE-g)SEzIx%j8k>mtErN*W@@7aia*tM9+y7! zVxu#Tp`{Cttvc?I2L&8W{YLZoEw3^@=U*Gu+U;@y4aNIn&r|=>iwAWXW=b4&Y`F#x)1Oi;*Ezj(pV{gA*K1Y zYS;kyT2-%mMc>ArvKWA(?Rr$11RwR-pHCDx=QRa~Txh1-GH zqlAFK*om<04KpIp$@PUWm1Wz4k03K7?8F;YS`FpQJT1r@E8VGa+NNP2@1yi!(4A-7 zjE^>18S&|(mV4Br!$aqxZ`IPN@-?<1Jc%xJZfA6t*)p}Vt6}mJ09Jb!;` zThW&Zg}?{R*T(-=yBmVQP~_-fl+x4%5EaszSfO5K$Jr58w^(7Ij1Ft*IgaaVV(VZo zc65qJ^t`<6s$0;dAd`9*2M_j;YU_&c=%OPHFLFrK7!x0?XM4t0XW9kT}+z zC2DavWh<1#7|pJzwJ92H(k7RK?~@aZ50*H{ktBddv)AT8i^0NVIaVF*JIh&8&5D5w zKE_D$mmcX$wRL0`-q(L!_k4_FD2_toUG2}nFwDEq=eWW(kh=JdX{f8}5|O(X%5Qwe zv$wx(E4j1cI0vnA-R@GIALax0{0NlX>c*~I&LorzM z2H+eCJ~>B?m;3*ZqXXj0_41zk3JJGFw(BNGyXpg>WOK>tu?Lg*KyeK6R)fUua)b=1 z&YYYH&A(X+5%CO~i1PyXJ$g-x5P91d)mCjm&UejIXR#(9r;2&rxV*YK_|yPSha>10 z&O7pXcv$4|=o%-Gu#(ExDd^kGpe)|`<+5x>JzWJkI^Ire@_e*v7&^t?^l`3lTyP_5 zMVR7Q#J*`Z`#?=d9nuY%iD5GuGA!Hjww(*iXR8K`xYir}SJkinRSjiOwUmX;R%@tt|PsYpPjDRHUFY0*!^QyI+|uCFu2g`>(s#J%;?13t6C=H9yalG(8g!zkj5l&Vl%Msr z^}y8wI@le3;zxY{fn$lq1g+m`!+|~<+uA{?X&7?+y!KQ0{x!C|>D3&2+4iB~{hcPc zy(G+sr9-Ms?@(Ok0|izU;(C8rw6RPnC!g&7)3V>M24MJ7UPB9&onfSvCOycdak~iy z>odiYbyx@ivMh?v_l02VLc$6udrRN15V-MT6~Fqb<5>>!8=Nz0Tus+*64`tI z>J%4;i}YzqPEL;D#)?GV@VoWhGX^6sAR()sAlZoqA)O)e;}sMJdG~r|8i2z_5vYm7 z6u~2OBNFl!q50oXWeDFXULV{bVX4a4DG-5?&;JGxuOLE>=gHyryjL)FGLZybUSZPY zM};nbLrFWLj98R7Ok7q0FFCj**z|!J@io>UWlMt!aY!wpaR4Gy$5L&v8 zEUy>oT%NkRO|uU)HR*>etmZGLm2F(Z1fE>o?JwTJSH&P?8xv<}{|(Me@EMuad7Ehc z{o;Fd!Vtdv6MjdTeqP|b?;fkcrAQos7Wr+)9Z~Kv_zan3TEhaP?Z^@5_ny|tDcKq8 zg$uszb#1C+q_g#2=6*)gIaj5ktCYpA^fpYf2v>hhef24 zX>!{=f&S_VdtV@cyl+LgAW8loOJTSyz@U??cT0=fy_%&1b%r(P&JB&3=zbSd}}7NT_tCu;gpHOQC4| zfE~9eIgE>+&qKL#bx88vHF0zS`oG!lzq^!21BQghnZxDoG&@5gKD_9x9Ai6_NcDx; zwHOwiR*rbcP(+BY3m0s|<_xD7{y>ZWy%}75=a1$s4*)iq%~PyD7&TpIC~msm;^^== zMdtUsH@TFX9{p1)!1NNp(}p6qCPAaJ_z39k{m53?pr@fSMDP{v?> zTb#;&H2>EozSST8#o>BSbm3A}$b7M?P#_p_1_%`a%Y-{n0|u>gpYO2AwYdV}zZCTb zBh7Yxyo;~?wEUES2RbC52LV*DwGe^4dL>&f!?<-u33f&oF zq69`Kjy%3XJ^mka%r_(uWUPr+yFS=kULl2AxgR50T+puW<;?L4@j3&Fm1@k-FV&g1huPjxCPq7bp`}pi{`2M9*+5<* zHh~l(P_2TzPmd@wWK4ufb$?t9L_}cHS)4`Q?`*u{$+WqV*eo;C--L0V4}E8iSoN%y zN>CK5wfwISC#A1;2c4G+G=AAp+*EtMJj}W}K~xsHgrd%6C|~*g1l|}SC&9SDAEPDN zjQ;vpL-aq}W)C(ft7#A*3!N%yR_*&ayUiBJ`Y(GjnMOM8iEb*J?t*fsbM_HIsvlvW zeP_Oc@AQWYqf;sstTdX$Qu{!vc> zlpX4yZ6N^ya#z~}aJy>oT4z`5_VV!X^gM=pxw9oUohd3jvG@r&TLEOf$PGk%rD+uz zPM|=WuaXaTI)6@|$YASz_c4Ym5Hq0BZE?r5*T-YRjg7-O|}8(vSky0hTz8nQYv9h1q(Ua} zVUTj=Y(qw>6o*RH_O$zt8>F{Golr*wCiVL>g(fM@GWjM%bbyv0?+S$SmK=%mZ_WfN z<=-Gw-jGci!vGkUFrX*U&Hvk)bDZM%kE(+3g$e1pJ6%k4Ldsydcz&^NakSHcc_`! z@;9wFFd7FT}0aMaX{p}1>*)t$rRC868vqb&h(&bWMy4xian4&i)-VmKT+ zrC=y330#5{7=&+0fY0M&s8~CNB??3y2$+f%qh^bPY!1l`1Ru}=tw~lU?lvRO600j1 zUQ*_#m#!Ce<0I%Hw7EHuZ0TJD`H7qotm9EEmdMaE&s?Se#L7jQQJj~|;F$^^5r9}` z-5gF#k0_R#0Ha_H))!hpk0Gfy-f%cB&}^}4+{@!c7U+LaNTx9%&Wh#`AkQOT3i)re zp&;?dR_f=gyK8lLl%6?RueJREhAL#nrBmoo3J;QNfxLkquEu62AHYM+QGa-{SmOLV z^CvR<#~Bo=B$oatT(Y&A?(iGPpN&H6_Vs3#bq2#Q1(VbIg8`4BI$vsBJ#yVpbP>Ml z^5fEbSzU8&`EGI%plpKE5rW5tkSPA}3kDI%KAA6b)qo+jn%1PF=uSR5oXlPw|77zC zSh;#Cx{fyS4xx{t&*x?P;NdKF77E1?g#;#5IZD~K=CZR-UQyc}_Loz9=*bbgyiol> zd$q$XWJU}lC<|c|X|>T1ngr0UN;2i~esAkdDiVqHqf{*G^YXxwdAdf2frxqBu!Tv4 z5R!$MORvFn`_aA;2>k-IdsK1&{Q-pTtlO=?yUBj>QXwEu2N>LhfyC5mk;-B(TnS08 zJ6o$D(-w^sVO@@1eqfL4bDitcleu(vnJ635m#aFUX#^_j%NY_LfwNqCpKjtd|scfDeR^(@mF4eb|!znd|~{GsNOOyR;1rRI$3Q3kn$w7TqhK9ia9Brf|Ua6sv!Wh_S-L)@*U8F zNMAZpTRl9V^oM(SH6ijE=+e0}IPa?8^uy>;xGNqLXblnIX1M8|_8&<0zdgC5a`diC z;6wc-2=Y(`^!IMA&%{k{4#pi`AL;L`%qIdKL{08>TA`)bYw|_@-NRMU5#_r_-y$Wot={5&F*Tac7zhZP!9V^N zKx_u1Gq)$RT|;}RjmG_Qakk8963v-z*6*!C$F8n!kNPp(+z|Xq!Z-?jQY}h)WgnyM za_k-;-KUT=&?WXqiYgwbiwJJZT@iPCt9>p8D|ox; zfxR_xCfIRz2Z5+1LpEfcgY1_E7aYda-dVJQi*bNIz6h>urIjCdP^YS^Pr3Y zM2E3^+_KWBc7$CYj!X83FN;XoXB~NPIu78hG#k2uz|PE``DC2yJ-16 z{+fIkkUC#c89!iJKW02Un%So^<7AcGBLXX!1j4K}3Tk2%*(Fst(EIy_QAB-TZjvh1 zOC3sQUM)m0OWuX*q=h>ce~|$p_bF}lS2S`CW!^o2LI5&)NnHbuH>C_6O1BY#=qH3F9_u1uk- zq+_pgvpE&&6CS^_DtOW0%Q}&izrQM4n~yIhT|D=}7f?wUzVrglbhK1S?px)hp#e{R zG=X?-g4du3OmUam0N_nk#LA60Q%4^E)Ih2|#?;EE^m%$M*7T0`5Ujb%!YEn95qRw5xs%ZAK^Y!Wx$I+VbaDJgg<2LR?8Y2@+rWUG9>+IFm(4M|RD>j+7 z4nMBv>opk(n1-nTc|=`*_#wiz_x|bCy}DQRdFs?TRds6bT|`S) zZyKuh8;ERIZ@FAH>zib)hl3vg|H}f!)EYb?g27wm7*W(ilchAlX3*xH!Vhkim&DUb zE4ibFjpA}zWd&nUQjys9TV831nlNlMoh9_d^q9t2^K`Y&i^+DmRY1B2d(qsL-t!VB zLvl4Dj^!(A=>0qK`A&n+nuvZhCvar@wmGOOo|9KLx3BG=I<;qzzq63@d_i6D)Zqd= zYH_9J1YxE^N8<=&EQ+rhhjH^+CU!h+50AjO1WErMW9(pnIC(Rt88PP+!gY9HPbXFX zp8fjZZ5+RcD({z5bOo5*Gl5N+L%9ATnlwlgEw=rEx5NF#C>vGTKI!sB&=w!)uH0uS zAwe3%aMkX8MKbcRZce|eCL01m^UFT@@Uc-C;4>F!91fYE{1yn>UL=zNmag$rJD!Jq zXr-r)Z)y zm`;kYLlS1JxyBoEzZLK6Lm`1+#dMj%v9x^H*@oH-JwXviEFp!Fe!Q*S8*uA*^?0?% z0hYwwbg6!zRiTP8O^s8u)HLMhWU$sJ>uB6}awePJD%ZOf8h_@_ZgHnaE zf%e^fXOO7U=+#yi%xKow?1F5?tWBXGtea#bR{eQYdd!fY#^U&6n`^q=%Hx=A<{!sp z+rDskr0O}*!3!cLx-vLqI#w2+LG*iKh58OZHb@{(o|sj6>^NOrK$%>A0IYbMfkiGT zDs#)AR^#?q*h_HEQDUeUqfP@mI9Wr?oL7np73P0LTFMvGBXC_Ce&@*doS#D{g6927$flJYU3=2>k6qxLppQpnObUs0){wZ&kRQxET3U^{5;+|E(xjg$f* z`xS<50yyH0YPVs&V3s5i{2N#afH!fQ@5VtPk{U2th8j-z*mSYlgk0ck zMJZh1ocm4bYpxZqtK29rm)ro<^S5*&UJm2Yl>`$gj7AnZ$(7X0V|Z1`#%;VDNCIpH ziX>tJp1vi5xR#Sx+t(oWw2@sW+Aie282tdJRs9Cz7f?gnTIgoFfSW&9;lZGdsL(XH zlj18_K0_qaXHw3%;AaL5@Pnut8&`?K6sgLquo{2ul_=qcmb%Qvb(If~YL)`r}tV`95s z6DK4L-MzC|BfMz7T6(siJ@dLyzrBTE?_#R!)|HKk9hpQBeJGKO>7i{X@y>_0!}#Ez zRaDo(Y%v*ayVlr^ziYgcLS8y zJj!*Bs828nsCW;8roeHOGL!voeCv>x+g-YbJ@q544>ZR+=P+eX6F=C<=SnL zgdgtG&#Me6f)FnNDXAryrpi9WEI@FA4zFvn%!k9|+8g{u38(#0v}$HkY;ODdh|ea{ zT#pBX1gBdHBImH#qY|W4ohM^?zqRM8=3mUVQxdx8Wvi=P1Aa1@{Pc!#r(JOrOOmg_ zSBpR=rcVqF97r)bSt{KPGT%ffAUy4ycw9;NHjU_(zWp+Z{&VCP>@V*qs-M?fBYMZV z_hJ5-UeF`-xXTTL($1skN9)s?cu{*#s-8SsGRN57-fM zY9L)(x{I1m<#~0LJk+!BxZb-XAd^ky z<#;&VWV#H(UICR}ZEiz2^E)@o{ze1#nz>$qBHJClZS>t0eO6-AE6zWAJAxU!%6l8#-MIhni< zMF>0z@)_5^-6j^Wt8R-rj9(*5qI$iJZU}c-c$cT}y`Xmu0louplf=#t#G}s4`QurZ zrO}C}jG)r%Nc8A}N)%o&1H@I!i2b?jZuy>l^GzW%?9u}{>J1_0IiKP7$l(BpVY?%v z%cnyT^pr{(r@IjEv~&(1Vb_tA7U7j#mWsDcw_-0dR&d;IytGUR=1>QxZ=T29Z1Avq zWHSH!+)^++_k+v#ed7p7>Ps8II_a3E6@YUh85eJp#Ckks@RU}(AR~;ar=S}V&u_Uy z-EIF44~Kl~Hq?6R?EbTOm1;E{IR5B4>^{TPdvG@%V-n;g;sn7CQWCjj7?ycabqx~y zEuzceB^Bd5ABA<}Q#+O1f$0hyBe7d;N#9xZpzB^MD<>H3eNdJSz*5l0#`dqk#MpdiX)WsDi#L8F=YWN5t+koEKG*0`}Fdx09pL zr^uD^$Z7*?O80#m^9=zX<$%oV7nSm!eJxa{SA_>sL@-KRRS-ea%|kLV&~nh#a=?1QhGMtPH0zG>=3<7( z6~s#ME#WND%p$;DwLXJ%Z{zH%?u%O3>8F>mhysLJw@9nRCVfilp>Ux%W)V@(N(HC7 z{p8W$@}`d_AH`RtTC%CDY<}r-EOhk1yM7J5)wQ+2_vW)I(&r#olwlFPgG`I17rw?r zI>km#eahj-;Pu$Ab-Y7|ibQvzzMy5pb}?GV_BPA{NnwHVDl}U0>+M$cUwL@k%B>~W z?9zhZD#>of!jCC(Mbv&IkNF$IfsJ#0~aA2~Axw_O6pOP=u z=T!`(_CzTU*O8aD26S{z8&ul8SviZjEeyXc$582|`!eDQFt>&FMN*Vj7r&Qx6z=LE z#mGAoLc>zql)Q?we0z?+Blv9$OFqL$^A^5gYL%0B_H8Gg&;ohgTCi3!h08+@HPK8V z-v3?#a!?N~GP@e2$9xdj7((1nK2$3~@%?oo$DCNK-5x&mIJ+BisP~b{iRiv8MI{M? zi1Ak#eh%V;pnCAZZ7FwulX0L>ZmWk4WQEmCx{wq_tXte#X|J`SLdAlGf}DgdS86`P z^vfldBSDJ$=}=q*SzD%nS1079t@#liy1XgNPh<@D{naT~Rk2JWJq71K%rIbPrn)cU z#&aS!-xK9s=GWoG<*(QXzd{&5_WksFH=aJuG@|K2{YRbOxbJw1=#$xCl8EJ}4dft( zPN%b*UqkUwilhrk*G|6cLLbkGce4mz4ax3>&HPcOAEC=DC;AZ@3gk`Q1MZB(Q@mbg z>Xo`NS-0P!@ZGUj&WNlN&jp@ui&JBS!jE^#`DVC5kG~KGlc`bz&`7K)m_}HwdW=j5 zQOkQd$(k?F()0(R6yE2ZOdpdcspmoZs_`THPD|dA{SeHYo9W`%TJHr%-4@rEWLvv1 z0WjT2fHeb91yTn=yshR60CraM)wcNuu}D<^KLLK{XSpNtIdZvFR(!X=w>6zpxcr?t zq+@t!5q2;sT+;>yVrhzztb<-BGM8y*1E55x$o4O>XSXl#PkqlMTfvYlRm@nr_m+1H ze*TEScHhT3DBt2JGMe9919G-HjCWI??nxgUOfVGxv-GSb%teUa zqjxp7T3-R{^v5@u9Vw8rMy!-~)3>zEc0@YmLNk}T9|ZEzr(GBv_KX#SGnSN#uA4iy zhk+)kZMyFMfqUu}(F?GRC^$8W&ofGFuqjoaVr?dfFL5DFnva#yVAwZ6ttd+YRY>>~ z5!&u8Z=epk`b0#)`P(`xb&Z`*UmRclK-fY=7c~FG(U$9g5W$WULiNr27*|iqBYlRZ ztjpx}mG13OBUNXjqXk>%2?6OHSk|H?xGVhJ_vJpl0`?YzrM4}t*X(=t)0!wU0wUT& zO6xFTVJs_u9q=8|j5P(V{adF zVpp~y&=vN&lA2*pL|Fa-f|c5EtTskuF&A$h>(J7a6E7;t907hSKpd;72*SP5w>Uyb zBweUkRNCvlA!IuX^h$JH4v+di-pmDgS7m;^6dHEp8z&EB)YV#TKVNL~ z;<6rG`t1?ESB3rZjD*8VwaxRYzfhi7c1(MJw~(it6yWqD#GIeu88DGdB66bihTrKP z2_K-1rmuJCRQ}0l>6#-vg59P!tWu^+^_ir`K=VY52J;gKG!gI7Vp%TP`pKiIwRvZ0 zwPz3m5;>|4weOUbzPyTLTGP#X`%EUDmD0Pe26G~}s2O2^xalP%6-tEK}O@q(qeRAsQDKqLC>+>9L zqol5epytQXJMlif6_QGfm4?$6lM|^A=(;?xyD)2voQFswkeSr6LDJ9ZQo=GjJQ~+D zgzdSlf#^qE^rKfrVU;Et_YpQbsA}x;DaMK$()^P<+q~xX_KapxgGcWc#YDFp-X)C-CtSEhWfEE-`osKtk>0r;YV!`}GNwg| zg>NEmVm$r`zhbN0|4hmxawHT*PtqIe;5%7rkC>Wfql+2Kll!`o&j@um+?YhoXJoJS zxMG5<(w56Q30<2Y&3bm)q4v`Z@3|?IW6EsQ zQ1lu)xBiH(iVZ4lcC|Wq?~(TsI}~2gOL(%F;{9bBE#-2;i1_4;cepVE7_uhtaCjpG zfL1m#g2VHpP%V9J?_6umjfvz-ILoGGE;#l9}&p$gqFjUFE!TJ?ut9n(SKb zM-ynKk{$qLJL8&C1hJ0FbvfgqNLd0fs~ibv9*N<{S7=g|n)iK1Gn6>uN#ScZZo0igS26ijLq%fPtkPgl#j)`O3f`sI?zfcIniTq`?|0rPMyX;J9r z*EbNlQ_*5nCJJT^{|n;?HE*FDC3xq!<<MK@*{zK45w@#IqRA`?_ z=KW0=oTFm(X`V~+1K31(D|xKA-l8vCb854-`NMp$FavTdOOlmvi}Z^$ zP`40@d~9vdHc%Gqcy)&C*b(DoKK;srbbuG^ECK(5Xt6FNBabM!B5=i(kL?B?GSN~bBS-|;G^0d#$O7OoD8 zNP$5n`DwucrfAt! zU;sA%5v{ERzu}eNci8WbLu^sF4%qm|uh9%-K_Uq#>C? z31wNq*yKNnO+B3I5&D=j9~!mX_Rl5?FSkQj*w0ccyKGg>y~Y}QPp~X!_{9Cfc)1$~ zzw2{1_mvs6#PrR`l8oNSM(g76->{fnogY^m-yHXra58oYplXZNR#LmHb%Gv-$90Sr zUzBTF%mx&F^>A>0rF7hK3J>08zQgMw-?E=Qd>$su_hw_@HqbF6yPR7_s+|%Xf!0EQ;j33mJ21Bxuw$cNAef^EEUHoBY@%`65=hpyTChW9rIILo5?> zw^R#Q)my9c`5Ya!?fIs;U?23LF$;qg>$4yE(-pRFG}IM1Q3Eb-^FVO;g0$1lh}NU8 zde$l^?`vhYC7an~C?1XF;Pjq)#V3ts3uYbW0_+GM9Q7}{?%!wzkGI|_HO9;?SPAyt zkEiU-9^h?zW52@!`?}BfMB=4>{Ixw0uhw=tY62oiI%IF}8&I#f{m*E1pRPeJTuhH`DuYs<_gaJxGjf{KT* zBIHMt4_d*&y@ZRp-9D z%I&Mu#hd6}qI$=A^Ev4HZLFUXGlkXcd{8%eb|(3$2y&D%h>x>{Yyjr6TTo2*@*c(t za4R7a<^Dm=@0>>oUNhgKgtN;ID4N#^JALXdu$A9f)P#OXG}vW}LN0T@oIqPSg#H$2 zF3KC{^i0%JVh!V|WciSHGgZ?J>Wxwv%@7zW0P~S4PDT@Y3?o%z6-1xL$3-i&USgNx zuP+8WO<^8NJ;PfteALeAH~I*r>XTP?NJ;wogj=@ujoU(o81<2#nMM0@3HL70C$R&2 zTAK5sLm=Dnmt$`p)(s0{)uJ!fix5ixQ!?aXNgpRU>rIuF=DuKXTpbm`KCE;Q;m9 zFUqwqt(O21&k;~r;kk$i3#R^cU@C0T*Fzh-0McKOdu@fF3OB)OVUQhsOr z@};T)sx)?wi1zM>U$GZn&N=8mUV|(Z)3`;{3Kg@N+F#4pn2+Qh z@?3@p2h%>ow5TlCm4r(3#y2`~PXKvBJf&wKUp3;d3^h6e0Lg9P0-+fbl#sg;9(~d*m={%WdEDL%#>Zz_9#@;18tE( zyMU~KR9P=D*E}d0st5qF)y(Ue zy4btPFV@iQtcd1r_`4x`8pekHRp_YoCE{iocjapX`Lt*JYTwNwZY7>7bVD&pS=RHL zoPynsBFWaH2}>P~x0%rIxexEH8`^MSA^vO&FH;+E`}yRt!rPx!i90XNj>J(ZbIYRs z48GK+M%%m=Bj*DaIT}N6P58HW52}D8*z5D`7zCOe3QUMT_mHh;`UHRbm*0+ub0RNl zN7lG`1*{D%&{}vuyzj%QxB-sNCfXn1S9=SH)lQWE6q4UBO5xwXBSzgUEK`!nxICfY zRt`Q%WLbq2vLnP`JzP1Q+#H!nQ4nXLeieLjG!m*KN&VT1=;MW_>30{Z#SrlB(@2*; zf7496A!!85G-5ZFp4&tD^9Tgr;Tt1!jj&GJYRX>c4oo>O-|lyuX%S+={a0`pa&~{!=t3zH|&@sWx8^+DhB2b6~hH`@$XCe*^LTOZF}2}G6RFrgIZO- zoJ`&r*>DJsfAZhkKfDzxA?U8=rnnB@4(e@h?mMksbSLi&BFEFPz)qF0BtCBmsqw-L zVZzzbHg;Nm_k@ig@th#5VcwYkKjQJYmp-j`EbSr?5YXYYT$c91IX^%5{X$$x9Y-9P zX}yp79PRy%`Lix%!uvbF`!Y@Hb37qW@AZu57^6N!rhATAog9%wzDa`C?UW%R*S@1C z-aycnjs^<#o|Pl3e5=6w{r0r%7wZ|!2)XbgX1l#|$;9OaQ~ z$5ft-n1;tp=iSx58Zqa|U=PTL!ys}}E(w4Sb4yWtb1UPvCl~PcYk^*<MZW;K5gf0ZS``*A( zIrG4_%cRzOX;}uwj>E#nj^_JahKfvJEst3xPuJeME=R`hbAItXmFnt1_$x7zADO}7 z&&97gAAh}NY`@7N>Fzg4a_}p%=Ifor z-LNqCDbr%X-7~Yx{QS)-Kv!8_@#j`8Rp%D2;b*cK66q+1aCgSzNh*EiUM=mYw=3i@ zR0KrKzUxSo6v3ouYPp1AmD)bz@g0v5pN%5uxE27N(t4L(6A%L`%@iqpOZzGRDL}QN zg`WaZc>nbP0>itg(cKDfrOoxm-%ET2tjQA|A`s}(na}=0xe0;-z1tjZMl$W#0!O%D zx0AZii-|G!YaY3%yDa%K(ZE_w6w_|EuNl(119-ZYUzED6+?$-XT^D-Cd40thh)#&L zrzw5g@Ap?WC{GTe2pXZAkH`^h3_Dw|xwz(gxLgL~uuc$<|5;{ z43l?rgOr*EyYVjLJ>4BJU2oRJ)!Qx&GPtFy-pD$&RZTirfwwE63O5<}dvW$L5VMgtPM<4{e!(6eYVD3;JATPL_r;ZQ zN%r)xa^Y1G3)kIqlq3cbh?Xg^xaDSe*sTa(>(P7b6`>Jlw_EDb=Q9 zZ|#xh^wJHEZZ>RcIRS4)0d&k{TF7agd+Z4QI{q85JM+V}IBBwc3m=qbJ6KBBJBh~| zhQp{2Xt>*GkHLe6qCLbmn`*8E`tG!g zv%e6MbA~56f)V>Ep!5t693S36gAr!-?I+KAe!g*;nDe4xja{rK279WsggRzfI1{nh ztGXM}dIJh8GM*_{H^MSUd_cPLzVrU5B{a#YJz-SF=aZPB_C=T*S+kw2MKD;uB@)tYYZ7FHjBn>?q5|Y z0?dp;J2HBeoV>o2yU0PHB2LjvWi$;7?Zi6x&2OYuIR_a^k#zeKumpJv;g?bl0gbV+ z?RE_Px!C2rcva-jmuf@-0u#eNg)qsU_Tm0W!P)T~aF`bE;BOzNCl*u5wa+Io4n#N} zqVUTQ^0ni#?%+VVV8IcbC;E?jN+{^xetEcaS?mXQF=)Oogf6toS#PB-CH)v7FI6uV zy?Vo*1;kX1roLGdO^V156A_9K^w*&v`wZmscPt^)GMoUUGXw{{k&Pe>Cq7PATo>gt zAR${38zzN=B7E4PPF0<1Esn#TPXf?NaQt7npROU^-W{u&>Fd?otjD)RE@9Z4)Mf8! zhiUCv0f=ZkAq|htgyo!D3l!;VRDT@FjyLq~{|}yuuriLH<|d%#4giJnYawL!FjB`q zo0#J6{z#}rB7xujVZ2=LsfG9$g0TkasQ+OPx%>Gw6cKs(CA|Az81aAbzsl$xaR7Dc zqSkYUUboJZ;Ap8ui?MbMojl25rb0jU0XD6+D5zbb{}27C>lvcK3thf!Czq=|*cc7l(-JLLWp+o?o#wN)=v0+~Bi{G~rLX7PbaJz0R&^4= zq14Ji3!La<+TXqLjCmB=;Wo1Ht*P3e9QcH(ooxy=SbDb&Ql;X4kn~6t71yi1cFxs#e z1&U1(n?HVph3V06q`d#I;^EuZ)WC3)lh<#0o3Xoo{`(^1#%Judl_(>)`{e$2nMAea z6!^)jAUlMEFRh2Ef}Ka+{~t&I zcKgTSp-pmp0{DV;ci`LA!S?)56YA7tD1(^TlJ+Y>8C>)2v%S}ZU@b$RIz2vm9O0}D z6!}OH*oPh~jp3~y0unmK|M#LHA&iWA30&T?Yu2B(-~=dh#pgs>->9dsTT=e~>42LV zO~JJ?tpF5J<^B9=X!mi7j1UhTj>YfPt9TN{{$&_ocAGE+(*9njx<~x>y08X9Elerxr;8vS_2yg2Mp=FE3^Xx1GrOMl8d#LR1k=Z9OtG061uxi zhxk2d|4`ya?6FY4!LeR^tGAJG8~uX4y{qns>&X@Ahy4+VgYCaM)#^tFz^^JV%CN0A zf)seSam#Vq-d9ZX3wCzS>BR~>yemgtgm~zh&nF zfcSmyW2ZnwM9jexprfP1B_N;%T%D4Y^_MbWD zK&Mc?Mb+NdxIK9#ApX|?`k=EG41z=t56dTWSSNU2jBr&0N_|ngHuF{4Jv}}B!Ut!E z0$$f~1q!LM0C$bQJ|7ntbx;I6q4+2A39*0q6i0Y12Q`vhzzXc?tTP87CQSjP?)j9G zP*eIzNomCofJT#Qsy{I?FlNP||cFU5BO7LHtBBpEdikIu%%MjpTlQmr%)m{a>1fqeSe zh(w4HI}7!;0L%xT#^dz)YJbM@bWJ3YP{{rn8d@r;AO;4;WSzB^<#<--7~g^@g1^;U zBQPZ7x|s0hhsggQvw#bQUlPqjeWCBQt2*A<&+-d4H8qh-u&dO3*q!7TjERYvZ1r$D zhq=e);QE&^8Bxh-%|JuL|LSb3`VN3OV|shOZKk88shRNE-2A&>XX)o+y@ra=Lm34H z4vaLwtBhI(9;O3ktx|w3?~E=khq6c_qO$*O3IfuM=GxXkY_-FtB-=V0u#J!H+wBAS zI=`uW?1ln5oj`g6$dn3-nSOo<4X)~d@mF|NmXu7-|BiOynOEcdg3aO9K;e7G8j$vK zTizKn`77PCr+sICK+J|791WKTwQG{yajm9vc&5d=4WO@SL{Ax#LP#Jby<+^L^(G z0~GOSy!vE zl7~&*+IHX>0iWC0l-1fUY3|RKA1ns_lW;rGlR`il`@aei|4Jc6ACX-4r(gMyXnA|L z$|o^*$|LMqMF96jBvb3_R>leeT%5{}WQANn-Y7;H?!i{NDp9`)8vT0+O0G2@RIuR* ztwP}Chbt{}{P}VhFhB-T%o$|K2g{=H>-dUNQ6-9UBq1Sj-_;n64}bMnx@JP(+TNA{ z!eDE6S593$uGVHj)f=#99PdLY5YH0AG+}`O0mC212p|y1bwEHs$)wvI@Xf#S>NG9l z$Vu)~*&IIEw4Ju+1!^Y7>lg=kCXZg zGKZ)gAY;k8*FA84Qg`rSi5UwdXcG=ddoyf5TmrY$1)lH4jhR0ABPW(WrM>?9|2yDF zoDWn9q(a+XRL@_0|9mL7x%ItxYLw@!GLw`pO5m=a>D-|CF!Q`msO^K>GUR|~w|SZ? z_UZa(8gMFf*DL;%qXtk}4IuDK3%2ZS?kb;_de)tViOF(nA}Njd`}UnxYXvCZ*WmPq zr?GHyswdbvgXMHl%ycE_-MTT^*wSO-@$kqBU2dk2V!M8Omq(Go!7rkWScs2FnoDB! zPwTl4#23piCRyK!lW=aVdN47YAM@|w&FF!BPLG*VdiYLc^j+Jzj|tfJoZz+%vg#+& z3#}gCz0VhR&rd7K6EABk^As$KE6&B?3(DE(+P}akBDTU9I!Fa1| zwjT`#5AG^<-`lplpQD#cogA%{s{pFhZ@GTIhR77;Ux_3}GY;z7P_`QQn5OMXirypa zjc2#Ju&nZbMe5r zlKjRM?f@lj50v@&vELV-?v}44pXQ8yLa7w)u8KuI%v7gE;&3tN22QK-9hfxT`3S#0 zV!QH;gx+6~-F`Wjn&kRmAZlm9Aa?Al?2MseDdE(<>@g?c_%t4zmsK@hzOd+WAf71t zvgyWdH!mtzMcx@CBOj7@c*4c!M7)PG;02OreV9C;!IY1WdU`DW6XZ`g@+xn0tSZMm z!wXX8d_->9`vhkhdjqYmpK$docU#T;Lu$QW?$)@?G|35)zaL)!x!nHQRFd~~K3pV< zu$atuX)cFQ4=sBnij>m2`TTfi(s@i={iBZL8JvTJ{evR5S!-``ZCT1y{%oq9>B9?7C z_LJ3)Ggcmpx(NjjDtHfR>HHp(hZmQQ*(`rp7I&A>R&4JochlkprGAq>C18SX;|kSO zga3zLOc5y|gSXF6Q0}At;4(!FqrZ3&t7orBP(HO0@?+wNP1BBA;hz8cSK?LqvZGwd z7FmBy!lnGH2V_AfyJi>+mgG~xH?Sg>m^e24A4R7hYSA@t_u z*8J_{kS{YHLyFj+ooRfwvoolP;g8lpwC!RQsx2D$!r9aH-l`mc8``5mP%gyb7cV8e)@ba1^T{2;^{sg$a++|2j-Pb{3LM`%Bp|YUFyq@XWT5# zz{1igAK7}k!EHIdrn^T#{FY1aMusM!_K)iuY`NJKE^D*n-An`DspTQy`Z8&!A=koq zCYpNR92guvgnWa|(iH3bgW)Zm2BDc*f8Csc3ApBxeC4Kt8Sf?MVJDh=TT|B1kitrH zvYUOIK&Q9e#wU34wmHeq{8%AfcBZ*AkWzmwQ{nf6hjD5P&zBErN6Sr9@>?#4^CB6Z zjzNcuO-t`NF0ZcQgTKAx*mdxs8+y&2+@N?jU1?}2$$yrFPe3pfqN0?16Y++_S%7Tm ze@rp)5*>G9uC=4?ZT?i8ZbEw#exMsHGtUhIxxeHx9+R^Lg7(uT{%Ni4@isC3GS(cLq`_*-uo6A4u z3i`&z*~Kk4?b+8Y$K;=c9Jh*mj0PF6uZ`1>^qd^ij^ymLhvtUQ;MXTiO+!a**J6E- zuv3*$pV`k}^(%|7W@GaXBhL=pNlm7D1t{T3uFd)hoK1XgDNc_&ZexGm7U1LKr=0z1 ztliqlIEsp=>Z^Dd&zWmI8tuF;`lD^0?r8xU)4Jp)3;azab-Ti5Zp&pm=&HVO1zfn& z+jd@3oC-C{_7FNBSmmzVwfXp|J4~L{_R77DiI04!&3AdTfOJKPEnF zBtXIV=fUa|FLtMD=Wd$NDV`F7d>a_|hM>lpOd=93T1w>k0HYU^Qv3 zvHB$G@@KL{j*jGEGDpH`myVK(a`;-4fwD&>l2m{maM$}Kx2?fiCc)U~gG#qUNBFTj zXH(rQ$g-n1`Sq`4GKNVL9hNO0IwYxsz#=eCb; zN9pI>6mL!Jyn95{njwj7*)!L_9;Js-o0{5Bt}j_2cUCsQ?8K`;QemnxJGav!xoI&S zDd}zr$V`^r3SQ?Yj_fMscCmw|+HNp8uc!?NS-;IZ=~8ueG7iUfkoHMwt0?`C)s6ok b!zqZkM^_}4XB+*WE4O7N6vZn@tXDd~{T0R)r~kdj7` z?rzwl@AbWR|GWET{W9a36VG|_R}W7$?kf@D)8GRDKy+7GUJC%A;8*A^I1c#162m_T z01!EQIXR8Ha&kxwcNZIbM{59JdtqsAe*G>d+h+?4bMw!A9Jle^eYBoDd9G!SZo_=S zT#IlgeEsxG2X-t3B86fhXaCfcZ-tj6)!JuE->D`z=DnR#*OFFf_aj~OX7aIA5|tC^8GI2kfbav9%+j_ z!-?mLfBgb37`}rYUz`we^KI;>#}fq5sn{?13iu?Qx9}k_V^tisyTxpf!LKLSuM|>O zs9Er1F&Zkm+r6rzLz=w&y!__oK%}Vr!4mCUnHAYQ>d6A+;^88W6{q|YmN(|+-!-xK zy}4x7yjZZpGqJGRrJBP&y_c`WqG~B8%cG{1`93vCO=XaGadjp7IyBTIA@s-A!POPo z4YixannmCHkGZeJ%?u(|<2 z!dDFZ>SXO{f%J89boLPQm1O#Jh8Xz$_hB9;dZcen+)d6}f} zkw~P3yOoWYmb~JBE(iZ7$z{sCn_q+!^_XZ&(8&(!R6uS z>}lc4W4_&-GC7GChKj`0o|CH0(*Z#jxa`yPo zYk@Dw^ZOSbK5kx~|F_FL?QQ-)F8lqLm^UMES`MV@y>hAW|U?u&o3MoDbp8voe_di8N!mWg1=WXrn zM0Hj%b4Y(~eRyOP?6#T?c`?PFq4X&;_uJ;@PqV_0ewwruDN?^*N+XTb*9?7ZWM-r~ zvc#ZtvC=d9^xE4&Zn4YfJX`96ao8H`;RW=kL#Ln4hdH_!-w&9P-d@gz35h9csbK%E z1q7^u8Tyz4u)CyKER9Y$n9`N;%ouzeWsr9Np0ej7ypYBI-j<4oopW7xX=<8@>slBh zv!0*ZuM#aKf!Fk&7Z$GEENI@>ZsY+z>2=8f3(ZNKNg-#vJyCzFKa)dcZgDt z_b!pv8>^f{l`y;f+kcQ4I2Aq+7W3cxTRFi9u>sBlxto#+84OiLI!nl$H zqbI^zJpfmt+QKuk_h?FPJJFGptDtMo>%YR+&S`Zu)E+3DeJo{oh^uypj4{koyLeY3 z&?bgH+{k(aq~&7;p;yyJc~S$@U&0?}U9x5z}r zSSd_nF%Jv!#>bmbG4hon;So-~oq$(7NYUPm>(AIO%nrJEMi{811+H2+pN2qro?>G} z-)qVJGt7|}Q7h#j9D{kKoVk01~bWTB*H9mC(-Vz6QIfGgx?KGVNNxdR^g{77AA zQ|WI}TpqiRp^9BYqD9D7ICK4AS05lrSt}zFRj;?o9Bxc1F$9Zz8DOsf*96&?f9DmHBGX(sFt_^4Wv20N z6fwgs1H$cH7Dn@#Mn5tts!w{+e3mm=SLaJy(Q$E0`UVD6vp>^auD$#9%S!6LiptOa z&KO#OJ@nN@IT4)q)Q{DLZ>?%}8D*3jb|w zBr}P!FeFpso$RlrB_;h*)0~GL(dCFT?~RG)jXrDN@$jBT=xb;o%))OGLs04ir*}F_ zP5LvW8Gf8D^d#3gu6)b!oWlf%siH`c+jy;zp#Ki!<}g$}9>9AwpF?7di+~Fj8#Qbe zX7IF}zkIk$L4e8E&V!c|qR-1yCo1jb7=i>NuhB~=Kd5omhGHOQP1vc)e>&DG z8L>k<^w)=zbLcI9ebTp>HanGziBcE5N3X4>tUQ-G(;Srkn2=hQSo$13Qfd~5P<8$J z>28{YUj^~(Q?+}4J1)}Q5a4}ws1$+r&IF6X9!W44ic60?-bbG-PzJx^dXV&(h_*lv zMrN+BiGR6h{T%>X-xYD$JeMOp%W&%9dMxEHTa|s&+f6lWE z^rwrcn*FE0&nW#a_nF+8XyoQcz{vL#m+(;ezI-?_IM8hElxa|?PpA1AF- zHpgH@`rk_fp^$L`3_%aJ`JdvfJVwFr@owjj|6BJ+cx^d8vda8T@udVy@}t&1r(UAF?-GqGuuU{e z3zvj6S6Y&?z2Ww(ee@|EmN2TEb1Ls%- zQp>w0ncNfb|4#m>3FbLBLLjNx-tV$%MG>1aOF)6s2ECDXIG+8;)W75qOK`i(Bk_jQ zmk)WbTCXF5G#^3*C4OoDZC_;$m;?n7Ps(5jEz~Q1^k#lgK z_K?g>WP7#ye|j_u@p%(&+~_;V0ynM(s1(k`XC5!5= zafxY@%4Cg89uck3fJxOxfYHFOF9~nF&lb~N#EKK9IcjgfmQ_)A5t%%aM5)ifvRDa1 zOPda9E>71* zUe7ra>8lFZ%{EI`IgEYvocSEl@Mwg6X!kkWwm-sLaZ28X<|8T;nwXNJEbKh>S#4;s zj)Kc55sHOXe1%Ef#Ib4%LkTHmf@?$sB`jng0izLiRx@ev&T$wk8GNtsOzYem1^3FaD-xQh1q%{ERoqJz~808*oj8|A|_iljf zLeO{HJjnDXE}!HyQr5Yt{Bq2}616 zLs1ODc1@=Bp7u0CjwuJm;wggm*GEcB(v51I?|}f}ea&oe`m-7TH7=o=i^EBmO3SWm z>D6D@`=OV&`40Qig;(DA%rNpE@631Q9kUkem(n+#@AhO*(@ucv?9u*Szx1An(E}%` z+8S_a8H^_9IKH0kS6r-zTZ=i*YhlXmU|{S9^IM4>Aza1=-9R_}1W zHc{Vs8P0QB;aF?{4o&7Zd5HaGNZd1bq=5-pD~2n*Zse1(-&GqiTUmrMlm+ZYi>Md+ z(v$T{O`T5F*mVo!!Syr~n}8zw1J+_9t2%x63uat_-G~U7O|5yRe;cJKbKpCfeu+K8 z8d1O9n%q>H z_w|i9=_WSxxuT|~X74hC?;OPce5VUf9M#sC_d=5U^bB$zf$C1YEeEd8tS*<~kLG*w zzz+MJDLyF-s6?MrpdhZl=DS=r!5iUae2ANUG5nIFh4yO%mQUy7knm*1f!%{jo4z!) z!h^LfW>q+F214jiEZp57YCMQ;fsTcZ?WglWJ8(fhfAlRIPx9(~&vX4dUz(^#E`OmM8+>48 zbu(zY758?u)Y-Z~SX`-UGWRID_GE8qQu&?HB$Gn)K*LsZk5nxg-3qtF!LWAk`45h7 zo$He|JP&Tvd#!a+U=^R{WdwK2s&36RjsJu^gH`$=V8j8&n01-ssHg>q$Pb3vqR>~7 z9Np<)MP%ba?HS>MkA|Oc8`ol*gOm~!149%wA|yzFfjDNIt>}=jCnV&2H>5pKam#Zm>^2p-6k8C^6FAt51gydC0w zO`EE68m#^yaBe9&m=a~v`4I0#Sj%A3o6_3%V=P?J^qnkrwbl(u|HMeLtY!;)*T~8z z(_9a#4GK%mTHay<28exFD9*thhwvE{i->2V6xL;em>5VQuzC0QWcQ5$;z9sLU!LR* zrI!&OdsuO~PNbSdE;2ag%+5ML^trS5_Hb=1j#b)WlymJ~<8C*{c|(57V}FF0P5)b` z;-xR44pVIjB;WEk-iZ4czy}^cAB`4$31!<`?Av>CGEafQs3fvkG|~1gNxS`&7jn`s zHhPtMlZr*{fLSTFa@6Yp=zTzo^MCscr!>Guxhg%U6HkiU$x)~*`n~R3Im0rMweQvHw7SM#3{0h-`q^ZU z#+An`W@luGcNr=In0s>Y6d@;?1}t;@sKdAr370^U)?oza2Ugz6-G!cyJa%7Sixx35 z+aa!yzALGP&2Pr}IN@ocre?UZkY48$tjg6St_R;h9Aq(s*3!COiVC?3p04*=?;1O@ zKtK0|952irinz`Jlya_+X%N>*R|y|CWOgts0!i>se0Ek5&laH}IRGS5UHU>$wK(PD z?_y_5LuX9sfR_WkUVuiD0bbn!=wdQ(#Afo=8zt;x`8-lBji9w-Zu zLJ?1vxEAArTYZ114A`xW7JDxCQm>AGWHo~hVao*IXh%F~Gl9yD#_ep>%<>C7#<`YH zTzGBn779t<9Fe6MQ*rHG2VlVSoer~9+K0y-0nQZe*;1ox*XYC&Q~ejZU)8;ui3}s) zJz_j%n7?B;5Hk758DKU>Xu#Wi4e~?y287>-GP2=;=m&L*oO9}oGied zW0O)kc!PyBlY~9L76&aHHpOqrgiJXkAr1K+)_WOwzauN*Rv0Q*3D8{0th74!k1r!b zaJ)5#@ETovvL14EdDJp~@2O+R+w1So>Ff`_c2CnW_=-K;HX5iay);$1h4RU$jXEfo zlK%Lz&@8FfAIBYc2Cb zOW3`bfLg+QoqwTwAOl1n8&FM5+M12))%Y(2YJ3s`2TWnw_5Wf=egY^HV3owmviI-B zjZaXyy;$+DZ~Rh#XLI}|X_zAtHq*urstJiyK(hHul|QJ`iU<}T1v3=+*tT0)v?CvQ z#r+9;?yO(ghV2j1)`o%2qM~0SuO%znI8?7Cg8-nZ->{K!_x~x<90P1~`dJo;PBhfi z1Q))(NrqyDH`Y5$Ni%=Z)RP67JCEeO7V}q>EoBTROS&1N=e1+MzFVo(-%Sh@O?|oL zXOCP_{BtXD80LIys!rj%3oI!FL~w5YE)9>|(;#p`M}rIyq9}^{Z043WpWecBf@oZu~B+dVUea0Uv0IXTa7wWNn$k=TRd%XW;Q#r_A++a~4T(;i({=XpTkvVe;Ed zP&c=7&z+xs3s*IcLot1RWk2*?U7r|0rasl7udcMk%M>~EyUB$gr0KW#?!2t{YMdwJ zWK_WQy_|Z2=yVG`n|+OLV)vvq9Gxm$&GF^U13og!Ez+RRQ7)q_sex|v*TE&U3? zkdgliQ-z0|%zGVglbkLj$DFTd$?4i}&(##^-nr#Mfg7^>{0Z@PGyud9G|0T-F?(Ca z#Z4tq=_o0~%wbY5IFhfelqx}wbY%5g8|4amVRp6-f?7hX} z$HWYZAQGI%AIc5-oclh3Rh^^=3bF~Sgqb(ugMvPrvegeWA7)5NuC(G7mXB|BzbX{8 z?7ZJ=L~6hFJn2(AaY zea7hdNk+acU5AvSk_U%=Nznv7|OL z7I;e^Eb>~+Yc;b>EGJ^9KxJDkyD8vka4Cc5ooz;tkzroit|YKF8+`Vr`QlJ~Q#~MH z;gytx&#^BEbUXHDYFwmcKHGiECc!;=PA~bjevP`bL?<8GbdY2~E=af_;DmS*(^S~( zqpxLmHDQ;`qr~>(5Q0xclxP4DCF%tGGr?2%&`lwLkBnlxzA<2aPO~>#@8y8M7)LAT zxwb=x`{JQHkDI`8^6F^uJ?YEZ$JFT9 z8;tDDKNP|SGVdmG=mn~q1@7boQ>9z-4%xo-Q#omL2GOM1P`BErCl*4+e7 zTo!`*0HyDWz37vYs#V|}ooPbzYvYc#T-LvsT%MJcvuI+M^V|KE>(Xo}WBc{>f^F#8 z_bLbB1{$N9;NFRBn?9P=fZ$PoZrm`G5hKuYHQg|nJKfbatKGspCK>C&Plu$XKp|Ym z?f}IMy{2c9hb-SEs)4zvYLG0jqd226=cJ^hbTbT7Pz1Cr$`fR)cy2ZNBtR^-h((I$eWv8Cj7SZ_dPM z%PJ{R&@*nsaBv3lGPt!ybEWH?n*;qmJnX<1+Bje>OL;9Ba6d??hP3hmRQq3;zHJb4zJevjTv(@=w7Iu6| z*FbuQ1BF6;P-io?fBLlaFlLsZsd`IwPmN{lY>7hU6?=#DZotu|SND099s&xIpUgmx zk;KOV+;Z~}44g*rL)XMdA!&W-@~;_*@A3Ae&d+^MW)HKnIg-%bA?{apmqr;=isEiN zq%@pV=gWgz1`p;KT1=ZJimJdVBeKfc0Lyu*_U zStNLW&ghDJ5P|m^(+7Bnd>)*ddko0*j4t;}6Wc|d<1G?H1*-C}a4+ks9meP>fYsrA z1%+o6KMKx{u7)T#YqWBrRrb`Ww}2wdxlEZnqjiBP{09`*WpI$M_q>WdnOnhN3%xOs zF}|x&>&gf+Vx>g#h1k>k4b?EEHFYU$hz|mDL_L9aEZXzxP)5KwP|C{JF5h_D-pEhC z9@?J&1Y3Fh*_QE+0l;Qd$(CNU5p?<0d8g7H7v&pLcL?g6gQE4pBP8I4*expxI!&lmajmCe)Y? z(;+FaY=Tmz?-1PYh+gnhv-=zi)w@G0ViWuDuGg>$Y6hQzKQa?0|m{LL(@&yw?&>P6A z3~>Bf%$7H7Q~@X-K|Y@@R~?4lFQkic%`blR^NjBjcgTi(JC;#QlP<~nz1$!FBw;hG zcC;6oq?7PXi6*`~!ZTN) zH|a41v%)EJbFEnU#&s1EUo&N}hId=9+uSP}qw6D*a<`l6mmD*}Mvp#Jj6-&H(Fc5= zkmBFv$7K!kBc>JlF6N_y8nB$KE*`hN`b4^M9Dw6Ex2M#?)BHXBOo2KAqU3ySEyNoa zA>z74L_2DED^8bmtNDx~E?-ySB;BRCr1Qh4?^$1yxF}j-UI;R{J{-no0E++>R$0{0 zW%;LmUD@e$VHbnQ0R73kk`J-5T04C0yA}1?IxGo*=J=hR9cRn;Tv!o!qD{9sITJ|* zvi0`H7N6}mKec@|-tv3_KOzJ(r2>bKKKdT~zJ%j;=veWC{$88q0h!fj!Vj<)gA^hO zD6It0-~{}!^W@@4x?;gt{M4w$e03&`qjdX|F6rMp0Gk%eF7A@>op^0XXcQ85R~A0F+{G|f zfe8tC_SDTeX=LI{9&(Nw`uQNPvSs3EY~)Z=^F^Yti&PHW_dH>1H9oc8RBz;XgCW}N z;`AT}&A8!^_PWM?NHIsKu_Tz&CuNwo`8fbCT}EyVdrSSa`uue?R4F~#H!ZoDX^}sH zUUw*J4|h*J+MVu^-J7ylbHj8+-XOWN2yx6?&}t)d{2Zcz6C7pjV&|fcU@FTdjwsSm zez3v~E{&(MuOShneI0Wj(6y1b)Trb@$8Cww5EPmO-jJR~W`;XyNHW6T^DeYkWcoxl zo-Cs7hwXnA&l)$uwipZMtYttpavC3Fmkw`R(SOrJ@X7&dSL@>mWYm6NoFG6DC^g7% z5p%cAx_soTIP;P}ZfKa9rM4;I-l3H^=CU=(A5l|yGb$4~-B8n@({Jgv4I=YLS{>uK zF%0VZ`JnLEOBnx9=p!jr!0x?;YrNBhY+qRV%;K;v#}9fLthZ%o`Ow8`dzx!!gWcPB zofL@pZ);cV#8sunKO|cUy8-uF8?}L`JXkTG zt$9rVok1bRPGe8aT zwcE>#A@;IRyeXZ+AFL%#)sby z?p<7->5jgJDtbJ9^5oYP+@O;UT&c*R8YLyhPj$koPv6~TQBa!I)2mHyyo(492VL|y zY`|{242mR02G=q(Gt<3~<}ppUbDuQpD7gNG7&YHa+#pf5C%%t;)BKn6{h?YnOY&l8!z`!an9g&H zOC?(PwZDewBHWVU5)_0sDEEnO6lN;yR3cnQh-Og0E0($-9v^Re%a}_jDQ25je9UapmKemm)ehCK| zuTl}9IA`_Ift~>P{-e}!yux#TS+nZ?ZdrG{-eYX2<9QZqir0$^m;SesjaI5=i<>)D z4zbgOn}@6ifATBa3b4$JcCFQ?TeFwV&eQepjH{Mj(F#51sySS6-)w;Y>PvSgPiFmi zpbP*XyQBcy{?c+yCFtO+- zmq$X3XYAGZom(F@4i%6iP(bYz>@?OZWJXPI%RC7P&Hm%BAidzIv#tuWK>zfzb#fjn zq7fdf!$Xm887|E6>^nT5rQDd#z+Vfh^j!CvGn~1@}VbKU!;>2N>rlnzK>YLBSZ7O zefhJIr^EJuCvPeP8UKbP#3oi!#*qt1y20H2*+1jut5G-|*8|lNGsBwnHt6r7wt*+a1GR_-#F5acR=Nvg!mqG`x%;V)oWTtx+L0I$7 zZ*OsT_iL|^PiiSLo(@qqzY*ADett?B+;YJ4%c@nC6j6b7-#zX&iK`)?k&feLbp>X= zbX8Qk0zT#4=&UI*PoK(Cip$@yjq<+sqGwIobFi__r_S-x5FOz5lK90npGYV2_bg2($sDHdx)Kk5)$>tZ9M3O9r!qD7&+DHnndhEA=d-YZ7An>CJTgg5(j{ zN9lY;EgwaM4EVo;Nw-kj_cAPqvU5}HxV=I&DuSG(CW7p((3H#oZqm}RF zmXCN&A;V=Bazc}>7yN#^WcQmRqQh~TS_AlCxVVKdhU5{w`gz^O4kky1ki%<4kUHv_ z;DFj-w)A;WtI>|5mo(T$X$+notc^UD=s5{&4LgyT0nM*`)#R_k%|QV(G?Yn+U?X|( zvWW?-VOfKo#}B`@3#eG|xd=#ZXDkv0HmOzbm2>eYy$U{Ev3)H|v%#TT@X7f`k#eh0 zGw!t;nYXp2eg+il7E&B+PN(COvw!%h^V4o9H)em_HX|#Q2(%qRVXG&JYk#|)SfCo= zIve0Z_*=I<-Crs0q$*0PH%h8(zC1-0fE2E2S4BEK_?JB5voZ{{Z1S3ystd8pE9}%?I#}7&bVc!lt zG_Ec$4DAfc%pqfj6~9!|?l=fB&^CpN9)YXh*bUHSOiuL}D=|s6Z&!jdLPsM&*F)oI zbJ}p5O7c{4<~ZMFR%)Hzbr_fGSbU36zabub2n;v?cAn1NEYEKHX-)BH?r?cHKcNb{Q^c)pXAw2p?G9@8v`|F~zzvd3d!Fix1cz(t zG5wqSbgDF1SlZN?$?alArGxRob<> zQG)D|_ZF|CUCYGvcT;ukDWWS?+Mh&2GM(g9d9zqE*4xtd;u+<9{gxgRwP-eYJ89by zySXJ5D>D)rw*%?K z-zsKiHzoI&@Q&l@<(cI;`}Tkw(fAS3tRI-6&LYo`>i7uq<%TNsM z*vMLL$*sYk9jeFJq*5uIKXHVdr?OX5k3wr<8Zk6?io))W6pW-Wg0O8k=wu<;Zv@Yn z2-FncfojfUb8A3BUVhsal!VCVXZyMkRPpC9Bk>}rFFCu;lSzrw<*fZNv$&yt>C&b8 zLl;nC&{loG)h7RnU00MF(uOdW!_c>p2VQ|z(nlBer7+ZEW^+df0uR~Fpmr+-RUHFC z0V%A#4E+?;mz%8P4;cY92CL3<&E!c}u03Jc4-0`Da8@d#rhg8Xk?fZ`E5hI8kjKIy z%;af4eqH6vYw-!&yl}y?>(a)FX3-mw!vDc*O|OwAM4fO3bjI7~L6I#we2w?(=NHT% zapM=NS{u&KQd>1EQ>PObH*NHN+VdkA9Pojc2+q@k0EN_HS}iaMkjT58DOVGbk+D#S z$AR@yy~<_wt5|YhI@blL3MQX9fNt`=*CLvATodKAb3^Ks*B{>8oT|%;h{~F}PaqYz zR$OD?TJD_-n#ijie%Idm<)&At=zMf`j1&XekPdg0tG5M)33(HKOb@-y1vCpQrM}={ zLS$0)u$jG1$r811wo~%D@d^ZF=~eY#5?DE$`h)t+)@XyTeg$;T8e`gAvD%<)1}tZI zpB)?xWQ0()@YjPQg=6sGt0XQ4+uT@W4LC&k5}*m~ifU%)ro<|HyRJBiUEcH$tt_BRoO6?CvFGnEV2y2&&>ttS)3}L2C zm)3T8$E$@`w{e^X7cKl;7kUzS%%s}=%q5h9kTXCpd79)0%P!XMs~FaLVfkO}&*K>Q zd9As=YwAZ54`yg`dy>5;#|rL1slX2r(Bhw$9J zz{!na2*>$iG5&GqD%hdp-sC8~piK9FVt-EvP|a8+V46RKgY7Qe zpK}7qAYZWNvWRbys;R<4)VAZTqW?H}RG^=9C0uZO3>KOQMtkG0lh*yo+@fyDqOL=% z-$yNIYm-ATdGt|g|2SQz8dBZiM{TUUvZ=0+NzBZyHO<^bfc1mnYtZ4l27oV z<0O!vM_cQ@SML2K%<){X>uOxDKt}ODd+SAl@3c-HY3LMO5TmM#FcxmO8%QLp0zn_NET`Strntkh~Z!)OP_5 zkdJqX>Nr7b6l~m70u(>QW|;Jg@x0C1MhK|kpg?9-waK#eb)KM@Qe}HD{RKEHzs;&} zhmhetR7LH-wflHW(CsG-OdgRXv);P(EroAusNAv(t{3_{FFJh=^$nQ%l90#7(WzM? zY&Srw1Hz1%Ya*aJb}xnZEj}f8n;vYqEAA8MS*&c-M5V`0=H7Ey9n8XgAYXiY@8&>#|_%Xn!RyW3V~sthOo3PvlWo%vK8#omj*YR)YP>?t)*>4=`2o4MY!F zO7wmazag!$Lioz=0-N*B=^7T^BvuQEXoG~ov1>&I#lyq%JY1)4bBRETJV+Lm01Z4MY{7qD={H_?6KEW#~OKKlJB+c*!<4vAnh#XWN_dg%Edg z<9-TnDD@EmkAyl1(Q`rZexNOq0PkwfToK7D>u7k^C){IqevGFw*)MZ(c4Yg`qBRWL z*!Igy9{bUv@j%CYoW-e+w(3;}n_Ow)KHLIJB_<90L!AZ)Ci8o2h7~Zct(iC2af4a2 zS)V^EuTItwH{jklfZ$wy6>m308Pc-_5M8|}=pghQHQMwUrHLI_;^X80Eaycl z?YRzry_}JgYlrWBP8a40x;$9|#kjllA7#Q%IfpSDgZbL54j;kB8G1^}TC@ZLRx1gp zjUVtj<(5G3Pkt;06iN^BAqv63pdK2UPdK2eoSPzT$!3^(Br~wvmm;n2y6X)lO2ACI z-t{0jorr6^Lyg^FSc!36n;JbOCIwU0T3dOs;jwhhaxr`CKFJagRvolCB`PK4AF%s{ z+mVHe-wJM7Zqe>CTw?NoLU8|J{^#b-?TFB|vC^T>FS3d{Vo$+jTxy$ee6IRcg!lUQ zRwvL9?VqTu!fFTyoyY5@2q_I85REwcq3-;7U1#{(N}0u#h3Y4D>0)iY$C1Mo)~ew0 zDLjw!h_QJUza;w+Qs)QMqU1IFtr}k%KK6UlEE;h zOYzz|&>B|bGHbI~I-<~mw^@SHi?1Z z8dW?AcB!`5%!T&zSYLSj%-D(@eeA?IQEMJ3^_08Gy_QD5W!L$DvF6Y#vf{vA9C#-e z;O&Qb#RMXe>(E2l5dI19Ex8%vi?P9!`u4U>@A=kDj29knP!1?=G=60;l7>S=7V&u> zUVaD{DnY1i(R6flly^#6J=y6FIhtkY(F={Df20f=qKm$vQbDJW`n2tKN5jr=U4;`l z4PRC{^(7lrJ<_dro3HnuuFP-t-MQXIkh=#`TDK`oXH2?|cLn#KRKsC{M;iE_g`?yy@tC;*8OPriK=iAligCg;r<)3O1nYIf|gOwA8pw6;EN}>U(9_V{=|(c zTL!mGke3d`gAu{ph)`U*dY1EZPP2Ok)M-La1-(}rMILT~#7Y~Ob?I~0>vvpcrY0!2 zJA$N-=fXKf-hBmU+oA?lu8)Iy}~ zN^eZFPeQcCO+mP7SeOp(1>nD`FFkRXZ`;ZUjwsuwK zmA-o5G-r`fKbQhW4sX~KC%0L~NfuO|;jeq(wucipgBi-optEZWl(RX4KMFVj?2k9tCK3Rr?oy?^d|LWtOrG@#0iMH;; zxDZkg&&$FfNDU6j<W2GCi z=sDF6H^^`$r<-RdzVF_Ki^u`o1)xzeevY0KH?6R`eJSZWYT7M835Eo5?1~D+FtBDb zL~k~YN7xDVC~#iO4CiVfp$hnUAYbZ?1B0lx>$j8AG=bWTX!kZh(}q|u6%?u^dBV(}9%U#Vb254KbUpqsA`ohT9sjni_~OPd=+X)@PvK%_>@ZX(Q)cfo?`+EDjp$!Gzc-YEUWd_b!Jxn| zl{tnJbxoboFEW3$DgXk4l~wEP$nTlltWu$vAMH_eU$J&@K%t$7*}Mg&kzV-qL!QY? zbr~c!)R_QKW($9A2j@IH+iJn%gBbJ^nUQf~`G=W@Wb*Xk#_->)AOC0@r|UZ~mTdV4 zd%_^j7&$ zB(O!bv+jwqp6Nf^KIVvE&y9g){RqG%GkxStS(hHLN@o zqsHC;*`)d!nTh>SJpWclSO_E3xeK5=eCSHjjCOnzJzVjbDvApDWf)a82d*wST)$p| zLDb(n$d=$wu4X+5KPnM}n<4IFm>I+Z*g+hTpamZJYW%4!hkSf0}H}}gEYzPzaH+(f&-{tmc8NJ zg_!r~H{fimZc)xu`wxifQga3R_)km!vl&JCR&GQB>YXwmcF3)nrT=;mGXw6vyC>`<-+L@QQEb9BBQLJDb26_=zEU?qJWv=zkjK`Jt>i>R>+4G*3s6mh<8o>fbgi&! zrS`J^{w)Bhl%v-5gKS%nm~vd9NuFJqIb@Xgc(}s+NLzeiljj*0#6C zaa@*wlG|#^3_bmmA0qeoY$4qx>GrKVGWKVp!GurtiB`*I*dAA@CtRAf0Yb4 z)RCR~zmb-`$lLV)hX~K&D6ci!9Atp-9L7yK0af^=i!bF3^qW|dD&p=Q%UvB-O3!_h zJ(SN+*KmyL+*t^aVCwuKXD@GA-Ip`gvd19E3gb4Zmk0O2{*2K34IF2|eTC`pFq{Yg zAynRWEjgtWR9v6Isg@uir#!a+vp~~kA=WPTqE^S9`6mpW;J$%vF?33b!)VdngVhmB zNf{%NNv0UzHWyP52hZ#u;8q`aIr^`Hs3tqjDEiHP((>VAEt>+GL@rGM&1*T@J4 zyPRm#MN$V7)V+Tc#exzqqxoN+V^eY}=&q zCVd8;Q)iT+&cMB36&#?<6?=ZM`CGz*gPVY@hGUFLVS(2n<-qYT%bhQG>zp7MV!pu3 z&uhds#M=C& z>|5OQenXb<$>t&+zq_#%-WCvj(HEbVbM<>`ZWziBt+oWYc`T z2JSe1CcX3c2Fbv#$z6h&ts7v9QS$t$@I8*MRZ<^55x?EUDuzJxj->PVGKg8Ycp(_} z3w&eV)AsZf6u5a&-E!)FBW_*er8^tLaR~vR zPJSl-eS+P*N7n7@g*j`YDQI6`fkSXl5A7P*4aP`oi7JD61LFS>C6N8keJ2SOeFVet z0+GM}X5EsLDM%MAbHVI^o zNDb1VfGD8U5DF-zfPf&K0+JF^LkNhZq;yE9AYJDf-FyGOeZF)({GbBH2Z`p*HB(4=&De zeMk+ceWHLL;`<}~Rs}FDG`vC^Bh!j|3>Ozn5Y_yUJTaec7UE)g-T-47y-AaLKhpo| zQE6@+E6ydV)LR27+}RUQ4R<^xgn#1>9RX@^xIxe*xyo_q2N={OS}pYHcYSe81>r!Y zI=FB{^AV)r)puAL1#`U}4x148zX<$I?C56-y)$Q$+P_I`CsY-LiB$kVcWwysd9V#6 zmGn$@K!R|}Crkz-0HeacNvhN3{KabVb>gdtNZcmu6lK4riZfX}&C6q+&I))d4MJRU z$tP;d1Z|pc4hy4eX50e70B zUT^rOhp~1GE_)=194&sfVUjz08kF-ee8#YbO(Ngb2>ChH#_55w$wh}u?9I-Mh}nry zF^dYFMBb6Kjb>}vXFJxHUu-rk7DwPT`tQ_R6Y-%et8pxGE)~8#ga5itRun43q!xCQ z>hoewDu7}0@}K{5{QqkTyRucZy*HxvQ<_xt3=CoFV9{h)Ox9%&^cCH2)=<%?3h=Jn zQwY|u-x&M+(n_)AB{j*vK@9eXr*F8(#Nq3!IOo57f0H2@l^>YVjUoA&EBjv9QB0)W z#l{J3%nUZAdecz|+nG=TjOXHi2!B*WU)yb>6)^SZ?`wE*z=IKoXSwP}p^cuALiS)R z4Z2Exd0h<^=5+*sEeH*b+M&j< z9uOI?-~S#uapm|~N9h5D{CX^JaDuR5ht`oqocSt~LXhI%O}4D`53?bAfLtlOlg`D5 zd+TN6pmx&+RdNn~!_)5`uV)9t=eutJcDKliJGkj|p8foHsmXVBGM29`lYts>Vu23y z3i0o4i_O}(I!j3U&fDdATkML>FGMQfK6^tK32!pUf+Y_O$~ui;R_v|_=gQG08Dc54Gi-IG>8}`hAbgsc@2BAHGvLzU025H-q0Pr z(`}dOhRF)*$0rstRo}#D(8fw~L!6?U#86v`mrQ>_5>CLil|(tAAZ3@fCps_VDI7+c z5V+XEto~cy<;5uBuEhWmaAGWLYT3H~80lwbAQZn}Lx)elJF@DKs=S*leWWz?nNlDC zY^Ln*E$AV)b>OHI;eWQ;K_6_t4XlCB#3$)XUxEt2zJ1ihwtIr?*01m zcOpo<5};oLP1HE3-JPK(OOoI9&S@;Cd zVlWxp+C4%VwA2B4TjZaHj_r2Bz|AE@$K7$9+MtlZzkwncZv<^E)Ji%d6I}jS%V81L z7lhyFXZvSkZA&5YpG@gGylWRyWkDCq@LD8CjX#5YesfxD{+*ltrd`Z10UuIzNc)?+G5 zxKvv4Eb`3Ny<(|>{-KSAR5;m3!8XvpK{3EN0_%VBIt9O=XG&++#KjT<)!?-sh(?JA z-U@*4%kr9?MF7orjvhGNFUuxo(Mpj9wr8-IYS;5gJTlZZ!I8TEG_&(@o@8FqPlO4q z_wNGYZf}j7k<-4%}nxJxzF zcVEJ=SU0=u@e0XeL%>f!AFX6Y*Wnj*#|dq4AC zZTQK`hl6qkqn?|0;CT(-c2ga>Z7~`> zGXctV%af@Q3+9e)Of>WJW!B@xBpWfmQ+W2qQrh|1NqJuhstNX~{Qo@xWC6Ky|3r;@ zA{~fRiA%iE7Kp@gQUsGv9$4}4d4)5bG2K>H#!di-A#FO$sKu>1(PX?>Fdpyt>K7XI zrza`N32?qnAVtD6NE!UH!PP}|P8S#$Xn*MX8inf&U!=)F-j!7vILoQD`)|le z)NRn_iXvZ6>6E^Oz1yqC?k^hs)XV3=A%`^xa&W%v17`D@`(V@Pa(95PI=_(hvynU$b29^Mk4*3~YCX4pxcADmkI4q-ZEw3e_Gi>QI8MrYw(BYh zS1721S^?kg@3(VH}KT`N@Ej*d*b=4_rAw{0x zl2qn~^VXy=11GfY{>VYtjZI3QLm>y;>2HTDf?UtOaM!9!IFw}$X7;HicgF+p{9X;~r-Bg;GmVU|uj99gIemnzTS?_jJO&BoDCMs^ z4wevc-YYP$DhT53Vtxqd=T1Q(8zTlL-#+xx zcDC?z6-EI84G<*$1?Q&UPe~QL5Wn()T>2!FB2)YSW7*Mi06_7xg@cQv&khOW3aHLB z@YI!tCH`cl9xbyWcG@^QuFp8# zCCvx9Mt5nw`qE7l<%IZHfQc`9o(XIvlvE;(0+}ha5u{9t#1Gh5Dh3OUm1axPFIfKk z{xe{9Zvx|eys0l_gUfMCI$!;?`*QhK&I9I0JH&AYMP=|4u;SAsZ~~5C9lh2?{_DSu6dCNW zkq_mSr(ir2*Ja{71B@OIm0Z{92d{5)z;b;(=>*_aUYM2NR(*e0>znzR7%kaZ)-*Hr zk|MyE-A%~LOUU9F?e;qb_d!3PXH>PM`vXn_7GHPx9rjURaw%4?$od$4Wv)}dI5yNu zAy|A4wv2w@s@O+73WkL2qd5}D10tz7)d#<5{?6BW1e237C3kh_GaXH!I|oWh`=cF~ zn#r!j@@f|Zzr82O-zr#PDqycbDLh0LrYsL{IJ6NTNP6$f;kwO8kb?wZGjMbmR~m>dB`u zAm+UxDXT-x$mmR4@=`?mA38=QG9+*!-Vq!&eb52I9g?NlLh@E3c_D>U2rHOL__-6d zN!ouZbTUpg#@^Eus*Uelfl)0YV>`0sKz~K`B>!~$wiHsglL^?rmj{wy7VG)YS3F&C zp9Z|j!>cf(F!!~0MM-38==5J5BJ!y|)=V0mH)ZRtD5q>aZEn$CsQ%iiZv?Ml ze>eEMO-J-i!sc!QW}mcTf%ZVO7F$|XtOM008uZIxA4w(biegx?lavDOz)W|ZY;z>) zoUBP>$#Zc1KG;S)NuqqW3wDBR11JTAsgd&GxJ#pP3}5#6FKZSBmV1b-a2yu9l{f9UUVuobf&M&_F+6$u{3kg!R&H7}UJ8KI0KOn}HB{D>*@b5K7At^eG4uFB zf>D3@*FKNoLT)#v?kdS8VrE!~biaF^>36!O7rv0koLx4X`oddG2zB%sWZWW*%gYg3 z@>PiyAJ%h99ILx-x$C!xfdz$NO7OpBTiUHy`7fkA|i=RO-(PZbTPUQ6= zZ1@pY4>G!c*_UPB)PU^*DMutgbxXo2MB9Eo`LtR1Q@Z*;%?yzH7d}+ZSTo{-B!zrt zO7ic1m37(YJ0AHic!Y6w&Yda4gI28H=rR3iXZCmH6z97hkk3rt@NVqhw2UcEM}hoCGp$uJro^qL%o5BuF)j3UA*)c@NeeLGfKOQd=f>;#xJ#Dlj9vz zgB@SC*iiJiGqrmAD~Y7O?m|Up4p**-d-XZ(PCS;&uHl3VFZK-SCB1}l8B~7eruxr* zE}huuupx$ie0yLhxh_V-#H0ys{H6K{R$7$cGtodbNFx8uh`H7IGOl--(>2HLv7Di& zzrOj^`}-$FJkph-7QNWHme{D_-w7cz{w^Zec=Ftbxd!t4mB?)>^K+j!jOM$JsW8)3 z`u}+o;;{I~A=Yq%7ibWz#bISceFafzIb&svijcYZesJ2JlVHSA3w_^CX}kSQTGPb! zp3fp$ZFe7<#PdV6kO?MmX59bR8x^mm>&aHU_scbiDuOQ+-TyqtqM%ynN@}0fo96qR z3jWTj{UWEyrA{+O?tSN@SA$(RIljZEAH+06?_RyoR-4RX7^Uc2Zro4RG}o(Ld=dN$ zsL^xJ-Gwi!kaM#>EF2>`2qL5!9Ijo`>krB%gjcUul&boDrjc*(sr)2BD(#b6PDMTD z`#sl%4P}k99YYI6F;geVnU}!5#@SFVJTH+@CqfNv0)sdSS)l;mQK7GXqL*W(*dB6K zhg+YIoemeCg^^GD%#*$^q~(8bc_JH=K_tty=__zN=ysAQ|f zFIUQN%)2%+S5aPGww>ux#F5ohlTA>EASSB1n{HPspw0ZF^_@@KE2q!I9yQ-OHd)Z~ z+KV&HQ#gChsODx;RDI|*_Czx0olziu-9G)$r+YC~@CL@qx0y9lnvZDl$)5*(54kwt zmvrCfi=e&!zBgj(zRbC}%)o|&$Loo@r)t7Aq!o$}2ZQ)uE_EdN z#4biG@0L_&^Ify}SQK3KXuQqr{a!$G=UscozKiRfnG=F(R9u=rvaadru6uR7SS1bo z&c&>i{h`)Frv;zXXzko;m->s_F8*hyftPMT%fTIyB>pDp7a4J8)wyW+-H)c1(ujGA zUjzNa0?z@j=@W%0suWHq@Rz(%Z?nJ3kmvRox$Mr4@Pjo(veRep_ zx}#rbFihsXj|h4@9Y-2q4U1;5!{_j`@D@Wsjvr`Ah7 zT@`0TQG~&=)mQIc64cc4^nC?P^vYK45ldIK>Yq1sO%tg2%7=P6jcOAa{AT;!Xx4O~ zldkwIBw=3aCGbt=w44lngVQ zd<;BF+Nj^O_tJpmBOwbmI6FRF*5DJH$ZuiaE_rV=&FZZjb^UYQf4KLa8^$#Y69)qJ ziK}%EdS5aO?(CpGhva1;FhH$_Z(ufv1 z^@`qCDoD@A-G<)b^tFDAIihMN^f{*yFwFv>CA!$brEfX?NGnx1#v?!No}t5GE&FI$ zz_Z?aZ_livWEH*jA^sF4T$^rmKDpdgMB150_Cn&9v8q8TxHE;2D-L3}>IHXDZ`$PA z=QEO&$nI?cLJ08hi=h|nt0C0I5v%RA>K$f3;AmuA?wH}S+vPVuv)ruSXLT)Z>i(F# zYQ9KgDiC^hy1mCWMN)Df_s{#r;hRA3hD^ZBaA_r@9uf^OCrpn$T|?-s_3=r0EMuB~ z*1aHJnQ2lQ{?bE+8VblaZRDBHP32d=5wdB_x`<01W5CaxOFm@!U`V8QtMMYh&$RwM zz%x8d{J8Ioe<~5E*@AE!2De7e0 za%*_GG+M30?j%9hCx`F?j;$r+-4wldang4~e{|&`AML@{aD^nE|H(TqYq9#1?&-p6 zo8wdScw+H{*ZX@5-vn({Y{3G6+GHm&iV7GC*qEoGg~}6u8Tu(1&7?H>t)Bi5 zQ>K(q+F20L#kVyqm~{#|U0AL3q#>aS+5VoGh6%cn27v_s0Z!^gm)LepL&Mp#Invh< zN_dN)9GO-F3r~<6%ZyOVikW+(h4asn?>Bdqx`RINN!PY$W6m7j@g6g($g%jF3GpVg zd{W3Wi|<3|@Ar5NZTT&z#wu=D_?}&##nbcbjW?gG4w&9rdLgu?G)_L(v^rF@=2W1c z-xWRrz;WA?eL6adZ}V`%;U`vZKH>$K*4XFRh1pEMOjrTgJg1OxpppU)%qSN*pDka$d7%W^sCbW zM+x&@=#do}AqC;x&lO$xico@VNBB{uKvk)juy5nDHO|ZW;_-qOk@1@6HU4tg{1Duq zSeqIQb`eG0^+CyKk$_X$b6B0nu#%5}Sef?#NBw(R(yP)SBs`a<`Y>aYl=CTqaI4|$ z#=SzLfOdr$6gHptvnn3_@B>ll<65s3O0!qhtqWeCzbKd8)+dBbvOa}yu;+qa67`6qn@DOukobe5_#k}4k9;QegbV|8XVP*6o~BXELP zAVQo!2%V%h)M*LX{EPWQWdUQzbs#J(EE&Pg#uf=`K z;Vgljt<7@ktCB{SO#JNPW~@w(vyb>jM^+Pw(#I2+e(%?P|3&NRjX+`(in8taG^}E8Amr{L!*u@a|Wmr}Xlqn1nwyy|OS*g>{@ zsVm$6V5OV>dQWD?r@jy#f}m@YKw_)u;Vj(mcd^ZPQDA`cXJt=tlaiOCgdP@a-PiuZ zrr^Rzm5GnA(lFt4K(J?S>7Op|Q? zCNHGa$G&_RM#cE2gKL$v>AkBQ3nx4K1wqA8hn=l5hMU6Gwt;y%(Hm>!r`Xr4J*2z! zX4JrYH9r>-?*ILaSpptlc_7EPqJ*J0g?;)3mxnG@Tnu&EtrO1Idkao^1k(A~z9Sly zZd<=^{8@VRAGGRyIEi~q2;}(q)b_% z)WJgg{^P+~jVa%g#_(wd7cy4sq;Nxpm@!|+J&MD_%KN24R>SN1lc~c|K18s?)bo>N zio4owJkNP7N+}n%OXZ!;PJNEV`E_w>zqIzo$v24z+@B)9GP*_CC13*msSkK&wbY1x zfS?Nch8CZSY2hi|7rC! z<1HW1FQ>4fDqxra*=*l^MXX7jGI#JEp(e^4=#j;^LWG0J#{7*hXW>UsgHZf{!cb_A zow5JbR)f1fpA8s7k%#SROCQd&;`v^qfee81%b*UqQJML;O=*HI#*0QG-d732tmV{I!Bg0X|g+jvvHzgl~=lh^&x|JA!Z!*sp6<5w?-9*HI{Pp{sNofY7qo0U7dbn+hytOJ!e$TE<*6=~7Fgms*AQS(l zZq7iv)-zH-;;g!^o2SjXzo(=sUm-_X&uA$1(_u{3fKXoX_B!;=!eQid!+&C?|0Np3 z(Q^794TU_{aZwfPgpZ(VT=}v0?pF8vdW(ke#PqNhiCG!C(pf?;`vp@Xk6aC@;vEDxmk)P1f4ZjO} zA`>tt*j8{$K2mSY)(`#*Xr&Zbd?|#8a9c@Q;n5AfthhynRY)*r;f17s|%?M zZGR#%(wrH}rc2(^@8;OAinSBFs$rwS(~uY*dGELPp#9K}8g{tp6ltFhS7H$fFAY99 zQ)|H`=?_w(7k9DKcH>=^-v1^0%MTmFC}YV7A7UJKR!o&GclmD{cv&`tjwAl7g_g`v0E_uA_16rbH5d=5uR`D&w;0`i;Aym zB3LbY(cq{d(*o!)wJoYH#Cj|{4lX^Tw zFFPR)Cz7lu;vjYee z8+X!M?Mug9;=o2EZ@Fw~wx{nY68iax{z#DPbk{c!K(i@06NXMvJsb|^)J&EKwENs+ zz8Xf+MPJP?@B*kzNRdHB_T@Lnk&l@N?!DynfAFzE%T>6M;dSa%oZ*IH39m{ne#;FpI{rL#n;ppj5&`*^LV;M0{KiDOkRy-9LSZ_Dia z9~8Kvh6(VCGAf(CO3(V?u*$VoyUpwU_sE$nQT~j06(k{1>1s0rWB7Km>je-6wyWt` zco)eDYFrUQq3`OLB^@6yqsDSGC4PYz<@4QCOJ{x@b1u!~G+>^wTCb3prAjjIPLX-t zaB)uHm|H3GGWx}lI?(TJIUN6SNZzA7z;E_VJ2$jAi>hi`e7(bo@WR2lY7Exsd>kBS zRH*Qa17I)z?GixqGFrfgBmksy)QDxWtB`?Am1OUlLFrw?Kn^JU;c_4Aqv>#e0b(Da zt)QQ4-$IWvP5(!GcmFZn*KhAQ|66;A8W8 zaBz?Hz#N_LFu+;yc;T+z;+8X+OM`^bq{W^0l21Q2qf+P#*q*NKKOyRvA!@1v`FW~R z=c)B;P}E1qG4^22?R4F2VjdQpH|DToR)tr(es~l*!U{OqYJ=n}@T-@yZ(f7xUW&~T z%MJzNB;Bn1Kc8-8u`kGN@hv?rukk#1RK}XL-nF~FIXTel?YY&JnCNahuMC14nXEt# zor=KgauM*8emg)ABHwAB11WdZ$h)fuSeOE4lM&roaqVdkG0soCw9T760tmu8X+cwa zCQnx4)t;#3A1D|tj0^h<%q)-+aF~60qEqB3iVdf$c>?)7Z81J!w2Gmx(iG^qvpV(*6k?*x3shr z>&DBJ(0a&1d&yuM$PXXngxwV{DQJB+H`<$9NhhA2)%ooB zMP!#~g|^+;9O1w=IParyo6gv8b(G3 z%Dr##9l*1Hg{Hu$6vmwJB1YhMZRh*zyh+y@&W{;-uuHK%tkXK4bD*eEDwoF9-McKJayd&>nhkP;Hf516u9Yf{y2FAxR?_i zR8$Ufsrk)y)SrnL{G1g;ak`rEtce1?e3tAew*u zCZrLZdt)XZ0x6Ey-}9Q+!HI?A1+Fc1z$q&^A53h=d7W%jNmtH2B%nDZkAxYyxNTtUeKTm3{e|Ztx3s#;|%IUev_?Y^eyNhd8amn8%k& zQ5eG|-}^=ry{|T7nHqr{*xbGt~wyeFy8UvKu%#G^2)ln_)EOUMU~Q zx+7XH^@C)jNM}M(_$Hls8VGLeO2z8g=Es{xz_B}V1%3RqlDxaX7A1@X1RbWJP??L1D`8K+>s?q)+gclo61TP0-9T zEtP0!anV#oP|W$0xSFrwbR&~r&Z3It&b?^ObY|0M-%NkJcU7gJqO8iI+O=t(Hb?VA zTkR#3qC#pPEh-leA;mZ2`&!=ceF-kEW?Y7S>3N&~sn22`2%L45Xpx6&@ePj{#h$3Jqh2mnA$8OJ#m^k45l;l{2O0;r z@cmmc1(t6}p^KiFLMjLGAr=;Tw7xs94Vxz}4uW<&038Njr1lIf#_!=Vs(=33O*_V$ z?nnS}h>K(Y0|@<@RB$1FP*`+y3wMSbjax$655Z?N-mv14!}{Rh)NJ)=2A*X@&cNT5 zM{ijXSNUO{70>RBM^&WIBN1bu8)SCz8zc67PM|1phmqK-TW>aCUG#$XcZ~lcdKesM zAu!`qdyY)m2b!B>ot9szz{QUI{RSQl_6{^r6cq&)N@74`z#95 zLj)yvC~(2QkZ}J}{QDKLLFn4!>FYb*gR}bA?8roZ{JIU=seXO6cuw>e=0 zD)eig>RARp7&}k3rhj_s@}+K-d*(!mySrYXhUm=&@|0ldLP`QQdXf2-8cZ`RpV`ns zd2>|nE;3-DQLnR%Si!5j%p;rg^9o)vr#t=KR0)~v-uS7dOtdd!;HAIcN`CNShhdvA zAWaNsM*09)zhfl&BDC@ni9~l*gjlo`t2&i1EU}mW28Uzh5UnFnC{>z&H0e8oKwSt! z@d+#lGd-t)G6V^I_HPR@djrXwq0VKp)gc;}$Hs%dm4QNbsq`7|5&E*0u56I}X<6e?-Z?=ih0+SKEs z^8ScjZa%XU9xZjn2_|sv)BlNxl>U+uh_RgUNtT)}wh-GGuZl{$oCowADz#EzhG_q& zqW)YPXmG@BWncj;k-q9(@?ary(}@CEhu@<}K+cr)Xi|1&$H1jmS})1``3lEyXtI=N zWW&j()aCEzY6ADcY`Te?Lxp@W>3=vYA89~)c_anTPL>$ZY3y^I@OH87 zOcW)!c-e65n6e;oMmrA9d578N+xk_Hu8@_7yOGk18O=U@)fP^tQEun2i6m0MR+SAG zP3yaFDgw#itk^RuIE*v^ymczTz_WN!#l&!)`Lld!rf*bILspL*c20(G-CIu?W(-{P ziANyrw%GarR*q@8AwfufR%DV+xV*Y6MB?I~4T7g`#$4W2Y4~I%;MBk*^E~`mFLl z?U#}w<#L+m8MWE*0_CLcsxQ*u$fIlen-7RL%1Zco`->Yp?#5_oOu=BDPSAW$(6=B= zAEu<-=DTe$3@kZ`iwnmq9KPFZ8}IQN_S;a`SAVo zpci*OOX?`l_go0an)`jg#%amkw76$WAHMzP#v1;?-*Kpx5PI*!ZA;~Qd3zvyElYn& zEgzKT4T30H$I%j2;FLBf%HcvLe9#Nzxx#BHy+xj^(+qP~s2s=ni%ZIts!BD{yJ0{L)Hb0;~~0sozIZj)xX>w$nu1&=oV^ zEGDKZoqs;aDm1H&#KXqXbK5p1;GwZu)eq55BtV}n)Y_08i?iJh&FI%h(zcqlTKZDHk@{x(7a^9n-a+wu_!=IL|z=ny%?1~7cBRs=tU3` z${{baI_LiWv^w^T!Jty&@vk%>?JBEhmL&oqhuNS==vvGjO-Imog@wW;kE6oFQH^M@ zljp9zz=C0GaVVfPC@t{di3_k9HlKltsw5`hFW<~HEKYGeL9tdIDRJ9l0q^xZc@RdZ zqh6Dx5)*jVmAr(RW)(gIJiA2+LBExjYU4ILS_n;3sSI3~nh*CFo26t+%=&#JN1vjVVt}YS!-xOniHP(yUc^;m zm=N*#-bkt&eEVdxHuZWC()xuiGwgf{e_0hb`WW?RD;zWW-yl^0fYeaSg31TylD+G# zb}8wa?Mkdzlsd7_KGQ?ny&*pz%@`Z)=Q33>dkQgp7?Cm2#sijA=M2jFpixsF& z{5z}N14KFxCoo#`J$?4*q~KA+)fggx!EY6~YFOy^jsPP?3V z;c`kg&*20X2*F`_jd!s3`s)Z?fd-{6os2?>)Q4tNg#o*>{4 zq!B`V44>9W>0SR{Cj|=v14mAiuy8_0HsUInQhaD?c6;^U)>LO!YfGSXw;`5+0Q{~j z90dz?!beic?@UI-j+Se|Alf=E#fDswZ30!*KXO{WcT@g;kET%h(;J4y5*VmT z+hy`EAp4MV8O{Deuh~+;z&%#%A2?>f5ypY9{uCi7=SJ%k}i z(T&@rFFkHS+bw22F?5V`(4a~G%!!*g;~H5OQDadZ`syweuD$)4N6(aL5VuLs?lT@uyZ# zuR<&dud0;%gf4?evw4VXu2&=>Ore32t9?9GKxnJFnJfkKil^!64KKh z9WDXyd_Q29B#IwRO8%L9E%>-eaSIu5Z> z5ZTtZ*lSdxFd^ImnjAbF43AbW>khLfF3HtEWC_SJeD!K|b+-f^R{X1|2l#dp2wB%% z)YVBuHvtiq1He30!U$lQjMpH1Jiza=2hEt!Vin}Qi5((;kd9qT?BX)@!_f#dEHa+-V@~b;HGjR#X zc#67^H}b_Cc3@5-+D-L!o6M=GZLCHxC}$#3ZYMy>95f7xfgI4wr*^oYGs~j;m&Rr!v0sP6!4^O1Lj- z19xy9sD|JRHHuTYAIB4SO-w8nG{l&2uxKc}<@Y^a(Z65+{Q8nz?>Xe8DP$K;8aN32 zJ$V2r@@3iAJ!FU>QDC8?!1xb;Xob&2hWZ=?quFsVdbrnQ1VOYcP@g#FmHQ@=?;lwu zr3wa1Hc%RT0&K8O_~Qhf%l_vemspq`ucdkQGk6|WCj!c`UL7n)tTQ~0$GCzrIISd_ z`|m6OhA8H~wSu3`lr@eV7}0@7}WIHp~*mM(>0K5#j`Vt77BK=OYe&_~FS(?cF8Es_d` zI|v_t=ImT}KV4-dOFXr||ICq;3r>f~QR7NRp(Khn|bnHW?Tmgm6I&JMjmJ`Lg-;YfnzpK$eF?%gfY5kSF`~ zsDu+C3v&1E5V{Gy0F@VgRC~{Y6hatrLoi!sk?7a}G&?goR`~L?GGUV2g9N$fK^i8- zy1%bXof`=L3ecv0T1Sz*J);%yFbFk;(k!XJ=`rS)gG%};9H=f&mcfBN?R!T^PUiDHAsaFx z%Lw!vR+>P0hz;epzdSoD_e*1D#0D5}5O+x-=`N7Dk~9<7c>WXhH5AL$YBdE4^!k3V z+Y2kpn~#`j#sBQ_gG&d8MZ^ zj)UBrum%Ri9Q>tW#d6DFsg=t2PoRrc`8Bn#Mz5?%>Ucl|^T!?V$kHzu78*58ow_2P zavc()7QzY0#SlUYXb_CsswfXmDKCyFX?uJ>P|l)9pX)5*j+fe;o&;)87!I>XSYNht^`w z5k0S+_*VUqtf|W)tGwlUfY)DB39;3+Tlass(trJiJCmTrJ~D-Ao;Vl&F#( zW{ASG{HCsbri4Zh%mEIn+xRg*cJ>AHr&WmME@r0Xt%N&uKP*Av&g~J9yB(eR6Hw*j zIyGs7kho%7h@$ws+>L#gMtoe@fQYC+2|=YJ?_%+8m!{9+?AnvO`EIhOUr1;xIC&Sz zrKFkoKt)%D&3T?n`;0J6t@LE^(SYyNqO`@QJu<=rNhIII3u1e`65<)~)HR<@;>2v> zyh0C+ZS?p{$P@6l5U~Ka?e;)7+L76OK44u!*0yUD-c4=t3lK@>$@Le6j@)#-O}~3% zPyv&8pq}c5h_O$6cxLP;Je(zjdb7XX;W;V9?6D|zPz(LF6Jy1` z;+JS~9Q>c8TECtI{eW+$UYv%2>r>t6GuJ!JDFsPK%oyo2?x3=OyP?9{JyK@&&B4D{ zRVRo7B)h!k6|Gwpf*#CebJ-~ZJsn`Vguh9^SELZg5?Mm+WGHB6_~hX$g=-KCqHC)D zMBLBkK`=CUyTiP1wnas{K^x!Z!=DiMm1*A*V{X$5Clzw(ZAc^ekT8V1k~ec8)qB%e zHy~XcHq#Uo^5ikbpKXTRTodsIA4?Wx*=KZ4fMe&$wC@4ON78(3fGL<&*pU^SXqSeg zm!-G6K&c^t6w$z%pD2>0y>3U&=di?^;@rFhrEq@Bcu*qm0lpVotQ#A*mm}`8(B~m> zG8t>n*bDCia!`;%NPWjZENv%*oO#nrTH>*FE?5>%yFI(cjmQ#%gOB~krqNF1O?x~D zlVZd=6F}f&$C)>O2SQ8M0xQ#L!Qp!O3MfVT4-*^sYBBy@PpX`jQixwx1+90DDFCp` zpkI3lS(U5#Atxar09gJXDZTD1Fx1*CH>o18t~(i5VJ5X{g0C!7J!JR!O~Cv_wCyqI zj?Q*uF05b-$p^5G@&3W#Z!7&QRf=Qqf5mlrGu8tvp^uG|dc*#43Mf|X0jV%y20CPy z0ljG5gdY&oaQJ|X-@GoN%=()m;A*o$!Y@UqynWMYA59=K08m593GC`OS+cN9FWDx@ za#gwBb_zhz;D%d$M>Q0Mjo1YBvbVsj!g{5LR*`nG`pJs!oYuZD4zAe4l-UNr zrnHN^pHC3ZbO0yL1alkOtv5k92z1r-(7&EF~w79(}O2+WyuX3Vi z&Tb#dy4!uxn;zE?zRm)726^-u8DEa2ZMk@z4wUPMaLOfpk4Z#dfpTlx3Di|o;eS!M z<-_R!m`^;(R3?=O-vBAo4l@|q&ttu+;P$dgxBPK+#L*AfpSxNo+A|uXXoYq6o{cTL zgWi+Day#;cx&*Bkkoj$pre~)NmVGXpQdVsw6Ivj);Zo-N{DcF=W?Ik(shlVEXu|8B z04Xs)cu4d}PXB>tb;_6!MlQl0}~W^c#=SQPaF4IHyO+i8R=Q)jr;kB~*= zw3t-IB-Jw8?oM@z7iROFt%}5AbRhIIqohRWMgS^Y?yTYs>L%W&*EE9t12<){=3>_P zmgbLc_q*R;ER@RZ4aS_-D@UxFGLz7CF~5HgXf9D%MDxz^8h=EkD~D=!EHnM8JjS&@VE z5a~}a_NuY6uKXFXK9hd3j07TyH=qta&ESR9Gd>g<=ziu304Q9{q|*705&voe7KP8= z^9EY?8j`7*C8+ro-J6zm1brB|WbB)JxKD47*GGUjztSg}uu@RmpxfL8(}a8Hji;wg@|Fbb3HNcW5Pxbp(jMk1!2oiU8{$y)JdvDc}Pt~l>OIXwQh%y|}aRY;@ zTRTs7?{k6xqde64nWv!J7jIb4=UHtfr7i*Qt-?xh7PSc$k~OI|F~;*5ck)i+lhT*8 zFw+v~kA$%b`S-o!mt*KgEs*};arsl6DEC8HIe}EnGR4C0h@wY_I)pFq3jW3DW#H1h%gdavu0mrtR-tG zLP$j+iY(a%McK3O`@YM*jpseS-}`><<2ioE@9#ut=5t-w`8v-NB$VD$P$y~kob!R# zAZMsH68#UI^Zw8kU2nHaHxb{Tr0Y$LC2y8mp=53>v?8nJ_0K{HxXd(PH49k&Yxc!f zt0RyUW=^Pa$%=D%qm~E5YcMa2;7H7GR!vB^f^$o~*O-zG^dtqvmLen-1QKtHT^D6G zgzekfDY534FJJz;P)R&13lPuBbgTuVLFyXUzWVX@g6!L$(TS&5j+AGqHzw1#NgmGLsL z14TrN(2dsxn2F!-G6vm_gB?lNel&91`iiTYfqTKN4^g^3x#`USiP%+I3%1gjyi;g( z!y91M@%pEDlVyfV*dFBGRJj+#F3+W4ZVIVskThJ|C`0whA!|sy)~fN2mebm=(3>st z5|32JK7_y@Um5x5GKheyeS~4fzJWF>3e!EiiZAEG1~_$WNU6Rn?>u?aE!_AvO5Ugd z!$0^uGxOlf4tOpyG8O*P0Nd&q>pv- z4Sp6z!LyzI5-ZKJ_~`C z>Ub}>A*J22H^2Cx?Vy6pjH_|1p0tM3QJnHo$yH9{aG!MzXl|%XItv%u@Pm3{5qRAf z_lA)75B|eWVgWjp|R&u9-o`&g2jIuw+mplc&Uw~9!^kP9^-kkdo5gA=xC#D4{=jL zRBQk&8wa&%%*|%1OHaOM-OSZ9zaw`*jp+_g0JSK|i-MAV`Wj@EnemkBkEC}6JIszstYgFBt)5o@m652DRXnrbJ@Z(h8%B=ZlT#WRlB@_T zPljjdq;-2gude+L1kEH)k`kjQ4EGf&Foj={a=ZP97l{_B@%OU-==#ZWO{*H$Mdr)k zRE!;|#PD$Xs)EW0Ma!>-4qS&1TVE}XX+l%!=Mc0zb^QNR5k4GI)GdL#iogdXTA zgxcM?fBB@&9L)tbgQp}~?Y`?J5UQvg3Y=jTWCQ_7IK8LX)Ww&TijvHMe0Q`@!PjYO zpIM`5O%>>A5ee_B?TeqWz0f;JO5*G0Prq+C5i4x=#xvx!8cG-Wlnm`pc5=LaheqTE zW0@3a*j>&G#PHETv>r88Zm5dECv!%9?@?IN_`W=&p{ErmiM4#l9~w}(VV4c#dI$JC zYos^?1=KefG3UmYLY)$M0nkKpXn!piT{2hh1TNTywuk7=|XdscGa{pH$oZ zGjEsuep8kU?yPbV*-$Z|r-VY_)I%uO|9nV^(H_B&srh;aa3kWiF|jtpWr2Zj>^$t0 zT3yFOUH-8+2&-FAa2%8|iKjqahxR#yAU_8kEiY*`Ml36G_WfkSi{C3EnBdT#RQwKp z7bz7^Px4#*!>FK;z6jp|QeuJH{$#Z3?xv{k1nE^hGY!u4e14HRyZD;eullyfQ)}e- zy$vuH$)&I|x+dcf#|Ou*9)&8$pVJDsc0KLtE!Ibb>J1&%*HY%nTEiQ_fTd~@r?U4D z4mh?J-j?A6xq?XM*%dmr_T$f+!l_6&g$7?0NqW{J-P-*aqmSIglW6e8OQjvbFXTw) z_E8A@F8w&QR{DrTZEWGcAk15}AhH8rooXJ*E`mZ1w;QPaPPN~AW{neho(LP6fV<7L zzqujAX8ZtI<4Q&oek&G!@Nu1cyN{`s@CmQW6}Sy}EuN+U%kR+#Z+tom>VJK%ketUf zDi}Wiv__TQMwxw%ek@lL#2*1X73fP?d6*$}tA-)n^NtrxOGpI%s~BWXy;dF`ECFQlh+Tg0ajGV)PQDi=%$q z4(fJ(-#HiUwK7RqDPKiO2B3Vk!C)~T{lR|lSAsa}LH6}G$|2zCV`Z#!9)ZJaqIF=@ z%?AvnnJ!FJ(3d~vP21%Bv=!W$ZUa@Sb+F!iv$Qv!6VDJ7Fv}(t^D#ILcDRBMLX&`u zU?Sw>kQL7CgM)wm`jicP=*c=)@clCYYrx1j8&gSl9w5!4xNUFT^ zAGk&VWlt`|hU6wH7yXj@y_gZc&1c2qg=;nB!x3M`^t7x`NogTgL7hWV#|W2&RvT}? zVJzswu#fMayqru=pWg}Q$@)NKE#Wf|7fND6gM&qA+E*i#W=O_=J&pn+g=Kw&*Zp$$ zNTXukVHch&TtpRvd+-)N1dFC%6k_uiV)FpGwQO3=^X(aRlsWf7{0{4uD;fE7iv;r==?D zf0{GcfH=`fCCf&pdN%d@FV7?;NH0p9pOgjcN=V&fbs3f2LJW^nU`v9yuw~2Zgu$S8 z68`$@BG1d@tk<|4hDu|JT#h;#JpL)bqw_P65Hcx)5xWhZlyUYcqON;P$XjqncvsYVy*P*XK zEeRpy!bx-)8<^Ut5$zqTp3kGAK7i$)eRR0N;bEc##yCwi0G0(dvwJqOjh(;4e2}n9$(KFw%uU|X&PW4zAN5@bH8NYxsKUk zW&~tTx-6d3_k_%m`U(V+KLAnfdYAP9R6X-Yf8m#SK`nQ}icJ*wSIRFalwpm`;`)CV0e-)NvR9q45q&n= zgkPUn`#@-!=xRDX6y~Hd#0>1dx#&Y%TNzwjAKqNM0=RcW2pBB_A8bFr2Z3sU&mCl? zIzPJLv3HeT2q6vmvBzlu1TZ9igNFP;8FP~Xe)D?yhb?pu%oc<#?@1jO6xcQ&N}5$o zxEf$ERg_TnWN>qba-t59Nz9+S=ksz8r+tHCq+(-Z?XNj@FVJKrmYo&+Q}+|_Y>M(S zMW<@2=m6q&CP1C-j4u8(!YObtIp1%7VPxj13x$L64y>UHM0^B0i`KUa)s?-rOLu+7j7Y94VA)@vc79dJ%SD)|lCc7^ z^a%1bLtpO~2h?>s6-ucZJdQ?gZhLu2x~iu0RYm^8^o zPkw8|pH|%f(3*6&e=hB=LWuJy##CYKchpdWgF&m7FFYw|r} zo$K5Kg~~%0*Y~&BAMc9vb%T`l(~~JGe%|}zVZ3u$X>wl+NNdbnUh|d?fEu6t6xoA% z8~BGvz_5v5HZ#fFO)d~pv%`b`*lip5Rn4wrXH1-A6#dhDm~J#BzZzZ`!DR!vJ$D)l z;$~?^O6K~vh-0L<`fk^()y!>*UF)Tbzp3C{bBo&cI5_ukOBo+Ob~akWzvxwUYvDe) zU#?#UV$KwFZS8y*376jf(<&snTtz#X^6&AVDuCw^yYnGpU~%++HXR>Wve&;v&v@lZ zUcl7Osw$QnW==w`CIaeoL`Lrvw$~+bi6S`qK<^vza5m|L}^}ZUA&za65uw*4LABbg!7eGHs;7<{l zkc4;rf@9X4>3&;Nzt?90u-=RZ1K6+}8&%>l2yJwG(R(xZaQx5XZFVRKCzu4*6HYZA z{g3(!_AQA50;VNhi00R_gZk1q0zMnBoEpSp0!+W&>m*u z$IbZ54pesh&0atxQBZ@9HyDMZIN>r2V_vbsZ9&e6Tfz=klj4IQ77iVxQesNXO%6zy zhRlLp$~|R`{98eFAWY3#N;+VSG7?nM_IkN1le_FIU?x^S%hXjY!YKZOmpyt7sqW9DnfDd)epx zR~SK!6jl(i0T zrc}69LIxP|a@Wy!tS5rUVJJ2Mf&y~EltJE{B;=o*EAxpOk<(^>`zHa(V8d_g<3SWAkCw+?~dLK%{mC|Dd_I&lMt-2$AWx9*z!ov z#?_k$YAAv(Di|FO;qnu=Rkyi3{cje=m4k z=-UMG3*A>{*lYp+4Y|en&8jL?cu7;zaaV|68OZ>^ZqzCH3sbI45T8-$ zb`grA^y)9{3vOJxENo6;2^67;xeQ{o%)N(KS?mcjs$B49!`T1OK1E_y?=m77)oQXa zuDChO)0tPIcZ8A|K0icAhd+I~X?XcO5#o13;R85hg;rCLp3kEp7Je0{m0Q|uSKBF} zQboZ0p!V7f)VXiM@#$*k^wQC=$J>Q%AMRB9|0x2Ux`F!XU>)P4SOsyiGH!EPT&_H% zz$dBs^lG#d{{LGAITJ=@Zqf1X*^tn_y24z^!uw<&ID!cdgWG4-k7+oR8>XFE_Q40(05Il$>*34O*H{3) zc?NV4KV9g_t24ii>rYn;VphpQTD$?rrbzEwVrA8jh@I9XN@YZ1HJtN@HjaidRsGq;Tqo} zZ`&0krk{HS&{*$rBo+!44nPPnv?lsny)$2dte4bEmg-kYn zE#rl2uxG0B!^ug}A*sMw{vkii6;!SY0&2MUo9#shy`UIuK|}2!&6N|+NgxEH=kLC8 znR*{hk>Le~S8$De8}5^)mY3`C_a=&(#d*4BN)6)#&el`RJAlwoJZsl;rlK?bMso2X zx8s^CbOgGE-KKugSGn&O11!t*CqRM20lT7|V-V0L?$$*|MRf;$^)z5zl;p`j00K?5 zDs%<|M$;~p#QDc;T;u?QHQ5m<{h}jKA9x#RTV4qu z^p%Sx+^EPiOATyHQxeJdI(5&)YY+>Y($RRrJUgP3e1ncEr@s04@3go| z+b*zbrjbHj&gxcVRG}Q4oYzdsFW=J##Bm!)6)6E7gxjpv#A!2^IBiC=hENXoTS982 zDx`xYtLY#O*hvx;gG?k;#z~k*)%fza;{z~%-sYDLfcZk>w0691IfqaOpqsj1HYzth zGJo12q@i)`4-hNMuK(wP|5cadhQ`){?A+h!Ys8&H4(4fpo%o&w9t)NLcccT>R^oyE zkQTGkBYw*_tfab|%8M`l61OApTPilj3X(f=A~wkG01@s#e#m!Vv@A5@89W3md!JYdZ3(k`db`e;D{K#=JmG&WnPD&`I7y<^mVV zyJC8gPZ+2~-s}f@jeX2|^FWCJsvgU-199^pJU@cU-7yiwXuUC@jq_`{nj2z0RQlz? zW_NdZH3iI|0^KeHT^o{Irsl}{>PvreBTEoO#dAQOsdZJ<-vZS23H$Q6gar_h)Eaik zbY|}FP_LJM+R3E6z0=;VJ8d%>4U)>!|2C%K#YaMEh}gFS{yF!XzfR5KU`YI0vt!<^ zptk_(HYOzar~%6nMz^M2fyMriq0X{l-OmS0=zCw%j-1blK$S=zS=wEw+xI{}cu%N_Gnx3`oU2%{I8Kx|A zoxQzfqJrupU2oT*`_hJc>VQEG~G9-SHMnkvKc84@V=ZAo=;- zt>mKZzp_Rdrdjb)F%vw0MJH&7j?^B+P6mS^bNL+`>3cFf{dpB8xJ7j2(O`ZJ7C+V8 z%v*=kcte~Pf0YQNt_)1D9>3J+TO%)%zUP|kZC0&#mcMr;F>w$AQTk(ZDiR8;wk`PG z^~vF!Umj|FWAs;YE*ol`JAQfmTazw}DucxKTlI8fb+9nHDn>?6PUC{u8`D(gbi%-M z3Dft5+QewcQbAN2XX&e$)hHD9`$77Jak_l;>Fmj)8zAKGe8thxu)F$T5X-}XqWR*e zFsJMv`uORlSH`vs35UVAQ*%( zOqGSO_+XBZCxA#U%okGIJTkwpcqco)NW` zZ&N-6z~zW87e0h$G9cV$~FiwfMh;oB54rZnfgfKApu1cPBxB)@O$M zGeao0*&1@*DSujCmF9z> zom9t*E}&@h6mtTP$99c{wV*6@!-v{n43E)7;(N@la+7sQxsrWKId@Tsq}5;+=9`~* ztTWB!sYZKzRbcAQ&BA94P%c|_C|N_Bx(J>s!_s4Qqy=Z|=5M=Sq(sTKI|lsmrfJb| zog2Hq?gKRe*!?jEW_N!cni&YgRNl!z$@!+4maO@I$e!@v?$2 zW^F0)LQlTwe7*`06YT)lc@Hu$e9n&K_CN2c^zj&U0r>1zqNDLGaE<1>49!BAX)`_U zZIZjkrLM2$jlcapzLpq(Iu`Ry`wqMg`di36+n>8ndV!RBPW|(O%#jTX!VSxj>LIU6 ze-6A;`faY1-+IOXPv4d_DiWbPS{oOfnh#MYzTIbQgl#L!op??mI`|0RRGz$g3RcD@ z<%rAZTliE=-KhUTUWwI5G%is4O3^BBHO0+6Q>7TNXQ2evN?mrvKbTgF-93KQ*vUH! zyYD(k%NAVlE8b5NFU&|x`z6xgJmuKR(c~6hI=>&5VF75D*eF0huF>%>Iz$OX9a zaVw}8{ku?9{-8p$3kL??HJg#qWYpY5FUMh8rOgBrZ)s}2Q~bSs!Qk_KE*B3_$yVer zC^zT=tj|dJ)i8V=(L|hp=kaMf`za^o_|qeoONT`Z&YcO1AlQIe>cxz)3?3X`*<)%x zr^!2-T9G|fIwp2k6((B|fU+0MucM@Ya7ESsu+;oKdU%Qnl8XI733J-rNYHJF1F_n= z5k|7CV^*pM_7}DmS#N+UX+djJ(1wdP{0Q!tZ$fF0uGpO0b}0j{rgN=Ga$@RZ_%rq^ zAbno02wCa9HKkJi1Z)~j3@`?AOam1SHS8lWAQBCvZ)SnVPOo%a zbQAc2+pkGhYJ%ZE1GrGX-lUMZMdaFSAEAh@%E4~OTenQS&RFMznPjL947z%Kqx8zH zz~^`eG}5>^bDVon`nrh%#0jOx3IXmmT_EP_(P!shbj5^(yZ(@;*V|hGX75J3%+U-~ zct-7-q}l7UIR!ArYGA6Mj>m5TpK2|gg{FQ`gOUsa#ZWL2vcapr2iP3T%b<=dRN*y_ zOVNeR;q)wNF!UpWymKv~A}=>@U_&4DG@WzX-(=s;eERH}dHwL)pH0mXHSxfl*lZLQ z#cdK%3e2+2QnN&Jf?a zAo2ed1Jg*rgsmn)AZ`$ecLJT)Tw$A)h?=uJl{nxoy87#9 zfuK_Bj}(yx_L8mS@0y?+&0K8*7#|*;Z2^2=!=&$Ir2dlOeCy#KL*T#dn}t{Z1m$BL zK$xl75H+jf@;g4_V4>whVELY^=aAY1jVnG75`dyEdcstWK)bG+!J(w!`#JbQ2qGbqC#Aq3(G{BnG_UeoR9|<_Z zvl1&qI#lAbz=l_E!)QS&NJl}zk0b#L*wkNOkx-?=&Quk+G;jgqVlxL>^L+Vgl{9Mx zz{u3IM_?pmP8S5W0T%r-BpSpnK&Ip1=~4NJJed9;Ac9MO8o5n} z1Go8)1tr(+ZFKzOna#N1F_!zFfYGq!F_R7+ltol?d~MIsg^Z+OlSr)o0LIeW>k|^LSe-iInX*UGO}V($U5E6?pYKal$ALdA7_9-Gdo@r( z`vDL{>4~RJK*dQE#RPEmgw_c)!|=4hqi3!&{Nr>(a1xzo9yAb}k}~1T*M=Y-_kl~# zS=e{gw&)6BG9;cc#up!&lU>nK1vT0ycX@Ni?F2lVY@DkRE1;XY{=UW|zMK!O91ee* zc~GdI{@^Di6Fd8F0zA*C(ws@Q#PZbsJY0o59gOjlJiwqG$d`^rB5E2S0<6yuCZ@}$ znyT#eBEQ8EGdIHxbHZqvAZ7WMY_Ulc)fbUUW&uZ$9q~g_^5*w5KW|@Dd)u`47d5L9 z2X`QGFGLr-R@%9i`R4w~9S#(7C~U)=O8OTQl=QdOXz)Q`!GrAaeDC<_EZ5rIReAB+ zIe6yPTH}9qC~A5Rl+=YAYkmdZ^S;Cl3Sp0vFQy6fs?&n8fv&#@gSvk`3g5gTQXROo;_A9Ss4hk2V(A!eA*9g-B(hDkz5U;?St zV4vR7{*&@5z8AdG-h;vfAmyc;P)3XE&FO=F!xIUrDTw2p>K#QI0@9-u<@7Bm0?50% zpd@3y`uIq)y1kdxta*GCg`movIM|$TdYuK3-mfgs3}lT2tan!8kwxw^bz?SzlfyNB z=jb5d`Q#k=XgtUp_#+a1{@?%1jPM;1&bd_Kf|lklZ+pdkbH%=dKT*svd2pbDKuEc! zhFanKYIZ?Y!LM2v0+AX@UN&+I8vHU$@Jb#R33VBf5Wm*}2=ksGm>|hUgTGH!F!Py; zzbz^xx;7+_D!mXG(Bw|-1*+}#J?q}j7n6C$UQMWcc={AM&9qxIpxyU6 zgmjn~gGoH-W+Rn1+cly>iyyT;)|v(iiww!1vw`Dv{^56-i27mMJ;P-?2bdl~iX1z} z3-Q8tNzhlM7!%dCg{8Lp`l`J^qaX&2v9+3^i^y#j;ZT|yx4d*=_}foO!dY^QEpi*< zN)u!K+Gls~Nx6U!686f$n){}0R5q{ok~f_5j%b_bL66e7&o_{MW=^oeoa`8ZlsMqk zeXwsu_c(WGYk`}ZXXJQ54Mq1bJ9#~wyfe%Ovhhr`7-YSYOyVXl632o3bQH7@tXct2 z04p|Uw#LR{sgo6Yrg{6EFkiO+R(FMh5UiRO&2f@A$w$gJ_6vda!uBsRS9+PQtu&A@ z8^NVK9K?VtB9Nr3vd?z9b@$I@^{(S=R%;)Y3aWgtxcUQvjC|yb zrRKk1=pzNL$kr@iHC`?Q9Qsb%{z8JGa?tTlo2uiti|Rc#|)wDK!@}nsWRyeWTeHp{Bj=Hp52|4NeMPXMHYY^ zLJYdi6SX^+C!SLC2PArMon{c$`L5Jy)foQ_AlW$+f2RjLwm%uyo-&VJ zjd8y4vdG2+=aces$3QV4a@1^cy-NoW7ump0>x=CHo`I>4BD4IP&LNb{3Mz;|O=2D% zh|+u;Z1^fB0_dlbni#v*Y)5!jEKYF;>LdI0dC?-?t9LQ60*>1hv= zn%9$0DJ)TLw&@#js|KG7r2RM?&LlhTKE8bE(noTe+F+>fu!Xww@$`M*_gJB_yhWZP ze-mV+#sF7~2+E#9T*EOKRR#K~N5T~wSKDhYEEQxnQk(Q?!-fyeAmdj1xgV!ItVyD}6zy^<3s z=(+?F)PkiN0r4ptJ`sRncKR*CM+_B>SwJC;V35c8FX|8%!S{66`Y8zW)AT=5Nlv%% z31yVdjHg727XfEMXL|;(=-GNxiQY0-VQ+Be-5U@1zdMQ52Q2(QO9{5gxN^KX6sR_Z z>==*(h#)Jp?>|p`%u7Tu&la|+NwrYRrcAO(;-%o5Sz%~gM<&RpL9>0OPLzSHh(83 zsu6cMiCMx-+j^bmCJ}Htz>0*m*IUEdC>_gn+faDGw`u{U;sLV{==d@dRA7;+xoBFs z@AF#0S>WQvbq8;tAQErNvh>2*m}=5!hkDP;M~Z-uE=oKq3bW zB#b{vm>Nzu{P-a?8JbrLUb=6(*?%{** zIG-oejm#3^Uut;CbUuyf%>8g=mFyy}BY9@kIMR}rXU!~Nr@(wijJmM^Z$F{#Aw<+u ziXLf8gRMGkcq=6MU8h;x7US&c`yg5Kql0wz-Ax@HD*fk93s4;SxEhrej=Wrd5G1pN z@D|T>vmA1vF+y5Vp4+#^0#&NisGP^}uy27TE#mzH-|Fu171+*z<}Ql^5Wn4&M6bqt z)Fe5WRAaFfE{9%=!|JOsuG|29(3=L;{zj3+ms0Z~{R~Hr3yMqL%V*%9XY`o8-ah8s31bD;USB$^e%1ZkbKBL$^04&VMQCpuWQSgR(YWDL++eGrnig1C^ z)nxVC(7H$Gm&p z{wgV*6i=nZ?Ss4B;e=(>L84 z`mXo3YACeuk%b=%FoaVi8Tey97jSzlb6DPEmU9Ic8~xmL`_0%T$@Wj(oR{yp8ee|< zic0Fr#!E&JF{dp>fmO2(op1?OerT^1ln>KSAiN8XItDIM<%st77n|T&`}YZO$?a_b z2bMCqqo?pg9;rPv9;;0N_|A|f5XBNiMP7D}%P0UhaSsFj6cqWJO0ohSlJKgUJML(b z?iH4dm*z$(nOxt;TYwAF2@N1OeN8wRJ^rdo(V!*{=i!tqb(dfg*G~x{A2LqtSThch z3OAtu6KKgN2@t!&hXVf0JO~Q=@IxwKNL32K^*56}x43Lz*jU-~Rs&~^IaM>1^RTaZ z9rKg23@jrcPnUA~X!yD!;w6yEFKh&r8-0`FkiuZU9;_P71YNV|K=We6__Alr;dnWz ztl+yBDw@X6(%yBkw$ASSwB86y1LP8;FMR*A`cn_Pa>c8!SQ7$>z6-?8Aw88 zW5L}QmS%z3B0XBw-Nx^ee%{-Z-Sh1rbSyy<{rJ=&(tQN9+y|E<$>n*LbdxOJBLk%hfPMQD2xnjr;?XzlZ!MY4I0E|L z7j4!+D!sl-;mSXjC(32ZI)*pQ;n+^2ot4ifNPx}M(?(j846tSwe%n#(8gsI8`*YSb zZ-g+>sr8_KwE7rwFR~k{P~4%&!2F8IID_!49kj)AP#t}28meGt)mVCL2tdK}sEp-+&z-96xdj4dZ?DR~t&37Q@RGH`I(R{Ydrn=nF$r#4dMY7?JYOb>U09DC{r$zoDer2G&rBG1-_NI zxzA5h*P=lDoNukTu-c9COzaZ_PwT+FK?ml}>E<-d%-RoNG)G59br%Azs_De`@iNEv zL?)9jj!If=eJz{J-BdtI4{rcJqDXuD>cWLKk+Es`$OdrB8YnRiY`CLSLbETnx7;0{ zgt|+-s%CuqevLb<=o}M#QZGkw{ca5=@TeAqYL7J1)o?o^r9@VB@IB9Z8tzL1fA7+! zjZP=gUXG&j$5d3I)`I3qqr7#3b%*7yUz5m~czJtSwZSNRrp0V#RLI|Pr4PLoZ9)mS zU%hff&!W{y9{nK}A{^^jxA8ps<4p_;MWD?Zv0o;GRh2PE%+yFa6Avq-Y!SEgWgb)g zcbzrO9UmeCnlfsz@(OH0Nqd=R%L%#r>n~?o&oobGoL;-EZxKc!kVsq1xbJiL=DN^| z=b$;2TB|`vtB?Lx(d7HPZ?a?*!X~E0=S_rGw)lROQMt5JVn8F2Nbp{{pwK8O4zGch zfp8u-SN5Me_0e**jxB%YZaxZte*x+Yzr(sZp3f{AzFk-F zj^ae1B1$wYxFRsoEITA~rn3WN=33V;5W#-j4q{o}zkTCyWAnEMhM=I`+ZmhxtM1;C z0{L+*=`8&ogX~paal!h-0`oeBCD8jG=9kM|vI~-vu7lm;-C1M*sN~q-(L+VTDK4v& z55(BU%#G>R)COcLV-|Lv3Vs17MNv2He|(Jee19_y2j2ZG;~UdddA0PF{SP%$HV9NX zF*S2k9v`AMmM&79 z*J%he+#pyt*aUn}sjkl-yw-SAY7s0zu1g_l{`d$1J`r(vXm?pT|-8w^4k-j$%;i`l=Dvm5d3iZ1yIE}_3dM4R$I0;F4nY3QM5fHXrrJ`XTbG#ecGf)huMQBK!Yb3Ogycc z3tsa{1gV$+*^x9|2QKao>9#H_{+q`=y2wX6L3?c}ig6k=lO9`tv^4H||n;*1dS>S{O<~3NjFX`?)V}!(NqmYj_U+ zcYWIYEzD>QpdT5Jl~?yGKsb@!LrAxnJ1+4+@ zDq~(N%mlJg>mZF?Q4mpYPFfD4@Htd`5wF0bR$S|EQ<|!3fGQ}P3O5@~t80EM0Y6Ho zu4ND`J_4SV(v*W_)do7oKSZnl3d!3!oVo4)yFk4K4BFRcq`hF}z>L%Hcy2AM+D!a- z*8Jm3IC&wtG;w{RKGaZG2cc7)$_~~Sn$?n5D&-k(yirctUOm1M;>v?T#|hu$sRE6M zg^8W0muv&V9=HOKcFeX4X8jx=&c|KyW@st4|AE^$#13h3RL!V=4IuJ_JMBVznqWIH znFF-{%!iXB7aTaw%4kq>t&6?Kpr>2nBPu(9K9RC^z^Gs4AJC0GA%Ew`k=nw$s*($s zw}vebDo#RG&8ze7mz~#ItPA34CiZj>nGntR2yy)|qQ@i5=f5708x!Y&$KxFsL%g_o z*r=8o`M@5PF!rB4N(ioIIq~Ca^H6PV?Uj6$noV7vc#u@G9s3KwfH(fLNKq~I^98T} zY;*&G%pi8k_qK}YCh);4(mnap05{j-C+A6w5rw*?brP`3^i=_e#1nSCN4v2L!?9(xa zYJBcQTh6Stvbz0FOpM!lN1WhzdxnO#Q(3mYCwtd|gD@Q|=aRw`?C+p8DY8Q7PPg1R zNJCuH2?D+IF6Pd@{M=v(F55>K%g*~%@u<~;%fw8+7a1kVrh_b6vB-vd?_J(t6maa!hrT#M zjSL#|&~xt5ub4kySrg5gH$pFyMeyXGL~MIJ2et{Dy}kH3cBK zjs?PexFRwFWajdQ*jjT&aT}!a>vmS;OeD~V&yVOH)oI4buLd1f2Vt>go^OFfD^jQ} zlUzgCseXLAqIM(*3q$IW|9U?8|SC0a#Zjf8+0{XvT_y-HS9L78QnpOH>Q84rGi zjh{NfEV`?kjBMu3;gLFSdX>Mc#~RZ1CUWZ@gyt3wCNCFKj_-NNFlFBs8NL=RD z_<(iee-pbZ??c95m0Nx__Wre{+;!krd0ke<#ZUJKxKzrNeQ8vV+&)qowBqR4Px9omVc*8jgoJwroQ#P9{M$Xd_>FIS`<_*oE8R9=Nr{8sVvJH zoqCntG+Sohe^|*ULcuGvaJtZU83Q|3>B8sVWnQzLPHWvfEL9SWF}*DSf5rmght>y9 z;(Iv|8Ia^r%$l%*ME!BTccRIih-1g%EhPst>AJNwqh}8Yb9B_Ou){gIZ!|-X&#=ia zcnT_DaqO4`>SRS`I{V#hUDJLuB}V(w?oT12#;cI!&S;w-R*?X21pe^V-SSSZ~0Q>yW zmz!3U?5kPJN5;XAgC!n&3a8$wc3qv@-THr)zAT0U0sD2GIm26ypa8=D0i+|PfzIhE zFelmHoiz772EX{r#QuU1?1P`-IR|FA7WLg5{q!xs;NP2 z+bMOv>IeImI^Vyq(6&C4p?`eSO8aJimpU5sM}?!`l0sSBdzoB%EuZV$#{L|8aDDqK zxomOw--z5NW`;>%0pLOe`w>QvmdkoMGv9%Y=3yu&_wY@xCv*=JRFuEhpw`qm*Gfab z2Y@qNb2cDE>H?8^GekggW(-jVmc&~A^Ov5hEcKa2G+I{!bfcbxTWm?-63>MDa#GZD z_OjWaar~cL5b9m3Qqi5EPp)>*0UZ3>Yz-dSHRH{5Z;eeseKl46!IkFSgB@P96C&7~ z6Y<~uP-%ouFR)%cVBx&{@KRylZ~+M2wavQZ_vEn#Z;ySAJe<}e9UKG-EB$xZ#t*q` zxww!mQzPUE)x#b&kY_I+{#HUp6I^MfJDgz4Oau!QEqd)Iz6RaSU|rh^oFb-UqZ~z! z#OPg#ko53Tp&~ZBp2PHprg zMBkhOBld_(LO$;pFtxh+xn8^05gGOFhe}2W(J8%jXre^<$OW6}?cZ#pQESkQGgi+YP_5;b; z>{CAz-`!w^-#!095DB~YSeo#4!ROq23Pb04vB(P^&j`9zkord|7;*}%k#B}|!f&DN zAeqUAa8f!>hhsMx>11_Gy>)MRk=UqMTgr?ntqjvIn8Adsq7hHH4}Z_{U~Wssj~RNyYHXleC%Z1hng5p zYp=PhW0u<1ea+Q@^vXFgsac&wV>UuBWzFh#q)p*z8d-NBOk{W6S z`Vy>)UaWXGbuSi~R6gDau+>P)*1aW6zm7QE;52?T-cM3aC- zpVHsEy;q8xo~O0GzblC8(Qm$etoS5(=;P19R2T59ex`KQqw#yatFSO3AtyIyXl*cT zwe(f3Ev>kcg6#l>*35+&xt95rUXh*tM`@y3pgC@Et6n5yk6p%EH^nFGpw3*a@AZck z$_q!2{U1pB+X@}BX5C1B%qa}%eCnet_1$y1Msw4)UZ`xw{RYK@B}#AOFrOQKMv@LM z?1DQS(*;qwaIDp#Ax+?Vc|P_CHj^a%xwGr=kG}dq!6UaFwikz~?kzS|_l*;}ZFai? zBgAQ%pBxkXJ{hM*(I@7cj5->)Hf`Le%_1a`l9k)7;F8amJgRb!tog*%HLfq_ytDrH zGq>W|#iF6(5|7hsx0tV1BbYo+^HDZ7eDs7|o({!83k-aGVL1Yn+E;X+GN7(Fg*cI) z8rtEG=Oi_7B2}Dni#;I2VY&Fl3Md7FHFT>9y?t@=aXVHc4+BpneHwL~sht0;GIFf; z>HDYeRFiCJ-M05l9>409NVD)I_xGmG$w^fiUp1@pE!!B4@-YJ}ypS(ZL*+Z*ixH*7 zs*vO77Q1$`3(HAS;(n(@zgW<=s-VhSnP%>|s^gQrBIB)S;YRD{7SH;n>L<#Ste5mx zW}P>A$< z8p{gwt2*9p`OWDV`l;iy+e_s(&GrJnT@t7BPAL+Cb3dF<2a!oh0mlVmM=8-D zqp<7GyXYLh5t0t`P-z%gaT|PIFB`&~_BppZ7LgW9k}Q|_xN~pwAs=cWa?jp>!&F%P zS8XF3x^N33X#cRx9gGB@2h!h@+Tk=f-p@GyfD~_jzicquH;ZO7oDr?;*@qbe^MCPQZ~~l@ZKM>3&A!WY8}^5qRI_nS24POj*f` z`ypxir?><;7IRk;v?my-FjKC1g%i?Zr`URbJ*trJ@p@dB()?o2*XUVo_j;~3_2hl$ z{3h-V_hwN)_Qqk+8&}mMGb5GgdQ0`n4y7z+&tD9FWRLxG5WA8|ex zn(J0guMx$%BORLWle!NCl4r%L(W7fwmdYBQx!k)%j~BI0@i$ZK90bQ$Q!f6-o&+w>-Ap1KC?8e;xPhIaFPjw%^kDqgp zW5h{jHYqDa84(AC?2wV2q9HRYa*i##qA07RMVZN72^o=1wycO_Z+_3C?!KSzgXAj(h`$@}II=TYj#6@Dv6PxUgcm`;qCpjqu!rld|nG!R@^%WUM= z(RxXr-puJU8M~5kE3UbPi5$oHLsP> z%OS62taitRM}ouLeXf5G3XS#lmS_6XHH<3yG;ID5f_|pa_!dg6is9bo$p}LP&L8Q9 zvo&HHPk?RWI0t(4cYxEuVKHur^Ocr-h=e^KzWjxk2(I+o_v!cwVJk7&nyR?Kb_=&;*%JllVJ)X_axzNH@{_~7)13QD5_#{{#D>EPvDpLAhG_g@zB@}ax)+-F8mD>6 zev@-Hy*z1C>vX0YLUX@E5a^ACQJuo(rIt?yMZZ$g>g#DbV8;eYOxHL#WyW$&yF!ZK ztR8X++!fdNc6Vk`p^=dz!&>|bK!8jbAN)z)djGyv*>wAHZ4;-kC20Wx0eVh_cn_b{ z6LdRxa-r?OKV^RDFVDR$l*6yhuCt}mwQ^B5at!b zQ)v2WF0tERR@ZV^HO0wvSd+5J8f=V|Gnc~F*sIqeTBB|DltaIJ-gLMuO-G>a%R6l->ut%#@Sr3C_h4+ z0EHxAcf`$(gd!d(w`1Gv>fFpw}FK%9NSucGNYYnS8rN2T5H`DPa>WAc$3n zr?s@Uj!fzmP73;UV7>wXnvZ7}L`<${XAmXNS3X&PRx!MsN{Yvm(Ler?FdlQ9#}b(L z7~VsKUKHMSCx>o1M1F7E758+jgE0(Y7;Ri;Ui9#0A0wl`oY&l`_gfiMpbz-6wEg>2 z>CJRcd`L)TPXO3qU4Y7Vz?(Hzr zeFrOF+C=e_NlFd!*h9ccg-pGDEx2@6Z=~R6XBY$Lth(3K^N_?YgsqrQmA{13FqcSg zvD>rUM9oyd2<@Q!=w%?2`T=BrXAw(tk5V>JvdXuL{v=qrVhAQkY=Qg^xtQxKLie(N z=WSix-8%t6!NGb?PD#`W#t%LiXWeOcv%eVgfWFT7^p(2LJvlTIlEuLqY4Ckn{=y{G zlNh1=7`}{(KpPu5Gqzuc*hof+`ot>{v?H|sbg1Vc2u+FV2j6NZgA+LY%Rx2K#KFd< z3APdE8}FRYSH2PrJnnR^#9EKR#J9wF9|pPLJ=lxRpV=n`eKa zN}~F5P^!w=?j%_cnIB3fpULxqRWn39Jw>74^(@@10H~w#VqBFQyy;Xum$ED(84!i4 z1PjIbmtGk|X~`jGL@PFd_?qi4U=-Iw0!i}-6?a#jwnV${Zj+@jAo6pRRir3LYd{Ig zf2?+--NTVKMJ5w<`lf-A{H7Y;_KQx*y8Hpg+VcJ%mv@2*0dLJ7MQOBF+$*Z)!(S@W zp8bgql=~uNzZ_s3K&y~AuJPn?DFoJz6+;zb&iLn~L#}Twf26zz9ROxz6nwi>;r09>+@e!t8ml}I4@}6l4#lhRdPY88Cx#_w1 zPgg0}uYO+{?({$RB*FZ_HnAwHR6UrW5`o&Tf+hyTs(V2KXU;q&J6y1FUPT4d)Qis6 zP(Rb4M3rHN8AW5onw8O8N*F6}MjIZRd)<>_4pkJEPfG}+EKnw@1LifmaZ*KiNrXrJQ`?_z!iLUJ!ufKx=+lgp=-oadXh zd@`JQfy^AxCPMP2lVPU~VdKI9l-eb(}ZHW^~kClPm=nH2iKE3b4?+ zR;Z-ct(Yt?WZY0c^lJo#4Vx^KR&^Q#4Oyb!ZBKH@1{?|XA}CF9$A4Fp&h7k|r66P` zqQV$)`bOJTd1iD8XDf#~)KusfHUkSjUADISrJ70Fclmo=$E)THGx92sPdMm_Jh!q4 zQa+@NyGtX@PZ35!&1lV31;zp;aoD zY^;K+=5XouVxzW3z?|g=xRpZ3#?@8-VVZHfSh(I>eb5t*P;epJKh1Dnl}cX~t)vC}@t;sKc5yHKEre>k2PV-?PgoqJp5@IrI8+C+3}R#_yj-+Ohp; zzXykX-03mjj}qKZdHbCuNnE504_{%+c9D|LdO+S4MIgA>@|0INkG;xej?giRLgiQW zyQLm&$WA&Gc9>^Q5yVj3>pP&;p1H$PndHA={DpIveK<*}N}Nt}L)sIPkCOx~c(qRA zmGE{X+z7fAFj`&}qK!qrx0))4n0`-HB#Q1i{*R)4m zq`^&Ia#Y!>pLK_BKpRW>0^bjo70E!mk6z)culJ;p(zqdSjLtzBlCGiXX@vAS=ueW8 zj+z&m9?0B`b=m*^N1%H?B0^DC=d|YbJ>Eq9o_!SFoQ%uL19^36O{o2EIv<8~TM0{# zs2F}!`)~ifdJapEpWPU|+V$U$@RsOM)G(7zn=#Q8N;HkvC&N!-&JI0m+V_bPe?*`{ zUPNsB>m2zTM2JT99`;*)U46A>vha6at$>r7i|f!mGMP!)V}SuaG27&--;YG!E&Kf_ zj^gi9om39>0&%rk0hy78f6&IrnJ764!Tt$iC#LtSH;I2F`y3aSIRd1X$FJV~{BFR~ zpHO$PSh{2=OqZO4V0%f4u>`=WGaValQu^-l^}9>W`FCn|S3NTNbP}cgpo8YCX=mB8 z5OIr-eXPR8#ehg$^8KksXIH$WN`d_Wu{VL1PA-c#7MGESJ%2}Zr)!*QX&%DKs09c7 zJf)^{DRh;Rf%Ffw z@7@N4ef?+s#fC8Fz>Q)z?+~qCHFBTTSs8UTW_5^>Pi+rt&9b!Q$TP|seB6G%!RqBZ zb_rYR<8ywpR*(`5tv|>658Su|5%V%(5wlnjF1_q}Z#l7GtyJN)bnNy(@ul>_q?%F) z98cTXT5E@FD*;K#;C6)ahJbnTspA8^kSMMGL^jGRz~A3Ma8O#%qEvcM`@)6i>+4mC zk+ioTfDb`UBQZuS0!$a5eda7}nYlDpjD_dk82jzlV1P!yH1GxIDH$dAjH{zn% zw;so-mmc?6>|kH$TsXJB3DHeUkk$3V%$q5UuTdJq;{jED$Tr04+zOC@Mi zl;kZ7!dBnXkA9dhH`#7@9;Tx+c7l?OU@o&5ZU?9ivUi*6`$*+6kb8~l-Nm#6Cobp5 z2h(WjX6%%_b)Ec{dFtq~W8y8PUQ0K?!8xaYVU1M;Uoz)XbN>2_pRJNuT7i21Jr9cl zLF~nZle`aTIOOVcNc!54Rb;-cXV-p?t&^j_0f+q^d}bRaFc>tfV0N=TeKx1*AX%G& z0h+1%KG9B|$^XKvu(SL~@7SyF-_ul!`ga;BNeGHD0jX+m%s-BM0_|DxjmzC&e}v7Q zSx2dttNA&dvn%vAp{UY4SnMx25KDKQo(>WLxA=rwPU5qa>7l({shvrMl#I!Hfsi9J zG27@l_BIP_X2bxxBtyQJ%qn{jJTB(Wy|(}6U8O`JZzEgLgN4q@@B8OE6dY$(I^OEv z8CQR&-uTSu{TW(<8JACtEQb;YsWk%!$G41&KR=L@k&TZf9e~)x1xFw5Z^%2)jQ|n! zr-tk%m@+YHx58tKvkgz#GdEEB^)jFJE^qw7lXEjT{W&;7^F8L}83~xmDUv{G3L7hq zK`k>g&JTH;i-AbJUlU&+nOeJ(Hz!CuQJCAYqP8-~Fx0xnz8*tNW)Rwd0Y}Cp=P9SO z6J~Fah@Rc|(X-I4uQVdC$^EEj^?30fBs;}^e08KbMPaCS(9@=qY0yzkEmTkPm*De? z2fw-wavPu1)7Ot|9=F&x$ZNuenE?+TG)kHeX@)H{c^RT_uB230O!wUmkpwMjB)o0< zwo50!y~5ao(ekBexp9@PL#Bmk{`IP3vtXcno4B}@So&%7z}QUUDyC9;lFMRQTbBgB&6fL1(R)ms<=G7UuUsE^BZ<-y-o{p5WMo68zdNojwXEauCh4uDOc>s(N zs__*Mto){WB@BzSDGwVCW>>y^=`(p%#&4_x;!y#TfNiA;LuUKI(gcE{FmjYR*=vGjbK)7U^;f55@iL7R z#wnPG$OG6nNQuV^#uYq5H8A&c!}>`ox2JrqqZ_`fZ!TpR-sEVO?y`dBhJq~ymHng8 zN0H0Q2BDcR$KE`< zxBBGsW1S~PQ5dTyv3CrLXg_3c9I>%tpz^=Lq13}vEm#IRv{@=zs#}_%s3D{mQHds7 zSK@bPhk{-Fi!x0=X_Jkc+x$Ne`8et44JG4|XV!>DivEM4Pw)(*1Z&mSqu>0*(!g}P zAUEu>H=EaDW{e43?=rn;e;cGwv=ttiJ!OYb_m_`_-u1U zp+ok8Z$k~O1kQENW~4g0r(Xf;#uz)m?KwPrGQR0JH1R59S+G_na9zZSFT9}(Tm|Xp z-qh4Ld&ZDa|N7OoboMIOedx<(>$Y|mZ8`fXI^1?;@>4HP3@U=Q7K(tSiiFnd z4mC}sDwxq{Dp0kXXNuuV$P|-}J6jS>!p#wAsLzEt>=L@)i5gTt_46d1#a8aG2C$gIOX&WK zphGaSn|gml;PBSY_><)y8R9wKDJ8jQD2+WxM}`4c7@y{)8-fH(i8F>RP#CmT$KZxh zu|?Xv0SjKf)JIaQXC}#VUT9NH4p}p^0>1NIuV?@B$gJI+tvrQN*U9UHH0xlkUu+mE z6KMKH_|BTrT~BgL)zeef=FkwxRP{}$YnRH7Q@3)IZ$)4-(Xb;h@WUPM6%R0{_<$O6 z&C2EW_hU4cfbu6h4Ne{5QbJ)^Vx(-sF-{w;w)_WNc{26 zOu@$Nm;a*H{+w$kc7#I6cm>}b&bl61&3Vrx(oQn!leiA@UN)U)T7OY{i}^ePYpTP1 z)nL7(g`(u758sLHfgeR{L6!9|iTO-a#c(V4_l|$shZzZBP|qXI@NKr21@#kB!WwP8 zgskJf9|w(3V(yvkB%@ZA-(&8dK8ujCwWfKTU6Lnnra%4!={aOJ*(0%k1~nNX)O6|EihaF53S;5X?BUn&C*lJy{P)Q9Cg_(6 zCVX~hhb&i5snG-+l}d2Kv|36!!}4Mu#KQcDA>%r1QPO#_vYtLv2NDME$x})ne#K}0 z7muP*kKu}F#gH~dk8LvLbr zmL>d{?;*P3rudUd`t;s2=+gQga;0y0v!dKRg-B4$Tm(X(>}+wzKDx%l5P>FQ+Ds98 zg-`jcJDJ|NJFpj2Iq7J&as2r4l03rvLq2vT^#6u8bIEz~63vyaqyg3}nXNwlN75Rj zwU0388-Y7U;>zjzJoOMU4?jUbYyWS^EV|yB>Zz`-&SOjldZTX{OQ2!5_Bl3sM2WI z2c1@_)~bM7p04x@=*Z~y2AN?>Yg>BC+u`~x^bH3Xz*WJ0?!L(C2(S-3U;g9K3C1%) zi+Ci-bdpE0OYRF|i)C+JBx?rU@-`Nf73rX=)CJxbEf8cq0LFh2P<(#?(G3ynReN@f?JLMz<4=9X*;o?C_)DAkd}Zc`H!*{^&gobaju2aBo9XrD8ba z3BzhJ#rLc8uOM#gfi(d!Py*mr}uj4l+kA)eofGrU_nXi zSm)-+*jz`3TbyiUItSe-wq#@|rs_S*y}M6hiao%n{q*#}N7d*#gHliDBNDa|dg8BK z`)eRlLk+Oq(VE*_Hr!~FrI;!L+~EwjzZkz!wo*2c_Ffe(TTltPBSM{jZ)c_ZQr`p> zDK*Hgq)%UO#S^0^=JG($X;8j>7y=D_4Y{m>s*YQhdlwF_ldYk}ZVr~R!1)#_zq71g ziwvVgw^)?>c)fN*H&Cog+4oq@s{EN%VY5h@Pln|Mvzpgp|6AN(*9^d16+ORqA~8DiWn>yfl8HvbjgU2GVbnc?Tg#2mZ7c)>q~bxmv5A})ElX*hg~L< zjip%cJjvOzOm1XzUe4{8!T1%HT8B`Gb--j7yZ~E8K+rMz(5&*!FomaUz^En)GF3D9 zGYPFj;zKSE0;-WQa}cQ5t!4H>H`eOXRPT~`@@If1xjY~tQcuC{$^-=liq&TG<6(Vs z0SxTU)1P+H-hn(j2R9PgALJiG}mSP>ynx0zs!n5LGN+q{zR{sryy1B3RY zLXcveoY*CwZEZ3VRELZj)L1j~iJD&&h0}g>67CRBg31(E3P!_%BOHJ zH~AzzR^5dxjw`ItpY0u88l_$rg+_bFZ{;v7!op2EsOB9BsW5oubUJdzp50`Se+HrE zO)Up^A$C9?qWB7L!1u3H{T}Dg-aKy4#)!sny>cRe);8C_GA>vYI=nc<1i1tRUdN5n z*O;9Tqvz(gdwE=C=zZ(2qqv9yGe<@-3ypsj-hafGTHm2c)?jlzEYjcJNGuTSv#p^?wv( z2_U5(W61HINM4pL@yA=<(U%G(L()XoYnOgHpBAhNqU#jfG-8Ev;=~X{ES97&nj6Z+`DsDvlT!Wv`y9vS)z}kg=_dL z=fQS)i=p2r9t3E8=cPetEs5$LK z>8fTp!kfDML1~%$Ft8GfG2>D3&kf8ugrTs+O@4FC>Dj%@&LchGx2eQk*Ig|Ki| zJKTdKnx~-|O&6I!V%`8Zeie9Da>TXS<&Sso69x&$6Q&dBRppqYqmaeEPYc~d7m9S} z_RTtc_py3>-imd*jKySQ=7#mP-QS;vT(U2JeHc}L5A+vgqJ5sc=bDY)==#BDE#P;` zVB`Diw{pA6(LK9iSH@DCml_@ZKcJf{%not`z1zIzPZRdIf9KZ zp;3nzJqA+*MwgLcQn!<%b*)d{v+{B~HpwU5)&L>WUH2Z$q81Uct_i33G-s z$zGAVBU`lZCW&Fd6e@4%x9_Uk2C?+Ue-^DU%dJ}J&M}5=89RjafsyF5tL_v^WPZ16 zj1M37?h3q|w zfmZF4mr4#FQOEOG+lNCqEjry`Te*nrOxt)PO?z1m=ko2~$Oq(W*)O=du;jWgsMYBT zETP1+ZvCsTxBcnBHpCawz>PgH>CdXipK%MLbYQFMVqr@SJZVd+}n>CF?JB z(l1W>!Sd5&8;u$j);5i%%6Fu?CE+PGT0P+6y3IFCs3D5RZ4RZc@LD7U(U>F)U^RO+ zq^Y)cd!?}05v>#ZthtImqB(F290JTkFo!;+#6?&KMRHhLTEBHVo_~J!9Nct0rI7Bj zR+nfs!jCl#B@yK2syVx&0lj948!cl7`j4@kpPT2$zMl1pt$!j=&t%7^tvuI z6c)kvpWmnd3hAsM0$D;e%s3`G@Q>j%IRZd5cX{T)*MHdb(*gLA!@&>#!(x<91ezKZ z90`g4nT4EgVK8LFUBiN9|2#(j>q8Ow)BdNc*g1^Re{>mz@z7t{_s42V+{~aJ~JS!5WIIg z(^4Hlk4{pSm)SVwwK+VF?~ZEolbAj!g_|zlnoDDmc;y;)1-B($0DXH;RDv0;Nb4Ciygh8J3YUb~tW)FdK|~G3b>9r3TnZjbri6AN~Oe%g%_jyt3oKcZZ0pH*eKX?KZ~N`Lr&j@dJh$# zgHqvk@*NH+nGz0yBIl5gYv}0MSkca3$;7GKeRn7+DPO>1ec>HD%g$d7!_SVooSc)w z_{so-G75^%20P9Zs=v%zffR?1jSa3<5(y9rpYoSq!WEuFKH7I+ZeaIx_dC$&MYqk&5`QU3tw0q1 ze{g#;av|n}S0&!>@%>;-;~}Q*A2+nBe2CrNOH$t2%XUHGuX7@M_Two)N|50*oC9KN zK(dD*NBL~$cV(X*f2eWiNiRd)Q8A{GkVclkhmn6>ZwhU-Ha-hBpuBxjiNslt&o0(7=m2(3n z6u6pu=@FTkWgioyo$0vEPqelFUr0NK!to!8tMlo9DlI(!7o`Q*gT5>-u-))?)dz4A zi%C`{r(ye<=?T#A)y5K2wm4qX3q#L^CPAOmO_6sNrYFYc0}ZUd#`i{*mi+Nr|D))* z1mLkR2vD_80Ui@>&2F%SEa4L-xqqRL?`b7^bYVh%GQkWi z%Uf+4qAwa^@lxxrA>0~r^}UTAshMpqGAr zRnDHh?!Q=kv-4&xc_F0AWtfriU9h1rYew%e&OoyzCCQ*{o7gAFZg7?bCkMC$2XBnr zYFHymjdK3+!K77hjH=A67CzpYwkzEXaH^%GQ`!j^Ew`GBiNT}? zb{GhFt;v`w7hd73aGNn?tb8MVXDTN5je+|j;zwbj{5I=$UyTB^jf#}`$i!KAzdw<6 z<-1fedCOhGu+%beYq{sGAP9gM%P|px6$V?&kiwpihD8npSYT>lwS6`y=(IcK30s$~ z>M-Wzt$CanC{Pub0mLuVMRtxKCly4iUjUJq9?TX`UCE9|Z@J#B{xa7SEvNTX(s8g! zo%4Xd;ofNY2X)F{pqFS_!uuaMe=u+@H78K)6OZwu12k+ko!JQPY>dEz1;>N)rO+do z4}zC>rc!|^GN(^>z7rAvM$gYa7>hlCJTi3g`gMLX@^0(AqMZJ3J1|fD&MqQceRq?x^Tk5u}Qki~C!q@mT*4Vt{aDk4$)kGKRqtg>eDpLPpu1YaWt;)}j zD%)G|!}SpMcmIsL&m(hM@Uz-RxGBsTp_L0S$Zr!!uK9DGhf&0(>hllRBhEPzlI{^! zA1h!EoHPJ|$6RT*6ink39)-A6woRqF=oF{i&+M){n{Mwc%AV#bC5^2`?{PYfRI)E@ zOhy&5{82gh*+=3XaVK(D(q5&=?G^@sk|S#!no_1&N@Eiha8*>Qn>R~t=cg*suBUB7 ztcAdm1M3r7pK6RREcV~t{?Q%lBKEj>yyv{tQ5(xz7u-B9WhQbxMmf--kH>GGjyqxc_><|) z^x-P<_5zFQyQu!vmxJ2k&PLhC^qSvHnLSsjpR> z-K(z==fA)rma1@ewZ|qxr^5GMr!4;$r2W*|7p6mpAx$+Q z-v;@5t4|b~96kaAc$bGRJK6~ARYE*>d?iBaHrQ!@Jv)QOfE}a^WnwsTdu2xuL zy<~0FM^0P>!P%}9iM(-e_UTqn4l;jFJ0`;V#Zk=`h8G|@a#1xLc=8o(dC}##PxN>S=N*@ZbwvGl8NBn1)KeXTq$YC=SI=OlC%bTktj~+M@hO5}* z4k!**;1n1q09S3~g#*`plpcolbInq50i7V6J7H*u(aJKK9sWMX#eY!o0XpLI&7G7z z9}5A@q?Z(O9i|ZFy^WU1QgwD|Cxjx_0q80gQ3RWH@m!WaHE|a@n1FXDI$VTqo%db! z`n*l+fp9l8K9ot?<4P+IR$qutP^kB9<-PgJRM9K$Call z;NDx5T|SHBrnz(OJ7j&-{?H9)@|dl}vLuu2$-@9>IUB5~o4G3$=Hb77$k-S%EU4Z0 zzj}&j(rwAgCeJ6v7pFUmO>paJG$XWmAI$wx2y2H37A%H6@VP}V>y{Gxi}7avd|mRe z(CdyjDJr`}WFJ$EdCslHGbJBZ4`D|skcNNvn0w2f$v(wuNGjp~rG`1r>SvW;H?;(z za`vDfxpl}%D*>n1;O=~P+j*>rS&k6*gHNZBxlVG1Rxyg1O3{<++$gVAu1-q1aC~!L z;S;1y4c+zUQA649@bc?cufno=-o~chw|Dk;t9^sVlQWVStH9h+t+W3+4xqWLdT73i zAY}QyM*OTQoJJ-!wGIR-)ToR^3t-huD8&DWLU7wTXTK$-+OKQahJ^rWFur!|&ig=x z39BHMUsl(|9yEz`<7E{UxMdF!-H%NKb6NKM@a_ovXc-s|s#m5QWaldewKTyl8A zHT$trm36Evht^{|wY7Q$G5+<@N_|gAKN0b+Dq)2Yy)*Z|+LKWG!KmUKL00gVDEZL2 za7ys#ZlzzU5Xovl9rAP5fTt&)d(uBeLN> zN|hf_m>5O8Jhwp8e>^&thA8Y{Th|+Zus^I5rvyi$u;U>2pZyW>H(j_ugYmQSiD2}< z@HtOqP>499FA#CoJ~JLeLL6ww%MHAa{zuzavZAJSf)=`zerX-T(#7ppGC zSs;2}>+yPa`caQ2tH$&H9)rNd3q1cZgo7Ksm|oXtKz>0v2U#LT`$Lg`&rO3A)kYSh zfb;z|SjPHV{^Pk?Te3jnH@V@fcjnXKH|7N9ylj&N+d3CEBUUCR4~(Mog`ZJKUbL{FG0Jeudfl*Q-nlw3J=?k$E{P6Q{Ny^!L3T=0qVg5C}L1qcWg_EV2_`gtqm|Iu{>&4I2%+M`Unt?m5}Sz>IL%b8)I!!IgT>)svq zBTq66gfO|qcpyg$5*_UAsjE(-_|hTRATUsZn5PT^SLbIC`}8h0`(mQyZnq^a9poEJ zY)xmVVTCDLu`MoiQp$1gXQ24~`x4E@Mbyr8&dy~?k16@}AUj0!iI?N*tVv);?cREw z!W)NyVnH`Y?_^iV&`ONwHXVYriMZ3p%ETFu^x-YM#u+xD&h#xjpNMPf>XZlBq(ec- zpaN{aV7IOZR3qZ#vcM3l3(3)M^k4Hg7HI_Szr(!@e)u~`W=qCcJaonjX<#FAdb;kZ z7agXZ6t&lMf#tP`N; z*TsXf^?Y44=j2J~8EMeMNIVegW*1c0<|k^JsWj1A9{w)~@FFsn>zUB5P@ytL%;>s1 zS2Wpgl2oxkEOvVhQ&M{f=eH}?gHVBOS61$|xAQ#ln>)NG+nM~JZjGkQ6;^@6A`QM7 zy5&9_Z*Y6NB9B=HIC{oFQ}V*|N!vuTsb@b(;y^@mY{jQ2*86#p?Q3|eTnMl7unvDn zHMs8rAzo1jw?j8QN_y<&A-!5-WOBCh=LAev!rN{Pq&YM$fx7o566|`b z@i`-c^+~d2ND99YbZ#KFGxnj&<@fpQ4hPL`ORt=d+8y!74yAT<81RNqgEam+ggAV= z8^89QNtn_QOjTP?ha33yUr|$SLHlgA!{Hh$n9u`LK0hi^S>ygAJk8}rA>Sjg|3h>< zPaCqm{tl5E$u53?X%xd9-(hp*iq^B*I$GNdY~+zn0det%V`OLUcz*tRYqrtkx=R3F zalPjw!JSk%`Gxm<*%L@?xDKi1_OB|ylU&8=r~!askYb;s2F zWEUQ}^A=JHGtXhUjX_Sl7E%oMzU&{!1%xhr6I$tTDOyh0a+iW3njmQ^I_&s~hj7d2 zfEgNck75{vsHPyp;3N%f1k(T&-Tx1rmfy1?wf2R`JKu>zyuq%OsX3p40VU=-e!RIt zcXr{N%o$HYYTgmQXjs7zBtG-}$ymi|pXY*oyP~3^0o?qlv$j_h4rDTdU6p1-z@)9O z=KV(1tx2`vbPWalj6O>6si?gV4x!WBgk8wRW4`el&s;fSNnbOu3w(esNa!vd-9j*y zidE=9_Fzb$IKomUZ~zus>afJ=)IV8vg~4}kXU+ATJaZJs*;>C4T{8$r(`vXx*QCTq zN$J@h%Nf$kaT{|u8?G%NPaZ5er2?`29U^CRZ>zuY{{6AL=Zl{?NvILOvF?1f+6-$X zh;!bfI8EC?Iy}{B^rIE3h@~+E;?}ABIlUD*G8VzF<#ZT(XyaE#R-uKEbYaS6Ck46aXi-aU8DTVJCRo+&ZKx#5>n#pN8;JW&qQ9WKqt zz+vSY9_-g_~-@3fbgv+gRC ziAb=TKHIIbQC$z9MVV8%Z67ds-!-to)?d>QS>jKUfpAB16<`A^RMd$Y>KOe)7%Hsx zy*zn&Cd2Zz{w0rV)kD)ZjkBM3D@kbIoWR9--g?oSX$hoF`qiC=mAQr|EETc)TyYG; zq3l~oz)?cwXA}M_yW@&c{L3?Q1r(}F{D-c%RJi~wMR`UpV*Uej_n1}kP)>6=1aVH)Q z_Ip?=ev^s5GRvpB$eFn3DECnt`wv+4;}I*Swr~pLOS)sNy;=OU#yYajow~qDI&5Cak+bEr z{ky9XD;gAdlwWLF>d&9;916q8EcSE~yEYq#UAl)efAkSsKa3!S@C`7xiEkajXSVBp z{P*A2=pcbY&Y+A7>{*mKp=k@0i!CwH9P+ra1_c?J-eos%I{k0tvG^dj#^BKIs+17p zk8xt)%yNaAj__Zc7PE5*y>5mu?v!8Y&}Y#@y)*C%ySKe=H=KJin>oMvih$qNz%_`6{cE#)O zq4J>Qq8;F*!RCnbGNdIxGPF%S>c@HG0Wk~YgMz>xeT^(PR}sR#{Dd(I0Ff33U#_>0 z))>&Idkg&)jqt2ep64M zQt!F1bNxn4aja=?!e!Z6mZ^Q0BBq265o z{-T4p-@~m9c=hri`Rr;V&cT7e1kVB_*crH)jXzeh=Rl&p*#+GpZJC+qVxHKr*5{N z*mSG2v>`p@nX8ecRJD+z8*c|yZtATexk?B=UY+FrUo7*fpa5PZ|DAkq)x;15it3li zOVYo4^PcE$DJkM(q|zXJQig%k{;LnTnR@w9Y|rm>WEee>wC_Eub zag+Z1V;b|ZLu}7vQ(_CNa8aIqMCB5V%|3b~v6MC>WQXF}km0X2rSE$+)&B06dAb32 zhw0^kXYN)P3%!_5(D4ll!ttlXvZ04>P~E~{;p#@7(OBL1q25#VLjvm zMGc+n@5V&CGEJ19%#$huisrEf!suj{Bv>7H^ zp{pQqy-RozDOK#bzyl8#YBYoy484fwEc-t=tsMfjI^G7XE!5xl45w|!EK1xXA$;QrG0u1{S0+w&GrvDk8p#9UOFJQHw%YNdKH-<``15=mHGNq zq(SS|({~|jGwy!H2f9_!Lr!17?w0_4g2KX@CK{_H`HwjFk33Qo3QRoM*t>sOygjjO zapIC%##38$W9CerkmvVW))VHN!~h`0^WSJk)!gEj!|4THXl{!wNloqx3YvF7PLK-n zGLSZqNWVFFY#pj12pHW17=j^msHJPly$gKJi~e@g2R#5m>y`;a>{afN6*E?;OaNWY z(-#3l$+bbUkk}$m)X`Y+og3!G9=d7}Us$=ZLSDj&iKXzUZA$oPJj|qg4 z!SP>Uqh2GqrcN%!Qw!$#Um`gg`z|4~>>pMQvH4gvV;KzV0ti{YkA8{jp&ZaAA`1w> zg;!j0P)x!i7X*s1EkBFK*+0nBFpjk0tT<_lnDEMMSZNsSVfr;!JR{PMmHej;*m?gK zdO?js^N(5IofV^x2U|)^YuXD#O)K9GtW(#@co&Dbkt|T#2A;7>B{_7Owm|NRoG~@H zCteh|M_J8K#2z8NSlkY>2QO76gAUWVON*vJ4#7qu96xXy51&N+>?g|qvFt- zY4&PdRq8H{GobN}A3^#5Oi?aJQT1+DLTXS}&5mD57EG{^(bEO{Eyl4V+#fpW-=8t%5RydXLsCLhw*8F zCNX;w{sk8+_;aRpb zcS2z)tPQI@w}R7y%QM|Nd|CHL&&jLBJbL)Bx)YA@i3oRMUk_1O&azui2)Qcx)XC>J zEFopQlae{3kWt~`HjhC%@Et}?)#KWUsStPn%hqMzIQ&Of8^bG%sH&>!czNM)G}L}L zK6vopmE5MVPa+>~HIvtxmacxdum^1NgpDmSD#oAG_tbp#!MOfSg&axa%TKlGbN9X6 z@TW@?3TKm(HP4+RrNTwvzyzhl!|{@2t}UG^@49cI`QBoq=!~t1n@G^2@}Kts3}yb< zsB8q>qv`~NpNM+=^pcYIfW_|{IFn-I2>U*~$A_uk+w-BMGELdxLX znG_7fDdhjXW3 zZr+lkeTkIRQ&U5O$*EI(A^L&QA59|hlMy0y2}H#_eX0(=r{mz^RN))Ge>^!A!~x%- znTxpBHIy!lo%}jR*(f#Slcu+kY_0DLLNA$vCt^{S=q~ciSw%QJ+$Dp&IE8#(4h9j( zxx)t`m%$jxZ(1PyY~vyg$4j*D*6&XnUKgQ>@h?EXO6s>qUPImX{F3{kDFXhxa9;b| J2PG^2{}215Ug-b; literal 0 HcmV?d00001 diff --git a/docs/developing/vsc_run.png b/docs/developing/vsc_run.png new file mode 100644 index 0000000000000000000000000000000000000000..a00fef184fb20017c530ab39b4f9d55cfb55e4a0 GIT binary patch literal 23843 zcmcG0bwHDE_xCmijFJ&biHycC5=!?3R6;@lK^g(28)>$Y7J^FWR3xO4Zb3qj?rxDB z-LUtb`aHkqdE?KQzu4~ks&k!lu5&);bM3jd<{c_>W^xb+M5U^td>;gYfI%Q|2aE*x z=3aohAn-xSR!K=)RY?hRHlYq${NMw$Hldo%HCFjyYRO)1QL(Z9N-0ro*?HR#79`BKZkfN$ZyvZv#Gy_tE6 z%|G7(8(+U6SsR)z#eA*X1>_60)iv-i(6}pY>Fg+IVdebDTF~3k z1rRp~Bt^*>`o8k*zs-S9avU}u9xl>CLS9~8f?gtm&TdbHu1iTt2?^g2x^Y7Q zctgP5$H~LOTfoVk^G_%L>POky-O|n0#lzOw2|?)B;*qnbha3k7VW5Bi{h6n=x9$Io zgqW{s-;D1_*T^IS!mjChOKUxxIBCX|SYYhmAAPV{GvO@pIcYoiP z6(Y##KjijjQ+|I7?20_OtkA!ASe`sGw&*7agaoN7-_-R6ucweDUu>={pB^=MJi_#V z2KMsW2Q=Co`ifEGLocJ~Mz#JI#?D9iiT00v#OYbS>NOT~s#G;DwySyZfkzOlPl%`p70g@g&>uNsFn#2k6ziR|FLb`j&Z`S5?CtH9`RrU`&^*fh{JD64eY{fk1hNeZ*Z)wk*}~n z{1lx1YFq?y+vCI7tJG9fm==wL9?!*F2cwnlab9e-^F#+iLIs=c_j=dP$%V@8hXuXZ zglvbW^u3R?6Fi+`^kzLYzQ)`+s`gNqqh`3;pnbI0lzsW1;JMF}whjZ%x4kHo-=KVa zkbLjb8c&QlV$6nh1x@HAnh%(+21=qr^$kLIRy(^RQEVpf`h9H980OA8%AKb-nDHBv z)#Ha-^NyP{Ux!NV^+^%CY1qS=#)Hq^Y>9J+7EO_ypO!K&@;m$zQ&{hjI|x_ko~|p; zIDOg5^_X>x_D2CdAH==ho)1SS{+oR15#I5;>c?z?MaROOMqK2r2Cs{Qsu z#NWryZen%A#Bv_wDT1DXpR2>sASeQaQRLDdtM+n!S443E^7pGb4sF4gz1|_{)Ksyh z%(3z!GRJmDgIkp!ORThlJ0~a2g*GM}S5x$CPB(p@ik}QvJf;g19WAT_^G|Wxt2u0t za_`R>O_fCDZDoFn@~ifa&9GF@3p9AXzRV!pmt`<$yuN_v62&6;KxgM zuP4d=NYbS36W6*tU`0nNF&dBgw7==_rCk5pn|KDRZtVS>ln0NiFYIYXPt}R8Qg1mk>7<&02fa3t|x31ef+E@rZWGQloXt93(qjYw_po}%HLgAyqDcw#>ssZE3c zH=Izwh^D4kNl)o-TNt@BL!wBq-?h|NEkm5tx~emT$zKNlnKBZA#11~VCl104JrpPz z4PUiiOV$5brO^t`wAbh|HBY-Ukm3MRWI4ftW=bG}3FxN{6h9kpYg~1?xe^$cT0A3m zZnybq(j^H>L_?HKx z+sbRDuB1?^+jfCiTl81&z=9wVr|Hx%QMJ&q(O-!j4m4DS^Ct~ zHBUTe1{gs5rHusP5}y1Dc*HNfFLYgb#ZRjK>yQ{u3lOj&X+y*wzfHmiAJX^BK7oN% z|0Q6(B#;1f*R56pKV8~-!fY*e{vLw%`YcT7QV}U6v}G8`U0P7&Mg!SP6wq*$6uL>koohQSJNH8J%`6$|ABTcQV&LX4%rUxL&A*)m7{;ZB)oW@{rsIuquRwxJ#K{w_ZsgeAd#xqqAJA&tmpyD4bB98+pB4>vLxc^$fH!d_BPDjn~ceqe> z5IfdoHTLaarF%qcv&SEF-O`-~7!t{ddGW$62RM?&9ml-QE+5FxKMzK}fF>p;-t8Z? zx3_ofP7R~i;q>JLrl8GySqTKWN)rX@0o?j{k!85!WL4+xcFRqK9)y->yxe&yHLo*C zf)kcbF3Kg}1ZEeO1eS206G4TBqN}P>R4G8UzI%5C=)MU`0uA==E|2z!#D0FK{f0^) z29>6KkR2=Z=5SGE<@pT9H7El95*-Fg2RGbA&_SPWOjxr@d#GGp*3mi(O7Z!bAQ;hl z#qY=Yc3gc%v}tY|wcM`x{l*rlrR1a%I4i%xoBWt3O3W`jEKdQa-pGkPP?eUx#L{YN z;O)Y9&k(k2yyMZh?0?*!Rz^nGGG2Qy^@NmlpgVBurBN;r4#}U4b{kq-e@b!h8ZGlb zB0pJDz$dtj<=v7zS#vj}=vzDHjFg>NlkMlVEhU5h$kxe}&MLYgIRAR|%M-tqlq!R- z6~JaKNMTHyd=2Z10vx|iUox~*vQ+%ETsLz-7Ru`~OQ&*MG8(kmERG67+$y-1Yo4T|=MDgbX+P?oK?MyVDHNavkM*qC~O2F>DC9l=I`jTnIyyi#~wH#{veG-QTe%k3MSoF6#DTFB%W6#|n@+`e;b z-rAcDXCo0h+m0(ADYoudtH+;oVW;)9{toQlJ*__j^1_9#(%4yOkV2A|CYQ;*8v zYUn6&Y%0H`S92RA<4<)3<<_(mj{oZYxSnXAza{i3 z0N?2x*pwQuFJ)9>b8oC)llv>t4H@ydCy#yJA(m=DSh`jQQv6pKx-G5 zWLSj^3L6%8S{2Tp2W);N&Hoy^z_LOAKryI&w-y&LU7IV9Kk6QT&YQ|e`FZu9^7=`i zC&)wXiKCsRabOdz6^?r&^FDlNv@)i1IoYAR%eOYeGF{OQ{ME3HljHFHiZcstvas;(G6WyzK)ScLb8HiJ7m#j<_k3CoC>w zw*Bww%yOU6f_4R?#bx6rz%-BnPT61B;F>Gzw};Ku;B8`=p;rewqIUV-TQ`P~xju0{ zJKlS`@aE3g=4_KuM1Q`CjF!7_Pd~?L=LMNHVSWKeQ|=YdoN{>H*MY;>?QEBWX*@bf z(S6J|^Hxnk2{Adp=jo4x?hzK}8VlZJ7k}a0eB4+mf5lNEC2I zwjQzWt`2wm?yXo;E1W*-7*Cb+Tl>zN<`IMz<*ArMXqy>1f7v)yNOGMQNo}xy+D9#K z`L5nSTCb!)1%?iBl~cmi4$qAC#Ny4vmvp*r0!FVKR*eo-vQk3XwQ2k z<86JjGe@l~pTWt40@T^dI8(o+09c8~pz_K6)nqzoV!5O(pN*`l4Ih#!eY*NVw-jB^{CD*dVL-bM zE@j%_#D3CE1Xo&pe`|Bo=urI=9`F~R1CBc4s`dH}p|Gv^8`j0E_i8p9Uv7L7fBYjp zD(A7tW7)-!sDi*f{?5~nDOs)gMS0%IuPj7AsRunvhDJ~b)d*Kmv4~%bfAw0Zc9%Bu zXPV@eio`BW4dXm=zKj-e%FZ#Vevok8GK{-Xv_+sI`VMrcuD0vS+5UXl=2p4m;a2#_ za(Rj!X~YJL7nvx1rdMhAFe<45@{;{DoT1(0LoY&`BZ=ucV7h}z; zyfi8h2r#mVpZSq)IRB(zjpe7^Mg9B5^+)|8pPpuEBz+6%Q{Jia-g+d#wYTn!>L?X@ z-qNjnxNSvy@mj=n`?Re7njhMkY#|DD3@a#Xr1h;83LZNwonzsZz(Wfbu@&uM7r}?y zrUP>-6dzns*_--#hStSw-e-Hm!Lx(tslb!Bg72G=1-DcGroZI zyN#FJ`rfAaZAf(uwfKBH(rS9N!rg9rp|bDUg7nk18Br3uwo=uk%<1P7ch~~x9pbGM z@-3>D(oj<-N%8?zs*Bem;&ENltJe<3`~38h`g(UuPjIM)mI#)mHLBeUeLO@GQl1&x z-?N=WFCXQYO|IBNor-Y&OERVpGbO<@fVog_t3F8>Xi`|oQq5P|Kiv_kxKf`%cFYW7 z?NCLZ&N0;g+6ox9PsgXm+UCD$zi!imc=uHCscCUXJ8@hz9PW4tnIGYq4moV+Cz>C5 zYv{E$a^<{toRR^p!v|nU&?Xvjtv-r_6A##`+Hk?fZt0 z!c*2pE0U#J_BWgg8F1dC^4_+#iq>qBE?7TP)K1cLymTCMxgs>w8yjHb2=-+Dr)y?+vk&JGns;J(Ek)!T_SzANJ2Y85kxFAv#(g{URet zKO1g4UDtOOcv@qRW6KetO)O*MWjlBugdV{6B~JL^YBOFx;7Jzc@@;+1A~98q@`x;- z4jdol37yhnE$9y17kLWARHRQXgqUiz7ENJ>jd#-a$ET;}LmEBO6JCp|4W6hEs1j-G z=*;WZ+}}Aix?#)hi*pD&Xf4o^UQWlh`;Qh=r+livHZvIfpxcD1{IOJs%-J*U_3+Pw zN=<;xc8WWU%uxQc63x_5c&j28c&1VkA3BiqCYjPmRODt*vt?v+S@Z+OJtrQGL@S}X z!~5wAAC7IGDT|Ql4%0FZh>$Uor>=yg0O6(2{XJE2=PB8^Fy_F#y}Sgn6@ja3Tdkg=^vS&8YRakAJ9GUi`j3 z#aih6CO{+iw&A5;v|V>zF>aKku8fA~;66zWI4g;(tZ?UW0@)CQm(irz)0^#aeZAVx zwli*gx6SvHmokG#1-uE9xWNrNygRTu>=Ff4v}Lc~3>AWw)-VUXsg28kwVRKYmv7Ez zxTB7jGZ&LV*zKZ6=KQ6(*)o7W&%Y8HWjo)z<9re<0(rX?$*icltR*kSc^Itg_P#MH zW5)LQ`SdERHl=0A`a1K<&#siEhnKa=P-pz+S@elRCSH@)3TMk&iow;S2Gm83su5SO z>fF|Oll;nwE1+Zf)6v?O?lC&8HGS1EQ+-C%3+!u8YDYI(W6_KEn4ymM69SjjGpirc zSLIs-_jov0uZwGKpNHuX9WTDYas>Zl>sV2u|YQC7zTLHjSZVGXlhW&Qb{vs2>8j|440s?(+Y?4xea zFW#b*3@f67c@`wLg#+fQ*k@}TUfA7NC*75Es&TK&t@NiCB|5YB{cMi3#kUz1zyYUA^N|PCclM-8%2Rfmx<|qb z1k3T&II;0cPrR^xiEd2Ghq|;c2K*$SNvAWlrk@3+=bn45e|GMb85a2*Hi;`$7uLra z1?A#I?|yp7Z&+<&XJsqfznFeKdI!flU(Y0xy8Ga>Of%W_stj4xah{u86RLD@+xK}u zJh|x|>XCnu=#Fm(Nw~b_Ry3}E%8;kHx-Su|Z+hgZb%LEulGB|3xOJp1SUK|LyWu*t z%)9TU#E&Lwg@x2l-c9_;u~eE%!7kog9}0u1}7Ca(7vE zoui^jEx0oE3S)`d4$1qq!}LWyFLQ2=+D7g&yCE&igjjnu+kYns!^Bq1((7kj#+u;b zE2IWj`NrMPq{(%*S@@6vVpmOB91##%Tss-|(AK&%Z*yQ-L~hXId)xj{z+TRSQtOA_ zSERy0(Cz33p6+8aqYr|ymk_-rv}E;u7zw(TmpyWCR8+$zXC~DJSq{i2vXSSRhuOAF zk|(#j5_mq?rc`be{{zjvyc}?4YbN{k_j9JiDO<}JvArZav8l4Hj}M1X_a42~$yee* z!TByhR+`&1dB$rK9?cr9EiR0z;puvE1vF9HCpyN`8=tYD!s+tGHzCl_W&ol&x`Uiw zUmqvEl-6E9@owIj7yG26e7S9}=BN63F$YwINZT~PX5udW16LOSz6qp>>P@0VT32M6 z8r=}Q_p!ig<7VU9aZej$TZIY!h_51z=?=V&6ymGuJlf~>!bpB0MOG0z0!!C}MI}D|`6Ho|F;LRyRSZc+ ztN0FE&!>p9R!jc1^X1;98XFSuzY+N#aK7%6iv=0r+ip)L@Tq&NI!w#=dxQ)p%t06a z1@EgQBClFLRsF)r@duhi6p&f@KSf%aY=WHt8TkWk#t^8yj_K~ zlE=ZgxS`64#PGa@m&nk?{+3LZWD}4j@K|O03`(0I~Ta5PS8apySs8 zS?@pyN2IkicZWcD(5&P~C}1jCTy_h#zeEf(xh??m;{)#H43=Ky3l-sfKeF&x|s`ri=h0P?e;9ujf(l#1EC<)-G5e0UaU2i*X;?g z$a)ucCWy3N@!!0uf9&2R)hd7VU2BX`I8F82aP9YY0#3TjVxvNH%p?kbc2jNoWa=Q- z3pe%E{VXeH$TCvy=V{>Cs#*1!MBP?|dAxhK-0*AZ6+Q`h@4Z2NQkKPjErm(>y=*Pw zrtD1Y@)e0`|1TnlZQR~Y8h+wIp5aBxOrpum+}zxRX?3AmD-_U`#xejv^gg(EZ+0WQ z=zH4f0`Jst<-RCIHyIQWB@gi(UI{3)XbQ`E-fpg~s0bwN6Jy|eL~ie~WFh$rEWWvl znbn_Os3wf@`lAq>_4(FIp}JqE z1Lh|a7vy$(%qx0`&Uyx6tF8V(Mwc-3K--e#d&CvFF&};nvEy#}6NgP>(iJAYjRp*n zM(x4(cf8fR#@Gkvw&ZVdL-{7F@;Kig*IOkE%BOrgjt_9oK*jB8pDOPt5Ij>W@cF@z zh)(G4RpYbR(#XXU?HAYR8Nl*07)QDC@r#V9V6pSHjk9ueuk0)veohe5$JY*qNweCZP+GJ z?fLQQ{;!XbRisMP;Tyc~KZs?THd9GV^jsT>zN(W9`ruALWy!t+}3NzfwZ2hroXC9kx*bDwqkAK6P1R2Vr(;dvFh8@w7kY zU2nj5BcStST8uC*b*$*8^5Ts8d3cz5B9+8F!nj^#blm_@N~Ax_44VBFcJce)dy+I z>c;h+%yO(RbtXLl(%Cvz|IM!(clh=u=9*ucXpdfQV|8m|2S7T?H7kjk@Hc5Kjsphj zlLhY~Vs*2ca(>zKi;8}0biA4lkNY=Qatf+uLADH5P`;PFOR0W>vXz&Xd@(?lJ8k<@ z=+b?WsepsY4epPA*|~QvyDIm8XbaBP8J0lsw11;RLpV0ohT5H zx-gj(QSt{cI2Vv69Lt!3kz0!4P^*b@E7ckMuobBsnixB+h^*u_q5*XKp^z@jd#6)k zG8YY?dA;fPqIyjZqtFWUo7){iNiAoK`4w~InR42}xN3j}QW=IC$hz01u5{(S)A8=I zlec1EdrsfGeiw9@f9!2hj{AB5*?5dzk5a^wt1|n+NC}CbIvNl2FMsvUyi0DV;3X@n#-5cy< zunLUvhLy@oKb14yuSi1}6HA!-)9tthcJS9>`nD@KBhE`~`-8&RiE1B$$LJsEK+m#Y zo>P5_*-Y`Js)J)|G~VxW>TM z*CFm?XRI<$?}|##QpBTQO~3QW;9$SH)e@AX=vVj#vRIs^yH&9Oqhu6r7-j!u|M<@m zMPFrU20>4(QlLi!0QpXcHIu~y#wp};tSEGo$EzfOyIH-M@`|jeR?&T0ZZs=Q1 zEJMlTLuJD&l5gk(9MOGmErjwn$!zxH3N|8j4LiAB>VuxqD@+u~raTYj?UDjQ4a_61 zneIL6@@dtu&^j?JyG(!<$Psx1y2Jmv<*5Jq5Sw$hx=+^Jty{pPK#)8-?N&7^uiQn9 zk(Mt5O3T z2SZ37#0G{iF$A%tXE58nD9WIkLquspVBqC+RYSm2-J{!F+V9{&Olq!Dg%pUr-SCSt z-J)qb@q~ywP2gi{=5plKfS6)|7W{B4=lwpz0hvV21qCfG9PPECypxeHl;xMw$h5dv z8x;}J$SDf&`_NfNAcSeaa9~O5YHEHM{VdOk3*{L$AY~3<#VI&DOss}c?gpT>GjTyB z&SsTDxome{QXaKpoWs{9$AQu$`Rn;;7y_Ce64^$mdqbe2{hvR4h!}r#os9Bgw0BtG zNgVBiiLR9D3LF#)C8^({zGis^&I8GgjoBJ|-5h8CoMy&W?G?j&LV+_~1<}(G&U@d` zkoNLzSbd8W^u{evQ^Vai+$IF^(!gx)DwI57gV7#3IE2i2-$Zg8oVEeI0UjX zR_oj66z;@4Wk*tP1I3#Z5~N&!*tX$;^nfjU#QE9Dc>HzCTmZ)xf6{gN0Q0Ixm{6vL z^C?4^FCgi(pNS=9Bo<3_`ZPW_83$D5D7#XYE5M zgdY?Z`)-y{Ab#==X&8zQrj{Qu68|!B>6$^$XV478{h)@G!5qhL&u9emaotx45imRL zvl>mb+KYd%@Ku@Nj_3#MSRlqKbDeK_rUWWN+Sp)Cs-HTM+{|?`{yho|YIuRvoY4Tb zml$acyO%Y;+q5>u%$RfSVeAu0q?cphv+zdJ)9$MuD=a zZ$(r6tBcfE0hpr%{M+-a0O^_Ub{~mN zbAxHEZ)v+Cq~YEjR%<;yy?vmpS;m|SBIwk18nVL^0_i78;E2b2CZV_iAzFcS#k1*y5iyu!mos%cxQ*EigU*te4}^ z{Nke13ik1ZHkdY5ee9(nHH>rpnYba^VNm=41L!as3BB52#K)JS^hHWrr8tTg+V>Ci zR|lG?b`ceK?ct-B3_@jKB9i!!AQu)e6WA`MVb}~cDIgflo7=`iaD>qW-UAamS^68~ zSO`e$@Yo40PkjoU>J``QlFf3!5A^k`xiMmQ5w`l%m$C{9v@EZykP~#H4sMf8hNOrR z@&veQcVEI0d*>rXmXj5Az6b9$Up~s}Z6!EGzNe5k4=Cv0y?tAf^yH$9T{{~uCOWOA zD@A7f+jF|fczm*y`^1x=`5K9@zXigIQE38y`t*a6uZooY4terhID)hOW2F3;z{S&c z{sP9GQ}^@--${Ud{|M#KpjM`f`WT}}KdR>2+yGD}PXMTQIfF7uUb%ze6z$i7H)<_Rikiwpz3J#sU*8|4uv$l{a>{t(vIT^zM~${RJ{ z(oo?#pWKWGLfX8H3?BSdZ3w~QA0pszP&{iC@xTO!CPcOKg29)^5sp(eqXJO+r2yC; z`o|TFiv~Ij!gyh(S5h1LmKIXdL;WW)rsW0P86R;7`kNFjr`+$1tvgSZm>^MCfV2Tu zg>8OA&p~e5x`zRbkuF_gCSaRiV36sakRB+#Qs>fRCK`y_7t^+jfK{WRA8a9T2zg=g zPPz&V>~sH~6&)aRdPwIJQWX#q#ur`HS?`8`E|{gf0r;ngNHS4zaR!Jk{SbNkJbC9% zE+=%shxly(@CXHih7mCvSutuLDY(3?o+JA@NS<6pO^^^~c9RC!>z*H=$E5VS+)MW? z-WrNaMz-I1KybkeaIglALq1uLHYgE&`SS;k4)P}Otp~I83=p`a3-l1(gR$&R;iN;t zp8X&;BS?^m9d0WLnDuS#cQ%&+Pd|rNh7-PDM!;=TKw(6EH)BQLa--o<*QDkMI;0YW zOt%gOEDEafAw3k3ilOjZ7-7G>VKxzHz=_!Kp=Z(FBQ!j8gmdF&j3{AV$_RL;aMaZx z8uQthi@-_y@aqo^f{H<5C6@u0+wjG81~}j@OYToF0V0!zbcRE8{V9oFZm_pyLjbwx zdPXt9kk}|PV_d+#4KR)9;b2iPv2FtKJ^ENG!Dn{qa6nA*a6rST zOLdKXtR%4&D@lC-`A6zDS`6ZrtN7xY4D8=xi6Zz(8(+jK^m3c@)eS#RD81L2jxVqc zFQKBB;Ts0m_>y5uqX0)JN@Hw-0+^p2L|_;;Bhq;547q@u1vCIl+XngV*Es@YRXzy{ zEQ%Q)mZnv6FD!RVR7Ewr?~hqaL+0+%Dn0ZNDxD50O&VV<-XUdtcb@PZD{ z`5)vK0uEM=4|#YFq;7zoaDYS5in)WQf;wuz`Q^$4z5tvuBo{9KQdt`-?EtC)_G2fS za(IBL)JMhgE3pJr%*rV5UjZcOm7~x=gMESrBYy)>vs4t(@`#XNAf$@|R(_+_WmeH| zqjJdsH&yH8J0sF9JHG~1q!<7kUrugr2|yYc1rEMsG}e;o!v4mjj3{60@2+BzhtgnX za&t+nd5(+_d2BHpdw*l3s7bYAWl)_F<^>RwJWTM$_!h^G zk0xT#I(S|HPpDiwfLbEioPpZBM4oUK6Y;DPbSvY|?-=1o8EJ&S+PCajajA8DpxcHN4PqT)f;M zD)&5q-F&glJ#Tqth!~Wn?X&kjL(&H7&+%K^2u_q2{y9cVdJo`t%f!^TRF-hegi)~s zL6DAdH&a2vrMJeEPV`47mne&;lf~LDY>d0*ftv3bUk3c?Z{lJCLE91b!>aFiMz6PC zo_|o=cLX3T6L*46*PPb;qEUoKO`bEXn2--*lY#>1#m~>criNoew zZuJQcWPgT+y9ng-=g)V?$4c!dX}`9=`AwaDzoF$WG2+>}TNYU_Gv=et=snR73z2Ci zlpF{|`SlvjzIgFP@j8>xh~0e?*^j?2Qu#Sr1O&_7D<6NlW@Pp$s{QUmw>YF)2Z{4& zar5KuRL7<;sxMdMd`I$4s*~T$0PZ`Od+2_HAz5L<__&p&lc9|@>pu?8!R6SV{MagmLK3*K>0=fABv091~4Rqz52S zK#pQKaDT-JWJoUAX9)K5T6@l1@a<)j7xcs2EO1aoJ%LL5KpLb{L7SdhppoM8-t!vE z%+9IG)-rE7{FWpCnu4^xbZ3KCwMSuxxPuaB)RVoWf>Dj{Jcubp`^EaO#6tz9+``;T zj6x=jfH;nj*rbDXw1`Yed1orf3r$5t0f*L(TyHu z_Z(8^@_Px>$%Ny+W!tAvxA#%6x`oYXhMFKzq&@J`x8{po8b z%y5%=s)(-9(pD=G7nNJ>YGaR=-60qoXz_7+wwKvz#Ew0Iu)I(})Q}nSQIGl@=!hN8 zcW@2l8y#c#akzhaV#I2-Mqok}KC(eY|&fKU4*&4mIn`?mPde<&Eo?qZkI2c>oO5pSR~L9Y{0Z&faYQ0f{j#;w%TCIT~^C6=$2*#l@a3Q2^(x zfA-aFGC(F`nAE8k7=4fY;ys{t6ZkXYOre<)U6bFf_}zc#0p&G%^Js!yB0oS&9?hU% z+|Su90Xwfv1%smakd04X0defB_uLi)vj;=gk2%OK#Ba|7#HIwgd2FR< zU--30Ei->hWgrOgO(1tBz866c`Qv1wB!QUpxd66-KbwJDeRyQk0in{d=PU5rXu&J`M#^jjB}OTsCst`Pq3veY~t! zVU4CSLg|kWMo!W34ZpxN^T4vU^l_+@eMf)~%|l@#R+OE69mgL7`Rn-S*rRAP&~-|i z%UY;0fZ%Bp6BDz)QH>h|BBn>~KYu*u)ncOfNK*ISqF``nNP4h71mnW+4?M(d{x4f! zTLs#8e(~!&P3i9h(pCH=_G5rsoSYZ{us5IX_TCu>iscSKUBrIqDBD86yFNdkKs~CM zw@CmpmfJk|Q@`k#v0-Vws>tH=`c9ec0?-0MJjgJz=p2dUd_5wdu(tw5N6H_!0p%<; zBOn{>2rMwIT?2@;MF2Hjs?7W=#BVl~;f8T8ayxLo9=PK*e24?EslgKtXvqscAxN}e zhZ$u)-Q`LH1HtmUF?^@Q^seuum;hfp$oc&ANZh)e-o8I0VtuN1oC`Do!0TPYTMO^B%2;LY z>yLhRy*F08Uy!FED_5Y=A;pk`c@?M;;a>7Vx%yJ4*>Z>}#pQ7EbIj_tbD)4JN=^p= zQ+jVqe6IIBSE^0L-(uxoj}o^Q&;8KY9tAR7ybS_$x`GU-;bs-Z`r@A`oFq(o4x8-n z6`&>oLj0WRTt}?HOEr(lDo-AZ_je+%292l_U4NnL{7AkY%H6NPq%FxOyd|-x~X$&eSc!yQ9=r;6y((? z9aGOMRbISI$NIBkW7#mUwP_m4+$SMrjJ=OuD;-0r$MPL;gFc$rZ}#+wqPMg!ojtDt zIQ~*Mk>bR5AsrnZCY&GVRWyM+F?M?L>w^eYP`sG^gY+5KqwHRN-}mlk^Dh`VwWsSy z*X==Pw_Q<0EH;b*sPzN09hUoIpA((yHV~hE6-;S)OP(l69=E)X7_K0 zet2#2EvEPpZkwyv(~oFb1qK}Fi}XDew489l037T9c7pECAS8bPX6m<;;&rzS{Jdh^ zxqgyR#Wn0sm8<>aJKV~uH%7E~Dt3w;CG9P_;L5AgKy({>#G#k9Ms0A*1;8tSt5NA( z&@71pb`Tl(dDX!*YMKnp9OeyFPUl_=`av~r4wNVu%R<#;n>xH3L&Ki4wmR38PS?j& z&EMBzHM>viTchyGXMX>r$?wU@Tt_{S+q`F*`QzM*kq8TR*r{~|g?;40XeNVs4Z#t7Wtt}4Rt{1;pRaajWG1wp; z$ztQr8S1=|xl5F!_LI#%^7jQFOd}$y5WWc%EDh7-1J(d~rTaK{obg=7Dff$c;2w+n zy{f0{iQ2lIJdDETXj?Fc#;u7$i(onuTDA0;hLxCh7grP~i;V*j)$BP*knkOJDJAU<(a0`u&0E8 z6f{1uI2#t<`88aSCed8j-boo1fvgfG0>Wqy3rF)Bt+Q#?cQkThuKDbmR3Yw&wG5(2m zScnv;CI3!Z^66AobQ*88p8$T_PN@F0c+#bbYQKr?yoW&GIxP`(kC%5F5m2j-4=PB1_i)(;LZ(IYDteYqQ}XNi zYW;af=QQect99M0{=_8Ryi3avt)nG3m`9scIO>sjuP5KcSa?4v_{Qni}zK6FMv;@OD$4xk?@>jF*^ zV=0C*Ll$?%zItauZ>x(ip(f1^HpWU{@=`jutHUM4H}Jn`6p=S{pA-F-|Iuy4@+^o6 zEWh2xsR@dg@ybu}9D2wDHlO?U-02Lh4QFrOnFHB!PgmFfhj z;g%K!HFu7M#Jvp=hzUjbEdZL4GJ(3Q&$mEBJ?QPMi$r1`zl$Tl4lamb9w=}p-<_5A z+HfF%II9KqQ-o@b7GFD#FYx@pc9ZhciTk%VxH~eKzgFBGmSG-V~bm zeT-sux;+ZGK@^R{|3-K~FPz$m_DmcKe>w$Vv2aimcy#uM$={ez>J9+J zcIlBZ{k=>KJQx4(=Kz9}oI`s9`q%z00HNQ1w@>=-=a~C>>wlae&;ol1^G>5eGHLq{ zYCiv)Nxp6yt`;Ww5+5Suhgb}4} zdjapMN1=E@*9=Se?1pl3ava;EuZjb4Zk9y_!PETqt;aB{Td=I$To0*0fTHs8r~l#R z?9i7d-C4tx|9;1ptkA*5*XJ$sUk~LBi;jzq=1Lv~szC-opf%tPsJXd=!auBnegrb;+K9(`YnH!F}MQ{k5tf0-+)V9Ia;t&-f@sbW` zWC->olM5E)Uwu5C(lq1s{!jQby7#xBTlXIG7S69bOjy5@GZmX(HFSPwd>zd1iBuwH z62IBN&;QBe>}xQenwCYy#T6iPuHpI}{OHid4O;CuV0TV`j4Fv(Pf zuXbcq{~#yD5jl;r%bv;~I5Sn02c4ircJv^1|8GOD4VHtr>q_9g^y;l&CdRi0iH>b0 zi%*o*x3#y|sN;eNwyMMUvnCc;34(xhq~5j;2ve6_GYp*HHmb=F%CLMGAYdV1^19sc zb=&mp#gnz>6Z151u^A4-#6=Rf(U9(xZHgw44V6`vJu*z2e=ig#{E9lJx@XqA@|&9~ zb~?Mdr!|4)Y)zIwhS_5}%Yqr3L2B&{VXrBGW){^F!| z)@h)&rlb*M;v6HfbEHXezpqkmd!M}-T`|I0pw-CCow`x)S3G~z0poh zk<(vSbqe>M=I->afrx!JLf2r%7LY~@d7P397aB%~`~R$HY;oK z|7F7?&=uj3f?r+XN$!|@>mHXZgN@}HngBm)z6%ZM3Z~;KoRsj&P@XWB^dl7rzP=g? zCD0@OjL*g%SmZ+Q2|R3^r7Vqs1%$qXDD7)zvBUDEqj2X3qyp$syyN;p@DFA;nq0oR z*RBaOZ;EJp$noy|LE~cw9FZ=hxUx_>%tJnkI5F8>5G7S z=2hrZmN7O-j?fN}H9UshB;jZ&iGg;CC3cg**8wZ;Uwj;Z!_3zM6JSR7xBlMjc;*zg z>FetkdE_oL_?D)>z7z6vi}vcbV1NywlL~W%=Z0Pm4skLPS}K<|l-0`{`tIDjcke{tRHhVNP!%YDA&xIon#{^l z(l<1$H1Me*Cg@O@X0c4V^c-x-XT^e*VI26HqT^N$=@I(}BakIqVQb5w@@LJF6O%Xa zKKg(m8NU=;5?5k!j%wIQ&yl;bxYU@$$;xdad~p%4d4`o3J2>Ol8?#&5f7Y_PoT z_>{MZqDMNYE2Ie;rX8y$U2&dC&p*6}40G3)k$kthUxZQ44PMP@%CNE6YtlLx2+j0%**nyJ5<5T&I}l;uEIRYnzvg)Mqg^Bwhg;>!T0i zqAjyW+=mIh?{~Pcvv-Qx`m9}>)~ZpO?5`^)EHDM#lv1gSW!cZJ?ZiV+4#ID-#4p3I z3*!CU>lsRuot>Tj9boA!t=&{V|E%P6i=9O2!8Qq%w*&>QCKYPEZSP{BGREG-8z=52 zseOpY=M6osHnXHq-eql*aAJ98d%7{}os|DFc~(T}cH+Az-1XIx&pzC_c=E9X&Tlnc zozFRcBD^+6akh&qUzr+Q!_Kxg;TI?bwKHN8vAu?JXjy~DnOUOjvKZ6Rv+j1dMT9mg zgDbjtorm9Pd5MTui(#~+L${T9L&X zcV%i#&+k<=o6|p!3*9X`Yd?XkEH>)3YHLZurth9}DZq0IP-fT0%%?D{6Y3;Os>&5m zCa~~!a~8)p{(fMzr*#~JW!Lx zxkWWvxn+vt2fGq3rAAvuxu!bZ`;nUdX&Ry7+%3#`K=zTeLTI#{r4;d4NlNUI9xU#U zV|J^v>I*&l;2p=u$?P#flZ!Shdi4axTo#3?TVe>h0v|$l0W{AQ z9hfb+Y3=|@WOwA^8U-l90WAWw{bJ6qQ-&TX0|=`-JeM&fXg-vN=8xTOFsu6US-{T; zKlTeW$N$Ty7M9K!m7K``JSyhUp7d)F$A=O%s>XkSHSa3jY7^ z*x&aygn$B6Tv8WSTq?Iid9g~7A*}@-5m6vwH)=)&B-;wsbYm-tW3D6n%QVl^5aya@ zr@&3Rxm`aWv!z_{lGtnQi6~BkO(?5_2d>xs1Nmz(9I+1du`eDap=J{{yzUA@klLK) zjreeI>uk16l*KHFWQqtbaU5|DjmZ_qA5qK>fsk1_!0%*ifPZIRH{&1GJTX{1eWb$}q`cQ%`0MgWU~`1Xi(SWM zf|t-dRO+V><}yN%6d_L(%Jw9nS6Oj31xWkRotP2B(!8oCJS#> z`aL+;pA=qb#uLZ7OCWAA zvzXC6Y;S`{V*4?S6L1n>v{&qdBJ6$D_AuPPHT=|{Kl&Kd&+4*>T7- z52+Oq4hQ>p_+3U7U%x3D_q{L3t&s6p@-PIvqB8I+n^Df0g3q3lApKjuuhq@Gx@&Uq zh&30jp4ncssUMPN5r-goeDMk-`W%K)wti)Ic!FD&$sbK1$^+E9do!@_c0iz*H4aIc z3RDST`q+DGR_Djo+=(`y^;Le8qmL`1zwi4#5OJeR!)FOLxyPh+Elx8~=Cf&M86u&& zxXqyUbIVa1VC(b8R+K{onbVI_3R8itMe1hpOrp5 zzkInI5rFXJp_hbVuOUlzU^zP@@KIF#KJD6uUn zh!9%UBL*cdzIK0mnPffCGzk^pIzGQ|_1OqfN24GqRDK3xh%;&F>5D1MggR^N*u;}% zyTg!>kfNu%?yBy4owk1Q9*?D8)={MWgJ?S>tw+`#wB_d|t@q6RK7l zA<3}%z3T(u%!6p&$HQ+kN<}>921=!Vpq_<3&P-A?ZkYI7U>&FPIvTdwxmMVT(En=AQ0A5G^26B?}*GlQ=f*nb*5FA5neNFtnA7Ghl!H<$X(j zals)d-(*>0J=P-`YQ4924Y(N*!?+=qKmE~lr2!zK16|gfBFXu9;N2OddUgUz3n?R8c|Q4YoS@sUfyBj=9U-~*~8OJ zGI?IX-<|tC+bYB6Tp#fjNI{iNBvJ==b%j*M<=+-Y`}Pw=^@*fohNSFW4T|z5ICf-k zrm2s|yhyK4_kwoD0H0uBZgOm8+. ARG BRANCH=master -FROM docker.pkg.github.com/splunk/splunk-syslog-ng-container/splunk-syslog-ng-container:${BRANCH} +FROM splunk/scs:base-${BRANCH} COPY --from=hairyhenderson/gomplate:v3.5.0 /gomplate /usr/local/bin/gomplate diff --git a/pytest.ini b/pytest.ini index 8d7aa27..a7f0f6c 100644 --- a/pytest.ini +++ b/pytest.ini @@ -3,6 +3,7 @@ testpaths = tests addopts = -v --tb=long --splunk_type=docker + --maxfail=1 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file From 09ed79e609bbd6cccf355f2a57323d84c3b1db8e Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Sat, 8 Feb 2020 11:06:02 -0500 Subject: [PATCH 148/174] updates --- pytest.ini | 3 ++- tests/conftest.py | 13 ++++++++----- tests/docker-compose.yml | 6 +++++- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/pytest.ini b/pytest.ini index a7f0f6c..254a172 100644 --- a/pytest.ini +++ b/pytest.ini @@ -3,7 +3,8 @@ testpaths = tests addopts = -v --tb=long --splunk_type=docker - --maxfail=1 + --keepalive + --splunk_hec_token=1ec3c8ac-74b3-46f2-ba44-a7c96b6ab236 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file diff --git a/tests/conftest.py b/tests/conftest.py index a2fc51e..e5429ee 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -158,11 +158,12 @@ def sc4s(request): @pytest.fixture(scope="session") -def splunk_docker(request, docker_services, docker_ip): +def splunk_docker(request, docker_services): + docker_services.start('splunk') port = docker_services.port_for("splunk", 8089) splunk = { - 'host': docker_ip, + 'host': docker_services.docker_ip, 'port': port, 'username': request.config.getoption('splunk_user'), 'password': request.config.getoption('splunk_password'), @@ -187,12 +188,14 @@ def splunk_external(request): @pytest.fixture(scope="session") -def sc4s_docker(request, docker_services, docker_ip): - ports = { 514: docker_services.port_for("sc4s", 514) } +def sc4s_docker(docker_services): + docker_services.start('sc4s') + + ports = {514: docker_services.port_for("sc4s", 514)} for x in range(5000, 5050): ports.update({ x: docker_services.port_for("sc4s", x)}) - return docker_ip, ports + return docker_services.docker_ip, ports @pytest.fixture(scope="session") diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index e6ec6c7..34d8613 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -45,14 +45,18 @@ services: context: ../splunk hostname: splunk ports: - - "8000" + - "8000:8000" - "8088" - "8089" environment: - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SPLUNK_PASSWORD=${SPLUNK_PASSWORD} - SPLUNK_START_ARGS=--accept-license + volumes: + - splunk-var:/opt/splunk/vars volumes: results: + external: false + splunk-var: external: false \ No newline at end of file From cf2783b8ca3fb23cc379ab56a4095ff212e3f233 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Sat, 8 Feb 2020 11:10:31 -0500 Subject: [PATCH 149/174] updates --- pytest.ini | 1 + tests/pytest-ci.ini | 2 +- tests/requirements.txt | 5 +++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/pytest.ini b/pytest.ini index 254a172..572557e 100644 --- a/pytest.ini +++ b/pytest.ini @@ -5,6 +5,7 @@ addopts = --splunk_type=docker --keepalive --splunk_hec_token=1ec3c8ac-74b3-46f2-ba44-a7c96b6ab236 + -n=8 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file diff --git a/tests/pytest-ci.ini b/tests/pytest-ci.ini index 9bcb6f8..988c802 100644 --- a/tests/pytest-ci.ini +++ b/tests/pytest-ci.ini @@ -5,7 +5,7 @@ addopts = -v --tb=long --splunk_host=splunk --sc4s_host=sc4s --junitxml=/work/test-results/test.xml - -n=6 + -n=10 junit_family=xunit1 filterwarnings = ignore::DeprecationWarning diff --git a/tests/requirements.txt b/tests/requirements.txt index 7e40d01..5bb5756 100644 --- a/tests/requirements.txt +++ b/tests/requirements.txt @@ -13,7 +13,8 @@ splunk-sdk flake8 pytz flaky -pytest-docker +lovely-pytest-docker pathlib2 psutil -requests \ No newline at end of file +requests +pytest-xdist \ No newline at end of file From 03a2d4803922bbb28fe06a72bf527cbe4909962b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Sat, 8 Feb 2020 19:13:47 -0500 Subject: [PATCH 150/174] Support citrix netscaler --- docs/sources/Citrix/index.md | 53 ++++++++++++++++++ mkdocs.yml | 55 ++++++++++--------- .../etc/conf.d/filters/citrix/netscaler.conf | 9 +++ .../log_paths/lp-citrix-netscaler.conf.tmpl | 41 ++++++++++++++ .../splunk_index.csv.example | 1 + .../vendor_product_by_source.conf.example | 4 ++ .../vendor_product_by_source.csv.example | 1 + package/etc/go_templates/source_network.t | 40 ++++++++++++++ tests/test_citrix_netscaler.py | 37 +++++++++++++ 9 files changed, 214 insertions(+), 27 deletions(-) create mode 100644 docs/sources/Citrix/index.md create mode 100644 package/etc/conf.d/filters/citrix/netscaler.conf create mode 100644 package/etc/conf.d/log_paths/lp-citrix-netscaler.conf.tmpl create mode 100644 tests/test_citrix_netscaler.py diff --git a/docs/sources/Citrix/index.md b/docs/sources/Citrix/index.md new file mode 100644 index 0000000..3c2fc13 --- /dev/null +++ b/docs/sources/Citrix/index.md @@ -0,0 +1,53 @@ +# Vendor - Citrix + +## Product - Netscaler ADC + +| Ref | Link | +|----------------|---------------------------------------------------------------------------------------------------------| +| Splunk Add-on | https://splunkbase.splunk.com/app/2770/ | +| Product Manual | https://docs.citrix.com/en-us/citrix-adc/12-1/system/audit-logging/configuring-audit-logging.html | + + +### Sourcetypes + +| sourcetype | notes | +|----------------|---------------------------------------------------------------------------------------------------------| +| citrix:netscaler:syslog | None | + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| citrix_netscaler | citrix:netscaler:syslog | netfw | none | + + +### Filter type + +MSG Parse: This filter parses message content + +### Setup and Configuration + +* Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. +* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source. +* Follow vendor configuration steps per Product Manual above. Ensure the data format selected is "MMDDYYYY" + +### Options + +| Variable | default | description | +|----------------|----------------|----------------| +| SC4S_LISTEN_CITRIX_NETSCALER_SPLUNK_TCP_PORT | empty string | Enable a TCP port for this specific vendor product using the port number defined | +| SC4S_LISTEN_CITRIX_NETSCALERSPLUNK_UDP_PORT | empty string | Enable a UDP port for this specific vendor product using the port number defined | +| SC4S_ARCHIVE_CITRIX_NETSCALER_SPLUNK | no | Enable archive to disk for this specific source | +| SC4S_DEST_CITRIX_NETSCALER_SPLUNK_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | +| SC4S_DEST_CITRIX_NETSCALER_SPLUNK_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | +| SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT | no | Use "DDMMYYYY" format rather than "MMDDYYYY" | + +### Verification + +Use the following search to validate events are present + +``` +index= sourcetype=cp_log +``` + +Verify timestamp, and host values match as expected diff --git a/mkdocs.yml b/mkdocs.yml index 82c56e5..4944898 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -1,21 +1,22 @@ site_name: Splunk Connect for Syslog nav: - - Home: 'index.md' + - Home: "index.md" - Getting Started: - - 'Read First': 'gettingstarted/index.md' - - 'Podman + systemd': 'gettingstarted/podman-systemd-general.md' - - 'Docker CE + systemd': 'gettingstarted/docker-systemd-general.md' - - 'Docker CE + Swarm': 'gettingstarted/docker-swarm-general.md' - - 'Docker CE + Swarm RHEL 7.7': 'gettingstarted/docker-swarm-rhel7.md' - - 'Bring your own Envionment': 'gettingstarted/byoe-rhel7.md' - - Configuration: 'configuration.md' - - Developing: 'docs/developing/index.md' + - "Read First": "gettingstarted/index.md" + - "Podman + systemd": "gettingstarted/podman-systemd-general.md" + - "Docker CE + systemd": "gettingstarted/docker-systemd-general.md" + - "Docker CE + Swarm": "gettingstarted/docker-swarm-general.md" + - "Docker CE + Swarm RHEL 7.7": "gettingstarted/docker-swarm-rhel7.md" + - "Bring your own Envionment": "gettingstarted/byoe-rhel7.md" + - Configuration: "configuration.md" + - Developing: "docs/developing/index.md" - Sources: - About: sources/index.md - Checkpoint: sources/Checkpoint/index.md - Cisco: sources/Cisco/index.md - - 'Common Event Format': sources/CommonEventFormat/index.md + - Citrix: sources/Citrix/index.md + - "Common Event Format": sources/CommonEventFormat/index.md - CyberArk: sources/CyberArk/index.md - Forcepoint: sources/Forcepoint/index.md - Fortinet: sources/Fortinet/index.md @@ -23,30 +24,30 @@ nav: - Juniper: sources/Juniper/index.md - Microfocus: sources/Microfocus/index.md - Nix: sources/nix/index.md - - 'Palo Alto Networks': sources/PaloaltoNetworks/index.md - - 'pfSense': sources/pfSense/index.md + - "Palo Alto Networks": sources/PaloaltoNetworks/index.md + - "pfSense": sources/pfSense/index.md - Proofpoint: sources/Proofpoint/index.md - Symantec: sources/Symantec/index.md - Ubiquiti: sources/Ubiquiti/index.md - VMware: sources/VMware/index.md - Zscaler: sources/Zscaler/index.md - - 'Demo Lab': 'demo.md' - - Performance: 'performance.md' - - Troubleshooting: 'troubleshooting.md' - - 'Upgrading SC4S': 'upgrade.md' + - "Demo Lab": "demo.md" + - Performance: "performance.md" + - Troubleshooting: "troubleshooting.md" + - "Upgrading SC4S": "upgrade.md" markdown_extensions: - - toc: - permalink: True - - smarty - - fenced_code - - sane_lists - - codehilite + - toc: + permalink: True + - smarty + - fenced_code + - sane_lists + - codehilite theme: - name: 'material' + name: "material" palette: - primary: 'black' - accent: 'orange' - favicon: 'logo.png' - logo: 'logo.png' + primary: "black" + accent: "orange" + favicon: "logo.png" + logo: "logo.png" diff --git a/package/etc/conf.d/filters/citrix/netscaler.conf b/package/etc/conf.d/filters/citrix/netscaler.conf new file mode 100644 index 0000000..121a417 --- /dev/null +++ b/package/etc/conf.d/filters/citrix/netscaler.conf @@ -0,0 +1,9 @@ +filter f_citrix_netscaler { + match("^citrix_netscaler", value("fields.sc4s_vendor_product")); +}; +filter f_citrix_netscaler_message { + message( + '^(<\d{1,3}>) (\d\d\/\d\d\/\d\d\d\d\:\d\d:\d\d:\d\d [^ ]{3}+) ([^ ]+) (.*)' + flags(store-matches) + ); +}; diff --git a/package/etc/conf.d/log_paths/lp-citrix-netscaler.conf.tmpl b/package/etc/conf.d/log_paths/lp-citrix-netscaler.conf.tmpl new file mode 100644 index 0000000..ed11613 --- /dev/null +++ b/package/etc/conf.d/log_paths/lp-citrix-netscaler.conf.tmpl @@ -0,0 +1,41 @@ +# Citrix Netscaler ADC +{{- /* The following provides a unique port source configuration if env var(s) are set */}} +{{- $context := dict "port_id" "CITRIX_NETSCALER" "parser" "citrix_netscaler" }} +{{- tmpl.Exec "t/source_network.t" $context }} + +log { + junction { +{{- if or (or (getenv (print "SC4S_LISTEN_CITRIX_NETSCALER_TCP_PORT")) (getenv (print "SC4S_LISTEN_CITRIX_NETSCALER_UDP_PORT"))) (getenv (print "SC4S_LISTEN_CITRIX_NETSCALER_TLS_PORT")) }} + channel { + # Listen on the specified dedicated port(s) for CITRIX_NETSCALER traffic + source (s_CITRIX_NETSCALER); + flags (final); + }; +{{- end}} + channel { + # Listen on the default port (typically 514) for CITRIX_NETSCALER traffic + source (s_DEFAULT); + filter(f_citrix_netscaler); + flags(final); + }; + }; + + rewrite { + set("citrix_netscaler", value("fields.sc4s_vendor_product")); + r_set_splunk_dest_default(sourcetype("citrix:netscaler:syslog"), index("netfw")) + }; + + parser {p_add_context_splunk(key("citrix_netscaler")); }; + parser (compliance_meta_by_source); + rewrite { set("$(template ${.splunk.sc4s_template} $(template t_msg_only))" value("MSG")); }; + +{{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_CITRIX_NETSCALER_HEC" "no")) }} + destination(d_hec); +{{- end}} + +{{- if or (conv.ToBool (getenv "SC4S_ARCHIVE_GLOBAL" "no")) (conv.ToBool (getenv "SC4S_ARCHIVE_CITRIX_NETSCALER" "no")) }} + destination(d_archive); +{{- end}} + + flags(flow-control,final); +}; diff --git a/package/etc/context_templates/splunk_index.csv.example b/package/etc/context_templates/splunk_index.csv.example index 6d36fa8..c307ca6 100644 --- a/package/etc/context_templates/splunk_index.csv.example +++ b/package/etc/context_templates/splunk_index.csv.example @@ -18,6 +18,7 @@ #cisco_ios,index,netops #cisco_ise,index,netauth #cisco_nx_os,index,netops +#citrix_netscaler,index,netfw #local_example,index,main #forcepoint_webprotect,index,netproxy #fortinet_fortios_event,index,netops diff --git a/package/etc/context_templates/vendor_product_by_source.conf.example b/package/etc/context_templates/vendor_product_by_source.conf.example index 591fa77..8be917a 100644 --- a/package/etc/context_templates/vendor_product_by_source.conf.example +++ b/package/etc/context_templates/vendor_product_by_source.conf.example @@ -2,6 +2,10 @@ filter f_test_test { host("testvp-*" type(glob)) #or netmask(xxx.xxx.xxx.xxx/xx) }; +filter f_citrix_netscaler { + host("test_ctitrixns-*" type(glob)) + #or netmask(xxx.xxx.xxx.xxx/xx) +}; filter f_juniper_idp { host("jnpidp-*" type(glob)) #or netmask(xxx.xxx.xxx.xxx/xx) diff --git a/package/etc/context_templates/vendor_product_by_source.csv.example b/package/etc/context_templates/vendor_product_by_source.csv.example index 193732e..1901afe 100644 --- a/package/etc/context_templates/vendor_product_by_source.csv.example +++ b/package/etc/context_templates/vendor_product_by_source.csv.example @@ -1,5 +1,6 @@ f_test_test,sc4s_vendor_product,"test_test" f_cisco_meraki,sc4s_vendor_product,"cisco_meraki" +f_citrix_netscaler,sc4s_vendor_product,"citrix_netscaler" f_infoblox,sc4s_vendor_product,"infoblox" f_juniper_nsm,sc4s_vendor_product,"juniper_nsm" f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp" diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t index a49e89b..0a59bcd 100644 --- a/package/etc/go_templates/source_network.t +++ b/package/etc/go_templates/source_network.t @@ -88,10 +88,50 @@ source s_{{ .port_id }} { {{ else if eq .parser "cisco_meraki_parser" }} parser (p_cisco_meraki); rewrite(set_rfc5424_epochtime); +{{ else if eq .parser "citrix_netscaler" }} + parser { +{{- if (conv.ToBool (getenv "SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT" "yes")) }} + #01/10/2001:01:01:01 GMT + date-parser(format('%d/%m/%Y:%H:%M:%S %Z') + template("$2")); + }; +{{ else }} + #10/01/2001:01:01:01 GMT + date-parser(format('%m/%d/%Y:%H:%M:%S %Z') + template("$2")); + }; +{{- end}} + rewrite { + set("citrix_netscaler" value("fields.sc4s_syslog_format")); + set("citrix_netscaler" value("fields.sc4s_vendor_product")); + set("$3" value("HOST")); + set("$4" value("MESSAGE")); + }; {{ else if eq .parser "no_parse" }} rewrite(set_no_parse); {{ else }} if { + filter(f_citrix_netscaler_message); + parser { +{{- if (conv.ToBool (getenv "SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT" "yes")) }} + #01/10/2001:01:01:01 GMT + date-parser(format('%d/%m/%Y:%H:%M:%S %Z') + template("$2")); + }; +{{ else }} + #10/01/2001:01:01:01 GMT + date-parser(format('%m/%d/%Y:%H:%M:%S %Z') + template("$2")); + }; +{{- end}} + rewrite { + set("citrix_netscaler" value("fields.sc4s_syslog_format")); + set("citrix_netscaler" value("fields.sc4s_vendor_product")); + set("$3" value("HOST")); + set("$4" value("MESSAGE")); + }; + + } elif { filter(f_rfc5424_strict); parser { syslog-parser(flags(syslog-protocol)); diff --git a/tests/test_citrix_netscaler.py b/tests/test_citrix_netscaler.py new file mode 100644 index 0000000..038eede --- /dev/null +++ b/tests/test_citrix_netscaler.py @@ -0,0 +1,37 @@ +# Copyright 2019 Splunk, Inc. +# +# Use of this source code is governed by a BSD-2-clause-style +# license that can be found in the LICENSE-BSD2 file or at +# https://opensource.org/licenses/BSD-2-Clause +import datetime +import random +import pytz + +from jinja2 import Environment, environment + +from .sendmessage import * +from .splunkutils import * +import random + +env = Environment(extensions=['jinja2_time.TimeExtension']) + +#<12> 01/10/2001:01:01:01 GMT netscaler ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - - +def test_citrix_netscaler(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "test-ctitrixns-{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) + pid = random.randint(1000, 32000) + + mt = env.from_string("{{ mark }} {% now 'utc', '%m/%d/%Y:%H:%M:%S' %} GMT {{ host }} ABC-D : SSLVPN HTTPREQUEST 1234567 : Context username@192.0.2.1 - SessionId: 12345- example.com User username : Group(s) groupname : Vserver a1b2:c3d4:e5f6:a7b8:c9d0:e1f2:a3b4:c5d6:123 - 01/01/2001:01:01:01 GMT GET file/path.gif - -\n") + message = mt.render(mark="<12>", host=host, pid=pid) + + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string("search index=netfw host={{ host }} sourcetype=\"citrix:netscaler:syslog\" | head 2") + search = st.render(host=host, pid=pid) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 From b7365128d4303da616c1a8b051fb97781fc5e672 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Sun, 9 Feb 2020 22:26:22 -0500 Subject: [PATCH 151/174] Add Cisco ACI Support Fixes #286 --- docs/sources/Cisco/index.md | 48 ++++++++++++++++ package/etc/conf.d/filters/cisco/apic.conf | 6 ++ .../conf.d/log_paths/lp-cisco_apic.conf.tmpl | 56 +++++++++++++++++++ .../splunk_index.csv.example | 2 + tests/conftest.py | 1 + tests/splunkutils.py | 5 +- tests/test_cisco_apic.py | 53 ++++++++++++++++++ tests/test_cisco_asa.py | 2 +- 8 files changed, 170 insertions(+), 3 deletions(-) create mode 100644 package/etc/conf.d/filters/cisco/apic.conf create mode 100644 package/etc/conf.d/log_paths/lp-cisco_apic.conf.tmpl create mode 100644 tests/test_cisco_apic.py diff --git a/docs/sources/Cisco/index.md b/docs/sources/Cisco/index.md index b0234dd..22242e5 100644 --- a/docs/sources/Cisco/index.md +++ b/docs/sources/Cisco/index.md @@ -48,6 +48,54 @@ index= sourcetype=cisco:acs Verify timestamp, and host values match as expected +## Product - APIC (ACI) + +| Ref | Link | +|----------------|---------------------------------------------------------------------------------------------------------| +| Splunk Add-on | No current add-on for syslog events | +| Product Manual | https://community.cisco.com/t5/security-documents/acs-5-x-configuring-the-external-syslog-server/ta-p/3143143 | + + +### Sourcetypes + +| sourcetype | notes | +|----------------|---------------------------------------------------------------------------------------------------------| +| cisco:apic:acl: | APIC events from leaf switches | +| cisco:apic:events | APIC events from any component used | + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| cisco_apic_acl | cisco:apic:acl | netfw | None | +| cisco_apic_events | cisco:apic:events | netops | None | + +### Filter type + +PATTERN MATCH + +### Setup and Configuration + +* No special steps required + +### Options + +| Variable | default | description | +|----------------|----------------|----------------| +| SC4S_LISTEN_CISCO_APIC_TCP_PORT | empty string | Enable a TCP port for this specific vendor product using the number defined | +| SC4S_LISTEN_CISCO_APIC_UDP_PORT | empty string | Enable a UDP port for this specific vendor product using the number defined | +| SC4S_ARCHIVE_CISCO_APIC | no | Enable archive to disk for this specific source | +| SC4S_DEST_CISCO_APIC_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | + +### Verification + +Use the following search to validate events are present + +``` +index= sourcetype=cisco:apic:* +``` + +Verify timestamp, and host values match as expected ## Product - ASA (Pre Firepower) diff --git a/package/etc/conf.d/filters/cisco/apic.conf b/package/etc/conf.d/filters/cisco/apic.conf new file mode 100644 index 0000000..ea6660d --- /dev/null +++ b/package/etc/conf.d/filters/cisco/apic.conf @@ -0,0 +1,6 @@ + +filter f_cisco_apic { + program('^%LOG_LOCAL\d-\d-'); + or + program('^%ACLLOG-\d-ACLLOG_PKTLOG'); +}; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/lp-cisco_apic.conf.tmpl b/package/etc/conf.d/log_paths/lp-cisco_apic.conf.tmpl new file mode 100644 index 0000000..cd3d9f9 --- /dev/null +++ b/package/etc/conf.d/log_paths/lp-cisco_apic.conf.tmpl @@ -0,0 +1,56 @@ +# Cisco APIC +{{- /* The following provides a unique port source configuration if env var(s) are set */}} +{{- $context := dict "port_id" "CISCO_APIC" "parser" "rfc3164" }} +{{- tmpl.Exec "t/source_network.t" $context }} + +log { + junction { +{{- if or (or (getenv (print "SC4S_LISTEN_CISCO_APIC_TCP_PORT")) (getenv (print "SC4S_LISTEN_CISCO_APIC_UDP_PORT"))) (getenv (print "SC4S_LISTEN_CISCO_APIC_TLS_PORT")) }} + channel { + # Listen on the specified dedicated port(s) for CISCO_APIC traffic + source (s_CISCO_APIC); + flags (final); + }; +{{- end}} + channel { + # Listen on the default port (typically 514) for CISCO_APIC traffic + source (s_DEFAULT); + filter(f_cisco_apic); + flags(final); + }; + }; + + rewrite { + guess-time-zone(); + }; + if { + filter { + program('^%ACLLOG-\d-ACLLOG_PKTLOG') + }; + rewrite { + set("cisco_APIC_acl", value("fields.sc4s_vendor_product")); + r_set_splunk_dest_default(sourcetype("cisco:apic:acl"), index("netfw"), template("t_hdr_msg")) + }; + parser { p_add_context_splunk(key("cisco_apic_acl")); }; + + } elif { + rewrite { + set("cisco_APIC_events", value("fields.sc4s_vendor_product")); + r_set_splunk_dest_default(sourcetype("cisco:apic:events"), index("netops"), template("t_hdr_msg")) + }; + parser { p_add_context_splunk(key("cisco_apic_events")); }; + }; + + parser (compliance_meta_by_source); + rewrite { set("$(template ${.splunk.sc4s_template} $(template t_hdr_msg))" value("MSG")); }; + +{{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_CISCO_APIC_HEC" "no")) }} + destination(d_hec); +{{- end}} + +{{- if or (conv.ToBool (getenv "SC4S_ARCHIVE_GLOBAL" "no")) (conv.ToBool (getenv "SC4S_ARCHIVE_CISCO_APIC" "no")) }} + destination(d_archive); +{{- end}} + + flags(flow-control,final); +}; diff --git a/package/etc/context_templates/splunk_index.csv.example b/package/etc/context_templates/splunk_index.csv.example index 6d36fa8..827a419 100644 --- a/package/etc/context_templates/splunk_index.csv.example +++ b/package/etc/context_templates/splunk_index.csv.example @@ -13,6 +13,8 @@ #checkpoint_splunk_web,index,netproxy #checkpoint_splunk,index,netops #checkpoint_splunk,index,netops +#cisco_apic_acl,index,netfw +#cisco_apic_events,index,netops #cisco_acs,index,netauth #cisco_asa,index,netfw #cisco_ios,index,netops diff --git a/tests/conftest.py b/tests/conftest.py index e5429ee..271f3a5 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -14,6 +14,7 @@ import splunklib.client as client + @pytest.fixture(scope="module") def setup_wordlist(): path_to_current_file = os.path.realpath(__file__) diff --git a/tests/splunkutils.py b/tests/splunkutils.py index bb77a58..205fcfa 100644 --- a/tests/splunkutils.py +++ b/tests/splunkutils.py @@ -24,12 +24,13 @@ def splunk_single(service, search): if stats["isDone"] == "1": break - sleep(2) + else: + sleep(2) # Get the results and display them resultCount = stats["resultCount"] eventCount = stats["eventCount"] - if resultCount > 0 or tried > 15: + if resultCount > 0 or tried > 5: break else: tried += 1 diff --git a/tests/test_cisco_apic.py b/tests/test_cisco_apic.py new file mode 100644 index 0000000..b7509fb --- /dev/null +++ b/tests/test_cisco_apic.py @@ -0,0 +1,53 @@ +# Copyright 2019 Splunk, Inc. +# +# Use of this source code is governed by a BSD-2-clause-style +# license that can be found in the LICENSE-BSD2 file or at +# https://opensource.org/licenses/BSD-2-Clause +import random + +from jinja2 import Environment + +from .sendmessage import * +from .splunkutils import * + +env = Environment(extensions=['jinja2_time.TimeExtension']) + +#<11>July 22 22:45:28 apic1 %LOG_LOCAL0-2-SYSTEM_MSG [F0110][soaking][node-failed][critical][topology/pod-1/node-102/fault-F0110] Node 102 not reachable. unknown +def test_cisco_aci(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %LOG_LOCAL0-2-SYSTEM_MSG [F0110][soaking][node-failed][critical][topology/pod-1/node-102/fault-F0110]\n") + message = mt.render(mark="<165>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string("search index=netops host=\"{{ host }}\" sourcetype=\"cisco:apic:events\" | head 2") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + +#%ACLLOG-5-ACLLOG_PKTLOG +def test_cisco_aci_acl(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %ACLLOG-5-ACLLOG_PKTLOG unable to locate real message\n") + message = mt.render(mark="<165>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"cisco:apic:acl\" | head 2") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 diff --git a/tests/test_cisco_asa.py b/tests/test_cisco_asa.py index edc2389..db8d3ac 100644 --- a/tests/test_cisco_asa.py +++ b/tests/test_cisco_asa.py @@ -46,7 +46,7 @@ def test_cisco_asa_traditional_nohost(record_property, setup_wordlist, setup_spl sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) - st = env.from_string("search index=netfw sourcetype=\"cisco:asa\" \"%ASA-4-402119\" \"{host}\" | head 2") + st = env.from_string("search index=netfw sourcetype=\"cisco:asa\" \"%ASA-4-402119\" \"{{ host }}\" | head 2") search = st.render(host=host) resultCount, eventCount = splunk_single(setup_splunk, search) From 230b79cabc5e678fbbb660b93cb9fa68a350f4b9 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 05:22:04 -0500 Subject: [PATCH 152/174] Update pytest.ini --- pytest.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pytest.ini b/pytest.ini index 572557e..fae841c 100644 --- a/pytest.ini +++ b/pytest.ini @@ -5,7 +5,7 @@ addopts = --splunk_type=docker --keepalive --splunk_hec_token=1ec3c8ac-74b3-46f2-ba44-a7c96b6ab236 - -n=8 + -n=4 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file From 5a6ebd1c93762f3d9cdaf2ef3742530d89bc7770 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 10:58:56 -0500 Subject: [PATCH 153/174] Support cisco UCM Fixes #251 --- docs/sources/Cisco/index.md | 48 +++++++- package/etc/conf.d/filters/cisco/ucm.conf | 13 +++ .../conf.d/log_paths/lp-cisco_ucm.conf.tmpl | 62 ++++++++++ package/etc/go_templates/source_network.t | 18 +++ tests/docker-compose.yml | 1 + tests/test_cisco_ucm.py | 110 ++++++++++++++++++ 6 files changed, 251 insertions(+), 1 deletion(-) create mode 100644 package/etc/conf.d/filters/cisco/ucm.conf create mode 100644 package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl create mode 100644 tests/test_cisco_ucm.py diff --git a/docs/sources/Cisco/index.md b/docs/sources/Cisco/index.md index b0234dd..9928aec 100644 --- a/docs/sources/Cisco/index.md +++ b/docs/sources/Cisco/index.md @@ -48,7 +48,6 @@ index= sourcetype=cisco:acs Verify timestamp, and host values match as expected - ## Product - ASA (Pre Firepower) | Ref | Link | @@ -283,3 +282,50 @@ index= sourcetype=merkai Verify timestamp, and host values match as expected +## Product - UCM + +| Ref | Link | +|----------------|---------------------------------------------------------------------------------------------------------| +| Splunk Add-on | na | +| Product Manual | multiple | + + +### Sourcetypes + +| sourcetype | notes | +|----------------|---------------------------------------------------------------------------------------------------------| +| cisco:ucm | None | + +### Sourcetype and Index Configuration + +| key | sourcetype | index | notes | +|----------------|----------------|----------------|----------------| +| cisco_ucm | cisco:ucm | ucm | None | + + +### Filter type + +PATTERN MATCH + +### Setup and Configuration + +* Refer to Cisco support web site + +### Options + +| Variable | default | description | +|----------------|----------------|----------------| +| SC4S_LISTEN_CISCO_UCM_TCP_PORT | empty string | Enable a TCP port for this specific vendor product using the number defined | +| SC4S_LISTEN_CISCO_UCM_UDP_PORT | empty string | Enable a UDP port for this specific vendor product using the number defined | +| SC4S_ARCHIVE_CISCO_UCM | no | Enable archive to disk for this specific source | +| SC4S_DEST_CISCO_UCM_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | + +### Verification + +Use the following search to validate events are present + +``` +index= sourcetype=cisco:ucm +``` + +Verify timestamp, and host values match as expected \ No newline at end of file diff --git a/package/etc/conf.d/filters/cisco/ucm.conf b/package/etc/conf.d/filters/cisco/ucm.conf new file mode 100644 index 0000000..8c08664 --- /dev/null +++ b/package/etc/conf.d/filters/cisco/ucm.conf @@ -0,0 +1,13 @@ + +filter f_cisco_ucm { + message("^%UC\_") + or + message("^%CCM\_") +}; + +filter f_cisco_ucm_message { + message( + '^(<\d{1,3}>)\d*: (?:([^:]+): )?(.*) : (%.*)' + flags(store-matches) + ); +}; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl b/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl new file mode 100644 index 0000000..cde238a --- /dev/null +++ b/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl @@ -0,0 +1,62 @@ +# Cisco UCM +{{- /* The following provides a unique port source configuration if env var(s) are set */}} +{{- $context := dict "port_id" "CISCO_UCM" "parser" "rfc3164" }} +{{- tmpl.Exec "t/source_network.t" $context }} + +log { + junction { +{{- if or (or (getenv (print "SC4S_LISTEN_CISCO_UCM_TCP_PORT")) (getenv (print "SC4S_LISTEN_CISCO_UCM_UDP_PORT"))) (getenv (print "SC4S_LISTEN_CISCO_UCM_TLS_PORT")) }} + channel { + # Listen on the specified dedicated port(s) for CISCO_UCM traffic + source (s_CISCO_UCM); + flags (final); + }; +{{- end}} + channel { + # Listen on the default port (typically 514) for CISCO_UCM traffic + source (s_DEFAULT); + filter(f_cisco_ucm); + flags(final); + }; + }; + + if { + filter { + message( + 'Node ?ID(?:\:|\=)([^ \]]+)' + flags(store-matches) + ); + }; + rewrite { + set("$1" value("HOST") ); + }; + } elif { + filter { + message( + ' on node ([^ ]+\. |[^ ]+ )' + flags(store-matches) + ); + }; + rewrite { + set("$1" value("HOST") ); + }; + }; + + rewrite { + set("cisco_ucm", value("fields.sc4s_vendor_product")); + r_set_splunk_dest_default(sourcetype("cisco:ucm"), index("main")) + }; + parser {p_add_context_splunk(key("cisco_ucm")); }; + parser (compliance_meta_by_source); + rewrite { set("$(template ${.splunk.sc4s_template} $(template t_hdr_msg))" value("MSG")); }; + +{{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_CISCO_UCM_HEC" "no")) }} + destination(d_hec); +{{- end}} + +{{- if or (conv.ToBool (getenv "SC4S_ARCHIVE_GLOBAL" "no")) (conv.ToBool (getenv "SC4S_ARCHIVE_CISCO_UCM" "no")) }} + destination(d_archive); +{{- end}} + + flags(flow-control,final); +}; diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t index a49e89b..236247e 100644 --- a/package/etc/go_templates/source_network.t +++ b/package/etc/go_templates/source_network.t @@ -100,6 +100,24 @@ source s_{{ .port_id }} { } elif { parser (p_cisco_meraki); rewrite(set_rfc5424_epochtime); + } elif { + filter(f_cisco_ucm_message); + parser { + #Oct 14 2015 05:50:19 AM.484 UTC + #Apr 21 19:01:35.638 UTC + date-parser(format( + '%b %d %Y %I:%M:%S %p.%f %Z', + '%b %d %H:%M:%S.%f %Z' + ) + template("$3")); + }; + rewrite { + set("cisco_ucm" value("fields.sc4s_syslog_format")); + set("cisco_ucm" value("fields.sc4s_vendor_product")); + set("$HOST_FROM" value("HOST") ); + set("$2" value("HOST") condition(match("^..." template("${2}"))) ); + set("$4" value("MESSAGE")); + }; } elif { filter(f_rfc3164_version); rewrite(set_rfc3164_no_version_string); diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index 34d8613..9966505 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -40,6 +40,7 @@ services: - SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT=5005 - SC4S_LISTEN_PFSENSE_TCP_PORT=5006 - SC4S_ARCHIVE_GLOBAL=no + - SC4S_SOURCE_STORE_RAWMSG=yes splunk: build: context: ../splunk diff --git a/tests/test_cisco_ucm.py b/tests/test_cisco_ucm.py new file mode 100644 index 0000000..1a155cd --- /dev/null +++ b/tests/test_cisco_ucm.py @@ -0,0 +1,110 @@ +# Copyright 2019 Splunk, Inc. +# +# Use of this source code is governed by a BSD-2-clause-style +# license that can be found in the LICENSE-BSD2 file or at +# https://opensource.org/licenses/BSD-2-Clause +import random + +from jinja2 import Environment + +from .sendmessage import * +from .splunkutils import * + +env = Environment(extensions=['jinja2_time.TimeExtension']) + +# https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2017/pdf/TECUCC-3000.pdf + +# <189>8103: Oct 14 2015 05:50:19 AM.484 UTC : %UC_AUDITLOG-5-AdministrativeEvent: %[ UserID =administrator][ ClientAddress =10.110.1.2][ Severity =5][ EventType =GeneralConfigurationUpdate][ ResourceAccessed=CUCMAdmin][ EventStatus =Success][ CompulsoryEvent =No][ AuditCategory =AdministrativeEvent][ ComponentID =Cisco CUCM Administration][ AuditDetails =record in table device, with key field name = SEP0000311107A5 deleted][App ID=Cisco Tomcat][Cluster ID=][Node ID=CUCM11PUB]: Audit Event is generated by this application + + +def test_cisco_ucm_nohost_auditlog(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), + random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}8103: {% now 'utc', '%b %d %Y %I:%M:%S %p' %}.100 UTC : %UC_AUDITLOG-5-AdministrativeEvent: %[ UserID =administrator][ ClientAddress =192.168.1.1][ Severity =5][ EventType =GeneralConfigurationUpdate][ ResourceAccessed=CUCMAdmin][ EventStatus =Success][ CompulsoryEvent =No][ AuditCategory =AdministrativeEvent][ ComponentID =Cisco CUCM Administration][ AuditDetails =record in table device, with key field name = SEP0000311107A5 deleted][App ID=Cisco Tomcat][Cluster ID=][Node ID={{ host }}]: Audit Event is generated by this application\n") + message = mt.render(mark="<189>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string( + "search index=main host=\"{{ host }}\" sourcetype=\"cisco:ucm\" | head 11") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + + +# <189>17: Apr 21 19:01:35.638 UTC : %CCM_RTMT-RTMT-2-RTMT-ERROR-ALERT: RTMT Alert Name:SyslogSeverityMatchFound Detail: At Tue Apr 21 14:01:35 CDT 2009 on node ORD-PUB1, the following SyslogSeverityMatchFound events generated: SeverityMatch - Critical ntpRunningStatus.sh: NTP server 10.12.254.33 is inactive. Verify the network to this server, that it is a NTPv4 server and is operational. SeverityMatch - Alert sshd(pam_unix)[20038]: check pass; user unknown App ID:Cisco AMC Service Cluster ID: Node ID:ord-pub1 +def test_cisco_ucm_nohost_rtmt(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), + random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}17: {% now 'utc', '%b %d %H:%M:%S' %}.100 UTC : %UC_AUDITLOG-5-AdministrativeEvent: %[ UserID =administrator][ ClientAddress =10.1.1.1][ Severity =5][ EventType =GeneralConfigurationUpdate][ ResourceAccessed=CUCMAdmin][ EventStatus =Success][ CompulsoryEvent =No][ AuditCategory =AdministrativeEvent][ ComponentID =Cisco CUCM Administration][ AuditDetails =record in table device, with key field name = SEP0000311107A5 deleted][App ID=Cisco Tomcat][Cluster ID=][Node ID={{ host }}]: Audit Event is generated by this application\n") + message = mt.render(mark="<189>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string( + "search index=main host=\"{{ host }}\" sourcetype=\"cisco:ucm\" | head 11") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + +# <189>23813: cucm-pub: Jul 05 2016 04:03:01 PM.688 UTC : %UC_RTMT-2-RTMT_ALERT: %[AlertName=SyslogSeverityMatchFound][AlertDetail= At Tue Jul 05 12:03:01 EDT 2016 on node 1.2.3.4, the following SyslogSeverityMatchFound events generated: #012SeverityMatch : Critical#012MatchedEvent : Jul 5 12:02:29 cucm-sub1 local7 2 ccm: 6838: cucm-sub1: Jul 05 2016 16:02:29.795 UTC : %UC_CALLMANAGER-2-SignalCongestionEntry: %[Thread=SIP Handler Thread] [AverageDelay=22] [EntryLatency=20] [ExitLatency=8] [SampleSize=10] [TotalSignalCongestionEntry=6752][HighPriorityQueueDepth=0][NormalPriorityQueueDepth=1][LowPriorityQueueDepth=0][AppID=Cisco CallManager][ClusterID=UCMCluster1][NodeID=cucm-sub1]: Unified CM has detected signal congestion in an internal thread and has throttled activities for that thread#012AppID : Cisco Syslog Agent#012Cluster + + +def test_cisco_ucm_host_auditlog(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), + random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}23813: {% now 'utc', '%b %d %Y %I:%M:%S %p' %}.100 UTC : %UC_AUDITLOG-5-AdministrativeEvent: %[ UserID =administrator][ ClientAddress =192.1.1.1][ Severity =5][ EventType =GeneralConfigurationUpdate][ ResourceAccessed=CUCMAdmin][ EventStatus =Success][ CompulsoryEvent =No][ AuditCategory =AdministrativeEvent][ ComponentID =Cisco CUCM Administration][ AuditDetails =record in table device, with key field name = SEP0000311107A5 deleted][App ID=Cisco Tomcat][Cluster ID=][Node ID={{ host }}]: Audit Event is generated by this application\n") + message = mt.render(mark="<189>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string( + "search index=main host=\"{{ host }}\" sourcetype=\"cisco:ucm\" | head 11") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 + +#<121>17: Apr 21 19:01:35.638 UTC : %CCM_RTMT-RTMT-2-RTMT-ERROR-ALERT: RTMT Alert Name:SyslogSeverityMatchFound Detail: At Tue Apr 21 14:01:35 CDT 2009 on node ORD-PUB1, the following SyslogSeverityMatchFound events generated: SeverityMatch - Critical ntpRunningStatus.sh: NTP server 10.12.254.33 is inactive. Verify the network to this server, that it is a NTPv4 server and is operational. SeverityMatch - Alert sshd(pam_unix)[20038]: check pass; user unknown App ID:Cisco AMC Service Cluster ID: Node ID:ord-pub1 + + +def test_cisco_ucm_nohost_alert(record_property, setup_wordlist, setup_splunk, setup_sc4s): + host = "{}-{}".format(random.choice(setup_wordlist), + random.choice(setup_wordlist)) + + mt = env.from_string( + "{{ mark }}17: {% now 'utc', '%b %d %H:%M:%S' %}.100 UTC : %CCM_RTMT-RTMT-2-RTMT-ERROR-ALERT: RTMT Alert Name:SyslogSeverityMatchFound Detail: At Tue Apr 21 14:01:35 CDT 2009 on node {{ host }}, the following SyslogSeverityMatchFound events generated: SeverityMatch - Critical ntpRunningStatus.sh: NTP server 10.12.254.33 is inactive. Verify the network to this server, that it is a NTPv4 server and is operational. SeverityMatch - Alert sshd(pam_unix)[20038]: check pass; user unknown App ID:Cisco AMC Service Cluster ID: Node ID:{{host}}\n") + message = mt.render(mark="<189>", host=host) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) + + st = env.from_string( + "search index=main host=\"{{ host }}\" sourcetype=\"cisco:ucm\" | head 11") + search = st.render(host=host) + + resultCount, eventCount = splunk_single(setup_splunk, search) + + record_property("host", host) + record_property("resultCount", resultCount) + record_property("message", message) + + assert resultCount == 1 From a1014178b13b1f1af6bb4d3a2d66a5b3cc972023 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 11:06:16 -0500 Subject: [PATCH 154/174] updates for dedicated port --- .../etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl | 2 +- .../context_templates/splunk_index.csv.example | 1 + package/etc/go_templates/source_network.t | 17 +++++++++++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl b/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl index cde238a..e0823cf 100644 --- a/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl +++ b/package/etc/conf.d/log_paths/lp-cisco_ucm.conf.tmpl @@ -1,6 +1,6 @@ # Cisco UCM {{- /* The following provides a unique port source configuration if env var(s) are set */}} -{{- $context := dict "port_id" "CISCO_UCM" "parser" "rfc3164" }} +{{- $context := dict "port_id" "CISCO_UCM" "parser" "cisco_ucm" }} {{- tmpl.Exec "t/source_network.t" $context }} log { diff --git a/package/etc/context_templates/splunk_index.csv.example b/package/etc/context_templates/splunk_index.csv.example index 6d36fa8..f3975d7 100644 --- a/package/etc/context_templates/splunk_index.csv.example +++ b/package/etc/context_templates/splunk_index.csv.example @@ -18,6 +18,7 @@ #cisco_ios,index,netops #cisco_ise,index,netauth #cisco_nx_os,index,netops +#cisco_ucm,index,main #local_example,index,main #forcepoint_webprotect,index,netproxy #fortinet_fortios_event,index,netops diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t index 236247e..6eea6df 100644 --- a/package/etc/go_templates/source_network.t +++ b/package/etc/go_templates/source_network.t @@ -88,6 +88,23 @@ source s_{{ .port_id }} { {{ else if eq .parser "cisco_meraki_parser" }} parser (p_cisco_meraki); rewrite(set_rfc5424_epochtime); +{{ else if eq .parser "cisco_ucm" }} + parser { + #Oct 14 2015 05:50:19 AM.484 UTC + #Apr 21 19:01:35.638 UTC + date-parser(format( + '%b %d %Y %I:%M:%S %p.%f %Z', + '%b %d %H:%M:%S.%f %Z' + ) + template("$3")); + }; + rewrite { + set("cisco_ucm" value("fields.sc4s_syslog_format")); + set("cisco_ucm" value("fields.sc4s_vendor_product")); + set("$HOST_FROM" value("HOST") ); + set("$2" value("HOST") condition(match("^..." template("${2}"))) ); + set("$4" value("MESSAGE")); + }; {{ else if eq .parser "no_parse" }} rewrite(set_no_parse); {{ else }} From e2db422b3794073c857bc2fa140b2b0d86408690 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 11:20:05 -0500 Subject: [PATCH 155/174] Change launch to tasks --- .vscode/launch.json | 25 ------------------------- .vscode/tasks.json | 33 +++++++++++++++++++++++++++++++++ docs/developing/index.md | 7 ++++--- pytest.ini | 2 +- 4 files changed, 38 insertions(+), 29 deletions(-) delete mode 100644 .vscode/launch.json create mode 100644 .vscode/tasks.json diff --git a/.vscode/launch.json b/.vscode/launch.json deleted file mode 100644 index f965872..0000000 --- a/.vscode/launch.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - // Use IntelliSense to learn about possible attributes. - // Hover to view descriptions of existing attributes. - // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 - "version": "0.2.0", - "configurations": [ - { - "name": "Setup Project", - "type": "python", - "request": "launch", - "module": "venv", - "args": ["venv"] - }, - { - "name": "Setup Requirements", - "type": "python", - "request": "launch", - "module": "pip", - "args": [ - "install", - "-r", - "requirements.txt"] - } - ] -} \ No newline at end of file diff --git a/.vscode/tasks.json b/.vscode/tasks.json new file mode 100644 index 0000000..e5c70bf --- /dev/null +++ b/.vscode/tasks.json @@ -0,0 +1,33 @@ +{ + // See https://go.microsoft.com/fwlink/?LinkId=733558 + // for the documentation about the tasks.json format + "version": "2.0.0", + "tasks": [ + { + "label": "Setup step 1: python venv", + "type": "shell", + "command": "python3 -m venv ./venv", + "windows": { + "command": "python venv" + }, + "group": "Setup", + "presentation": { + "reveal": "always", + "panel": "new" + } + }, + { + "label": "Setup step 2: python requirements", + "type": "shell", + "command": "pip3 install -r requirements.txt", + "windows": { + "command": "python requirements" + }, + "group": "Setup", + "presentation": { + "reveal": "always", + "panel": "new" + } + } + ] +} \ No newline at end of file diff --git a/docs/developing/index.md b/docs/developing/index.md index 25d836c..5cf9063 100644 --- a/docs/developing/index.md +++ b/docs/developing/index.md @@ -28,9 +28,10 @@ The follow steps are only required on the first time run. * Python * Test Explorer * "Python Test Explorer" -* Click the "Run/Debug" bug icon -* Select the "Setup Project" task and click the Green play icon -* Select the "Setup Requirements" task and click the Green play icon +* From the terminal menu select Run Task +* Select "Setup step 1: python venv" then "go without scanning output" +* From the terminal menu select Run Task +* Select "Setup step 2: python requirements" then "go without scanning output" ![VS Code setup](vsc_run.png) diff --git a/pytest.ini b/pytest.ini index fae841c..b587d06 100644 --- a/pytest.ini +++ b/pytest.ini @@ -5,7 +5,7 @@ addopts = --splunk_type=docker --keepalive --splunk_hec_token=1ec3c8ac-74b3-46f2-ba44-a7c96b6ab236 - -n=4 + #-n=4 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file From 8ba5806abe4d49f18e8460fa1385d652919fcf2b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 13:37:06 -0500 Subject: [PATCH 156/174] make DRY --- package/etc/conf.d/filters/cisco/ucm.conf | 21 ++++++++++++- package/etc/go_templates/source_network.t | 36 +++-------------------- 2 files changed, 24 insertions(+), 33 deletions(-) diff --git a/package/etc/conf.d/filters/cisco/ucm.conf b/package/etc/conf.d/filters/cisco/ucm.conf index 8c08664..a1e751d 100644 --- a/package/etc/conf.d/filters/cisco/ucm.conf +++ b/package/etc/conf.d/filters/cisco/ucm.conf @@ -10,4 +10,23 @@ filter f_cisco_ucm_message { '^(<\d{1,3}>)\d*: (?:([^:]+): )?(.*) : (%.*)' flags(store-matches) ); -}; \ No newline at end of file +}; + +parser p_cisco_ucm_date { + #Oct 14 2015 05:50:19 AM.484 UTC + #Apr 21 19:01:35.638 UTC + date-parser(format( + '%b %d %Y %I:%M:%S %p.%f %Z', + '%b %d %H:%M:%S.%f %Z' + ) + template("$3")); +}; + +rewrite r_cisco_ucm_message { + set("cisco_ucm" value("fields.sc4s_syslog_format")); + set("cisco_ucm" value("fields.sc4s_vendor_product")); + set("$HOST_FROM" value("HOST") ); + set("$2" value("HOST") condition(match("^..." template("${2}"))) ); + set("$4" value("MESSAGE")); +}; + diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t index 6eea6df..1e4b488 100644 --- a/package/etc/go_templates/source_network.t +++ b/package/etc/go_templates/source_network.t @@ -89,22 +89,8 @@ source s_{{ .port_id }} { parser (p_cisco_meraki); rewrite(set_rfc5424_epochtime); {{ else if eq .parser "cisco_ucm" }} - parser { - #Oct 14 2015 05:50:19 AM.484 UTC - #Apr 21 19:01:35.638 UTC - date-parser(format( - '%b %d %Y %I:%M:%S %p.%f %Z', - '%b %d %H:%M:%S.%f %Z' - ) - template("$3")); - }; - rewrite { - set("cisco_ucm" value("fields.sc4s_syslog_format")); - set("cisco_ucm" value("fields.sc4s_vendor_product")); - set("$HOST_FROM" value("HOST") ); - set("$2" value("HOST") condition(match("^..." template("${2}"))) ); - set("$4" value("MESSAGE")); - }; + parser (p_cisco_ucm_date); + rewrite (r_cisco_ucm_message); {{ else if eq .parser "no_parse" }} rewrite(set_no_parse); {{ else }} @@ -119,22 +105,8 @@ source s_{{ .port_id }} { rewrite(set_rfc5424_epochtime); } elif { filter(f_cisco_ucm_message); - parser { - #Oct 14 2015 05:50:19 AM.484 UTC - #Apr 21 19:01:35.638 UTC - date-parser(format( - '%b %d %Y %I:%M:%S %p.%f %Z', - '%b %d %H:%M:%S.%f %Z' - ) - template("$3")); - }; - rewrite { - set("cisco_ucm" value("fields.sc4s_syslog_format")); - set("cisco_ucm" value("fields.sc4s_vendor_product")); - set("$HOST_FROM" value("HOST") ); - set("$2" value("HOST") condition(match("^..." template("${2}"))) ); - set("$4" value("MESSAGE")); - }; + parser (p_cisco_ucm_date); + rewrite (r_cisco_ucm_message); } elif { filter(f_rfc3164_version); rewrite(set_rfc3164_no_version_string); From fcd2503895c6581638b5c133c0d4104f967f6883 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 13:39:50 -0500 Subject: [PATCH 157/174] make DRY --- .../etc/conf.d/filters/citrix/netscaler.conf | 19 +++++++++ package/etc/go_templates/source_network.t | 41 ++----------------- 2 files changed, 23 insertions(+), 37 deletions(-) diff --git a/package/etc/conf.d/filters/citrix/netscaler.conf b/package/etc/conf.d/filters/citrix/netscaler.conf index 121a417..9f8d97c 100644 --- a/package/etc/conf.d/filters/citrix/netscaler.conf +++ b/package/etc/conf.d/filters/citrix/netscaler.conf @@ -7,3 +7,22 @@ filter f_citrix_netscaler_message { flags(store-matches) ); }; + +parser p_citrix_netscaler_date { +{{- if (conv.ToBool (getenv "SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT" "yes")) }} + #01/10/2001:01:01:01 GMT + date-parser(format('%d/%m/%Y:%H:%M:%S %Z') + template("$2")); +{{ else }} + #10/01/2001:01:01:01 GMT + date-parser(format('%m/%d/%Y:%H:%M:%S %Z') + template("$2")); +{{- end}} +}; + +rewrite r_citrix_netscaler_message { + set("citrix_netscaler" value("fields.sc4s_syslog_format")); + set("citrix_netscaler" value("fields.sc4s_vendor_product")); + set("$3" value("HOST")); + set("$4" value("MESSAGE")); +}; \ No newline at end of file diff --git a/package/etc/go_templates/source_network.t b/package/etc/go_templates/source_network.t index 0a59bcd..0728c2d 100644 --- a/package/etc/go_templates/source_network.t +++ b/package/etc/go_templates/source_network.t @@ -89,48 +89,15 @@ source s_{{ .port_id }} { parser (p_cisco_meraki); rewrite(set_rfc5424_epochtime); {{ else if eq .parser "citrix_netscaler" }} - parser { -{{- if (conv.ToBool (getenv "SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT" "yes")) }} - #01/10/2001:01:01:01 GMT - date-parser(format('%d/%m/%Y:%H:%M:%S %Z') - template("$2")); - }; -{{ else }} - #10/01/2001:01:01:01 GMT - date-parser(format('%m/%d/%Y:%H:%M:%S %Z') - template("$2")); - }; -{{- end}} - rewrite { - set("citrix_netscaler" value("fields.sc4s_syslog_format")); - set("citrix_netscaler" value("fields.sc4s_vendor_product")); - set("$3" value("HOST")); - set("$4" value("MESSAGE")); - }; + parser(p_citrix_netscaler_date); + rewrite(r_citrix_netscaler_message); {{ else if eq .parser "no_parse" }} rewrite(set_no_parse); {{ else }} if { filter(f_citrix_netscaler_message); - parser { -{{- if (conv.ToBool (getenv "SC4S_SOURCE_CITRIX_NETSCALER_USEALT_DATE_FORMAT" "yes")) }} - #01/10/2001:01:01:01 GMT - date-parser(format('%d/%m/%Y:%H:%M:%S %Z') - template("$2")); - }; -{{ else }} - #10/01/2001:01:01:01 GMT - date-parser(format('%m/%d/%Y:%H:%M:%S %Z') - template("$2")); - }; -{{- end}} - rewrite { - set("citrix_netscaler" value("fields.sc4s_syslog_format")); - set("citrix_netscaler" value("fields.sc4s_vendor_product")); - set("$3" value("HOST")); - set("$4" value("MESSAGE")); - }; - + parser(p_citrix_netscaler_date); + rewrite(r_citrix_netscaler_message); } elif { filter(f_rfc5424_strict); parser { From 052148f80ff18fee0353876bd7263b85cf07c7b4 Mon Sep 17 00:00:00 2001 From: mbonsack Date: Mon, 10 Feb 2020 11:22:34 -0800 Subject: [PATCH 158/174] Update ucm.conf --- package/etc/conf.d/filters/cisco/ucm.conf | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/package/etc/conf.d/filters/cisco/ucm.conf b/package/etc/conf.d/filters/cisco/ucm.conf index a1e751d..332e7cd 100644 --- a/package/etc/conf.d/filters/cisco/ucm.conf +++ b/package/etc/conf.d/filters/cisco/ucm.conf @@ -13,13 +13,13 @@ filter f_cisco_ucm_message { }; parser p_cisco_ucm_date { - #Oct 14 2015 05:50:19 AM.484 UTC - #Apr 21 19:01:35.638 UTC - date-parser(format( - '%b %d %Y %I:%M:%S %p.%f %Z', - '%b %d %H:%M:%S.%f %Z' - ) - template("$3")); + #Oct 14 2015 05:50:19 AM.484 UTC + #Apr 21 19:01:35.638 UTC + date-parser(format( + '%b %d %Y %I:%M:%S %p.%f %Z', + '%b %d %H:%M:%S.%f %Z' + ) + template("$3")); }; rewrite r_cisco_ucm_message { @@ -29,4 +29,3 @@ rewrite r_cisco_ucm_message { set("$2" value("HOST") condition(match("^..." template("${2}"))) ); set("$4" value("MESSAGE")); }; - From d378d1e0256fec3ce06fdc44fd0a933cc8269f15 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 14:25:13 -0500 Subject: [PATCH 159/174] Update mkdocs.yml --- mkdocs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdocs.yml b/mkdocs.yml index 82c56e5..0a5506b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -28,7 +28,7 @@ nav: - Proofpoint: sources/Proofpoint/index.md - Symantec: sources/Symantec/index.md - Ubiquiti: sources/Ubiquiti/index.md - - VMware: sources/VMware/index.md + - VMware: sources/VMWare/index.md - Zscaler: sources/Zscaler/index.md - 'Demo Lab': 'demo.md' - Performance: 'performance.md' From 48fcab1ce8f3376e683df79e1e90c034cadab20e Mon Sep 17 00:00:00 2001 From: mbonsack Date: Mon, 10 Feb 2020 11:26:11 -0800 Subject: [PATCH 160/174] Update ucm.conf --- package/etc/conf.d/filters/cisco/ucm.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/etc/conf.d/filters/cisco/ucm.conf b/package/etc/conf.d/filters/cisco/ucm.conf index 332e7cd..a193625 100644 --- a/package/etc/conf.d/filters/cisco/ucm.conf +++ b/package/etc/conf.d/filters/cisco/ucm.conf @@ -19,7 +19,8 @@ parser p_cisco_ucm_date { '%b %d %Y %I:%M:%S %p.%f %Z', '%b %d %H:%M:%S.%f %Z' ) - template("$3")); + template("$3") + ); }; rewrite r_cisco_ucm_message { From cc359084bf8ac294f9e86f6202572d74ee825179 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 14:48:24 -0500 Subject: [PATCH 161/174] make tmpl --- .../conf.d/filters/citrix/{netscaler.conf => netscaler.conf.tmpl} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename package/etc/conf.d/filters/citrix/{netscaler.conf => netscaler.conf.tmpl} (100%) diff --git a/package/etc/conf.d/filters/citrix/netscaler.conf b/package/etc/conf.d/filters/citrix/netscaler.conf.tmpl similarity index 100% rename from package/etc/conf.d/filters/citrix/netscaler.conf rename to package/etc/conf.d/filters/citrix/netscaler.conf.tmpl From 6b5fbcfe7b722c6b76d424caff5d59e508fd1559 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 14:54:23 -0500 Subject: [PATCH 162/174] Update conftest.py --- tests/conftest.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 271f3a5..a02c8a2 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -14,7 +14,6 @@ import splunklib.client as client - @pytest.fixture(scope="module") def setup_wordlist(): path_to_current_file = os.path.realpath(__file__) @@ -128,14 +127,17 @@ def docker_compose_file(pytestconfig): return os.path.join(str(pytestconfig.invocation_dir), "tests", "docker-compose.yml") + @pytest.fixture(scope="session") def splunk(request): if request.config.getoption('splunk_type') == 'external': request.fixturenames.append('splunk_external') splunk = request.getfixturevalue("splunk_external") elif request.config.getoption('splunk_type') == 'docker': - os.environ['SPLUNK_PASSWORD'] = request.config.getoption('splunk_password') - os.environ['SPLUNK_HEC_TOKEN'] = request.config.getoption('splunk_hec_token') + os.environ['SPLUNK_PASSWORD'] = request.config.getoption( + 'splunk_password') + os.environ['SPLUNK_HEC_TOKEN'] = request.config.getoption( + 'splunk_hec_token') request.fixturenames.append('splunk_docker') splunk = request.getfixturevalue("splunk_docker") else: @@ -193,8 +195,8 @@ def sc4s_docker(docker_services): docker_services.start('sc4s') ports = {514: docker_services.port_for("sc4s", 514)} - for x in range(5000, 5050): - ports.update({ x: docker_services.port_for("sc4s", x)}) + for x in range(5000, 5006): + ports.update({x: docker_services.port_for("sc4s", x)}) return docker_services.docker_ip, ports From 32855a103a65f68e8b1e75183db1237fb8932aa0 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 15:00:13 -0500 Subject: [PATCH 163/174] Update netscaler.conf.tmpl --- package/etc/conf.d/filters/citrix/netscaler.conf.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/etc/conf.d/filters/citrix/netscaler.conf.tmpl b/package/etc/conf.d/filters/citrix/netscaler.conf.tmpl index 9f8d97c..76c0334 100644 --- a/package/etc/conf.d/filters/citrix/netscaler.conf.tmpl +++ b/package/etc/conf.d/filters/citrix/netscaler.conf.tmpl @@ -13,11 +13,11 @@ parser p_citrix_netscaler_date { #01/10/2001:01:01:01 GMT date-parser(format('%d/%m/%Y:%H:%M:%S %Z') template("$2")); -{{ else }} +{{- else }} #10/01/2001:01:01:01 GMT date-parser(format('%m/%d/%Y:%H:%M:%S %Z') template("$2")); -{{- end}} +{{- end }} }; rewrite r_citrix_netscaler_message { From aaaecada657ccab975322746bd90c95d31551a6a Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 15:51:22 -0500 Subject: [PATCH 164/174] Update test_cisco_apic.py --- tests/test_cisco_apic.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_cisco_apic.py b/tests/test_cisco_apic.py index b7509fb..9526f55 100644 --- a/tests/test_cisco_apic.py +++ b/tests/test_cisco_apic.py @@ -17,7 +17,7 @@ def test_cisco_aci(record_property, setup_wordlist, setup_splunk, setup_sc4s): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( - "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %LOG_LOCAL0-2-SYSTEM_MSG [F0110][soaking][node-failed][critical][topology/pod-1/node-102/fault-F0110]\n") + "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %LOG_LOCAL0-2-SYSTEM_MSG [F0110][soaking][node-failed][critical][topology/pod-1/node-102/fault-F0110]\n") message = mt.render(mark="<165>", host=host) sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) @@ -37,7 +37,7 @@ def test_cisco_aci_acl(record_property, setup_wordlist, setup_splunk, setup_sc4s host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( - "{{ mark }}{% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %ACLLOG-5-ACLLOG_PKTLOG unable to locate real message\n") + "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %ACLLOG-5-ACLLOG_PKTLOG unable to locate real message\n") message = mt.render(mark="<165>", host=host) sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) From 53db72662c2c19f725bbe720323f29fb1a73d720 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 16:26:01 -0500 Subject: [PATCH 165/174] Update config.yml --- .circleci/config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1792d17..959b8b0 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -99,6 +99,7 @@ publish: &publish docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} + - run: name: Docker Save command: | From 8ccd3bd7f9ca8ec04b512e43aa120a3d8229ccc6 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 17:51:39 -0500 Subject: [PATCH 166/174] Update config.yml --- .circleci/config.yml | 95 +++++++++++++++++++++----------------------- 1 file changed, 45 insertions(+), 50 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 959b8b0..0e946a8 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -70,7 +70,7 @@ test: &test - run: name: test command: | - docker-compose -f tests/docker-compose-ci.yml pull + docker-compose -f tests/docker-compose-ci.yml build docker-compose -f tests/docker-compose-ci.yml up --abort-on-container-exit no_output_timeout: 1h - run: @@ -87,7 +87,6 @@ test: &test - store_test_results: path: test-results - publish: &publish steps: - setup_remote_docker: @@ -99,7 +98,7 @@ publish: &publish docker login -u $DOCKER_USER -p $DOCKER_PASS docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - + - run: name: Docker Save command: | @@ -112,8 +111,8 @@ publish: &publish tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - run: command: | - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi - docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} splunk/scs:${VERSION} + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi + docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} splunk/scs:${VERSION} - docker/push: image: splunk/scs tag: $DOCKER_TAG @@ -141,115 +140,111 @@ jobs: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: '3.25.1' + SYSLOG: "3.25.1" steps: - - checkout - - setup_remote_docker: - docker_layer_caching: true - - run: - name: Docker Login - command: | - docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: - name: Build Splunk - command: | - docker build tests \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} - - run: - name: Push Splunk - command: | - docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} + - checkout + - setup_remote_docker: + docker_layer_caching: true + - run: + name: Docker Login + command: | + docker login -u $DOCKER_USER -p $DOCKER_PASS + docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com + - run: + name: Build Splunk + command: | + docker build tests \ + -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} + - run: + name: Push Splunk + command: | + docker push \ + docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} -#JOB SC4S + #JOB SC4S build-sc4s-3-25-1: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: 'syslog-ng-3.25.1' + SYSLOG: "syslog-ng-3.25.1" <<: *build-sc4s build-sc4s-master: docker: - image: circleci/buildpack-deps:18.04 environment: - SYSLOG: 'master' + SYSLOG: "master" <<: *build-sc4s -#JOB SPLUNK + #JOB SPLUNK build-splunk-7-2: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: '7.2' + SPLUNK: "7.2" <<: *build-splunk build-splunk-7-3: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: '7.3' + SPLUNK: "7.3" <<: *build-splunk build-splunk-8-0: docker: - image: circleci/buildpack-deps:18.04 environment: - SPLUNK: '8.0' + SPLUNK: "8.0" <<: *build-splunk test-sc4s-3-25-1-splunk-8-0: docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '8.0' + SYSLOG: "3.25.1" + SPLUNK: "8.0" <<: *test test-sc4s-master-splunk-8-0: docker: - image: circleci/python:3.7 environment: - SYSLOG: 'master' - SPLUNK: '8.0' + SYSLOG: "master" + SPLUNK: "8.0" <<: *test test-sc4s-3-25-1-splunk-7-3: docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '7.3' + SYSLOG: "3.25.1" + SPLUNK: "7.3" <<: *test test-sc4s-3-25-1-splunk-7-2: - docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '7-2' + SYSLOG: "3.25.1" + SPLUNK: "7-2" <<: *test publish-edge: - docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '8.0' + SYSLOG: "3.25.1" + SPLUNK: "8.0" VERSION_TAG: edge GHR_FLAGS: -prerelease <<: *publish publish-latest: - docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '8.0' + SYSLOG: "3.25.1" + SPLUNK: "8.0" VERSION_TAG: latest <<: *publish publish-tag: - docker: - image: circleci/python:3.7 environment: - SYSLOG: '3.25.1' - SPLUNK: '8.0' + SYSLOG: "3.25.1" + SPLUNK: "8.0" <<: *publish workflows: version: 2 @@ -314,4 +309,4 @@ workflows: ignore: /.*/ - publish-tag: requires: - - publish-pre-gh-tag \ No newline at end of file + - publish-pre-gh-tag From 361fd396dac33be95bc819c89a44ddcd68ccfb25 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 18:10:47 -0500 Subject: [PATCH 167/174] Update pytest.ini --- pytest.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pytest.ini b/pytest.ini index b587d06..4fce685 100644 --- a/pytest.ini +++ b/pytest.ini @@ -5,7 +5,7 @@ addopts = --splunk_type=docker --keepalive --splunk_hec_token=1ec3c8ac-74b3-46f2-ba44-a7c96b6ab236 - #-n=4 + -n=6 filterwarnings = ignore::DeprecationWarning junit_family=xunit1 \ No newline at end of file From 817cbbbe8ccbe88114d87b52b5d8a52987be58fe Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 18:31:22 -0500 Subject: [PATCH 168/174] Update config.yml --- .circleci/config.yml | 151 ++++--------------------------------------- 1 file changed, 13 insertions(+), 138 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 0e946a8..d2e4a11 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -8,65 +8,17 @@ #work. If not, see . version: 2.1 -build-sc4s: &build-sc4s - steps: - - checkout - - setup_remote_docker: - docker_layer_caching: true - - run: - name: Docker Login - command: | - docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - semver-orb/export-tag - - run: - name: Build SC4S - command: | - echo $SEMVER_VERSION >package/VERSION - docker build --build-arg BRANCH=${SYSLOG} package \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - - run: - name: Push SC4S - command: | - docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - -build-splunk: &build-splunk - steps: - - checkout - - setup_remote_docker: - docker_layer_caching: true - - run: - name: Docker Login - command: | - docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: - name: Build Splunk - command: | - docker build --build-arg SPLUNK_VERSION=${SPLUNK} splunk \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} - - run: - name: Push Splunk - command: | - docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:splunk-${SPLUNK}-${CIRCLE_SHA1} - test: &test steps: - checkout - setup_remote_docker: docker_layer_caching: true - - run: - name: Docker Login - command: | - docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - run: name: Setup for testing command: | pip install -r tests/requirements.txt mkdir test-results + - semver-orb/export-tag - run: name: test command: | @@ -96,23 +48,25 @@ publish: &publish name: Docker Login command: | docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: docker pull docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} - + - semver-orb/export-tag + - run: + name: Build SC4S + command: | + echo $SEMVER_VERSION >package/VERSION + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${DOCKER_TAG}"; fi + docker build --build-arg BRANCH=${SYSLOG} package \ + -t splunk/scs:${VERSION} - run: name: Docker Save command: | mkdir -p /tmp/workspace/ - docker save docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} | gzip -c > /tmp/workspace/oci_container.tar.gz + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${DOCKER_TAG}"; fi + docker save splunk/scs:${VERSION} | gzip -c > /tmp/workspace/oci_container.tar.gz - run: name: BYOE Config command: | tar rvf /tmp/workspace/baremetal.tar -C package/etc . tar rvf /tmp/workspace/baremetal.tar -C package/sbin entrypoint.sh - - run: - command: | - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi - docker tag docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:sc4s-${SYSLOG}-${CIRCLE_SHA1} splunk/scs:${VERSION} - docker/push: image: splunk/scs tag: $DOCKER_TAG @@ -136,63 +90,6 @@ orbs: semver-orb: tv2norge/semver-orb@0.0.1 jobs: - build-tests: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SYSLOG: "3.25.1" - steps: - - checkout - - setup_remote_docker: - docker_layer_caching: true - - run: - name: Docker Login - command: | - docker login -u $DOCKER_USER -p $DOCKER_PASS - docker login -u $GITHUB_USER -p $GITHUB_TOKEN docker.pkg.github.com - - run: - name: Build Splunk - command: | - docker build tests \ - -t docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} - - run: - name: Push Splunk - command: | - docker push \ - docker.pkg.github.com/splunk/splunk-connect-for-syslog/stg-splunk-connect-for-syslog:tests-${CIRCLE_SHA1} - - #JOB SC4S - build-sc4s-3-25-1: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SYSLOG: "syslog-ng-3.25.1" - <<: *build-sc4s - build-sc4s-master: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SYSLOG: "master" - <<: *build-sc4s - #JOB SPLUNK - build-splunk-7-2: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SPLUNK: "7.2" - <<: *build-splunk - build-splunk-7-3: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SPLUNK: "7.3" - <<: *build-splunk - build-splunk-8-0: - docker: - - image: circleci/buildpack-deps:18.04 - environment: - SPLUNK: "8.0" - <<: *build-splunk test-sc4s-3-25-1-splunk-8-0: docker: - image: circleci/python:3.7 @@ -228,7 +125,7 @@ jobs: environment: SYSLOG: "3.25.1" SPLUNK: "8.0" - VERSION_TAG: edge + DOCKER_TAG: edge GHR_FLAGS: -prerelease <<: *publish publish-latest: @@ -237,7 +134,7 @@ jobs: environment: SYSLOG: "3.25.1" SPLUNK: "8.0" - VERSION_TAG: latest + DOCKER_TAG: latest <<: *publish publish-tag: docker: @@ -250,32 +147,10 @@ workflows: version: 2 build_and_deploy: jobs: - - build-tests - - build-sc4s-3-25-1 - - build-sc4s-master - - build-splunk-7-2 - - build-splunk-7-3 - - build-splunk-8-0 - test-sc4s-3-25-1-splunk-8-0: - requires: - - build-sc4s-3-25-1 - - build-splunk-8-0 - - build-tests - test-sc4s-master-splunk-8-0: - requires: - - build-sc4s-master - - build-splunk-8-0 - - build-tests - test-sc4s-3-25-1-splunk-7-3: - requires: - - build-sc4s-3-25-1 - - build-splunk-7-3 - - build-tests - test-sc4s-3-25-1-splunk-7-2: - requires: - - build-sc4s-3-25-1 - - build-splunk-7-2 - - build-tests - publish-pre-gh-edge: type: approval requires: From 21cf64216be6d469b1f4ddc659a4c099c76d34c7 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 18:33:40 -0500 Subject: [PATCH 169/174] Update config.yml --- .circleci/config.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index d2e4a11..6be7f68 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -147,10 +147,10 @@ workflows: version: 2 build_and_deploy: jobs: - - test-sc4s-3-25-1-splunk-8-0: - - test-sc4s-master-splunk-8-0: - - test-sc4s-3-25-1-splunk-7-3: - - test-sc4s-3-25-1-splunk-7-2: + - test-sc4s-3-25-1-splunk-8-0 + - test-sc4s-master-splunk-8-0 + - test-sc4s-3-25-1-splunk-7-3 + - test-sc4s-3-25-1-splunk-7-2 - publish-pre-gh-edge: type: approval requires: From fa8ec62cb2d9c4bfe6f5a41a9c4614895ea9fee3 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 18:39:54 -0500 Subject: [PATCH 170/174] Update test_cisco_asa.py --- tests/test_cisco_asa.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_cisco_asa.py b/tests/test_cisco_asa.py index db8d3ac..32d0c00 100644 --- a/tests/test_cisco_asa.py +++ b/tests/test_cisco_asa.py @@ -41,7 +41,7 @@ def test_cisco_asa_traditional_nohost(record_property, setup_wordlist, setup_spl host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( - "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %}: %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0C190BF9, sequence number= 0x598243) from {host} (user= 192.0.0.1) to 192.0.0.2 that failed anti-replay checking.\n") + "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %}: %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0C190BF9, sequence number= 0x598243) from {{host}} (user= 192.0.0.1) to 192.0.0.2 that failed anti-replay checking.\n") message = mt.render(mark="<111>", host=host) sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) From 3f9a904bb17b045e2010ff04c15c826daa928f7c Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 19:00:25 -0500 Subject: [PATCH 171/174] update --- .circleci/config.yml | 10 +++++----- tests/docker-compose-ci.yml | 5 ++++- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6be7f68..1e7e9a9 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -94,7 +94,7 @@ jobs: docker: - image: circleci/python:3.7 environment: - SYSLOG: "3.25.1" + SYSLOG: "syslog-ng- 3.25.1" SPLUNK: "8.0" <<: *test test-sc4s-master-splunk-8-0: @@ -108,14 +108,14 @@ jobs: docker: - image: circleci/python:3.7 environment: - SYSLOG: "3.25.1" + SYSLOG: "syslog-ng-3.25.1" SPLUNK: "7.3" <<: *test test-sc4s-3-25-1-splunk-7-2: docker: - image: circleci/python:3.7 environment: - SYSLOG: "3.25.1" + SYSLOG: "syslog-ng-3.25.1" SPLUNK: "7-2" <<: *test @@ -123,7 +123,7 @@ jobs: docker: - image: circleci/python:3.7 environment: - SYSLOG: "3.25.1" + SYSLOG: "syslog-ng-3.25.1" SPLUNK: "8.0" DOCKER_TAG: edge GHR_FLAGS: -prerelease @@ -132,7 +132,7 @@ jobs: docker: - image: circleci/python:3.7 environment: - SYSLOG: "3.25.1" + SYSLOG: "syslog-ng-3.25.1" SPLUNK: "8.0" DOCKER_TAG: latest <<: *publish diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml index cb5f09d..cc59c46 100644 --- a/tests/docker-compose-ci.yml +++ b/tests/docker-compose-ci.yml @@ -19,7 +19,10 @@ services: - results:/work/test-results sc4s: - build: ../package + build: + context: ../package + args: + - BRANCH: ${SYSLOG} hostname: sc4s #When this is enabled test_common will fail # command: -det From fa8cb77d7c7df2852ec22d99ef63eee6e2967ecb Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 19:03:07 -0500 Subject: [PATCH 172/174] Update docker-compose-ci.yml --- tests/docker-compose-ci.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/tests/docker-compose-ci.yml b/tests/docker-compose-ci.yml index cc59c46..7ce6645 100644 --- a/tests/docker-compose-ci.yml +++ b/tests/docker-compose-ci.yml @@ -8,7 +8,6 @@ #work. If not, see . version: "3.7" - services: test: build: . @@ -19,10 +18,10 @@ services: - results:/work/test-results sc4s: - build: + build: context: ../package - args: - - BRANCH: ${SYSLOG} + args: + BRANCH: ${SYSLOG} hostname: sc4s #When this is enabled test_common will fail # command: -det @@ -64,4 +63,4 @@ services: volumes: results: - external: false \ No newline at end of file + external: false From bc4610d0742634760c4befd49f614781c6ac1b6b Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 19:08:04 -0500 Subject: [PATCH 173/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1e7e9a9..5550ebe 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -94,7 +94,7 @@ jobs: docker: - image: circleci/python:3.7 environment: - SYSLOG: "syslog-ng- 3.25.1" + SYSLOG: "syslog-ng-3.25.1" SPLUNK: "8.0" <<: *test test-sc4s-master-splunk-8-0: From 930298dd407ea1636e0242add229f756f3924a85 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 10 Feb 2020 19:17:40 -0500 Subject: [PATCH 174/174] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 5550ebe..2b6ea4e 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -76,7 +76,7 @@ publish: &publish command: | PATH=$PATH:/usr/local/go/bin go get -v -u github.com/tcnksm/ghr - if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${VERSION_TAG}"; fi + if [ -n "${CIRCLE_TAG}" ]; then VERSION=${CIRCLE_TAG}; else VERSION="${DOCKER_TAG}"; fi $HOME/go/bin/ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} ${GHR_FLAGS} -delete ${VERSION} /tmp/workspace/ - store_artifacts: