more

internal/collector/issue_extract.go

@@ -44,6 +44,42 @@ func extractSpanErrors(tracker *issues.Tracker, td ptrace.Traces, timestamp int6
 	return found
 }
 
+func recordSuspiciousTraceIPs(recorder HoneypotRecorder, td ptrace.Traces) {
+	if recorder == nil {
+		return
+	}
+	resourceSpans := td.ResourceSpans()
+	for i := 0; i < resourceSpans.Len(); i++ {
+		rs := resourceSpans.At(i)
+		scopeSpans := rs.ScopeSpans()
+		for j := 0; j < scopeSpans.Len(); j++ {
+			spans := scopeSpans.At(j).Spans()
+			for k := 0; k < spans.Len(); k++ {
+				span := spans.At(k)
+				_ = recorder.RecordTelemetry(sourceIP(span.Attributes(), rs.Resource().Attributes()), httpRoute(span.Attributes()))
+			}
+		}
+	}
+}
+
+func recordSuspiciousLogIPs(recorder HoneypotRecorder, ld plog.Logs) {
+	if recorder == nil {
+		return
+	}
+	resourceLogs := ld.ResourceLogs()
+	for i := 0; i < resourceLogs.Len(); i++ {
+		rl := resourceLogs.At(i)
+		scopeLogs := rl.ScopeLogs()
+		for j := 0; j < scopeLogs.Len(); j++ {
+			records := scopeLogs.At(j).LogRecords()
+			for k := 0; k < records.Len(); k++ {
+				record := records.At(k)
+				_ = recorder.RecordTelemetry(sourceIP(record.Attributes(), rl.Resource().Attributes()), httpRoute(record.Attributes()))
+			}
+		}
+	}
+}
+
 // extractLogErrors scans logs for error/fatal severity records and records
 // one issue occurrence per error found. It reports whether any error was
 // seen, so the caller can notify live clients.
@@ -131,23 +167,27 @@ func logSample(record plog.LogRecord, res pcommon.Resource, timestamp int64, tit
 // its resource.
 func sourceIP(attrs, resource pcommon.Map) string {
 	ip := firstAttr(attrs,
+		"http.request.header.x-real-ip",
+		"http.request.header.x_real_ip",
+		"http.request.header.x-forwarded-for",
+		"http.request.header.x_forwarded_for",
 		"client.address",
 		"client.ip",
 		"http.client_ip",
-		"net.peer.ip",
 		"network.peer.address",
-		"http.request.header.x-real-ip",
-		"http.request.header.x-forwarded-for",
-		"http.request.header.x_real_ip",
-		"http.request.header.x_forwarded_for",
+		"net.peer.ip",
 	)
 	if ip == "" {
 		ip = firstAttr(resource,
+			"http.request.header.x-real-ip",
+			"http.request.header.x_real_ip",
+			"http.request.header.x-forwarded-for",
+			"http.request.header.x_forwarded_for",
 			"client.address",
 			"client.ip",
 			"http.client_ip",
-			"net.peer.ip",
 			"network.peer.address",
+			"net.peer.ip",
 		)
 	}
 	return strings.TrimSpace(strings.SplitN(ip, ",", 2)[0])