agent_aws: handle bytes values in special agent JSON serializer - #953
Open
terashiman wants to merge 1 commit into
Open
agent_aws: handle bytes values in special agent JSON serializer#953terashiman wants to merge 1 commit into
terashiman wants to merge 1 commit into
Conversation
WAFv2 ByteMatchStatement.SearchString is returned by boto3 as bytes. The special agent's custom JSON serializer only handled datetime objects and raised TypeError for anything else, crashing the AWS special agent (and check_mk_discovery with it) whenever a monitored WAFv2 Web ACL contains a byte-match rule (e.g. one blocking a URI path such as "/admin/"). Decode bytes to str so the wafv2_web_acl section can be serialized instead of aborting the whole agent run.
|
All contributors have signed the CLA ✍️ ✅ |
Author
|
I have read the CLA Document and I hereby sign the CLA. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The AWS special agent's custom JSON serializer (
datetime_serializerinagent_aws.py) only handlesdatetimeobjects and raisesTypeErrorfor anything else. AWS WAFv2'sByteMatchStatement.SearchStringfield is decoded by boto3 as Pythonbytes(e.g.b'/admin/'for a rule blocking that URI path), which is a completely ordinary WAFv2 rule configuration. When such a rule exists on a monitored Web ACL, serializing thewafv2_web_aclsection raises an unhandledTypeError, and the special agent exits with code 1 before finishing output. This causesCheck_MK Discoveryto report the WAFv2 (and any other not-yet-emitted) services as vanished/critical, even though AWS connectivity and credentials are fine.Reproduced with
--debug:Fix
Add a
bytesbranch todatetime_serializerthat decodes tostr(UTF-8,errors="replace") instead of falling through to theTypeError.Test plan
agent_awsmanually against a WAFv2 Web ACL containing aByteMatchStatementrule; reproducedTypeError: b'...' is not JSON serializableand exit code 1 on the unpatched agentSearchStringvalue in thewafv2_web_aclsectionCheck_MK Discoveryand all AWS/WAFv2 services report OK