first version that runs

Author: ncode

cmd/root.go

@@ -85,7 +85,7 @@ func initConfig() {
 		home, err := os.UserHomeDir()
 		cobra.CheckErr(err)
 
-		// Search config in home directory with name ".courier" (without extension).
+		// Search config in home directory with name ".vault-audit-filter" (without extension).
 		viper.AddConfigPath(home)
 		viper.SetConfigType("yaml")
 		viper.SetConfigName(".vault-audit-filter")
@@ -108,4 +108,8 @@ func initConfig() {
 		logger.Error("vault.token is required")
 		os.Exit(1)
 	}
+
+	if !viper.IsSet("rules") || len(viper.GetStringSlice("rules")) == 0 {
+		logger.Info("No rules defined in configuration; all audit logs will be printed")
+	}
 }

cmd/setup.go

@@ -18,7 +18,7 @@ package cmd
 import (
 	"os"
 
-	"github.com/ncode/courier/pkg/vault"
+	"github.com/ncode/vault-audit-filter/pkg/vault"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )

configs/docker/docker-compose.yaml

@@ -16,9 +16,6 @@ services:
     container_name: vault-audit-filter_auditserver
     depends_on:
       - vault_primary
-      - vault_replica_red
-      - vault_replica_green
-      - vault_replica_blue
     command: "auditServer --vault.token root --vault.audit_address vault-audit-filter_auditserver:1269"
 
   vault-audit-filter_setup:

main.go

@@ -15,7 +15,7 @@ limitations under the License.
 */
 package main
 
-import "github.com/ncode/courier/cmd"
+import "github.com/ncode/vault-audit-filter/cmd"
 
 func main() {
 	cmd.Execute()

pkg/auditserver/server.go

@@ -3,6 +3,7 @@ package auditserver
 import (
 	"encoding/json"
 	"github.com/expr-lang/expr"
+	"github.com/expr-lang/expr/vm"
 	"github.com/panjf2000/gnet"
 	"github.com/spf13/viper"
 	"log/slog"
@@ -46,7 +47,7 @@ type AuditLog struct {
 }
 
 type CompiledRule struct {
-	Program *expr.Program
+	Program *vm.Program
 }
 
 type AuditServer struct {
@@ -79,6 +80,11 @@ func (as *AuditServer) React(frame []byte, c gnet.Conn) (out []byte, action gnet
 }
 
 func (as *AuditServer) shouldLog(auditLog *AuditLog) bool {
+	// If no rules are defined, log all audit logs
+	if len(as.compiledExpr) == 0 {
+		return true
+	}
+
 	for _, compiledRule := range as.compiledExpr {
 		output, err := expr.Run(compiledRule.Program, auditLog)
 		if err != nil {