feat(alertmanager): fix labels for alertmanager

outputs/alertmanager.go

@@ -20,6 +20,7 @@ package outputs
 import (
 	"encoding/json"
 	"log"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -45,11 +46,15 @@ var defaultSeverityMap = map[types.PriorityType]string{
 	types.Emergency:     "critical",
 }
 
+// labels should match [a-zA-Z_][a-zA-Z0-9_]*
+var (
+	reg = regexp.MustCompile("[^a-zA-Z0-9_]")
+)
+
 func newAlertmanagerPayload(falcopayload types.FalcoPayload, config *types.Configuration) []alertmanagerPayload {
 	var amPayload alertmanagerPayload
 	amPayload.Labels = make(map[string]string)
 	amPayload.Annotations = make(map[string]string)
-	replacer := strings.NewReplacer(".", "_", "[", "_", "]", "")
 
 	for i, j := range falcopayload.OutputFields {
 		if strings.HasPrefix(i, "n_evts") {
@@ -87,12 +92,13 @@ func newAlertmanagerPayload(falcopayload types.FalcoPayload, config *types.Confi
 			}
 			continue
 		}
+		safeLabel := alertmanagerSafeLabel(i)
 		switch v := j.(type) {
 		case string:
 			//AlertManger unsupported chars in a label name
-			amPayload.Labels[replacer.Replace(i)] = v
+			amPayload.Labels[safeLabel] = v
 		case json.Number:
-			amPayload.Labels[replacer.Replace(i)] = v.String()
+			amPayload.Labels[safeLabel] = v.String()
 		default:
 			continue
 		}
@@ -158,3 +164,14 @@ func (c *Client) AlertmanagerPost(falcopayload types.FalcoPayload) {
 	c.Stats.Alertmanager.Add(OK, 1)
 	c.PromStats.Outputs.With(map[string]string{"destination": "alertmanager", "status": OK}).Inc()
 }
+
+func alertmanagerSafeLabel(label string) string {
+	// replace all unsafe characters with _
+	replaced := reg.ReplaceAllString(label, "_")
+	// remove double __
+	replaced = strings.ReplaceAll(replaced, "__", "_")
+	// remove trailing _
+	replaced = strings.TrimRight(replaced, "_")
+	// remove leading _
+	return strings.TrimLeft(replaced, "_")
+}

outputs/alertmanager_test.go

@@ -75,3 +75,74 @@ func TestNewAlertmanagerPayloadDropEvent(t *testing.T) {
 
 	require.Equal(t, o1, o2)
 }
+
+func TestNewAlertmanagerPayloadBadLabels(t *testing.T) {
+	input := `{"hostname":"host","output":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","output_fields":{"ebpf/enabled":"1","n drops/buffer?clone{fork]enter":"0","n_drops_buffer_clone_fork_exit":"0"},"priority":"Debug","rule":"Falco internal: syscall event drop","time":"2023-03-03T03:03:03.000000003Z"}`
+	expectedOutput := `[{"labels":{"ebpf_enabled":"1","eventsource":"","hostname":"host","n_drops_buffer_clone_fork_enter":"0","n_drops_buffer_clone_fork_exit":"0","priority":"Warning","rule":"Falco internal: syscall event drop","severity":"warning","source":"falco"},"annotations":{"description":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","info":"Falco internal: syscall event drop. 815508 system calls dropped in last second.","summary":"Falco internal: syscall event drop"},"endsAt":"0001-01-01T00:00:00Z"}]`
+	var f types.FalcoPayload
+	d := json.NewDecoder(strings.NewReader(input))
+	d.UseNumber()
+	err := d.Decode(&f) //have to decode it the way newFalcoPayload does
+	require.Nil(t, err)
+
+	config := &types.Configuration{
+		Alertmanager: types.AlertmanagerOutputConfig{DropEventDefaultPriority: Critical},
+	}
+	json.Unmarshal([]byte(defaultThresholds), &config.Alertmanager.DropEventThresholdsList)
+
+	s, err := json.Marshal(newAlertmanagerPayload(f, config))
+	require.Nil(t, err)
+
+	var o1, o2 []alertmanagerPayload
+	require.Nil(t, json.Unmarshal([]byte(expectedOutput), &o1))
+	require.Nil(t, json.Unmarshal(s, &o2))
+
+	require.Equal(t, o1, o2)
+}
+
+func Test_alertmanagerSafeLabel(t *testing.T) {
+	tests := []struct {
+		label string
+		want  string
+	}{
+		{
+			label: "host",
+			want:  "host",
+		},
+		{
+			label: "host_name",
+			want:  "host_name",
+		},
+		{
+			label: "host{name}",
+			want:  "host_name",
+		},
+		{
+			label: "host[name]",
+			want:  "host_name",
+		},
+		{
+			label: "{host}[name]",
+			want:  "host_name",
+		},
+		{
+			label: "host[name]other",
+			want:  "host_name_other",
+		},
+		{
+			label: "host(name)",
+			want:  "host_name",
+		},
+		{
+			label: "json.value[/user/extra/sessionName]",
+			want:  "json_value_user_extra_sessionName",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.label, func(t *testing.T) {
+			if got := alertmanagerSafeLabel(tt.label); got != tt.want {
+				t.Errorf("alertmanagerSafeLabel() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}