parser

Documentation

Overview

Package parser parses service metadata

Index

• type DockerProxy
  • func NewDockerProxy() *DockerProxy
  • func (d *DockerProxy) Extract(processes map[int32]*procutil.Process)
  • func (d *DockerProxy) Filter(payload *model.Connections)
• type ServiceExtractor
  • func NewServiceExtractor(enabled, useWindowsServiceName, useImprovedAlgorithm bool) *ServiceExtractor
  • func (d *ServiceExtractor) Extract(processes map[int32]*procutil.Process)
  • func (d *ServiceExtractor) GetServiceContext(pid int32) []string
• type WindowsServiceInfo

Types

type DockerProxy

type DockerProxy struct {
	// contains filtered or unexported fields
}

DockerProxy keeps track of every docker-proxy instance and filters network traffic going through them

func NewDockerProxy

func NewDockerProxy() *DockerProxy

NewDockerProxy instantiates a new filter loaded with docker-proxy instance information

func (*DockerProxy) Extract

func (d *DockerProxy) Extract(processes map[int32]*procutil.Process)

Extract the process metadata from the processes

func (*DockerProxy) Filter

func (d *DockerProxy) Filter(payload *model.Connections)

Filter all connections that have a docker-proxy at one end

type ServiceExtractor

type ServiceExtractor struct {
	// contains filtered or unexported fields
}

ServiceExtractor infers a service tag by extracting it from a process

func NewServiceExtractor

func NewServiceExtractor(enabled, useWindowsServiceName, useImprovedAlgorithm bool) *ServiceExtractor

NewServiceExtractor instantiates a new service discovery extractor

func (*ServiceExtractor) Extract

func (d *ServiceExtractor) Extract(processes map[int32]*procutil.Process)

Extract the process metadata from the processes

func (*ServiceExtractor) GetServiceContext

func (d *ServiceExtractor) GetServiceContext(pid int32) []string

GetServiceContext returns the service context for the PID

type WindowsServiceInfo

type WindowsServiceInfo struct {
	ServiceName []string
	DisplayName []string
}

WindowsServiceInfo represents service data that is parsed from the SCM. On non-Windows platforms these fields should always be empty. On Windows, multiple services can be binpacked into a single `svchost.exe`, which is why `ServiceName` and `DisplayName` are slices.