learn

Documentation

Index

• Constants
• func MergeWitness(dst, src *pb.Witness)
• func ToWitnessID(streamID uuid.UUID, seq int) akid.WitnessID
• func UnassignedHTTPID() *pb.MethodID
• func UnknownHTTPMethodMeta() *pb.MethodMeta
• func ValidLuhn(number string) bool
• type KGXReportError
  • func (e KGXReportError) Error() string
• type KGXWitnessProcessor
  • func NewKGXWitnessProcessor(lrn akid.LearnSessionID, client rest.LearnClient, bufferSize int, ...) *KGXWitnessProcessor
  • func (w *KGXWitnessProcessor) Close()
  • func (w *KGXWitnessProcessor) ProcessWitness(r *witnessResult) error
  • func (w *KGXWitnessProcessor) SetWitnessTags(tags map[tags.Key]string)
• type ParseAPISpecError
  • func (pase ParseAPISpecError) Error() string
• type PartialWitness
  • func ParseHTTP(elem akinet.ParsedNetworkContent) (*PartialWitness, error)
• type PartialWitnessParser
• type SensitiveDataMatcher
  • func CombineMatchers(matchers []SensitiveDataMatcher) SensitiveDataMatcher

Constants

const (
	// The fallback to trying compression algorithms is more exprensive because there doesn't seem to be a
	// good way of interrogating the algorithms about whether the stream is OK. So we limit the amount of
	// data is may consume or produce.
	MaxFallbackInput  = 1 * 1024 * 1024
	MaxFallbackOutput = 10 * 1024 * 1024

	// This limit is used for non-YAML and non-JSON types that we can have some hope of parsing.
	MaxBufferedBody = 5 * 1024 * 1024

	// For types where we just return a string (or maybe an int) then it doesn't make
	// sense to pull in a lot of data, just to hash it anyway.  The only reason to have more than
	// a few bytes is so we can more reliably distinguish whether responses are identical.
	SmallBodySample = 10 * 1024
)

Functions

func MergeWitness

func MergeWitness(dst, src *pb.Witness)

func ToWitnessID

func ToWitnessID(streamID uuid.UUID, seq int) akid.WitnessID

Generates a v5 UUID as witness ID based on stream ID and seq.

func UnassignedHTTPID

func UnassignedHTTPID() *pb.MethodID

These need to be constructors, rather than a global var that's reused, so that there is not a race condition when marshaling to protobufs that share them. (The race condition actually manifested in obfuscate().)

func UnknownHTTPMethodMeta

func UnknownHTTPMethodMeta() *pb.MethodMeta

func ValidLuhn

func ValidLuhn(number string) bool

code adopted from https://github.com/ShiraazMoollatjie/goluhn

Types

type KGXReportError

type KGXReportError struct {
	// contains filtered or unexported fields
}

func (KGXReportError) Error

func (e KGXReportError) Error() string

type KGXWitnessProcessor

type KGXWitnessProcessor struct {
	// contains filtered or unexported fields
}

implements witnessProcessor

func NewKGXWitnessProcessor

func NewKGXWitnessProcessor(lrn akid.LearnSessionID, client rest.LearnClient, bufferSize int, flushDuration time.Duration, dir kgxapi.NetworkDirection) *KGXWitnessProcessor

func (*KGXWitnessProcessor) Close

func (w *KGXWitnessProcessor) Close()

func (*KGXWitnessProcessor) ProcessWitness

func (w *KGXWitnessProcessor) ProcessWitness(r *witnessResult) error

func (*KGXWitnessProcessor) SetWitnessTags

func (w *KGXWitnessProcessor) SetWitnessTags(tags map[tags.Key]string)

Sets the tags for all witnesses going forward.

type ParseAPISpecError

type ParseAPISpecError string

func (ParseAPISpecError) Error

func (pase ParseAPISpecError) Error() string

type PartialWitness

type PartialWitness struct {
	Witness *pb.Witness

	// Key used to pair this PartialWitness up with its counterpart.
	PairKey akid.WitnessID
}

A partial witness is a witness that only includes the argument or response. It represents a raw observation from a TCP flow and should be paired up with the corresponding observation from the opposite flow in the same TCP stream.

func ParseHTTP

func ParseHTTP(elem akinet.ParsedNetworkContent) (*PartialWitness, error)

type PartialWitnessParser

type PartialWitnessParser func(akinet.ParsedNetworkContent) (*PartialWitness, error)

type SensitiveDataMatcher

type SensitiveDataMatcher func(string) bool

This can be applied to any field (cookies, query strings, etc).

func CombineMatchers

func CombineMatchers(matchers []SensitiveDataMatcher) SensitiveDataMatcher

Utility to consolidate matching and generate Akita Spec Annotation structure if a sensitive data match is found.