derive

Documentation

Index

• Constants
• Variables
• type DeriveFunction
  • func ContainerCreate(containers *containers.Containers) DeriveFunction
  • func ContainerRemove(containers *containers.Containers) DeriveFunction
  • func DetectHookedSyscall(kernelSymbols helpers.KernelSymbolTable) DeriveFunction
  • func HookedSeqOps(kernelSymbols helpers.KernelSymbolTable) DeriveFunction
  • func NetPacketDNS() DeriveFunction
  • func NetPacketDNSRequest() DeriveFunction
  • func NetPacketDNSResponse() DeriveFunction
  • func NetPacketHTTP() DeriveFunction
  • func NetPacketHTTPRequest() DeriveFunction
  • func NetPacketHTTPResponse() DeriveFunction
  • func NetPacketICMP() DeriveFunction
  • func NetPacketICMPv6() DeriveFunction
  • func NetPacketIPv4() DeriveFunction
  • func NetPacketIPv6() DeriveFunction
  • func NetPacketTCP() DeriveFunction
  • func NetPacketUDP() DeriveFunction
  • func SymbolsCollision(soLoader sharedobjs.DynamicSymbolsLoader, fScopes *filterscope.FilterScopes) DeriveFunction
  • func SymbolsLoaded(soLoader sharedobjs.DynamicSymbolsLoader, ...) DeriveFunction
• type SymbolsCollisionArgsGenerator
• type Table
  • func (t Table) DeriveEvent(event trace.Event) ([]trace.Event, []error)
  • func (t Table) Register(deriveFrom, deriveTo events.ID, deriveCondition func() bool, ...) error

Constants

const (
	IPPROTO_TCP uint8 = 6
	IPPROTO_UDP uint8 = 17
)

Variables

var NetSeqOps = [6]string{
	"tcp4_seq_ops",
	"tcp6_seq_ops",
	"udp_seq_ops",
	"udp6_seq_ops",
	"raw_seq_ops",
	"raw6_seq_ops",
}

Struct names for the interfaces HookedSeqOpsEventID checks for hooks The show,start,next and stop operation function pointers will be checked for each of those

var NetSeqOpsFuncs = [4]string{
	"show",
	"start",
	"next",
	"stop",
}

Types

type DeriveFunction

type DeriveFunction func(trace.Event) ([]trace.Event, []error)

DeriveFunction is a function prototype for a function that receives an event as argument and may produce a new event if relevant. It returns a derived or empty event, depending on successful derivation, and an error if one occurred.

func ContainerCreate

func ContainerCreate(containers *containers.Containers) DeriveFunction

ContainerCreate receives a containers as a closure argument to track it's containers. If it receives a cgroup_mkdir event, it can derive a container_create event from it.

func ContainerRemove

func ContainerRemove(containers *containers.Containers) DeriveFunction

ContainerRemove receives a containers.Containers object as a closure argument to track it's containers. If it receives a cgroup_rmdir event, it can derive a container_remove event from it.

func DetectHookedSyscall

func DetectHookedSyscall(kernelSymbols helpers.KernelSymbolTable) DeriveFunction

func HookedSeqOps

func HookedSeqOps(kernelSymbols helpers.KernelSymbolTable) DeriveFunction

func NetPacketDNS

func NetPacketDNS() DeriveFunction

func NetPacketDNSRequest

func NetPacketDNSRequest() DeriveFunction

func NetPacketDNSResponse

func NetPacketDNSResponse() DeriveFunction

func NetPacketHTTP

func NetPacketHTTP() DeriveFunction

func NetPacketHTTPRequest

func NetPacketHTTPRequest() DeriveFunction

func NetPacketHTTPResponse

func NetPacketHTTPResponse() DeriveFunction

func NetPacketICMP

func NetPacketICMP() DeriveFunction

func NetPacketICMPv6

func NetPacketICMPv6() DeriveFunction

func NetPacketIPv4

func NetPacketIPv4() DeriveFunction

func NetPacketIPv6

func NetPacketIPv6() DeriveFunction

func NetPacketTCP

func NetPacketTCP() DeriveFunction

func NetPacketUDP

func NetPacketUDP() DeriveFunction

func SymbolsCollision

func SymbolsCollision(soLoader sharedobjs.DynamicSymbolsLoader, fScopes *filterscope.FilterScopes,
) DeriveFunction

func SymbolsLoaded

func SymbolsLoaded(
	soLoader sharedobjs.DynamicSymbolsLoader,
	filterScopes *filterscope.FilterScopes,
) DeriveFunction

type SymbolsCollisionArgsGenerator

type SymbolsCollisionArgsGenerator struct {
	// contains filtered or unexported fields
}

SymbolsCollisionArgsGenerator creates the shared object symbols collisions derived events. To do so, it uses multiple caches to accelerate performance and reduce chances for failure.

type Table

type Table map[events.ID]map[events.ID]struct {
	DeriveFunction DeriveFunction
	Enabled        func() bool
}

Table defines a table between events and events they can be derived into corresponding to a deriveFunction The Enabled flag is used in order to skip derivation of unneeded events.

func (Table) DeriveEvent

func (t Table) DeriveEvent(event trace.Event) ([]trace.Event, []error)

DeriveEvent takes a trace.Event and checks if it can derive additional events from it as defined by a derivationTable.

func (Table) Register

func (t Table) Register(deriveFrom, deriveTo events.ID, deriveCondition func() bool, deriveLogic DeriveFunction) error

Register registers a new derivation handler