signature

Documentation

Index

• Constants
• type DefaultSignatureConfig
• type Event
• type GitCloneDetected
  • func NewGitCloneDetectedSignature(log *logging.Logger, cfg GitCloneSignatureConfig) *GitCloneDetected
  • func (*GitCloneDetected) GetMetadata() SignatureMetadata
  • func (s *GitCloneDetected) OnEvent(event *types.Event) *v1.SignatureFinding
• type GitCloneSignatureConfig
• type SOCKS5Detected
  • func (*SOCKS5Detected) GetMetadata() SignatureMetadata
  • func (s *SOCKS5Detected) OnEvent(event *types.Event) *v1.SignatureFinding
• type SOCKS5DetectionSignatureConfig
• type SOCKS5DetectionState
• type Signature
  • func DefaultSignatures(log *logging.Logger, cfg SignatureEngineConfig) ([]Signature, error)
  • func NewSOCKS5DetectedSignature(log *logging.Logger, cfg SOCKS5DetectionSignatureConfig) (Signature, error)
• type SignatureEngine
  • func NewEngine(signatures []Signature, log *logging.Logger, cfg SignatureEngineConfig) *SignatureEngine
  • func (e *SignatureEngine) EventInput() chan<- *types.Event
  • func (e *SignatureEngine) Events() <-chan Event
  • func (e *SignatureEngine) QueueEvent(event *types.Event)
  • func (e *SignatureEngine) Run(ctx context.Context) error
  • func (e *SignatureEngine) TargetEvents() []events.ID
• type SignatureEngineConfig
• type SignatureMetadata

Constants

const DefaultSOCKS5SignatureCacheSize = 1024

Types

type DefaultSignatureConfig

type DefaultSignatureConfig struct {
	SOCKS5DetectedSignatureEnabled   bool                           `json:"SOCKS5DetectedSignatureEnabled"`
	SOCKS5DetectedSignatureConfig    SOCKS5DetectionSignatureConfig `json:"SOCKS5DetectedSignatureConfig"`
	GitCloneDetectedSignatureEnabled bool                           `json:"GitCloneSignatureEnabled"`
	GitCloneDetectedSignatureConfig  GitCloneSignatureConfig        `json:"GitCloneSignatureConfig"`
}

type Event

type Event struct {
	EbpfEvent      *types.Event
	SignatureEvent *castpb.SignatureEvent
}

Event is final signature event with finding.

type GitCloneDetected

type GitCloneDetected struct {
	// contains filtered or unexported fields
}

func NewGitCloneDetectedSignature

func NewGitCloneDetectedSignature(log *logging.Logger, cfg GitCloneSignatureConfig) *GitCloneDetected

func (*GitCloneDetected) GetMetadata

func (*GitCloneDetected) GetMetadata() SignatureMetadata

func (*GitCloneDetected) OnEvent

func (s *GitCloneDetected) OnEvent(event *types.Event) *v1.SignatureFinding

type GitCloneSignatureConfig

type GitCloneSignatureConfig struct {
	RedactPasswords bool
}

type SOCKS5Detected

type SOCKS5Detected struct {
	// contains filtered or unexported fields
}

func (*SOCKS5Detected) GetMetadata

func (*SOCKS5Detected) GetMetadata() SignatureMetadata

func (*SOCKS5Detected) OnEvent

func (s *SOCKS5Detected) OnEvent(event *types.Event) *v1.SignatureFinding

type SOCKS5DetectionSignatureConfig

type SOCKS5DetectionSignatureConfig struct {
	CacheSize uint32
}

type SOCKS5DetectionState

type SOCKS5DetectionState uint8

const (
	SOCKS5Unknown SOCKS5DetectionState = iota
	SOCKS5InitialClientRequestReceived
	SOCKS5InitialClientRequestSend
	SOCKS5InitialServerResponseSend
	SOCKS5InitialServerResponseReceived
)

type Signature

type Signature interface {
	GetMetadata() SignatureMetadata

	OnEvent(event *types.Event) *castpb.SignatureFinding
}

func DefaultSignatures

func DefaultSignatures(log *logging.Logger, cfg SignatureEngineConfig) ([]Signature, error)

func NewSOCKS5DetectedSignature

func NewSOCKS5DetectedSignature(log *logging.Logger, cfg SOCKS5DetectionSignatureConfig) (Signature, error)

type SignatureEngine

type SignatureEngine struct {
	// contains filtered or unexported fields
}

func NewEngine

func NewEngine(signatures []Signature, log *logging.Logger, cfg SignatureEngineConfig) *SignatureEngine

func (*SignatureEngine) EventInput

func (e *SignatureEngine) EventInput() chan<- *types.Event

func (*SignatureEngine) Events

func (e *SignatureEngine) Events() <-chan Event

func (*SignatureEngine) QueueEvent

func (e *SignatureEngine) QueueEvent(event *types.Event)

func (*SignatureEngine) Run

func (e *SignatureEngine) Run(ctx context.Context) error

func (*SignatureEngine) TargetEvents

func (e *SignatureEngine) TargetEvents() []events.ID

type SignatureEngineConfig

type SignatureEngineConfig struct {
	InputChanSize          int                    `validate:"required" json:"inputChanSize"`
	OutputChanSize         int                    `validate:"required" json:"outputChanSize"`
	DefaultSignatureConfig DefaultSignatureConfig `json:"default_signature_config"`
}

type SignatureMetadata

type SignatureMetadata struct {
	ID           castpb.SignatureEventID
	Name         string
	Version      string
	TargetEvents []events.ID
}