signature

Documentation

Index

• Constants
• type DefaultSignatureConfig
• type SOCKS5Detected
  • func (*SOCKS5Detected) GetMetadata() SignatureMetadata
  • func (s *SOCKS5Detected) OnEvent(event *types.Event) *v1.SignatureFinding
• type SOCKS5DetectionSignatureConfig
• type SOCKS5DetectionState
• type Signature
  • func DefaultSignatures(log *logging.Logger, cfg DefaultSignatureConfig) ([]Signature, error)
  • func NewSOCKS5DetectedSignature(cfg SOCKS5DetectionSignatureConfig) (Signature, error)
  • func NewStdViaSocketSignature(log *logging.Logger) Signature
  • func NewTTYDetectedSignature() Signature
• type SignatureEngine
  • func NewEngine(signatures []Signature, log *logging.Logger, cfg SignatureEngineConfig) *SignatureEngine
  • func (e *SignatureEngine) EventInput() chan<- *types.Event
  • func (e *SignatureEngine) Events() <-chan *castpb.Event
  • func (e *SignatureEngine) QueueEvent(event *types.Event)
  • func (e *SignatureEngine) Run(ctx context.Context) error
  • func (e *SignatureEngine) TargetEvents() []events.ID
• type SignatureEngineConfig
• type SignatureMetadata
• type StdioViaSocket
  • func (*StdioViaSocket) GetMetadata() SignatureMetadata
  • func (s *StdioViaSocket) OnEvent(event *types.Event) *v1.SignatureFinding
• type TTYDetected
  • func (*TTYDetected) GetMetadata() SignatureMetadata
  • func (s *TTYDetected) OnEvent(event *types.Event) *v1.SignatureFinding

Constants

const DefaultSOCKS5SignatureCacheSize = 1024

Types

type DefaultSignatureConfig

type DefaultSignatureConfig struct {
	TTYDetectedSignatureEnabled    bool
	SOCKS5DetectedSignatureEnabled bool
	SOCKS5DetectedSignatureConfig  SOCKS5DetectionSignatureConfig
}

type SOCKS5Detected

type SOCKS5Detected struct {
	// contains filtered or unexported fields
}

func (*SOCKS5Detected) GetMetadata

func (*SOCKS5Detected) GetMetadata() SignatureMetadata

func (*SOCKS5Detected) OnEvent

func (s *SOCKS5Detected) OnEvent(event *types.Event) *v1.SignatureFinding

type SOCKS5DetectionSignatureConfig

type SOCKS5DetectionSignatureConfig struct {
	CacheSize uint32
}

type SOCKS5DetectionState

type SOCKS5DetectionState uint8

const (
	SOCKS5Unknown SOCKS5DetectionState = iota
	SOCKS5InitialClientRequestReceived
	SOCKS5InitialClientRequestSend
	SOCKS5InitialServerResponseSend
	SOCKS5InitialServerResponseReceived
)

type Signature

type Signature interface {
	GetMetadata() SignatureMetadata

	OnEvent(event *types.Event) *castpb.SignatureFinding
}

func DefaultSignatures

func DefaultSignatures(log *logging.Logger, cfg DefaultSignatureConfig) ([]Signature, error)

func NewSOCKS5DetectedSignature

func NewSOCKS5DetectedSignature(cfg SOCKS5DetectionSignatureConfig) (Signature, error)

func NewStdViaSocketSignature

func NewStdViaSocketSignature(log *logging.Logger) Signature

func NewTTYDetectedSignature

func NewTTYDetectedSignature() Signature

type SignatureEngine

type SignatureEngine struct {
	// contains filtered or unexported fields
}

func NewEngine

func NewEngine(signatures []Signature, log *logging.Logger, cfg SignatureEngineConfig) *SignatureEngine

func (*SignatureEngine) EventInput

func (e *SignatureEngine) EventInput() chan<- *types.Event

func (*SignatureEngine) Events

func (e *SignatureEngine) Events() <-chan *castpb.Event

func (*SignatureEngine) QueueEvent

func (e *SignatureEngine) QueueEvent(event *types.Event)

func (*SignatureEngine) Run

func (e *SignatureEngine) Run(ctx context.Context) error

func (*SignatureEngine) TargetEvents

func (e *SignatureEngine) TargetEvents() []events.ID

type SignatureEngineConfig

type SignatureEngineConfig struct {
	InputChanSize          int `validate:"required"`
	OutputChanSize         int `validate:"required"`
	DefaultSignatureConfig DefaultSignatureConfig
}

type SignatureMetadata

type SignatureMetadata struct {
	ID           castpb.SignatureEventID
	Name         string
	Version      string
	TargetEvents []events.ID
}

type StdioViaSocket

type StdioViaSocket struct {
	// contains filtered or unexported fields
}

func (*StdioViaSocket) GetMetadata

func (*StdioViaSocket) GetMetadata() SignatureMetadata

func (*StdioViaSocket) OnEvent

func (s *StdioViaSocket) OnEvent(event *types.Event) *v1.SignatureFinding

type TTYDetected

type TTYDetected struct{}

func (*TTYDetected) GetMetadata

func (*TTYDetected) GetMetadata() SignatureMetadata

func (*TTYDetected) OnEvent

func (s *TTYDetected) OnEvent(event *types.Event) *v1.SignatureFinding