process

Documentation

Overview

Package process fetches process and socket information from the operating system. It can find the process owning a network connection.

Index

• Variables
• func All() map[int]*Process
• func CleanProcessStorage(activePIDs map[int]struct{})
• func GetActiveConnectionIDs() []string
• func GetPidByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, ...) (pid int, direction bool, err error)
• func GetPidByPacket(pkt packet.Packet) (pid int, direction bool, err error)
• func SetDBController(controller *database.Controller)
• type Process
  • func GetOrFindPrimaryProcess(ctx context.Context, pid int) (*Process, error)
  • func GetOrFindProcess(ctx context.Context, pid int) (*Process, error)
  • func GetProcessByEndpoints(ctx context.Context, localIP net.IP, localPort uint16, remoteIP net.IP, ...) (process *Process, err error)
  • func GetProcessByPacket(pkt packet.Packet) (process *Process, direction bool, err error)
  • func GetProcessFromStorage(pid int) (*Process, bool)
  • func (p *Process) Delete()
  • func (p *Process) GetExecHash(algorithm string) (string, error)
  • func (p *Process) GetProfile(ctx context.Context) error
  • func (p *Process) IsAdmin() bool
  • func (p *Process) IsKernel() bool
  • func (p *Process) IsSystem() bool
  • func (p *Process) IsUser() bool
  • func (p *Process) Profile() *profile.LayeredProfile
  • func (p *Process) Save()
  • func (p *Process) String() string

Variables

var (
	ErrConnectionNotFound = errors.New("could not find connection in system state tables")
	ErrProcessNotFound    = errors.New("could not find process in system state tables")
)

Errors

var (
	// UnknownProcess is used when a process cannot be found.
	UnknownProcess = &Process{
		UserID:    -1,
		UserName:  "Unknown",
		Pid:       -1,
		ParentPid: -1,
		Name:      "Unknown Processes",
	}

	// OSProcess is used to represent the Kernel.
	OSProcess = &Process{
		UserID:    0,
		UserName:  "Kernel",
		Pid:       0,
		ParentPid: 0,
		Name:      "Operating System",
	}
)

var (
	CfgOptionEnableProcessDetectionKey = "core/enableProcessDetection"
)

Configuration Keys

Functions

func All

func All() map[int]*Process

All returns a copy of all process objects.

func CleanProcessStorage

func CleanProcessStorage(activePIDs map[int]struct{})

CleanProcessStorage cleans the storage from old processes.

func GetActiveConnectionIDs

func GetActiveConnectionIDs() []string

GetActiveConnectionIDs returns a list of all active connection IDs.

func GetPidByEndpoints

func GetPidByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, protocol packet.IPProtocol) (pid int, direction bool, err error)

GetPidByEndpoints returns the pid of the owner of the described link.

func GetPidByPacket

func GetPidByPacket(pkt packet.Packet) (pid int, direction bool, err error)

GetPidByPacket returns the pid of the owner of the packet.

func SetDBController

func SetDBController(controller *database.Controller)

SetDBController sets the database controller and allows the package to push database updates on a save. It must be set by the package that registers the "network" database.

Types

type Process

type Process struct {
	record.Base
	sync.Mutex

	UserID    int
	UserName  string
	UserHome  string
	Pid       int
	ParentPid int
	Path      string
	Cwd       string
	CmdLine   string
	FirstArg  string

	ExecName   string
	ExecHashes map[string]string

	LocalProfileKey string

	Name string
	Icon string

	FirstSeen int64
	LastSeen  int64

	Virtual bool // This process is either merged into another process or is not needed.
	// contains filtered or unexported fields
}

A Process represents a process running on the operating system

func GetOrFindPrimaryProcess

func GetOrFindPrimaryProcess(ctx context.Context, pid int) (*Process, error)

GetOrFindPrimaryProcess returns the highest process in the tree that matches the given PID.

func GetOrFindProcess

func GetOrFindProcess(ctx context.Context, pid int) (*Process, error)

GetOrFindProcess returns the process for the given PID.

func GetProcessByEndpoints

func GetProcessByEndpoints(ctx context.Context, localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, protocol packet.IPProtocol) (process *Process, err error)

GetProcessByEndpoints returns the process that owns the described link.

func GetProcessByPacket

func GetProcessByPacket(pkt packet.Packet) (process *Process, direction bool, err error)

GetProcessByPacket returns the process that owns the given packet.

func GetProcessFromStorage

func GetProcessFromStorage(pid int) (*Process, bool)

GetProcessFromStorage returns a process from the internal storage.

func (*Process) Delete

func (p *Process) Delete()

Delete deletes a process from the storage and propagates the change.

func (*Process) GetExecHash

func (p *Process) GetExecHash(algorithm string) (string, error)

GetExecHash returns the hash of the executable with the given algorithm.

func (*Process) GetProfile

func (p *Process) GetProfile(ctx context.Context) error

GetProfile finds and assigns a profile set to the process.

func (*Process) IsAdmin

func (p *Process) IsAdmin() bool

IsAdmin returns whether the process is run by an admin user.

func (*Process) IsKernel

func (p *Process) IsKernel() bool

IsKernel returns whether the process is the Kernel.

func (*Process) IsSystem

func (p *Process) IsSystem() bool

IsSystem returns whether the process is run by the operating system.

func (*Process) IsUser

func (p *Process) IsUser() bool

IsUser returns whether the process is run by a normal user.

func (*Process) Profile

func (p *Process) Profile() *profile.LayeredProfile

Profile returns the assigned layered profile.

func (*Process) Save

func (p *Process) Save()

Save saves the process to the internal state and pushes an update.

func (*Process) String

func (p *Process) String() string

Strings returns a string representation of process.