intel

Documentation

Index

• func SetReverseResolver(fn func(ctx context.Context, ip string) (domain string, err error))
• type Entity
  • func (e *Entity) CNAMECheckEnabled() bool
  • func (e *Entity) DstPort() uint16
  • func (e *Entity) EnableCNAMECheck(ctx context.Context, enabled bool)
  • func (e *Entity) EnableReverseResolving()
  • func (e *Entity) FetchData(ctx context.Context)
  • func (e *Entity) GetASN(ctx context.Context) (uint, bool)
  • func (e *Entity) GetCountry(ctx context.Context) (string, bool)
  • func (e *Entity) GetCountryInfo(ctx context.Context) *geoip.CountryInfo
  • func (e *Entity) GetDomain(ctx context.Context, mayUseReverseDomain bool) (string, bool)
  • func (e *Entity) GetIP() (net.IP, bool)
  • func (e *Entity) GetLocation(ctx context.Context) (*geoip.Location, bool)
  • func (e *Entity) Init(dstPort uint16) *Entity
  • func (e *Entity) ListBlockReason() ListBlockReason
  • func (e *Entity) LoadLists(ctx context.Context)
  • func (e *Entity) MatchLists(lists []string) bool
  • func (e *Entity) ResetLists()
  • func (e *Entity) ResolveSubDomainLists(ctx context.Context, enabled bool)
• type ListBlockReason
  • func (br ListBlockReason) Context() interface{}
  • func (br ListBlockReason) GetExtraRRs(ctx context.Context, _ *dns.Msg) []dns.RR
  • func (br ListBlockReason) MarshalJSON() ([]byte, error)
  • func (br ListBlockReason) String() string
• type ListMatch
  • func (lm *ListMatch) String() string

Functions

func SetReverseResolver

func SetReverseResolver(fn func(ctx context.Context, ip string) (domain string, err error))

SetReverseResolver allows the resolver module to register a function to allow reverse resolving IPs to domains.

Types

type Entity

type Entity struct {
	sync.Mutex

	// IP is the IP address of the connection. If domain is
	// set, IP has been resolved by following all CNAMEs.
	IP net.IP

	// IPScope holds the network scope of the IP.
	// For DNS requests, this signifies in which scope the DNS request was resolved.
	IPScope netutils.IPScope

	// Protocol is the protcol number used by the connection.
	Protocol uint8

	// Port is the remote port of the connection
	Port uint16

	// Domain is the target domain of the connection.
	Domain string

	// ReverseDomain is the domain the IP address points to. This is only
	// resolved and populated when needed.
	ReverseDomain string

	// CNAME is a list of domain names that have been
	// resolved for Domain.
	CNAME []string

	// Country holds the country the IP address (ASN) is
	// located in.
	Country string

	// Coordinates holds the approximate coordinates of the IP address.
	Coordinates *geoip.Coordinates

	// ASN holds the autonomous system number of the IP.
	ASN uint

	// ASOrg holds the owner's name of the autonomous system.
	ASOrg string

	// LocationError holds an error message if fetching the location failed.
	LocationError string

	// BlockedByLists holds list source IDs that
	// are used to block the entity.
	BlockedByLists []string

	// BlockedEntities holds a list of entities that
	// have been blocked. Values can be used as a key
	// for the ListOccurences map.
	BlockedEntities []string

	// ListOccurences is a map that matches an entity (Domain, IPs, ASN, Country, Sub-domain)
	// to a list of sources where the entity has been observed in.
	ListOccurences map[string][]string

	// ListsError holds an error message if fetching the lists failed.
	ListsError string
	// contains filtered or unexported fields
}

Entity describes a remote endpoint in many different ways. It embeddes a sync.Mutex but none of the endpoints own functions performs locking. The caller MUST ENSURE proper locking and synchronization when accessing any properties of Entity.

func (*Entity) CNAMECheckEnabled

func (e *Entity) CNAMECheckEnabled() bool

CNAMECheckEnabled returns true if the entities CNAMEs should also be checked.

func (*Entity) DstPort

func (e *Entity) DstPort() uint16

DstPort returns the destination port.

func (*Entity) EnableCNAMECheck

func (e *Entity) EnableCNAMECheck(ctx context.Context, enabled bool)

EnableCNAMECheck enalbes or disables list lookups for entity CNAMEs.

func (*Entity) EnableReverseResolving

func (e *Entity) EnableReverseResolving()

EnableReverseResolving enables reverse resolving the domain from the IP on demand.

func (*Entity) FetchData

func (e *Entity) FetchData(ctx context.Context)

FetchData fetches additional information, meant to be called before persisting an entity record.

func (*Entity) GetASN

func (e *Entity) GetASN(ctx context.Context) (uint, bool)

GetASN returns the AS number and whether it is set.

func (*Entity) GetCountry

func (e *Entity) GetCountry(ctx context.Context) (string, bool)

GetCountry returns the two letter ISO country code and whether it is set.

func (*Entity) GetCountryInfo

func (e *Entity) GetCountryInfo(ctx context.Context) *geoip.CountryInfo

GetCountryInfo returns the two letter ISO country code and whether it is set.

func (*Entity) GetDomain

func (e *Entity) GetDomain(ctx context.Context, mayUseReverseDomain bool) (string, bool)

GetDomain returns the domain and whether it is set.

func (*Entity) GetIP

func (e *Entity) GetIP() (net.IP, bool)

GetIP returns the IP and whether it is set.

func (*Entity) GetLocation

func (e *Entity) GetLocation(ctx context.Context) (*geoip.Location, bool)

GetLocation returns the raw location data and whether it is set.

func (*Entity) Init

func (e *Entity) Init(dstPort uint16) *Entity

Init initializes internal metadata about the entity. If the entity does not describe a destination, you can supply a different destination port for endpoint matching. It returns the entity itself for single line formatting.

func (*Entity) ListBlockReason

func (e *Entity) ListBlockReason() ListBlockReason

ListBlockReason returns the block reason for this entity.

func (*Entity) LoadLists

func (e *Entity) LoadLists(ctx context.Context)

LoadLists searches all filterlists for all occurrences of this entity.

func (*Entity) MatchLists

func (e *Entity) MatchLists(lists []string) bool

MatchLists matches the entities lists against a slice of source IDs and updates various entity properties like BlockedByLists, ListOccurences and BlockedEntitites.

func (*Entity) ResetLists

func (e *Entity) ResetLists()

ResetLists resets the current list data and forces all list sources to be re-acquired when calling GetLists().

func (*Entity) ResolveSubDomainLists

func (e *Entity) ResolveSubDomainLists(ctx context.Context, enabled bool)

ResolveSubDomainLists enables or disables list lookups for sub-domains.

type ListBlockReason

type ListBlockReason []ListMatch

ListBlockReason is a list of list matches.

func (ListBlockReason) Context

func (br ListBlockReason) Context() interface{}

Context returns br wrapped into a map. It implements the endpoints.Reason interface.

func (ListBlockReason) GetExtraRRs

func (br ListBlockReason) GetExtraRRs(ctx context.Context, _ *dns.Msg) []dns.RR

GetExtraRRs implements the nsutil.RRProvider interface and adds additional TXT records justifying the reason the request was blocked.

func (ListBlockReason) MarshalJSON

func (br ListBlockReason) MarshalJSON() ([]byte, error)

MarshalJSON marshals the list block reason into a map prefixed with filterlists.

func (ListBlockReason) String

func (br ListBlockReason) String() string

type ListMatch

type ListMatch struct {
	Entity        string
	ActiveLists   []string
	InactiveLists []string
}

ListMatch represents an entity that has been matched against filterlists.

func (*ListMatch) String

func (lm *ListMatch) String() string