pkg

package
v0.0.0-...-30deb2f Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 3, 2021 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrReload var to define a reload of the consumer
	ErrReload = fmt.Errorf("reload consumer")
)

Functions

func AccessFileOpt 

func AccessFileOpt(fs afero.Fs, path string, logger zerolog.Logger) func(*AccessListener)

AccessFileOpt function used to return metadata on a file

func ArrayClean 

func ArrayClean(array []string) []string

ArrayClean function to clean an array of duplicates?

func ArrayDiff 

func ArrayDiff(array1, array2 []string) (add, del []string)

ArrayDiff function to compare two arrays

func ArrayEqual 

func ArrayEqual(array1, array2 []string) bool

ArrayEqual checks if one array equals the second array

func Encode 

func Encode(i interface{}) ([]byte, error)

Encode takes in data, and encodes it for use in BPF TODO: unused in current code

func GenericDiffFileOpt 

func GenericDiffFileOpt(fs afero.Fs, path string, logger zerolog.Logger) func(*GenericDiffListener)

GenericDiffFileOpt function used to return metadata on a file

func GenericFileOpt 

func GenericFileOpt(fs afero.Fs, path string, logger zerolog.Logger) func(*GenericListener)

GenericFileOpt function used to return metadata on a file TODO: unused in current code

func GobMarshal 

func GobMarshal(i interface{}) ([]byte, error)

GobMarshal function to marshal interface to byte slice

func GobUnmarshal 

func GobUnmarshal(i interface{}, b []byte) error

GobUnmarshal function to unmarshal gob

func IsNotExist 

func IsNotExist(err error) bool

IsNotExist Golang has a weird behavior regarding stat function if one entry in the path is a file We need to rewrite the os.IsNotExist function

func MaskLeft 

func MaskLeft(s string) string

MaskLeft function to maskleft given string

Types

type Access 

type Access struct {
	Grant, Deny []string
}

Access struct used to store changes to access.conf

func (Access) IsEmpty 

func (a Access) IsEmpty() bool

IsEmpty method to check if diff is empty

type AccessListener 

type AccessListener struct {
	zerolog.Logger
	afero.Fs
	// contains filtered or unexported fields
}

AccessListener struct used for filestream events.

func NewAccessListener 

func NewAccessListener(options ...func(*AccessListener)) *AccessListener

NewAccessListener function to create a new file event listener

func (*AccessListener) Register 

func (al *AccessListener) Register() []string

Register method returns list of paths to files to be watched

type AccessState 

type AccessState struct {
	*AccessListener
	// contains filtered or unexported fields
}

AccessState struct keeps track of state changes based on AccessListener struct and methods

func (*AccessState) Changed 

func (as *AccessState) Changed() bool

Changed checks if the new AccessState instance is different from old AccessState instance

func (*AccessState) Created 

func (as *AccessState) Created() bool

Created checks if the current AccessState has been created

func (*AccessState) Load 

func (as *AccessState) Load(db *AgentDB) (err error)

Load reads in current state from local db instance

func (*AccessState) Notify 

func (as *AccessState) Notify(cmd string, user string)

Notify is the method to notify of a change in state

func (*AccessState) Parse 

func (as *AccessState) Parse() (State, error)

Parse calls parse(), and update new AccessState

func (*AccessState) Save 

func (as *AccessState) Save(db *AgentDB) error

Save commits a state to the local DB instance.

func (*AccessState) Teardown 

func (as *AccessState) Teardown() error

Teardown is the reset method when a change has been detected. Set new state to old state, and reload.

type AgentDB 

type AgentDB struct {
	zerolog.Logger
	*bolt.DB
}

AgentDB struct containing db connection

func (*AgentDB) LoadAccess 

func (a *AgentDB) LoadAccess() (Access, error)

LoadAccess method to load access

func (*AgentDB) LoadGeneric 

func (a *AgentDB) LoadGeneric() (Generic, error)

LoadGeneric method to load generic files

func (*AgentDB) LoadGenericDiff 

func (a *AgentDB) LoadGenericDiff() (GenericDiff, error)

LoadGenericDiff method to load generic files that require a diff

func (*AgentDB) LoadUsers 

func (a *AgentDB) LoadUsers() (Users, error)

LoadUsers method to load users

func (*AgentDB) SaveAccess 

func (a *AgentDB) SaveAccess(access Access) error

SaveAccess method to save access config

func (*AgentDB) SaveGeneric 

func (a *AgentDB) SaveGeneric(generic Generic) error

SaveGeneric method to save generic files

func (*AgentDB) SaveGenericDiff 

func (a *AgentDB) SaveGenericDiff(genericDiff GenericDiff) error

SaveGenericDiff method to save generic files that require a diff

func (*AgentDB) SaveUsers 

func (a *AgentDB) SaveUsers(users Users) error

SaveUsers method to save Users

type BaseConsumer 

type BaseConsumer struct {
	*AgentDB
	ParserLoader
	sync.RWMutex
}

BaseConsumer is a struct that contains the base objects needed to make a consumer

func (*BaseConsumer) Consume 

func (bc *BaseConsumer) Consume(e Event) error

Consume consumes an event

func (*BaseConsumer) Init 

func (bc *BaseConsumer) Init() error

Init function for populating a base consumer

func (*BaseConsumer) Register 

func (bc *BaseConsumer) Register() *sync.Map

Register method maps files to consumers.

type BaseConsumers 

type BaseConsumers []*BaseConsumer

BaseConsumers is a type to describe multiple BaseConsumers

func (BaseConsumers) Consumers 

func (bc BaseConsumers) Consumers() (consumers []Consumer)

Consumers returns a slice of consumers.

type Consumer 

type Consumer interface {
	Consume(e Event) error
	Register
}

Consumer interface describes a consumer for a watcher

type Consumers 

type Consumers struct {
	zerolog.Logger
	*sync.Map // map[string]Consumer
}

Consumers map of consumers

func (Consumers) Files 

func (c Consumers) Files() (files []string)

Files method to get list of files

type Event 

type Event struct {
	Mode      int32
	PID       uint32
	UID       uint32
	Size      uint32
	Inode     uint64
	Device    uint64
	NewInode  uint64 // target directory when renaming
	NewDevice uint64 // target file when renaming, 0 if doesn't exist
	Com       string
	Path      string
}

Event struct the represents event that is sent to user space from BPF

type FIM 

type FIM struct {
	Module     *elf.Module
	RulesTable *elf.Map

	Events chan Event
	zerolog.Logger
	// contains filtered or unexported fields
}

FIM struct that represents BPF event system

func InitFIM 

func InitFIM(bccFile string, logger zerolog.Logger) (*FIM, error)

InitFIM function to initialize and start BPF

func (*FIM) AddFile 

func (f *FIM) AddFile(name string) error

AddFile method to add a new file to BPF monitor

func (*FIM) GetFileFromInode 

func (f *FIM) GetFileFromInode(key uint64) (string, error)

GetFileFromInode look up filename for given inode

func (*FIM) RemoveFile 

func (f *FIM) RemoveFile(name string) error

RemoveFile method to remove a file from BPF monitor

func (*FIM) RemoveInode 

func (f *FIM) RemoveInode(key uint64) (string, error)

RemoveInode method to remove a file from BPF monitor

func (*FIM) Stats 

func (f *FIM) Stats() string

Stats method to print status of code

func (*FIM) StopBPF 

func (f *FIM) StopBPF() error

StopBPF method to clean up bpf after running

type File 

type File struct {
	afero.Fs
	zerolog.Logger
	Path string
}

File struct to define file

func NewFile 

func NewFile(options ...func(*File)) *File

NewFile function to create new files

type FileMissing 

type FileMissing struct {
	File string
	Consumer
	zerolog.Logger
}

FileMissing struct is used when a watched file cannot be located

func NewFileMissing 

func NewFileMissing(events chan Event, options ...func(*FileMissing)) *FileMissing

NewFileMissing function watches for a file to be found, and adds the file to be monitored.

func (*FileMissing) Register 

func (fm *FileMissing) Register() *sync.Map

Register method registers the newly found file to the correct consumer

type Generic 

type Generic struct {
	Contents []byte
}

Generic struct used to store changes to generic files

func (Generic) IsEmpty 

func (a Generic) IsEmpty() bool

IsEmpty method to check if diff is empty

type GenericDiff 

type GenericDiff struct {
	Rule []string
}

GenericDiff struct used to store changes to the generic file with diff

func (GenericDiff) IsEmpty 

func (gd GenericDiff) IsEmpty() bool

IsEmpty method to check if diff is empty

type GenericDiffListener 

type GenericDiffListener struct {
	zerolog.Logger
	afero.Fs
	// contains filtered or unexported fields
}

GenericDiffListener struct used for filestream events.

func NewGenericDiffListener 

func NewGenericDiffListener(options ...func(*GenericDiffListener)) *GenericDiffListener

NewGenericDiffListener function to create a new file event listener

func (*GenericDiffListener) Register 

func (gdl *GenericDiffListener) Register() []string

Register method returns list of paths to files to be watched

type GenericDiffState 

type GenericDiffState struct {
	*GenericDiffListener
	// contains filtered or unexported fields
}

GenericDiffState struct keeps track of state changes based on GenericDiffListener struct and methods

func (*GenericDiffState) Changed 

func (gds *GenericDiffState) Changed() bool

Changed checks if the new GenericDiffState instance is different from old GenericDiffState instance

func (*GenericDiffState) Created 

func (gds *GenericDiffState) Created() bool

Created checks if the current GenericDiffState has been created

func (*GenericDiffState) Load 

func (gds *GenericDiffState) Load(db *AgentDB) (err error)

Load reads in current state from local db instance

func (*GenericDiffState) Notify 

func (gds *GenericDiffState) Notify(cmd string, user string)

Notify is the method to notify of a change in state

func (*GenericDiffState) Parse 

func (gds *GenericDiffState) Parse() (State, error)

Parse calls parse(), and update new GenericDiffState

func (*GenericDiffState) Register 

func (gds *GenericDiffState) Register() []string

Register returns a list of files to watch for changes

func (*GenericDiffState) Save 

func (gds *GenericDiffState) Save(db *AgentDB) error

Save commits a state to the local DB instance.

func (*GenericDiffState) Teardown 

func (gds *GenericDiffState) Teardown() error

Teardown is the reset method when a change has been detected. Set new state to old state, and reload.

type GenericListener 

type GenericListener struct {
	zerolog.Logger
	afero.Fs
	File  string
	IsDir bool
	Key   []byte
}

GenericListener struct used for filestream events.

func NewGenericListener 

func NewGenericListener(options ...func(*GenericListener)) *GenericListener

NewGenericListener function to create a new file event listener

func (*GenericListener) Register 

func (gl *GenericListener) Register() []string

Register method returns list of paths to files to be watched

type GenericState 

type GenericState struct {
	*GenericListener
	// contains filtered or unexported fields
}

GenericState struct keeps track of state changes based on GenericListener struct and methods

func (*GenericState) Changed 

func (gs *GenericState) Changed() bool

Changed checks if the new UserState instance is different from old UserState instance

func (*GenericState) Created 

func (gs *GenericState) Created() bool

Created checks if the current UserState has been created

func (*GenericState) Load 

func (gs *GenericState) Load(db *AgentDB) error

Load reads in current state from local db instance

func (*GenericState) Notify 

func (gs *GenericState) Notify(cmd string, user string)

Notify is the method to notify of a change in state

func (*GenericState) Parse 

func (gs *GenericState) Parse() (State, error)

Parse calls parse(), and update new UserState

func (*GenericState) Register 

func (gs *GenericState) Register() []string

Register returns a list of files to watch for changes

func (*GenericState) Save 

func (gs *GenericState) Save(db *AgentDB) error

Save commits a state to the local DB instance.

func (*GenericState) Teardown 

func (gs *GenericState) Teardown() error

Teardown is the reset method when a change has been detected. Set new state to old state, and reload.

type LogAccess 

type LogAccess Access

LogAccess type wrapper

func (LogAccess) MarshalZerologObject 

func (la LogAccess) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to marshal access object

type LogEvent 

type LogEvent Event

LogEvent type wrapper

func (LogEvent) MarshalZerologObject 

func (le LogEvent) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to marshal object

type LogGeneric 

type LogGeneric GenericState

LogGeneric type wrapper

func (LogGeneric) MarshalZerologObject 

func (lg LogGeneric) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to marshal generic object

type LogGenericDiff 

type LogGenericDiff GenericDiff

LogGenericDiff type wrapper

func (LogGenericDiff) MarshalZerologObject 

func (lgd LogGenericDiff) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to marshal generic diff object

type LogUser 

type LogUser User

LogUser type wrapper

func (LogUser) MarshalZerologObject 

func (lu LogUser) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to marshal user event

type LogUsers 

type LogUsers Users

LogUsers type wrapper

func (LogUsers) MarshalZerologArray 

func (lu LogUsers) MarshalZerologArray(a *zerolog.Array)

MarshalZerologArray method to marshal array

type Map 

type Map map[string]string

Map type to define Map

func (Map) Equal 

func (m1 Map) Equal(m2 Map) bool

Equal method to check if map1 == map2

type Metrics 

type Metrics struct {
	GraphiteHost        string
	Namespace           string
	GraphiteMode        int
	MetricsInterval     time.Duration
	EveryHourRegister   goMetrics.Registry
	EveryMinuteRegister goMetrics.Registry
	Hostname            string
	RoleName            string
	Logger              zerolog.Logger
	// contains filtered or unexported fields
}

Metrics struct defining configs for graphite metrics

func (*Metrics) Init 

func (m *Metrics) Init() error

Init method to start up graphite metrics

func (*Metrics) RecordBPFMetrics 

func (m *Metrics) RecordBPFMetrics()

RecordBPFMetrics send metrics for BPF hits and misses per probe

func (*Metrics) RecordByEventsCaught 

func (m *Metrics) RecordByEventsCaught()

RecordByEventsCaught sends count of number of events caught by ebpf

func (*Metrics) RecordByInstalledHost 

func (m *Metrics) RecordByInstalledHost()

RecordByInstalledHost graphite metric to show how manay host have bpfink installed

func (*Metrics) RecordByLogTypes 

func (m *Metrics) RecordByLogTypes(logType string)

RecordByLogTypes sends count of different types of logs

func (*Metrics) RecordVersion 

func (m *Metrics) RecordVersion(version string)

RecordVersion graphite metric to show the version of bpfink running on each host

type ParserLoader 

type ParserLoader interface {
	Load(db *AgentDB) error
	Save(db *AgentDB) error
	Parse() (State, error)
	Register() []string
}

ParserLoader describes the interface for maintaining the data in a consumer

type Register 

type Register interface {
	Register() *sync.Map // map[string]Consumer
}

Register defines register interface for a watcher

type Set 

type Set map[string]struct{}

Set type to define Set

func Array2Set 

func Array2Set(array []string) Set

Array2Set function to convert Array to a set

func SetDiff 

func SetDiff(old, new Set) (add, del Set)

SetDiff check difference between two sets TODO: unused in current code

func (Set) Equal 

func (s Set) Equal(s2 Set) bool

Equal method to check if set1 == set2 deep compare

func (Set) Push 

func (s Set) Push(entries ...string)

Push method to push entries into set

func (Set) ToArray 

func (s Set) ToArray() (array []string)

ToArray method to return items into slice of string

type State 

type State interface {
	Changed() bool
	Created() bool
	Notify(string, string)
	Teardown() error
}

State describes the interface for maintaining state of instances for a consumer

type User 

type User struct {
	Name     string
	Password string
	Keys     []string
}

User struct representing a user

func (*User) Equal 

func (u1 *User) Equal(u2 *User) bool

Equal method to compare to users

type Users 

type Users map[string]*User

Users map of user objects

type UsersListener 

type UsersListener struct {
	afero.Fs
	Shadow, Passwd string
	zerolog.Logger
}

UsersListener struct of listener for users

func NewUsersListener 

func NewUsersListener(options ...func(*UsersListener)) *UsersListener

NewUsersListener new function to create user listener

func (*UsersListener) Register 

func (ul *UsersListener) Register(includes []string) (out []string)

Register method takes in list of files to monitor for writes

type UsersState 

type UsersState struct {
	*UsersListener
	// contains filtered or unexported fields
}

UsersState struct keeps track of state changes based on UserListener struct and methods

func (*UsersState) Changed 

func (us *UsersState) Changed() bool

Changed checks if the new UserState instance is different from old UserState instance

func (*UsersState) Created 

func (us *UsersState) Created() bool

Created checks if the current UserState has been created

func (*UsersState) Load 

func (us *UsersState) Load(db *AgentDB) error

Load reads in current state from local db instance

func (*UsersState) Notify 

func (us *UsersState) Notify(cmd string, user string)

Notify is the method to notify of a change in state

func (*UsersState) Parse 

func (us *UsersState) Parse() (State, error)

Parse calls parse(), and update new UserState

func (*UsersState) Register 

func (us *UsersState) Register() []string

Register returns a list of files to watch for changes

func (*UsersState) Save 

func (us *UsersState) Save(db *AgentDB) error

Save commits a state to the local DB instance.

func (*UsersState) Teardown 

func (us *UsersState) Teardown() error

Teardown is the reset method when a change has been detected. Set new state to old state, and reload.

type Watcher 

type Watcher struct {
	zerolog.Logger
	*FIM
	Key       []byte
	Database  *AgentDB
	Consumers []Consumer

	CloseChannels chan struct{}
	Excludes      []*regexp.Regexp
	GenericDiff   []string
	Metrics       *Metrics
	// contains filtered or unexported fields
}

Watcher struct defines a watcher object

func NewWatcher 

func NewWatcher(options ...func(*Watcher)) *Watcher

NewWatcher function to create new watcher function

func (*Watcher) Start 

func (w *Watcher) Start() error

Start method to start the watcher for the given consumers nolint:gocyclo // TODO: decompose this function

func (*Watcher) Stop 

func (w *Watcher) Stop() error

Stop method to clean up anc gracefully exit the watcher and BPF

type ZerologMarshalerArrayFunc 

type ZerologMarshalerArrayFunc func(a *zerolog.Array)

ZerologMarshalerArrayFunc function signature for marshaling an array

func (ZerologMarshalerArrayFunc) MarshalZerologArray 

func (zmaf ZerologMarshalerArrayFunc) MarshalZerologArray(a *zerolog.Array)

MarshalZerologArray method to wrap logger

type ZerologMarshalerObjectFunc 

type ZerologMarshalerObjectFunc func(e *zerolog.Event)

ZerologMarshalerObjectFunc function signature for marshaling an object

func (ZerologMarshalerObjectFunc) MarshalZerologObject 

func (zmof ZerologMarshalerObjectFunc) MarshalZerologObject(e *zerolog.Event)

MarshalZerologObject method to wrap a logger

Source Files

View all Source files

Directories

Path Synopsis
lang
access
generic
genericdiff
passwd
shadow

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.