domain

Documentation

Index

• Constants
• type Data
• type Event
• type IP4Event
• type ReportEvent

Constants

const (
	// EventPolicyStatusPass is the pass status of the event
	EventPolicyStatusPass = "pass"

	// EventPolicyStatusBlock is the block status of the event
	EventPolicyStatusBlock = "block"
)

const (
	// EventProtocolTCP is the TCP protocol
	EventProtocolTCP = "tcp"
	EventProtocolUDP = "udp"
)

const (
	// TracerModeMonitor is the monitor mode
	TracerModeMonitor = "monitor"

	// TracerModeTrace is the trace mode
	TracerModeTrace = "trace"

	// TracerModeIndexMonitor is the index of the monitor mode
	TracerModeIndexMonitor = 0

	// TracerModeIndexTrace is the index of the trace mode
	TracerModeIndexTrace = 1
)

const EBPFCollectionMapAllow = "allow_map"

EBPFCollectionMapAllow is the allow list of the EBPF collection map

const EBPFCollectionMapIPV4ClosedEvents = "ipv4_closed_events"

EBPFCollectionMapIPV4ClosedEvents is the IPv4 closed events of the EBPF collection map

const EBPFCollectionMapIPV4Events = "ipv4_events"

EBPFCollectionMapIPV4Events is the IPv4 events of the EBPF collection map

const EBPFCollectionMapMode = "mode_map"

EBPFCollectionMapMode is the mode of the EBPF collection map

Types

type Data

type Data struct {
	// The allowed hosts from the cmd package.
	// The 'parser' package will append the host machine's DNS servers.
	AllowedHosts []string `json:"allowed_hosts"`
	// Allowed IPs.
	AllowedIPs []net.IP `json:"allowed_ip_addr"`
	// Allow GitHub Meta addresses. The address list is stored
	// with Rego policies.
	// You can find the full meta list here: https://api.github.com/meta.
	AllowGithubMeta bool `json:"allow_github_meta"`
	// Allow local IP addresses.
	AllowLocalIPRanges bool `json:"allow_local_ip_ranges"`
}

Data represents the JSON data used in Open Policy Agent (OPA). In OPA, decisions are made by comparing "policy" (Rego Code) and "data" (JSON).

type Event

type Event struct {
	TsUs  uint64   //
	Pid   uint32   // process id
	Af    uint16   // Address Family
	Task  [16]byte // task name
	Proto uint8    // Protocol name
}

Event is a common event interface

type IP4Event

type IP4Event struct {
	Event
	Daddr uint32 // Destination address
	Dport uint16 // Destination port

}

IP4Event represents a socket connect event from AF_INET(4)

type ReportEvent

type ReportEvent struct {
	ProcessID          uint32   `json:"pid"`
	TaskName           string   `json:"task_name"`
	Protocol           string   `json:"proto"`
	DestinationAddress string   `json:"daddr"`
	DestinationPort    uint16   `json:"dport"`
	Domains            []string `json:"domains"`
	Policy             string   `json:"policy"`
}

ReportEvent represents a report event