process

Documentation

Overview

Package process fetches process and socket information from the operating system. It can find the process owning a network connection.

Index

• Variables
• func CleanProcessStorage(thresholdDuration time.Duration)
• func GetActiveConnectionIDs() []string
• func GetPidByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, ...) (pid int, direction bool, err error)
• func GetPidByPacket(pkt packet.Packet) (pid int, direction bool, err error)
• func SetDBController(controller *database.Controller)
• type Process
  • func All() []*Process
  • func GetOrFindProcess(pid int) (*Process, error)
  • func GetProcessByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, ...) (process *Process, err error)
  • func GetProcessByPacket(pkt packet.Packet) (process *Process, direction bool, err error)
  • func GetProcessFromStorage(pid int) (*Process, bool)
  • func (p *Process) AddCommunication()
  • func (p *Process) Delete()
  • func (p *Process) FindProfiles() error
  • func (p *Process) GetExecHash(algorithm string) (string, error)
  • func (m *Process) IsAdmin() bool
  • func (m *Process) IsKernel() bool
  • func (m *Process) IsSystem() bool
  • func (m *Process) IsUser() bool
  • func (p *Process) ProfileSet() *profile.Set
  • func (p *Process) RemoveCommunication()
  • func (p *Process) Save()
  • func (p *Process) String() string

Variables

var (
	ErrConnectionNotFound = errors.New("could not find connection in system state tables")
	ErrProcessNotFound    = errors.New("could not find process in system state tables")
)

Errors

var (
	// UnknownProcess is used when a process cannot be found.
	UnknownProcess = &Process{
		UserID:    -1,
		UserName:  "Unknown",
		Pid:       -1,
		ParentPid: -1,
		Name:      "Unknown Processes",
	}
)

Functions

func CleanProcessStorage

func CleanProcessStorage(thresholdDuration time.Duration)

CleanProcessStorage cleans the storage from old processes.

func GetActiveConnectionIDs

func GetActiveConnectionIDs() []string

GetActiveConnectionIDs returns a list of all active connection IDs.

func GetPidByEndpoints

func GetPidByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, protocol packet.IPProtocol) (pid int, direction bool, err error)

GetPidByEndpoints returns the pid of the owner of the described link.

func GetPidByPacket

func GetPidByPacket(pkt packet.Packet) (pid int, direction bool, err error)

GetPidByPacket returns the pid of the owner of the packet.

func SetDBController

func SetDBController(controller *database.Controller)

SetDBController sets the database controller and allows the package to push database updates on a save. It must be set by the package that registers the "network" database.

Types

type Process

type Process struct {
	record.Base
	sync.Mutex

	UserID    int
	UserName  string
	UserHome  string
	Pid       int
	ParentPid int
	Path      string
	Cwd       string
	CmdLine   string
	FirstArg  string

	ExecName   string
	ExecHashes map[string]string

	UserProfileKey string

	Name string
	Icon string

	FirstCommEstablished int64
	LastCommEstablished  int64
	CommCount            uint
	// contains filtered or unexported fields
}

A Process represents a process running on the operating system

func All

func All() []*Process

All returns a copy of all process objects.

func GetOrFindProcess

func GetOrFindProcess(pid int) (*Process, error)

GetOrFindProcess returns the process for the given PID.

func GetProcessByEndpoints

func GetProcessByEndpoints(localIP net.IP, localPort uint16, remoteIP net.IP, remotePort uint16, protocol packet.IPProtocol) (process *Process, err error)

GetProcessByEndpoints returns the process that owns the described link.

func GetProcessByPacket

func GetProcessByPacket(pkt packet.Packet) (process *Process, direction bool, err error)

GetProcessByPacket returns the process that owns the given packet.

func GetProcessFromStorage

func GetProcessFromStorage(pid int) (*Process, bool)

GetProcessFromStorage returns a process from the internal storage.

func (*Process) AddCommunication

func (p *Process) AddCommunication()

AddCommunication increases the connection counter and the last connection timestamp.

func (*Process) Delete

func (p *Process) Delete()

Delete deletes a process from the storage and propagates the change.

func (*Process) FindProfiles

func (p *Process) FindProfiles() error

FindProfiles finds and assigns a profile set to the process.

func (*Process) GetExecHash

func (p *Process) GetExecHash(algorithm string) (string, error)

GetExecHash returns the hash of the executable with the given algorithm.

func (*Process) IsAdmin

func (m *Process) IsAdmin() bool

IsAdmin returns whether the process is run by an admin user.

func (*Process) IsKernel

func (m *Process) IsKernel() bool

IsKernel returns whether the process is the Kernel.

func (*Process) IsSystem

func (m *Process) IsSystem() bool

IsSystem returns whether the process is run by the operating system.

func (*Process) IsUser

func (m *Process) IsUser() bool

IsUser returns whether the process is run by a normal user.

func (*Process) ProfileSet

func (p *Process) ProfileSet() *profile.Set

ProfileSet returns the assigned profile set.

func (*Process) RemoveCommunication

func (p *Process) RemoveCommunication()

RemoveCommunication lowers the connection counter by one.

func (*Process) Save

func (p *Process) Save()

Save saves the process to the internal state and pushes an update.

func (*Process) String

func (p *Process) String() string

Strings returns a string represenation of process.