audit

Documentation

Index

• Variables
• func AddMapping(t reflect.Type, mapper func(msg *auditv1.EventEntity) Details)
• func EmittingHandler(emitter Emitter, app auditv1.AppProtocol, delegate http.Handler) http.Handler
• func LocalAddr(ctx context.Context) net.Addr
• func RemoteAddr(ctx context.Context) net.Addr
• func StoreConnPropertiesInContext(ctx context.Context, c net.Conn) context.Context
• func TLSConnectionState(ctx context.Context) (tls.ConnectionState, bool)
• func TLSVersionToEntity(version uint16) auditv1.TLSVersion
• type DHCP
  • func (d DHCP) AddToMsg(msg *auditv1.EventEntity)
• type DNS
  • func (d DNS) AddToMsg(msg *auditv1.EventEntity)
• type DNSQuestion
• type Details
• type Emitter
• type EmitterFunc
  • func (ef EmitterFunc) Emit(ev Event)
• type Event
  • func NewEventFromProto(msg *auditv1.EventEntity) (ev Event)
  • func (e *Event) ApplyDefaults(id int64)
  • func (e *Event) ProtoMessage() *auditv1.EventEntity
  • func (e *Event) SetDestinationIPFromAddr(localAddr net.Addr) error
  • func (e *Event) SetSourceIPFromAddr(remoteAddr net.Addr) error
• type EventReaderOption
• type EventStream
  • func MustNewEventStream(logger logging.Logger, options ...EventStreamOption) EventStream
  • func NewEventStream(logger logging.Logger, options ...EventStreamOption) (EventStream, error)
• type EventStreamOption
• type EventWriterOption
• type HTTP
  • func (d *HTTP) AddToMsg(msg *auditv1.EventEntity)
• type Reader
  • func NewEventReader(source io.Reader, opts ...EventReaderOption) Reader
• type Sink
• type TLSDetails
  • func NewTLSDetailsFromProto(entity *auditv1.TLSDetailsEntity) *TLSDetails
  • func (d TLSDetails) ProtoMessage() *auditv1.TLSDetailsEntity
• type Writer
  • func NewEventWriter(target io.Writer, opts ...EventWriterOption) Writer

Variables

var (
	WithBufferSize = func(bufferSize int) EventStreamOption {
		return func(cfg *eventStreamCfg) {
			cfg.bufferSize = bufferSize
		}
	}
	WithGeneratorIndex = func(generatorIndex int64) EventStreamOption {
		return func(cfg *eventStreamCfg) {
			cfg.generatorIndex = generatorIndex
		}
	}
	WithSinkBufferSize = func(bufferSize int) EventStreamOption {
		return func(cfg *eventStreamCfg) {
			cfg.sinkBuffersize = bufferSize
		}
	}
	WithSinkConsumptionTimeout = func(timeout time.Duration) EventStreamOption {
		return func(cfg *eventStreamCfg) {
			cfg.sinkConsumptionTimeout = timeout
		}
	}
	WithDistributeParallelization = func(parallelization int) EventStreamOption {
		return func(cfg *eventStreamCfg) {
			if parallelization <= 0 || parallelization > runtime.NumCPU() {
				return
			}
			cfg.distributeParallelization = parallelization
		}
	}
)

var ErrSinkAlreadyRegistered = errors.New("sink with same name already registered")

var ErrValueMostNotBeNil = errors.New("event value must not be nil")

Functions

func AddMapping

func AddMapping(t reflect.Type, mapper func(msg *auditv1.EventEntity) Details)

func EmittingHandler

func EmittingHandler(emitter Emitter, app auditv1.AppProtocol, delegate http.Handler) http.Handler

func LocalAddr

func LocalAddr(ctx context.Context) net.Addr

func RemoteAddr

func RemoteAddr(ctx context.Context) net.Addr

func StoreConnPropertiesInContext

func StoreConnPropertiesInContext(ctx context.Context, c net.Conn) context.Context

func TLSConnectionState

func TLSConnectionState(ctx context.Context) (tls.ConnectionState, bool)

func TLSVersionToEntity

func TLSVersionToEntity(version uint16) auditv1.TLSVersion

Types

type DHCP

type DHCP struct {
	HopCount uint8
	OpCode   auditv1.DHCPOpCode
	HWType   auditv1.DHCPHwType
}

func (DHCP) AddToMsg

func (d DHCP) AddToMsg(msg *auditv1.EventEntity)

type DNS

type DNS struct {
	OPCode    auditv1.DNSOpCode
	Questions []DNSQuestion
}

func (DNS) AddToMsg

func (d DNS) AddToMsg(msg *auditv1.EventEntity)

type DNSQuestion

type DNSQuestion struct {
	RRType auditv1.ResourceRecordType
	Name   string
}

type Details

type Details interface {
	AddToMsg(msg *auditv1.EventEntity)
}

type Emitter

type Emitter interface {
	Emit(ev Event)
}

type EmitterFunc

type EmitterFunc func(ev Event)

func (EmitterFunc) Emit

func (ef EmitterFunc) Emit(ev Event)

type Event

type Event struct {
	ID              int64
	Timestamp       time.Time
	Transport       auditv1.TransportProtocol
	Application     auditv1.AppProtocol
	SourceIP        net.IP
	DestinationIP   net.IP
	SourcePort      uint16
	DestinationPort uint16
	ProtocolDetails Details
	TLS             *TLSDetails
}

func NewEventFromProto

func NewEventFromProto(msg *auditv1.EventEntity) (ev Event)

func (*Event) ApplyDefaults

func (e *Event) ApplyDefaults(id int64)

func (*Event) ProtoMessage

func (e *Event) ProtoMessage() *auditv1.EventEntity

func (*Event) SetDestinationIPFromAddr

func (e *Event) SetDestinationIPFromAddr(localAddr net.Addr) error

func (*Event) SetSourceIPFromAddr

func (e *Event) SetSourceIPFromAddr(remoteAddr net.Addr) error

type EventReaderOption

type EventReaderOption func(reader *eventReader)

type EventStream

type EventStream interface {
	io.Closer
	Emitter
	RegisterSink(ctx context.Context, s Sink) error
	Sinks() []string
	RemoveSink(name string) (exists bool)
}

func MustNewEventStream

func MustNewEventStream(logger logging.Logger, options ...EventStreamOption) EventStream

func NewEventStream

func NewEventStream(logger logging.Logger, options ...EventStreamOption) (EventStream, error)

type EventStreamOption

type EventStreamOption func(cfg *eventStreamCfg)

type EventWriterOption

type EventWriterOption func(writer *eventWriter)

type HTTP

type HTTP struct {
	Method  string
	Host    string
	URI     string
	Proto   string
	Headers http.Header
}

func (*HTTP) AddToMsg

func (d *HTTP) AddToMsg(msg *auditv1.EventEntity)

type Reader

type Reader interface {
	Read() (Event, error)
}

func NewEventReader

func NewEventReader(source io.Reader, opts ...EventReaderOption) Reader

type Sink

type Sink interface {
	Name() string
	OnSubscribe(evs <-chan Event)
}

type TLSDetails

type TLSDetails struct {
	Version     string
	CipherSuite string
	ServerName  string
}

func NewTLSDetailsFromProto

func NewTLSDetailsFromProto(entity *auditv1.TLSDetailsEntity) *TLSDetails

func (TLSDetails) ProtoMessage

func (d TLSDetails) ProtoMessage() *auditv1.TLSDetailsEntity

type Writer

type Writer interface {
	io.Closer
	Write(ev *Event) error
}

func NewEventWriter

func NewEventWriter(target io.Writer, opts ...EventWriterOption) Writer