Documentation
¶
Index ¶
- Constants
- Variables
- func GetAliasByIP(ip string) string
- func LoadAliases(filename string) error
- type Action
- type Duration
- type Loader
- func (l *Loader) Add(rule *Rule, saveToDisk bool) error
- func (l *Loader) Delete(ruleName string) error
- func (l *Loader) EnableChecksums(enable bool)
- func (l *Loader) FindFirstMatch(con *conman.Connection) (match *Rule)
- func (l *Loader) GetAll() map[string]*Rule
- func (l *Loader) HasChecksums(op Operand)
- func (l *Loader) Load(path string) error
- func (l *Loader) NumRules() int
- func (l *Loader) Reload(path string) error
- func (l *Loader) Replace(rule *Rule, saveToDisk bool) error
- func (l *Loader) Save(rule *Rule, path string) error
- type Operand
- type Operator
- type Rule
- type Sensitive
- type Type
Constants ¶
const ( Simple = Type("simple") Regexp = Type("regexp") Complex = Type("complex") // for future use List = Type("list") Network = Type("network") Lists = Type("lists") )
Available types
const ( OpTrue = Operand("true") OpProcessID = Operand("process.id") OpProcessPath = Operand("process.path") OpProcessParentPath = Operand("process.parent.path") OpProcessCmd = Operand("process.command") OpProcessEnvPrefix = Operand("process.env.") OpProcessEnvPrefixLen = 12 OpProcessHashMD5 = Operand("process.hash.md5") OpProcessHashSHA1 = Operand("process.hash.sha1") OpUserID = Operand("user.id") OpUserName = Operand("user.name") OpSrcIP = Operand("source.ip") OpSrcPort = Operand("source.port") OpDstIP = Operand("dest.ip") OpDstHost = Operand("dest.host") OpDstPort = Operand("dest.port") OpDstNetwork = Operand("dest.network") OpSrcNetwork = Operand("source.network") OpProto = Operand("protocol") OpIfaceIn = Operand("iface.in") OpIfaceOut = Operand("iface.out") OpList = Operand("list") OpDomainsLists = Operand("lists.domains") OpDomainsRegexpLists = Operand("lists.domains_regexp") OpIPLists = Operand("lists.ips") OpNetLists = Operand("lists.nets") OpHashMD5Lists = Operand("lists.hash.md5") )
Available operands
const ( Allow = Action("allow") Deny = Action("deny") Reject = Action("reject") )
Actions of rules
const ( Once = Duration("once") Restart = Duration("until restart") Always = Duration("always") )
daemon possible durations
const (
DefaultPath = "/etc/opensnitchd/rules"
)
DefaultPath directory
Variables ¶
var AliasIPCache = make(map[string][]*net.IPNet)
var NetworkAliases = make(map[string][]string)
Functions ¶
func GetAliasByIP ¶
func LoadAliases ¶
Types ¶
type Loader ¶
Loader is the object that holds the rules loaded from disk, as well as the rules watcher.
func NewLoader ¶
NewLoader loads rules from disk, and watches for changes made to the rules files on disk.
func (*Loader) Delete ¶
Delete deletes a rule from the list by name. If the duration is Always (i.e: saved on disk), it'll attempt to delete it from disk.
func (*Loader) EnableChecksums ¶
EnableChecksums enables checksums field for rules globally.
func (*Loader) FindFirstMatch ¶
func (l *Loader) FindFirstMatch(con *conman.Connection) (match *Rule)
FindFirstMatch will try match the connection against the existing rule set.
func (*Loader) HasChecksums ¶
HasChecksums checks if the rule will check for binary checksum matches
func (*Loader) Reload ¶
Reload loads rules from the specified path, deleting existing loaded rules from memory.
type Operator ¶
type Operator struct {
Operand Operand `json:"operand"`
Data string `json:"data"`
Type Type `json:"type"`
List []Operator `json:"list"`
Sensitive Sensitive `json:"sensitive"`
sync.RWMutex
// contains filtered or unexported fields
}
Operator represents what we want to filter of a connection, and how.
func NewOperator ¶
NewOperator returns a new operator object
func (*Operator) ClearLists ¶
func (o *Operator) ClearLists()
ClearLists deletes all the entries of a list
func (*Operator) Match ¶
func (o *Operator) Match(con *conman.Connection, hasChecksums bool) bool
Match tries to match parts of a connection with the given operator.
func (*Operator) SerializeData ¶
func (*Operator) StopMonitoringLists ¶
func (o *Operator) StopMonitoringLists()
StopMonitoringLists stops the monitoring lists goroutine.
type Rule ¶
type Rule struct {
// Save date fields as string, to avoid issues marshalling Time (#1140).
Created string `json:"created"`
Updated string `json:"updated"`
Name string `json:"name"`
Description string `json:"description"`
Action Action `json:"action"`
Duration Duration `json:"duration"`
Operator Operator `json:"operator"`
Enabled bool `json:"enabled"`
Precedence bool `json:"precedence"`
Nolog bool `json:"nolog"`
}
Rule represents an action on a connection. The fields match the ones saved as json to disk. If a .json rule file is modified on disk, it's reloaded automatically.
func Create ¶
func Create(name, description string, enabled, precedence, nolog bool, action Action, duration Duration, op *Operator) *Rule
Create creates a new rule object with the specified parameters.
func Deserialize ¶
Deserialize translates back the rule received to a Rule object
func (*Rule) Match ¶
func (r *Rule) Match(con *conman.Connection, hasChecksums bool) bool
Match performs on a connection the checks a Rule has, to determine if it must be allowed or denied.
Source Files