go-agent: github.com/sqreen/go-agent/agent/internal/rule Index | Files | Directories

package rule

import "github.com/sqreen/go-agent/agent/internal/rule"

This package manages the rules by instantiating the callbacks and attaching them to their corresponding hooks.

Package rule implements the engine to manage rules.

Main requirements: - Rules can be globally enabled or disabled, independently from setting

the list of rules.

- Rule hookpoints can be undefined, ie. the backend sent more rules than

actually required.

- Errors regarding hookpoint or callbacks should be handled. - Setting new rules when already enabled and having active rules should be

atomic at the hook level. For example, having a new SQLi rule should not
introduce a time when it is disabled, but should instead be replaced with
the new one atomically.


Package Files

callback.go doc.go instrumentation.go rule.go signature.go

func NewCallback Uses

func NewCallback(name string, rule *CallbackContext, nextProlog sqhook.PrologCallback) (cb interface{}, err error)

NewCallback returns the callback object or function for the given callback name. An error is returned if the callback name is unknown or an error occurred during the constructor call.

func NewECDSAPublicKey Uses

func NewECDSAPublicKey(PEMPublicKey string) (*ecdsa.PublicKey, error)

NewECDSAPublicKey creates a ECDSA public key from a PEM public key.

func Verify Uses

func Verify(publicKey *ecdsa.PublicKey, hash []byte, signature []byte) error

Verify returns a non-nil error when message verification against the public key failed, nil otherwise.

func VerifyRuleSignature Uses

func VerifyRuleSignature(r *api.Rule, publicKey *ecdsa.PublicKey) error

VerifyRuleSignature returns a non-nil error when the rule signature is invalid, nil otherwise.

type CallbackContext Uses

type CallbackContext struct {
    // contains filtered or unexported fields

func NewCallbackContext Uses

func NewCallbackContext(r *api.Rule, logger Logger, metricsEngine *metrics.Engine, errorMetricsStore *metrics.Store) *CallbackContext

func (*CallbackContext) BlockingMode Uses

func (c *CallbackContext) BlockingMode() bool

func (*CallbackContext) Config Uses

func (d *CallbackContext) Config() interface{}

func (*CallbackContext) NewAttack Uses

func (ctx *CallbackContext) NewAttack(blocked bool, info interface{}) *record.AttackEvent

NewAttack creates a new attack based on the rule context and the given argument.

func (*CallbackContext) PushMetricsValue Uses

func (d *CallbackContext) PushMetricsValue(key interface{}, value uint64)

type CallbackObject Uses

type CallbackObject interface {
    Prolog() sqhook.PrologCallback

CallbackObject can be used by callbacks needing to return an object instead of a function that will be closed when removed from its hookpoint. For example, it allows to release memory out of the garbage collector' scope.

type CallbacksConstructorFunc Uses

type CallbacksConstructorFunc func(rule callback.Context, nextProlog sqhook.PrologCallback) (callbackCtor interface{}, err error)

CallbackConstructorFunc is a function returning a callback function or a CallbackObject configured with the given data.

type Engine Uses

type Engine struct {
    // contains filtered or unexported fields

func NewEngine Uses

func NewEngine(logger Logger, instrumentationEngine InstrumentationFace, metricsEngine *metrics.Engine, errorMetricsStore *metrics.Store, publicKey *ecdsa.PublicKey) *Engine

NewEngine returns a new rule engine.

func (*Engine) Disable Uses

func (e *Engine) Disable()

Disable the hooks currently attached to callbacks.

func (*Engine) Enable Uses

func (e *Engine) Enable()

Enable the hooks of the ongoing configured rules.

func (*Engine) PackID Uses

func (e *Engine) PackID() string

PackID returns the ID of the current pack of rules.

func (*Engine) SetRules Uses

func (e *Engine) SetRules(packID string, rules []api.Rule)

SetRules set the currents rules. If rules were already set, it will replace them by atomically modifying the hooks, and removing what is left.

type HookFace Uses

type HookFace interface {
    Attach(prolog sqhook.PrologCallback) error

type InstrumentationFace Uses

type InstrumentationFace interface {
    Find(symbol string) (HookFace, error)

type Logger Uses

type Logger interface {

Logger interface required by this package.



Package rule imports 20 packages (graph) and is imported by 1 packages. Updated 2020-02-17. Refresh now. Tools for package owners.