Documentation
¶
Index ¶
- Constants
- type Scanner
- func (s *Scanner) AddSignature(sig *detection.Signature) error
- func (s *Scanner) AddSignatures(sigs []detection.Signature) error
- func (s *Scanner) Close() error
- func (s *Scanner) CountSignatures() (int, error)
- func (s *Scanner) GetDatabase() *detection.SignatureDatabase
- func (s *Scanner) GetSignature(id string) (*detection.Signature, error)
- func (s *Scanner) LoadDatabase(path string) error
- func (s *Scanner) SaveDatabase(path string) error
- func (s *Scanner) ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
- func (s *Scanner) ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
- func (s *Scanner) SetMatchThreshold(threshold float64) error
- func (s *Scanner) SetThreshold(threshold float64) error
Constants ¶
const ( // MaxDBSizeBytes bounds how much of a database file LoadDatabase reads, // so an oversized or padded file cannot exhaust memory. MaxDBSizeBytes = 64 * 1024 * 1024 // SecureFilePerms is the mode SaveDatabase writes the database with: // owner read and write only. SecureFilePerms = 0600 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Scanner ¶
type Scanner struct {
// contains filtered or unexported fields
}
Scanner is a signature store held in memory and persisted as one JSON file. Scans take a read lock; loads and additions take the write lock.
func NewScanner ¶
func NewScanner() *Scanner
NewScanner returns an empty store with the default match threshold (0.75) and entropy tolerance (0.5).
func (*Scanner) AddSignature ¶
AddSignature appends a copy of sig, first giving sig an ID if it has none.
func (*Scanner) AddSignatures ¶
AddSignatures appends copies of sigs under one lock, first giving each signature without an ID one, in place.
func (*Scanner) CountSignatures ¶
CountSignatures returns the number of signatures in the store.
func (*Scanner) GetDatabase ¶
func (s *Scanner) GetDatabase() *detection.SignatureDatabase
GetDatabase returns a copy of the database that shares nothing with the store.
func (*Scanner) GetSignature ¶
GetSignature returns a copy of the signature with the given ID.
func (*Scanner) LoadDatabase ¶
LoadDatabase replaces the store's contents with the database at path. The file must be a regular file (a FIFO or device could block the read) and may contain no fields the database format does not define.
func (*Scanner) SaveDatabase ¶
SaveDatabase writes the database to path atomically: it encodes into a temporary file in the same directory with SecureFilePerms, syncs it, and renames it over path, so a crash never leaves a truncated database.
func (*Scanner) ScanTopology ¶
func (s *Scanner) ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
ScanTopology checks topo against every signature and returns the matches at or above the threshold, most confident first.
func (*Scanner) ScanTopologyExact ¶
func (s *Scanner) ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
ScanTopologyExact returns the first signature topo matches with a confidence of at least 0.99, or nil. It ignores the scanner's entropy tolerance and passes no fallback (0), so only a signature's own tolerance admits an entropy difference; a signature that sets none can never match: at equal entropy its entropy score is 0/0 (NaN), and otherwise 0.5, which keeps confidence below 0.99.
func (*Scanner) SetMatchThreshold ¶ added in v7.5.0
SetMatchThreshold is SetThreshold, under the name PebbleScanner uses.
func (*Scanner) SetThreshold ¶
SetThreshold sets the minimum confidence ScanTopology reports. NaN, an infinity, or a value outside [0, 1] is refused: NaN in particular would fail every comparison and silently suppress all alerts.
Source Files