parser

package
v0.0.10 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 10, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source
const (
	DirectionClientToServer = proxy.DirectionClientToServer
	DirectionServerToClient = proxy.DirectionServerToClient
	RiskLevelCritical       = proxy.RiskLevelCritical
	RiskLevelHigh           = proxy.RiskLevelHigh
	RiskLevelMedium         = proxy.RiskLevelMedium
	RiskLevelLow            = proxy.RiskLevelLow
	RiskLevelNone           = proxy.RiskLevelNone
)

Variables

This section is empty.

Functions

This section is empty.

Types

type ANSIFilter

type ANSIFilter struct {
	// contains filtered or unexported fields
}

ANSIFilter ANSI 转义序列过滤器

func NewANSIFilter

func NewANSIFilter() *ANSIFilter

NewANSIFilter 创建 ANSI 过滤器

func (*ANSIFilter) ContainsANSI

func (f *ANSIFilter) ContainsANSI(data []byte) bool

ContainsANSI 检测数据中是否包含 ANSI 转义序列

func (*ANSIFilter) ExtractPrintableText

func (f *ANSIFilter) ExtractPrintableText(data []byte) []byte

ExtractPrintableText 提取可打印文本(用于命令提取)

func (*ANSIFilter) Filter

func (f *ANSIFilter) Filter(data []byte) []byte

Filter 过滤 ANSI 转义序列,返回纯文本

func (*ANSIFilter) IsInteractiveCommand

func (f *ANSIFilter) IsInteractiveCommand(data []byte) bool

IsInteractiveCommand 判断是否为交互式命令(vim、top、less等)

type CommandBuffer

type CommandBuffer struct {
	// contains filtered or unexported fields
}

CommandBuffer 命令缓冲器,用于预解析和阻断

func NewCommandBuffer

func NewCommandBuffer(sessionID string, parser *SSHParser) *CommandBuffer

NewCommandBuffer 创建命令缓冲器

func (*CommandBuffer) GetBufferSize

func (cb *CommandBuffer) GetBufferSize() int

GetBufferSize 获取缓冲区大小

func (*CommandBuffer) PreProcess

func (cb *CommandBuffer) PreProcess(ctx context.Context, data []byte) (*PreProcessResult, error)

PreProcess 预处理数据,返回是否应该阻断

func (*CommandBuffer) Reset

func (cb *CommandBuffer) Reset()

Reset 重置缓冲区

func (*CommandBuffer) SetCallbacks

func (cb *CommandBuffer) SetCallbacks(
	onCommand func(*audit.OperationEvent),
	onBlock func(string),
)

SetCallbacks 设置回调函数

type DangerousPattern

type DangerousPattern struct {
	Pattern     *regexp.Regexp
	Level       RiskLevel
	Description string
}

DangerousPattern 危险命令模式

type Direction

type Direction = proxy.Direction

从 proxy 包导入公共类型

type ParseResult

type ParseResult = proxy.ParseResult

type PreProcessResult

type PreProcessResult struct {
	// ShouldBlock 是否应该阻断
	ShouldBlock bool
	// BlockReason 阻断原因
	BlockReason string
	// CleanData 清洗后的数据(可以转发)
	CleanData []byte
	// Events 解析出的事件
	Events []*audit.OperationEvent
}

PreProcessResult 预处理结果

type RiskLevel

type RiskLevel = proxy.RiskLevel

type SSHParser

type SSHParser struct {
	// contains filtered or unexported fields
}

SSHParser SSH 协议解析器

func NewSSHParser

func NewSSHParser() *SSHParser

NewSSHParser 创建 SSH 解析器

func (*SSHParser) DetectRisk

func (p *SSHParser) DetectRisk(event *audit.OperationEvent) RiskLevel

DetectRisk 检测风险等级

func (*SSHParser) Parse

func (p *SSHParser) Parse(ctx context.Context, data []byte, direction Direction, sessionID string) (*ParseResult, error)

Parse 解析 SSH 数据流

func (*SSHParser) Protocol

func (p *SSHParser) Protocol() audit.Protocol

Protocol 实现 Parser 接口

func (*SSHParser) Reset

func (p *SSHParser) Reset()

Reset 重置解析器状态(用于新会话)

func (*SSHParser) ShouldBlock

func (p *SSHParser) ShouldBlock(event *audit.OperationEvent) bool

ShouldBlock 判断是否应该拦截

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL