Documentation
¶
Index ¶
- Constants
- type ANSIFilter
- type CommandBuffer
- type DangerousPattern
- type Direction
- type ParseResult
- type PreProcessResult
- type RiskLevel
- type SSHParser
- func (p *SSHParser) DetectRisk(event *audit.OperationEvent) RiskLevel
- func (p *SSHParser) Parse(ctx context.Context, data []byte, direction Direction, sessionID string) (*ParseResult, error)
- func (p *SSHParser) Protocol() audit.Protocol
- func (p *SSHParser) Reset()
- func (p *SSHParser) ShouldBlock(event *audit.OperationEvent) bool
Constants ¶
View Source
const ( DirectionClientToServer = proxy.DirectionClientToServer DirectionServerToClient = proxy.DirectionServerToClient RiskLevelCritical = proxy.RiskLevelCritical RiskLevelHigh = proxy.RiskLevelHigh RiskLevelMedium = proxy.RiskLevelMedium RiskLevelLow = proxy.RiskLevelLow RiskLevelNone = proxy.RiskLevelNone )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ANSIFilter ¶
type ANSIFilter struct {
// contains filtered or unexported fields
}
ANSIFilter ANSI 转义序列过滤器
func (*ANSIFilter) ContainsANSI ¶
func (f *ANSIFilter) ContainsANSI(data []byte) bool
ContainsANSI 检测数据中是否包含 ANSI 转义序列
func (*ANSIFilter) ExtractPrintableText ¶
func (f *ANSIFilter) ExtractPrintableText(data []byte) []byte
ExtractPrintableText 提取可打印文本(用于命令提取)
func (*ANSIFilter) Filter ¶
func (f *ANSIFilter) Filter(data []byte) []byte
Filter 过滤 ANSI 转义序列,返回纯文本
func (*ANSIFilter) IsInteractiveCommand ¶
func (f *ANSIFilter) IsInteractiveCommand(data []byte) bool
IsInteractiveCommand 判断是否为交互式命令(vim、top、less等)
type CommandBuffer ¶
type CommandBuffer struct {
// contains filtered or unexported fields
}
CommandBuffer 命令缓冲器,用于预解析和阻断
func NewCommandBuffer ¶
func NewCommandBuffer(sessionID string, parser *SSHParser) *CommandBuffer
NewCommandBuffer 创建命令缓冲器
func (*CommandBuffer) GetBufferSize ¶
func (cb *CommandBuffer) GetBufferSize() int
GetBufferSize 获取缓冲区大小
func (*CommandBuffer) PreProcess ¶
func (cb *CommandBuffer) PreProcess(ctx context.Context, data []byte) (*PreProcessResult, error)
PreProcess 预处理数据,返回是否应该阻断
func (*CommandBuffer) SetCallbacks ¶
func (cb *CommandBuffer) SetCallbacks( onCommand func(*audit.OperationEvent), onBlock func(string), )
SetCallbacks 设置回调函数
type DangerousPattern ¶
DangerousPattern 危险命令模式
type ParseResult ¶
type ParseResult = proxy.ParseResult
type PreProcessResult ¶
type PreProcessResult struct {
// ShouldBlock 是否应该阻断
ShouldBlock bool
// BlockReason 阻断原因
BlockReason string
// CleanData 清洗后的数据(可以转发)
CleanData []byte
// Events 解析出的事件
Events []*audit.OperationEvent
}
PreProcessResult 预处理结果
type SSHParser ¶
type SSHParser struct {
// contains filtered or unexported fields
}
SSHParser SSH 协议解析器
func (*SSHParser) DetectRisk ¶
func (p *SSHParser) DetectRisk(event *audit.OperationEvent) RiskLevel
DetectRisk 检测风险等级
func (*SSHParser) Parse ¶
func (p *SSHParser) Parse(ctx context.Context, data []byte, direction Direction, sessionID string) (*ParseResult, error)
Parse 解析 SSH 数据流
func (*SSHParser) ShouldBlock ¶
func (p *SSHParser) ShouldBlock(event *audit.OperationEvent) bool
ShouldBlock 判断是否应该拦截
Click to show internal directories.
Click to hide internal directories.