Documentation
¶
Index ¶
- Constants
- func NewActivityWriter(store activityStore, batchSize int, timeout time.Duration, bufferSize int) *activityWriter
- func NewBatchWriter(batchSize int, timeout time.Duration, bufferSize int, repo nodes.NodeManager) *batchWriter
- func NewOsctrldBehindCollector(m *osqueryversions.Manager, envs *environments.EnvManager) prometheus.Collector
- func NewOsctrldDownCollector(flags *nodeconfig.FlagsManager, envs *environments.EnvManager) prometheus.Collector
- func NewOsctrldRolloutPausedCollector(m *osqueryversions.Manager, envs *environments.EnvManager) prometheus.Collector
- func NewResponseWriter(w http.ResponseWriter) *responseWriter
- func RegisterMetrics(reg prometheus.Registerer)
- func SetDBDegraded(degraded bool)
- type HandlersTLS
- func (h *HandlersTLS) CarveBlockHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) CarveInitHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) CertHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ConfigHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) EnrollHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) EnrollPackageHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ErrorHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ExtensionDownloadHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ExtensionsHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) FlagsHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) HealthHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) LogHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) OsctrldMiddleware(download bool, next http.Handler) http.Handler
- func (h *HandlersTLS) OsqueryConfigEndpointHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) OsqueryHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ProcessCarveBlock(req types.CarveBlockRequest, environment, uuid string, envid uint)
- func (h *HandlersTLS) ProcessCarveInit(req types.CarveInitRequest, sessionid, environment string) error
- func (h *HandlersTLS) ProcessCarveWrite(req types.QueryCarveScheduled, queryName, nodeKey, environment string) error
- func (h *HandlersTLS) PrometheusMiddleware(next http.Handler) http.Handler
- func (h *HandlersTLS) QueryReadHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) QueryWriteHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) QuickEnrollHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) QuickRemoveHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) RootHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) ScriptHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) StatusHandler(w http.ResponseWriter, r *http.Request)
- func (h *HandlersTLS) VerifyHandler(w http.ResponseWriter, r *http.Request)
- type Option
- func WithActivityWriter(activityWriter *activityWriter) Option
- func WithAuditLog(al *auditlog.AuditLogManager) Option
- func WithCarves(carves *carves.Carves) Option
- func WithConfigEndpoints(endpoints *config.YAMLConfigurationEndpoints) Option
- func WithDBHealth(hl backend.DegradedReader) Option
- func WithDebugHTTP(cfg *config.YAMLConfigurationDebug) Option
- func WithEnvCache(ec *environments.EnvCache) Option
- func WithEnvs(envs *environments.EnvManager) Option
- func WithExtensions(m *extensions.Manager) Option
- func WithFlagsOverrides(m *nodeconfig.FlagsManager) Option
- func WithLogs(logs *logging.LoggerTLS) Option
- func WithNodeConfig(m *nodeconfig.Manager) Option
- func WithNodes(nodes *nodes.NodeManager) Option
- func WithOsctrldLimits(l *OsctrldLimits) Option
- func WithOsqueryValues(values *config.YAMLConfigurationOsquery) Option
- func WithOsqueryVersions(m *osqueryversions.Manager) Option
- func WithPosture(pm *posture.PostureManager) Option
- func WithQueries(queries *queries.Queries) Option
- func WithSessionHints(hints *cache.SessionHints) Option
- func WithSettings(settings *settings.Settings) Option
- func WithSettingsCache(settingsCache *settings.RedisSettingsCache) Option
- func WithTags(tags *tags.TagManager) Option
- func WithVulns(inv *vulns.Inventory) Option
- func WithWriteHandler(writeHandler *batchWriter) Option
- type OsctrldLimits
- type TLSResponse
Constants ¶
const ( RequestPath = "path" RequestMethod = "method" StatusCode = "status_code" Environment = "osctrl_env" RequestType = "type" LogType = "log_type" )
Variables ¶
This section is empty.
Functions ¶
func NewActivityWriter ¶ added in v0.5.4
func NewBatchWriter ¶ added in v0.4.4
func NewBatchWriter(batchSize int, timeout time.Duration, bufferSize int, repo nodes.NodeManager) *batchWriter
NewBatchWriter creates and starts a new batch writer.
func NewOsctrldBehindCollector ¶ added in v0.6.1
func NewOsctrldBehindCollector(m *osqueryversions.Manager, envs *environments.EnvManager) prometheus.Collector
NewOsctrldBehindCollector returns the collector for osctrld_osquery_behind.
func NewOsctrldDownCollector ¶ added in v0.6.1
func NewOsctrldDownCollector(flags *nodeconfig.FlagsManager, envs *environments.EnvManager) prometheus.Collector
NewOsctrldDownCollector returns the collector for osctrld_osquery_down.
func NewOsctrldRolloutPausedCollector ¶ added in v0.6.1
func NewOsctrldRolloutPausedCollector(m *osqueryversions.Manager, envs *environments.EnvManager) prometheus.Collector
NewOsctrldRolloutPausedCollector returns the collector for osctrld_osquery_rollout_paused.
func NewResponseWriter ¶
func NewResponseWriter(w http.ResponseWriter) *responseWriter
func RegisterMetrics ¶
func RegisterMetrics(reg prometheus.Registerer)
func SetDBDegraded ¶ added in v0.5.5
func SetDBDegraded(degraded bool)
SetDBDegraded updates the db_degraded gauge. Called by the DB health monitor via its OnChange callback. Safe to call even when metrics are not registered (the gauge is a no-op until RegisterMetrics runs).
Types ¶
type HandlersTLS ¶
type HandlersTLS struct {
Envs *environments.EnvManager
EnvCache *environments.EnvCache
Nodes *nodes.NodeManager
Tags *tags.TagManager
Queries *queries.Queries
Carves *carves.Carves
Settings *settings.Settings
SettingsCache *settings.RedisSettingsCache
SessionHints *cache.SessionHints
Logs *logging.LoggerTLS
WriteHandler *batchWriter
ActivityWriter *activityWriter
Posture *posture.PostureManager
Vulns *vulns.Inventory // nil when --vuln-enabled is off: osctrl:vuln: results are discarded
OsqueryValues *config.YAMLConfigurationOsquery
ConfigEndpoints *config.YAMLConfigurationEndpoints
DebugHTTP *zerolog.Logger
DebugHTTPConfig *config.YAMLConfigurationDebug
AuditLog *auditlog.AuditLogManager
NodeConfig *nodeconfig.Manager // nil: per-node config overrides are inert
FlagsOverrides *nodeconfig.FlagsManager // nil: per-node flags overrides are inert
Extensions *extensions.Manager // nil: osctrld extension routes are not registered
OsqueryVersions *osqueryversions.Manager // nil: the osctrld osquery version route is not registered
OsctrldLimits *OsctrldLimits // nil: osctrld routes are not rate-limited
// DBHealth, when wired via WithDBHealth, lets HealthHandler
// report backend degradation. nil means "no monitor" and the
// health endpoint reports healthy as before.
DBHealth backend.DegradedReader
}
HandlersTLS to keep all handlers for TLS
func CreateHandlersTLS ¶
func CreateHandlersTLS(opts ...Option) *HandlersTLS
CreateHandlersTLS to initialize the TLS handlers struct
func (*HandlersTLS) CarveBlockHandler ¶
func (h *HandlersTLS) CarveBlockHandler(w http.ResponseWriter, r *http.Request)
CarveBlockHandler - Function to handle the blocks of the file carver
func (*HandlersTLS) CarveInitHandler ¶
func (h *HandlersTLS) CarveInitHandler(w http.ResponseWriter, r *http.Request)
CarveInitHandler - Function to handle the initialization of the file carver This function does not use go routines to handle requests because the session_id returned must be already created in the DB, otherwise block requests will fail.
func (*HandlersTLS) CertHandler ¶
func (h *HandlersTLS) CertHandler(w http.ResponseWriter, r *http.Request)
CertHandler - Function to retrieve certificate for osquery nodes, from osctrld
func (*HandlersTLS) ConfigHandler ¶
func (h *HandlersTLS) ConfigHandler(w http.ResponseWriter, r *http.Request)
ConfigHandler - Function to handle the configuration requests from osquery nodes
func (*HandlersTLS) EnrollHandler ¶
func (h *HandlersTLS) EnrollHandler(w http.ResponseWriter, r *http.Request)
EnrollHandler - Function to handle the enroll requests from osquery nodes
func (*HandlersTLS) EnrollPackageHandler ¶
func (h *HandlersTLS) EnrollPackageHandler(w http.ResponseWriter, r *http.Request)
EnrollPackageHandler - Function to handle the endpoint for quick enrollment package download
func (*HandlersTLS) ErrorHandler ¶
func (h *HandlersTLS) ErrorHandler(w http.ResponseWriter, r *http.Request)
ErrorHandler for error requests
func (*HandlersTLS) ExtensionDownloadHandler ¶ added in v0.6.1
func (h *HandlersTLS) ExtensionDownloadHandler(w http.ResponseWriter, r *http.Request)
ExtensionDownloadHandler streams one extension binary assigned in the environment, chunk by chunk.
func (*HandlersTLS) ExtensionsHandler ¶ added in v0.6.1
func (h *HandlersTLS) ExtensionsHandler(w http.ResponseWriter, r *http.Request)
ExtensionsHandler returns the osquery extensions osctrld should run: the environment's, plus the node's own when the request names a node of this environment. It records the extension status that node reports.
func (*HandlersTLS) FlagsHandler ¶
func (h *HandlersTLS) FlagsHandler(w http.ResponseWriter, r *http.Request)
FlagsHandler - Function to retrieve flags for osquery nodes, from osctrld
func (*HandlersTLS) HealthHandler ¶
func (h *HandlersTLS) HealthHandler(w http.ResponseWriter, r *http.Request)
HealthHandler for health requests. Returns HTTP 200 when the backend is healthy (or no DB health monitor is wired), and HTTP 204 when the DB health monitor reports the backend as degraded. 204 — rather than 503 — is used because the service is still serving osquery nodes from stale-serve caches; the non-200 code lets load balancers / operators distinguish the degraded state without dropping traffic.
func (*HandlersTLS) LogHandler ¶
func (h *HandlersTLS) LogHandler(w http.ResponseWriter, r *http.Request)
LogHandler - Function to handle the log requests from osquery nodes, both status and results
func (*HandlersTLS) OsctrldMiddleware ¶ added in v0.6.1
OsctrldMiddleware wraps an osctrld route: the per-address traffic limit (and the download limit when download is set), then the failed-secret block, which turns a blocked address away before its body is read. Requests and latency are recorded by route pattern.
func (*HandlersTLS) OsqueryConfigEndpointHandler ¶ added in v0.5.2
func (h *HandlersTLS) OsqueryConfigEndpointHandler(w http.ResponseWriter, r *http.Request)
OsqueryConfigEndpointHandler - Function to handle the osquery configuration endpoint
func (*HandlersTLS) OsqueryHandler ¶ added in v0.6.1
func (h *HandlersTLS) OsqueryHandler(w http.ResponseWriter, r *http.Request)
OsqueryHandler tells osctrld which osquery version a node of the environment should run. Anything that is malformed or not such a node gets 400, never 404: osctrld reads 404 as "route not served". A well-formed but unsupported platform is a 200 with a reason.
func (*HandlersTLS) ProcessCarveBlock ¶
func (h *HandlersTLS) ProcessCarveBlock(req types.CarveBlockRequest, environment, uuid string, envid uint)
ProcessCarveBlock - Function to process one block from a file carve FIXME it can be more efficient on db access
func (*HandlersTLS) ProcessCarveInit ¶
func (h *HandlersTLS) ProcessCarveInit(req types.CarveInitRequest, sessionid, environment string) error
ProcessCarveInit - Function to initialize a file carve from a node
func (*HandlersTLS) ProcessCarveWrite ¶
func (h *HandlersTLS) ProcessCarveWrite(req types.QueryCarveScheduled, queryName, nodeKey, environment string) error
ProcessCarveWrite - Function to process the scheduling of file carves from a node
func (*HandlersTLS) PrometheusMiddleware ¶
func (h *HandlersTLS) PrometheusMiddleware(next http.Handler) http.Handler
func (*HandlersTLS) QueryReadHandler ¶
func (h *HandlersTLS) QueryReadHandler(w http.ResponseWriter, r *http.Request)
QueryReadHandler - Function to handle on-demand queries to osquery nodes
func (*HandlersTLS) QueryWriteHandler ¶
func (h *HandlersTLS) QueryWriteHandler(w http.ResponseWriter, r *http.Request)
QueryWriteHandler - Function to handle distributed query results from osquery nodes
func (*HandlersTLS) QuickEnrollHandler ¶
func (h *HandlersTLS) QuickEnrollHandler(w http.ResponseWriter, r *http.Request)
QuickEnrollHandler - Function to handle the endpoint for quick enrollment script distribution
func (*HandlersTLS) QuickRemoveHandler ¶
func (h *HandlersTLS) QuickRemoveHandler(w http.ResponseWriter, r *http.Request)
QuickRemoveHandler - Function to handle the endpoint for quick removal script
func (*HandlersTLS) RootHandler ¶
func (h *HandlersTLS) RootHandler(w http.ResponseWriter, r *http.Request)
RootHandler to be used as health check
func (*HandlersTLS) ScriptHandler ¶
func (h *HandlersTLS) ScriptHandler(w http.ResponseWriter, r *http.Request)
ScriptHandler - Function to retrieve enroll/remove script for osquery nodes, from osctrld
func (*HandlersTLS) StatusHandler ¶ added in v0.6.1
func (h *HandlersTLS) StatusHandler(w http.ResponseWriter, r *http.Request)
StatusHandler stores the osqueryd health and rollback report of a node of the environment. Anything that is not such a node gets 400, never 404: osctrld reads 404 as "route not served". Each new rollback event is counted and audited once.
func (*HandlersTLS) VerifyHandler ¶
func (h *HandlersTLS) VerifyHandler(w http.ResponseWriter, r *http.Request)
VerifyHandler - Function to verify status of enrolled osquery nodes, from osctrld
type Option ¶
type Option func(*HandlersTLS)
Option to pass to creator
func WithActivityWriter ¶ added in v0.5.4
func WithActivityWriter(activityWriter *activityWriter) Option
WithActivityWriter to pass value as option
func WithAuditLog ¶ added in v0.5.2
func WithAuditLog(al *auditlog.AuditLogManager) Option
WithAuditLog passes the audit-log manager so the TLS service can record failed enrollment attempts for SoC alerting.
func WithConfigEndpoints ¶ added in v0.5.2
func WithConfigEndpoints(endpoints *config.YAMLConfigurationEndpoints) Option
WithConfigEndpoints to pass configuration endpoints values
func WithDBHealth ¶ added in v0.5.5
func WithDBHealth(hl backend.DegradedReader) Option
WithDBHealth wires a DB health monitor so HealthHandler can report backend degradation (HTTP 204) instead of always reporting 200. Pass nil to keep the legacy "always healthy" behavior.
func WithDebugHTTP ¶ added in v0.4.5
func WithDebugHTTP(cfg *config.YAMLConfigurationDebug) Option
WithDebugHTTP to pass debug HTTP configuration values
func WithEnvCache ¶ added in v0.5.5
func WithEnvCache(ec *environments.EnvCache) Option
WithEnvCache sets a pre-built EnvCache (e.g., one with a Redis-backed invalidation check wired in). When provided, CreateHandlersTLS skips the default NewEnvCache call.
func WithEnvs ¶
func WithEnvs(envs *environments.EnvManager) Option
WithEnvs to pass value as option
func WithExtensions ¶ added in v0.6.1
func WithExtensions(m *extensions.Manager) Option
WithExtensions enables serving osquery extensions to osctrld.
func WithFlagsOverrides ¶ added in v0.6.1
func WithFlagsOverrides(m *nodeconfig.FlagsManager) Option
WithFlagsOverrides enables per-node osquery flags overrides for osctrld.
func WithNodeConfig ¶ added in v0.6.1
func WithNodeConfig(m *nodeconfig.Manager) Option
WithNodeConfig enables per-node osquery configuration overrides.
func WithOsctrldLimits ¶ added in v0.6.1
func WithOsctrldLimits(l *OsctrldLimits) Option
WithOsctrldLimits rate-limits the osctrld routes; nil leaves them unlimited.
func WithOsqueryValues ¶ added in v0.4.7
func WithOsqueryValues(values *config.YAMLConfigurationOsquery) Option
WithOsqueryValues to pass osquery configuration values
func WithOsqueryVersions ¶ added in v0.6.1
func WithOsqueryVersions(m *osqueryversions.Manager) Option
WithOsqueryVersions enables telling osctrld which osquery version to run.
func WithPosture ¶ added in v0.5.5
func WithPosture(pm *posture.PostureManager) Option
func WithQueries ¶
WithQueries to pass value as option
func WithSessionHints ¶ added in v0.6.0
func WithSessionHints(hints *cache.SessionHints) Option
WithSessionHints shares interactive session polling hints with the API.
func WithSettings ¶
WithSettings to pass value as option
func WithSettingsCache ¶ added in v0.5.5
func WithSettingsCache(settingsCache *settings.RedisSettingsCache) Option
WithSettingsCache to pass Redis-backed TLS settings cache
func WithVulns ¶ added in v0.6.0
WithVulns wires the vulnerability inventory store (nil when disabled).
func WithWriteHandler ¶ added in v0.4.4
func WithWriteHandler(writeHandler *batchWriter) Option
WithWriteHandler to pass value as option
type OsctrldLimits ¶ added in v0.6.1
type OsctrldLimits struct {
// Auth is charged only by wrong secrets, per address and environment.
Auth *ratelimit.Limiter
// Traffic is charged by every osctrld request, per address.
Traffic *ratelimit.Limiter
// Download is charged by every extension download, per address.
Download *ratelimit.Limiter
// contains filtered or unexported fields
}
OsctrldLimits holds the per-process rate limiters of the osctrld routes. They key on utils.GetIP: the TCP peer, or the forwarded client when the peer is a configured trusted proxy (otherwise every client behind a proxy shares the proxy's budgets).
func NewOsctrldLimits ¶ added in v0.6.1
func NewOsctrldLimits(cfg config.YAMLConfigurationRateLimits) *OsctrldLimits
NewOsctrldLimits builds the osctrld limiters from the rate-limit config.
type TLSResponse ¶
type TLSResponse struct {
Message string `json:"message"`
}
TLSResponse to be returned to requests
Source Files