posture

package
v0.74.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 3, 2026 License: BSD-3-Clause, AGPL-3.0 Imports: 12 Imported by: 9

Documentation

Index

Constants

View Source 
const (
	NBVersionCheckName        = "NBVersionCheck"
	OSVersionCheckName        = "OSVersionCheck"
	GeoLocationCheckName      = "GeoLocationCheck"
	PeerNetworkRangeCheckName = "PeerNetworkRangeCheck"
	ProcessCheckName          = "ProcessCheck"

	CheckActionAllow string = "allow"
	CheckActionDeny  string = "deny"
)

Variables

This section is empty.

Functions

func AffectsPosture added in v0.73.2 

func AffectsPosture(ctx context.Context, diff *nbpeer.MetaDiff, checks []*Checks) bool

AffectsPosture reports whether the change in diff flips the verdict of any check. It replays each check against the peer's old and new state and compares verdicts, so a change that moves a field but stays the right side of a threshold (e.g. a kernel bump still above the minimum) does not force a re-evaluation. See verdictChanged for how an evaluation error counts.

func MeetsMinVersion added in v0.48.0 

func MeetsMinVersion(minVer, peerVer string) (bool, error)

MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version

Types

type Check 

type Check interface {
	Name() string
	Check(ctx context.Context, peer nbpeer.Peer) (bool, error)
	Validate() error
}

Check represents an interface for performing a check on a peer.

type Checks 

type Checks struct {
	// ID of the posture checks
	ID string `gorm:"primaryKey"`

	// Name of the posture checks
	Name string

	// Description of the posture checks visible in the UI
	Description string

	// AccountID is a reference to the Account that this object belongs
	AccountID string `json:"-" gorm:"index"`

	// Checks is a set of objects that perform the actual checks
	Checks ChecksDefinition `gorm:"serializer:json"`
}

func NewChecksFromAPIPostureCheck added in v0.28.0 

func NewChecksFromAPIPostureCheck(source api.PostureCheck) (*Checks, error)

func NewChecksFromAPIPostureCheckUpdate added in v0.28.0 

func NewChecksFromAPIPostureCheckUpdate(source api.PostureCheckUpdate, postureChecksID string) (*Checks, error)

func (*Checks) Copy 

func (pc *Checks) Copy() *Checks

Copy returns a copy of a posture checks.

func (*Checks) EventMeta 

func (pc *Checks) EventMeta() map[string]any

EventMeta returns activity event meta-related to this posture checks.

func (*Checks) GetChecks 

func (pc *Checks) GetChecks() []Check

GetChecks returns list of all initialized checks definitions

func (*Checks) TableName 

func (*Checks) TableName() string

TableName returns the name of the table for the Checks model in the database.

func (*Checks) ToAPIResponse added in v0.28.0 

func (pc *Checks) ToAPIResponse() *api.PostureCheck

func (*Checks) Validate 

func (pc *Checks) Validate() error

Validate checks the validity of a posture checks.

type ChecksDefinition 

type ChecksDefinition struct {
	NBVersionCheck        *NBVersionCheck        `json:",omitempty"`
	OSVersionCheck        *OSVersionCheck        `json:",omitempty"`
	GeoLocationCheck      *GeoLocationCheck      `json:",omitempty"`
	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:",omitempty"`
	ProcessCheck          *ProcessCheck          `json:",omitempty"`
}

ChecksDefinition contains definition of actual check

func (ChecksDefinition) Copy 

func (cd ChecksDefinition) Copy() ChecksDefinition

Copy returns a copy of a checks definition.

type GeoLocationCheck 

type GeoLocationCheck struct {
	// Locations list of geolocations, to which the policy applies
	Locations []Location

	// Action to take upon policy match
	Action string
}

func (*GeoLocationCheck) Check 

func (g *GeoLocationCheck) Check(_ context.Context, peer nbpeer.Peer) (bool, error)

func (*GeoLocationCheck) Name 

func (g *GeoLocationCheck) Name() string

func (*GeoLocationCheck) Validate added in v0.28.0 

func (g *GeoLocationCheck) Validate() error

type Location 

type Location struct {
	// CountryCode 2-letter ISO 3166-1 alpha-2 code that represents the country
	CountryCode string

	// CityName Commonly used English name of the city
	CityName string
}

type MinKernelVersionCheck 

type MinKernelVersionCheck struct {
	MinKernelVersion string
}

type MinVersionCheck 

type MinVersionCheck struct {
	MinVersion string
}

type NBVersionCheck 

type NBVersionCheck struct {
	MinVersion string
}

func (*NBVersionCheck) Check 

func (n *NBVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error)

func (*NBVersionCheck) Name 

func (n *NBVersionCheck) Name() string

func (*NBVersionCheck) Validate added in v0.28.0 

func (n *NBVersionCheck) Validate() error

type OSVersionCheck 

type OSVersionCheck struct {
	Android *MinVersionCheck
	Darwin  *MinVersionCheck
	Ios     *MinVersionCheck
	Linux   *MinKernelVersionCheck
	Windows *MinKernelVersionCheck
}

func (*OSVersionCheck) Check 

func (c *OSVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error)

func (*OSVersionCheck) Name 

func (c *OSVersionCheck) Name() string

func (*OSVersionCheck) Validate added in v0.28.0 

func (c *OSVersionCheck) Validate() error

type PeerNetworkRangeCheck added in v0.26.1 

type PeerNetworkRangeCheck struct {
	Action string
	Ranges []netip.Prefix `gorm:"serializer:json"`
}

func (*PeerNetworkRangeCheck) Check added in v0.26.1 

func (p *PeerNetworkRangeCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error)

Check evaluates configured ranges against the peer's local network interface prefixes and its public connection IP (as a /32 or /128). A configured range matches when it fully contains one of those prefixes, so operators can target both private subnets and public CIDRs (e.g. 1.0.0.0/24, 2.2.2.2/32). Including the connection IP is what lets a public-range posture check work — peer.Meta.NetworkAddresses only carries local NIC addresses.

func (*PeerNetworkRangeCheck) Name added in v0.26.1 

func (p *PeerNetworkRangeCheck) Name() string

func (*PeerNetworkRangeCheck) Validate added in v0.28.0 

func (p *PeerNetworkRangeCheck) Validate() error

type Process added in v0.28.0 

type Process struct {
	LinuxPath   string
	MacPath     string
	WindowsPath string
}

type ProcessCheck added in v0.28.0 

type ProcessCheck struct {
	Processes []Process
}

func (*ProcessCheck) Check added in v0.28.0 

func (p *ProcessCheck) Check(_ context.Context, peer nbpeer.Peer) (bool, error)

func (*ProcessCheck) Name added in v0.28.0 

func (p *ProcessCheck) Name() string

func (*ProcessCheck) Validate added in v0.28.0 

func (p *ProcessCheck) Validate() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.