Directories
¶
| Path | Synopsis |
|---|---|
|
Package atomicio implements atomic file writes used by state-bearing callers (firewall engine, autoblock tracker, etc.).
|
Package atomicio implements atomic file writes used by state-bearing callers (firewall engine, autoblock tracker, etc.). |
|
Package blockdigest batches CSM auto-block events into a per-country roll-up so operators learn when IPs from their customers' countries get blocked.
|
Package blockdigest batches CSM auto-block events into a per-country roll-up so operators learn when IPs from their customers' countries get blocked. |
|
Package bpf provides the shared scaffolding that BPF-backed live monitors across the daemon use: a common Backend interface, backend-kind constants for operator config, sentinel errors that distinguish "not built" from "kernel unsupported", and a per-feature backend metric.
|
Package bpf provides the shared scaffolding that BPF-backed live monitors across the daemon use: a common Backend interface, backend-kind constants for operator config, sentinel errors that distinguish "not built" from "kernel unsupported", and a per-feature backend metric. |
|
Package broadcast provides a one-to-many publish bus for alert.Finding events.
|
Package broadcast provides a one-to-many publish bus for alert.Finding events. |
|
HTTP abuse detection.
|
HTTP abuse detection. |
|
Package contenttype classifies file content shared by the malware scanners.
|
Package contenttype classifies file content shared by the malware scanners. |
|
Package control defines the wire protocol between the CSM daemon and its local command-line client.
|
Package control defines the wire protocol between the CSM daemon and its local command-line client. |
|
af_alg_bpfprog
Package af_alg_bpfprog hosts the BPF C source for the AF_ALG (CVE-2026-31431 "Copy Fail") kernel-side deny program and the generated Go bindings produced by bpf2go.
|
Package af_alg_bpfprog hosts the BPF C source for the AF_ALG (CVE-2026-31431 "Copy Fail") kernel-side deny program and the generated Go bindings produced by bpf2go. |
|
connection_bpfprog
Package connection_bpfprog hosts the BPF C source for the cgroup/connect outbound-connection tracker and the generated Go bindings produced by bpf2go.
|
Package connection_bpfprog hosts the BPF C source for the cgroup/connect outbound-connection tracker and the generated Go bindings produced by bpf2go. |
|
exec_bpfprog
Package exec_bpfprog hosts the BPF C source for the sched/sched_process_exec tracepoint live monitor and the generated Go bindings produced by bpf2go.
|
Package exec_bpfprog hosts the BPF C source for the sched/sched_process_exec tracepoint live monitor and the generated Go bindings produced by bpf2go. |
|
sensitive_file_bpfprog
Package sensitive_file_bpfprog hosts the BPF C source for the lsm/file_permission live monitor and the generated Go bindings produced by bpf2go.
|
Package sensitive_file_bpfprog hosts the BPF C source for the lsm/file_permission live monitor and the generated Go bindings produced by bpf2go. |
|
rollback
Package rollback implements the firewall settings tentative-apply workflow: a save with a deadline that auto-reverts unless the operator confirms before the timer expires.
|
Package rollback implements the firewall settings tentative-apply workflow: a save with a deadline that auto-reverts unless the operator confirms before the timer expires. |
|
Package forensic produces evidence archives for incident response.
|
Package forensic produces evidence archives for incident response. |
|
Package geoip provides IP geolocation via MaxMind GeoLite2 databases and on-demand RDAP lookups for detailed ISP/org information.
|
Package geoip provides IP geolocation via MaxMind GeoLite2 databases and on-demand RDAP lookups for detailed ISP/org information. |
|
Package incident groups related security findings into a single "story" with a timeline.
|
Package incident groups related security findings into a single "story" with a timeline. |
|
integration
|
|
|
webserver
Package webserver auto-installs the CSM challenge webserver glue (Apache / LSWS / Nginx) with a write-validate-reload-or-revert flow.
|
Package webserver auto-installs the CSM challenge webserver glue (Apache / LSWS / Nginx) with a write-validate-reload-or-revert flow. |
|
Package log provides a structured-logging wrapper around log/slog.
|
Package log provides a structured-logging wrapper around log/slog. |
|
mailfwd
|
|
|
adapter
Package adapter renders and applies the MTA-native forward-guard rule.
|
Package adapter renders and applies the MTA-native forward-guard rule. |
|
guard
Package guard glues the operator config to the pure forward-guard policy.
|
Package guard glues the operator config to the pure forward-guard policy. |
|
intel
Package intel turns exim_mainlog deferral lines into operator-facing reputation signals: which outbound IPs are being throttled, by which mail providers, and for what stated reason.
|
Package intel turns exim_mainlog deferral lines into operator-facing reputation signals: which outbound IPs are being throttled, by which mail providers, and for what stated reason. |
|
inventory
Package inventory enumerates mail forwarders on a host and classifies their destinations, so operators can see which accounts relay mail off-server and to which providers.
|
Package inventory enumerates mail forwarders on a host and classifies their destinations, so operators can see which accounts relay mail off-server and to which providers. |
|
policy
Package policy is the single source of truth for the forward-guard hold decision: given the signals observed for a message, should the external forward copy be held? The same Verdict function feeds both the dry-run "would-hold" accounting and (in Phase 2) the generated MTA rule, so the two can never drift apart.
|
Package policy is the single source of truth for the forward-guard hold decision: given the signals observed for a message, should the external forward copy be held? The same Verdict function feeds both the dry-run "would-hold" accounting and (in Phase 2) the generated MTA rule, so the two can never drift apart. |
|
quarantine
Package quarantine is the CSM-owned Maildir that holds external forward copies the forward-guard decided to withhold.
|
Package quarantine is the CSM-owned Maildir that holds external forward copies the forward-guard decided to withhold. |
|
Package maillog reads postfix/dovecot log lines from either a tailed file or systemd-journald, normalizing them into a single Line type so the daemon's mail-brute and PHP-relay parsers don't have to care which source supplied the line.
|
Package maillog reads postfix/dovecot log lines from either a tailed file or systemd-journald, normalizing them into a single Line type so the daemon's mail-brute and PHP-relay parsers don't have to care which source supplied the line. |
|
Package mailranges maintains an atomic in-memory map of mail-provider IP ranges used to exempt shared-source ranges (carrier CGNAT, mail providers) from firewall DoS heuristics.
|
Package mailranges maintains an atomic in-memory map of mail-provider IP ranges used to exempt shared-source ranges (carrier CGNAT, mail providers) from firewall DoS heuristics. |
|
Package metrics is CSM's local OpenMetrics implementation.
|
Package metrics is CSM's local OpenMetrics implementation. |
|
Package mysqlclient wraps the database/sql + go-sql-driver/mysql pair for the read-only queries CSM issues against host-local MySQL/MariaDB.
|
Package mysqlclient wraps the database/sql + go-sql-driver/mysql pair for the read-only queries CSM issues against host-local MySQL/MariaDB. |
|
Package netutil holds the shared public-range guard used to validate operator- and vendor-supplied IP ranges.
|
Package netutil holds the shared public-range guard used to validate operator- and vendor-supplied IP ranges. |
|
Package obs centralises crash reporting and selective error capture via Sentry.
|
Package obs centralises crash reporting and selective error capture via Sentry. |
|
Package platform detects the host OS, control panel, and web server so CSM checks can pick the right config/log paths instead of hardcoding cPanel+Apache layouts.
|
Package platform detects the host OS, control panel, and web server so CSM checks can pick the right config/log paths instead of hardcoding cPanel+Apache layouts. |
|
Package processctx maintains process context (PID/PPID/UID/account/exe/cmdline) for use enriching real-time security findings.
|
Package processctx maintains process context (PID/PPID/UID/account/exe/cmdline) for use enriching real-time security findings. |
|
Package redisinfo wraps the go-redis client for the few read-only INFO calls CSM needs (memory metrics, keyspace counts).
|
Package redisinfo wraps the go-redis client for the few read-only INFO calls CSM needs (memory metrics, keyspace counts). |
|
Package reporting is the node side of CSM abuse reporting (Layer A).
|
Package reporting is the node side of CSM abuse reporting (Layer A). |
|
Package sdnotify is a thin wrapper around go-systemd's daemon notification helpers.
|
Package sdnotify is a thin wrapper around go-systemd's daemon notification helpers. |
|
Package threatintel -- bot allowlist + verification.
|
Package threatintel -- bot allowlist + verification. |
|
Package updatecheck polls upstream release channels and tells the daemon whether a newer CSM version is available so the Web UI can surface a banner.
|
Package updatecheck polls upstream release channels and tells the daemon whether a newer CSM version is available so the Web UI can surface a banner. |
|
Package verdict implements an HMAC-signed HTTP client for the auto_response.verdict_callback hook.
|
Package verdict implements an HMAC-signed HTTP client for the auto_response.verdict_callback hook. |
|
Package yaraipc defines the wire protocol spoken between the CSM daemon and the supervised `csm yara-worker` child process.
|
Package yaraipc defines the wire protocol spoken between the CSM daemon and the supervised `csm yara-worker` child process. |
|
Package yaraworker implements the `csm yara-worker` subcommand: a child process that exists only to host the YARA-X cgo surface and reply to scan requests over a Unix socket.
|
Package yaraworker implements the `csm yara-worker` subcommand: a child process that exists only to host the YARA-X cgo surface and reply to scan requests over a Unix socket. |
Click to show internal directories.
Click to hide internal directories.