Documentation
¶
Overview ¶
Package scanlog ships raw per-chunk nuclei output (matched and unmatched) to one or more storage destinations.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LogDestinations ¶
func LogDestinations()
LogDestinations records the resolved destinations once at boot. Without it the only evidence of a misconfigured bucket is a per-chunk upload warning during the first scan, which nobody is watching for.
func Upload ¶
Upload gzips outputFile once and ships it to every destination. An empty output file is skipped without contacting any destination.
func ValidateS3Config ¶
func ValidateS3Config() error
ValidateS3Config checks the environment at boot.
Types ¶
type PlatformUploader ¶
type PlatformUploader struct{}
PlatformUploader stores scan logs in ProjectDiscovery-managed storage.
func NewPlatformUploader ¶
func NewPlatformUploader() *PlatformUploader
NewPlatformUploader returns an uploader targeting PDCP-managed storage.
func (*PlatformUploader) Name ¶
func (*PlatformUploader) Name() string
Name identifies the destination in logs.
func (*PlatformUploader) Upload ¶
func (*PlatformUploader) Upload(ctx context.Context, m Meta, gzPath string, gzSize int64) (string, error)
Upload ships the gzipped scan log via:
- POST /v1/scans/{scan_id}/scan_log/upload-url?history_id=N with {"filename": ...}
- PUT the bytes to the signed URL with the response Headers verbatim.
The payload is an opaque .gz blob (no Content-Encoding) so the SigV4 signed headers never need to cover Content-Encoding; server gunzips on read.
type S3Config ¶
type S3Config struct {
Bucket string
Region string
AccessKeyID string
SecretKey string
Endpoint string
UsePathStyle bool
Prefix string
}
S3Config describes a customer-owned S3 destination. Credentials are always explicit: the AWS default chain is deliberately not consulted, so no ambient credential on the host can be used to write to the operator's bucket.
func S3ConfigFromEnv ¶
func S3ConfigFromEnv() S3Config
S3ConfigFromEnv reads the destination config. Bucket empty means the destination is off.
Every field is trimmed, credentials included: a secret sourced from a Kubernetes secretRef built with --from-file keeps its trailing newline, and SigV4 would sign with it and fail every request.
func (S3Config) PlaintextWarning ¶
PlaintextWarning describes the exposure when the endpoint is plaintext and not loopback. The scan log is every finding for the customer's hosts, and over http:// it travels in the clear along with a replayable Authorization header. In-cluster MinIO over http:// is a legitimate setup, so this warns rather than rejects.
type S3Uploader ¶
type S3Uploader struct {
// contains filtered or unexported fields
}
S3Uploader writes scan logs to a customer-owned, S3-compatible bucket. Nothing about the object is reported back to the platform.
func NewS3Uploader ¶
func NewS3Uploader(cfg S3Config) *S3Uploader
NewS3Uploader returns an uploader for cfg. Validate the config at boot; this constructor assumes it already passed.
type Uploader ¶
type Uploader interface {
Upload(ctx context.Context, m Meta, gzPath string, gzSize int64) (location string, err error)
Name() string
}
Uploader ships one gzipped scan log. Implementations receive an already compressed file and return where the object landed.
func Destinations ¶
func Destinations() []Uploader
Destinations resolves the configured upload targets. An empty slice means scan-log upload is off. The platform toggle and a customer-owned bucket are independent, so either, both or neither can be active.
Source Files