-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* First commit Signed-off-by: Ben <[email protected]> * Adding base host rules Signed-off-by: Amit Schendel <[email protected]> * Adding base code of host rule manager Signed-off-by: Amit Schendel <[email protected]> * Adding mock Signed-off-by: Amit Schendel <[email protected]> * fixing process details Signed-off-by: Ben <[email protected]> * Adding main support for rule manager Signed-off-by: Amit Schendel <[email protected]> * Removing import Signed-off-by: Amit Schendel <[email protected]> * Adding process tree support Signed-off-by: Amit Schendel <[email protected]> * Adding fixed config Signed-off-by: Amit Schendel <[email protected]> * Chaning log to debug to prevent spamming Signed-off-by: Amit Schendel <[email protected]> * Adding new code Signed-off-by: Amit Schendel <[email protected]> * Adding rules Signed-off-by: Amit Schendel <[email protected]> * Adding fixed rules Signed-off-by: Amit Schendel <[email protected]> * Adding path and rules Signed-off-by: Amit Schendel <[email protected]> * Commenting read env variable from proc Signed-off-by: Amit Schendel <[email protected]> * Added host agent rules (#485) * Added host agent rules Signed-off-by: Afek Berger <[email protected]> * fixed tests & naming Signed-off-by: Afek Berger <[email protected]> --------- Signed-off-by: Afek Berger <[email protected]> * Fixing rule name Signed-off-by: Amit Schendel <[email protected]> * Configuring event receiver export Signed-off-by: Ben <[email protected]> * fix Signed-off-by: Ben <[email protected]> * Fixing test Signed-off-by: Amit Schendel <[email protected]> * Changing unused params to _ Signed-off-by: Amit Schendel <[email protected]> * Adding syscall peeking Signed-off-by: Amit Schendel <[email protected]> * Adding rule creation at constructor Signed-off-by: Amit Schendel <[email protected]> * Adding generic cooldown queue Signed-off-by: Amit Schendel <[email protected]> * implementing caching in the hosthashsensor Signed-off-by: Ben <[email protected]> * skip env check when running on host Signed-off-by: Matthias Bertschy <[email protected]> * fix kernel version parsing Signed-off-by: Matthias Bertschy <[email protected]> * Using temp k8s interface Signed-off-by: Amit Schendel <[email protected]> * Adding cloudmetadata to alerts Signed-off-by: Amit Schendel <[email protected]> * First commit Signed-off-by: Ben <[email protected]> * Adding base host rules Signed-off-by: Amit Schendel <[email protected]> * Adding base code of host rule manager Signed-off-by: Amit Schendel <[email protected]> * Adding mock Signed-off-by: Amit Schendel <[email protected]> * fixing process details Signed-off-by: Ben <[email protected]> * Adding main support for rule manager Signed-off-by: Amit Schendel <[email protected]> * Removing import Signed-off-by: Amit Schendel <[email protected]> * Adding process tree support Signed-off-by: Amit Schendel <[email protected]> * Adding fixed config Signed-off-by: Amit Schendel <[email protected]> * Chaning log to debug to prevent spamming Signed-off-by: Amit Schendel <[email protected]> * Adding new code Signed-off-by: Amit Schendel <[email protected]> * Adding rules Signed-off-by: Amit Schendel <[email protected]> * Adding fixed rules Signed-off-by: Amit Schendel <[email protected]> * Adding path and rules Signed-off-by: Amit Schendel <[email protected]> * Commenting read env variable from proc Signed-off-by: Amit Schendel <[email protected]> * Added host agent rules (#485) * Added host agent rules Signed-off-by: Afek Berger <[email protected]> * fixed tests & naming Signed-off-by: Afek Berger <[email protected]> --------- Signed-off-by: Afek Berger <[email protected]> * Fixing rule name Signed-off-by: Amit Schendel <[email protected]> * Configuring event receiver export Signed-off-by: Ben <[email protected]> * fix Signed-off-by: Ben <[email protected]> * Fixing test Signed-off-by: Amit Schendel <[email protected]> * Changing unused params to _ Signed-off-by: Amit Schendel <[email protected]> * Adding syscall peeking Signed-off-by: Amit Schendel <[email protected]> * Adding rule creation at constructor Signed-off-by: Amit Schendel <[email protected]> * Adding generic cooldown queue Signed-off-by: Amit Schendel <[email protected]> * implementing caching in the hosthashsensor Signed-off-by: Ben <[email protected]> * Using temp k8s interface Signed-off-by: Amit Schendel <[email protected]> * Adding cloudmetadata to alerts Signed-off-by: Amit Schendel <[email protected]> * skip env check when running on host Signed-off-by: Matthias Bertschy <[email protected]> * fix kernel version parsing Signed-off-by: Matthias Bertschy <[email protected]> * split main into node and host agent Signed-off-by: Matthias Bertschy <[email protected]> * Ptracewatcher Signed-off-by: Ben <[email protected]> * Adding host network watcher (#486) * Adding host network watcher Signed-off-by: Amit Schendel <[email protected]> * Fixing process tree Signed-off-by: Amit Schendel <[email protected]> * adding a goreleaser config Signed-off-by: Matthias Bertschy <[email protected]> --------- Signed-off-by: Amit Schendel <[email protected]> Signed-off-by: Matthias Bertschy <[email protected]> Co-authored-by: Matthias Bertschy <[email protected]> * Fixing Dockerfile - @matthias blame Signed-off-by: Amit Schendel <[email protected]> * fix Signed-off-by: Ben <[email protected]> * Removing network on host Signed-off-by: Amit Schendel <[email protected]> * Clean unused code Signed-off-by: Amit Schendel <[email protected]> * Removing io_uring init on host Signed-off-by: Amit Schendel <[email protected]> * Adding reporting of open and exec to hash sensor Signed-off-by: Amit Schendel <[email protected]> * Adding injected rule creator Signed-off-by: Amit Schendel <[email protected]> * Public validate Signed-off-by: Amit Schendel <[email protected]> * Removing files Signed-off-by: Amit Schendel <[email protected]> * Removing host container Signed-off-by: Amit Schendel <[email protected]> * fixing nits before merging Signed-off-by: Matthias Bertschy <[email protected]> --------- Signed-off-by: Ben <[email protected]> Signed-off-by: Amit Schendel <[email protected]> Signed-off-by: Afek Berger <[email protected]> Signed-off-by: Matthias Bertschy <[email protected]> Co-authored-by: Amit Schendel <[email protected]> Co-authored-by: Afek Berger <[email protected]> Co-authored-by: Matthias Bertschy <[email protected]> Co-authored-by: Amit Schendel <[email protected]>
- Loading branch information
5 people
authored
Feb 20, 2025
1 parent
e34aa76
commit 963c7ef
Showing
37 changed files
with
449 additions
and
220 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,4 +3,4 @@ temp | |
| .vscode | ||
| resources/ebpf/falco/* | ||
| node-agent | ||
| __pycache__ | ||
| __pycache__ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package cooldownqueue | ||
|
|
||
| import ( | ||
| "time" | ||
|
|
||
| "istio.io/pkg/cache" | ||
| ) | ||
|
|
||
| const ( | ||
| DefaultExpiration = 5 * time.Second | ||
| EvictionInterval = 1 * time.Second | ||
| ) | ||
|
|
||
| // CooldownQueue is a queue that lets clients put events into it with a cooldown | ||
| // | ||
| // When a client puts an event into a queue, it waits for a cooldown period before | ||
| // the event is forwarded to the consumer. If and event for the same key is put into the queue | ||
| // again before the cooldown period is over, the event is overridden and the cooldown period is reset. | ||
| type CooldownQueue[T any] struct { | ||
| closed bool | ||
| seenEvents cache.ExpiringCache | ||
| innerChan chan T // Private channel | ||
| resultChan <-chan T // Read-only public channel | ||
| } | ||
|
|
||
| // NewCooldownQueue returns a new Cooldown Queue | ||
| func NewCooldownQueue[T any](cooldown time.Duration, evictionInterval time.Duration) *CooldownQueue[T] { | ||
| events := make(chan T) | ||
| callback := func(key, value any) { | ||
| events <- value.(T) | ||
| } | ||
| c := cache.NewTTLWithCallback(cooldown, evictionInterval, callback) | ||
| return &CooldownQueue[T]{ | ||
| seenEvents: c, | ||
| innerChan: events, | ||
| resultChan: events, | ||
| } | ||
| } | ||
|
|
||
| func (q *CooldownQueue[T]) Closed() bool { | ||
| return q.closed | ||
| } | ||
|
|
||
| // Enqueue enqueues an event in the Cooldown Queue | ||
| func (q *CooldownQueue[T]) Enqueue(e T, key string) { | ||
| if q.closed { | ||
| return | ||
| } | ||
|
|
||
| q.seenEvents.Set(key, e) | ||
| } | ||
|
|
||
| func (q *CooldownQueue[T]) Stop() { | ||
| q.closed = true | ||
| close(q.innerChan) | ||
| } | ||
|
|
||
| // ResultChan returns a read-only channel for consuming events. | ||
| func (q *CooldownQueue[T]) ResultChan() <-chan T { | ||
| return q.resultChan | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.