Files
beelzebub/tracer/tracer.go

134 lines
2.6 KiB
Go
Raw Normal View History

2022-05-09 23:16:59 +02:00
package tracer
import (
2022-05-19 23:20:20 +02:00
"time"
2022-06-04 17:14:46 +02:00
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
log "github.com/sirupsen/logrus"
)
2022-05-09 23:16:59 +02:00
const Workers = 5
2022-05-09 23:16:59 +02:00
type Event struct {
2022-05-19 23:20:20 +02:00
DateTime string
RemoteAddr string
2022-05-17 23:32:00 +02:00
Protocol string
Command string
CommandOutput string
2022-05-17 23:32:00 +02:00
Status string
Msg string
ID string
Environ string
User string
Password string
Client string
Headers string
Cookies string
UserAgent string
HostHTTPRequest string
Body string
HTTPMethod string
RequestURI string
Description string
2022-05-09 23:16:59 +02:00
}
type (
Protocol int
Status int
)
const (
HTTP Protocol = iota
SSH
2022-07-03 17:15:38 +02:00
TCP
)
2022-05-17 23:32:00 +02:00
func (status Protocol) String() string {
2022-07-03 17:15:38 +02:00
return [...]string{"HTTP", "SSH", "TCP"}[status]
2022-05-17 23:32:00 +02:00
}
2022-05-09 23:16:59 +02:00
const (
Start Status = iota
End
Stateless
Interaction
)
func (status Status) String() string {
return [...]string{"Start", "End", "Stateless", "Interaction"}[status]
}
type Strategy func(event Event)
type Tracer interface {
TraceEvent(event Event)
}
type tracer struct {
strategy Strategy
eventsChan chan Event
}
var (
eventsTotal = promauto.NewCounter(prometheus.CounterOpts{
Namespace: "beelzebub",
Name: "events_total",
Help: "The total number of events",
})
eventsSSHTotal = promauto.NewCounter(prometheus.CounterOpts{
Namespace: "beelzebub",
Name: "ssh_events_total",
Help: "The total number of SSH events",
})
eventsTCPTotal = promauto.NewCounter(prometheus.CounterOpts{
Namespace: "beelzebub",
Name: "tcp_events_total",
Help: "The total number of TCP events",
})
eventsHTTPTotal = promauto.NewCounter(prometheus.CounterOpts{
Namespace: "beelzebub",
Name: "http_events_total",
Help: "The total number of HTTP events",
})
)
func Init(strategy Strategy) *tracer {
tracer := &tracer{
strategy: strategy,
eventsChan: make(chan Event, Workers),
}
for i := 0; i < Workers; i++ {
go func(i int) {
log.Debug("Init trace worker: ", i)
for event := range tracer.eventsChan {
tracer.strategy(event)
}
}(i)
}
return tracer
}
func (tracer *tracer) setStrategy(strategy Strategy) {
tracer.strategy = strategy
}
func (tracer *tracer) TraceEvent(event Event) {
event.DateTime = time.Now().UTC().Format(time.RFC3339)
tracer.eventsChan <- event
eventsTotal.Inc()
switch event.Protocol {
case HTTP.String():
eventsHTTPTotal.Inc()
case SSH.String():
eventsSSHTotal.Inc()
case TCP.String():
eventsTCPTotal.Inc()
}
}