github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-09-09 06:21:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update main.go, messageSensitiveDataCleaner.go, and 6 more files...

Browse Source
This commit is contained in:
RamiBerm
2021-06-01 14:25:52 +03:00
parent 47237f05a5
commit 4bc16fa0b4
8 changed files with 114 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
api/main.go
View File

@@ -16,7 +16,6 @@ import (
"mizuserver/pkg/utils"
"os"
"os/signal"
"regexp"
)
var shouldTap = flag.Bool("tap", false, "Run in tapper mode without API")
@@ -24,9 +23,6 @@ var aggregator = flag.Bool("aggregator", false, "Run in aggregator mode with API
var standalone = flag.Bool("standalone", false, "Run in standalone tapper and API mode")
var aggregatorAddress = flag.String("aggregator-address", "", "Address of mizu collector for tapping")
const nodeNameEnvVar = "NODE_NAME"
const tappedAddressesPerNodeDictEnvVar = "TAPPED_ADDRESSES_PER_HOST"
const plainTextRegexesEnvVar = "PLAINTEXT_REGEXES"
func main() {
flag.Parse()
@@ -38,7 +34,7 @@ func main() {
if *standalone {
harOutputChannel := tap.StartPassiveTapper()
filteredHarChannel := make(chan *tap.OutputChannelItem)
go filterHarHeaders(harOutputChannel, filteredHarChannel)
go filterHarHeaders(harOutputChannel, filteredHarChannel, getFilteringOptions())
go api.StartReadingEntries(filteredHarChannel, nil)
hostApi(nil)
} else if *shouldTap {
@@ -57,12 +53,12 @@ func main() {
if err != nil {
panic(fmt.Sprintf("Error connecting to socket server at %s %v", *aggregatorAddress, err))
}
filteredHarChannel := make(chan *tap.OutputChannelItem)
go filterHarHeaders(harOutputChannel, filteredHarChannel)
go pipeChannelToSocket(socketConnection, filteredHarChannel)
go pipeChannelToSocket(socketConnection, harOutputChannel)
} else if *aggregator {
socketHarOutChannel := make(chan *tap.OutputChannelItem, 1000)
go api.StartReadingEntries(socketHarOutChannel, nil)
filteredHarChannel := make(chan *tap.OutputChannelItem)
go api.StartReadingEntries(filteredHarChannel, nil)
go filterHarHeaders(socketHarOutChannel, filteredHarChannel, getFilteringOptions())
hostApi(socketHarOutChannel)
}
@@ -96,40 +92,32 @@ func hostApi(socketHarOutputChannel chan<- *tap.OutputChannelItem) {
func getTapTargets() []string {
nodeName := os.Getenv(nodeNameEnvVar)
nodeName := os.Getenv(shared.NodeNameEnvVar)
var tappedAddressesPerNodeDict map[string][]string
err := json.Unmarshal([]byte(os.Getenv(tappedAddressesPerNodeDictEnvVar)), &tappedAddressesPerNodeDict)
err := json.Unmarshal([]byte(os.Getenv(shared.TappedAddressesPerNodeDictEnvVar)), &tappedAddressesPerNodeDict)
if err != nil {
panic(fmt.Sprintf("env var %s's value of %s is invalid! must be map[string][]string %v", tappedAddressesPerNodeDictEnvVar, tappedAddressesPerNodeDict, err))
panic(fmt.Sprintf("env var %s's value of %s is invalid! must be map[string][]string %v", shared.TappedAddressesPerNodeDictEnvVar, tappedAddressesPerNodeDict, err))
}
return tappedAddressesPerNodeDict[nodeName]
}
func getFilteringOptions() *sensitiveDataFiltering.FilteringOptions {
regexJsonArr := os.Getenv(plainTextRegexesEnvVar)
if regexJsonArr == "" {
func getFilteringOptions() *shared.FilteringOptions {
filteringOptionsJson := os.Getenv(shared.MizuFilteringOptionsEnvVar)
if filteringOptionsJson == "" {
return nil
}
var regexStrSlice []string
err := json.Unmarshal([]byte(regexJsonArr), &regexStrSlice)
var filteringOptions shared.FilteringOptions
err := json.Unmarshal([]byte(filteringOptionsJson), &filteringOptions)
if err != nil {
panic(fmt.Sprintf("env var %s's value of %s is invalid! must be []string %v", plainTextRegexesEnvVar, regexJsonArr, err))
panic(fmt.Sprintf("env var %s's value of %s is invalid! json must match the shared.FilteringOptions struct %v", shared.MizuFilteringOptionsEnvVar, filteringOptionsJson, err))
}
parsedRegexSlice := make([]regexp.Regexp, 0)
for _, regexStr := range regexStrSlice {
regex, err := regexp.Compile(regexStr)
if err != nil {
panic(fmt.Sprintf("env var %s's value of %s is invalid! must be []string %v", plainTextRegexesEnvVar, regexJsonArr, err))
}
parsedRegexSlice = append(parsedRegexSlice, *regex)
}
return &sensitiveDataFiltering.FilteringOptions{PlainTextFilterRegexes: parsedRegexSlice}
return &filteringOptions
}
func filterHarHeaders(inChannel <- chan *tap.OutputChannelItem, outChannel chan *tap.OutputChannelItem) {
func filterHarHeaders(inChannel <- chan *tap.OutputChannelItem, outChannel chan *tap.OutputChannelItem, filterOptions *shared.FilteringOptions) {
for message := range inChannel {
sensitiveDataFiltering.FilterSensitiveInfoFromHarRequest(message, nil)
sensitiveDataFiltering.FilterSensitiveInfoFromHarRequest(message, filterOptions)
outChannel <- message
}
}

12
api/pkg/sensitiveDataFiltering/messageSensitiveDataCleaner.go
View File

@@ -3,20 +3,16 @@ package sensitiveDataFiltering
import (
"encoding/json"
"fmt"
"github.com/up9inc/mizu/shared"
"mizuserver/pkg/tap"
"net/url"
"regexp"
"strings"
"github.com/beevik/etree"
"github.com/google/martian/har"
)
type FilteringOptions struct {
PlainTextFilterRegexes []regexp.Regexp
}
func FilterSensitiveInfoFromHarRequest(harOutputItem *tap.OutputChannelItem, options *FilteringOptions) {
func FilterSensitiveInfoFromHarRequest(harOutputItem *tap.OutputChannelItem, options *shared.FilteringOptions) {
filterHarHeaders(harOutputItem.HarEntry.Request.Headers)
filterHarHeaders(harOutputItem.HarEntry.Response.Headers)
@@ -78,7 +74,7 @@ func isFieldNameSensitive(fieldName string) bool {
return false
}
func filterHttpBody(bytes []byte, contentType string, options *FilteringOptions) ([]byte, error) {
func filterHttpBody(bytes []byte, contentType string, options *shared.FilteringOptions) ([]byte, error) {
mimeType := strings.Split(contentType, ";")[0]
switch strings.ToLower(mimeType) {
case "application/json":
@@ -99,7 +95,7 @@ func filterHttpBody(bytes []byte, contentType string, options *FilteringOptions)
return bytes, nil
}
func filterPlainText(bytes []byte, options *FilteringOptions) []byte {
func filterPlainText(bytes []byte, options *shared.FilteringOptions) []byte {
for _, regex := range options.PlainTextFilterRegexes {
bytes = regex.ReplaceAll(bytes, []byte(maskedFieldPlaceholderValue))
}

4
api/pkg/tap/passive_tapper.go
View File

@@ -13,6 +13,7 @@ import (
"encoding/json"
"flag"
"fmt"
"github.com/up9inc/mizu/shared"
"log"
"os"
"os/signal"
@@ -34,7 +35,6 @@ import (
const AppPortsEnvVar = "APP_PORTS"
const OutPortEnvVar = "WEB_SOCKET_PORT"
const maxHTTP2DataLenEnvVar = "HTTP2_DATA_SIZE_LIMIT"
const hostModeEnvVar = "HOST_MODE"
// default is 1MB, more than the max size accepted by collector and traffic-dumper
const maxHTTP2DataLenDefault = 1 * 1024 * 1024
const cleanPeriod = time.Second * 10
@@ -258,7 +258,7 @@ func startPassiveTapper(harWriter *HarWriter) {
maxHTTP2DataLen = convertedInt
}
}
hostMode = os.Getenv(hostModeEnvVar) == "1"
hostMode = os.Getenv(shared.HostModeEnvVar) == "1"
fmt.Printf("App Ports: %v\n", appPorts)
fmt.Printf("Tap output websocket port: %s\n", tapOutputPort)