Skip to content

Commit

Permalink
bug fixes
Browse files Browse the repository at this point in the history
  • Loading branch information
@caffix
caffix committed Dec 6, 2024
1 parent fa0bed1 commit 23b9d76
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 39 deletions.
4 changes: 0 additions & 4 deletions engine/plugins/dns/cname.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,11 +110,7 @@ func (d *dnsCNAME) store(e *et.Event, fqdn *dbt.Entity, rr []*resolve.ExtractedA
Source: d.plugin.source.Name,
Confidence: d.plugin.source.Confidence,
})
} else {
e.Session.Log().Error(err.Error(), slog.Group("plugin", "name", d.plugin.name, "handler", d.name))
}
} else {
e.Session.Log().Error(err.Error(), slog.Group("plugin", "name", d.plugin.name, "handler", d.name))
}
}

Expand Down
17 changes: 9 additions & 8 deletions engine/plugins/horizontals/contact.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,18 +51,18 @@ func (h *horContact) check(e *et.Event) error {
}
}

src := h.plugin.source
var assets []*dbt.Entity
for _, im := range impacted {
if a, err := e.Session.Cache().FindEntityByContent(im.Asset, e.Session.Cache().StartTime()); err == nil && len(a) == 1 {
if a, err := e.Session.Cache().FindEntityByContent(im.Asset,
e.Session.Cache().StartTime()); err == nil && len(a) == 1 {
assets = append(assets, a[0])
} else if n := h.store(e, im.Asset, src); n != nil {
} else if n := h.store(e, im.Asset); n != nil {
assets = append(assets, n)
}
}

if len(assets) > 0 {
h.plugin.process(e, assets, src)
h.plugin.process(e, assets)
h.plugin.addAssociatedRelationship(e, assocs)
}
}
Expand All @@ -73,7 +73,8 @@ func (h *horContact) lookup(e *et.Event, asset *dbt.Entity, conf int) []*scope.A
labels := []string{"organization", "location", "email"}

var results []*scope.Association
if edges, err := e.Session.Cache().OutgoingEdges(asset, e.Session.Cache().StartTime(), labels...); err == nil && len(edges) > 0 {
if edges, err := e.Session.Cache().OutgoingEdges(asset,
e.Session.Cache().StartTime(), labels...); err == nil && len(edges) > 0 {
for _, edge := range edges {
entity, err := e.Session.Cache().FindEntityById(edge.ToEntity.ID)
if err != nil {
Expand All @@ -92,15 +93,15 @@ func (h *horContact) lookup(e *et.Event, asset *dbt.Entity, conf int) []*scope.A
return results
}

func (h *horContact) store(e *et.Event, asset oam.Asset, src *et.Source) *dbt.Entity {
func (h *horContact) store(e *et.Event, asset oam.Asset) *dbt.Entity {
a, err := e.Session.Cache().CreateAsset(asset)
if err != nil || a == nil {
return nil
}

_, _ = e.Session.Cache().CreateEntityProperty(a, &property.SourceProperty{
Source: src.Name,
Confidence: src.Confidence,
Source: h.plugin.source.Name,
Confidence: h.plugin.source.Confidence,
})
return a
}
24 changes: 12 additions & 12 deletions engine/plugins/horizontals/fqdn.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,9 +60,8 @@ func (h *horfqdn) check(e *et.Event) error {
conf = matches.Confidence(string(oam.FQDN))
}

src := h.plugin.source
if len(ptrs) > 0 {
h.checkPTR(e, ptrs, e.Entity, src)
h.checkPTR(e, ptrs, e.Entity)
return nil
}

Expand All @@ -78,22 +77,23 @@ func (h *horfqdn) check(e *et.Event) error {

var assets []*dbt.Entity
for _, im := range impacted {
if a, err := e.Session.Cache().FindEntityByContent(im.Asset, e.Session.Cache().StartTime()); err == nil && len(a) == 1 {
if a, err := e.Session.Cache().FindEntityByContent(im.Asset,
e.Session.Cache().StartTime()); err == nil && len(a) == 1 {
assets = append(assets, a[0])
} else if n := h.store(e, im.Asset, src); n != nil {
} else if n := h.store(e, im.Asset); n != nil {
assets = append(assets, n)
}
}

if len(assets) > 0 {
h.plugin.process(e, assets, src)
h.plugin.process(e, assets)
h.plugin.addAssociatedRelationship(e, assocs)
}
}
return nil
}

func (h *horfqdn) checkPTR(e *et.Event, edges []*dbt.Edge, fqdn *dbt.Entity, src *et.Source) {
func (h *horfqdn) checkPTR(e *et.Event, edges []*dbt.Edge, fqdn *dbt.Entity) {
if ins, err := e.Session.Cache().IncomingEdges(fqdn, e.Session.Cache().StartTime(), "ptr_record"); err == nil && len(ins) > 0 {
for _, r := range ins {
from, err := e.Session.Cache().FindEntityById(r.FromEntity.ID)
Expand Down Expand Up @@ -121,16 +121,16 @@ func (h *horfqdn) checkPTR(e *et.Event, edges []*dbt.Edge, fqdn *dbt.Entity, src
if e.Session.Scope().AddDomain(dom) {
h.plugin.log.Info(fmt.Sprintf("[%s: %s] was added to the session scope", "FQDN", dom))
}
h.plugin.submitFQDN(e, dom, src)
h.plugin.submitFQDN(e, dom)
}
} else if _, conf := e.Session.Scope().IsAssetInScope(to.Asset, 0); conf > 0 {
if e.Session.Scope().Add(ip) {
size := 100
if e.Session.Config().Active {
size = 250
}
h.plugin.submitIPAddresses(e, ip, src)
support.IPAddressSweep(e, ip, src, size, h.plugin.submitIPAddresses)
h.plugin.submitIPAddresses(e, ip, h.plugin.source)
support.IPAddressSweep(e, ip, h.plugin.source, size, h.plugin.submitIPAddresses)
h.plugin.log.Info(fmt.Sprintf("[%s: %s] was added to the session scope", ip.AssetType(), ip.Key()))
}
}
Expand All @@ -151,15 +151,15 @@ func (h *horfqdn) lookup(e *et.Event, asset *dbt.Entity, conf int) []*scope.Asso
return assocs
}

func (h *horfqdn) store(e *et.Event, asset oam.Asset, src *et.Source) *dbt.Entity {
func (h *horfqdn) store(e *et.Event, asset oam.Asset) *dbt.Entity {
a, err := e.Session.Cache().CreateAsset(asset)
if err != nil || a == nil {
return nil
}

_, _ = e.Session.Cache().CreateEntityProperty(a, &property.SourceProperty{
Source: src.Name,
Confidence: src.Confidence,
Source: h.plugin.source.Name,
Confidence: h.plugin.source.Confidence,
})
return a
}
32 changes: 17 additions & 15 deletions engine/plugins/horizontals/plugin.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,8 @@ func (h *horizPlugin) makeAssocRelationshipEntries(e *et.Event, assoc, assoc2 *d
return
}
// check that this relationship has not already been setup during this session
if edges, err := e.Session.Cache().OutgoingEdges(assoc, e.Session.Cache().StartTime(), "associated_with"); err == nil && len(edges) > 0 {
if edges, err := e.Session.Cache().OutgoingEdges(assoc,
e.Session.Cache().StartTime(), "associated_with"); err == nil && len(edges) > 0 {
for _, edge := range edges {
if edge.ToEntity.ID == assoc2.ID {
return
Expand All @@ -134,22 +135,22 @@ func (h *horizPlugin) makeAssocRelationshipEntries(e *et.Event, assoc, assoc2 *d
})
}

func (h *horizPlugin) process(e *et.Event, assets []*dbt.Entity, src *et.Source) {
func (h *horizPlugin) process(e *et.Event, assets []*dbt.Entity) {
for _, asset := range assets {
// check for new networks added to the scope
switch v := asset.Asset.(type) {
case *oamnet.Netblock:
h.ipPTRTargetsInScope(e, asset, src)
h.sweepAroundIPs(e, asset, src)
h.ipPTRTargetsInScope(e, asset)
h.sweepAroundIPs(e, asset)
//h.sweepNetblock(e, v, src)
case *oamreg.IPNetRecord:
if ents, err := e.Session.Cache().FindEntityByContent(
&oamnet.Netblock{CIDR: v.CIDR, Type: v.Type}, e.Session.Cache().StartTime()); err == nil && len(ents) == 1 {
a := ents[0]

if _, ok := a.Asset.(*oamnet.Netblock); ok {
h.ipPTRTargetsInScope(e, a, src)
h.sweepAroundIPs(e, a, src)
h.ipPTRTargetsInScope(e, a)
h.sweepAroundIPs(e, a)
//h.sweepNetblock(e, nb, src)
}
}
Expand All @@ -162,19 +163,20 @@ func (h *horizPlugin) process(e *et.Event, assets []*dbt.Entity, src *et.Source)
})

_, _ = e.Session.Cache().CreateEntityProperty(asset, &property.SourceProperty{
Source: src.Name,
Confidence: src.Confidence,
Source: h.source.Name,
Confidence: h.source.Confidence,
})
}
}

func (h *horizPlugin) ipPTRTargetsInScope(e *et.Event, nb *dbt.Entity, src *et.Source) {
func (h *horizPlugin) ipPTRTargetsInScope(e *et.Event, nb *dbt.Entity) {
if edges, err := e.Session.Cache().OutgoingEdges(nb, e.Session.Cache().StartTime(), "contains"); err == nil && len(edges) > 0 {
for _, edge := range edges {
to, err := e.Session.Cache().FindEntityById(edge.ToEntity.ID)
if err != nil {
continue
}

reverse, err := dns.ReverseAddr(to.Asset.Key())
if err != nil {
continue
Expand All @@ -195,7 +197,7 @@ func (h *horizPlugin) ipPTRTargetsInScope(e *et.Event, nb *dbt.Entity, src *et.S
}
if dom, err := publicsuffix.EffectiveTLDPlusOne(to.Asset.Key()); err == nil {
if e.Session.Scope().AddDomain(dom) {
h.submitFQDN(e, dom, src)
h.submitFQDN(e, dom)
h.log.Info(fmt.Sprintf("[%s: %s] was added to the session scope", "FQDN", dom))
}
}
Expand All @@ -206,7 +208,7 @@ func (h *horizPlugin) ipPTRTargetsInScope(e *et.Event, nb *dbt.Entity, src *et.S
}
}

func (h *horizPlugin) sweepAroundIPs(e *et.Event, nb *dbt.Entity, src *et.Source) {
func (h *horizPlugin) sweepAroundIPs(e *et.Event, nb *dbt.Entity) {
if edges, err := e.Session.Cache().OutgoingEdges(nb, e.Session.Cache().StartTime(), "contains"); err == nil && len(edges) > 0 {
for _, edge := range edges {
size := 100
Expand All @@ -219,7 +221,7 @@ func (h *horizPlugin) sweepAroundIPs(e *et.Event, nb *dbt.Entity, src *et.Source
continue
}
if ip, ok := to.Asset.(*oamnet.IPAddress); ok {
support.IPAddressSweep(e, ip, src, size, h.submitIPAddresses)
support.IPAddressSweep(e, ip, h.source, size, h.submitIPAddresses)
}
}
}
Expand Down Expand Up @@ -295,12 +297,12 @@ func (h *horizPlugin) submitIPAddresses(e *et.Event, asset *oamnet.IPAddress, sr
}
}

func (h *horizPlugin) submitFQDN(e *et.Event, dom string, src *et.Source) {
func (h *horizPlugin) submitFQDN(e *et.Event, dom string) {
fqdn, err := e.Session.Cache().CreateAsset(&domain.FQDN{Name: dom})
if err == nil && fqdn != nil {
_, _ = e.Session.Cache().CreateEntityProperty(fqdn, &property.SourceProperty{
Source: src.Name,
Confidence: src.Confidence,
Source: h.source.Name,
Confidence: h.source.Confidence,
})
_ = e.Dispatcher.DispatchEvent(&et.Event{
Name: fqdn.Asset.Key(),
Expand Down

0 comments on commit 23b9d76

Please sign in to comment.