Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(helpers): net_packet_http request/response #4354

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

rscampos
Copy link
Contributor

@rscampos rscampos commented Oct 16, 2024

fix: #4346

1. Explain what the PR does

bedbced temp go.mod just for test
a0c1304 feat(test): e2e integration test for new helpers
f5498d0 feat(helpers): net_packet_http request/response

f5498d0 feat(helpers): net_packet_http request/response

- Add `GetProtoHTTPRequestByName` to get http request header from the
  event `net_packet_http_request`;
- Add `GetProtoHTTPResponseByName` to get http response header from the
  event `net_packet_http_response`;

2. Explain how to test it

  1. Duplicate the http.go signature file.
  2. Update the event to net_packet_http_request or net_packet_http_response.
  3. Use the appropriate helper: GetProtoHTTPRequestByName or GetProtoHTTPResponseByName.

3. Other comments

- Add `GetProtoHTTPRequestByName` to get http request header from the
  event `net_packet_http_request`;
- Add `GetProtoHTTPResponseByName` to get http response header from the
  event `net_packet_http_response`;
@NDStrahilevitz
Copy link
Collaborator

@rscampos Maybe use these helpers in the existing signatures if possible? For example add themto the instrumentation tests. Then we can merge.

Copy link
Collaborator

@NDStrahilevitz NDStrahilevitz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, although we should probably use something similar to the flow events in DNS instead of these events (which are meant for legacy compatibility iirc).

@@ -43,6 +43,8 @@ require (
sigs.k8s.io/controller-runtime v0.18.2
)

replace github.com/aquasecurity/tracee/signatures/helpers => ./signatures/helpers/
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove and update through types PR

@NDStrahilevitz
Copy link
Collaborator

@rscampos Merge at will once you do the types PR (which you can merge without +1 as far as i'm concerned)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

GetProtoHTTPByName for net_packet_http_request
2 participants