@@ -26,6 +26,7 @@ type EventHandler struct {
2626 ProcessMap map [string ]* Process
2727 netMutex sync.RWMutex
2828 fileMutex sync.RWMutex
29+ procMutex sync.RWMutex
2930}
3031
3132var classAPrivateSubnet , classBPrivateSubnet , classCPrivateSubnet , loopBackSubnet * net.IPNet
@@ -56,18 +57,27 @@ func (eventHandler *EventHandler) handleFileEvent(event *Event) {
5657 }
5758
5859 if fileType != "" {
59- toolChecksum , _ := getProgramChecksum (event .Exe )
60- exe := filepath .Base (event .Exe )
61- eventHandler .ApiClient .sendFileEvent (eventHandler .CorrelationId , eventHandler .Repo , fileType , event .Timestamp , exe , toolChecksum )
60+ tool := * eventHandler .GetToolChain (event .PPid , event .Exe )
61+ eventHandler .ApiClient .sendFileEvent (eventHandler .CorrelationId , eventHandler .Repo , fileType , event .Timestamp , tool )
6262 eventHandler .ProcessFileMap [event .Pid ] = true
6363 }
6464 }
6565
6666 eventHandler .fileMutex .Unlock ()
6767}
68- func (eventHandler * EventHandler ) handleProcessEvent () {
6968
69+ func (eventHandler * EventHandler ) handleProcessEvent (event * Event ) {
70+ eventHandler .procMutex .Lock ()
71+
72+ _ , found := eventHandler .ProcessMap [event .Pid ]
73+
74+ if ! found {
75+ eventHandler .ProcessMap [event .Pid ] = & Process {PID : event .Pid , PPid : event .PPid , Exe : event .Exe , Arguments : event .ProcessArguments }
76+ }
77+
78+ eventHandler .procMutex .Unlock ()
7079}
80+
7181func (eventHandler * EventHandler ) handleNetworkEvent (event * Event ) {
7282 eventHandler .netMutex .Lock ()
7383
@@ -82,23 +92,18 @@ func (eventHandler *EventHandler) handleNetworkEvent(event *Event) {
8292
8393 if ! found {
8494 //writeLog(fmt.Sprintf("handleNetworkEvent %v", event))
95+ tool := Tool {}
8596 image := GetContainerByPid (event .Pid )
86- checksum := ""
87- exe := ""
8897 if image == "" {
89-
9098 if event .Exe != "" {
91- checksum , _ = getProgramChecksum (event .Exe )
92-
99+ tool = * eventHandler .GetToolChain (event .PPid , event .Exe )
93100 }
94- exe = filepath . Base ( event . Exe )
101+
95102 } else {
96- event .Exe = image
97- checksum = image
98- exe = image
103+ tool = Tool {Name : image , SHA256 : image } // TODO: Set container image checksum
99104 }
100105
101- eventHandler .ApiClient .sendNetConnection (eventHandler .CorrelationId , eventHandler .Repo , event .IPAddress , event .Port , "" , event .Timestamp , exe , checksum )
106+ eventHandler .ApiClient .sendNetConnection (eventHandler .CorrelationId , eventHandler .Repo , event .IPAddress , event .Port , "" , event .Timestamp , tool )
102107 eventHandler .ProcessConnectionMap [cacheKey ] = true
103108 }
104109 }
@@ -113,7 +118,7 @@ func (eventHandler *EventHandler) HandleEvent(event *Event) {
113118 case fileMonitorTag :
114119 eventHandler .handleFileEvent (event )
115120 case processMonitorTag :
116- eventHandler .handleProcessEvent ()
121+ eventHandler .handleProcessEvent (event )
117122 }
118123}
119124
@@ -160,6 +165,34 @@ func getProgramChecksum(path string) (string, error) {
160165 return fmt .Sprintf ("%x" , h .Sum (nil )), nil
161166}
162167
168+ func (eventHandler * EventHandler ) GetToolChain (ppid , exe string ) * Tool {
169+ checksum , _ := getProgramChecksum (exe )
170+ tool := Tool {Name : filepath .Base (exe ), SHA256 : checksum }
171+
172+ // In some cases the process has already exited, so get from map first
173+ parentProcess , found := eventHandler .ProcessMap [ppid ]
174+
175+ if found {
176+ tool .Parent = eventHandler .GetToolChain (parentProcess .PPid , parentProcess .Exe )
177+ return & tool
178+ }
179+
180+ // If not in map, may be long running, so get from OS
181+ parentProcessId , err := getParentProcessId (ppid )
182+ if err != nil {
183+ return & tool
184+ }
185+
186+ path , err := getProcessExe (ppid )
187+ if err != nil {
188+ return & tool
189+ }
190+
191+ tool .Parent = eventHandler .GetToolChain (fmt .Sprintf ("%d" , parentProcessId ), path )
192+
193+ return & tool
194+ }
195+
163196func isPrivateIPAddress (ipAddress string ) bool {
164197 if classAPrivateSubnet == nil {
165198 _ , classAPrivateSubnet , _ = net .ParseCIDR (classAPrivateAddressRange )
0 commit comments