Skip to content

Commit db323b1

Browse files
varunsh-codervarunsh-coder
authored
Merge pull request #124 from step-security/int
Use reverse lookup for domain name
2 parents d71ce6c + d163ec2 commit db323b1

File tree

9 files changed

+64
-26
lines changed

9 files changed

+64
-26
lines changed

‎agent.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,16 @@ func Run(ctx context.Context, configFilePath string, hostDNSServer DNSServer,
8282
ApiClient: apiclient,
8383
EgressPolicy: config.EgressPolicy,
8484
AllowedEndpoints: allowedEndpoints,
85+
ReverseIPLookup: make(map[string]string),
8586
}
8687

87-
go startDNSServer(dnsProxy, hostDNSServer, errc)
88-
go startDNSServer(dnsProxy, dockerDNSServer, errc) // this is for the docker bridge
88+
go startDNSServer(&dnsProxy, hostDNSServer, errc)
89+
go startDNSServer(&dnsProxy, dockerDNSServer, errc) // this is for the docker bridge
8990

9091
// start proc mon
9192
if cmd == nil {
92-
procMon := &ProcessMonitor{CorrelationId: config.CorrelationId, Repo: config.Repo, ApiClient: apiclient, WorkingDirectory: config.WorkingDirectory}
93+
procMon := &ProcessMonitor{CorrelationId: config.CorrelationId, Repo: config.Repo,
94+
ApiClient: apiclient, WorkingDirectory: config.WorkingDirectory, DNSProxy: &dnsProxy}
9395
go procMon.MonitorProcesses(errc)
9496
WriteLog("started process monitor")
9597
}
@@ -237,8 +239,6 @@ func refreshDNSEntries(ctx context.Context, iptables *Firewall, allowedEndpoints
237239
// add to cache with new TTL
238240
dnsProxy.Cache.Set(domainName, answer)
239241

240-
go dnsProxy.ApiClient.sendDNSRecord(dnsProxy.CorrelationId, dnsProxy.Repo, domainName, answer.Data)
241-
242242
WriteLog(fmt.Sprintf("domain resolved: %s, ip address: %s, TTL: %d", domainName, answer.Data, answer.TTL))
243243
}
244244
}

‎apiclient.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,12 @@ type FileEvent struct {
2727
}
2828

2929
type NetworkConnection struct {
30-
IPAddress string `json:"ipAddress,omitempty"`
31-
Port string `json:"port,omitempty"`
32-
TimeStamp time.Time `json:"timestamp"`
33-
Tool Tool `json:"tool"`
34-
Status string `json:"status,omitempty"`
30+
IPAddress string `json:"ipAddress,omitempty"`
31+
Port string `json:"port,omitempty"`
32+
DomainName string `json:"domainName,omitempty"`
33+
TimeStamp time.Time `json:"timestamp"`
34+
Tool Tool `json:"tool"`
35+
Status string `json:"status,omitempty"`
3536
}
3637

3738
type ApiClient struct {
@@ -54,12 +55,13 @@ func (apiclient *ApiClient) sendDNSRecord(correlationId, repo, domainName, ipAdd
5455
return apiclient.sendApiRequest("POST", url, dnsRecord)
5556
}
5657

57-
func (apiclient *ApiClient) sendNetConnection(correlationId, repo, ipAddress, port, status string, timestamp time.Time, tool Tool) error {
58+
func (apiclient *ApiClient) sendNetConnection(correlationId, repo, ipAddress, port, domainName, status string, timestamp time.Time, tool Tool) error {
5859

5960
networkConnection := &NetworkConnection{}
6061

6162
networkConnection.IPAddress = ipAddress
6263
networkConnection.Port = port
64+
networkConnection.DomainName = domainName
6365
networkConnection.Status = status
6466
networkConnection.TimeStamp = timestamp
6567
networkConnection.Tool = tool

‎dnsproxy.go‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,21 @@ import (
55
"fmt"
66
"io/ioutil"
77
"math"
8+
"sync"
89

910
"github.com/miekg/dns"
1011
"github.com/pkg/errors"
1112
)
1213

1314
type DNSProxy struct {
14-
Cache *Cache
15-
CorrelationId string
16-
Repo string
17-
ApiClient *ApiClient
18-
EgressPolicy string
19-
AllowedEndpoints map[string][]Endpoint
15+
Cache *Cache
16+
CorrelationId string
17+
Repo string
18+
ApiClient *ApiClient
19+
EgressPolicy string
20+
AllowedEndpoints map[string][]Endpoint
21+
ReverseIPLookup map[string]string
22+
ReverseIPLookupMutex sync.RWMutex
2023
}
2124

2225
type DNSResponse struct {
@@ -70,6 +73,25 @@ func (proxy *DNSProxy) getResponse(requestMsg *dns.Msg) (*dns.Msg, error) {
7073
return responseMsg, nil
7174
}
7275

76+
func (proxy *DNSProxy) SetReverseIPLookup(domain, ipAddress string) {
77+
proxy.ReverseIPLookupMutex.Lock()
78+
79+
proxy.ReverseIPLookup[ipAddress] = domain
80+
81+
proxy.ReverseIPLookupMutex.Unlock()
82+
}
83+
84+
func (proxy *DNSProxy) GetReverseIPLookup(ipAddress string) string {
85+
proxy.ReverseIPLookupMutex.RLock()
86+
domain, found := proxy.ReverseIPLookup[ipAddress]
87+
proxy.ReverseIPLookupMutex.RUnlock()
88+
if found {
89+
return domain
90+
} else {
91+
return ""
92+
}
93+
}
94+
7395
func (proxy *DNSProxy) processOtherTypes(q *dns.Question, requestMsg *dns.Msg) (*dns.RR, error) {
7496
queryMsg := new(dns.Msg)
7597
requestMsg.CopyTo(queryMsg)
@@ -79,7 +101,7 @@ func (proxy *DNSProxy) processOtherTypes(q *dns.Question, requestMsg *dns.Msg) (
79101
}
80102

81103
func (proxy *DNSProxy) isAllowedDomain(domain string) bool {
82-
for domainName, _ := range proxy.AllowedEndpoints {
104+
for domainName := range proxy.AllowedEndpoints {
83105
if dns.Fqdn(domainName) == dns.Fqdn(domain) {
84106
return true
85107
}
@@ -191,11 +213,12 @@ func (proxy *DNSProxy) processTypeA(q *dns.Question, requestMsg *dns.Msg) (*dns.
191213
return nil, err
192214
}
193215

194-
return &rr, nil
216+
proxy.SetReverseIPLookup(q.Name, ip)
195217

218+
return &rr, nil
196219
}
197220

198-
func startDNSServer(dnsProxy DNSProxy, server DNSServer, errc chan error) {
221+
func startDNSServer(dnsProxy *DNSProxy, server DNSServer, errc chan error) {
199222
dns.HandleFunc(".", func(w dns.ResponseWriter, r *dns.Msg) {
200223
switch r.Opcode {
201224
case dns.OpcodeQuery:

‎dnsproxy_test.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ func TestDNSProxy_getResponse(t *testing.T) {
102102
ApiClient: apiclient,
103103
EgressPolicy: tt.fields.EgressPolicy,
104104
AllowedEndpoints: tt.fields.AllowedEndpoints,
105+
ReverseIPLookup: make(map[string]string),
105106
}
106107
got, err := proxy.getResponse(tt.args.requestMsg)
107108
if (err != nil) != tt.wantErr {
@@ -131,9 +132,10 @@ func TestDNSProxy_auditCacheTTL(t *testing.T) {
131132
cache := InitCache(EgressPolicyAudit)
132133

133134
proxy := &DNSProxy{
134-
Cache: &cache,
135-
ApiClient: apiclient,
136-
EgressPolicy: EgressPolicyAudit,
135+
Cache: &cache,
136+
ApiClient: apiclient,
137+
EgressPolicy: EgressPolicyAudit,
138+
ReverseIPLookup: make(map[string]string),
137139
}
138140

139141
// should call httpmock

‎eventhandler.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ type EventHandler struct {
2121
CorrelationId string
2222
Repo string
2323
ApiClient *ApiClient
24+
DNSProxy *DNSProxy
2425
ProcessConnectionMap map[string]bool
2526
ProcessFileMap map[string]bool
2627
ProcessMap map[string]*Process
@@ -102,7 +103,8 @@ func (eventHandler *EventHandler) handleNetworkEvent(event *Event) {
102103
tool = Tool{Name: image, SHA256: image} // TODO: Set container image checksum
103104
}
104105

105-
eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, "", event.Timestamp, tool)
106+
reverseLookUp := eventHandler.DNSProxy.GetReverseIPLookup(event.IPAddress)
107+
eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, reverseLookUp, "", event.Timestamp, tool)
106108
eventHandler.ProcessConnectionMap[cacheKey] = true
107109
}
108110
}

‎eventhandler_test.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ func TestEventHandler_HandleEvent(t *testing.T) {
4444
args: args{event: &Event{EventType: fileMonitorTag, Exe: "/path/to/exe", FileName: ".git/objects"}}},
4545
}
4646
for _, tt := range tests {
47+
cache := InitCache(EgressPolicyAudit)
48+
proxy := &DNSProxy{
49+
Cache: &cache,
50+
ApiClient: apiclient,
51+
EgressPolicy: EgressPolicyAudit,
52+
ReverseIPLookup: make(map[string]string),
53+
}
4754
t.Run(tt.name, func(t *testing.T) {
4855
eventHandler := &EventHandler{
4956
CorrelationId: tt.fields.CorrelationId,
@@ -52,6 +59,7 @@ func TestEventHandler_HandleEvent(t *testing.T) {
5259
ProcessConnectionMap: tt.fields.ProcessConnectionMap,
5360
ProcessFileMap: tt.fields.ProcessFileMap,
5461
ProcessMap: tt.fields.ProcessMap,
62+
DNSProxy: proxy,
5563
}
5664
eventHandler.HandleEvent(tt.args.event)
5765
})

‎netmon.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ func (netMonitor *NetworkMonitor) handlePacket(attrs nflog.Attribute) {
9292

9393
if isSYN {
9494
netMonitor.ApiClient.sendNetConnection(netMonitor.CorrelationId, netMonitor.Repo,
95-
ipv4Address, port, netMonitor.Status, timestamp, Tool{Name: Unknown, SHA256: Unknown})
95+
ipv4Address, port, "", netMonitor.Status, timestamp, Tool{Name: Unknown, SHA256: Unknown})
9696

9797
if netMonitor.Status == "Dropped" {
9898
go WriteLog(fmt.Sprintf("ip address dropped: %s", ipv4Address))

‎procmon.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ type ProcessMonitor struct {
1717
CorrelationId string
1818
Repo string
1919
ApiClient *ApiClient
20+
DNSProxy *DNSProxy
2021
WorkingDirectory string
2122
Events map[int]*Event
2223
mutex sync.RWMutex

‎procmon_linux.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func (p *ProcessMonitor) MonitorProcesses(errc chan error) {
111111
func (p *ProcessMonitor) receive(r *libaudit.AuditClient) error {
112112

113113
p.Events = make(map[int]*Event)
114-
eventHandler := EventHandler{CorrelationId: p.CorrelationId, Repo: p.Repo, ApiClient: p.ApiClient}
114+
eventHandler := EventHandler{CorrelationId: p.CorrelationId, Repo: p.Repo, ApiClient: p.ApiClient, DNSProxy: p.DNSProxy}
115115
eventHandler.ProcessConnectionMap = make(map[string]bool)
116116
eventHandler.ProcessFileMap = make(map[string]bool)
117117
eventHandler.ProcessMap = make(map[string]*Process)

0 commit comments

Comments
 (0)