Skip to content

Generate flows

Ghost User requested to merge dissect into introsp-struct

Start the infrastructure to generate flows out of packages, link them to the flows and pass verdicts on the whole flows. Also report the flows to the socket where a user can connect. This is useful for testing of other parts, like the aggregator. However, as we are missing the actual part where we assign packets to existing flows and start a new flow for each packet, there's no practical use of this yet. The info about the flow is also a bit lacking.

If you want to test it, run the launch script as user. A socket socket is created, you can connect there. It outputs the JSON infos about the flows, handles connection/disconnection/stuck connection, etc. It doesn't expect any data to be written to the socket (but reads them and throws them away anyway, to make sure the kernel buffers don't overflow if someone writes them by accident).

The automagic JSON serializer may look a bit magical, but it's nothing new, it's similar to the magic already present in previous branches.

Note that the target branch is selected so the diff is correct. It is expected introsp-struct gets reviewed and merged first and we would merge to master then.

Merge request reports