diff --git a/eventhandler.go b/eventhandler.go index c657c7f..1051338 100644 --- a/eventhandler.go +++ b/eventhandler.go @@ -164,6 +164,11 @@ func printContainerInfo(pid, ppid string) { func (eventHandler *EventHandler) handleNetworkEvent(event *Event) { + // sinkhole is returned in-case of dns-block + if event.IPAddress == StepSecuritySinkHoleIPAddress { + return + } + if !isPrivateIPAddress(event.IPAddress) && // commenting out AzureIPAddress since it should not be called // strings.Compare(event.IPAddress, AzureIPAddress) != 0 && @@ -191,16 +196,10 @@ func (eventHandler *EventHandler) handleNetworkEvent(event *Event) { } else { tool = Tool{Name: image, SHA256: image} // TODO: Set container image checksum } + reverseLookUp := eventHandler.DNSProxy.GetReverseIPLookup(event.IPAddress) - status := "" - matchedPolicy := "" - reason := "" - if eventHandler.DNSProxy.GlobalBlocklist != nil && eventHandler.DNSProxy.GlobalBlocklist.IsIPAddressBlocked(event.IPAddress) { - status = "Dropped" - matchedPolicy = GlobalBlocklistMatchedPolicy - reason = eventHandler.DNSProxy.GlobalBlocklist.BlockedIPAddressReason(event.IPAddress) - } - eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, reverseLookUp, status, matchedPolicy, reason, event.Timestamp, tool) + eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, reverseLookUp, "", "", "", event.Timestamp, tool) + process := "" if image == "" { process = tool.Name diff --git a/go.mod b/go.mod index feee67c..1e7e808 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/jarcoal/httpmock v1.3.0 github.com/miekg/dns v1.1.57 github.com/pkg/errors v0.9.1 - github.com/step-security/armour v1.2.1 + github.com/step-security/armour v1.2.4 ) require ( diff --git a/go.sum b/go.sum index 86e9aec..420ae0d 100644 --- a/go.sum +++ b/go.sum @@ -187,10 +187,8 @@ github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0= github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/step-security/armour v1.2.0 h1:DzGsX0HOWiMJpD8wo5k5bJKohWbjk3WYm6x13UNzsTE= -github.com/step-security/armour v1.2.0/go.mod h1:uopgPKW3HfuP05Wc0QeaN9buiy/XJH2B5HdNuM8sBLE= -github.com/step-security/armour v1.2.1 h1:WFhrnUanh60c+jUXBsEX01jS5pi51Cs28wq//tLiuqU= -github.com/step-security/armour v1.2.1/go.mod h1:uopgPKW3HfuP05Wc0QeaN9buiy/XJH2B5HdNuM8sBLE= +github.com/step-security/armour v1.2.4 h1:061EolSwyzGUVZq9w9rlDOMY5DLF+pd2aLabzls8Po8= +github.com/step-security/armour v1.2.4/go.mod h1:uopgPKW3HfuP05Wc0QeaN9buiy/XJH2B5HdNuM8sBLE= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=