mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-14 11:54:01 +08:00
Adel Zaalouk
def7da876c
Native events failed the official OCSF 1.8.0 validator: HTTP Activity emitted is_src_dst_assignment_known, sandbox Process Activity events had no actor, connection_info lacked direction_id, and SSH Activity events named no endpoint. Schema tests missed these because they checked only top-level, non-profile attributes. Add a connection direction enum, require an actor on Process Activity and an endpoint on SSH Activity at compile time, and name the supervisor's SSH server with svc_name and its socket path. Validate against OCSF 1.8.0 only. validate_required_fields and validate_known_fields share one recursive walker that rejects undefined attributes at every level and, for events, attributes from undeclared profiles; objects are validated as objects. Records labelled with another version fail. Vendor tactic and technique so ATT&CK-mapped findings validate, drop the unused v1.7.0 schemas, and make the embedded-schema drift test tolerate CRLF checkouts. Keep it fixed with a per-builder conformance test and a Podman e2e test that runs an L7 policy against a local server and validates the supervisor's real Network, HTTP and SSH Activity JSONL. Top-level container stays unchanged; #4915 tracks it. The schema downgrade is unchanged. Closes #4283 Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
53 lines
1.6 KiB
Rust
53 lines
1.6 KiB
Rust
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
//! OCSF `connection_info` object.
|
|
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
use crate::enums::ConnectionDirectionId;
|
|
|
|
/// OCSF Connection Info object.
|
|
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
|
pub struct ConnectionInfo {
|
|
/// Protocol name (e.g., "tcp", "udp").
|
|
///
|
|
/// Kept as `String` because the OCSF spec defines this as free-form
|
|
/// `string_t`, and sandbox integration passes runtime-dynamic values.
|
|
pub protocol_name: String,
|
|
|
|
/// Connection direction id. Required by the OCSF schema.
|
|
pub direction_id: ConnectionDirectionId,
|
|
|
|
/// Sibling label for `direction_id`.
|
|
pub direction: String,
|
|
}
|
|
|
|
impl ConnectionInfo {
|
|
/// Create connection info with the given protocol and an unknown direction.
|
|
#[must_use]
|
|
pub fn new(protocol: &str) -> Self {
|
|
let direction_id = ConnectionDirectionId::Unknown;
|
|
Self {
|
|
protocol_name: protocol.to_string(),
|
|
direction_id,
|
|
direction: direction_id.to_string(),
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn test_connection_info() {
|
|
let info = ConnectionInfo::new("tcp");
|
|
let json = serde_json::to_value(&info).unwrap();
|
|
assert_eq!(json["protocol_name"], "tcp");
|
|
// Required by the OCSF schema; the direction is not known at these call sites.
|
|
assert_eq!(json["direction_id"], 0);
|
|
assert_eq!(json["direction"], "Unknown");
|
|
}
|
|
}
|