11#include " signal.hpp"
22
3+ #include < optional>
4+
35namespace loglens {
46namespace {
57
6- AuthSignalKind signal_kind_for_event_type (EventType type) {
7- switch (type) {
8- case EventType::SshFailedPassword:
9- return AuthSignalKind::SshFailedPassword;
10- case EventType::SshInvalidUser:
11- return AuthSignalKind::SshInvalidUser;
12- case EventType::SshFailedPublicKey:
13- return AuthSignalKind::SshFailedPublicKey;
14- case EventType::PamAuthFailure:
15- return AuthSignalKind::PamAuthFailure;
16- case EventType::Unknown:
17- case EventType::SshAcceptedPassword:
18- case EventType::SessionOpened:
19- case EventType::SudoCommand:
20- default :
21- return AuthSignalKind::Unknown;
22- }
23- }
8+ struct SignalMapping {
9+ AuthSignalKind signal_kind = AuthSignalKind::Unknown;
10+ bool counts_as_attempt_evidence = false ;
11+ bool counts_as_terminal_auth_failure = false ;
12+ bool counts_as_sudo_burst_evidence = false ;
13+ };
2414
25- const AuthSignalBehavior* behavior_for_event_type (EventType type , const AuthSignalConfig& config) {
26- switch (type ) {
15+ std::optional<SignalMapping> signal_mapping_for_event ( const Event& event , const AuthSignalConfig& config) {
16+ switch (event. event_type ) {
2717 case EventType::SshFailedPassword:
28- return &config.ssh_failed_password ;
18+ return SignalMapping{
19+ AuthSignalKind::SshFailedPassword,
20+ config.ssh_failed_password .counts_as_attempt_evidence ,
21+ config.ssh_failed_password .counts_as_terminal_auth_failure ,
22+ false };
2923 case EventType::SshInvalidUser:
30- return &config.ssh_invalid_user ;
24+ return SignalMapping{
25+ AuthSignalKind::SshInvalidUser,
26+ config.ssh_invalid_user .counts_as_attempt_evidence ,
27+ config.ssh_invalid_user .counts_as_terminal_auth_failure ,
28+ false };
3129 case EventType::SshFailedPublicKey:
32- return &config.ssh_failed_publickey ;
30+ return SignalMapping{
31+ AuthSignalKind::SshFailedPublicKey,
32+ config.ssh_failed_publickey .counts_as_attempt_evidence ,
33+ config.ssh_failed_publickey .counts_as_terminal_auth_failure ,
34+ false };
3335 case EventType::PamAuthFailure:
34- return &config.pam_auth_failure ;
36+ return SignalMapping{
37+ AuthSignalKind::PamAuthFailure,
38+ config.pam_auth_failure .counts_as_attempt_evidence ,
39+ config.pam_auth_failure .counts_as_terminal_auth_failure ,
40+ false };
41+ case EventType::SudoCommand:
42+ return SignalMapping{
43+ AuthSignalKind::SudoCommand,
44+ false ,
45+ false ,
46+ true };
47+ case EventType::SessionOpened:
48+ if (event.program == " pam_unix(sudo:session)"
49+ return SignalMapping{
50+ AuthSignalKind::SudoSessionOpened,
51+ false ,
52+ false ,
53+ false };
54+ }
55+ return std::nullopt ;
3556 case EventType::Unknown:
3657 case EventType::SshAcceptedPassword:
37- case EventType::SessionOpened:
38- case EventType::SudoCommand:
3958 default :
40- return nullptr ;
59+ return std:: nullopt ;
4160 }
4261}
4362
@@ -48,18 +67,19 @@ std::vector<AuthSignal> build_auth_signals(const std::vector<Event>& events, con
4867 signals.reserve (events.size ());
4968
5069 for (const auto & event : events) {
51- const auto * behavior = behavior_for_event_type (event. event_type , config);
52- if (behavior == nullptr ) {
70+ const auto mapping = signal_mapping_for_event (event, config);
71+ if (!mapping. has_value () ) {
5372 continue ;
5473 }
5574
5675 signals.push_back (AuthSignal{
5776 event.timestamp ,
5877 event.source_ip ,
5978 event.username ,
60- signal_kind_for_event_type (event.event_type ),
61- behavior->counts_as_attempt_evidence ,
62- behavior->counts_as_terminal_auth_failure ,
79+ mapping->signal_kind ,
80+ mapping->counts_as_attempt_evidence ,
81+ mapping->counts_as_terminal_auth_failure ,
82+ mapping->counts_as_sudo_burst_evidence ,
6383 event.line_number });
6484 }
6585
0 commit comments