mirror of
https://github.com/Vyntral/god-eye.git
synced 2026-05-24 00:24:01 +02:00
3a4c230aa7
Complete architectural overhaul. Replaces the v0.1 monolithic scanner with an event-driven pipeline of auto-registered modules. Foundation (internal/): - eventbus: typed pub/sub, 20 event types, race-safe, drop counter - module: registry with phase-based selection - store: thread-safe host store with per-host locks + deep-copy reads - pipeline: coordinator with phase barriers + panic recovery - config: 5 scan profiles + 3 AI tiers + YAML loader + auto-discovery Modules (26 auto-registered across 6 phases): - Discovery: passive (26 sources), bruteforce, recursive, AXFR, GitHub dorks, CT streaming, permutation, reverse DNS, vhost, ASN, supply chain (npm + PyPI) - Enrichment: HTTP probe + tech fingerprint + TLS appliance ID, ports - Analysis: security checks, takeover (110+ sigs), cloud, JavaScript, GraphQL, JWT, headers (OWASP), HTTP smuggling, AI cascade, Nuclei - Reporting: TXT/JSON/CSV writer + AI scan brief AI layer (internal/ai/ + internal/modules/ai/): - Three profiles: lean (16 GB), balanced (32 GB MoE), heavy (64 GB) - Six event-driven handlers: CVE, JS file, HTTP response, secret filter, multi-agent vuln enrichment, anomaly + executive report - Content-hash cache dedups Ollama calls across hosts - Auto-pull of missing models via /api/pull with streaming progress - End-of-scan AI SCAN BRIEF in terminal with top chains + next actions Nuclei compat layer (internal/nucleitpl/): - Executes ~13k community templates (HTTP subset) - Auto-download of nuclei-templates ZIP to ~/.god-eye/nuclei-templates - Scope filter rejects off-host templates (eliminates OSINT FPs) Operations: - Interactive wizard (internal/wizard/) — zero-flag launch - LivePrinter (internal/tui/) — colorized event stream - Diff engine + scheduler (internal/diff, internal/scheduler) for continuous ASM monitoring with webhook alerts - Proxy support (internal/proxyconf/): http / https / socks5 / socks5h + basic auth Fixes #1 — native SOCKS5 / Tor compatibility via --proxy flag. 185 unit tests across 15 packages, all race-detector clean.
115 lines
2.8 KiB
Go
115 lines
2.8 KiB
Go
// Package scheduler runs a scan at fixed intervals for asm-continuous
|
|
// workflows. Each scan run feeds the diff engine; meaningful changes fan
|
|
// out to registered Alerters.
|
|
//
|
|
// Minimal implementation for Fase 5 skeleton: interval ticker + in-memory
|
|
// snapshot ring. Persistence (SQLite/BoltDB) and sophisticated scheduling
|
|
// (cron syntax, jitter) are follow-ups.
|
|
package scheduler
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"sync"
|
|
"time"
|
|
|
|
"god-eye/internal/diff"
|
|
"god-eye/internal/store"
|
|
)
|
|
|
|
// ScanRun executes a single scan and returns the snapshot hosts.
|
|
type ScanRun func(ctx context.Context) (hosts []*store.Host, err error)
|
|
|
|
// Alerter receives diff reports with meaningful changes.
|
|
type Alerter interface {
|
|
Notify(ctx context.Context, report *diff.Report) error
|
|
Name() string
|
|
}
|
|
|
|
// Scheduler runs ScanRun on an interval.
|
|
type Scheduler struct {
|
|
Target string
|
|
Interval time.Duration
|
|
Run ScanRun
|
|
Alerters []Alerter
|
|
|
|
mu sync.Mutex
|
|
lastSnap []*store.Host
|
|
lastAt time.Time
|
|
}
|
|
|
|
// New constructs a scheduler. Every field is required except Alerters,
|
|
// which defaults to nil (no notifications).
|
|
func New(target string, interval time.Duration, run ScanRun) *Scheduler {
|
|
return &Scheduler{Target: target, Interval: interval, Run: run}
|
|
}
|
|
|
|
// AddAlerter registers an Alerter that receives meaningful diff reports.
|
|
func (s *Scheduler) AddAlerter(a Alerter) { s.Alerters = append(s.Alerters, a) }
|
|
|
|
// Start runs indefinitely until ctx is canceled. The first scan runs
|
|
// immediately, subsequent scans run on s.Interval cadence.
|
|
func (s *Scheduler) Start(ctx context.Context) error {
|
|
if s.Run == nil {
|
|
return errors.New("scheduler: nil Run")
|
|
}
|
|
if s.Interval <= 0 {
|
|
return errors.New("scheduler: Interval must be > 0")
|
|
}
|
|
|
|
// First scan now (so continuous mode produces something immediately).
|
|
s.runOnce(ctx)
|
|
|
|
t := time.NewTicker(s.Interval)
|
|
defer t.Stop()
|
|
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
case <-t.C:
|
|
s.runOnce(ctx)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (s *Scheduler) runOnce(ctx context.Context) {
|
|
if ctx.Err() != nil {
|
|
return
|
|
}
|
|
hosts, err := s.Run(ctx)
|
|
if err != nil {
|
|
// Scan failure is non-fatal for the scheduler itself; the next
|
|
// tick will try again.
|
|
return
|
|
}
|
|
|
|
s.mu.Lock()
|
|
prev := s.lastSnap
|
|
prevAt := s.lastAt
|
|
s.lastSnap = hosts
|
|
s.lastAt = time.Now()
|
|
s.mu.Unlock()
|
|
|
|
// No diff possible on the first run.
|
|
if prev == nil {
|
|
return
|
|
}
|
|
|
|
report := diff.Compute(s.Target, prev, hosts, prevAt, time.Now())
|
|
if !report.HasMeaningful() {
|
|
return
|
|
}
|
|
for _, a := range s.Alerters {
|
|
_ = a.Notify(ctx, report)
|
|
}
|
|
}
|
|
|
|
// LastSnapshot returns the most recent scan snapshot + timestamp. Returns
|
|
// (nil, zero) before the first scan.
|
|
func (s *Scheduler) LastSnapshot() ([]*store.Host, time.Time) {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
return s.lastSnap, s.lastAt
|
|
}
|