{"action":"closed","issue":{"url":"https://api.github.com/repos/david415/HoneyBadger/issues/5","labels_url":"https://api.github.com/repos/david415/HoneyBadger/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/david415/HoneyBadger/issues/5/comments","events_url":"https://api.github.com/repos/david415/HoneyBadger/issues/5/events","html_url":"https://github.com/david415/HoneyBadger/issues/5","id":55134632,"number":5,"title":"Add proper injection attack full-take logging.","user":{"login":"david415","id":50611,"avatar_url":"https://avatars.githubusercontent.com/u/50611?v=3","gravatar_id":"","url":"https://api.github.com/users/david415","html_url":"https://github.com/david415","followers_url":"https://api.github.com/users/david415/followers","following_url":"https://api.github.com/users/david415/following{/other_user}","gists_url":"https://api.github.com/users/david415/gists{/gist_id}","starred_url":"https://api.github.com/users/david415/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david415/subscriptions","organizations_url":"https://api.github.com/users/david415/orgs","repos_url":"https://api.github.com/users/david415/repos","events_url":"https://api.github.com/users/david415/events{/privacy}","received_events_url":"https://api.github.com/users/david415/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/david415/HoneyBadger/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/david415/HoneyBadger/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/david415/HoneyBadger/labels/highest%20priority","name":"highest priority","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-01-22T10:03:25Z","updated_at":"2015-02-15T00:28:51Z","closed_at":"2015-02-15T00:28:51Z","body":"\r\nHoneyBadger is designed to be a long running daemon that concurrently processes many long (or short) running TCP connections. SInce we need to perform a full-take on all data and metadata... therefore we must be able to enforce maximum disk quota, memory usage maximum and concurrent connection maximum. In this issue/ticket we are only concerned with enforcing a maximum disk quota. Files written have a max enforced size and total stream contents can be split into many files with a 32 bit integer suffix to order them... called a split-ID.\r\n\r\nUser specifies a target logging directory. HoneyBadger creates (if non-existent) a \"active\" and \"inactive\" subdirectories for active and inactive connections. After a timeout/close/reset the connection data is moved from the active to the inactive directory. The files associated with a connection shall be named flow_id.pseuodo-randomly-generated-32bit-integer-value.split-ID like this:\r\n\r\n192.168.1.1:2345-192.168.1.2:3563.0.0\r\n\r\nfurther suffixes can be added to indicate what kind of data/metadata the file contains about that connection.\r\n\r\nWe need to log several things to disk:\r\n\r\n- full-take log of both TCP reassembled stream directions\r\n- log all the overlap bytes and it's TCP Sequence boundaries\r\n- full packet log; we should log all the packets belonging to this connection to a pcap file\r\n"}}