1. When verifying artifacts, reported error line number now accounts
for the yaml structure.
2. Verify new case: Defining functions in LET and calling them with
incorrect parameters.
3. Identify calling undefined plugins or functions (previously this
was not a warning because it could have been defined by LET
definitions).
4. Resolving import and export sections when verifying artifacts now
warn about misuse of imported functions which may have changed
their definitions.
5. Uploads are now reported as Dicts instead of an upload object.
6. Dict sorting now implemented.
7. Lots of artifact bugs found by previous static analysis
8. Updated to go 1.24.0
---------
Co-authored-by: snyk-bot <[email protected]>
Since WSS connections are never re-established the nanny will timeout if
no messages were sent within the time (by default 10 min). This will
cause a hard exit.
---------
Co-authored-by: rob-wilco <[email protected]>
Event monitoing and client side flow manager were globals for the
client which caused problems when running multiple clients in the same
process (e.g. `velociraptor gui` command)
The refactor creates separate instaces that live within the executor
allowing multiple different instances to exist simultaneously.
* Also reduced permission requirements for manipulating client event
tables to COLLECT_CLIENT (normally given to the investigator role).
Now it is possible to limit the number of clients enrolled per
second. Also refactored code and fixed pool client so it supports
multiple requests per flow (e.g. Generic.Client.Info).
This change adds support to multiple frontends:
* Added `config frontend` command
A wizard which allows one to add a new frontend to the configuration.
* Frontend service now selects a frontend to take on.
Once frontends are configured, Velociraptor will choose which frontend
it will use at startup time.
* Frontends report heartbeat information in the datastore.
* The Velociraptor server checks for a stale configuration at startup
and will assume this configuration if available.
This change allows multiple frontends to work. Currently only the
mysql datastore allows multi-frontend support because there is no
mechanism for transmitting notifications in the file based store.
* Implemented client side frontend redirect.
Frontends may redirect clients to other frontends using a 301 redirect
response. Clients will then accept this and start talking with the
target frontend.
This allows frontends to loadshed and advertise new frontends to
clients. I.e. clients do not need to know in advance any frontends
they will talk with, they dynamically learn then by following the
redirects.
Once redirected, the client will maintain the same frontend until an
error is encountered, after which it will try every url it knows about
until one works (including previously advertised frontends).
