Documentation ¶
Index ¶
- func InspectByte(ctx context.Context, data []byte, inspect Inspector) (bool, error)
- type AND
- type Config
- type Content
- type Default
- type ForEach
- type ForEachOptions
- type IP
- type Inspector
- type JSONSchema
- type JSONValid
- type Length
- type NAND
- type NOR
- type OR
- type Operator
- type Random
- type RegExp
- type Strings
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type AND ¶
type AND struct {
Inspectors []Inspector
}
AND implements the Operator interface and applies the boolean AND logic to configured inspectors.
type Config ¶ added in v0.4.0
Config is used with OperatorFactory to produce new Operators from JSON configurations.
type Content ¶ added in v0.2.0
Content evaluates data by its content (media, MIME) type. When used in Substation pipelines, it is most effective when using processors that change the format of data (e.g., process/gzip). The inspector supports MIME types that follow this specification: https://mimesniff.spec.whatwg.org/.
The inspector has these settings:
Type: media type used during inspection Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
data: [31, 139, 8, 0, 0, 0, 0, 0, 0, 255, 74, 203, 207, 7, 4, 0, 0, 255, 255, 33, 101, 115, 140, 3, 0, 0, 0] == application/x-gzip
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "content", "settings": { "type": "application/x-gzip" } }
type ForEach ¶ added in v0.6.0
type ForEach struct { Options ForEachOptions `json:"options"` Type string `json:"type"` Key string `json:"key"` Negate bool `json:"negate"` }
ForEach evaluates conditions by iterating and applying a condition to each element in a JSON array.
The inspector has these settings:
Options: Condition inspector to be applied to all array elements. Type: Method of combining the results of the conditions evaluated. Must be one of: none: none of the elements must match the condition any: at least one of the elements must match the condition all: all of the elements must match the condition Key: JSON key-value to retrieve for inspection Negate (optional): If set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
When loaded with a factory, the inspector uses this JSON configuration:
{ "options": { "type": "strings", "settings": { "function": "endswith", "expression": "@example.com" } }, "type": "all", "key:": "input", "negate": false }
type ForEachOptions ¶ added in v0.6.0
ForEachOptions contains custom options for the ForEach processor:
Inspector: condition applied to the data
type IP ¶
IP evaluates IP addresses by their type and usage. This inspector uses the standard library's net package to identify the type and usage of the address (more information is available here: https://pkg.go.dev/net#IP).
The inspector has these settings:
Type: IP address type used during inspection. Must be one of: valid: valid address of any type loopback: valid loopback address multicast: valid multicast address multicast_link_local: valid link local multicast address private: valid private address unicast_global: valid global unicast address unicast_link_local: valid link local unicast address unspecified: valid "unspecified" address (e.g., 0.0.0.0, ::) Key (optional): JSON key-value to retrieve for inspection. Negate (optional): If set to true, then the inspection is negated (i.e., true becomes false, false becomes true). Defaults to false.
The inspector supports these patterns:
JSON: {"ip_address":"10.0.0.1"} == private data: 10.0.0.1 == private
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "ip", "settings": { "type": "private" } }
type Inspector ¶
Inspector is the interface shared by all inspector methods.
func InspectorFactory ¶
InspectorFactory returns a configured Inspector from a config. This is the recommended method for retrieving ready-to-use Inspectors.
type JSONSchema ¶
type JSONSchema struct { Schema []struct { Key string `json:"key"` Type string `json:"type"` } `json:"schema"` Negate bool `json:"negate"` }
JSONSchema evaluates JSON objects against a minimal schema parser.
The inspector has these settings:
Schema.Key: JSON key-value to retrieve for inspection Schema.Type: value type used during inspection of the Schema.Key must be one of: string number (float, int) boolean (true, false) json Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
JSON: {"foo":"bar","baz":123} == string,number
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "json_schema", "settings": { "schema": [ { "key": "foo", "type": "string" }, { "key": "bar", "type": "number" } ] } }
type JSONValid ¶
type JSONValid struct {
Negate bool `json:"negate"`
}
JSONValid evaluates JSON objects for validity.
The inspector has these settings:
Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
data: {"foo":"bar","baz":123} == valid foo == invalid
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "json_valid" }
type Length ¶ added in v0.4.0
type Length struct { Function string `json:"function"` Value int `json:"value"` Type string `json:"type"` Key string `json:"key"` Negate bool `json:"negate"` }
Length evaluates data using len functions. This inspector supports evaluating byte and rune (character) length of strings. If a JSON array is input, then the length is evaluated against the number of elements in the array.
The inspector has these settings:
Function: length evaluation function used during inspection must be one of: equals greaterthan lessthan Value: length value used during inspection Type (optional): length type used during inspection must be one of: byte (number of bytes) rune (number of characters) defaults to byte Key (optional): JSON key-value to retrieve for inspection Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
JSON: {"foo":"bar"} == 3 {"foo":["bar","baz","qux"]} == 3 data: bar == 3
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "length", "settings": { "function": "equals", "value": 3 } }
type NAND ¶
type NAND struct {
Inspectors []Inspector
}
NAND implements the Operator interface and applies the boolean NAND logic to configured inspectors.
type NOR ¶
type NOR struct {
Inspectors []Inspector
}
NOR implements the Operator interface and applies the boolean NOR logic to configured inspectors.
type OR ¶
type OR struct {
Inspectors []Inspector
}
OR implements the Operator interface and applies the boolean OR logic to configured inspectors.
type Operator ¶
Operator is the interface shared by all operator methods. Operators apply a series of Inspectors to and verify the state (aka "condition") of data.
func OperatorFactory ¶
OperatorFactory returns a configured Operator from a config. This is the recommended method for retrieving ready-to-use Operators.
type Random ¶ added in v0.4.0
type Random struct{}
Random evaluates data based on a random choice. This inspector uses the standard library's rand package. This is best paired with the drop processor and can be used to integration test new configurations and deployments.
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "random" }
type RegExp ¶
type RegExp struct { Expression string `json:"expression"` Key string `json:"key"` Negate bool `json:"negate"` }
RegExp evaluates data using a regular expression. This inspector uses a regexp cache provided by internal/regexp.
The inspector has these settings:
Expression: regular expression to use during inspection Key (optional): JSON key-value to retrieve for inspection Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
JSON: {"foo":"bar"} == ^bar data: bar == ^bar
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "regexp", "settings": { "expression": "^bar" }, }
type Strings ¶
type Strings struct { Function string `json:"function"` Expression string `json:"expression"` Key string `json:"key"` Negate bool `json:"negate"` }
Strings evaluates data using string functions. This inspector uses the standard library's strings package.
The inspector has these settings:
Function: string evaluation function to use during inspection must be one of: equals contains endswith startswith Expression: substring expression to use during inspection Key (optional): JSON key-value to retrieve for inspection Negate (optional): if set to true, then the inspection is negated (i.e., true becomes false, false becomes true) defaults to false
The inspector supports these patterns:
JSON: {"foo":"bar"} == bar data: bar == bar
When loaded with a factory, the inspector uses this JSON configuration:
{ "type": "strings", "settings": { "function": "endswith", "expression": "bar" } }