match

Documentation

Index

• func RegisterSuricataRuleLoader(h SuricataRuleLoaderType)
• type Group
  • func NewGroup(opt ...GroupOption) *Group
  • func (g *Group) FeedFrame(raw []byte)
  • func (g *Group) FeedHTTPFlow(src, dst string, srcPort, dstPort int, req *http.Request, rsp *http.Response)
  • func (g *Group) FeedHTTPFlowBytes(req, rsp []byte)
  • func (g *Group) FeedHTTPRequestBytes(reqBytes []byte)
  • func (g *Group) FeedHTTPResponseBytes(rsp []byte)
  • func (g *Group) LoadRule(r *rule.Rule)
  • func (g *Group) LoadRules(r ...*rule.Rule)
  • func (g *Group) LoadRulesWithQuery(query string) error
  • func (g *Group) SetLoader(loader SuricataRuleLoaderType)
  • func (g *Group) Wait()
• type GroupOption
  • func WithGroupOnMatchedCallback(cb func(packet gopacket.Packet, match *rule.Rule)) GroupOption
• type HttpFlow
  • func (h *HttpFlow) ToRequestPacket() []gopacket.Packet
• type Matcher
  • func New(r *rule.Rule) *Matcher
  • func (m *Matcher) Match(flow []byte) bool
  • func (m *Matcher) MatchHTTPFlow(flow *HttpFlow) bool
  • func (m *Matcher) MatchPackage(pk gopacket.Packet) bool
• type SuricataRuleLoaderType

Functions

func RegisterSuricataRuleLoader

func RegisterSuricataRuleLoader(h SuricataRuleLoaderType)

Types

type Group

type Group struct {
	HTTPMatcher     []*sync.Pool
	OrdinaryMatcher []*sync.Pool
	// contains filtered or unexported fields
}

Group is a group of rules

func NewGroup

func NewGroup(opt ...GroupOption) *Group

func (*Group) FeedFrame

func (g *Group) FeedFrame(raw []byte)

func (*Group) FeedHTTPFlow

func (g *Group) FeedHTTPFlow(src, dst string, srcPort, dstPort int, req *http.Request, rsp *http.Response)

func (*Group) FeedHTTPFlowBytes

func (g *Group) FeedHTTPFlowBytes(req, rsp []byte)

func (*Group) FeedHTTPRequestBytes

func (g *Group) FeedHTTPRequestBytes(reqBytes []byte)

func (*Group) FeedHTTPResponseBytes

func (g *Group) FeedHTTPResponseBytes(rsp []byte)

func (*Group) LoadRule

func (g *Group) LoadRule(r *rule.Rule)

func (*Group) LoadRules

func (g *Group) LoadRules(r ...*rule.Rule)

func (*Group) LoadRulesWithQuery

func (g *Group) LoadRulesWithQuery(query string) error

func (*Group) SetLoader

func (g *Group) SetLoader(loader SuricataRuleLoaderType)

func (*Group) Wait

func (g *Group) Wait()

type GroupOption

type GroupOption func(group *Group)

func WithGroupOnMatchedCallback

func WithGroupOnMatchedCallback(cb func(packet gopacket.Packet, match *rule.Rule)) GroupOption

type HttpFlow

type HttpFlow struct {
	ReqInstance *http.Request
	Src         string
	SrcPort     int
	Dst         string
	DstPort     int
	Req         []byte
	Rsp         []byte
	// contains filtered or unexported fields
}

func (*HttpFlow) ToRequestPacket

func (h *HttpFlow) ToRequestPacket() []gopacket.Packet

type Matcher

type Matcher struct {
	// contains filtered or unexported fields
}

func New

func New(r *rule.Rule) *Matcher

func (*Matcher) Match

func (m *Matcher) Match(flow []byte) bool

func (*Matcher) MatchHTTPFlow

func (m *Matcher) MatchHTTPFlow(flow *HttpFlow) bool

func (*Matcher) MatchPackage

func (m *Matcher) MatchPackage(pk gopacket.Packet) bool

type SuricataRuleLoaderType

type SuricataRuleLoaderType func(query string) (chan *rule.Rule, error)