Documentation
¶
Overview ¶
Package scanner is the DPI content scanner: a set of pre-compiled regex signatures applied to HTTP response bodies flowing through SSL-Inspect tunnels, with a per-host bypass list and atomic persistence. It is extracted from the flat package main per ADR-0002; its only Culvert dependencies are the obs / fileutil / hostutil seams.
Patterns are standard Go regex strings. Matching is byte-level. Each match is bounded by a timeout to prevent ReDoS from pathological patterns or input.
Index ¶
- func MatchRegexWithTimeout(re *regexp.Regexp, data []byte, timeout time.Duration) bool
- type ContentScanner
- func (s *ContentScanner) Add(pattern string) error
- func (s *ContentScanner) BypassHosts() []string
- func (s *ContentScanner) Enabled() bool
- func (s *ContentScanner) IsBypassHost(host string) bool
- func (s *ContentScanner) List() []string
- func (s *ContentScanner) Load(path string) error
- func (s *ContentScanner) MaxBytes() int64
- func (s *ContentScanner) Path() string
- func (s *ContentScanner) Remove(pattern string) bool
- func (s *ContentScanner) Save()
- func (s *ContentScanner) Scan(data []byte) (string, bool)
- func (s *ContentScanner) Set(patterns []string) error
- func (s *ContentScanner) SetBypassHosts(hosts []string)
- func (s *ContentScanner) SetPath(path string)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MatchRegexWithTimeout ¶
MatchRegexWithTimeout runs re.Match(data) with a deadline. Returns false if the match does not complete in time (ReDoS prevention); on timeout it fails closed (treats a timeout as a suspicious match).
Types ¶
type ContentScanner ¶
type ContentScanner struct {
// contains filtered or unexported fields
}
ContentScanner holds pre-compiled DPI regex patterns and applies them to HTTP response bodies.
func New ¶
func New(maxBytes int64) *ContentScanner
New returns a ContentScanner with the given per-response buffer cap and an empty bypass-host set.
func (*ContentScanner) Add ¶
func (s *ContentScanner) Add(pattern string) error
Add compiles and appends a single pattern.
func (*ContentScanner) BypassHosts ¶
func (s *ContentScanner) BypassHosts() []string
BypassHosts returns a sorted copy of the current DPI bypass host list. Tier 3.4.
func (*ContentScanner) Enabled ¶
func (s *ContentScanner) Enabled() bool
Enabled returns true when at least one pattern is loaded.
func (*ContentScanner) IsBypassHost ¶
func (s *ContentScanner) IsBypassHost(host string) bool
IsBypassHost reports whether the given host is on the DPI bypass list. Hot path: called once per inspected tunnel response. Tier 3.4.
func (*ContentScanner) List ¶
func (s *ContentScanner) List() []string
List returns a snapshot of all raw pattern strings.
func (*ContentScanner) Load ¶
func (s *ContentScanner) Load(path string) error
Load reads a JSON array of regex strings (legacy format) or a dpiContentFile envelope ({patterns, bypass_hosts}) from path. If the file does not exist, Load succeeds (empty scanner — no patterns active).
func (*ContentScanner) MaxBytes ¶
func (s *ContentScanner) MaxBytes() int64
MaxBytes returns the per-response buffering cap.
func (*ContentScanner) Path ¶
func (s *ContentScanner) Path() string
Path returns the configured persistence file path ("" when unset).
func (*ContentScanner) Remove ¶
func (s *ContentScanner) Remove(pattern string) bool
Remove deletes the first occurrence of pattern from the list. Returns true if a pattern was removed.
func (*ContentScanner) Save ¶
func (s *ContentScanner) Save()
Save persists the current pattern list and bypass host list to the configured file path. Uses an atomic write (tmp + rename) so a crash never leaves a partial file. No-op if no path is configured. Writes the envelope format when bypass hosts are present, otherwise the legacy array format so existing tooling keeps working. Tier 3.4.
func (*ContentScanner) Scan ¶
func (s *ContentScanner) Scan(data []byte) (string, bool)
Scan checks data against all compiled patterns. Returns the first matching raw pattern string and true, or ("", false). Each regex match is bounded by dpiRegexTimeout to prevent ReDoS hangs.
func (*ContentScanner) Set ¶
func (s *ContentScanner) Set(patterns []string) error
Set atomically replaces the full pattern list. Returns an error if any pattern fails to compile; on error the existing patterns are unchanged.
func (*ContentScanner) SetBypassHosts ¶
func (s *ContentScanner) SetBypassHosts(hosts []string)
SetBypassHosts atomically replaces the DPI bypass host list. Hosts are lower-cased and trimmed. Tier 3.4.
func (*ContentScanner) SetPath ¶
func (s *ContentScanner) SetPath(path string)
SetPath sets the persistence file path without loading from it. Used by the test suite (and any caller wanting Save to target a specific file) in place of reaching into the unexported field after the ADR-0002 extraction.
Source Files