injection

type ARPPacketConfig struct {
	SrcMAC       net.HardwareAddr
	DstMAC       net.HardwareAddr
	SenderMAC    net.HardwareAddr
	SenderIP     net.IP
	TargetMAC    net.HardwareAddr
	TargetIP     net.IP
	Operation    uint16 // layers.ARPRequest or layers.ARPReply
	IsGratuitous bool
}

type ARPSpoofHandler struct{}

type Action string

type ActionHandler interface {
	Execute(ctx *InjectionContext, config map[string]any) (*ActionResult, error)
}

type ActionResult struct {
	// Action is the action that was executed.
	Action Action

	// Success indicates if the action completed successfully.
	Success bool

	// Error contains any error that occurred.
	Error error

	// ModifiedPacket is the modified packet data (for modify actions).
	ModifiedPacket []byte

	// InjectPackets are additional packets to inject.
	InjectPackets [][]byte

	// Drop indicates the original packet should be dropped.
	Drop bool

	// Delay specifies how long to delay the packet.
	Delay time.Duration

	// RuleName is the name of the rule that triggered this action.
	RuleName string

	// Timestamp is when the action was executed.
	Timestamp time.Time

	// Details contains action-specific details for logging.
	Details map[string]any
}

type Config struct {
	// Description provides information about this rule set.
	Description string `yaml:"description"`

	// Rules is the list of injection rules.
	Rules []*Rule `yaml:"rules"`
}

type DNSQueryConfig struct {
	SrcMAC    net.HardwareAddr
	DstMAC    net.HardwareAddr
	SrcIP     net.IP
	DstIP     net.IP
	SrcPort   uint16
	DstPort   uint16 // Usually 53
	QueryID   uint16
	QueryName string
	QueryType layers.DNSType
	TTL       uint8
}

type DNSResponseConfig struct {
	SrcMAC      net.HardwareAddr
	DstMAC      net.HardwareAddr
	SrcIP       net.IP
	DstIP       net.IP
	SrcPort     uint16 // Usually 53
	DstPort     uint16
	QueryID     uint16
	QueryName   string
	QueryType   layers.DNSType
	ResponseIP  net.IP
	ResponseTTL uint32
	TTL         uint8
}

type DNSSpoofHandler struct{}

type DelayHandler struct{}

type Engine struct {
	// contains filtered or unexported fields
}

type EngineConfig struct {
	// RulesPath is the path to rules file or directory.
	RulesPath string

	// QueueNum is the nfqueue number to use.
	QueueNum uint16

	// Interface is the network interface for packet injection.
	Interface string

	// AutoIPTables enables automatic iptables rule configuration.
	AutoIPTables bool

	// IPTablesTarget specifies the iptables target filter (e.g., "-d 192.168.1.0/24").
	IPTablesTarget string

	// Verbose enables verbose logging.
	Verbose bool

	// DryRun if true, evaluates rules but does not actually inject or modify packets.
	DryRun bool

	// LogActions if true, logs all injection actions to a file.
	LogActions bool

	// LogFile is the path to the action log file.
	LogFile string

	// MaxQueueLen is the maximum number of packets to queue.
	MaxQueueLen uint32

	// DefaultAction is the action to take when no rules match.
	DefaultAction Action
}

type EngineStats struct {

	// Atomic counters for high-performance updates
	PacketsProcessed atomic.Uint64
	PacketsMatched   atomic.Uint64
	ActionsExecuted  atomic.Uint64
	PacketsDropped   atomic.Uint64
	PacketsModified  atomic.Uint64
	PacketsInjected  atomic.Uint64
	Errors           atomic.Uint64

	// Per-rule match counts (requires mutex)
	RuleMatches map[string]uint64

	// Per-action counts (requires mutex)
	ActionCounts map[Action]uint64

	// Start time
	StartTime time.Time
	// contains filtered or unexported fields
}

type EngineStatsSnapshot struct {
	PacketsProcessed uint64
	PacketsMatched   uint64
	ActionsExecuted  uint64
	PacketsDropped   uint64
	PacketsModified  uint64
	PacketsInjected  uint64
	Errors           uint64
	RuleMatches      map[string]uint64
	ActionCounts     map[Action]uint64
	StartTime        time.Time
}

type HTTPInjectHeaderHandler struct{}

type HTTPRedirectHandler struct{}

type HTTPSSLStripHandler struct{}

type ICMPPacketConfig struct {
	SrcMAC  net.HardwareAddr
	DstMAC  net.HardwareAddr
	SrcIP   net.IP
	DstIP   net.IP
	Type    layers.ICMPv4TypeCode
	ID      uint16
	Seq     uint16
	Payload []byte
	TTL     uint8
}

type IPTablesBlockHandler struct{}

type IPTablesLogHandler struct{}

type IPTablesRateLimitHandler struct{}

type IPTablesRejectHandler struct{}

type InjectionContext struct {
	// Packet is the decoded gopacket packet.
	Packet gopacket.Packet

	// RawData is the raw packet bytes.
	RawData []byte

	// Timestamp is when the packet was captured.
	Timestamp time.Time

	// Interface is the network interface the packet arrived on.
	Interface string

	// Direction indicates if packet is inbound or outbound.
	Direction PacketDirection

	// Ethernet layer (if present).
	Ethernet *layers.Ethernet

	// IPv4 layer (if present).
	IPv4 *layers.IPv4

	// IPv6 layer (if present).
	IPv6 *layers.IPv6

	// TCP layer (if present).
	TCP *layers.TCP

	// UDP layer (if present).
	UDP *layers.UDP

	// DNS layer (if present).
	DNS *layers.DNS

	// ARP layer (if present).
	ARP *layers.ARP

	// Payload is the application-layer payload.
	Payload []byte

	// AuditRecord is the decoded netcap audit record (if available).
	AuditRecord types.AuditRecord

	// Flow identifier string.
	Flow string

	// MatchedRules contains the names of rules that matched this packet.
	MatchedRules []string
}

type ModifyPayloadHandler struct{}

type NFQueueHandler struct {
	// contains filtered or unexported fields
}

type PacketBuilder struct {
	// Default TTL for IP packets
	DefaultTTL uint8

	// Default window size for TCP packets
	DefaultWindow uint16
}

type PacketDirection int

type RawInjector struct {
	// contains filtered or unexported fields
}

type Rule struct {
	// Name is a unique identifier for the rule.
	Name string `yaml:"name"`

	// Description provides human-readable information about the rule.
	Description string `yaml:"description"`

	// Type specifies which audit record type this rule applies to (e.g., "TCP", "HTTP", "DNS").
	Type string `yaml:"type"`

	// Expression is the expr-lang expression to evaluate against packets.
	Expression string `yaml:"expression"`

	// Action specifies what action to perform when the rule matches.
	Action Action `yaml:"action"`

	// ActionConfig contains action-specific configuration parameters.
	ActionConfig map[string]any `yaml:"action_config"`

	// Enabled determines whether this rule is active.
	Enabled bool `yaml:"enabled"`

	// Priority determines rule evaluation order (higher = evaluated first).
	Priority int `yaml:"priority,omitempty"`

	// StopOnMatch if true, stops evaluating further rules after this one matches.
	StopOnMatch bool `yaml:"stop_on_match,omitempty"`

	// Tags are custom labels for categorizing rules.
	Tags []string `yaml:"tags,omitempty"`
	// contains filtered or unexported fields
}

type TCPFlags struct {
	SYN bool
	ACK bool
	FIN bool
	RST bool
	PSH bool
	URG bool
	ECE bool
	CWR bool
	NS  bool
}

type TCPPacketConfig struct {
	SrcMAC  net.HardwareAddr
	DstMAC  net.HardwareAddr
	SrcIP   net.IP
	DstIP   net.IP
	SrcPort uint16
	DstPort uint16
	Seq     uint32
	Ack     uint32
	Flags   TCPFlags
	Window  uint16
	Payload []byte
	TTL     uint8
}

type TCPRSTHandler struct{}

type UDPPacketConfig struct {
	SrcMAC  net.HardwareAddr
	DstMAC  net.HardwareAddr
	SrcIP   net.IP
	DstIP   net.IP
	SrcPort uint16
	DstPort uint16
	Payload []byte
	TTL     uint8
}