Documentation
¶
Index ¶
- func CompileExpression(expression string, recordType types.Type) (*vm.Program, error)
- func Contains(slice any, value any) bool
- func ContainsAny(str string, substrs []string) bool
- func CreateEnvironment(record types.AuditRecord) map[string]any
- func DurationSince(ts int64) int64
- func EvaluateExpression(program *vm.Program, record types.AuditRecord) (bool, error)
- func FormatTime(ts int64, format string) string
- func HasKey(m any, key string) bool
- func InSubnet(ip, cidr string) bool
- func IsPrivateIP(ip string) bool
- func IsPublicIP(ip string) bool
- func MatchesPattern(str, pattern string) bool
- func MustCompileExpression(expression string, recordType types.Type) *vm.Program
- func ParsePort(port string) int
- func PortInRange(port, start, end int) bool
- func TimeInRange(ts, start, end int64) bool
- type CompiledFilter
- type FilterHyperscanStatus
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompileExpression ¶
CompileExpression compiles an expr-lang expression for a specific audit record type. The expression has access to all fields of the audit record and helper functions.
func Contains ¶
Contains checks if a slice contains a specific value. Supports []string, []int, and []int32 (common in protobuf).
func ContainsAny ¶
ContainsAny checks if a string contains any of the provided substrings.
func CreateEnvironment ¶
func CreateEnvironment(record types.AuditRecord) map[string]any
CreateEnvironment creates an expression environment from an audit record. This makes all fields of the record accessible in expressions. Note: Helper functions are declared via expr.Function() in CompileExpression() with explicit type signatures.
func DurationSince ¶
DurationSince returns the duration in nanoseconds since a given timestamp.
func EvaluateExpression ¶
EvaluateExpression evaluates a compiled expression against an audit record. Returns true if the record matches the filter, false otherwise.
func FormatTime ¶
FormatTime formats a timestamp (nanoseconds) according to the provided format string. Uses Go's time format layout (e.g., "2006-01-02 15:04:05").
func HasKey ¶
HasKey checks if a map contains a specific key. Supports map[string]string and map[string]interface{}.
func IsPrivateIP ¶
IsPrivateIP checks if an IP address is in a private range.
func IsPublicIP ¶
IsPublicIP checks if an IP address is a public (non-private) address.
func MatchesPattern ¶
MatchesPattern checks if a string matches a regular expression pattern. Compiled regexes are cached to avoid recompilation on repeated calls.
When the binary is built with `-tags hyperscan` and the pattern is one Hyperscan accepts, the boolean answer is taken directly from a per-pattern Hyperscan database (single-pattern block-mode DBs return the same true/false predicate as RE2 for the HS-supported subset of PCRE). Patterns Hyperscan refuses to compile transparently fall through to the existing RE2 cache path so behaviour is preserved.
func MustCompileExpression ¶
MustCompileExpression compiles an expression and panics on error. Useful for static expressions that are known to be valid.
func ParsePort ¶
ParsePort converts a port string to an integer. Returns 0 if the string cannot be parsed.
func PortInRange ¶
PortInRange checks if a port is within a given range (inclusive).
func TimeInRange ¶
TimeInRange checks if a timestamp (nanoseconds) is within a given range.
Types ¶
type CompiledFilter ¶
CompiledFilter wraps a compiled expression program with its record type.
type FilterHyperscanStatus ¶ added in v0.9.1
type FilterHyperscanStatus struct {
Enabled bool `json:"enabled"`
LibVersion string `json:"lib_version"`
PatternsCached int `json:"patterns_cached"`
PatternsHS int `json:"patterns_hyperscan"`
PatternsRE2 int `json:"patterns_re2_only"`
HSDecisions uint64 `json:"hs_decisions"`
HSEarlyExits uint64 `json:"hs_early_exits"`
HSScanErrors uint64 `json:"hs_scan_errors"`
}
FilterHyperscanStatus mirrors the tagged-build type so the web UI handler renders the same JSON schema in both build configurations.
func GetFilterHyperscanStatus ¶ added in v0.9.1
func GetFilterHyperscanStatus() FilterHyperscanStatus
GetFilterHyperscanStatus reports a "disabled" snapshot.
Source Files