gonids

type Absent struct {
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	Transforms    Transforms
	OrElse        bool
}

type ByteMatch struct {
	// DataPosition defaults to pkt_data state, can be modified to apply to file_data, base64_data locations.
	// This value will apply to all following contents, to reset to default you must reset DataPosition during processing.
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	// Kind is a specific operation type we're taking.
	Kind byteMatchType
	// Negate indicates negation of a value, currently only used for isdataat.
	Negate bool
	// A variable name being extracted by byte_extract.
	Variable string
	// Number of bytes to operate on. "bytes to convert" in Snort Manual. This can be an int, or a var from byte_extract.
	NumBytes string
	// Operator for comparison in byte_test.
	Operator string
	// Value to compare against using byte_test.
	Value string
	// Offset within given buffer to operate on.
	Offset string
	// Other specifics required for jump/test here. This might make sense to pull out into a "ByteMatchOption" later.
	Options []string
}

type Content struct {
	// DataPosition defaults to pkt_data state, can be modified to apply to file_data, base64_data locations.
	// This value will apply to all following contents, to reset to default you must reset DataPosition during processing.
	DataPosition DataPos
	// FrameName holds the frame name when DataPosition is framePos (e.g. "dns.pdu" for frame:dns.pdu;).
	FrameName string
	// DataDirection holds an optional sticky buffer direction modifier ("to_server" or "to_client").
	DataDirection string
	// FastPattern settings for the content.
	FastPattern FastPattern
	// Pattern is the pattern match of a content (e.g. HTTP in content:"HTTP").
	Pattern []byte
	// Negate is true for negated content match.
	Negate bool
	// Options are the option associated to the content (e.g. http_header).
	Options []*ContentOption
	// Transforms is the list of transforms attached to this content (sticky buffer).
	Transforms Transforms
}

type ContentOption struct {
	// Name is the name of the option (e.g. offset).
	Name string
	// Value is the value associated to the option, default to "" for option without value.
	Value string
}

type DataPos int

type DataRep struct {
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	Transforms    Transforms
	Name          string
	Operator      string
	Value         int
	Options       []string
}

type Dataset struct {
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	Transforms    Transforms
	Cmd           string
	Name          string
	Options       []string
}

type DetectionFilter struct {
	Track    string
	Count    int
	Seconds  int
	UniqueOn string
}

type FastPattern struct {
	Enabled bool
	Only    bool
	Offset  int
	Length  int
}

type Flowbit struct {
	Action string
	Value  string
}

type Flowint struct {
	Name     string
	Modifier string
	Value    string
}

type LenMatch struct {
	// DataPosition defaults to pkt_data state, can be modified to apply to file_data, base64_data locations.
	// This value will apply to all following contents, to reset to default you must reset DataPosition during processing.
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	Kind          lenMatchType
	Min           int
	Max           int
	Num           int
	Operator      string
	Options       []string
}

type Matchers []orderedMatcher

type Metadata struct {
	Key   string
	Value string
}

type Metadatas []*Metadata

type Network struct {
	NegateNets  bool     // Negate the full set of Networks.
	Nets        []string // Currently just []string because these can be variables $HOME_NET, not a valid IPNet.
	NegatePorts bool     // Negate the full set of ports.
	Ports       []string // Currently just []string because these can be variables $HTTP_PORTS, not just ints.
}

type PCRE struct {
	// DataPosition defaults to pkt_data state, can be modified to apply to file_data, base64_data locations.
	// This value will apply to all following contents, to reset to default you must reset DataPosition during processing.
	DataPosition  DataPos
	FrameName     string
	DataDirection string
	Pattern       []byte
	Negate        bool
	Options       []byte
	Transforms    Transforms
}

type Reference struct {
	// Type is the system name for the reference: (url, cve, md5, etc.)
	Type string
	// Value is the identifier in the system: (address, cvd-id, hash)
	Value string
}

type Requires struct {
	Version  [][]VersionConstraint
	Features []string
	Keywords []string
}

type Rule struct {
	// Disbled identifies if the rule is disabled/commented out.
	Disabled bool
	// Action is the action the rule will take (alert, pass, drop, etc.).
	Action string
	// Protocol is the protocol the rule looks at.
	Protocol string
	// Source is the address and ports for the source of the traffic.
	Source Network
	// Destination is the address and ports for the source of the traffic.
	Destination Network
	// Bidirectional indicates the directionality of a rule (-> or <>).
	Bidirectional bool
	// Transactional indicates the rule uses the transactional direction operator (=>).
	Transactional bool
	// SID is the identifier of the rule.
	SID int
	// Revision is the revision of the rule.
	Revision int
	// Description is the msg field of the rule.
	Description string
	// Target specifies the attack target (src_ip or dest_ip).
	Target string
	// References contains references associated to the rule (e.g. CVE number).
	References []*Reference
	// Contents are all the decoded content matches.
	Tags map[string]string
	// Statements is a slice of string. These items are similar to Tags, but have no value. (e.g. 'sameip;')
	Statements []string
	// TLSTags is a slice of TLS related matches.
	TLSTags []*TLSTag
	// StreamMatch holds stream_size parameters.
	StreamMatch *StreamCmp
	// Threshold holds threshold parameters.
	Threshold *Threshold
	// DetectionFilter holds detection_filter parameters.
	DetectionFilter *DetectionFilter
	// Requires holds Suricata engine/feature/keyword requirements.
	Requires *Requires
	// Metas is a slice of Metadata.
	Metas Metadatas
	// Flowbits is a slice of Flowbit.
	Flowbits []*Flowbit
	// Xbits is a slice of Xbit
	Xbits []*Xbit
	// Flowints is a slice of Flowint
	Flowints []*Flowint
	// Matchers are internally used to ensure relative matches are printed correctly.
	// Make this private before checkin?
	Matchers Matchers
}

type RuleScanner struct {
	IncludeComments bool
	// contains filtered or unexported fields
}

type StreamCmp struct {
	// Direction of traffic to inspect: server, client, both, either.
	Direction string
	// Operator is the comparison operator to apply >, <, !=, etc.
	Operator string
	// TODO: Can this number be a variable, if yes s/int/string.
	// Number is the size to compare against
	Number int
}

type TLSTag struct {
	// Is the match negated (!).
	Negate bool
	// Key holds the thing we're inspecting (tls.version, tls.fingerprint, etc.).
	Key string
	// TODO: Consider string -> []byte and handle hex input.
	// TODO: Consider supporting []struct if we can support things like: tls.version:!1.2,!1.3
	// Value holds the value for the match.
	Value string
}

type Threshold struct {
	Type       string
	Track      string
	Count      int
	Seconds    int
	Multiplier int
}

type Transform struct {
	Name  string
	Value string
}

type Transforms []*Transform

type UnsupportedOptionError struct {
	Rule    *Rule
	Options []string
}

type VersionConstraint struct {
	Operator string
	Version  string
}

type Xbit struct {
	Action string
	Name   string
	Track  string
	// Expire should be an int, default 0 value makes stringer difficult because this is an
	// optional parameter. If we can confirm that this must be > 0 we can convert to int.
	Expire string
}