rule

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 15, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ValidateRuleDirectory

func ValidateRuleDirectory(directory string) (errs []error, fatalErr error)

ValidateRuleDirectory 严格验证规则目录下的所有规则文件。

行为: - 遍历目录中的所有 YAML 规则文件 - 对每个文件调用 LoadRuleStrict 收集 YAML/Matcher 的所有错误 - 不会中断整个遍历,所有问题都会被返回

fatalErr 仅在目录本身不可访问等致命场景下返回; errs 列出所有规则文件级别的问题,用于 validate 模式报告。

Types

type CompiledRule added in v1.7.0

type CompiledRule struct {
	Source  *Rule
	Runtime *Rule
}

CompiledRule is the runtime representation of a YAML Rule. The source Rule is retained for metadata and extraction, while the rule set owns only compiled runtime entries.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager 规则管理器,实现单例模式和热更新

func LoadDefaultRules added in v1.6.18

func LoadDefaultRules(ctx context.Context) (*Manager, error)

LoadDefaultRules ensures the default rule repository exists and loads it.

func NewManager

func NewManager() *Manager

NewManager 创建一个新的规则管理器实例

func NewManagerWithPath

func NewManagerWithPath(path string) (*Manager, error)

NewManagerWithPath 创建一个新的规则管理器实例并加载指定路径的规则

func (*Manager) FindRuleByName

func (m *Manager) FindRuleByName(name string) *Rule

FindRuleByName 根据名称查找规则

func (*Manager) GetLastLoadTime

func (m *Manager) GetLastLoadTime() time.Time

GetLastLoadTime 获取最后加载时间

func (*Manager) GetRuleSet added in v1.7.0

func (m *Manager) GetRuleSet() *RuleSet

GetRuleSet returns the latest immutable rule snapshot.

func (*Manager) IsLoaded

func (m *Manager) IsLoaded() bool

IsLoaded 判断规则库是否已加载

func (*Manager) LoadRules

func (m *Manager) LoadRules(path string) error

LoadRules 加载规则库

func (*Manager) ReloadRules

func (m *Manager) ReloadRules() error

ReloadRules 重新加载规则库

type MatchPartGetter

type MatchPartGetter func(part string, CaseSensitive bool) string

MatchPartGetter 定义了获取匹配部分的函数类型 CaseSensitive 大小写敏感

type MatchResult

type MatchResult struct {
	Rule      *Rule             // 匹配到的规则
	Extracted map[string]string // 提取的字段值
}

MatchResult 表示匹配结果

func (MatchResult) IsPlugin

func (m MatchResult) IsPlugin() bool

type Plugin

type Plugin struct {
	Path string `yaml:"path" json:"path,omitempty"`
}

type Rule

type Rule struct {
	Name              string `json:"name,omitempty"`
	Service           string `yaml:"service" json:"service,omitempty"`
	MatchersCondition string `yaml:"matchers-condition" json:"matchers_condition,omitempty"`
	// 组件太多  采用层级匹配 优化匹配速度
	Require  []string               `json:"require,omitempty"`
	Matchers []*matchers.Matcher    `json:"matchers,omitempty"`
	Plugins  []*Plugin              `yaml:"plugins"`
	Cpe      map[string]interface{} `yaml:"cpe" json:"cpe,omitempty"`
}

func LoadRule

func LoadRule(filename string) ([]*Rule, error)

func LoadRuleStrict

func LoadRuleStrict(filename string) ([]*Rule, []error)

LoadRuleStrict 与 LoadRule 类似,但用于严格校验: - 收集 YAML 解析错误 - 收集 matcher 编译错误 返回规则和累积错误(如果有)。

func (*Rule) Match

func (r *Rule) Match(getMatchPart MatchPartGetter) (bool, map[string]string)

type RuleSet added in v1.7.0

type RuleSet struct {
	Rules map[string][]*CompiledRule `yaml:"-"`
}

Finger 根据协议分组

func NewRuleSet added in v1.7.0

func NewRuleSet() *RuleSet

func ScanRuleDirectory

func ScanRuleDirectory(directory string) (*RuleSet, error)

func (RuleSet) AddRules added in v1.7.0

func (f RuleSet) AddRules(rules []*Rule)

func (RuleSet) Match added in v1.7.0

func (f RuleSet) Match(service string, getMatchPart MatchPartGetter) []*MatchResult

Match 执行指纹匹配并返回包含规则的匹配结果

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL