filter

type Action ¶ added in v1.0.0

type Action int

Action represents the action to take when a rule matches

const (
	ActionLog Action = iota
	ActionDrop
)

func (a Action) String() string

type AddressPredicate ¶ added in v1.0.0

type AddressPredicate struct {
	Direction string   // source, destination
	Addresses []string // IP addresses or CIDR
	Ports     []uint16 // optional ports
}

AddressPredicate matches IP addresses or CIDR ranges

type AnyPredicate ¶ added in v1.0.0

type AnyPredicate struct{}

AnyPredicate matches any event (catch-all)

type BinaryExpr ¶ added in v1.0.0

type BinaryExpr struct {
	Op    BinaryOp
	Left  ExprNode
	Right ExprNode
}

BinaryExpr represents a binary expression (AND, OR)

type BinaryOp ¶ added in v1.0.0

type BinaryOp int

const (
	OpAnd BinaryOp = iota
	OpOr
)

type CompiledRule ¶ added in v1.0.0

type CompiledRule struct {
	Rule      *Rule
	Predicate PredicateFunc
	RuleText  string
}

CompiledRule represents a parsed and compiled filter rule

type ExprNode ¶ added in v1.0.0

type ExprNode interface {
	// contains filtered or unexported methods
}

ExprNode represents a node in the expression AST

type Filter ¶

type Filter struct {
	Rules []CompiledRule
}

Filter represents a compiled set of filter rules

func NewFilter(ruleStrings []string) (*Filter, error)

func (f *Filter) Evaluate(event conntrack.Event) (bool, bool, int)

type Lexer ¶ added in v1.0.0

type Lexer struct {
	// contains filtered or unexported fields
}

func NewLexer(input string) *Lexer

func (l *Lexer) NextToken() (Token, error)

type NetworkPredicate ¶ added in v1.0.0

type NetworkPredicate struct {
	Direction string   // source, destination
	Networks  []string // LOCAL, PRIVATE, PUBLIC, MULTICAST
}

NetworkPredicate matches network types

type Parser ¶ added in v1.0.0

type Parser struct {
	// contains filtered or unexported fields
}

func NewParser(input string) (*Parser, error)

func (p *Parser) ParseRule() (*Rule, error)

type PortPredicate ¶ added in v1.0.0

type PortPredicate struct {
	Direction string   // source, destination
	Ports     []uint16 // port numbers or ranges
}

PortPredicate matches ports

type Predicate ¶ added in v1.0.0

type Predicate interface {
	ExprNode
	// contains filtered or unexported methods
}

Predicate represents a base predicate

type PredicateFunc ¶ added in v1.0.0

type PredicateFunc func(event conntrack.Event) bool

PredicateFunc is a function that evaluates a predicate against an event

func Compile(expr ExprNode) (PredicateFunc, error)

type ProtocolPredicate ¶ added in v1.0.0

type ProtocolPredicate struct {
	Protocols []string // TCP, UDP
}

ProtocolPredicate matches protocols

type Rule ¶ added in v1.0.0

type Rule struct {
	Action Action
	Expr   ExprNode
}

Rule represents a complete filter rule

type Token ¶ added in v1.0.0

type Token struct {
	Type  TokenType
	Value string
	Pos   int
}

type TokenType ¶ added in v1.0.0

type TokenType int

const (
	TokenEOF TokenType = iota
	TokenIdent
	TokenNumber
	TokenComma
	TokenDash
	TokenSlash
	TokenColon
	TokenDot
	TokenLParen
	TokenRParen
	TokenAnd
	TokenOr
	TokenNot
	TokenLog
	TokenDrop
	TokenEventType
	TokenProtocol
	TokenSource
	TokenDestination
	TokenAddress
	TokenNetwork
	TokenPort
	TokenOn
	TokenAny
)

type TypePredicate ¶ added in v1.0.0

type TypePredicate struct {
	Types []string // NEW, UPDATE, DESTROY
}

TypePredicate matches event types

type UnaryExpr ¶ added in v1.0.0

type UnaryExpr struct {
	Op   UnaryOp
	Expr ExprNode
}

UnaryExpr represents a unary expression (NOT)

type UnaryOp ¶ added in v1.0.0

type UnaryOp int

const (
	OpNot UnaryOp = iota
)