2018-06-10 22:50:03 +08:00
|
|
|
package constant
|
|
|
|
|
2023-08-16 11:06:30 +08:00
|
|
|
const (
|
|
|
|
RuleConfigDomain RuleConfig = "DOMAIN"
|
|
|
|
RuleConfigDomainSuffix RuleConfig = "DOMAIN-SUFFIX"
|
|
|
|
RuleConfigDomainKeyword RuleConfig = "DOMAIN-KEYWORD"
|
|
|
|
RuleConfigGeoIP RuleConfig = "GEOIP"
|
|
|
|
RuleConfigIPCIDR RuleConfig = "IP-CIDR"
|
|
|
|
RuleConfigIPCIDR6 RuleConfig = "IP-CIDR6"
|
|
|
|
RuleConfigSrcIPCIDR RuleConfig = "SRC-IP-CIDR"
|
|
|
|
RuleConfigSrcPort RuleConfig = "SRC-PORT"
|
|
|
|
RuleConfigDstPort RuleConfig = "DST-PORT"
|
|
|
|
RuleConfigInboundPort RuleConfig = "INBOUND-PORT"
|
|
|
|
RuleConfigProcessName RuleConfig = "PROCESS-NAME"
|
|
|
|
RuleConfigProcessPath RuleConfig = "PROCESS-PATH"
|
|
|
|
RuleConfigIPSet RuleConfig = "IPSET"
|
|
|
|
RuleConfigRuleSet RuleConfig = "RULE-SET"
|
|
|
|
RuleConfigScript RuleConfig = "SCRIPT"
|
|
|
|
RuleConfigMatch RuleConfig = "MATCH"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Rule Config Type String represents a rule type in configuration files.
|
|
|
|
type RuleConfig string
|
|
|
|
|
2018-06-10 22:50:03 +08:00
|
|
|
// Rule Type
|
|
|
|
const (
|
2018-09-09 15:01:46 +08:00
|
|
|
Domain RuleType = iota
|
|
|
|
DomainSuffix
|
2018-06-10 22:50:03 +08:00
|
|
|
DomainKeyword
|
|
|
|
GEOIP
|
|
|
|
IPCIDR
|
2019-05-09 21:00:29 +08:00
|
|
|
SrcIPCIDR
|
|
|
|
SrcPort
|
|
|
|
DstPort
|
2023-08-03 22:30:08 +08:00
|
|
|
InboundPort
|
2020-07-19 13:17:05 +08:00
|
|
|
Process
|
2022-03-12 19:07:53 +08:00
|
|
|
ProcessPath
|
2023-04-22 20:07:47 +08:00
|
|
|
IPSet
|
2019-02-18 21:53:57 +08:00
|
|
|
MATCH
|
2018-06-10 22:50:03 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
type RuleType int
|
|
|
|
|
2018-06-20 22:41:02 +08:00
|
|
|
func (rt RuleType) String() string {
|
|
|
|
switch rt {
|
2018-09-09 15:01:46 +08:00
|
|
|
case Domain:
|
|
|
|
return "Domain"
|
2018-06-20 22:41:02 +08:00
|
|
|
case DomainSuffix:
|
|
|
|
return "DomainSuffix"
|
|
|
|
case DomainKeyword:
|
|
|
|
return "DomainKeyword"
|
|
|
|
case GEOIP:
|
2019-10-27 21:44:07 +08:00
|
|
|
return "GeoIP"
|
2018-06-20 22:41:02 +08:00
|
|
|
case IPCIDR:
|
|
|
|
return "IPCIDR"
|
2019-05-09 21:00:29 +08:00
|
|
|
case SrcIPCIDR:
|
|
|
|
return "SrcIPCIDR"
|
|
|
|
case SrcPort:
|
|
|
|
return "SrcPort"
|
|
|
|
case DstPort:
|
|
|
|
return "DstPort"
|
2023-08-03 22:30:08 +08:00
|
|
|
case InboundPort:
|
|
|
|
return "InboundPort"
|
2020-07-19 13:17:05 +08:00
|
|
|
case Process:
|
|
|
|
return "Process"
|
2022-03-12 19:07:53 +08:00
|
|
|
case ProcessPath:
|
|
|
|
return "ProcessPath"
|
2023-04-22 20:07:47 +08:00
|
|
|
case IPSet:
|
|
|
|
return "IPSet"
|
2019-02-18 21:53:57 +08:00
|
|
|
case MATCH:
|
2019-10-27 21:44:07 +08:00
|
|
|
return "Match"
|
2018-06-20 22:41:02 +08:00
|
|
|
default:
|
2019-08-26 12:26:14 +08:00
|
|
|
return "Unknown"
|
2018-06-20 22:41:02 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-06-10 22:50:03 +08:00
|
|
|
type Rule interface {
|
|
|
|
RuleType() RuleType
|
2019-10-28 00:02:23 +08:00
|
|
|
Match(metadata *Metadata) bool
|
2018-06-10 22:50:03 +08:00
|
|
|
Adapter() string
|
2018-06-20 22:41:02 +08:00
|
|
|
Payload() string
|
2020-07-27 11:57:55 +08:00
|
|
|
ShouldResolveIP() bool
|
2022-03-12 19:07:53 +08:00
|
|
|
ShouldFindProcess() bool
|
2018-06-10 22:50:03 +08:00
|
|
|
}
|