rule

Documentation

Index

• Constants
• type Action
• type Duration
• type Loader
  • func NewLoader(liveReload bool) (*Loader, error)
  • func (l *Loader) Add(rule *Rule, saveToDisk bool) error
  • func (l *Loader) Delete(ruleName string) error
  • func (l *Loader) FindFirstMatch(con *conman.Connection) (match *Rule)
  • func (l *Loader) GetAll() map[string]*Rule
  • func (l *Loader) Load(path string) error
  • func (l *Loader) NumRules() int
  • func (l *Loader) Reload() error
  • func (l *Loader) Replace(rule *Rule, saveToDisk bool) error
  • func (l *Loader) Save(rule *Rule, path string) error
• type Operand
• type Operator
  • func NewOperator(t Type, s Sensitive, o Operand, data string, list []Operator) (*Operator, error)
  • func (o *Operator) Compile() error
  • func (o *Operator) Match(con *conman.Connection) bool
  • func (o *Operator) String() string
• type Rule
  • func Create(name string, enabled bool, precedence bool, action Action, duration Duration, ...) *Rule
  • func Deserialize(reply *protocol.Rule) (*Rule, error)
  • func (r *Rule) Match(con *conman.Connection) bool
  • func (r *Rule) Serialize() *protocol.Rule
  • func (r *Rule) String() string
• type Sensitive
• type Type

Constants

const (
	Simple  = Type("simple")
	Regexp  = Type("regexp")
	Complex = Type("complex") // for future use
	List    = Type("list")
	Network = Type("network")
)

Available types

const (
	OpTrue                = Operand("true")
	OpProcessID           = Operand("process.id")
	OpProcessPath         = Operand("process.path")
	OpProcessCmd          = Operand("process.command")
	OpProcessEnvPrefix    = Operand("process.env.")
	OpProcessEnvPrefixLen = 12
	OpUserID              = Operand("user.id")
	OpDstIP               = Operand("dest.ip")
	OpDstHost             = Operand("dest.host")
	OpDstPort             = Operand("dest.port")
	OpDstNetwork          = Operand("dest.network")
	OpProto               = Operand("protocol")
	OpList                = Operand("list")
)

Available operands

const (
	Allow = Action("allow")
	Deny  = Action("deny")
)

Actions of rules

const (
	Once    = Duration("once")
	Restart = Duration("until restart")
	Always  = Duration("always")
)

daemon possible durations

Types

type Action

type Action string

Action of a rule

type Duration

type Duration string

Duration of a rule

type Loader

type Loader struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

Loader is the object that holds the rules loaded from disk, as well as the rules watcher.

func NewLoader

func NewLoader(liveReload bool) (*Loader, error)

NewLoader loads rules from disk, and watches for changes made to the rules files on disk.

func (*Loader) Add

func (l *Loader) Add(rule *Rule, saveToDisk bool) error

Add adds a rule to the list of rules, and optionally saves it to disk.

func (*Loader) Delete

func (l *Loader) Delete(ruleName string) error

Delete deletes a rule from the list. If the duration is Always (i.e: saved on disk), it'll attempt to delete it from disk.

func (*Loader) FindFirstMatch

func (l *Loader) FindFirstMatch(con *conman.Connection) (match *Rule)

FindFirstMatch will try match the connection against the existing rule set.

func (*Loader) GetAll

func (l *Loader) GetAll() map[string]*Rule

GetAll returns the loaded rules.

func (*Loader) Load

func (l *Loader) Load(path string) error

Load loads rules files from disk.

func (*Loader) NumRules

func (l *Loader) NumRules() int

NumRules returns he number of loaded rules.

func (*Loader) Reload

func (l *Loader) Reload() error

Reload reloads the rules from disk.

func (*Loader) Replace

func (l *Loader) Replace(rule *Rule, saveToDisk bool) error

Replace adds a rule to the list of rules, and optionally saves it to disk.

func (*Loader) Save

func (l *Loader) Save(rule *Rule, path string) error

Save a rule to disk.

type Operand

type Operand string

Operand is what we check on a connection.

type Operator

type Operator struct {
	Type      Type       `json:"type"`
	Operand   Operand    `json:"operand"`
	Sensitive Sensitive  `json:"sensitive"`
	Data      string     `json:"data"`
	List      []Operator `json:"list"`
	// contains filtered or unexported fields
}

Operator represents what we want to filter of a connection, and how.

func NewOperator

func NewOperator(t Type, s Sensitive, o Operand, data string, list []Operator) (*Operator, error)

NewOperator returns a new operator object

func (*Operator) Compile

func (o *Operator) Compile() error

Compile translates the operator type field to its callback counterpart

func (*Operator) Match

func (o *Operator) Match(con *conman.Connection) bool

Match tries to match parts of a connection with the given operator.

func (*Operator) String

func (o *Operator) String() string

type Rule

type Rule struct {
	Created    time.Time `json:"created"`
	Updated    time.Time `json:"updated"`
	Name       string    `json:"name"`
	Enabled    bool      `json:"enabled"`
	Precedence bool      `json:"precedence"`
	Action     Action    `json:"action"`
	Duration   Duration  `json:"duration"`
	Operator   Operator  `json:"operator"`
}

Rule represents an action on a connection. The fields match the ones saved as json to disk. If a .json rule file is modified on disk, it's reloaded automatically.

func Create

func Create(name string, enabled bool, precedence bool, action Action, duration Duration, op *Operator) *Rule

Create creates a new rule object with the specified parameters.

func Deserialize

func Deserialize(reply *protocol.Rule) (*Rule, error)

Deserialize translates back the rule received to a Rule object

func (*Rule) Match

func (r *Rule) Match(con *conman.Connection) bool

Match performs on a connection the checks a Rule has, to determine if it must be allowed or denied.

func (*Rule) Serialize

func (r *Rule) Serialize() *protocol.Rule

Serialize translates a Rule to the protocol object

func (*Rule) String

func (r *Rule) String() string

type Sensitive

type Sensitive bool

Sensitive defines if a rule is case-sensitive or not. By default no.

type Type

type Type string

Type is the type of rule. Every type has its own way of checking the user data against connections.