tree

Documentation

Overview

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

• Constants
• Variables
• func FromRules(rulesList []string) (ruleMap types.RuleMapScanner, err error)
• func LookupID(pkt types.MetaRule) (id []string, err error)
• type Bactracking
  • func NewBactracking(target types.MetaRule) *Bactracking
  • func (bt *Bactracking) Accepted(node nodes.NodeValue) bool
  • func (bt *Bactracking) AddPartial(node nodes.NodeValue)
  • func (bt *Bactracking) Backtrack(node *Tree)
  • func (bt *Bactracking) GetResult() []string
  • func (bt *Bactracking) Solution() bool
• type Tree
  • func GetNodeByType(key string, value interface{}) (*Tree, error)
  • func InsertRule(lvl int, keys []string, rule types.MetaRule) (nodeID *Tree, ok bool, err error)
  • func New(value nodes.NodeValue) *Tree

Constants

const (
	RuleMapBuiltMsg           = "building rules map"
	CompileYaraRuleFailedMsg  = "Mole could not compile a yara rule, because"
	YaraRuleMetadataMsg       = "while getting metadata info from %s got"
	AddingRuleMsg             = "adding rule: proto:%s | src:%s | sport:%s | dst:%s | dport:%s"
	InsertRuleFailedMsg       = "unable to insert rule %s, because"
	NewYaraCompilerMsg        = "while creating yara compiler got"
	CompiledRulesNotFoundMsg  = "unable to get compiled rules"
	WhileGettingNodeByTypeMsg = "while getting node by type got"
	DecisionTreeNotInitMsg    = "decision tree not initialized"
	CreateTreeNodeAtLevelMsg  = "when creating node at level %d with key %s got"
	SolutionNotFoundMsg       = "solution not found"
	BactrackWithNilNode       = "backtracking does not work with nil nodes"
)

Variables

var (
	ErrCompiledRulesNotFound = errors.New(CompiledRulesNotFoundMsg)
	ErrDecisionTreeNotInit   = errors.New(DecisionTreeNotInitMsg)
	ErrSolutionNotFound      = errors.New(SolutionNotFoundMsg)
)

Functions

func FromRules

func FromRules(rulesList []string) (ruleMap types.RuleMapScanner, err error)

FromRules builds the Decision tree from scratch and returns types.RuleMapScanner which is a map that define what Yara rule set execute for each id

func LookupID

func LookupID(pkt types.MetaRule) (id []string, err error)

LookupID search through the Decision tree for a Yara rule that matches with the packet metadata

Types

type Bactracking

type Bactracking struct {
	// contains filtered or unexported fields
}

Bactracking implements the backtracking search

func NewBactracking

func NewBactracking(target types.MetaRule) *Bactracking

NewBactracking returns a new Backtracking object. The argument is the target to search for

func (*Bactracking) Accepted

func (bt *Bactracking) Accepted(node nodes.NodeValue) bool

Accepted check whether the NodeValue is a good candidate for the solution

func (*Bactracking) AddPartial

func (bt *Bactracking) AddPartial(node nodes.NodeValue)

AddPartial adds partial solution using the NodeValue

func (*Bactracking) Backtrack

func (bt *Bactracking) Backtrack(node *Tree)

Backtrack performs the search

func (*Bactracking) GetResult

func (bt *Bactracking) GetResult() []string

GetResult returns the identifier from the `id` node

func (*Bactracking) Solution

func (bt *Bactracking) Solution() bool

Solution returns whether the algorithm has a soluiton

type Tree

type Tree struct {
	// Value is the node's value
	Value nodes.NodeValue
	// Parent points to the parent node
	Parent *Tree
	// Next points to the next node in the same lavel
	Next *Tree
	// Children point to the child node and so the next level in the tree
	Children *Tree
}

Tree implemnts a n-ary tree for storing the decision tree

var (
	// Decision is the decision tree
	Decision *Tree
)

func GetNodeByType

func GetNodeByType(key string, value interface{}) (*Tree, error)

GetNodeByType returns a node based on the type of node

func InsertRule

func InsertRule(lvl int, keys []string, rule types.MetaRule) (nodeID *Tree, ok bool, err error)

InsertRule inserts Yara rule and generates an ID

func New

func New(value nodes.NodeValue) *Tree

New returns a new Tree with a root node