idsrules

Documentation

Index

• type Rule
  • func Parse(buf string) (Rule, error)
  • func ParseReader(reader io.Reader) ([]Rule, error)
• type RuleOption
• type RuleReader
  • func NewRuleReader(reader io.Reader) *RuleReader
  • func (r *RuleReader) Next() (Rule, error)

Types

type Rule

type Rule struct {
	// The raw rule string.
	Raw string

	Enabled bool

	// Header components.
	Action     string
	Proto      string
	SourceAddr string
	SourcePort string
	Direction  string
	DestAddr   string
	DestPort   string

	// List of options in order.
	Options []RuleOption

	// Some options are also pulled out for easy access.
	Msg string
	Sid uint64
	Gid uint64
}

Rule is a struct representing an IDS rule.

func Parse

func Parse(buf string) (Rule, error)

Parse an IDS rule from the provided string buffer.

func ParseReader

func ParseReader(reader io.Reader) ([]Rule, error)

ParseReader parses multiple rules from a reader.

type RuleOption

type RuleOption struct {
	Option string `json:"option"`
	Args   string `json:"args"`
}

RuleOption is a struct representing an IDS rule option.

type RuleReader

type RuleReader struct {
	// contains filtered or unexported fields
}

RuleReader parses rules one by from an underlying reader.

func NewRuleReader

func NewRuleReader(reader io.Reader) *RuleReader

NewRuleReader creates a new RuleReader reading from a reader.

func (*RuleReader) Next

func (r *RuleReader) Next() (Rule, error)

Next returns the next rule read from the reader. Empty lines and commented out lines are skipped. Any other line that doesn't parse as a rule is considered an error.