rules

Documentation

Index

• Variables
• func ClearRules()
• func LoadRuleFromFile(templatesFS fs.FS, filePath string) error
• type MatchersCondition
• type Rule
  • func GetProductRules(product string) []*Rule
  • func (rule *Rule) Match(execution *core.Execution, detection *core.Detection) (bool, error)
• type RuleHttp
  • func (http *RuleHttp) Match(execution *core.Execution, detection *core.Detection) (bool, error)
• type RuleHttpMatcher
  • func (matcher *RuleHttpMatcher) Match(asset *assets.Asset) bool
• type RuleHttpMatcherPart
• type RuleHttpMatcherType
• type RuleHttpMethod
• type RuleInfo

Variables

var Rules = make(map[string][]*Rule, 0)

Functions

func ClearRules

func ClearRules()

func LoadRuleFromFile

func LoadRuleFromFile(templatesFS fs.FS, filePath string) error

Types

type MatchersCondition

type MatchersCondition string

const (
	MatchersConditionAnd MatchersCondition = "and"
	MatchersConditionOr  MatchersCondition = "or"
)

type Rule

type Rule struct {
	Name       string              `yaml:"-"`
	Info       RuleInfo            `yaml:"info"`
	Version    string              `yaml:"version" validate:"required"`
	Http       []RuleHttp          `yaml:"http" validate:"dive"`
	Constraint *semver.Constraints `yaml:"-"`
}

func GetProductRules

func GetProductRules(product string) []*Rule

func (*Rule) Match

func (rule *Rule) Match(execution *core.Execution, detection *core.Detection) (bool, error)

type RuleHttp

type RuleHttp struct {
	Method            RuleHttpMethod    `yaml:"method" validate:"required,oneof=GET"`
	Path              string            `yaml:"path" validate:"required"`
	MatchersCondition MatchersCondition `yaml:"matchers-condition" validate:"required,oneof=and or"`
	Matchers          []RuleHttpMatcher `yaml:"matchers" validate:"required,min=1,dive"`
}

func (*RuleHttp) Match

func (http *RuleHttp) Match(execution *core.Execution, detection *core.Detection) (bool, error)

type RuleHttpMatcher

type RuleHttpMatcher struct {
	Type   RuleHttpMatcherType `yaml:"type" validate:"required,oneof=word regex status"`
	Part   RuleHttpMatcherPart `yaml:"part" validate:"required_if=Type word,required_if=Type regex,len=0|oneof=body"`
	Word   string              `yaml:"word" validate:"required_if=Type word"`
	Regex  string              `yaml:"regex" validate:"required_if=Type regex"`
	Status int                 `yaml:"status" validate:"required_if=Type status,gte=0,lte=999"`
}

func (*RuleHttpMatcher) Match

func (matcher *RuleHttpMatcher) Match(asset *assets.Asset) bool

type RuleHttpMatcherPart

type RuleHttpMatcherPart string

const (
	RuleHttpMatcherPartBody RuleHttpMatcherPart = "body"
)

type RuleHttpMatcherType

type RuleHttpMatcherType string

const (
	RuleHttpMatcherTypeWord   RuleHttpMatcherType = "word"
	RuleHttpMatcherTypeRegex  RuleHttpMatcherType = "regex"
	RuleHttpMatcherTypeStatus RuleHttpMatcherType = "status"
)

type RuleHttpMethod

type RuleHttpMethod string

const (
	RuleHttpMethodGet RuleHttpMethod = "GET"
)

type RuleInfo

type RuleInfo struct {
	Product string `yaml:"product" validate:"required"`
	Author  string `yaml:"author"`
}