rule

type AddressRule struct {
	// 这两个是修饰词
	Any      bool
	Negative bool

	IPv4CIDR string
	IPv6CIDR string

	SubRules []*AddressRule

	Env string
	// contains filtered or unexported fields
}

type ContentRule struct {
	Negative bool
	Content  []byte

	// payload config
	Nocase     bool // case insensitive
	Depth      *int
	Offset     *int
	StartsWith bool
	EndsWith   bool
	Distance   *int
	Within     *int
	// no effect
	RawBytes bool
	IsDataAt string
	BSize    string
	DSize    string
	// won't support
	ByteTest string
	// won't support
	ByteMath string
	// won't support
	ByteJump string
	// won't support
	ByteExtract string
	// won't support
	RPC string // sunrpc call
	// won't support
	Replace     []byte
	PCRE        string
	PCREParsed  *pcre.PCRE
	FastPattern bool

	// e.g set,bihinder3
	FlowBits     string
	FlowInt      string
	XBits        string
	NoAlert      bool
	Base64Decode string
	Base64Data   bool

	ExtraFlags []string

	Modifier modifier.Modifier
}

type ContentRuleConfig struct {
	Flow *FlowRule

	Thresholding *ThresholdingConfig

	/* DNS Config*/
	DNS *DNSRule

	/* HTTP Config */
	HTTPConfig *HTTPConfig

	/* IP */
	IPConfig *IPLayerRule

	/* TCP */
	TcpConfig *TCPLayerRule

	/* ICMP */
	IcmpConfig *ICMPLayerRule

	/* Payload Match */
	ContentRules []*ContentRule

	// PrefilterRule is a contentRuleConfig with no more than single config.
	// not implement yet
	PrefilterRule *ContentRuleConfig
}

type DNSRule struct {
	OpcodeNegative bool
	Opcode         int
}

type FlowRule struct {
	ToClient    bool
	Established bool
	ToServer    bool
}

type HTTPConfig struct {
	// deprecated and not implemented
	Uricontent string
	Urilen     *numrange.NumRange
}

type ICMPLayerRule struct {
	IType     *numrange.NumRange // itype
	ICode     *numrange.NumRange // icode
	ICMPId    *int               // icmp_id
	ICMPSeq   *int
	ICMPv6MTU *numrange.NumRange
}

type IPLayerRule struct {
	TTL int
	/*
		IP Option	Description
		rr	Record Route
		eol	End of List
		nop	No Op
		ts	Time Stamp
		sec	IP Security
		esec	IP Extended Security
		lsrr	Loose Source Routing
		ssrr	Strict Source Routing
		satid	Stream Identifier
		any	any IP options are set
	*/
	IPOpts     string
	Sameip     bool
	IPProto    string
	Id         int
	Geoip      string
	FragBits   string
	FragOffset string
	Tos        string
}

type MultipleBufferMatching struct {
	// contains filtered or unexported fields
}

type PortRule struct {
	Any      bool
	Negative bool

	Ports []int

	Rules []*PortRule

	Env string
	// contains filtered or unexported fields
}

type Rule struct {
	Raw                string       `json:"raw"`
	Message            string       `json:"message"`
	MessageChinese     string       `json:"message_chinese"`
	Action             string       `json:"action"`
	Protocol           string       `json:"protocol"`
	SourceAddress      *AddressRule `json:"source_address"`
	DestinationAddress *AddressRule `json:"destination_address"`
	SourcePort         *PortRule    `json:"source_port"`
	DestinationPort    *PortRule    `json:"destination_port"`

	Sid       int
	Rev       int
	Gid       int
	ClassType string
	Reference map[string]string
	Priority  int
	Metadata  []string
	Target    string // src_ip/dest_ip

	ContentRuleConfig *ContentRuleConfig

	RuleUpdatedAt      string `json:"update_at"`
	RuleCreatedAt      string `json:"created_at"`
	Deployment         string `json:"deployment"`
	SignatureSeverity  string `json:"signature_severity"`
	AttackTarget       string `json:"attack_target"`
	FormerCategory     string `json:"former_category"`
	AffectedProduct    string `json:"affected_product"`
	Tag                string `json:"tag"`
	PerformanceImpact  string `json:"performance_impact"`
	MalwareFamily      string `json:"malware_family"`
	MitreTechniqueID   string `json:"mitre_technique_id"`
	MitreTacticID      string `json:"mitre_tactic_id"`
	MitreTechniqueName string `json:"mitre_technique_name"`
	MitreTacticName    string `json:"mitre_tactic_name"`
	Confidence         string `json:"confidence"`
	ReviewedAt         string `json:"reviewed_at"`
	CVE                string `json:"cve"`
}

type RuleSyntaxVisitor struct {
	Raw        []byte
	CompileRaw string
	Errors     []error
	Rules      []*Rule

	// 设置环境变量规则
	Environment map[string]string
}

type TCPLayerRule struct {
	Seq            *int
	Ack            *int
	NegativeWindow bool
	Window         *int
	TCPMss         *numrange.NumRange
	Flags          string
}

type ThresholdingConfig struct {
	ThresholdMode bool
	LimitMode     bool
	Count         int
	Seconds       int
	Track         string
}