Method ProcessPacket

injection/engine.go:138–225

ProcessPacket evaluates all rules against a packet and returns actions to perform.

(pkt gopacket.Packet, iface string)

// ProcessPacket evaluates all rules against a packet and returns actions to perform.
func (e *Engine) ProcessPacket(pkt gopacket.Packet, iface string) ([]*ActionResult, error) {
	e.mu.RLock()
	defer e.mu.RUnlock()

	// Update stats (atomic - no lock needed)
	e.stats.PacketsProcessed.Add(1)

	// Create injection context
	ctx := NewInjectionContext(pkt, iface)

	var results []*ActionResult

	// Evaluate each rule
	for _, rule := range e.config.Rules {
		if !rule.Enabled || !rule.IsCompiled() {
			continue
		}

		// Determine record type for this rule
		recordType, err := parseRecordType(rule.Type)
		if err != nil {
			continue // Skip rules with invalid types
		}

		// Create audit record for expression evaluation
		record := e.createAuditRecord(ctx, recordType)
		if record == nil {
			continue
		}

		// Evaluate expression
		match, err := filter.EvaluateExpression(rule.GetCompiled(), record)
		if err != nil {
			e.stats.Errors.Add(1)
			continue
		}

		if !match {
			continue
		}

		// Rule matched (atomic for counter, mutex for map)
		e.stats.PacketsMatched.Add(1)
		e.stats.mu.Lock()
		e.stats.RuleMatches[rule.Name]++
		e.stats.mu.Unlock()

		ctx.MatchedRules = append(ctx.MatchedRules, rule.Name)

		// Execute action
		result, err := e.executeAction(ctx, rule)
		if err != nil {
			e.stats.Errors.Add(1)

			if e.eConfig.Verbose {
				fmt.Printf("Error executing action for rule %s: %v\n", rule.Name, err)
			}
			continue