Method Compile

daemon/rule/operator.go:109–214

Compile translates the operator type field to its callback counterpart

()

// Compile translates the operator type field to its callback counterpart
func (o *Operator) Compile() error {
	if o.isCompiled {
		return nil
	}

	// The only operator Type that can have the Data field empty are:
	// Simple, Regexp, List.
	// For List, because it uses List field and not Data field.
	// For Simple and Regexp, because it can be useful to match on some
	// operands that can in practice be equal to an empty string. This is the
	// case, for example, when a request has a "bare" IP instead of a domain
	// name, therefore DstHost field will be empty. You can match empty string
	// with simple comparison or the "^$" regexp pattern.
	if !(o.Type == Simple || o.Type == Regexp || o.Type == List) &&
		o.Operand != OpTrue && o.Data == "" {
		return fmt.Errorf("Operand %s cannot be empty (%s)", o.Operand, o.Type)
	}

	if o.Type == Simple {
		if o.Operand == OpUserName {
			// TODO: allow regexps, take into account users from containers.
			u, err := user.Lookup(o.Data)
			if err != nil {
				return fmt.Errorf("user.name Operand error: %s", err)
			}
			o.cb = o.simpleCmp
			o.Data = u.Uid
			return nil
		} else if o.Operand == OpProcessHashMD5 || o.Operand == OpProcessHashSHA1 {
			o.cb = o.hashCmp
			return nil
		}

		o.cb = o.simpleCmp

	} else if o.Type == Regexp {
		o.cb = o.reCmp
		if o.Sensitive == false {
			o.Data = strings.ToLower(o.Data)
		}
		re, err := regexp.Compile(o.Data)
		if err != nil {
			return err
		}
		o.re = re
	} else if o.Type == List {
		o.Operand = OpList
	} else if o.Type == Network {
		// Check if the operator's data is an alias present in the cache
		if ipNets, found := AliasIPCache[o.Data]; found {
			o.cb = func(value interface{}) bool {
				ip := value.(net.IP)
				matchFound := false

				for _, ipNet := range ipNets {
					if ipNet.Contains(ip) {
						matchFound = true
						break