Method Match

daemon/rule/operator.go:336–413

Match tries to match parts of a connection with the given operator.

(con *conman.Connection, hasChecksums bool)

// Match tries to match parts of a connection with the given operator.
func (o *Operator) Match(con *conman.Connection, hasChecksums bool) bool {

	if o.Operand == OpTrue {
		return true
	} else if o.Operand == OpList {
		return o.listMatch(con, hasChecksums)
	} else if o.Operand == OpProcessPath {
		return o.cb(con.Process.Path)
	} else if o.Operand == OpProcessParentPath {
		p := con.Process
		for pp := p.Parent; pp != nil; pp = pp.Parent {
			if o.cb(pp.Path) {
				return true
			}
		}
		return false
	} else if o.Operand == OpProcessCmd {
		return o.cb(strings.Join(con.Process.Args, " "))
	} else if o.Operand == OpDstHost {
		return o.cb(con.DstHost)
	} else if o.Operand == OpDstIP {
		return o.cb(con.DstIP.String())
	} else if o.Operand == OpDstPort {
		return o.cb(strconv.FormatUint(uint64(con.DstPort), 10))
	} else if o.Operand == OpDomainsLists {
		return o.cb(con.DstHost)
	} else if o.Operand == OpIPLists {
		return o.cb(con.DstIP.String())
	} else if o.Operand == OpHashMD5Lists {
		return o.cb(con.Process.Checksums[procmon.HashMD5])
	} else if o.Operand == OpUserID || o.Operand == OpUserName {
		return o.cb(strconv.Itoa(con.Entry.UserId))
	} else if o.Operand == OpDstNetwork {
		return o.cb(con.DstIP)
	} else if o.Operand == OpSrcNetwork {
		return o.cb(con.SrcIP)
	} else if o.Operand == OpNetLists {
		return o.cb(con.DstIP)
	} else if o.Operand == OpDomainsRegexpLists {
		return o.cb(con.DstHost)
	} else if o.Operand == OpIfaceIn {
		if ifname, err := net.InterfaceByIndex(con.Pkt.IfaceInIdx); err == nil {
			return o.cb(ifname.Name)
		}
	} else if o.Operand == OpIfaceOut {
		if ifname, err := net.InterfaceByIndex(con.Pkt.IfaceOutIdx); err == nil {
			return o.cb(ifname.Name)
		}
	} else if o.Operand == OpProcessHashMD5 || o.Operand == OpProcessHashSHA1 {
		ret := true
		if !hasChecksums {
			return ret
		}
		con.Process.RLock()
		for algo := range con.Process.Checksums {
			ret = o.cb(con.Process.Checksums[algo])
			if ret {
				break