|
|
@@ -8,7 +8,7 @@ import { sortDomains } from '../stable-sort-domain';
|
|
|
import { RuleOutput } from './base';
|
|
|
import picocolors from 'picocolors';
|
|
|
import { normalizeDomain } from '../normalize-domain';
|
|
|
-import { isProbablyIpv4 } from '../is-fast-ip';
|
|
|
+import { isProbablyIpv4, isProbablyIpv6 } from '../is-fast-ip';
|
|
|
|
|
|
type Preprocessed = [domain: string[], domainSuffix: string[], sortedDomainRules: string[]];
|
|
|
|
|
|
@@ -52,6 +52,10 @@ export class RulesetOutput extends RuleOutput<Preprocessed> {
|
|
|
appendArrayFromSet(results, this.processName, i => `PROCESS-NAME,${i}`);
|
|
|
appendArrayFromSet(results, this.processPath, i => `PROCESS-NAME,${i}`);
|
|
|
|
|
|
+ appendArrayFromSet(results, this.sourceIpOrCidr, i => `SRC-IP,${i}`);
|
|
|
+ appendArrayFromSet(results, this.sourcePort, i => `SRC-PORT,${i}`);
|
|
|
+ appendArrayFromSet(results, this.destPort, i => `DEST-PORT,${i}`);
|
|
|
+
|
|
|
appendArrayInPlace(results, this.otherRules);
|
|
|
|
|
|
appendArrayFromSet(results, this.urlRegex, i => `URL-REGEX,${i}`);
|
|
|
@@ -86,6 +90,21 @@ export class RulesetOutput extends RuleOutput<Preprocessed> {
|
|
|
appendArrayFromSet(results, this.processName, i => `PROCESS-NAME,${i}`);
|
|
|
appendArrayFromSet(results, this.processPath, i => `PROCESS-PATH,${i}`);
|
|
|
|
|
|
+ appendArrayFromSet(results, this.sourceIpOrCidr, value => {
|
|
|
+ if (value.includes('/')) {
|
|
|
+ return `SRC-IP-CIDR,${value}`;
|
|
|
+ }
|
|
|
+ if (isProbablyIpv4(value)) {
|
|
|
+ return `SRC-IP-CIDR,${value}/32`;
|
|
|
+ }
|
|
|
+ if (isProbablyIpv6(value)) {
|
|
|
+ return `SRC-IP-CIDR6,${value}/128`;
|
|
|
+ }
|
|
|
+ return '';
|
|
|
+ });
|
|
|
+ appendArrayFromSet(results, this.sourcePort, i => `SRC-PORT,${i}`);
|
|
|
+ appendArrayFromSet(results, this.destPort, i => `DST-PORT,${i}`);
|
|
|
+
|
|
|
// appendArrayInPlace(results, this.otherRules);
|
|
|
|
|
|
appendArrayInPlace(
|
|
|
@@ -127,6 +146,31 @@ export class RulesetOutput extends RuleOutput<Preprocessed> {
|
|
|
domain_keyword: Array.from(this.domainKeywords),
|
|
|
domain_regex: Array.from(this.domainWildcard).map(RuleOutput.domainWildCardToRegex),
|
|
|
ip_cidr,
|
|
|
+ source_ip_cidr: [...this.sourceIpOrCidr].reduce<string[]>((acc, cur) => {
|
|
|
+ if (cur.includes('/')) {
|
|
|
+ acc.push(cur);
|
|
|
+ } else if (isProbablyIpv4(cur)) {
|
|
|
+ acc.push(cur + '/32');
|
|
|
+ } else if (isProbablyIpv6(cur)) {
|
|
|
+ acc.push(cur + '/128');
|
|
|
+ }
|
|
|
+
|
|
|
+ return acc;
|
|
|
+ }, []),
|
|
|
+ source_port: [...this.sourcePort].reduce<number[]>((acc, cur) => {
|
|
|
+ const tmp = Number(cur);
|
|
|
+ if (!Number.isNaN(tmp)) {
|
|
|
+ acc.push(tmp);
|
|
|
+ }
|
|
|
+ return acc;
|
|
|
+ }, []),
|
|
|
+ port: [...this.destPort].reduce<number[]>((acc, cur) => {
|
|
|
+ const tmp = Number(cur);
|
|
|
+ if (!Number.isNaN(tmp)) {
|
|
|
+ acc.push(tmp);
|
|
|
+ }
|
|
|
+ return acc;
|
|
|
+ }, []),
|
|
|
process_name: Array.from(this.processName),
|
|
|
process_path: Array.from(this.processPath)
|
|
|
}]
|