Struct Cuckoo 

pub struct Cuckoo;

cuckoo module.

To use the module, the json report must be provided before the scan:

use boreal::module::{Cuckoo, CuckooData};
use boreal::compiler::CompilerBuilder;

let mut compiler = CompilerBuilder::new().add_module(Cuckoo).build();
compiler.add_rules_str(r#"
import "cuckoo"

rule a {
    condition: cuckoo.network.host(/crates.io/)
}"#).unwrap();
let mut scanner = compiler.finalize();

let report = r#"{ "network": { "hosts": ["crates.io"] } }"#;
let cuckoo_data = CuckooData::from_json_report(report).unwrap();
scanner.set_module_data::<Cuckoo>(cuckoo_data);

let result = scanner.scan_mem(b"").unwrap();
assert_eq!(result.rules.len(), 1);

Trait Implementations

impl Debug for Cuckoo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Module for Cuckoo

fn get_name(&self) -> &'static str

Name of the module, used in import clauses.

fn get_static_values(&self) -> HashMap<&'static str, StaticValue>

Static values exported by the module.

fn get_dynamic_types(&self) -> HashMap<&'static str, Type>

Type of the dynamic values exported by the module.

fn setup_new_scan(&self, data_map: &mut ModuleDataMap<'_>)

Setup data when a new scan is started.

fn get_dynamic_values( &self, _ctx: &mut ScanContext<'_, '_, '_>, _values: &mut HashMap<&'static str, Value>, )

Values computed dynamically.

impl ModuleData for Cuckoo

type PrivateData = ()

Private Data to associate with the module.

type UserData = CuckooData

Data that the user can provide to the module.