pub struct BehaviorTracker { /* private fields */ }Expand description
The reference BehaviorTracker’s in-memory return-pattern windows.
The redis-free fallback: pattern_key -> client_ip -> timestamps,
with the same sliding-window arithmetic (len(timestamps) > threshold).
Implementations§
Source§impl BehaviorTracker
impl BehaviorTracker
Sourcepub fn track_return_pattern(
&mut self,
endpoint_id: &str,
client_ip: &str,
status: u16,
body_prefix: Option<&[u8]>,
rule: &BehaviorRule,
max_inspect_bytes: usize,
now: SystemTime,
) -> bool
pub fn track_return_pattern( &mut self, endpoint_id: &str, client_ip: &str, status: u16, body_prefix: Option<&[u8]>, rule: &BehaviorRule, max_inspect_bytes: usize, now: SystemTime, ) -> bool
track_return_pattern: record one response observation for
(endpoint_id, client_ip) when the response matches the rule’s
pattern, and answer whether the rule tripped
(len(timestamps) > threshold inside the rule’s window).
status and body_prefix are the response facts: body_prefix is
the caller’s capture bounded by the inspect-bytes budget and only
read when the pattern needs the body and the caller has
behavior_scan_response_body enabled. now is the caller’s clock
(the reference time.time() float); SystemTime converts via
unix_now.
Sourcepub fn check_response_pattern(
&mut self,
status: u16,
body_prefix: Option<&[u8]>,
pattern: &str,
max_inspect_bytes: usize,
) -> Option<bool>
pub fn check_response_pattern( &mut self, status: u16, body_prefix: Option<&[u8]>, pattern: &str, max_inspect_bytes: usize, ) -> Option<bool>
_check_response_pattern: Some(true/false) when the pattern was
evaluated, None when it could not be (a body pattern while no
body prefix was captured).
Sourcepub fn dispatch_action(
rule: &BehaviorRule,
client_ip: &str,
passive_mode: bool,
) -> BehaviorAction
pub fn dispatch_action( rule: &BehaviorRule, client_ip: &str, passive_mode: bool, ) -> BehaviorAction
BehaviorActionDispatchMixin.apply_action: passive mode only logs
(so BehaviorAction::LoggedOnly), active mode bans with the rule
duration override (else the reference 3600s default) or reduces to
a note. The caller applies the ban to its IP-ban store; the
reference ban reason is behavioral_violation.