mac resolution

ruleset/expr.go

@@ -191,6 +191,10 @@ func streamInfoToExprEnv(info StreamInfo) map[string]interface{} {
 	m := map[string]interface{}{
 		"id":    info.ID,
 		"proto": info.Protocol.String(),
+		"mac": map[string]string{
+			"src": info.SrcMAC.String(),
+			"dst": info.DstMAC.String(),
+		},
 		"ip": map[string]string{
 			"src": info.SrcIP.String(),
 			"dst": info.DstIP.String(),
@@ -211,7 +215,7 @@ func streamInfoToExprEnv(info StreamInfo) map[string]interface{} {
 
 func isBuiltInAnalyzer(name string) bool {
 	switch name {
-	case "id", "proto", "ip", "port":
+	case "id", "proto", "mac", "ip", "port":
 		return true
 	default:
 		return false

ruleset/interface.go

@@ -67,6 +67,7 @@ const (
 type StreamInfo struct {
 	ID               int64
 	Protocol         Protocol
+	SrcMAC, DstMAC   net.HardwareAddr
 	SrcIP, DstIP     net.IP
 	SrcPort, DstPort uint16
 	Props            analyzer.CombinedPropMap