mac resolution

ruleset/expr.go

@@ -191,6 +191,10 @@ func streamInfoToExprEnv(info StreamInfo) map[string]interface{} {
 	m := map[string]interface{}{
 		"id":    info.ID,
 		"proto": info.Protocol.String(),
+		"mac": map[string]string{
+			"src": info.SrcMAC.String(),
+			"dst": info.DstMAC.String(),
+		},
 		"ip": map[string]string{
 			"src": info.SrcIP.String(),
 			"dst": info.DstIP.String(),
@@ -211,7 +215,7 @@ func streamInfoToExprEnv(info StreamInfo) map[string]interface{} {
 
 func isBuiltInAnalyzer(name string) bool {
 	switch name {
-	case "id", "proto", "ip", "port":
+	case "id", "proto", "mac", "ip", "port":
 		return true
 	default:
 		return false