From 3a17dd33106a8e83d96c50e0522a7373967a6a0f Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sun, 24 Aug 2025 23:08:41 +0200
Subject: [PATCH] feat(aa): add support for advanced network rule.

---
 pkg/aa/network.go                | 68 +++++++++++++++++++++-----------
 pkg/aa/rule_test.go              | 11 ++++++
 pkg/aa/templates/rule/network.j2 | 16 ++++++++
 3 files changed, 73 insertions(+), 22 deletions(-)

diff --git a/pkg/aa/network.go b/pkg/aa/network.go
index d5a2af70b..15dd4385e 100644
--- a/pkg/aa/network.go
+++ b/pkg/aa/network.go
@@ -33,34 +33,54 @@ func init() {
 	}
 }
 
-type AddressExpr struct {
-	Source      string
-	Destination string
-	Port        string
+type LocalAddress struct {
+	IP   string
+	Port string
 }
 
-func newAddressExprFromLog(log map[string]string) AddressExpr {
-	return AddressExpr{
-		Source:      log["laddr"],
-		Destination: log["faddr"],
-		Port:        log["lport"],
+func newLocalAddressFromLog(log map[string]string) LocalAddress {
+	return LocalAddress{
+		IP:   log["laddr"],
+		Port: log["lport"],
 	}
 }
 
-func (r AddressExpr) Compare(other AddressExpr) int {
-	if res := compare(r.Source, other.Source); res != 0 {
-		return res
-	}
-	if res := compare(r.Destination, other.Destination); res != 0 {
+func (r LocalAddress) Compare(other LocalAddress) int {
+	if res := compare(r.IP, other.IP); res != 0 {
 		return res
 	}
 	return compare(r.Port, other.Port)
 }
 
+type PeerAddress struct {
+	IP   string
+	Port string
+	Src  string
+}
+
+func newPeerAddressFromLog(log map[string]string) PeerAddress {
+	return PeerAddress{
+		IP:   log["faddr"],
+		Port: log["fport"],
+		Src:  log["saddr"],
+	}
+}
+
+func (r PeerAddress) Compare(other PeerAddress) int {
+	if res := compare(r.IP, other.IP); res != 0 {
+		return res
+	}
+	if res := compare(r.Port, other.Port); res != 0 {
+		return res
+	}
+	return compare(r.Src, other.Src)
+}
+
 type Network struct {
 	Base
 	Qualifier
-	AddressExpr
+	LocalAddress
+	PeerAddress
 	Domain   string
 	Type     string
 	Protocol string
@@ -90,12 +110,13 @@ func newNetwork(q Qualifier, rule rule) (Rule, error) {
 
 func newNetworkFromLog(log map[string]string) Rule {
 	return &Network{
-		Base:        newBaseFromLog(log),
-		Qualifier:   newQualifierFromLog(log),
-		AddressExpr: newAddressExprFromLog(log),
-		Domain:      log["family"],
-		Type:        log["sock_type"],
-		Protocol:    log["protocol"],
+		Base:         newBaseFromLog(log),
+		Qualifier:    newQualifierFromLog(log),
+		LocalAddress: newLocalAddressFromLog(log),
+		PeerAddress:  newPeerAddressFromLog(log),
+		Domain:       log["family"],
+		Type:         log["sock_type"],
+		Protocol:     log["protocol"],
 	}
 }
 
@@ -135,7 +156,10 @@ func (r *Network) Compare(other Rule) int {
 	if res := compare(r.Protocol, o.Protocol); res != 0 {
 		return res
 	}
-	if res := r.AddressExpr.Compare(o.AddressExpr); res != 0 {
+	if res := r.LocalAddress.Compare(o.LocalAddress); res != 0 {
+		return res
+	}
+	if res := r.PeerAddress.Compare(o.PeerAddress); res != 0 {
 		return res
 	}
 	return r.Qualifier.Compare(o.Qualifier)
diff --git a/pkg/aa/rule_test.go b/pkg/aa/rule_test.go
index ee50532a9..ed6e7043d 100644
--- a/pkg/aa/rule_test.go
+++ b/pkg/aa/rule_test.go
@@ -216,6 +216,17 @@ var (
 			wMerge:    false,
 			wString:   "network netlink raw,",
 		},
+		{
+			name:      "network3",
+			fromLog:   newNetworkFromLog,
+			log:       network3Log,
+			rule:      network3,
+			wValidErr: true,
+			other:     network1,
+			wCompare:  -7,
+			wMerge:    false,
+			wString:   "network dgram ip=127.0.0.1 port=57007 peer=(ip=127.0.0.53, port=53), # failed af match",
+		},
 		{
 			name:     "mount",
 			fromLog:  newMountFromLog,
diff --git a/pkg/aa/templates/rule/network.j2 b/pkg/aa/templates/rule/network.j2
index 6f2503a8b..3694442be 100644
--- a/pkg/aa/templates/rule/network.j2
+++ b/pkg/aa/templates/rule/network.j2
@@ -15,6 +15,22 @@
             {{ " " }}{{ . }}
         {{- end -}}
     {{- end -}}
+    {{- with .LocalAddress.IP -}}
+        {{ " ip=" }}{{ . }}
+    {{- end -}}
+    {{- with .LocalAddress.Port -}}
+        {{ " port=" }}{{ . }}
+    {{- end -}}
+    {{- if and .PeerAddress.IP .PeerAddress.Port -}}
+        {{ " peer=(ip=" }}{{ .PeerAddress.IP }}{{ ", port="}}{{ .PeerAddress.Port }}{{ ")" }}
+    {{- else -}}
+        {{- with .PeerAddress.IP -}}
+            {{ " peer=(ip=" }}{{ . }}{{ ")" }}
+        {{- end -}}
+        {{- with .PeerAddress.Port -}}
+            {{ " peer=(port=" }}{{ . }}{{ ")" }}
+        {{- end -}}
+    {{- end -}}
     {{- "," -}}
     {{- template "comment" . -}}
 {{- end -}}
\ No newline at end of file