NAME

ThreatNet::Filter::Chain - Create a chain of ThreatNet filters

SYNOPSIS

    # After stripping junk ips, pass events through a Threat Cache,
    # and then keep only the events that have occured in an IP range
    # that we are responsible for.
    my $Chain = ThreatNet::Filter::Chain->new(
        ThreatNet::Filter::Junk->new,
        ThreatNet::Filter::ThreatCache->new,
        ThreatNet::Filter::Network->new( '202.123.123.0/24' ),
        );
    
    sub process_message {
        my $Message = shift;
        
        unless ( $Chain->keep($Message) ) {
                return;
        }
        
        print "Threat spotted in our network at " . $Message->ip . "\n";
    }

DESCRIPTION

ThreatNet::Filter::Chain lets you create filters that represent an entire chain of filters. ThreatNet::Message objects are checked against each individual filter in the same order.

A message must pass the keep method of each filter to move down the chain. If a message is rejected at a point in chain, filters further down the chain will not see them. This is mainly of importance to stateful filters such as ThreatNet::Filter::ThreatCache.

It is assumed you don't actual care which filter rejects a message, and as such there is no way to tell this :)

METHODS

The methods are the same as for the parent ThreatNet::Filter class, but with a change to the new constructor.

new $Filter [, $Filter, ... ]

The new constructor takes a set of (1 or more) ThreatNet::Filter objects, and creates a Filter object that acts as a "short-cutting logical AND" combination of them.

Returns a new ThreatNet::Filter::Chain object, or undef if not provided with the correct params.

keep $Message

The keep method takes a single ThreatNet::Message object and checks it against each of the child filters in turn, short-cutting if any of them does not want to keep the message.

One small note - The keep method returns exactly the same false value it recieves from the child filter, whether that is normal false or undef.

Returns true if you should keep the message, or false to discard.

SUPPORT

All bugs should be filed via the bug tracker at

http://rt.cpan.org/NoAuth/ReportBug.html?Queue=ThreatNet-Filter

For other issues, or commercial enhancement and support, contact the author

AUTHORS

Adam Kennedy <adamk@cpan.org>

SEE ALSO

http://ali.as/threatnet/, ThreatNet::Filter

COPYRIGHT

Copyright (c) 2005 Adam Kennedy. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

The full text of the license can be found in the LICENSE file included with this module.