actions: Compute the rule association during rules load

This commit is contained in:
Felipe Zimmerle
2020-05-18 15:08:17 -03:00
parent 374203b000
commit eb3e05646d
83 changed files with 842 additions and 415 deletions

View File

@@ -54,7 +54,7 @@ bool InspectFile::evaluate(Transaction *transaction,
const bpstd::string_view &str,
RuleMessage *ruleMessage) {
if (m_isScript) {
return m_lua.run(transaction, str.c_str());
return m_lua.run(transaction, str.to_string());
} else {
FILE *in;
char buff[512];
@@ -64,7 +64,7 @@ bool InspectFile::evaluate(Transaction *transaction,
openstr.append(m_param);
openstr.append(" ");
openstr.append(str.c_str());
openstr.append(str.to_string());
if (!(in = popen(openstr.c_str(), "r"))) {
return false;
}

View File

@@ -30,7 +30,7 @@ namespace operators {
bool Rx::init(const std::string &file, std::string *error) {
if (m_string->m_containsMacro == false) {
if (m_string->containsMacro() == false) {
m_re = new Regex(m_param);
}
@@ -44,11 +44,11 @@ bool Rx::evaluate(Transaction *transaction,
RuleMessage *ruleMessage) {
Regex *re;
if (m_param.empty() && !m_string->m_containsMacro) {
if (m_param.empty() && !m_string->containsMacro()) {
return true;
}
if (m_string->m_containsMacro) {
if (m_string->containsMacro()) {
std::string eparam(m_string->evaluate(transaction));
re = new Regex(eparam);
} else {
@@ -73,12 +73,12 @@ bool Rx::evaluate(Transaction *transaction,
logOffset(ruleMessage, capture.m_offset, capture.m_length);
}
if (!captures.empty()) {
return true;
if (m_string->containsMacro()) {
delete re;
}
if (m_string->m_containsMacro) {
delete re;
if (!captures.empty()) {
return true;
}
return false;

View File

@@ -43,7 +43,7 @@ class Rx : public Operator {
}
~Rx() {
if (m_string->m_containsMacro == false && m_re != NULL) {
if (m_string->containsMacro() == false && m_re != NULL) {
delete m_re;
m_re = NULL;
}

View File

@@ -28,7 +28,7 @@ namespace operators {
bool RxGlobal::init(const std::string &arg, std::string *error) {
if (m_string->m_containsMacro == false) {
if (m_string->containsMacro() == false) {
m_re = new Regex(m_param);
}
@@ -40,11 +40,11 @@ bool RxGlobal::evaluate(Transaction *transaction, RuleWithActions *rule,
const bpstd::string_view& input, RuleMessage *ruleMessage) {
Regex *re;
if (m_param.empty() && !m_string->m_containsMacro) {
if (m_param.empty() && !m_string->containsMacro()) {
return true;
}
if (m_string->m_containsMacro) {
if (m_string->containsMacro()) {
std::string eparam(m_string->evaluate(transaction));
re = new Regex(eparam);
} else {
@@ -69,7 +69,7 @@ bool RxGlobal::evaluate(Transaction *transaction, RuleWithActions *rule,
logOffset(ruleMessage, capture.m_offset, capture.m_length);
}
if (m_string->m_containsMacro) {
if (m_string->containsMacro()) {
delete re;
}

View File

@@ -43,13 +43,14 @@ class RxGlobal : public Operator {
}
~RxGlobal() {
if (m_string->m_containsMacro == false && m_re != NULL) {
if (m_string->containsMacro() == false && m_re != NULL) {
delete m_re;
m_re = NULL;
}
}
bool evaluate(Transaction *transaction, RuleWithActions *rule,
bool evaluate(Transaction *transaction,
RuleWithActions *rule,
const bpstd::string_view& input,
RuleMessage *ruleMessage) override;