1 /*
2 * Copyright (c) 2002-2010 Balabit
3 * Copyright (c) 1998-2010 Balázs Scheidler
4 *
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2.1 of the License, or (at your option) any later version.
9 *
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
14 *
15 * You should have received a copy of the GNU Lesser General Public
16 * License along with this library; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
18 *
19 * As an additional exemption you are allowed to compile & link against the
20 * OpenSSL libraries as published by the OpenSSL project. See the file
21 * COPYING for details.
22 *
23 */
24
25 #ifndef LOGMATCHER_H_INCLUDED
26 #define LOGMATCHER_H_INCLUDED
27
28 #include "logmsg/logmsg.h"
29 #include "template/templates.h"
30
31 #define LOG_MATCHER_ERROR log_template_error_quark()
32
33 GQuark log_matcher_error_quark(void);
34
35 enum
36 {
37 /* use global search/replace */
38 LMF_GLOBAL = 0x0001,
39 LMF_ICASE = 0x0002,
40 LMF_MATCH_ONLY = 0x0004,
41
42 /* POSIX + PCRE common flags */
43 LMF_NEWLINE= 0x0008,
44 LMF_UTF8 = 0x0010,
45 LMF_STORE_MATCHES = 0x0020,
46 LMF_DISABLE_JIT = 0x0040,
47
48 /* string flags */
49 LMF_SUBSTRING = 0x0080,
50 LMF_PREFIX = 0x0100,
51
52 /* advanced LIBPCRE flags */
53 LMF_DUPNAMES = 0x00080000,
54 };
55
56 typedef struct _LogMatcherOptions
57 {
58 gint flags;
59 gchar *type;
60 } LogMatcherOptions;
61
62 typedef struct _LogMatcher LogMatcher;
63
64 struct _LogMatcher
65 {
66 gint ref_cnt;
67 gint flags;
68 gchar *pattern;
69 gboolean (*compile)(LogMatcher *s, const gchar *re, GError **error);
70 /* value_len can be -1 to indicate unknown length */
71 gboolean (*match)(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len);
72 /* value_len can be -1 to indicate unknown length, new_length can be returned as -1 to indicate unknown length */
73 gchar *(*replace)(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len,
74 LogTemplate *replacement, gssize *new_length);
75 void (*free_fn)(LogMatcher *s);
76 };
77
78 static inline gboolean
log_matcher_compile(LogMatcher * s,const gchar * re,GError ** error)79 log_matcher_compile(LogMatcher *s, const gchar *re, GError **error)
80 {
81 return s->compile(s, re, error);
82 }
83
84 static inline gboolean
log_matcher_match(LogMatcher * s,LogMessage * msg,gint value_handle,const gchar * value,gssize value_len)85 log_matcher_match(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len)
86 {
87 return s->match(s, msg, value_handle, value, value_len);
88 }
89
90 static inline gchar *
log_matcher_replace(LogMatcher * s,LogMessage * msg,gint value_handle,const gchar * value,gssize value_len,LogTemplate * replacement,gssize * new_length)91 log_matcher_replace(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len,
92 LogTemplate *replacement, gssize *new_length)
93 {
94 if (s->replace)
95 return s->replace(s, msg, value_handle, value, value_len, replacement, new_length);
96 return NULL;
97 }
98
99 static inline void
log_matcher_set_flags(LogMatcher * s,gint flags)100 log_matcher_set_flags(LogMatcher *s, gint flags)
101 {
102 s->flags = flags;
103 }
104
105 static inline gboolean
log_matcher_is_replace_supported(LogMatcher * s)106 log_matcher_is_replace_supported(LogMatcher *s)
107 {
108 return s->replace != NULL;
109 }
110
111 LogMatcher *log_matcher_pcre_re_new(const LogMatcherOptions *options);
112 LogMatcher *log_matcher_string_new(const LogMatcherOptions *options);
113 LogMatcher *log_matcher_glob_new(const LogMatcherOptions *options);
114
115 LogMatcher *log_matcher_new(const LogMatcherOptions *options);
116 LogMatcher *log_matcher_ref(LogMatcher *s);
117 void log_matcher_unref(LogMatcher *s);
118
119
120 gboolean log_matcher_options_set_type(LogMatcherOptions *options, const gchar *type);
121 gboolean log_matcher_options_process_flag(LogMatcherOptions *self, const gchar *flag);
122 void log_matcher_options_defaults(LogMatcherOptions *options);
123 void log_matcher_options_init(LogMatcherOptions *options);
124 void log_matcher_options_destroy(LogMatcherOptions *options);
125
126 void log_matcher_pcre_set_nv_prefix(LogMatcher *s, const gchar *prefix);
127
128 #endif
129