1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
/*
* Copyright (c) 2002-2013, 2015 Balabit
* Copyright (c) 1998-2013, 2015 Balázs Scheidler
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 as published
* by the Free Software Foundation, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*
* As an additional exemption you are allowed to compile & link against the
* OpenSSL libraries as published by the OpenSSL project. See the file
* COPYING for details.
*
*/
#include "correlation-key.h"
#include "logmsg/logmsg.h"
#include <string.h>
/*********************************************************
* CorrelationKey, is the key in the state hash table
*********************************************************/
guint
correlation_key_hash(gconstpointer k)
{
CorrelationKey *key = (CorrelationKey *) k;
guint hash;
hash = (key->scope << 30);
switch (key->scope)
{
case RCS_PROCESS:
hash += g_str_hash(key->pid);
case RCS_PROGRAM:
hash += g_str_hash(key->program);
case RCS_HOST:
hash += g_str_hash(key->host);
case RCS_GLOBAL:
break;
default:
g_assert_not_reached();
break;
}
return hash + g_str_hash(key->session_id);
}
gboolean
correlation_key_equal(gconstpointer k1, gconstpointer k2)
{
CorrelationKey *key1 = (CorrelationKey *) k1;
CorrelationKey *key2 = (CorrelationKey *) k2;
if (key1->scope != key2->scope)
return FALSE;
switch (key1->scope)
{
case RCS_PROCESS:
if (strcmp(key1->pid, key2->pid) != 0)
return FALSE;
case RCS_PROGRAM:
if (strcmp(key1->program, key2->program) != 0)
return FALSE;
case RCS_HOST:
if (strcmp(key1->host, key2->host) != 0)
return FALSE;
case RCS_GLOBAL:
break;
default:
g_assert_not_reached();
break;
}
if (strcmp(key1->session_id, key2->session_id) != 0)
return FALSE;
return TRUE;
}
/* fills a CorrelationKey structure with borrowed values */
void
correlation_key_init(CorrelationKey *self, CorrelationScope scope, LogMessage *msg, gchar *session_id)
{
memset(self, 0, sizeof(*self));
self->scope = scope;
self->session_id = session_id;
/* NVTable ensures that builtin name-value pairs are always NUL terminated */
switch (scope)
{
case RCS_PROCESS:
self->pid = log_msg_get_value(msg, LM_V_PID, NULL);
case RCS_PROGRAM:
self->program = log_msg_get_value(msg, LM_V_PROGRAM, NULL);
case RCS_HOST:
self->host = log_msg_get_value(msg, LM_V_HOST, NULL);
case RCS_GLOBAL:
break;
default:
g_assert_not_reached();
break;
}
}
gint
correlation_key_lookup_scope(const gchar *scope)
{
if (strcasecmp(scope, "global") == 0)
return RCS_GLOBAL;
else if (strcasecmp(scope, "host") == 0)
return RCS_HOST;
else if (strcasecmp(scope, "program") == 0)
return RCS_PROGRAM;
else if (strcasecmp(scope, "process") == 0)
return RCS_PROCESS;
return -1;
}
|
