/* GPattern only works with utf8 strings, if the input is not utf8, we risk
* a crash
*/
static gboolean
log_matcher_glob_match(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len)
{
LogMatcherGlob *self = (LogMatcherGlob *) s;
if (G_LIKELY((msg->flags & LF_UTF8) || g_utf8_validate(value, value_len, NULL)))
{
static gboolean warned = FALSE;
gchar *buf;
if (G_UNLIKELY(!warned && (msg->flags & LF_UTF8) == 0))
{
msg_warning("Input is valid utf8, but the log message is not tagged as such, this performs worse than enabling validate-utf8 flag on input",
evt_tag_printf("value", "%.*s", (gint) value_len, value),
NULL);
warned = TRUE;
}
APPEND_ZERO(buf, value, value_len);
return g_pattern_match(self->pattern, value_len, buf, NULL);
}
else
{
msg_warning("Input is not valid utf8, glob match requires utf8 input, thus it never matches in this case",
evt_tag_printf("value", "%.*s", (gint) value_len, value),
NULL);
}
return FALSE;
}
static gboolean
date_parser_process(LogParser *s,
LogMessage **pmsg,
const LogPathOptions *path_options,
const gchar *input,
gsize input_len)
{
DateParser *self = (DateParser *) s;
LogMessage *msg = log_msg_make_writable(pmsg, path_options);
msg_trace("date-parser message processing started",
evt_tag_str ("input", input),
evt_tag_str ("format", self->date_format),
evt_tag_printf("msg", "%p", *pmsg));
/* this macro ensures zero termination by copying input to a
* g_alloca()-d buffer if necessary. In most cases it's not though.
*/
APPEND_ZERO(input, input, input_len);
gboolean res = _convert_timestamp_to_logstamp(self,
msg->timestamps[LM_TS_RECVD].ut_sec,
&msg->timestamps[self->time_stamp],
input);
return res;
}
static gboolean
filter_in_list_eval(FilterExprNode *s, LogMessage **msgs, gint num_msg)
{
FilterInList *self = (FilterInList *)s;
LogMessage *msg = msgs[0];
const gchar *value;
gssize len = 0;
value = log_msg_get_value(msg, self->value_handle, &len);
APPEND_ZERO(value, value, len);
return (g_tree_lookup(self->tree, value) != NULL) ^ s->comp;
}
static gboolean
log_matcher_posix_re_match(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len)
{
LogMatcherPosixRe *self = (LogMatcherPosixRe *) s;
regmatch_t matches[RE_MAX_MATCHES];
gboolean rc;
const gchar *buf;
APPEND_ZERO(buf, value, value_len);
rc = !regexec(&self->pattern, buf, RE_MAX_MATCHES, matches, 0);
if (rc && (s->flags & LMF_STORE_MATCHES))
{
log_matcher_posix_re_feed_backrefs(s, msg, value_handle, matches, value);
}
return rc;
}
static const gchar *
log_matcher_string_match_string(LogMatcherString *self, const gchar *value, gsize value_len)
{
const gchar *result = NULL;
gboolean match = FALSE;
const gchar *pattern = self->super.pattern;
if (self->pattern_len > value_len)
return NULL;
if (G_LIKELY((self->super.flags & (LMF_SUBSTRING + LMF_PREFIX)) == 0))
{
if (self->super.flags & LMF_ICASE)
match = strncasecmp(value, pattern, value_len) == 0;
else
match = strncmp(value, pattern, value_len) == 0;
}
else if (self->super.flags & LMF_PREFIX)
{
if (self->super.flags & LMF_ICASE)
match = strncasecmp(value, pattern, MIN(value_len, self->pattern_len)) == 0;
else
match = strncmp(value, pattern, MIN(value_len, self->pattern_len)) == 0;
}
else if (self->super.flags & LMF_SUBSTRING)
{
if (self->super.flags & LMF_ICASE)
{
gchar *buf;
gchar *res;
APPEND_ZERO(buf, value, value_len);
res = strcasestr(buf, pattern);
if (res)
result = value + (res - buf);
}
else
{
result = g_strstr_len(value, value_len, pattern);
}
}
if (match && !result)
result = value;
return result;
}
static gchar *
log_matcher_posix_re_replace(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len, LogTemplate *replacement, gssize *new_length)
{
LogMatcherPosixRe *self = (LogMatcherPosixRe *) s;
regmatch_t matches[RE_MAX_MATCHES];
gboolean rc;
GString *new_value = NULL;
gsize current_ofs = 0;
gboolean first_round = TRUE;
gchar *buf;
APPEND_ZERO(buf, value, value_len);
do
{
if (current_ofs == value_len)
break;
rc = !regexec(&self->pattern, buf + current_ofs, RE_MAX_MATCHES, matches, current_ofs > 0 ? REG_NOTBOL : 0);
if (rc)
{
/* start_ofs & end_ofs are relative to the original string */
gsize start_ofs = matches[0].rm_so + current_ofs;
gsize end_ofs = matches[0].rm_eo + current_ofs;
if (start_ofs == end_ofs && !first_round)
{
start_ofs++;
end_ofs++;
}
log_matcher_posix_re_feed_backrefs(s, msg, value_handle, matches, buf + current_ofs);
if (!new_value)
new_value = g_string_sized_new(value_len);
g_string_append_len(new_value, buf + current_ofs, start_ofs - current_ofs);
log_template_append_format(replacement, msg, NULL, LTZ_LOCAL, 0, NULL, new_value);
current_ofs = end_ofs;
if ((self->super.flags & LMF_GLOBAL) == 0)
{
g_string_append_len(new_value, buf + current_ofs, value_len - current_ofs);
break;
}
}
else
{
if (new_value)
{
/* no more matches, append the end of the string */
g_string_append_len(new_value, buf + current_ofs, value_len - current_ofs);
}
}
first_round = FALSE;
}
while (rc && (self->super.flags & LMF_GLOBAL));
if (new_value)
{
if (new_length)
*new_length = new_value->len;
return g_string_free(new_value, FALSE);
}
return NULL;
}
