int ausearch_add_timestamp_item_ex(auparse_state_t *au, const char *op,
time_t sec, unsigned milli, unsigned serial, ausearch_rule_t how)
{
static const struct {
unsigned value;
const char name[3];
} ts_tab[] = {
{EO_VALUE_LT, "<"},
{EO_VALUE_LE, "<="},
{EO_VALUE_GE, ">="},
{EO_VALUE_GT, ">"},
{EO_VALUE_EQ, "="},
};
struct expr *expr;
size_t i;
unsigned t_op;
for (i = 0; i < sizeof(ts_tab) / sizeof(*ts_tab); i++) {
if (strcmp(ts_tab[i].name, op) == 0)
goto found_op;
}
goto err_out;
found_op:
t_op = ts_tab[i].value;
if (milli >= 1000)
goto err_out;
// Make sure how is within range
if (how < AUSEARCH_RULE_CLEAR || how > AUSEARCH_RULE_AND)
goto err_out;
// All pre-checks are done, build a rule
expr = expr_create_timestamp_comparison_ex(t_op, sec, milli, serial);
if (expr == NULL)
return -1;
if (add_expr(au, expr, how) != 0)
return -1; /* expr is freed by add_expr() */
return 0;
err_out:
errno = EINVAL;
return -1;
}
/* Create a timestamp comparison-expression for with OP, SEC, MILLI.
On success, return the created expression.
On error, set errno and return NULL. */
struct expr *
expr_create_timestamp_comparison(unsigned op, time_t sec, unsigned milli)
{
return expr_create_timestamp_comparison_ex(op, sec, milli, 0);
}
