void EventPublisherPlugin::fire(const EventContextRef& ec, EventTime time) {
EventContextID ec_id;
if (isEnding()) {
// Cannot emit/fire while ending
return;
}
{
boost::lock_guard<boost::mutex> lock(ec_id_lock_);
ec_id = next_ec_id_++;
}
// Fill in EventContext ID and time if needed.
if (ec != nullptr) {
ec->id = ec_id;
if (ec->time == 0) {
if (time == 0) {
time = getUnixTime();
}
// Todo: add a check to assure normalized (seconds) time.
ec->time = time;
}
}
for (const auto& subscription : subscriptions_) {
auto es = EventFactory::getEventSubscriber(subscription->subscriber_name);
if (es->state() == SUBSCRIBER_RUNNING) {
fireCallback(subscription, ec);
}
}
}
void EventPublisherPlugin::fire(const EventContextRef& ec, EventTime time) {
if (isEnding()) {
// Cannot emit/fire while ending
return;
}
EventContextID ec_id = 0;
{
WriteLock lock(ec_id_lock_);
ec_id = next_ec_id_++;
}
// Fill in EventContext ID and time if needed.
if (ec != nullptr) {
ec->id = ec_id;
if (ec->time == 0) {
if (time == 0) {
time = getUnixTime();
}
ec->time = time;
}
}
for (const auto& subscription : subscriptions_) {
auto es = EventFactory::getEventSubscriber(subscription->subscriber_name);
if (es != nullptr && es->state() == SUBSCRIBER_RUNNING) {
es->event_count_++;
fireCallback(subscription, ec);
}
}
}
virtual void main()
{
while (!isEnding())
{
//count++;
//printf("Count is %d\n", count);
NovaTime::sleep(1);
}
}
Status ProcessEventSubscriber::init() {
auto pubref = EventFactory::getEventPublisher("kernel");
if (pubref == nullptr || pubref->isEnding()) {
return Status(1, "No kernel event publisher");
}
auto sc = createSubscriptionContext();
sc->event_type = OSQUERY_PROCESS_EVENT;
subscribe(&ProcessEventSubscriber::Callback, sc);
return Status(0, "OK");
}
QueryData genOsqueryEvents(QueryContext& context) {
QueryData results;
auto publishers = EventFactory::publisherTypes();
for (const auto& publisher : publishers) {
Row r;
r["name"] = publisher;
r["publisher"] = publisher;
r["type"] = "publisher";
auto pubref = EventFactory::getEventPublisher(publisher);
if (pubref != nullptr) {
r["subscriptions"] = INTEGER(pubref->numSubscriptions());
r["events"] = INTEGER(pubref->numEvents());
r["restarts"] = INTEGER(pubref->restartCount());
r["active"] = (pubref->hasStarted() && !pubref->isEnding()) ? "1" : "0";
} else {
r["subscriptions"] = "0";
r["events"] = "0";
r["restarts"] = "0";
r["active"] = "-1";
}
results.push_back(r);
}
auto subscribers = EventFactory::subscriberNames();
for (const auto& subscriber : subscribers) {
Row r;
r["name"] = subscriber;
r["type"] = "subscriber";
// Subscribers will never 'restart'.
r["restarts"] = "0";
auto subref = EventFactory::getEventSubscriber(subscriber);
if (subref != nullptr) {
r["publisher"] = subref->getType();
r["subscriptions"] = INTEGER(subref->numSubscriptions());
r["events"] = INTEGER(subref->numEvents());
// Subscribers are always active, even if their publisher is not.
r["active"] = (subref->state() == SUBSCRIBER_RUNNING) ? "1" : "0";
} else {
r["subscriptions"] = "0";
r["events"] = "0";
r["active"] = "-1";
}
results.push_back(r);
}
return results;
}
static int
selectRule (int length) {
int ruleOffset;
int maximumLength;
if (length < 1) return 0;
if (length == 1) {
const ContractionTableCharacter *ctc = getContractionTableCharacter(toLowerCase(*src));
if (!ctc) return 0;
ruleOffset = ctc->rules;
maximumLength = 1;
} else {
wchar_t characters[2];
characters[0] = toLowerCase(src[0]);
characters[1] = toLowerCase(src[1]);
ruleOffset = getContractionTableHeader()->rules[CTH(characters)];
maximumLength = 0;
}
while (ruleOffset) {
currentRule = getContractionTableItem(ruleOffset);
currentOpcode = currentRule->opcode;
currentFindLength = currentRule->findlen;
if ((length == 1) ||
((currentFindLength <= length) &&
checkCurrentRule(src))) {
setAfter(currentFindLength);
if (!maximumLength) {
maximumLength = currentFindLength;
if (prefs.capitalizationMode != CTB_CAP_NONE) {
typedef enum {CS_Any, CS_Lower, CS_UpperSingle, CS_UpperMultiple} CapitalizationState;
#define STATE(c) (testCharacter((c), CTC_UpperCase)? CS_UpperSingle: testCharacter((c), CTC_LowerCase)? CS_Lower: CS_Any)
CapitalizationState current = STATE(before);
int i;
for (i=0; i<currentFindLength; i+=1) {
wchar_t character = src[i];
CapitalizationState next = STATE(character);
if (i > 0) {
if (((current == CS_Lower) && (next == CS_UpperSingle)) ||
((current == CS_UpperMultiple) && (next == CS_Lower))) {
maximumLength = i;
break;
}
if ((prefs.capitalizationMode != CTB_CAP_SIGN) &&
(next == CS_UpperSingle)) {
maximumLength = i;
break;
}
}
if ((prefs.capitalizationMode == CTB_CAP_SIGN) && (current > CS_Lower) && (next == CS_UpperSingle)) {
current = CS_UpperMultiple;
} else if (next != CS_Any) {
current = next;
} else if (current == CS_Any) {
current = CS_Lower;
}
}
#undef STATE
}
}
if ((currentFindLength <= maximumLength) &&
(!currentRule->after || testCharacter(before, currentRule->after)) &&
(!currentRule->before || testCharacter(after, currentRule->before))) {
switch (currentOpcode) {
case CTO_Always:
case CTO_Repeatable:
case CTO_Literal:
return 1;
case CTO_LargeSign:
case CTO_LastLargeSign:
if (!isBeginning() || !isEnding()) currentOpcode = CTO_Always;
return 1;
case CTO_WholeWord:
case CTO_Contraction:
if (testCharacter(before, CTC_Space|CTC_Punctuation) &&
testCharacter(after, CTC_Space|CTC_Punctuation))
return 1;
break;
case CTO_LowWord:
if (testCharacter(before, CTC_Space) && testCharacter(after, CTC_Space) &&
(previousOpcode != CTO_JoinedWord) &&
((dest == destmin) || !dest[-1]))
return 1;
break;
case CTO_JoinedWord:
if (testCharacter(before, CTC_Space|CTC_Punctuation) &&
(before != '-') &&
(dest + currentRule->replen < destmax)) {
const wchar_t *end = src + currentFindLength;
const wchar_t *ptr = end;
while (ptr < srcmax) {
if (!testCharacter(*ptr, CTC_Space)) {
if (!testCharacter(*ptr, CTC_Letter)) break;
if (ptr == end) break;
return 1;
}
if (ptr++ == cursor) break;
}
}
break;
case CTO_SuffixableWord:
if (testCharacter(before, CTC_Space|CTC_Punctuation) &&
testCharacter(after, CTC_Space|CTC_Letter|CTC_Punctuation))
return 1;
break;
case CTO_PrefixableWord:
if (testCharacter(before, CTC_Space|CTC_Letter|CTC_Punctuation) &&
testCharacter(after, CTC_Space|CTC_Punctuation))
return 1;
break;
case CTO_BegWord:
if (testCharacter(before, CTC_Space|CTC_Punctuation) &&
testCharacter(after, CTC_Letter))
return 1;
break;
case CTO_BegMidWord:
if (testCharacter(before, CTC_Letter|CTC_Space|CTC_Punctuation) &&
testCharacter(after, CTC_Letter))
return 1;
break;
case CTO_MidWord:
if (testCharacter(before, CTC_Letter) && testCharacter(after, CTC_Letter))
return 1;
break;
case CTO_MidEndWord:
if (testCharacter(before, CTC_Letter) &&
testCharacter(after, CTC_Letter|CTC_Space|CTC_Punctuation))
return 1;
break;
case CTO_EndWord:
if (testCharacter(before, CTC_Letter) &&
testCharacter(after, CTC_Space|CTC_Punctuation))
return 1;
break;
case CTO_BegNum:
if (testCharacter(before, CTC_Space|CTC_Punctuation) &&
testCharacter(after, CTC_Digit))
return 1;
break;
case CTO_MidNum:
if (testCharacter(before, CTC_Digit) && testCharacter(after, CTC_Digit))
return 1;
break;
case CTO_EndNum:
if (testCharacter(before, CTC_Digit) &&
testCharacter(after, CTC_Space|CTC_Punctuation))
return 1;
break;
case CTO_PrePunc:
if (testCharacter(*src, CTC_Punctuation) && isBeginning() && !isEnding()) return 1;
break;
case CTO_PostPunc:
if (testCharacter(*src, CTC_Punctuation) && !isBeginning() && isEnding()) return 1;
break;
default:
break;
}
}
}
ruleOffset = currentRule->next;
}
return 0;
}
Nec1Decoder::Nec1Decoder(const IrReader &irReader) : IrDecoder() {
unsigned int index = 0;
boolean success;
if (irReader.getDataLength() == 4U) {
success = getDuration(irReader.getDuration(index++), 16U);
if (!success)
return;
success = getDuration(irReader.getDuration(index++), 4U);
if (!success)
return;
success = getDuration(irReader.getDuration(index++), 1U);
if (!success)
return;
success = isEnding(irReader.getDuration(index));
if (!success)
return;
ditto = true;
setValid(true);
//strcpy_PF(decode, (uint_farptr_t) nec1DittoLiteral); // FIXME
strcpy(decode, nec1DittoLiteral); // FIXME
} else if (irReader.getDataLength() == 34U * 2U) {
success = getDuration(irReader.getDuration(index++), 16U);
if (!success)
return;
success = getDuration(irReader.getDuration(index++), 8U);
if (!success)
return;
D = decodeParameter(irReader, index);
if (D == invalid)
return;
index += 16;
S = decodeParameter(irReader, index);
if (S == invalid)
return;
index += 16;
F = decodeParameter(irReader, index);
if (F == invalid)
return;
index += 16;
int invF = decodeParameter(irReader, index);
if (invF < 0)
return;
if ((F ^ invF) != 0xFF)
return;
index += 16;
success = getDuration(irReader.getDuration(index++), 1U);
if (!success)
return;
success = isEnding(irReader.getDuration(index));
if (!success)
return;
ditto = false;
setValid(true);
//strncpy_PF(decode, pgm_read_byte(nec1DittoLiteral), 4);
//strcpy_PF(decode, (uint_farptr_t) F("NEC1"));
strcpy(decode, "NEC1");
char junk[5];
sprintf(junk, " %d", D);
strcat(decode, junk);
if (S != 255 - D) {
sprintf(junk, " %d", S);
strcat(decode, junk);
}
sprintf(junk, " %d", F);
strcat(decode, junk);
}
}
