static int checksum_field_name_resolver(const idmef_path_t *path, int field_context, const char *table_name,
prelude_string_t *output)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "key") == 0 )
child_name = "checksum_key";
return prelude_string_sprintf(output, "%s.%s", table_name, child_name);
}
static int addata_field_name_resolver(const idmef_path_t *path, int field_context, const char *table_name,
prelude_string_t *output)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( field_context == FIELD_CONTEXT_SELECT && strcmp(child_name, "data") == 0 )
return prelude_string_sprintf(output, "%s.%s, %s.type",
table_name, child_name, table_name);
return prelude_string_sprintf(output, "%s.%s", table_name, child_name);
}
static int web_service_table_name_resolver(const idmef_path_t *path, char **table_name)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "arg") == 0 )
*table_name = strdup("Prelude_WebServiceArg");
else
*table_name = strdup("Prelude_WebService");
return *table_name ? 0 : prelude_error_from_errno(errno);
}
static int file_access_table_name_resolver(const idmef_path_t *path, char **table_name)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "permission") == 0 )
*table_name = strdup("Prelude_FileAccess_Permission");
else
*table_name = strdup("Prelude_FileAccess");
return *table_name ? 0 : prelude_error_from_errno(errno);
}
static int time_without_usec_field_name_resolver(const idmef_path_t *path, int field_context,
const char *table_name, prelude_string_t *output)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( field_context == FIELD_CONTEXT_SELECT )
return prelude_string_sprintf(output, "%s.%s, %s.%s_gmtoff",
table_name, child_name, table_name, child_name);
return prelude_string_sprintf(output, "%s.%s", table_name, child_name);
}
static int file_field_name_resolver(const idmef_path_t *path, int field_context, const char *table_name,
prelude_string_t *output)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "create_time") == 0 ||
strcmp(child_name, "modify_time") == 0 ||
strcmp(child_name, "access_time") == 0 )
return time_without_usec_field_name_resolver(path, field_context, table_name, output);
return prelude_string_sprintf(output, "%s.%s", table_name, child_name);
}
static int message_field_name_resolver(const idmef_path_t *path, int field_context, const char *table_name,
prelude_string_t *output)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "create_time") == 0 ||
strcmp(child_name, "detect_time") == 0 ||
strcmp(child_name, "analyzer_time") == 0 )
return time_with_usec_field_name_resolver(path, field_context, table_name, output);
return default_field_name_resolver(path, field_context, table_name, output);
}
static int process_table_name_resolver(const idmef_path_t *path, char **table_name)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "arg") == 0 )
*table_name = strdup("Prelude_ProcessArg");
else if ( strcmp(child_name, "env") == 0 )
*table_name = strdup("Prelude_ProcessEnv");
else
*table_name = strdup("Prelude_Process");
return *table_name ? 0 : prelude_error_from_errno(errno);
}
static int message_table_name_resolver(const idmef_path_t *path, char **table_name)
{
const char *child_name = idmef_path_get_name(path, idmef_path_get_depth(path) - 1);
if ( strcmp(child_name, "create_time") == 0 )
*table_name = strdup("Prelude_CreateTime");
else if ( strcmp(child_name, "detect_time") == 0 )
*table_name = strdup("Prelude_DetectTime");
else if ( strcmp(child_name, "analyzer_time") == 0 )
*table_name = strdup("Prelude_AnalyzerTime");
else
return default_table_name_resolver(path, table_name);
return *table_name ? 0 : prelude_error_from_errno(errno);
}
static int default_field_name_resolver(const idmef_path_t *path, int field_context,
const char *table_name, prelude_string_t *output)
{
return prelude_string_sprintf(output, "%s.%s", table_name,
idmef_path_get_name(path, idmef_path_get_depth(path) - 1));
}