static int context_match(const cst_val *PATTERN, const cst_val *STRING, const cst_val *sets) { if (!PATTERN) return TRUE; else if (!STRING) return FALSE; else if (val_cdr(PATTERN) && (cst_streq("*",val_string(val_car(PATTERN))))) return context_match(val_cdr(val_cdr(PATTERN)),STRING,sets) || /* skip */ context_match(val_cdr(PATTERN),STRING,sets) || /* last match */ (item_match(val_car(val_cdr(PATTERN)),val_car(STRING),sets) && context_match(val_cdr(val_cdr(PATTERN)), /* loop match */ val_cdr(STRING),sets)); #if 0 else if (val_cdr(PATTERN) && (cst_streq("+",val_string(val_car(PATTERN))))) return context_match(val_cdr(PATTERN),STRING,sets) || /* last match */ (item_match(val_car(val_cdr(PATTERN)),val_car(STRING),sets) && context_match(val_cdr(val_cdr(PATTERN)), /* loop match */ val_cdr(STRING),sets)); #endif else if (item_match(val_car(PATTERN),val_car(STRING),sets)) return context_match(val_cdr(PATTERN),val_cdr(STRING),sets); else return FALSE; }
static int rule_matches(const cst_val *LC, const cst_val *RC, const cst_val *RLC, const cst_val *RA, const cst_val *RRC, const cst_val *sets) { const cst_val *rc, *ra; /* Check [ X ] bit */ for (rc=RC,ra=RA; ra; ra=val_cdr(ra),rc=val_cdr(rc)) { if (!rc) return FALSE; if (!cst_streq(val_string(val_car(ra)), val_string(val_car(rc)))) return FALSE; } /* Check LC bit: LC may have some limited regex stuff */ if (context_match(RLC,LC,sets) && context_match(RRC,rc,sets)) return TRUE; else return FALSE; }
int match(llist *l) { // Are we within time range? if (start_time == 0 || l->e.sec >= start_time) { if (end_time == 0 || l->e.sec <= end_time) { if (event_id == -1 || event_id == l->e.serial) { // OK - do the heavier checking if (extract_search_items(l)) { return 0; } // perform additional tests for the field if (event_node_list) { const snode *sn; int found=0; slist *sptr = event_node_list; if (l->e.node == NULL) return 0; slist_first(sptr); sn=slist_get_cur(sptr); while (sn && !found) { if (sn->str && (!strcmp(sn->str, l->e.node))) found++; else sn=slist_next(sptr); } if (!found) return 0; } if (user_match(l) == 0) return 0; if (group_match(l) == 0) return 0; if ((event_ppid != -1) && (event_ppid != l->s.ppid)) return 0; if ((event_pid != -1) && (event_pid != l->s.pid)) return 0; if (event_machine != -1 && (event_machine != audit_elf_to_machine(l->s.arch))) return 0; if ((event_syscall != -1) && (event_syscall != l->s.syscall)) return 0; if ((event_session_id != -2) && (event_session_id != l->s.session_id)) return 0; if (event_exit_is_set) { if (l->s.exit_is_set == 0) return 0; if (event_exit != l->s.exit) return 0; } if ((event_success != S_UNSET) && (event_success != l->s.success)) return 0; // event_type requires looking at each item if (event_type != NULL) { int found = 0; const lnode *n; list_first(l); n = list_get_cur(l); do { int_node *in; ilist_first(event_type); in = ilist_get_cur(event_type); do { if (in->num == n->type){ found = 1; break; } } while((in = ilist_next(event_type))); if (found) break; } while ((n = list_next(l))); if (!found) return 0; } // Done all the easy compares, now do the // string searches. if (event_filename) { int found = 0; if (l->s.filename == NULL && l->s.cwd == NULL) return 0; if (l->s.filename) { const snode *sn; slist *sptr = l->s.filename; slist_first(sptr); sn=slist_get_cur(sptr); do { if (sn->str == NULL) return 0; if (strmatch( event_filename, sn->str)) { found = 1; break; } } while ((sn=slist_next(sptr))); if (!found && l->s.cwd == NULL) return 0; } if (l->s.cwd && !found) { /* Check cwd, too */ if (strmatch(event_filename, l->s.cwd) == 0) return 0; } } if (event_hostname) { if (l->s.hostname == NULL) return 0; if (strmatch(event_hostname, l->s.hostname) == 0) return 0; } if (event_terminal) { if (l->s.terminal == NULL) return 0; if (strmatch(event_terminal, l->s.terminal) == 0) return 0; } if (event_exe) { if (l->s.exe == NULL) return 0; if (strmatch(event_exe, l->s.exe) == 0) return 0; } if (event_comm) { if (l->s.comm == NULL) return 0; if (strmatch(event_comm, l->s.comm) == 0) return 0; } if (event_key) { if (l->s.key == NULL) return 0; else { int found = 0; const snode *sn; slist *sptr = l->s.key; slist_first(sptr); sn=slist_get_cur(sptr); do { if (sn->str == NULL) return 0; if (strmatch( event_key, sn->str)) { found = 1; break; } } while ((sn=slist_next(sptr))); if (!found) return 0; } } if (event_vmname) { if (l->s.vmname == NULL) return 0; if (strmatch(event_vmname, l->s.vmname) == 0) return 0; } if (event_uuid) { if (l->s.uuid == NULL) return 0; if (strmatch(event_uuid, l->s.uuid) == 0) return 0; } if (context_match(l) == 0) return 0; return 1; } } } return 0; }