/* GPattern only works with utf8 strings, if the input is not utf8, we risk * a crash */ static gboolean log_matcher_glob_match(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len) { LogMatcherGlob *self = (LogMatcherGlob *) s; if (G_LIKELY((msg->flags & LF_UTF8) || g_utf8_validate(value, value_len, NULL))) { static gboolean warned = FALSE; gchar *buf; if (G_UNLIKELY(!warned && (msg->flags & LF_UTF8) == 0)) { msg_warning("Input is valid utf8, but the log message is not tagged as such, this performs worse than enabling validate-utf8 flag on input", evt_tag_printf("value", "%.*s", (gint) value_len, value), NULL); warned = TRUE; } APPEND_ZERO(buf, value, value_len); return g_pattern_match(self->pattern, value_len, buf, NULL); } else { msg_warning("Input is not valid utf8, glob match requires utf8 input, thus it never matches in this case", evt_tag_printf("value", "%.*s", (gint) value_len, value), NULL); } return FALSE; }
static gboolean date_parser_process(LogParser *s, LogMessage **pmsg, const LogPathOptions *path_options, const gchar *input, gsize input_len) { DateParser *self = (DateParser *) s; LogMessage *msg = log_msg_make_writable(pmsg, path_options); msg_trace("date-parser message processing started", evt_tag_str ("input", input), evt_tag_str ("format", self->date_format), evt_tag_printf("msg", "%p", *pmsg)); /* this macro ensures zero termination by copying input to a * g_alloca()-d buffer if necessary. In most cases it's not though. */ APPEND_ZERO(input, input, input_len); gboolean res = _convert_timestamp_to_logstamp(self, msg->timestamps[LM_TS_RECVD].ut_sec, &msg->timestamps[self->time_stamp], input); return res; }
static gboolean filter_in_list_eval(FilterExprNode *s, LogMessage **msgs, gint num_msg) { FilterInList *self = (FilterInList *)s; LogMessage *msg = msgs[0]; const gchar *value; gssize len = 0; value = log_msg_get_value(msg, self->value_handle, &len); APPEND_ZERO(value, value, len); return (g_tree_lookup(self->tree, value) != NULL) ^ s->comp; }
static gboolean log_matcher_posix_re_match(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len) { LogMatcherPosixRe *self = (LogMatcherPosixRe *) s; regmatch_t matches[RE_MAX_MATCHES]; gboolean rc; const gchar *buf; APPEND_ZERO(buf, value, value_len); rc = !regexec(&self->pattern, buf, RE_MAX_MATCHES, matches, 0); if (rc && (s->flags & LMF_STORE_MATCHES)) { log_matcher_posix_re_feed_backrefs(s, msg, value_handle, matches, value); } return rc; }
static const gchar * log_matcher_string_match_string(LogMatcherString *self, const gchar *value, gsize value_len) { const gchar *result = NULL; gboolean match = FALSE; const gchar *pattern = self->super.pattern; if (self->pattern_len > value_len) return NULL; if (G_LIKELY((self->super.flags & (LMF_SUBSTRING + LMF_PREFIX)) == 0)) { if (self->super.flags & LMF_ICASE) match = strncasecmp(value, pattern, value_len) == 0; else match = strncmp(value, pattern, value_len) == 0; } else if (self->super.flags & LMF_PREFIX) { if (self->super.flags & LMF_ICASE) match = strncasecmp(value, pattern, MIN(value_len, self->pattern_len)) == 0; else match = strncmp(value, pattern, MIN(value_len, self->pattern_len)) == 0; } else if (self->super.flags & LMF_SUBSTRING) { if (self->super.flags & LMF_ICASE) { gchar *buf; gchar *res; APPEND_ZERO(buf, value, value_len); res = strcasestr(buf, pattern); if (res) result = value + (res - buf); } else { result = g_strstr_len(value, value_len, pattern); } } if (match && !result) result = value; return result; }
static gchar * log_matcher_posix_re_replace(LogMatcher *s, LogMessage *msg, gint value_handle, const gchar *value, gssize value_len, LogTemplate *replacement, gssize *new_length) { LogMatcherPosixRe *self = (LogMatcherPosixRe *) s; regmatch_t matches[RE_MAX_MATCHES]; gboolean rc; GString *new_value = NULL; gsize current_ofs = 0; gboolean first_round = TRUE; gchar *buf; APPEND_ZERO(buf, value, value_len); do { if (current_ofs == value_len) break; rc = !regexec(&self->pattern, buf + current_ofs, RE_MAX_MATCHES, matches, current_ofs > 0 ? REG_NOTBOL : 0); if (rc) { /* start_ofs & end_ofs are relative to the original string */ gsize start_ofs = matches[0].rm_so + current_ofs; gsize end_ofs = matches[0].rm_eo + current_ofs; if (start_ofs == end_ofs && !first_round) { start_ofs++; end_ofs++; } log_matcher_posix_re_feed_backrefs(s, msg, value_handle, matches, buf + current_ofs); if (!new_value) new_value = g_string_sized_new(value_len); g_string_append_len(new_value, buf + current_ofs, start_ofs - current_ofs); log_template_append_format(replacement, msg, NULL, LTZ_LOCAL, 0, NULL, new_value); current_ofs = end_ofs; if ((self->super.flags & LMF_GLOBAL) == 0) { g_string_append_len(new_value, buf + current_ofs, value_len - current_ofs); break; } } else { if (new_value) { /* no more matches, append the end of the string */ g_string_append_len(new_value, buf + current_ofs, value_len - current_ofs); } } first_round = FALSE; } while (rc && (self->super.flags & LMF_GLOBAL)); if (new_value) { if (new_length) *new_length = new_value->len; return g_string_free(new_value, FALSE); } return NULL; }