YamlNode_t *moloch_rules_parse_yaml(char *filename, YamlNode_t *parent, yaml_parser_t *parser, gboolean sequence) { char *key = NULL; YamlNode_t *node; int done = 0; while (!done) { yaml_event_t event; if (!yaml_parser_parse(parser, &event)) LOGEXIT("%s:%zu - Parse error '%s'", filename, parser->problem_mark.line, parser->problem); #ifdef RULES_DEBUG LOG("%s %d", yaml_names[event.type], event.type); #endif switch(event.type) { case YAML_NO_EVENT: done = 1; break; case YAML_SCALAR_EVENT: #ifdef RULES_DEBUG LOG("SCALAR_EVENT: %s => %s", key, event.data.scalar.value); #endif if (sequence) { moloch_rules_add_node(parent, g_strdup((gchar *)event.data.scalar.value), YAML_NODE_SEQUENCE_VALUE); } else if (key) { moloch_rules_add_node(parent, key, g_strdup((gchar *)event.data.scalar.value)); key = NULL; } else { key = g_strdup((gchar *)event.data.scalar.value); } break; case YAML_SEQUENCE_START_EVENT: case YAML_MAPPING_START_EVENT: if (parent == NULL) { parent = node = moloch_rules_add_node(NULL, g_strdup("root"), NULL); } else { node = moloch_rules_add_node(parent, key, NULL); } key = NULL; if (moloch_rules_parse_yaml(filename, node, parser, event.type == YAML_SEQUENCE_START_EVENT) == NULL) return NULL; break; case YAML_MAPPING_END_EVENT: case YAML_SEQUENCE_END_EVENT: done = 1; default: ; } yaml_event_delete(&event); } return parent; }
void moloch_rules_load(char **names) { int i; // Make a copy of current items to free later MolochRulesInfo_t *freeing = MOLOCH_TYPE_ALLOC0(MolochRulesInfo_t); memcpy(freeing, ¤t, sizeof(current)); moloch_free_later(freeing, (GDestroyNotify) moloch_rules_free); // Load all the rule files for (i = 0; names[i]; i++) { yaml_parser_t parser; yaml_parser_initialize(&parser); FILE *input = fopen(names[i], "rb"); if (!input) LOGEXIT("ERROR - can not open rules file %s", names[i]); yaml_parser_set_input_file(&parser, input); YamlNode_t *parent = moloch_rules_parse_yaml(names[i], NULL, &parser, FALSE); yaml_parser_delete(&parser); if (!parent) { LOG("WARNING %s - has no rules", names[i]); continue; } #ifdef RULES_DEBUG moloch_rules_parse_print(parent, 0); #endif moloch_rules_load_file(names[i], parent); moloch_rules_free_node(parent); fclose(input); } // Part 2, which will also copy loading to current moloch_rules_load_complete(); }