| 401 | |
| 402 | |
| 403 | class WhereClauseEvaluator(object): |
| 404 | def __init__(self, logger, aspace, whereclause): |
| 405 | self.logger = logger |
| 406 | self.elements = whereclause.Elements |
| 407 | self._aspace = aspace |
| 408 | |
| 409 | def eval(self, event): |
| 410 | if not self.elements: |
| 411 | return True |
| 412 | # spec says we should only evaluate first element, which may use other elements |
| 413 | try: |
| 414 | res = self._eval_el(0, event) |
| 415 | except Exception as ex: |
| 416 | self.logger.exception("Exception while evaluating WhereClause %s for event %s: %s", |
| 417 | self.elements, event, ex) |
| 418 | return False |
| 419 | return res |
| 420 | |
| 421 | def _eval_el(self, index, event): |
| 422 | el = self.elements[index] |
| 423 | # ops = [self._eval_op(op, event) for op in el.FilterOperands] |
| 424 | ops = el.FilterOperands # just to make code more readable |
| 425 | if el.FilterOperator == ua.FilterOperator.Equals: |
| 426 | return self._eval_op(ops[0], event) == self._eval_op(ops[1], event) |
| 427 | elif el.FilterOperator == ua.FilterOperator.IsNull: |
| 428 | return self._eval_op(ops[0], event) is None # FIXME: might be too strict |
| 429 | elif el.FilterOperator == ua.FilterOperator.GreaterThan: |
| 430 | return self._eval_op(ops[0], event) > self._eval_op(ops[1], event) |
| 431 | elif el.FilterOperator == ua.FilterOperator.LessThan: |
| 432 | return self._eval_op(ops[0], event) < self._eval_op(ops[1], event) |
| 433 | elif el.FilterOperator == ua.FilterOperator.GreaterThanOrEqual: |
| 434 | return self._eval_op(ops[0], event) >= self._eval_op(ops[1], event) |
| 435 | elif el.FilterOperator == ua.FilterOperator.LessThanOrEqual: |
| 436 | return self._eval_op(ops[0], event) <= self._eval_op(ops[1], event) |
| 437 | elif el.FilterOperator == ua.FilterOperator.Like: |
| 438 | return self._likeoperator(self._eval_op(ops[0], event), self._eval_op(ops[1], event)) |
| 439 | elif el.FilterOperator == ua.FilterOperator.Not: |
| 440 | return not self._eval_op(ops[0], event) |
| 441 | elif el.FilterOperator == ua.FilterOperator.Between: |
| 442 | return self._eval_el(ops[2], event) >= self._eval_op(ops[0], event) >= self._eval_op(ops[1], event) |
| 443 | elif el.FilterOperator == ua.FilterOperator.InList: |
| 444 | return self._eval_op(ops[0], event) in [self._eval_op(op, event) for op in ops[1:]] |
| 445 | elif el.FilterOperator == ua.FilterOperator.And: |
| 446 | return self._eval_op(ops[0], event) and self._eval_op(ops[1], event) |
| 447 | elif el.FilterOperator == ua.FilterOperator.Or: |
| 448 | return self._eval_op(ops[0], event) or self._eval_op(ops[1], event) |
| 449 | elif el.FilterOperator == ua.FilterOperator.Cast: |
| 450 | self.logger.warn("Cast operand not implemented, assuming True") |
| 451 | return True |
| 452 | elif el.FilterOperator == ua.FilterOperator.OfType: |
| 453 | return event.EventType == self._eval_op(ops[0], event) |
| 454 | else: |
| 455 | # TODO: implement missing operators |
| 456 | self.logger.warning("WhereClause not implemented for element: %s", el) |
| 457 | raise NotImplementedError |
| 458 | |
| 459 | def _like_operator(self, string, pattern): |
| 460 | raise NotImplementedError |
no outgoing calls