Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new query language plugin #2074

Merged
merged 12 commits into from
Feb 11, 2022
Merged

Add new query language plugin #2074

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
0206cd7
Add new query language plugin
mavam Feb 9, 2022
cbea219
Move implementation into plugin
mavam Feb 9, 2022
3cd6584
Enable plugins in CI
mavam Feb 9, 2022
bff828a
Migrate integration tests
mavam Feb 9, 2022
1251504
Use build matrix for CI instead of bundling plugin
mavam Feb 10, 2022
394ebd6
Fix changelog version
mavam Feb 10, 2022
b66f9e2
Add changelog entries
mavam Feb 11, 2022
fda3989
Add stub README pointing to docs
mavam Feb 11, 2022
b1f85dc
Symlink integration test data into sigma plugin
mavam Feb 11, 2022
dbb1231
Tweak changelog entry
mavam Feb 11, 2022
243f866
Try VAST language first, then all other languages
mavam Feb 11, 2022
251bbfa
Build Sigma plugin per default
mavam Feb 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Try VAST language first, then all other languages
  • Loading branch information
@mavam
mavam committed Feb 11, 2022
commit 243f866f968eacc21d6783b38d41c0dfaf736279
24 changes: 12 additions & 12 deletions libvast/src/system/spawn_arguments.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,23 +36,23 @@ normalized_and_validated(std::vector<std::string>::const_iterator begin,
if (begin == end)
return caf::make_error(ec::syntax_error, "no query expression given");
auto query = detail::join(begin, end, " ");
// We are trying all query language plugins in a non-deterministic order.
for (const auto& plugin : plugins::get())
if (const auto* query_lang = plugin.as<query_language_plugin>()) {
if (auto expr = query_lang->parse(query))
// Always try parsing as VAST expression first.
if (auto e = to<expression>(query))
return normalize_and_validate(std::move(*e));
// If that fails, we try all query language plugins, currently in a
// non-deterministic order.
// TODO: let the user choose exactly one language instead.
for (const auto& plugin : plugins::get()) {
if (const auto* language = plugin.as<query_language_plugin>()) {
if (auto expr = language->parse(query))
return normalize_and_validate(std::move(*expr));
else
// TODO: Demote to DEBUG when polishing the PR.
VAST_ERROR("failed to parse query as {} languae: {}", plugin->name(),
VAST_DEBUG("failed to parse query as {} language: {}", language->name(),
expr.error());
mavam marked this conversation as resolved.
Show resolved Hide resolved
}
// TODO: rewrite the VAST expression as a query language plugin.
if (auto e = to<expression>(query)) {
return normalize_and_validate(std::move(*e));
} else {
VAST_DEBUG("failed to parse query as VAST expression: {}", e.error());
return std::move(e.error());
}
return caf::make_error(ec::syntax_error,
fmt::format("invalid query: {}", query));
}

caf::expected<expression>
Expand Down