parse-events: Add regex to string matches for filter

Add =~ and !~ for filtering string matches.

Also fixed the == and != string matching since it was using
strncmp() due to values may not being NULL terminated. Copies
the data instead and compares the copy.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

3 files changed, 83 insertions, 6 deletions

diff --git a/parse-events.c b/parse-events.c
index 679c0c9..7e0336b 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -696,6 +696,16 @@ static int __peek_char(void)
         return input_buf[input_buf_ptr];
 }
 
+/**
+ * pevent_peek_char - peek at the next character that will be read
+ *
+ * Returns the next character read, or -1 if end of buffer.
+ */
+int pevent_peek_char(void)
+{
+        return __peek_char();
+}
+
 static enum event_type force_token(const char *str, char **tok);
 
 static enum event_type __read_token(char **tok)
diff --git a/parse-events.h b/parse-events.h
index 13b1f3a..1573869 100644
--- a/parse-events.h
+++ b/parse-events.h
@@ -22,6 +22,7 @@
 #define _PARSE_EVENTS_H
 
 #include <stdarg.h>
+#include <regex.h>
 
 #ifndef __unused
 #define __unused __attribute__ ((unused))
@@ -485,6 +486,7 @@ void pevent_unref(struct pevent *pevent);
 void pevent_buffer_init(const char *buf, unsigned long long size);
 enum event_type pevent_read_token(char **tok);
 void pevent_free_token(char *token);
+int pevent_peek_char(void);
 
 /* for debugging */
 void pevent_print_funcs(struct pevent *pevent);
@@ -513,8 +515,8 @@ enum filter_cmp_type {
         FILTER_CMP_LE,
         FILTER_CMP_MATCH,
         FILTER_CMP_NOT_MATCH,
-        FILTER_CMP_CONTAIN,
-        FILTER_CMP_NOT_CONTAIN,
+        FILTER_CMP_REGEX,
+        FILTER_CMP_NOT_REGEX,
 };
 
 enum filter_arg_type {
@@ -547,6 +549,8 @@ struct filter_arg_str {
         enum filter_cmp_type    type;
         struct format_field     *field;
         char                    *val;
+        char                    *buffer;
+        regex_t                 reg;
 };
 
 struct filter_arg {
diff --git a/parse-filter.c b/parse-filter.c
index 3e47b2a..8944644 100644
--- a/parse-filter.c
+++ b/parse-filter.c
@@ -23,7 +23,6 @@
 #include <string.h>
 #include <stdarg.h>
 #include <ctype.h>
-#include <regex.h>
 #include <errno.h>
 #include <sys/types.h>
 
@@ -89,7 +88,20 @@ static enum event_type read_token(char **tok)
                 type = pevent_read_token(&token);
         } while (type == EVENT_NEWLINE || type == EVENT_SPACE);
 
-        *tok = token;
+        /* If token is = or ! check to see if the next char is ~ */
+        if (token &&
+            (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
+            pevent_peek_char() == '~') {
+                /* append it */
+                *tok = malloc(3);
+                sprintf(*tok, "%c%c", *token, '~');
+                free_token(token);
+                /* Now remove the '~' from the buffer */
+                pevent_read_token(&token);
+                free_token(token);
+        } else
+                *tok = token;
+
         return type;
 }
 
@@ -205,6 +217,8 @@ static void free_arg(struct filter_arg *arg)
 
         case FILTER_ARG_STR:
                 free(arg->str.val);
+                regfree(&arg->str.reg);
+                free(arg->str.buffer);
                 break;
 
         case FILTER_ARG_OP:
@@ -314,6 +328,8 @@ static int process_valid_field(struct filter_arg *arg,
                                char *val,
                                char **error_str)
 {
+        int ret;
+
         switch (type) {
 
         case EVENT_SQUOTE:
@@ -332,6 +348,13 @@ static int process_valid_field(struct filter_arg *arg,
                         op_type = FILTER_CMP_NOT_MATCH;
                         break;
 
+                case FILTER_CMP_REGEX:
+                case FILTER_CMP_NOT_REGEX:
+                        ret = regcomp(&arg->str.reg, val, REG_ICASE|REG_NOSUB);
+                        if (ret)
+                                return -1;
+                        break;
+
                 default:
                         show_error(error_str,
                                    "Op not allowed with string");
@@ -343,9 +366,24 @@ static int process_valid_field(struct filter_arg *arg,
                 arg->str.val = strdup(val);
                 if (!arg->str.val)
                         die("Can't allocate arg value");
+
+                /* Need a buffer to copy data int for tests */
+                arg->str.buffer = malloc_or_die(arg->str.field->size + 1);
+                /* Null terminate this buffer */
+                arg->str.buffer[arg->str.field->size] = 0;
+
                 break;
         case EVENT_ITEM:
  as_int:
+                switch (op_type) {
+                case FILTER_CMP_REGEX:
+                case FILTER_CMP_NOT_REGEX:
+                        show_error(error_str,
+                                   "Op not allowed with integers");
+                        return -1;
+                default:
+                        break;
+                }
                 arg->type = FILTER_ARG_NUM;
                 arg->num.field = field;
                 arg->num.type = op_type;
@@ -477,6 +515,10 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                 etype = FILTER_CMP_LE;
         } else if (strcmp(token, ">=") == 0) {
                 etype = FILTER_CMP_GE;
+        } else if (strcmp(token, "=~") == 0) {
+                etype = FILTER_CMP_REGEX;
+        } else if (strcmp(token, "!~") == 0) {
+                etype = FILTER_CMP_NOT_REGEX;
         } else {
                 show_error(error_str,
                            "Unknown op '%s' after '%s'",
@@ -897,13 +939,34 @@ static int test_str(struct event_format *event,
                     struct filter_arg *arg, struct record *record)
 {
         const char *val = record->data + arg->str.field->offset;
+        const char *buffer;
+
+        /*
+         * We need to copy the data since we can't be sure the field
+         * is null terminated.
+         */
+        if (*(val + arg->str.field->size - 1)) {
+                /* copy it */
+                memcpy(arg->str.buffer, val, arg->str.field->size);
+                /* the buffer is already NULL terminated */
+                buffer = arg->str.buffer;
+        } else
+                /* OK, it's NULL terminated */
+                buffer = val;
 
         switch (arg->str.type) {
         case FILTER_CMP_MATCH:
-                return strncmp(val, arg->str.val, arg->str.field->size) == 0;
+                return strcmp(buffer, arg->str.val) == 0;
 
         case FILTER_CMP_NOT_MATCH:
-                return strncmp(val, arg->str.val, arg->str.field->size) != 0;
+                return strcmp(buffer, arg->str.val) != 0;
+
+        case FILTER_CMP_REGEX:
+                /* Returns zero on match */
+                return !regexec(&arg->str.reg, buffer, 0, NULL, 0);
+
+        case FILTER_CMP_NOT_REGEX:
+                return regexec(&arg->str.reg, buffer, 0, NULL, 0);
 
         default:
                 /* ?? */