Esempio n. 1
0
        private EqlNode BuildOperandNode(ParseTreeNode parseTreeNode)
        {
            if (parseTreeNode.Term.Name == "binary_expression")
            {
                return(BuildBinaryExpressionNode(parseTreeNode));
            }

            if (parseTreeNode.Term.Name == "term")
            {
                switch (parseTreeNode.ChildNodes[0].Term.Name.ToLowerInvariant())
                {
                case "expression_identifier":
                    if (parseTreeNode.ChildNodes[0].ChildNodes[0].Term != null &&
                        parseTreeNode.ChildNodes[0].ChildNodes[0].Term.Name == "column_relation")
                    {
                        var direction = EqlRelationDirectionType.TargetOrigin;
                        if (parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[0].Token.ValueString == "$$")
                        {
                            direction = EqlRelationDirectionType.OriginTarget;
                        }

                        var relationNameNode        = parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[1];
                        var fieldName               = parseTreeNode.ChildNodes[0].ChildNodes[2].ChildNodes[0].Token.ValueString;
                        EqlRelationFieldNode result = new EqlRelationFieldNode {
                            FieldName = fieldName
                        };
                        result.Relations.Add(new EqlRelationInfo {
                            Name = relationNameNode.ChildNodes[0].Token.ValueString, Direction = direction
                        });
                        return(result);
                    }
                    else
                    {
                        var fieldName = parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[0].Token.ValueString;
                        return(new EqlFieldNode {
                            FieldName = fieldName
                        });
                    }

                case "argument":
                    var argName = parseTreeNode.ChildNodes[0].ChildNodes[1].Token.ValueString;
                    return(new EqlArgumentValueNode {
                        ArgumentName = argName
                    });

                case "number":
                    return(new EqlNumberValueNode {
                        Number = Convert.ToDecimal(parseTreeNode.ChildNodes[0].Token.ValueString)
                    });

                case "string":
                    return(new EqlTextValueNode {
                        Text = parseTreeNode.ChildNodes[0].Token.ValueString
                    });

                case "null":
                    return(new EqlKeywordNode {
                        Keyword = "null"
                    });

                case "true":
                    return(new EqlKeywordNode {
                        Keyword = "true"
                    });

                case "false":
                    return(new EqlKeywordNode {
                        Keyword = "false"
                    });

                case "expression_list":
                    return(BuildBinaryExpressionNode(parseTreeNode.ChildNodes[0].ChildNodes[0]));

                default:
                    throw new EqlException("Unexpected term during process of binary operations.");
                }
            }

            return(null);
        }
Esempio n. 2
0
        private void BuildSelectFieldList(List <EqlFieldNode> list, ParseTreeNode parseTreeNode)
        {
            foreach (var parseNode in parseTreeNode.ChildNodes)
            {
                var columnSourceNode = parseNode.ChildNodes[0];
                var fieldNode        = columnSourceNode.ChildNodes[0];

                switch (fieldNode.Term.Name)
                {
                case "*":
                {
                    list.Add(new EqlWildcardFieldNode());
                }
                    continue;

                case "identifier":
                {
                    string fieldName = fieldNode.ChildNodes[0].Token.ValueString;
                    list.Add(new EqlFieldNode()
                        {
                            FieldName = fieldName
                        });
                }
                    continue;

                case "column_relation_list":
                {
                    List <EqlRelationInfo> relationInfos = GetRelationInfos(fieldNode);
                    //second child node is "." keyword, so we skip it and take the third node,
                    //which is an identifier with field name or keyword symbol * for wildcard
                    var fieldName = string.Empty;
                    if (columnSourceNode.ChildNodes[2].Term.Name == "identifier")
                    {
                        fieldName = columnSourceNode.ChildNodes[2].ChildNodes[0].Token.ValueString;
                    }
                    else if (columnSourceNode.ChildNodes[2].Term.Name == "*")
                    {
                        fieldName = "*";
                    }

                    EqlRelationFieldNode relFieldNode = null;
                    if (fieldName == "*")
                    {
                        relFieldNode = new EqlRelationWildcardFieldNode();
                    }
                    else
                    {
                        relFieldNode = new EqlRelationFieldNode {
                            FieldName = fieldName
                        }
                    };

                    relFieldNode.Relations.AddRange(relationInfos);
                    list.Add(relFieldNode);
                }
                    continue;

                default:
                    throw new EqlException("Unknown term in select command syntax parse tree.");
                }
            }
        }