private EqlNode BuildOperandNode(ParseTreeNode parseTreeNode)
{
if (parseTreeNode.Term.Name == "binary_expression")
{
return(BuildBinaryExpressionNode(parseTreeNode));
}
if (parseTreeNode.Term.Name == "term")
{
switch (parseTreeNode.ChildNodes[0].Term.Name.ToLowerInvariant())
{
case "expression_identifier":
if (parseTreeNode.ChildNodes[0].ChildNodes[0].Term != null &&
parseTreeNode.ChildNodes[0].ChildNodes[0].Term.Name == "column_relation")
{
var direction = EqlRelationDirectionType.TargetOrigin;
if (parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[0].Token.ValueString == "$$")
{
direction = EqlRelationDirectionType.OriginTarget;
}
var relationNameNode = parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[1];
var fieldName = parseTreeNode.ChildNodes[0].ChildNodes[2].ChildNodes[0].Token.ValueString;
EqlRelationFieldNode result = new EqlRelationFieldNode {
FieldName = fieldName
};
result.Relations.Add(new EqlRelationInfo {
Name = relationNameNode.ChildNodes[0].Token.ValueString, Direction = direction
});
return(result);
}
else
{
var fieldName = parseTreeNode.ChildNodes[0].ChildNodes[0].ChildNodes[0].Token.ValueString;
return(new EqlFieldNode {
FieldName = fieldName
});
}
case "argument":
var argName = parseTreeNode.ChildNodes[0].ChildNodes[1].Token.ValueString;
return(new EqlArgumentValueNode {
ArgumentName = argName
});
case "number":
return(new EqlNumberValueNode {
Number = Convert.ToDecimal(parseTreeNode.ChildNodes[0].Token.ValueString)
});
case "string":
return(new EqlTextValueNode {
Text = parseTreeNode.ChildNodes[0].Token.ValueString
});
case "null":
return(new EqlKeywordNode {
Keyword = "null"
});
case "true":
return(new EqlKeywordNode {
Keyword = "true"
});
case "false":
return(new EqlKeywordNode {
Keyword = "false"
});
case "expression_list":
return(BuildBinaryExpressionNode(parseTreeNode.ChildNodes[0].ChildNodes[0]));
default:
throw new EqlException("Unexpected term during process of binary operations.");
}
}
return(null);
}
private void BuildSelectFieldList(List <EqlFieldNode> list, ParseTreeNode parseTreeNode)
{
foreach (var parseNode in parseTreeNode.ChildNodes)
{
var columnSourceNode = parseNode.ChildNodes[0];
var fieldNode = columnSourceNode.ChildNodes[0];
switch (fieldNode.Term.Name)
{
case "*":
{
list.Add(new EqlWildcardFieldNode());
}
continue;
case "identifier":
{
string fieldName = fieldNode.ChildNodes[0].Token.ValueString;
list.Add(new EqlFieldNode()
{
FieldName = fieldName
});
}
continue;
case "column_relation_list":
{
List <EqlRelationInfo> relationInfos = GetRelationInfos(fieldNode);
//second child node is "." keyword, so we skip it and take the third node,
//which is an identifier with field name or keyword symbol * for wildcard
var fieldName = string.Empty;
if (columnSourceNode.ChildNodes[2].Term.Name == "identifier")
{
fieldName = columnSourceNode.ChildNodes[2].ChildNodes[0].Token.ValueString;
}
else if (columnSourceNode.ChildNodes[2].Term.Name == "*")
{
fieldName = "*";
}
EqlRelationFieldNode relFieldNode = null;
if (fieldName == "*")
{
relFieldNode = new EqlRelationWildcardFieldNode();
}
else
{
relFieldNode = new EqlRelationFieldNode {
FieldName = fieldName
}
};
relFieldNode.Relations.AddRange(relationInfos);
list.Add(relFieldNode);
}
continue;
default:
throw new EqlException("Unknown term in select command syntax parse tree.");
}
}
}