{
}
+std::vector<char> Rule::data() const
+{
+ std::vector<char> ret(buf);
+ for (auto &c : conditions) {
+ if (c.second)
+ c.second->emit(ret);
+ }
+ return ret;
+}
+
void Rule::setTag(const std::string &tag)
{
//[TODO]: save tags
}
}
}
-
-void Rule::updateConditions()
-{
- for (auto &c : conditions) {
- c.second->emit(buf);
- }
-}
#ifndef __AUDIT_RULE_H__
#define __AUDIT_RULE_H__
-#include <unordered_map>
+#include <map>
#include <memory>
#include <linux/audit.h>
bool operator == (const Rule &rule)
{
- return buf == rule.buf;
+ return (data() == rule.data());
}
RuleType type() const
return _type;
}
+ std::vector<char> data() const;
+
void set(RuleType type)
{
_type = type;
bool isStringField(unsigned int type) const;
void setComponents(const std::vector<char> &rule);
- void updateConditions();
private:
RuleType _type;
std::vector<char> buf;
- std::unordered_map<unsigned int, std::shared_ptr<FieldBase>> conditions;
+ std::map<unsigned int, std::shared_ptr<FieldBase>> conditions;
};
template <typename T>