OVAL variable component Oval_component instances specify evaluation constraints on local variables (see oval_variable_get_type).
- If oval_component_get_type == OVAL_FUNCTION_CONCAT - Concatenation function
- Oval_function_CONCAT takes two or more components and sub-concatenates them together to form a single string. The first component makes up the begining of the resulting string and any following components are added to the end it. If one of the components returns multiple values then the concat function would be performed multiple times and the end result would be an array of values for the local variable. For example assume a local variable has two sub-components: a basic component element returns the values "abc" and "def", and a literal component element that has a value of "xyz". The local_variable element would be evaluated to have two values, "abcxyz" and "defxyz". If one of the components does not exist, then the result of the concat operation should be does not exist.
- If oval_component_get_type == OVAL_FUNCTION_COUNT - Counting function.
- The count function counts the values represented by one or more components as an integer. This function determines the total number of values referenced by all of thespecified sub-components.
- If oval_component_get_type == OVAL_FUNCTION_ARITHMETIC - Arithmetic function.
- The arithmetic function takes two or more integer or float components and performs a basic mathmetical function on them. The result of this function in a single integer or float unless one of the components returns multiple values. In this case the specified arithmetic function would be performed multiple times and the end result would be an array of values for the local variable. For example assume a local_variable specifies the arithmetic function with an arithmetic_operation of "add" and has two sub-components under this function: the first component returns multiple values "1" and "2", and the second component returns multiple values "3" and "4" and "5". The local_variable element would be evaluated to have six values: 1+3, 1+4, 1+5, 2+3, 2+4, and 2+5.
- If oval_component_get_type == OVAL_FUNCTION_REGEX_CAPTURE - Regex_capture function.
- The regex_capture function captures a single substring from a string component. The 'pattern' attribute provides a regular expression that must contain a single subexpression (using parentheses). The first match of the subexpression is considered the captured substring. For example, the pattern ^abc(.*)xyz$ would capture a substring from each of the string component's values if the value starts with abc and ends with xyz. In this case the subexpression would be all the characters that exist in between the abc and the xyz. If more than one subexpression is supplied only the first match is considered. If more than one match is identified by a single subexpression only the first match is considered. If no matches are found or a subexpression is not supplied the function will evaluate to an empty string. Note that subexpressions match the longest possible substrings.
- If oval_component_get_type == OVAL_FUNCTION_BEGIN - Begin function
- The begin function takes a single string component and defines a character (or string) that the component string should start with. The character attribute defines the specific character (or string). The character (or string) is only added to the component string if the component string doesn't already start with the specified character (or string).
- If oval_component_get_type == OVAL_FUNCTION_END - End function
- The end function takes a single string component and defines a character (or string) that the component string should end with. The character attribute defines the specific character (or string). The character (or string) is only added to the component string if the component string doesn't already end with the specified character (or string). If the desired end character is a string, then the entire end string must exist at the end if the component string. If the entire end string is not present then the entire end string is appended to the component string.
- If oval_component_get_type == OVAL_FUNCTION_SPLIT - Split function
- The split function takes a single string component and turns it into multiple values based on a delimiter string. For example, assume that a basic component element returns the value "a-b-c-d" to the split function with the delimiter set to "-". The local_variable element would be evaluated to have four values "a", "b", "c", and "d". If the basic component returns a value that begins, or ends, with a delimiter, the local_variable element would contain empty string values at the beginning, or end, of the set of values returned for that string component. For example, if the delimiter is "-", and the basic component element returns the value "-a-a-", the local_variable element would be evaluated to have four values "", "a", "a", and "". Likewise, if the basic component element returns a value that contains adjacent delimiters such as "---", the local_variable element would be evaluated to have four values "", "", "", and "". Lastly, if the basic component element used by the split function returns multiple values, then the split function is performed multiple times, and all of the results, from each of the split functions, are returned.
- If oval_component_get_type == OVAL_FUNCTION_SUBSTRING - Substring function
- The substring function takes a single string component and produces a single value that contains a portion of the original string. The substring_start attribute defines the starting position in the original string. Note, to include the first character of the string, the start position would be 1. Also note that a value less than one also means starting at the first character of the string. The substring_length attribute defines how many character after and including the starting character to include. Note that a substring_length value greater than the actual length of the string or a negative value means to include all the characters after the starting character. For example assume a basic component element that returns the value "abcdefg" with a substring_start value of 3 and a substring_length value of 2. The local_variable element would be evaluate to have a single value of "cd". If the string component used by the substring function returns multiple values, then the substring operation is performed multiple times and results in multiple values for the component.
- If oval_component_get_type == OVAL_FUNCTION_TIMEDIF - Time difference function
- Oval_function_TIMEDIF calculates the difference in seconds between date-time values. If one component is specified, the values of that component are subtracted from the current time (UTC). If two components are specified, the value of the second component is subtracted from the value of the first component. If the component(s) contain multiple values, the operation is performed multiple times on the Cartesian product of the component(s) and the result is an array of time difference values. For example, assume a local_variable specifies the time_difference function and has two sub-components under this function: the first component returns multiple values "04/02/2009" and "04/03/2009", and the second component returns multiple values "02/02/2005" and "02/03/2005" and "02/04/2005". The local_variable element would be evaluated to have six values: (ToSeconds("04/02/2009") - ToSeconds("02/02/2005")), (ToSeconds("04/02/2009") - ToSeconds("02/03/2005")), (ToSeconds("04/02/2009") - ToSeconds("02/04/2005")), (ToSeconds("04/03/2009") - ToSeconds("02/02/2005")), (ToSeconds("04/03/2009") - ToSeconds("02/03/2005")), and (ToSeconds("04/03/2009") - ToSeconds("02/04/2005"))..
- If oval_component_get_type == OVAL_FUNCTION_ESCAPE_REGEX - Escape Regular Expression function
- Oval_function_ESCAPE_REGEX takes a single string component and escapes all the regular expression characters. The purpose for this is that many times, a component used in pattern match needs to be treated as a literal string and not a regular expression. For example, assume a basic component element that identifies a file path that is held in the Windows registry. This path is a string that might contain regular expression characters. These characters are likely not intended to be treated as regular expression characters and need to be escaped. This function allows a definition writer to mark convert the values of components to regular expression format. Note that when using regular expressions, OVAL supports a common subset of the regular expression character classes, operations, expressions and other lexical tokens defined within Perl 5's regular expression specification. For more information on the supported regular expression syntax in OVAL see: http://oval.mitre.org/language/about/re_support_5.6.html.
- If oval_component_get_type == OVAL_COMPONENT_LITERAL - Literal component
- Oval_literal evaluates to a literal value.
- If oval_component_get_type == OVAL_COMPONENT_OBJECTREF - Object component
- Oval_component_object binds an Oval_object. During evaluation of the component, the object is queried and the resultant item stream is transformed to provide the Oval_value stream that constitutes the evaluation result of this component. The item stream transformation consists of using the component object_field attribute to identify the name of a specific item field whose value is appended to the component value stream.
- If oval_component_get_type == OVAL_COMPONENT_VARREF - Variable component
- Oval_variable_component binds an Oval_variable. The component evaluation is the result of the evaluation of the bound Oval_variable.
|
| struct oval_component * | oval_component_new (struct oval_definition_model *, oval_component_type_t type) |
| | Construct new intance of Oval_component. More...
|
| |
| struct oval_component * | oval_component_clone (struct oval_definition_model *new_model, struct oval_component *old_component) |
| | Clone instance of Oval_component. More...
|
| |
|
void | oval_component_free (struct oval_component *) |
| | Free instance of Oval_component.
|
| |
|
|
void | oval_component_set_type (struct oval_component *component, oval_component_type_t type) |
| | Set type of component Oval_component->type.
|
| |
| void | oval_component_set_object (struct oval_component *, struct oval_object *object) |
| | set attribute Oval_component_object->object. More...
|
| |
|
void | oval_component_set_item_field (struct oval_component *, char *) |
| | set attribute Oval_component_object->item_field.
|
| |
|
void | oval_component_set_record_field (struct oval_component *, char *) |
| | set attribute Oval_component_object->record_field.
|
| |
| void | oval_component_set_variable (struct oval_component *, struct oval_variable *variable) |
| | set attribute Oval_component_object->variable. More...
|
| |
|
void | oval_component_add_function_component (struct oval_component *, struct oval_component *) |
| |
|
void | oval_component_set_arithmetic_operation (struct oval_component *, oval_arithmetic_operation_t) |
| |
|
void | oval_component_set_prefix (struct oval_component *, char *) |
| |
|
void | oval_component_set_suffix (struct oval_component *, char *) |
| |
|
void | oval_component_set_split_delimiter (struct oval_component *, char *) |
| |
|
void | oval_component_set_glob_to_regex_glob_noescape (struct oval_component *, bool) |
| |
|
void | oval_component_set_substring_start (struct oval_component *, int) |
| |
|
void | oval_component_set_substring_length (struct oval_component *, int) |
| |
|
void | oval_component_set_timedif_format_1 (struct oval_component *, oval_datetime_format_t) |
| |
|
void | oval_component_set_timedif_format_2 (struct oval_component *, oval_datetime_format_t) |
| |
|
void | oval_component_set_regex_pattern (struct oval_component *, char *) |
| |
|
void | oval_component_set_literal_value (struct oval_component *, struct oval_value *) |
| |
|
|
oval_component_type_t | oval_component_get_type (struct oval_component *) |
| | Returns attribute Oval_component->type.
|
| |
| struct oval_object * | oval_component_get_object (struct oval_component *) |
| | Returns attribute Oval_component_object->object. More...
|
| |
| char * | oval_component_get_item_field (struct oval_component *) |
| | Returns attribute Oval_component_object->item_field. More...
|
| |
| char * | oval_component_get_record_field (struct oval_component *) |
| | Returns attribute Oval_component_object->record_field. More...
|
| |
| struct oval_variable * | oval_component_get_variable (struct oval_component *) |
| | Returns attribute Oval_component_variable->variable. More...
|
| |
| struct oval_component_iterator * | oval_component_get_function_components (struct oval_component *) |
| | Returns attribute Oval_function->components. More...
|
| |
| oval_arithmetic_operation_t | oval_component_get_arithmetic_operation (struct oval_component *) |
| | Returns attribute Oval_function_ARITHMETIC->arithmetic_operation. More...
|
| |
| char * | oval_component_get_prefix (struct oval_component *) |
| | Returns attribute Oval_function_BEGIN->prefix. More...
|
| |
| char * | oval_component_get_suffix (struct oval_component *) |
| | Returns attribute Oval_function_END->suffix. More...
|
| |
| char * | oval_component_get_split_delimiter (struct oval_component *) |
| | Returns attribute Oval_function_SPLIT->delimiter. More...
|
| |
| bool | oval_component_get_glob_to_regex_glob_noescape (struct oval_component *) |
| | Returns attribute Oval_function_GLOB_TO_REGEX->glob_noescape. More...
|
| |
| int | oval_component_get_substring_start (struct oval_component *) |
| | Returns attribute Oval_function_SUBSTRING->start. More...
|
| |
| int | oval_component_get_substring_length (struct oval_component *) |
| | Returns attribute Oval_function_SUBSTRING->length. More...
|
| |
| oval_datetime_format_t | oval_component_get_timedif_format_1 (struct oval_component *) |
| | Returns attribute Oval_function_TIMEDIF->timedif_format_1. More...
|
| |
| oval_datetime_format_t | oval_component_get_timedif_format_2 (struct oval_component *) |
| | Returns attribute Oval_function_TIMEDIF->timedif_format_2. More...
|
| |
| char * | oval_component_get_regex_pattern (struct oval_component *) |
| | Returns attribute Oval_function_REGEX_CAPTURE->pattern. More...
|
| |
| struct oval_value * | oval_component_get_literal_value (struct oval_component *) |
| | Returns attribute Oval_literal->literal. More...
|
| |
1.8.5
