
/*****************************************************************************
**
**  This program is free software; you can redistribute it and/or
**  modify it, however, you cannot sell it.
**
**  This program is distributed in the hope that it will be useful,
**  but WITHOUT ANY WARRANTY; without even the implied warranty of
**  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
**
**  You should have received a copy of the license attached to the
**  use of this software.  If not, visit www.shmoo.com/osiris for
**  details.
**
*****************************************************************************/

/*****************************************************************************
**
**  File:    notify_filter.h
**  Date:    September 17, 2003
**
**  Author:  Brian Wotring
**
**  Purpose: structure representing a notification filter object
**           used to filter out deltas that will trigger a notification.
**
*****************************************************************************/

#ifndef NOTIFY_FILTER_H
#define NOTIFY_FILTER_H


#define NOTIFY_FILTER_TYPE_INCLUDE_ONLY    0x1
#define NOTIFY_FILTER_TYPE_EXCLUDE         0x2

typedef enum
{
    /* UNIX 1 */

    ATTR_CHECKSUM      = 1 << 0,
    ATTR_DEVICE        = 1 << 1,
    ATTR_INODE         = 1 << 2,
    ATTR_PERMISSIONS   = 1 << 3,
    ATTR_LINKS         = 1 << 4,
    ATTR_UID           = 1 << 5,
    ATTR_GID           = 1 << 6,
    ATTR_MTIME         = 1 << 7,
    ATTR_ATIME         = 1 << 8,
    ATTR_CTIME         = 1 << 9,
    ATTR_DEVICE_TYPE   = 1 << 10,
    ATTR_BYTES         = 1 << 11,
    ATTR_BLOCKS        = 1 << 12,
    ATTR_BLOCK_SIZE    = 1 << 13,

    /* WINNT */

    ATTR_OWNER_SID       = 1 << 14,
    ATTR_GROUP_SID       = 1 << 15,
    ATTR_WIN32_FILE      = 1 << 16,

    /* new and missing. */

    ATTR_NEW           = 1 << 17,
    ATTR_MISSING       = 1 << 18

} OSI_ATTR_MASK;

struct n_keywords
{
    char *word;
    int  type;
};

static struct n_keywords notify_keywords[] =
{
    { "csum", ATTR_CHECKSUM },
    { "device", ATTR_DEVICE },
    { "inode", ATTR_INODE },
    { "perm", ATTR_PERMISSIONS },
    { "links", ATTR_LINKS },
    { "uid", ATTR_UID },
    { "gid", ATTR_GID },
    { "mtime", ATTR_MTIME },
    { "atime", ATTR_ATIME },
    { "ctime", ATTR_CTIME },
    { "dtype", ATTR_DEVICE_TYPE },
    { "bytes", ATTR_BYTES },
    { "blocks", ATTR_BLOCKS },
    { "bsize", ATTR_BLOCK_SIZE },
    { "osid", ATTR_OWNER_SID },
    { "gsid", ATTR_GROUP_SID },
    { "fileattr", ATTR_WIN32_FILE },
    { "new", ATTR_NEW },
    { "missing", ATTR_MISSING },
    { NULL, 0 }
};


static struct n_keywords notify_descriptions[] =
{
    { "checksum", ATTR_CHECKSUM },
    { "device number", ATTR_DEVICE },
    { "inode number", ATTR_INODE },
    { "permissions (mode)", ATTR_PERMISSIONS },
    { "number of hard links", ATTR_LINKS },
    { "user ID", ATTR_UID },
    { "group ID", ATTR_GID },
    { "last modification time", ATTR_MTIME },
    { "last access time", ATTR_ATIME },
    { "last change time", ATTR_CTIME },
    { "device type", ATTR_DEVICE_TYPE },
    { "number of bytes", ATTR_BYTES },
    { "number of blocks", ATTR_BLOCKS },
    { "block size", ATTR_BLOCK_SIZE },
    { "owner SID", ATTR_OWNER_SID },
    { "group SID", ATTR_GROUP_SID },
    { "windows file attributes", ATTR_WIN32_FILE },
    { "not in trusted database", ATTR_NEW },
    { "not present in latest scan", ATTR_MISSING },
    { NULL, 0 }
};


typedef struct OSI_NOTIFY_FILTER
{
    char host[MAX_HOSTNAME_LENGTH];
    char path[MAX_PATH_LENGTH];

    osi_uint64 type; 
    osi_uint64 mask;
    
} OSI_NOTIFY_FILTER;

void wrap_notify_filter( OSI_NOTIFY_FILTER *filter );
void unwrap_notify_filter( OSI_NOTIFY_FILTER *filter );

unsigned int pack_notify_filter( OSI_NOTIFY_FILTER *filter, char *buffer,
                                 int buffer_size );

void unpack_notify_filter( OSI_NOTIFY_FILTER *filter, char *buffer,
                           int buffer_size );


void print_notify_filter( OSI_NOTIFY_FILTER *filter );
void print_notify_attribute_mask( osi_uint64 attr_list );
void print_valid_notify_filter_attributes();


char * osi_get_name_for_notify_attribute( osi_uint64 attr );
unsigned long mask_from_notify_keywords( const char *keywords );


#endif
