osquery_rust/plugin/table/
query_constraint.rs

1use crate::plugin::table::ColumnType;
2use std::collections::HashMap;
3
4// QueryConstraints contains the constraints from the WHERE clause of the query,
5// that can optionally be used to optimize the table generation. Note that the
6// _osquery SQLite engine will perform the filtering with these constraints, so
7// it is not mandatory that they be used in table generation.
8// QueryConstraints is a map from column name to the details of the
9// constraints on that column.
10pub type QueryConstraints = HashMap<String, ConstraintList>;
11
12// ConstraintList contains the details of the constraints for the given column.
13#[allow(dead_code)]
14pub struct ConstraintList {
15    affinity: ColumnType,
16    constraints: Vec<Constraint>,
17}
18
19// Constraint contains both an operator and an expression that are applied as
20// constraints in the query.
21#[allow(dead_code)]
22struct Constraint {
23    op: Operator,
24    expr: String,
25}
26
27#[allow(dead_code)]
28enum Operator {
29    // 1
30    Unique,
31    // 2
32    Equals,
33    // 4
34    GreaterThan,
35    // 8
36    LessThanOrEquals,
37    // 16
38    LessThan,
39    // 32
40    GreaterThanOrEquals,
41    // 64
42    Match,
43    // 65
44    Like,
45    // 66
46    Glob,
47    // 67
48    Regexp,
49}