refactor(bitset): Introduce IsInitalized method

Author: rabbitstack

pkg/event/bitset.go

@@ -89,6 +89,15 @@ func (b *BitSets) IsBitSet(evt *Event) bool {
 		(b.cats != nil && b.cats.Test(uint(evt.Category.Index())))
 }
 
-func (b *BitSets) IsBitmaskInitialized() bool  { return b.bitmask != nil }
-func (b *BitSets) IsTypesInitialized() bool    { return b.types != nil }
-func (b *BitSets) IsCategoryInitialized() bool { return b.cats != nil }
+// IsInitialized checks if the given bitset type is initialized.
+func (b *BitSets) IsInitialized(bs BitSetType) bool {
+	switch bs {
+	case BitmaskBitSet:
+		return b.bitmask != nil
+	case TypeBitSet:
+		return b.types != nil
+	case CategoryBitSet:
+		return b.cats != nil
+	}
+	return false
+}

pkg/filter/ql/literal_test.go

@@ -34,47 +34,47 @@ func TestSequenceExprIsEvaluable(t *testing.T) {
 	}{
 		{"evt.name = 'CreateProcess'", &event.Event{Type: event.CreateProcess, Category: event.Process}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.True(t, sexpr.bitsets.IsTypesInitialized())
-				assert.False(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.False(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.True(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 		{"evt.name = 'CreateProcess'", &event.Event{Type: event.TerminateProcess, Category: event.Process}, false, nil},
 		{"evt.name = 'CreateProcess' or evt.name = 'TerminateThread'", &event.Event{Type: event.TerminateProcess, Category: event.Process}, false, nil},
 		{"evt.name = 'CreateProcess' or evt.category = 'object'", &event.Event{Type: event.TerminateProcess, Category: event.Process}, false, nil},
 		{"evt.name = 'CreateProcess' or evt.name = 'OpenProcess'", &event.Event{Type: event.OpenProcess, Category: event.Process}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.True(t, sexpr.bitsets.IsTypesInitialized())
-				assert.False(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.False(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.True(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 		{"evt.name = 'CreateProcess' or evt.name = 'CreateThread'", &event.Event{Type: event.CreateThread, Category: event.Thread}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.False(t, sexpr.bitsets.IsTypesInitialized())
-				assert.True(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.False(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.False(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.True(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 		{"evt.name = 'CreateProcess' or evt.category = 'registry'", &event.Event{Type: event.RegSetValue, Category: event.Registry}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.True(t, sexpr.bitsets.IsTypesInitialized())
-				assert.False(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.True(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.True(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.True(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 		{"evt.name = 'CreateProcess' or evt.name = 'OpenProcess' or evt.category = 'registry'", &event.Event{Type: event.OpenProcess, Category: event.Process}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.True(t, sexpr.bitsets.IsTypesInitialized())
-				assert.False(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.True(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.True(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.False(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.True(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 		{"evt.name = 'CreateProcess' or evt.name = 'SetThreadContext' or evt.category = 'registry'", &event.Event{Type: event.CreateProcess, Category: event.Process}, true,
 			func(t *testing.T, sexpr *SequenceExpr) {
-				assert.False(t, sexpr.bitsets.IsTypesInitialized())
-				assert.True(t, sexpr.bitsets.IsBitmaskInitialized())
-				assert.True(t, sexpr.bitsets.IsCategoryInitialized())
+				assert.False(t, sexpr.bitsets.IsInitialized(event.TypeBitSet))
+				assert.True(t, sexpr.bitsets.IsInitialized(event.BitmaskBitSet))
+				assert.True(t, sexpr.bitsets.IsInitialized(event.CategoryBitSet))
 			},
 		},
 	}