search

RackSec / desdemona

Data-backed security operations
Eclipse Public License 1.0
2 stars 7 forks source link

Free variables should be implicitly distinct #119

Open lvh opened 8 years ago

lvh commented 8 years ago

Right now, multiple fresh variables are not implicitly distinct. For example, with the events [{:ip "10.0.0.1"}], the query '(= (:ip x) (:ip y) "10.0.0.1") will (correctly!) result in: [[{:ip "10.0.0.1"} {:ip "10.0.0.1"}]]. While this is correct from a logic program perspective, this is probably not what the SOC wants. We can solve this by applying distincto to all of the logic variables.

lvh commented 8 years ago

This of course gets combinatorically worse once you add more logic variables.