mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 13:08:20 +00:00
Working unified2 analyzer.
- No output by default yet. Most of the activity is centered around generating the Unified2::alert event which ties together an IDSEvent and a packet.
This commit is contained in:
parent
48a190276a
commit
091c8f3ebc
11 changed files with 282 additions and 69 deletions
|
@ -1,7 +1,5 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include <string>
|
||||
|
||||
#include "Unified2.h"
|
||||
#include "file_analysis/Manager.h"
|
||||
|
||||
|
@ -15,6 +13,7 @@ Unified2::Unified2(RecordVal* args, File* file)
|
|||
|
||||
Unified2::~Unified2()
|
||||
{
|
||||
delete interp;
|
||||
}
|
||||
|
||||
file_analysis::Analyzer* Unified2::Instantiate(RecordVal* args, File* file)
|
||||
|
@ -24,6 +23,15 @@ file_analysis::Analyzer* Unified2::Instantiate(RecordVal* args, File* file)
|
|||
|
||||
bool Unified2::DeliverStream(const u_char* data, uint64 len)
|
||||
{
|
||||
interp->NewData(true, data, data+len);
|
||||
try
|
||||
{
|
||||
interp->NewData(true, data, data + len);
|
||||
}
|
||||
catch ( const binpac::Exception& e )
|
||||
{
|
||||
printf("Binpac exception: %s\n", e.c_msg());
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue