Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add input interface to forward data for file analysis.

Browse source 
The new Input::add_analysis function is used to automatically forward
input data on to the file analysis framework.
This commit is contained in:
Jon Siwek 2013-05-21 10:29:22 -05:00
parent 90fa331279
commit 0ef074594d
9 changed files with 219 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/file_analysis/File.cc
View file

@ -85,14 +85,10 @@ File::File(const string& file_id, Connection* conn, AnalyzerTag::Tag tag,
if ( conn )
{
// add source, connection, is_orig fields
val->Assign(source_idx, new StringVal(::Analyzer::GetTagName(tag)));
SetSource(::Analyzer::GetTagName(tag));
val->Assign(is_orig_idx, new Val(is_orig, TYPE_BOOL));
UpdateConnectionFields(conn);
}
else
{
// TODO: what to use as source field? (input framework interface)
}
UpdateLastActivityTime();
}
@ -172,6 +168,18 @@ int File::Idx(const string& field)
return rval;
}
string File::GetSource() const
{
Val* v = val->Lookup(source_idx);
return v ? v->AsString()->CheckString() : string();
}
void File::SetSource(const string& source)
{
val->Assign(source_idx, new StringVal(source.c_str()));
}
double File::GetTimeoutInterval() const
{
return LookupFieldDefaultInterval(timeout_interval_idx);