Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add new hook HookLoadFileExtended that allows plugins to supply Zeek script code to parse.

Browse source 
The new hooks works similar to the existing `HookLoadFile` but,
additionally, allows the plugin to return a string that contains the
code to be used for the file being loaded. If the plugin does so, the
content of any actual file on disk will be ignored (in fact, there
doesn't even need to be a file on disk in that case). This works for
both Zeek scripts and signatures.

There's a new test that covers the new functionality, testing loading
both scripts and signatures from memory. I also manually tested that the
debugger integration works, but I don't see much of a way to add a
regression test for that part.

We keep the existing hook as well for backwards compatibility. We could
decide to deprecate it, but not sure that buys us much, so left that
out.

Closes #1757.
This commit is contained in:
Robin Sommer 2021-09-24 12:50:27 +02:00
parent 1efaf8d7a4
commit 34eaf42b92
21 changed files with 1525 additions and 92 deletions
Download patch file Download diff file Expand all files Collapse all files

65
src/PolicyFile.cc
View file

@ -72,49 +72,60 @@ int how_many_lines_in(const char* policy_filename)
return pf->lines.size();
}
bool LoadPolicyFileText(const char* policy_filename)
bool LoadPolicyFileText(const char* policy_filename,
const std::optional<std::string>& preloaded_content)
{
if ( ! policy_filename )
return true;
FILE* f = fopen(policy_filename, "r");
if ( ! f )
{
debug_msg("No such policy file: %s.\n", policy_filename);
return false;
}
PolicyFile* pf = new PolicyFile;
if ( policy_files.find(policy_filename) != policy_files.end() )
debug_msg("Policy file %s already loaded\n", policy_filename);
PolicyFile* pf = new PolicyFile;
policy_files.insert(PolicyFileMap::value_type(policy_filename, pf));
struct stat st;
if ( fstat(fileno(f), &st) != 0 )
if ( preloaded_content )
{
char buf[256];
util::zeek_strerror_r(errno, buf, sizeof(buf));
reporter->Error("fstat failed on %s: %s", policy_filename, buf);
fclose(f);
return false;
auto size = preloaded_content->size();
pf->filedata = new char[size + 1];
memcpy(pf->filedata, preloaded_content->data(), size);
pf->filedata[size] = '\0';
}
else
{
FILE* f = fopen(policy_filename, "r");
pf->lmtime = st.st_mtime;
off_t size = st.st_size;
if ( ! f )
{
debug_msg("No such policy file: %s.\n", policy_filename);
return false;
}
// ### This code is not necessarily Unicode safe!
// (probably fine with UTF-8)
pf->filedata = new char[size + 1];
if ( fread(pf->filedata, size, 1, f) != 1 )
reporter->InternalError("Failed to fread() file data");
pf->filedata[size] = 0;
fclose(f);
struct stat st;
if ( fstat(fileno(f), &st) != 0 )
{
char buf[256];
util::zeek_strerror_r(errno, buf, sizeof(buf));
reporter->Error("fstat failed on %s: %s", policy_filename, buf);
fclose(f);
return false;
}
pf->lmtime = st.st_mtime;
off_t size = st.st_size;
// ### This code is not necessarily Unicode safe!
// (probably fine with UTF-8)
pf->filedata = new char[size + 1];
if ( fread(pf->filedata, size, 1, f) != 1 )
reporter->InternalError("Failed to fread() file data");
pf->filedata[size] = 0;
fclose(f);
}
// Separate the string by newlines.
pf->lines.push_back(pf->filedata);
for ( char* iter = pf->filedata; *iter; ++iter )
{
if ( *iter == '\n' )