Add new hook HookLoadFileExtended that allows plugins to supply Zeek script code to parse.

The new hooks works similar to the existing `HookLoadFile` but,
additionally, allows the plugin to return a string that contains the
code to be used for the file being loaded. If the plugin does so, the
content of any actual file on disk will be ignored (in fact, there
doesn't even need to be a file on disk in that case). This works for
both Zeek scripts and signatures.

There's a new test that covers the new functionality, testing loading
both scripts and signatures from memory. I also manually tested that the
debugger integration works, but I don't see much of a way to add a
regression test for that part.

We keep the existing hook as well for backwards compatibility. We could
decide to deprecate it, but not sure that buys us much, so left that
out.

Closes #1757.
This commit is contained in:
Robin Sommer 2021-09-24 12:50:27 +02:00
parent 1efaf8d7a4
commit 34eaf42b92
21 changed files with 1525 additions and 92 deletions

View file

@ -47,10 +47,7 @@ bool ScannedFile::AlreadyScanned() const
return rval;
}
SignatureFile::SignatureFile(std::string file)
: file(std::move(file))
{
}
SignatureFile::SignatureFile(std::string file) : file(std::move(file)) { }
SignatureFile::SignatureFile(std::string file, std::string full_path)
: file(std::move(file)), full_path(std::move(full_path))