Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add file analysis action to send data to script-land in chosen events.

Browse source
This commit is contained in:
Jon Siwek 2013-02-22 16:49:53 -06:00
parent 85410a7657
commit 4b30cc2e24
10 changed files with 134 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/file_analysis.bif
View file

@ -61,11 +61,12 @@ enum Action %{
ACTION_MD5,
ACTION_SHA1,
ACTION_SHA256,
ACTION_DATA_EVENT,
%}
function FileAnalysis::postpone_timeout%(file_id: string%): bool
%{
using namespace file_analysis;
using file_analysis::FileID;
bool result = file_mgr->PostponeTimeout(FileID(file_id->CheckString()));
return new Val(result, TYPE_BOOL);
%}
@ -74,9 +75,9 @@ function FileAnalysis::add_action%(file_id: string,
action: FileAnalysis::Action,
args: any%): bool
%{
using namespace file_analysis;
RecordVal* rv = args->AsRecordVal()->CoerceTo(
BifType::Record::FileAnalysis::ActionArgs);
using file_analysis::FileID;
using BifType::Record::FileAnalysis::ActionArgs;
RecordVal* rv = args->AsRecordVal()->CoerceTo(ActionArgs);
bool result = file_mgr->AddAction(FileID(file_id->CheckString()),
action->AsEnumVal(), rv);
Unref(rv);
@ -86,7 +87,7 @@ function FileAnalysis::add_action%(file_id: string,
function FileAnalysis::remove_action%(file_id: string,
action: FileAnalysis::Action%): bool
%{
using namespace file_analysis;
using file_analysis::FileID;
bool result = file_mgr->RemoveAction(FileID(file_id->CheckString()),
action->AsEnumVal());
return new Val(result, TYPE_BOOL);
@ -94,7 +95,7 @@ function FileAnalysis::remove_action%(file_id: string,
function FileAnalysis::stop%(file_id: string%): bool
%{
using namespace file_analysis;
using file_analysis::FileID;
bool result = file_mgr->RemoveFile(FileID(file_id->CheckString()));
return new Val(result, TYPE_BOOL);
%}