Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 08:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: add unit tests covering current protocol integration.

Browse source 
And had to make various fixes/refinements after scrutinizing results.
This commit is contained in:
Jon Siwek 2013-03-19 15:50:05 -05:00
parent b30211c178
commit 59ed5c75f1
72 changed files with 2605 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/file_analysis/Hash.cc
View file

@ -6,7 +6,7 @@
using namespace file_analysis;
Hash::Hash(RecordVal* args, Info* info, HashVal* hv, const char* field)
: Action(args, info), hash(hv)
: Action(args, info), hash(hv), fed(false)
{
using BifType::Record::FileAnalysis::ActionResults;
if ( (result_field_idx = ActionResults->FieldOffset(field)) < 0 )
@ -23,6 +23,9 @@ bool Hash::DeliverStream(const u_char* data, uint64 len)
{
if ( ! hash->IsValid() ) return false;
if ( ! fed )
fed = len > 0;
hash->Feed(data, len);
return true;
}
@ -40,7 +43,7 @@ bool Hash::Undelivered(uint64 offset, uint64 len)
void Hash::Finalize()
{
if ( ! hash->IsValid() ) return;
if ( ! hash->IsValid() || ! fed ) return;
StringVal* sv = hash->Get();
info->GetResults(args)->Assign(result_field_idx, sv);

1
src/file_analysis/Hash.h
View file

@ -31,6 +31,7 @@ protected:
void Finalize();
HashVal* hash;
bool fed;
int result_field_idx;
};

3
src/file_analysis/Info.cc
View file

@ -97,7 +97,8 @@ Info::Info(const string& unique, Connection* conn)
reinterpret_cast<u_char*>(hash));
uitoa_n(hash[0], id, sizeof(id), 62);
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s", id);
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s (%s)", id,
unique.c_str());
val = new RecordVal(BifType::Record::FileAnalysis::Info);
val->Assign(file_id_idx, new StringVal(id));