Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

very basic input to event working...

Browse source
This commit is contained in:
Bernhard Amann 2011-10-25 14:11:21 -07:00
parent d7a3b85fcd
commit 5b0c307f87
5 changed files with 42 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/frameworks/input/main.bro
View file

@ -5,8 +5,8 @@ export {
type ReaderDescription: record {
source: string;
idx: any;
val: any;
destination: any;
val: any &optional;
destination: any &optional;
};
}

18
src/InputMgr.cc
View file

@ -91,8 +91,22 @@ InputReader* InputMgr::CreateReader(EnumVal* reader, RecordVal* description)
// get the source...
const BroString* bsource = description->Lookup(rtype->FieldOffset("source"))->AsString();
string source((const char*) bsource->Bytes(), bsource->Len());
reader_obj->Init(source, 0, NULL);
RecordType *idx = description->Lookup(rtype->FieldOffset("idx"))->AsType()->AsTypeType()->Type()->AsRecordType();
LogField** fields = new LogField*[idx->NumFields()];
for ( int i = 0; i < idx->NumFields(); i++ )
{
// FIXME: do type checking...
LogField* field = new LogField();
field->name = idx->FieldName(i);
field->type = idx->FieldType(i)->Tag();
fields[i] = field;
}
reader_obj->Init(source, idx->NumFields(), fields);
reader_obj->Update();
return reader_obj;

11
src/InputReader.cc
View file

@ -5,6 +5,8 @@
InputReader::InputReader()
{
buf = 0;
buf_len = 1024;
disabled = true; // disabled will be set correcty in init.
}
@ -18,6 +20,11 @@ void InputReader::Error(const char *msg)
input_mgr->Error(this, msg);
}
void InputReader::Error(const string &msg)
{
input_mgr->Error(this, msg.c_str());
}
bool InputReader::Init(string arg_source, int arg_num_fields,
const LogField* const * arg_fields)
{
@ -38,6 +45,10 @@ bool InputReader::Update() {
return DoUpdate();
}
void InputReader::SendEvent(const string& name, const int num_vals, const LogVal* const *vals) {
input_mgr->SendEvent(name, num_vals, vals);
}
// stolen from logwriter
const char* InputReader::Fmt(const char* format, ...)
{

3
src/InputReader.h
View file

@ -31,6 +31,7 @@ protected:
virtual bool DoUpdate() = 0;
// Reports an error to the user.
void Error(const string &msg);
void Error(const char *msg);
// The following methods return the information as passed to Init().
@ -39,6 +40,8 @@ protected:
// A thread-safe version of fmt(). (stolen from logwriter)
const char* Fmt(const char* format, ...);
void SendEvent(const string& name, const int num_vals, const LogVal* const *vals);
private:
friend class InputMgr;

14
src/InputReaderAscii.cc
View file

@ -37,7 +37,7 @@ bool InputReaderAscii::DoInit(string path, int num_fields, const LogField* const
file = new ifstream(path.c_str());
if ( !file->is_open() ) {
Error(Fmt("cannot open %s", path.c_str()));
Error(Fmt("cannot open %s", fname.c_str()));
return false;
}
@ -108,7 +108,7 @@ bool InputReaderAscii::DoUpdate() {
istringstream splitstream(line);
string s;
LogVal fields[num_fields];
LogVal** fields = new LogVal*[num_fields];
unsigned int currTab = 0;
unsigned int currField = 0;
@ -136,11 +136,12 @@ bool InputReaderAscii::DoUpdate() {
return false;
}
LogVal val(currMapping.type, true);
LogVal* val = new LogVal(currMapping.type, true);
switch ( currMapping.type ) {
case TYPE_STRING:
val.val.string_val = new string(s);
val->val.string_val = new string(s);
break;
default:
Error(Fmt("unsupported field format %d for %s", currMapping.type,
@ -148,6 +149,8 @@ bool InputReaderAscii::DoUpdate() {
return false;
}
fields[currField] = val;
currField++;
}
@ -157,6 +160,9 @@ bool InputReaderAscii::DoUpdate() {
}
// ok, now we have built our line. send it back to... whomever.
// for testing purposes: fixed event.
SendEvent("inputEvent", num_fields, fields);
}