Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: checkpoint in middle of big reorganization.

Browse source 
- FileAnalysis::Info is now just a record used for logging, the fa_file
  record type is defined in init-bare.bro as the analogue to a
  connection record.

- Starting to transfer policy hook triggers and analyzer results to
  events.
This commit is contained in:
Jon Siwek 2013-04-09 15:49:58 -05:00
parent e73a261262
commit 641154f8e8
68 changed files with 855 additions and 871 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/file_analysis/Hash.cc
View file

@ -2,15 +2,13 @@
#include "Hash.h"
#include "util.h"
#include "Event.h"
using namespace file_analysis;
Hash::Hash(RecordVal* args, Info* info, HashVal* hv, const char* field)
: Action(args, info), hash(hv), fed(false)
Hash::Hash(RecordVal* args, File* file, HashVal* hv, const char* arg_kind)
: Action(args, file), hash(hv), fed(false), kind(arg_kind)
{
using BifType::Record::FileAnalysis::ActionResults;
if ( (result_field_idx = ActionResults->FieldOffset(field)) < 0 )
reporter->InternalError("Missing ActionResults field: %s", field);
hash->Init();
}
@ -45,6 +43,10 @@ void Hash::Finalize()
{
if ( ! hash->IsValid() || ! fed ) return;
StringVal* sv = hash->Get();
info->GetResults(args)->Assign(result_field_idx, sv);
val_list* vl = new val_list();
vl->append(file->GetVal()->Ref());
vl->append(new StringVal(kind));
vl->append(hash->Get());
mgr.Dispatch(new Event(file_hash, vl));
}