Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Plugin: Add hooks for log init and writing.

Browse source 
The two hooks being added are:

void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields);

which is called when a writer is being instantiated and contains
information about the fields being logged, as well as

bool HookLogWrite(const std::string& writer, const std::string& filter, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields, threading::Value** vals);

which is called for each log line being written by each writer. It
contains all the data being written. The data can be changed in the
function call and lines can be prevented from being written.

This commit also fixes a few small problems with plugin hooks itself,
and extends the tests that were already there, besides introducing tests
for the added functionality.
This commit is contained in:
Johanna Amann 2017-02-27 10:01:14 -08:00
parent 2c2c9c9052
commit 684ea8aa37
16 changed files with 689 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/threading/Formatter.cc
View file

@ -22,7 +22,7 @@ Formatter::~Formatter()
{
}
string Formatter::Render(const threading::Value::addr_t& addr) const
string Formatter::Render(const threading::Value::addr_t& addr)
{
if ( addr.family == IPv4 )
{
@ -90,7 +90,7 @@ threading::Value::addr_t Formatter::ParseAddr(const string &s) const
return val;
}
string Formatter::Render(const threading::Value::subnet_t& subnet) const
string Formatter::Render(const threading::Value::subnet_t& subnet)
{
char l[16];
@ -104,7 +104,7 @@ string Formatter::Render(const threading::Value::subnet_t& subnet) const
return s;
}
string Formatter::Render(double d) const
string Formatter::Render(double d)
{
char buf[256];
modp_dtoa(d, buf, 6);

6
src/threading/Formatter.h
View file

@ -87,7 +87,7 @@ public:
*
* @return An ASCII representation of the address.
*/
string Render(const threading::Value::addr_t& addr) const;
static string Render(const threading::Value::addr_t& addr);
/**
* Convert an subnet value into a string.
@ -98,7 +98,7 @@ public:
*
* @return An ASCII representation of the subnet.
*/
string Render(const threading::Value::subnet_t& subnet) const;
static string Render(const threading::Value::subnet_t& subnet);
/**
* Convert a double into a string. This renders the double with Bro's
@ -110,7 +110,7 @@ public:
*
* @return An ASCII representation of the double.
*/
string Render(double d) const;
static string Render(double d);
/**
* Convert a string into a TransportProto. The string must be one of