Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add an is_orig parameter to file_over_new_connection event.

Browse source
This commit is contained in:
Jon Siwek 2013-07-09 15:58:28 -05:00
parent efe878f3de
commit 73155c321b
12 changed files with 21 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/file_analysis/File.cc
View file

@ -90,7 +90,7 @@ File::File(const string& file_id, Connection* conn, analyzer::Tag tag,
// add source, connection, is_orig fields
SetSource(analyzer_mgr->GetAnalyzerName(tag));
val->Assign(is_orig_idx, new Val(is_orig, TYPE_BOOL));
UpdateConnectionFields(conn);
UpdateConnectionFields(conn, is_orig);
}
UpdateLastActivityTime();
@ -113,7 +113,7 @@ double File::GetLastActivityTime() const
return val->Lookup(last_active_idx)->AsTime();
}
void File::UpdateConnectionFields(Connection* conn)
void File::UpdateConnectionFields(Connection* conn, bool is_orig)
{
if ( ! conn )
return;
@ -137,6 +137,7 @@ void File::UpdateConnectionFields(Connection* conn)
val_list* vl = new val_list();
vl->append(val->Ref());
vl->append(conn_val->Ref());
vl->append(new Val(is_orig, TYPE_BOOL));
if ( did_file_new_event )
FileEvent(file_over_new_connection, vl);

3
src/file_analysis/File.h
View file

@ -173,8 +173,9 @@ protected:
* Updates the "conn_ids" and "conn_uids" fields in #val record with the
* \c conn_id and UID taken from \a conn.
* @param conn the connection over which a part of the file has been seen.
* @param is_orig true if the connection originator is sending the file.
*/
void UpdateConnectionFields(Connection* conn);
void UpdateConnectionFields(Connection* conn, bool is_orig);
/**
* Increment a byte count field of #val record by \a size.

2
src/file_analysis/Manager.cc
View file

@ -250,7 +250,7 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
rval->UpdateLastActivityTime();
if ( update_conn )
rval->UpdateConnectionFields(conn);
rval->UpdateConnectionFields(conn, is_orig);
}
return rval;