Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 17:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Event/zeek.bif: Add EventMetadata current() and current_values() accessors

Browse source 
...and basic smoke testing.
This commit is contained in:
Arne Welzel 2025-05-21 16:48:47 +02:00
parent 53b0f0ad64
commit 75aa6588fe
14 changed files with 155 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

34
src/Event.cc
View file

@ -66,6 +66,40 @@ Event::Event(detail::EventMetadataVectorPtr arg_meta, const EventHandlerPtr& arg
Ref(obj);
}
zeek::VectorValPtr Event::MetadataValues(const EnumValPtr& id) const {
static const auto& any_vec_t = zeek::id::find_type<zeek::VectorType>("any_vec");
auto result = zeek::make_intrusive<zeek::VectorVal>(any_vec_t);
if ( ! meta )
return result;
auto id_int = id->Get();
if ( id_int < 0 )
zeek::reporter->InternalError("Negative enum value %s: %" PRId64, obj_desc_short(id.get()).c_str(), id_int);
zeek_uint_t uintid = static_cast<zeek_uint_t>(id_int);
const auto* desc = event_registry->LookupMetadata(uintid);
if ( ! desc )
return result;
for ( const auto& entry : *meta ) {
if ( entry.Id() != uintid )
continue;
// Sanity check the type.
if ( ! same_type(desc->Type(), entry.Val()->GetType()) ) {
zeek::reporter->InternalWarning("metadata has unexpected type %s, wanted %s",
obj_desc_short(entry.Val()->GetType().get()).c_str(),
obj_desc_short(desc->Type().get()).c_str());
continue;
}
result->Append(entry.Val());
}
return result;
}
double Event::Time() const {
if ( ! meta )
return 0.0;