diff --git a/src/event.bif b/src/event.bif index d1ddf29d52..609cbf02b6 100644 --- a/src/event.bif +++ b/src/event.bif @@ -851,3 +851,8 @@ event new_event%(name: string, params: call_argument_vector%); ## Shows an IP address anonymization mapping. event anonymization_mapping%(orig: addr, mapped: addr%); + +## An event that signals a pcap file is done being processed. +## +## path: the filesystem path of the pcap file +event Pcap::file_done%(path: string%); diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc index eb13b4d024..52d87bd3b8 100644 --- a/src/iosource/pcap/Source.cc +++ b/src/iosource/pcap/Source.cc @@ -6,6 +6,8 @@ #include "iosource/Packet.h" #include "iosource/BPF_Program.h" +#include "Event.h" + #include "pcap.bif.h" #ifdef HAVE_PCAP_INT_H @@ -47,6 +49,9 @@ void PcapSource::Close() last_data = nullptr; Closed(); + + if ( Pcap::file_done ) + mgr.QueueEventFast(Pcap::file_done, {new StringVal(props.path)}); } void PcapSource::OpenLive() diff --git a/testing/btest/Baseline/core.pcap_file_done/out b/testing/btest/Baseline/core.pcap_file_done/out new file mode 100644 index 0000000000..d561ae9921 --- /dev/null +++ b/testing/btest/Baseline/core.pcap_file_done/out @@ -0,0 +1 @@ +pcap file done, /home/jon/pro/zeek/zeek/testing/btest/Traces/http/get.trace diff --git a/testing/btest/core/pcap_file_done.zeek b/testing/btest/core/pcap_file_done.zeek new file mode 100644 index 0000000000..b05680b121 --- /dev/null +++ b/testing/btest/core/pcap_file_done.zeek @@ -0,0 +1,7 @@ +# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT >out +# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out + +event Pcap::file_done(path: string) + { + print "pcap file done", path; + }