Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 18:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add MD5/SHA1/SHA256 file analysis hashing actions.

Browse source
This commit is contained in:
Jon Siwek 2013-02-21 21:05:01 -06:00
parent ceb471fb36
commit 85410a7657
11 changed files with 271 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/file_analysis/Action.h
View file

@ -2,9 +2,12 @@
#define FILE_ANALYSIS_ACTION_H
#include "Val.h"
#include "NetVar.h"
namespace file_analysis {
typedef BifEnum::FileAnalysis::Action ActionTag;
class Info;
/**
@ -17,29 +20,44 @@ public:
/**
* Subclasses may override this to receive file data non-sequentially.
* @return true if the action is still in a valid state to continue
* receiving data/events or false if it's essentially "done".
*/
virtual void DeliverChunk(const u_char* data, uint64 len, uint64 offset) {}
virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset)
{ return true; }
/**
* Subclasses may override this to receive file sequentially.
* @return true if the action is still in a valid state to continue
* receiving data/events or false if it's essentially "done".
*/
virtual void DeliverStream(const u_char* data, uint64 len) {}
virtual bool DeliverStream(const u_char* data, uint64 len)
{ return true; }
/**
* Subclasses may override this to specifically handle the end of a file.
* @return true if the action is still in a valid state to continue
* receiving data/events or false if it's essentially "done".
*/
virtual void EndOfFile() {}
virtual bool EndOfFile()
{ return true; }
/**
* Subclasses may override this to handle missing data in a file stream.
* @return true if the action is still in a valid state to continue
* receiving data/events or false if it's essentially "done".
*/
virtual void Undelivered(uint64 offset, uint64 len) {}
virtual bool Undelivered(uint64 offset, uint64 len)
{ return true; }
ActionTag Tag() const { return tag; }
protected:
Action(Info* arg_info) {}
Action(Info* arg_info, ActionTag arg_tag) : info(arg_info), tag(arg_tag) {}
Info* info;
ActionTag tag;
};
typedef Action* (*ActionInstantiator)(const RecordVal* args, Info* info);