Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/corelight/logging-hooks' of https://github.com/corelight/bro

Browse source 
* 'topic/corelight/logging-hooks' of https://github.com/corelight/bro:
  Plugin: Add hooks for log init and writing.
This commit is contained in:
Jon Siwek 2017-05-04 11:37:48 -05:00
commit 874d2b9fb0
18 changed files with 763 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

84
src/plugin/Manager.cc
View file

@ -712,7 +712,7 @@ void Manager::HookSetupAnalyzerTree(Connection *conn) const
if ( HavePluginForHook(META_HOOK_PRE) )
{
args.push_back(conn);
args.push_back(HookArgument(conn));
MetaHookPre(HOOK_SETUP_ANALYZER_TREE, args);
}
@ -739,7 +739,7 @@ void Manager::HookUpdateNetworkTime(double network_time) const
if ( HavePluginForHook(META_HOOK_PRE) )
{
args.push_back(network_time);
args.push_back(HookArgument(network_time));
MetaHookPre(HOOK_UPDATE_NETWORK_TIME, args);
}
@ -762,7 +762,7 @@ void Manager::HookBroObjDtor(void* obj) const
if ( HavePluginForHook(META_HOOK_PRE) )
{
args.push_back(obj);
args.push_back(HookArgument(obj));
MetaHookPre(HOOK_BRO_OBJ_DTOR, args);
}
@ -779,6 +779,84 @@ void Manager::HookBroObjDtor(void* obj) const
MetaHookPost(HOOK_BRO_OBJ_DTOR, args, HookArgument());
}
void Manager::HookLogInit(const std::string& writer,
const std::string& instantiating_filter,
bool local, bool remote,
const logging::WriterBackend::WriterInfo& info,
int num_fields,
const threading::Field* const* fields) const
{
HookArgumentList args;
if ( HavePluginForHook(META_HOOK_PRE) )
{
args.push_back(HookArgument(writer));
args.push_back(HookArgument(instantiating_filter));
args.push_back(HookArgument(local));
args.push_back(HookArgument(remote));
args.push_back(HookArgument(&info));
args.push_back(HookArgument(num_fields));
args.push_back(HookArgument(std::make_pair(num_fields, fields)));
MetaHookPre(HOOK_LOG_INIT, args);
}
hook_list* l = hooks[HOOK_LOG_INIT];
if ( l )
for ( hook_list::iterator i = l->begin(); i != l->end(); ++i )
{
Plugin* p = (*i).second;
p->HookLogInit(writer, instantiating_filter, local, remote, info,
num_fields, fields);
}
if ( HavePluginForHook(META_HOOK_POST) )
MetaHookPost(HOOK_LOG_INIT, args, HookArgument());
}
bool Manager::HookLogWrite(const std::string& writer,
const std::string& filter,
const logging::WriterBackend::WriterInfo& info,
int num_fields,
const threading::Field* const* fields,
threading::Value** vals) const
{
HookArgumentList args;
if ( HavePluginForHook(META_HOOK_PRE) )
{
args.push_back(HookArgument(writer));
args.push_back(HookArgument(filter));
args.push_back(HookArgument(&info));
args.push_back(HookArgument(num_fields));
args.push_back(HookArgument(std::make_pair(num_fields, fields)));
args.push_back(HookArgument(vals));
MetaHookPre(HOOK_LOG_WRITE, args);
}
hook_list* l = hooks[HOOK_LOG_WRITE];
bool result = true;
if ( l )
for ( hook_list::iterator i = l->begin(); i != l->end(); ++i )
{
Plugin* p = (*i).second;
if ( ! p->HookLogWrite(writer, filter, info, num_fields, fields,
vals) )
{
result = false;
break;
}
}
if ( HavePluginForHook(META_HOOK_POST) )
MetaHookPost(HOOK_LOG_WRITE, args, HookArgument(result));
return result;
}
void Manager::MetaHookPre(HookType hook, const HookArgumentList& args) const
{
hook_list* l = hooks[HOOK_CALL_FUNCTION];