Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add filter_subnet_table bif

Browse source 
This bif works similar to the matching_subnet bif. The difference is
that, instead of returning a vector of the subnets that match, we return
a filtered view of the original set/table only containing the changed
subnets.

This commit also fixes a small bug in TableVal::UpdateTimestamp
(ReadOperation only has to be called when LoggingAccess() is true).
This commit is contained in:
Johanna Amann 2016-03-16 15:50:13 -07:00
parent f5ce4785ea
commit a6cb85d86a
7 changed files with 153 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

50
src/Val.cc
View file

@ -1833,6 +1833,54 @@ Val* TableVal::Lookup(Val* index, bool use_default_val)
return def;
}
VectorVal* TableVal::LookupSubnets(const SubNetVal* search)
{
if ( ! subnets )
reporter->InternalError("LookupSubnets called on wrong table type");
VectorVal* result = new VectorVal(internal_type("subnet_vec")->AsVectorType());
auto matches = subnets->FindAll(search);
for ( auto element : matches )
{
SubNetVal* s = new SubNetVal(get<0>(element));
result->Assign(result->Size(), s);
}
return result;
}
TableVal* TableVal::LookupSubnetValues(const SubNetVal* search)
{
if ( ! subnets )
reporter->InternalError("LookupSubnetValues called on wrong table type");
TableVal* nt = new TableVal(this->Type()->Ref()->AsTableType());
auto matches = subnets->FindAll(search);
for ( auto element : matches )
{
SubNetVal* s = new SubNetVal(get<0>(element));
TableEntryVal* entry = reinterpret_cast<TableEntryVal*>(get<1>(element));
if ( entry && entry->Value() )
nt->Assign(s, entry->Value()->Ref());
else
nt->Assign(s, 0); // set
if ( entry )
{
entry->SetExpireAccess(network_time);
if ( LoggingAccess() && attrs->FindAttr(ATTR_EXPIRE_READ) )
ReadOperation(s, entry);
}
Unref(s); // assign does not consume index
}
return nt;
}
bool TableVal::UpdateTimestamp(Val* index)
{
TableEntryVal* v;
@ -1854,7 +1902,7 @@ bool TableVal::UpdateTimestamp(Val* index)
return false;
v->SetExpireAccess(network_time);
if ( attrs->FindAttr(ATTR_EXPIRE_READ) )
if ( LoggingAccess() && attrs->FindAttr(ATTR_EXPIRE_READ) )
ReadOperation(index, v);
return true;