Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Reformat the world

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-09-16 15:35:39 -07:00
parent 194cb24547
commit b2f171ec69
714 changed files with 35149 additions and 35203 deletions
Download patch file Download diff file Expand all files Collapse all files

85
src/RuleAction.h
View file

@ -1,72 +1,75 @@
#pragma once
#include "zeek/analyzer/Tag.h"
#include <sys/types.h> // for u_char
#include <string>
namespace zeek::detail {
#include "zeek/analyzer/Tag.h"
namespace zeek::detail
{
class Rule;
class RuleEndpointState;
// Base class of all rule actions.
class RuleAction {
class RuleAction
{
public:
RuleAction() { }
virtual ~RuleAction() { }
RuleAction() { }
virtual ~RuleAction() { }
virtual void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) = 0;
virtual void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) = 0;
virtual void PrintDebug() = 0;
};
};
// Implements the "event" keyword.
class RuleActionEvent : public RuleAction {
class RuleActionEvent : public RuleAction
{
public:
explicit RuleActionEvent(const char* arg_msg);
~RuleActionEvent() override { delete [] msg; }
~RuleActionEvent() override { delete[] msg; }
void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) override;
void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) override;
void PrintDebug() override;
private:
const char* msg;
};
};
class RuleActionMIME : public RuleAction {
class RuleActionMIME : public RuleAction
{
public:
explicit RuleActionMIME(const char* arg_mime, int arg_strength = 0);
~RuleActionMIME() override
{ delete [] mime; }
~RuleActionMIME() override { delete[] mime; }
void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) override
{ }
void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) override
{
}
void PrintDebug() override;
std::string GetMIME() const
{ return mime; }
std::string GetMIME() const { return mime; }
int GetStrength() const
{ return strength; }
int GetStrength() const { return strength; }
private:
const char* mime;
int strength;
};
};
// Base class for enable/disable actions.
class RuleActionAnalyzer : public RuleAction {
class RuleActionAnalyzer : public RuleAction
{
public:
explicit RuleActionAnalyzer(const char* analyzer);
void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) override = 0;
void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) override = 0;
void PrintDebug() override;
@ -76,26 +79,28 @@ public:
private:
analyzer::Tag analyzer;
analyzer::Tag child_analyzer;
};
};
class RuleActionEnable : public RuleActionAnalyzer {
class RuleActionEnable : public RuleActionAnalyzer
{
public:
explicit RuleActionEnable(const char* analyzer) : RuleActionAnalyzer(analyzer) {}
explicit RuleActionEnable(const char* analyzer) : RuleActionAnalyzer(analyzer) { }
void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) override;
void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) override;
void PrintDebug() override;
};
};
class RuleActionDisable : public RuleActionAnalyzer {
class RuleActionDisable : public RuleActionAnalyzer
{
public:
explicit RuleActionDisable(const char* analyzer) : RuleActionAnalyzer(analyzer) {}
explicit RuleActionDisable(const char* analyzer) : RuleActionAnalyzer(analyzer) { }
void DoAction(const Rule* parent, RuleEndpointState* state,
const u_char* data, int len) override;
void DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data,
int len) override;
void PrintDebug() override;
};
};
} // namespace zeek::detail
} // namespace zeek::detail