mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
Reformat Zeek in Spicy style
This largely copies over Spicy's `.clang-format` configuration file. The one place where we deviate is header include order since Zeek depends on headers being included in a certain order.
This commit is contained in:
Benjamin Bannier
parent
7b8e7ed72c
commit
f5a76c1aed
786 changed files with 131714 additions and 153609 deletions
|
|
@ -9,67 +9,59 @@
|
|||
#include "zeek/file_analysis/Manager.h"
|
||||
#include "zeek/util.h"
|
||||
|
||||
namespace zeek::file_analysis::detail
|
||||
{
|
||||
namespace zeek::file_analysis::detail {
|
||||
|
||||
Extract::Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename,
|
||||
uint64_t arg_limit, bool arg_limit_includes_missing)
|
||||
: file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), std::move(args), file),
|
||||
filename(arg_filename), limit(arg_limit), written(0),
|
||||
limit_includes_missing(arg_limit_includes_missing)
|
||||
{
|
||||
char buf[128];
|
||||
file_stream = fopen(filename.data(), "wb");
|
||||
Extract::Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename, uint64_t arg_limit,
|
||||
bool arg_limit_includes_missing)
|
||||
: file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), std::move(args), file),
|
||||
filename(arg_filename),
|
||||
limit(arg_limit),
|
||||
written(0),
|
||||
limit_includes_missing(arg_limit_includes_missing) {
|
||||
char buf[128];
|
||||
file_stream = fopen(filename.data(), "wb");
|
||||
|
||||
if ( file_stream )
|
||||
{
|
||||
// Try to ensure full buffering.
|
||||
if ( util::detail::setvbuf(file_stream, nullptr, _IOFBF, BUFSIZ) )
|
||||
{
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Warning("cannot set buffering mode for %s: %s", filename.data(), buf);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("cannot open %s: %s", filename.c_str(), buf);
|
||||
}
|
||||
}
|
||||
if ( file_stream ) {
|
||||
// Try to ensure full buffering.
|
||||
if ( util::detail::setvbuf(file_stream, nullptr, _IOFBF, BUFSIZ) ) {
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Warning("cannot set buffering mode for %s: %s", filename.data(), buf);
|
||||
}
|
||||
}
|
||||
else {
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("cannot open %s: %s", filename.c_str(), buf);
|
||||
}
|
||||
}
|
||||
|
||||
Extract::~Extract()
|
||||
{
|
||||
if ( file_stream && fclose(file_stream) )
|
||||
{
|
||||
char buf[128];
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("cannot close %s: %s", filename.data(), buf);
|
||||
}
|
||||
}
|
||||
Extract::~Extract() {
|
||||
if ( file_stream && fclose(file_stream) ) {
|
||||
char buf[128];
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("cannot close %s: %s", filename.data(), buf);
|
||||
}
|
||||
}
|
||||
|
||||
static ValPtr get_extract_field_val(const RecordValPtr& args, const char* name)
|
||||
{
|
||||
const auto& rval = args->GetField(name);
|
||||
static ValPtr get_extract_field_val(const RecordValPtr& args, const char* name) {
|
||||
const auto& rval = args->GetField(name);
|
||||
|
||||
if ( ! rval )
|
||||
reporter->Error("File extraction analyzer missing arg field: %s", name);
|
||||
if ( ! rval )
|
||||
reporter->Error("File extraction analyzer missing arg field: %s", name);
|
||||
|
||||
return rval;
|
||||
}
|
||||
return rval;
|
||||
}
|
||||
|
||||
file_analysis::Analyzer* Extract::Instantiate(RecordValPtr args, file_analysis::File* file)
|
||||
{
|
||||
const auto& fname = get_extract_field_val(args, "extract_filename");
|
||||
const auto& limit = get_extract_field_val(args, "extract_limit");
|
||||
const auto& extract_limit_includes_missing = get_extract_field_val(
|
||||
args, "extract_limit_includes_missing");
|
||||
file_analysis::Analyzer* Extract::Instantiate(RecordValPtr args, file_analysis::File* file) {
|
||||
const auto& fname = get_extract_field_val(args, "extract_filename");
|
||||
const auto& limit = get_extract_field_val(args, "extract_limit");
|
||||
const auto& extract_limit_includes_missing = get_extract_field_val(args, "extract_limit_includes_missing");
|
||||
|
||||
if ( ! fname || ! limit || ! extract_limit_includes_missing )
|
||||
return nullptr;
|
||||
if ( ! fname || ! limit || ! extract_limit_includes_missing )
|
||||
return nullptr;
|
||||
|
||||
return new Extract(std::move(args), file, fname->AsString()->CheckString(), limit->AsCount(),
|
||||
extract_limit_includes_missing->AsBool());
|
||||
}
|
||||
return new Extract(std::move(args), file, fname->AsString()->CheckString(), limit->AsCount(),
|
||||
extract_limit_includes_missing->AsBool());
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if we are exceeding the write limit with this write.
|
||||
|
|
@ -79,118 +71,102 @@ file_analysis::Analyzer* Extract::Instantiate(RecordValPtr args, file_analysis::
|
|||
* @param n number of bytes to write to keep within limit
|
||||
* @returns true if limit exceeded
|
||||
*/
|
||||
static bool check_limit_exceeded(uint64_t lim, uint64_t written, uint64_t len, uint64_t* n)
|
||||
{
|
||||
if ( lim == 0 )
|
||||
{
|
||||
*n = len;
|
||||
return false;
|
||||
}
|
||||
static bool check_limit_exceeded(uint64_t lim, uint64_t written, uint64_t len, uint64_t* n) {
|
||||
if ( lim == 0 ) {
|
||||
*n = len;
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( written >= lim )
|
||||
{
|
||||
*n = 0;
|
||||
return true;
|
||||
}
|
||||
else if ( written + len > lim )
|
||||
{
|
||||
*n = lim - written;
|
||||
return true;
|
||||
}
|
||||
else
|
||||
{
|
||||
*n = len;
|
||||
}
|
||||
if ( written >= lim ) {
|
||||
*n = 0;
|
||||
return true;
|
||||
}
|
||||
else if ( written + len > lim ) {
|
||||
*n = lim - written;
|
||||
return true;
|
||||
}
|
||||
else {
|
||||
*n = len;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
bool Extract::DeliverStream(const u_char* data, uint64_t len)
|
||||
{
|
||||
if ( ! file_stream )
|
||||
return false;
|
||||
bool Extract::DeliverStream(const u_char* data, uint64_t len) {
|
||||
if ( ! file_stream )
|
||||
return false;
|
||||
|
||||
uint64_t towrite = 0;
|
||||
bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
uint64_t towrite = 0;
|
||||
bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
|
||||
if ( limit_exceeded && file_extraction_limit )
|
||||
{
|
||||
file_analysis::File* f = GetFile();
|
||||
f->FileEvent(file_extraction_limit,
|
||||
{f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
|
||||
if ( limit_exceeded && file_extraction_limit ) {
|
||||
file_analysis::File* f = GetFile();
|
||||
f->FileEvent(file_extraction_limit, {f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
|
||||
|
||||
// Limit may have been modified by a BIF, re-check it.
|
||||
limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
}
|
||||
// Limit may have been modified by a BIF, re-check it.
|
||||
limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
}
|
||||
|
||||
char buf[128];
|
||||
char buf[128];
|
||||
|
||||
if ( towrite > 0 )
|
||||
{
|
||||
if ( fwrite(data, towrite, 1, file_stream) != 1 )
|
||||
{
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("failed to write to extracted file %s: %s", filename.data(), buf);
|
||||
fclose(file_stream);
|
||||
file_stream = nullptr;
|
||||
return false;
|
||||
}
|
||||
if ( towrite > 0 ) {
|
||||
if ( fwrite(data, towrite, 1, file_stream) != 1 ) {
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("failed to write to extracted file %s: %s", filename.data(), buf);
|
||||
fclose(file_stream);
|
||||
file_stream = nullptr;
|
||||
return false;
|
||||
}
|
||||
|
||||
written += towrite;
|
||||
}
|
||||
written += towrite;
|
||||
}
|
||||
|
||||
// Assume we may not try to write anything more for a while due to reaching
|
||||
// the extraction limit and the file analysis File still proceeding to
|
||||
// do other analysis without destructing/closing this one until the very end,
|
||||
// so flush anything currently buffered.
|
||||
if ( limit_exceeded && fflush(file_stream) )
|
||||
{
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Warning("cannot fflush extracted file %s: %s", filename.data(), buf);
|
||||
}
|
||||
// Assume we may not try to write anything more for a while due to reaching
|
||||
// the extraction limit and the file analysis File still proceeding to
|
||||
// do other analysis without destructing/closing this one until the very end,
|
||||
// so flush anything currently buffered.
|
||||
if ( limit_exceeded && fflush(file_stream) ) {
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Warning("cannot fflush extracted file %s: %s", filename.data(), buf);
|
||||
}
|
||||
|
||||
return (! limit_exceeded);
|
||||
}
|
||||
return (! limit_exceeded);
|
||||
}
|
||||
|
||||
bool Extract::Undelivered(uint64_t offset, uint64_t len)
|
||||
{
|
||||
if ( ! file_stream )
|
||||
return false;
|
||||
bool Extract::Undelivered(uint64_t offset, uint64_t len) {
|
||||
if ( ! file_stream )
|
||||
return false;
|
||||
|
||||
if ( limit_includes_missing )
|
||||
{
|
||||
uint64_t towrite = 0;
|
||||
bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
// if the limit is exceeded, we have to raise the event. This gives scripts the opportunity
|
||||
// to raise the limit.
|
||||
if ( limit_exceeded && file_extraction_limit )
|
||||
{
|
||||
file_analysis::File* f = GetFile();
|
||||
f->FileEvent(file_extraction_limit,
|
||||
{f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
|
||||
// we have to check again if the limit is still exceedee
|
||||
limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
}
|
||||
if ( limit_includes_missing ) {
|
||||
uint64_t towrite = 0;
|
||||
bool limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
// if the limit is exceeded, we have to raise the event. This gives scripts the opportunity
|
||||
// to raise the limit.
|
||||
if ( limit_exceeded && file_extraction_limit ) {
|
||||
file_analysis::File* f = GetFile();
|
||||
f->FileEvent(file_extraction_limit, {f->ToVal(), GetArgs(), val_mgr->Count(limit), val_mgr->Count(len)});
|
||||
// we have to check again if the limit is still exceedee
|
||||
limit_exceeded = check_limit_exceeded(limit, written, len, &towrite);
|
||||
}
|
||||
|
||||
// if the limit is exceeded, abort and don't do anything - no reason to seek.
|
||||
if ( limit_exceeded )
|
||||
return false;
|
||||
// if the limit is exceeded, abort and don't do anything - no reason to seek.
|
||||
if ( limit_exceeded )
|
||||
return false;
|
||||
|
||||
// if we don't skip holes, count this hole against the write limit
|
||||
written += len;
|
||||
}
|
||||
// if we don't skip holes, count this hole against the write limit
|
||||
written += len;
|
||||
}
|
||||
|
||||
if ( fseek(file_stream, len + offset, SEEK_SET) != 0 )
|
||||
{
|
||||
char buf[128];
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("failed to seek in extracted file %s: %s", filename.data(), buf);
|
||||
fclose(file_stream);
|
||||
file_stream = nullptr;
|
||||
return false;
|
||||
}
|
||||
if ( fseek(file_stream, len + offset, SEEK_SET) != 0 ) {
|
||||
char buf[128];
|
||||
util::zeek_strerror_r(errno, buf, sizeof(buf));
|
||||
reporter->Error("failed to seek in extracted file %s: %s", filename.data(), buf);
|
||||
fclose(file_stream);
|
||||
file_stream = nullptr;
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
} // namespace zeek::file_analysis::detail
|
||||
} // namespace zeek::file_analysis::detail
|
||||
|
|
|
|||
|
|
@ -10,72 +10,70 @@
|
|||
#include "zeek/file_analysis/File.h"
|
||||
#include "zeek/file_analysis/analyzer/extract/events.bif.h"
|
||||
|
||||
namespace zeek::file_analysis::detail
|
||||
{
|
||||
namespace zeek::file_analysis::detail {
|
||||
|
||||
/**
|
||||
* An analyzer to extract content of files to local disk.
|
||||
*/
|
||||
class Extract : public file_analysis::Analyzer
|
||||
{
|
||||
class Extract : public file_analysis::Analyzer {
|
||||
public:
|
||||
/**
|
||||
* Destructor. Will close the file that was used for data extraction.
|
||||
*/
|
||||
~Extract() override;
|
||||
/**
|
||||
* Destructor. Will close the file that was used for data extraction.
|
||||
*/
|
||||
~Extract() override;
|
||||
|
||||
/**
|
||||
* Write a chunk of file data to the local extraction file.
|
||||
* @param data pointer to a chunk of file data.
|
||||
* @param len number of bytes in the data chunk.
|
||||
* @return false if there was no extraction file open and the data couldn't
|
||||
* be written, else true.
|
||||
*/
|
||||
bool DeliverStream(const u_char* data, uint64_t len) override;
|
||||
/**
|
||||
* Write a chunk of file data to the local extraction file.
|
||||
* @param data pointer to a chunk of file data.
|
||||
* @param len number of bytes in the data chunk.
|
||||
* @return false if there was no extraction file open and the data couldn't
|
||||
* be written, else true.
|
||||
*/
|
||||
bool DeliverStream(const u_char* data, uint64_t len) override;
|
||||
|
||||
/**
|
||||
* Report undelivered bytes.
|
||||
* @param offset distance into the file where the gap occurred.
|
||||
* @param len number of bytes undelivered.
|
||||
* @return true
|
||||
*/
|
||||
bool Undelivered(uint64_t offset, uint64_t len) override;
|
||||
/**
|
||||
* Report undelivered bytes.
|
||||
* @param offset distance into the file where the gap occurred.
|
||||
* @param len number of bytes undelivered.
|
||||
* @return true
|
||||
*/
|
||||
bool Undelivered(uint64_t offset, uint64_t len) override;
|
||||
|
||||
/**
|
||||
* Create a new instance of an Extract analyzer.
|
||||
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
||||
* @param file the file to which the analyzer will be attached.
|
||||
* @return the new Extract analyzer instance or a null pointer if the
|
||||
* the "extraction_file" field of \a args wasn't set.
|
||||
*/
|
||||
static file_analysis::Analyzer* Instantiate(RecordValPtr args, file_analysis::File* file);
|
||||
/**
|
||||
* Create a new instance of an Extract analyzer.
|
||||
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
||||
* @param file the file to which the analyzer will be attached.
|
||||
* @return the new Extract analyzer instance or a null pointer if the
|
||||
* the "extraction_file" field of \a args wasn't set.
|
||||
*/
|
||||
static file_analysis::Analyzer* Instantiate(RecordValPtr args, file_analysis::File* file);
|
||||
|
||||
/**
|
||||
* Sets the maximum allowed extracted file size. A value of zero means
|
||||
* "no limit".
|
||||
* @param bytes number of bytes allowed to be extracted
|
||||
*/
|
||||
void SetLimit(uint64_t bytes) { limit = bytes; }
|
||||
/**
|
||||
* Sets the maximum allowed extracted file size. A value of zero means
|
||||
* "no limit".
|
||||
* @param bytes number of bytes allowed to be extracted
|
||||
*/
|
||||
void SetLimit(uint64_t bytes) { limit = bytes; }
|
||||
|
||||
protected:
|
||||
/**
|
||||
* Constructor.
|
||||
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
||||
* @param file the file to which the analyzer will be attached.
|
||||
* @param arg_filename a file system path which specifies the local file
|
||||
* to which the contents of the file will be extracted/written.
|
||||
* @param arg_limit the maximum allowed file size.
|
||||
* @param arg_limit_includes_missing missing bytes count towards limit if true.
|
||||
*/
|
||||
Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename,
|
||||
uint64_t arg_limit, bool arg_limit_includes_missing);
|
||||
/**
|
||||
* Constructor.
|
||||
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
||||
* @param file the file to which the analyzer will be attached.
|
||||
* @param arg_filename a file system path which specifies the local file
|
||||
* to which the contents of the file will be extracted/written.
|
||||
* @param arg_limit the maximum allowed file size.
|
||||
* @param arg_limit_includes_missing missing bytes count towards limit if true.
|
||||
*/
|
||||
Extract(RecordValPtr args, file_analysis::File* file, const std::string& arg_filename, uint64_t arg_limit,
|
||||
bool arg_limit_includes_missing);
|
||||
|
||||
private:
|
||||
std::string filename;
|
||||
FILE* file_stream;
|
||||
uint64_t limit; // the file extraction limit
|
||||
uint64_t written; // how many bytes we have written so far
|
||||
bool limit_includes_missing; // do count missing bytes against limit if true
|
||||
};
|
||||
std::string filename;
|
||||
FILE* file_stream;
|
||||
uint64_t limit; // the file extraction limit
|
||||
uint64_t written; // how many bytes we have written so far
|
||||
bool limit_includes_missing; // do count missing bytes against limit if true
|
||||
};
|
||||
|
||||
} // namespace zeek::file_analysis::detail
|
||||
} // namespace zeek::file_analysis::detail
|
||||
|
|
|
|||
|
|
@ -5,22 +5,18 @@
|
|||
#include "zeek/file_analysis/Component.h"
|
||||
#include "zeek/file_analysis/analyzer/extract/Extract.h"
|
||||
|
||||
namespace zeek::plugin::detail::Zeek_FileExtract
|
||||
{
|
||||
namespace zeek::plugin::detail::Zeek_FileExtract {
|
||||
|
||||
class Plugin : public zeek::plugin::Plugin
|
||||
{
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new zeek::file_analysis::Component(
|
||||
"EXTRACT", zeek::file_analysis::detail::Extract::Instantiate));
|
||||
zeek::plugin::Configuration Configure() override {
|
||||
AddComponent(new zeek::file_analysis::Component("EXTRACT", zeek::file_analysis::detail::Extract::Instantiate));
|
||||
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileExtract";
|
||||
config.description = "Extract file content";
|
||||
return config;
|
||||
}
|
||||
} plugin;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileExtract";
|
||||
config.description = "Extract file content";
|
||||
return config;
|
||||
}
|
||||
} plugin;
|
||||
|
||||
} // namespace zeek::plugin::detail::Zeek_FileExtract
|
||||
} // namespace zeek::plugin::detail::Zeek_FileExtract
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue