mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
Reformat Zeek in Spicy style
This largely copies over Spicy's `.clang-format` configuration file. The one place where we deviate is header include order since Zeek depends on headers being included in a certain order.
This commit is contained in:
Benjamin Bannier
parent
7b8e7ed72c
commit
f5a76c1aed
786 changed files with 131714 additions and 153609 deletions
|
|
@ -9,10 +9,9 @@
|
|||
#include <cstring>
|
||||
#include <set>
|
||||
|
||||
namespace btest::plugin::Demo_Hooks
|
||||
{
|
||||
namespace btest::plugin::Demo_Hooks {
|
||||
Plugin plugin;
|
||||
}
|
||||
}
|
||||
|
||||
using namespace btest::plugin::Demo_Hooks;
|
||||
|
||||
|
|
@ -20,359 +19,301 @@ using namespace btest::plugin::Demo_Hooks;
|
|||
// receiving the current version string or parts of it and make the
|
||||
// baseline non-deterministic.
|
||||
static std::set<std::string> sanitized_functions = {
|
||||
"Version::parse",
|
||||
"gsub",
|
||||
"split_string1",
|
||||
"lstrip",
|
||||
"to_count",
|
||||
"cat",
|
||||
"Telemetry::__dbl_gauge_metric_get_or_add",
|
||||
"Telemetry::gauge_with",
|
||||
"Telemetry::make_labels",
|
||||
"Telemetry::gauge_family_set",
|
||||
"Version::parse",
|
||||
"gsub",
|
||||
"split_string1",
|
||||
"lstrip",
|
||||
"to_count",
|
||||
"cat",
|
||||
"Telemetry::__dbl_gauge_metric_get_or_add",
|
||||
"Telemetry::gauge_with",
|
||||
"Telemetry::make_labels",
|
||||
"Telemetry::gauge_family_set",
|
||||
};
|
||||
|
||||
// When a filename given to LOAD_FILE* hooks (and to the meta pre/post hooks)
|
||||
// contains any of these keywords, no log message is generated.
|
||||
static std::set<std::string> load_file_filter = {
|
||||
"Zeek_AF_Packet",
|
||||
"Zeek_JavaScript",
|
||||
"Zeek_AF_Packet",
|
||||
"Zeek_JavaScript",
|
||||
};
|
||||
|
||||
static bool skip_load_file_logging_for(const std::string& s)
|
||||
{
|
||||
for ( const auto& needle : load_file_filter )
|
||||
if ( s.find(needle) != std::string::npos )
|
||||
return true;
|
||||
static bool skip_load_file_logging_for(const std::string& s) {
|
||||
for ( const auto& needle : load_file_filter )
|
||||
if ( s.find(needle) != std::string::npos )
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
zeek::plugin::Configuration Plugin::Configure()
|
||||
{
|
||||
EnableHook(zeek::plugin::HOOK_LOAD_FILE);
|
||||
EnableHook(zeek::plugin::HOOK_LOAD_FILE_EXT);
|
||||
EnableHook(zeek::plugin::HOOK_CALL_FUNCTION);
|
||||
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
|
||||
EnableHook(zeek::plugin::HOOK_DRAIN_EVENTS);
|
||||
EnableHook(zeek::plugin::HOOK_UPDATE_NETWORK_TIME);
|
||||
EnableHook(zeek::plugin::META_HOOK_PRE);
|
||||
EnableHook(zeek::plugin::META_HOOK_POST);
|
||||
EnableHook(zeek::plugin::HOOK_SETUP_ANALYZER_TREE);
|
||||
EnableHook(zeek::plugin::HOOK_LOG_INIT);
|
||||
EnableHook(zeek::plugin::HOOK_LOG_WRITE);
|
||||
EnableHook(zeek::plugin::HOOK_UNPROCESSED_PACKET);
|
||||
EnableHook(zeek::plugin::HOOK_OBJ_DTOR);
|
||||
zeek::plugin::Configuration Plugin::Configure() {
|
||||
EnableHook(zeek::plugin::HOOK_LOAD_FILE);
|
||||
EnableHook(zeek::plugin::HOOK_LOAD_FILE_EXT);
|
||||
EnableHook(zeek::plugin::HOOK_CALL_FUNCTION);
|
||||
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
|
||||
EnableHook(zeek::plugin::HOOK_DRAIN_EVENTS);
|
||||
EnableHook(zeek::plugin::HOOK_UPDATE_NETWORK_TIME);
|
||||
EnableHook(zeek::plugin::META_HOOK_PRE);
|
||||
EnableHook(zeek::plugin::META_HOOK_POST);
|
||||
EnableHook(zeek::plugin::HOOK_SETUP_ANALYZER_TREE);
|
||||
EnableHook(zeek::plugin::HOOK_LOG_INIT);
|
||||
EnableHook(zeek::plugin::HOOK_LOG_WRITE);
|
||||
EnableHook(zeek::plugin::HOOK_UNPROCESSED_PACKET);
|
||||
EnableHook(zeek::plugin::HOOK_OBJ_DTOR);
|
||||
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Demo::Hooks";
|
||||
config.description = "Exercises all plugin hooks";
|
||||
config.version.major = 1;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Demo::Hooks";
|
||||
config.description = "Exercises all plugin hooks";
|
||||
config.version.major = 1;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
|
||||
static void describe_hook_args(const zeek::plugin::HookArgumentList& args, zeek::ODesc* d)
|
||||
{
|
||||
bool first = true;
|
||||
bool serialize_args = true;
|
||||
static void describe_hook_args(const zeek::plugin::HookArgumentList& args, zeek::ODesc* d) {
|
||||
bool first = true;
|
||||
bool serialize_args = true;
|
||||
|
||||
for ( zeek::plugin::HookArgumentList::const_iterator i = args.begin(); i != args.end(); i++ )
|
||||
{
|
||||
if ( first )
|
||||
{
|
||||
first = false;
|
||||
for ( zeek::plugin::HookArgumentList::const_iterator i = args.begin(); i != args.end(); i++ ) {
|
||||
if ( first ) {
|
||||
first = false;
|
||||
|
||||
i->Describe(d);
|
||||
i->Describe(d);
|
||||
|
||||
// For function calls we remove args for unstable arguments
|
||||
// from parsing the version in `base/misc/version`.
|
||||
if ( i->GetType() == zeek::plugin::HookArgument::FUNC &&
|
||||
sanitized_functions.count(d->Description()) != 0 )
|
||||
serialize_args = false;
|
||||
// For function calls we remove args for unstable arguments
|
||||
// from parsing the version in `base/misc/version`.
|
||||
if ( i->GetType() == zeek::plugin::HookArgument::FUNC && sanitized_functions.count(d->Description()) != 0 )
|
||||
serialize_args = false;
|
||||
|
||||
continue;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
d->Add(", ");
|
||||
d->Add(", ");
|
||||
|
||||
if ( serialize_args )
|
||||
i->Describe(d);
|
||||
else
|
||||
d->Add("...");
|
||||
if ( serialize_args )
|
||||
i->Describe(d);
|
||||
else
|
||||
d->Add("...");
|
||||
|
||||
first = false;
|
||||
}
|
||||
}
|
||||
first = false;
|
||||
}
|
||||
}
|
||||
|
||||
int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std::string& resolved)
|
||||
{
|
||||
if ( skip_load_file_logging_for(resolved) )
|
||||
return -1;
|
||||
int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std::string& resolved) {
|
||||
if ( skip_load_file_logging_for(resolved) )
|
||||
return -1;
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFile",
|
||||
file.c_str(), resolved.c_str());
|
||||
return -1;
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFile", file.c_str(),
|
||||
resolved.c_str());
|
||||
return -1;
|
||||
}
|
||||
|
||||
std::pair<int, std::optional<std::string>> Plugin::HookLoadFileExtended(const LoadType type,
|
||||
const std::string& file,
|
||||
const std::string& resolved)
|
||||
{
|
||||
if ( skip_load_file_logging_for(resolved) )
|
||||
return std::make_pair(-1, std::nullopt);
|
||||
std::pair<int, std::optional<std::string>> Plugin::HookLoadFileExtended(const LoadType type, const std::string& file,
|
||||
const std::string& resolved) {
|
||||
if ( skip_load_file_logging_for(resolved) )
|
||||
return std::make_pair(-1, std::nullopt);
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFileExtended",
|
||||
file.c_str(), resolved.c_str());
|
||||
return std::make_pair(-1, std::nullopt);
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLoadFileExtended", file.c_str(),
|
||||
resolved.c_str());
|
||||
return std::make_pair(-1, std::nullopt);
|
||||
}
|
||||
|
||||
std::pair<bool, zeek::ValPtr> Plugin::HookFunctionCall(const zeek::Func* func,
|
||||
zeek::detail::Frame* frame, zeek::Args* args)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
std::pair<bool, zeek::ValPtr> Plugin::HookFunctionCall(const zeek::Func* func, zeek::detail::Frame* frame,
|
||||
zeek::Args* args) {
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
|
||||
zeek::plugin::HookArgument(func).Describe(&d);
|
||||
zeek::plugin::HookArgument(func).Describe(&d);
|
||||
|
||||
// For function calls we remove args for unstable arguments
|
||||
// from parsing the version in `base/misc/version`.
|
||||
//
|
||||
if ( sanitized_functions.count(d.Description()) != 0 )
|
||||
d.Add("(...)");
|
||||
else
|
||||
zeek::plugin::HookArgument(args).Describe(&d);
|
||||
// For function calls we remove args for unstable arguments
|
||||
// from parsing the version in `base/misc/version`.
|
||||
//
|
||||
if ( sanitized_functions.count(d.Description()) != 0 )
|
||||
d.Add("(...)");
|
||||
else
|
||||
zeek::plugin::HookArgument(args).Describe(&d);
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookCallFunction",
|
||||
d.Description());
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookCallFunction", d.Description());
|
||||
|
||||
return {false, nullptr};
|
||||
}
|
||||
return {false, nullptr};
|
||||
}
|
||||
|
||||
bool Plugin::HookQueueEvent(zeek::Event* event)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
zeek::plugin::HookArgument(event).Describe(&d);
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookQueueEvent",
|
||||
d.Description());
|
||||
bool Plugin::HookQueueEvent(zeek::Event* event) {
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
zeek::plugin::HookArgument(event).Describe(&d);
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookQueueEvent", d.Description());
|
||||
|
||||
static int i = 0;
|
||||
static int i = 0;
|
||||
|
||||
if ( zeek::run_state::network_time && i == 0 )
|
||||
{
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| RequestObjDtor",
|
||||
d.Description());
|
||||
if ( zeek::run_state::network_time && i == 0 ) {
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| RequestObjDtor", d.Description());
|
||||
|
||||
RequestObjDtor(event);
|
||||
i = 1;
|
||||
}
|
||||
RequestObjDtor(event);
|
||||
i = 1;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
void Plugin::HookDrainEvents()
|
||||
{
|
||||
fprintf(stderr, "%.6f %-15s\n", zeek::run_state::network_time, "| HookDrainEvents");
|
||||
}
|
||||
void Plugin::HookDrainEvents() { fprintf(stderr, "%.6f %-15s\n", zeek::run_state::network_time, "| HookDrainEvents"); }
|
||||
|
||||
void Plugin::HookUpdateNetworkTime(double network_time)
|
||||
{
|
||||
fprintf(stderr, "%.6f %-15s %.6f\n", zeek::run_state::network_time, "| HookUpdateNetworkTime",
|
||||
zeek::run_state::network_time);
|
||||
}
|
||||
void Plugin::HookUpdateNetworkTime(double network_time) {
|
||||
fprintf(stderr, "%.6f %-15s %.6f\n", zeek::run_state::network_time, "| HookUpdateNetworkTime",
|
||||
zeek::run_state::network_time);
|
||||
}
|
||||
|
||||
void Plugin::HookObjDtor(void* obj)
|
||||
{
|
||||
fprintf(stderr, "%.6f %-15s\n", zeek::run_state::network_time, "| HookObjDtor");
|
||||
}
|
||||
void Plugin::HookObjDtor(void* obj) {
|
||||
fprintf(stderr, "%.6f %-15s\n", zeek::run_state::network_time, "| HookObjDtor");
|
||||
}
|
||||
|
||||
void Plugin::MetaHookPre(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
describe_hook_args(args, &d);
|
||||
void Plugin::MetaHookPre(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args) {
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
describe_hook_args(args, &d);
|
||||
|
||||
// Special case file loading filtering.
|
||||
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
|
||||
if ( skip_load_file_logging_for(std::string(d.Description())) )
|
||||
return;
|
||||
// Special case file loading filtering.
|
||||
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
|
||||
if ( skip_load_file_logging_for(std::string(d.Description())) )
|
||||
return;
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s(%s)\n", zeek::run_state::network_time, " MetaHookPre",
|
||||
hook_name(hook), d.Description());
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s(%s)\n", zeek::run_state::network_time, " MetaHookPre", hook_name(hook),
|
||||
d.Description());
|
||||
}
|
||||
|
||||
void Plugin::MetaHookPost(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args,
|
||||
zeek::plugin::HookArgument result)
|
||||
{
|
||||
zeek::ODesc d1;
|
||||
d1.SetShort();
|
||||
describe_hook_args(args, &d1);
|
||||
zeek::plugin::HookArgument result) {
|
||||
zeek::ODesc d1;
|
||||
d1.SetShort();
|
||||
describe_hook_args(args, &d1);
|
||||
|
||||
// Special case file loading filtering.
|
||||
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
|
||||
if ( skip_load_file_logging_for(std::string(d1.Description())) )
|
||||
return;
|
||||
// Special case file loading filtering.
|
||||
if ( hook == zeek::plugin::HOOK_LOAD_FILE || hook == zeek::plugin::HOOK_LOAD_FILE_EXT )
|
||||
if ( skip_load_file_logging_for(std::string(d1.Description())) )
|
||||
return;
|
||||
|
||||
zeek::ODesc d2;
|
||||
d2.SetShort();
|
||||
result.Describe(&d2);
|
||||
zeek::ODesc d2;
|
||||
d2.SetShort();
|
||||
result.Describe(&d2);
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s(%s) -> %s\n", zeek::run_state::network_time, " MetaHookPost",
|
||||
hook_name(hook), d1.Description(), d2.Description());
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s(%s) -> %s\n", zeek::run_state::network_time, " MetaHookPost", hook_name(hook),
|
||||
d1.Description(), d2.Description());
|
||||
}
|
||||
|
||||
void Plugin::HookSetupAnalyzerTree(zeek::Connection* conn)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
conn->Describe(&d);
|
||||
void Plugin::HookSetupAnalyzerTree(zeek::Connection* conn) {
|
||||
zeek::ODesc d;
|
||||
d.SetShort();
|
||||
conn->Describe(&d);
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookSetupAnalyzerTree",
|
||||
d.Description());
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s\n", zeek::run_state::network_time, "| HookSetupAnalyzerTree", d.Description());
|
||||
}
|
||||
|
||||
void Plugin::HookLogInit(const std::string& writer, const std::string& instantiating_filter,
|
||||
bool local, bool remote,
|
||||
void Plugin::HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote,
|
||||
const zeek::logging::WriterBackend::WriterInfo& info, int num_fields,
|
||||
const zeek::threading::Field* const* fields)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
const zeek::threading::Field* const* fields) {
|
||||
zeek::ODesc d;
|
||||
|
||||
d.Add("{");
|
||||
for ( int i = 0; i < num_fields; i++ )
|
||||
{
|
||||
const zeek::threading::Field* f = fields[i];
|
||||
d.Add("{");
|
||||
for ( int i = 0; i < num_fields; i++ ) {
|
||||
const zeek::threading::Field* f = fields[i];
|
||||
|
||||
if ( i > 0 )
|
||||
d.Add(", ");
|
||||
if ( i > 0 )
|
||||
d.Add(", ");
|
||||
|
||||
d.Add(f->name);
|
||||
d.Add(" (");
|
||||
d.Add(f->TypeName());
|
||||
d.Add(")");
|
||||
}
|
||||
d.Add("}");
|
||||
d.Add(f->name);
|
||||
d.Add(" (");
|
||||
d.Add(f->TypeName());
|
||||
d.Add(")");
|
||||
}
|
||||
d.Add("}");
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s %d/%d %s\n", zeek::run_state::network_time, "| HookLogInit",
|
||||
info.path, local, remote, d.Description());
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s %d/%d %s\n", zeek::run_state::network_time, "| HookLogInit", info.path, local,
|
||||
remote, d.Description());
|
||||
}
|
||||
|
||||
void Plugin::RenderVal(const zeek::threading::Value* val, zeek::ODesc& d) const
|
||||
{
|
||||
if ( ! val->present )
|
||||
{
|
||||
d.Add("<uninitialized>");
|
||||
return;
|
||||
}
|
||||
void Plugin::RenderVal(const zeek::threading::Value* val, zeek::ODesc& d) const {
|
||||
if ( ! val->present ) {
|
||||
d.Add("<uninitialized>");
|
||||
return;
|
||||
}
|
||||
|
||||
switch ( val->type )
|
||||
{
|
||||
switch ( val->type ) {
|
||||
case zeek::TYPE_BOOL: d.Add(val->val.int_val ? "T" : "F"); break;
|
||||
|
||||
case zeek::TYPE_BOOL:
|
||||
d.Add(val->val.int_val ? "T" : "F");
|
||||
break;
|
||||
case zeek::TYPE_INT: d.Add(val->val.int_val); break;
|
||||
|
||||
case zeek::TYPE_INT:
|
||||
d.Add(val->val.int_val);
|
||||
break;
|
||||
case zeek::TYPE_COUNT: d.Add(val->val.uint_val); break;
|
||||
|
||||
case zeek::TYPE_COUNT:
|
||||
d.Add(val->val.uint_val);
|
||||
break;
|
||||
case zeek::TYPE_PORT: d.Add(val->val.port_val.port); break;
|
||||
|
||||
case zeek::TYPE_PORT:
|
||||
d.Add(val->val.port_val.port);
|
||||
break;
|
||||
case zeek::TYPE_SUBNET: d.Add(zeek::threading::Formatter::Render(val->val.subnet_val)); break;
|
||||
|
||||
case zeek::TYPE_SUBNET:
|
||||
d.Add(zeek::threading::Formatter::Render(val->val.subnet_val));
|
||||
break;
|
||||
case zeek::TYPE_ADDR: d.Add(zeek::threading::Formatter::Render(val->val.addr_val)); break;
|
||||
|
||||
case zeek::TYPE_ADDR:
|
||||
d.Add(zeek::threading::Formatter::Render(val->val.addr_val));
|
||||
break;
|
||||
case zeek::TYPE_DOUBLE: d.Add(val->val.double_val, true); break;
|
||||
|
||||
case zeek::TYPE_DOUBLE:
|
||||
d.Add(val->val.double_val, true);
|
||||
break;
|
||||
case zeek::TYPE_INTERVAL:
|
||||
case zeek::TYPE_TIME: d.Add(zeek::threading::Formatter::Render(val->val.double_val)); break;
|
||||
|
||||
case zeek::TYPE_INTERVAL:
|
||||
case zeek::TYPE_TIME:
|
||||
d.Add(zeek::threading::Formatter::Render(val->val.double_val));
|
||||
break;
|
||||
case zeek::TYPE_ENUM:
|
||||
case zeek::TYPE_STRING:
|
||||
case zeek::TYPE_FILE:
|
||||
case zeek::TYPE_FUNC: d.AddN(val->val.string_val.data, val->val.string_val.length); break;
|
||||
|
||||
case zeek::TYPE_ENUM:
|
||||
case zeek::TYPE_STRING:
|
||||
case zeek::TYPE_FILE:
|
||||
case zeek::TYPE_FUNC:
|
||||
d.AddN(val->val.string_val.data, val->val.string_val.length);
|
||||
break;
|
||||
case zeek::TYPE_TABLE:
|
||||
for ( int j = 0; j < val->val.set_val.size; j++ ) {
|
||||
if ( j > 0 )
|
||||
d.Add(",");
|
||||
|
||||
case zeek::TYPE_TABLE:
|
||||
for ( int j = 0; j < val->val.set_val.size; j++ )
|
||||
{
|
||||
if ( j > 0 )
|
||||
d.Add(",");
|
||||
RenderVal(val->val.set_val.vals[j], d);
|
||||
}
|
||||
break;
|
||||
|
||||
RenderVal(val->val.set_val.vals[j], d);
|
||||
}
|
||||
break;
|
||||
case zeek::TYPE_VECTOR:
|
||||
for ( int j = 0; j < val->val.vector_val.size; j++ ) {
|
||||
if ( j > 0 )
|
||||
d.Add(",");
|
||||
|
||||
case zeek::TYPE_VECTOR:
|
||||
for ( int j = 0; j < val->val.vector_val.size; j++ )
|
||||
{
|
||||
if ( j > 0 )
|
||||
d.Add(",");
|
||||
RenderVal(val->val.vector_val.vals[j], d);
|
||||
}
|
||||
break;
|
||||
|
||||
RenderVal(val->val.vector_val.vals[j], d);
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
assert(false);
|
||||
}
|
||||
}
|
||||
default: assert(false);
|
||||
}
|
||||
}
|
||||
|
||||
bool Plugin::HookLogWrite(const std::string& writer, const std::string& filter,
|
||||
const zeek::logging::WriterBackend::WriterInfo& info, int num_fields,
|
||||
const zeek::threading::Field* const* fields,
|
||||
zeek::threading::Value** vals)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
const zeek::threading::Field* const* fields, zeek::threading::Value** vals) {
|
||||
zeek::ODesc d;
|
||||
|
||||
d.Add("[");
|
||||
for ( int i = 0; i < num_fields; i++ )
|
||||
{
|
||||
const zeek::threading::Field* f = fields[i];
|
||||
const zeek::threading::Value* val = vals[i];
|
||||
d.Add("[");
|
||||
for ( int i = 0; i < num_fields; i++ ) {
|
||||
const zeek::threading::Field* f = fields[i];
|
||||
const zeek::threading::Value* val = vals[i];
|
||||
|
||||
if ( i > 0 )
|
||||
d.Add(", ");
|
||||
if ( i > 0 )
|
||||
d.Add(", ");
|
||||
|
||||
d.Add(f->name);
|
||||
d.Add("=");
|
||||
d.Add(f->name);
|
||||
d.Add("=");
|
||||
|
||||
RenderVal(val, d);
|
||||
}
|
||||
d.Add("]");
|
||||
RenderVal(val, d);
|
||||
}
|
||||
d.Add("]");
|
||||
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLogWrite",
|
||||
info.path, d.Description());
|
||||
return true;
|
||||
}
|
||||
fprintf(stderr, "%.6f %-15s %s %s\n", zeek::run_state::network_time, "| HookLogWrite", info.path, d.Description());
|
||||
return true;
|
||||
}
|
||||
|
||||
void Plugin::HookUnprocessedPacket(const zeek::Packet* packet)
|
||||
{
|
||||
zeek::ODesc d;
|
||||
d.Add("[");
|
||||
d.Add("ts=");
|
||||
d.Add(packet->time);
|
||||
d.Add(" len=");
|
||||
d.Add(packet->len);
|
||||
d.Add("]");
|
||||
void Plugin::HookUnprocessedPacket(const zeek::Packet* packet) {
|
||||
zeek::ODesc d;
|
||||
d.Add("[");
|
||||
d.Add("ts=");
|
||||
d.Add(packet->time);
|
||||
d.Add(" len=");
|
||||
d.Add(packet->len);
|
||||
d.Add("]");
|
||||
|
||||
fprintf(stderr, "%.6f %-23s %s\n", zeek::run_state::network_time, "| HookUnprocessedPacket",
|
||||
d.Description());
|
||||
}
|
||||
fprintf(stderr, "%.6f %-23s %s\n", zeek::run_state::network_time, "| HookUnprocessedPacket", d.Description());
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,44 +3,37 @@
|
|||
|
||||
#include <zeek/plugin/Plugin.h>
|
||||
|
||||
namespace btest::plugin::Demo_Hooks
|
||||
{
|
||||
namespace btest::plugin::Demo_Hooks {
|
||||
|
||||
class Plugin : public zeek::plugin::Plugin
|
||||
{
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
protected:
|
||||
int HookLoadFile(const LoadType type, const std::string& file,
|
||||
const std::string& resolved) override;
|
||||
std::pair<int, std::optional<std::string>>
|
||||
HookLoadFileExtended(const LoadType type, const std::string& file,
|
||||
const std::string& resolved) override;
|
||||
std::pair<bool, zeek::ValPtr> HookFunctionCall(const zeek::Func* func,
|
||||
zeek::detail::Frame* parent,
|
||||
zeek::Args* args) override;
|
||||
bool HookQueueEvent(zeek::Event* event) override;
|
||||
void HookDrainEvents() override;
|
||||
void HookUpdateNetworkTime(double network_time) override;
|
||||
void HookObjDtor(void* obj) override;
|
||||
void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local,
|
||||
bool remote, const zeek::logging::WriterBackend::WriterInfo& info,
|
||||
int num_fields, const zeek::threading::Field* const* fields) override;
|
||||
bool HookLogWrite(const std::string& writer, const std::string& filter,
|
||||
const zeek::logging::WriterBackend::WriterInfo& info, int num_fields,
|
||||
const zeek::threading::Field* const* fields,
|
||||
zeek::threading::Value** vals) override;
|
||||
void HookSetupAnalyzerTree(zeek::Connection* conn) override;
|
||||
void HookUnprocessedPacket(const zeek::Packet* packet) override;
|
||||
void MetaHookPre(zeek::plugin::HookType hook,
|
||||
const zeek::plugin::HookArgumentList& args) override;
|
||||
void MetaHookPost(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args,
|
||||
zeek::plugin::HookArgument result) override;
|
||||
int HookLoadFile(const LoadType type, const std::string& file, const std::string& resolved) override;
|
||||
std::pair<int, std::optional<std::string>> HookLoadFileExtended(const LoadType type, const std::string& file,
|
||||
const std::string& resolved) override;
|
||||
std::pair<bool, zeek::ValPtr> HookFunctionCall(const zeek::Func* func, zeek::detail::Frame* parent,
|
||||
zeek::Args* args) override;
|
||||
bool HookQueueEvent(zeek::Event* event) override;
|
||||
void HookDrainEvents() override;
|
||||
void HookUpdateNetworkTime(double network_time) override;
|
||||
void HookObjDtor(void* obj) override;
|
||||
void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote,
|
||||
const zeek::logging::WriterBackend::WriterInfo& info, int num_fields,
|
||||
const zeek::threading::Field* const* fields) override;
|
||||
bool HookLogWrite(const std::string& writer, const std::string& filter,
|
||||
const zeek::logging::WriterBackend::WriterInfo& info, int num_fields,
|
||||
const zeek::threading::Field* const* fields, zeek::threading::Value** vals) override;
|
||||
void HookSetupAnalyzerTree(zeek::Connection* conn) override;
|
||||
void HookUnprocessedPacket(const zeek::Packet* packet) override;
|
||||
void MetaHookPre(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args) override;
|
||||
void MetaHookPost(zeek::plugin::HookType hook, const zeek::plugin::HookArgumentList& args,
|
||||
zeek::plugin::HookArgument result) override;
|
||||
|
||||
void RenderVal(const zeek::threading::Value* val, zeek::ODesc& d) const;
|
||||
void RenderVal(const zeek::threading::Value* val, zeek::ODesc& d) const;
|
||||
|
||||
// Overridden from zeek::plugin::Plugin.
|
||||
zeek::plugin::Configuration Configure() override;
|
||||
};
|
||||
// Overridden from zeek::plugin::Plugin.
|
||||
zeek::plugin::Configuration Configure() override;
|
||||
};
|
||||
|
||||
extern Plugin plugin;
|
||||
|
||||
}
|
||||
} // namespace btest::plugin::Demo_Hooks
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue