mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
995368e68c
This changes many weird names to move non-static content from the weird name into the "addl" field to help ensure the total number of weird names is reasonably bounded. Note the net_weird and flow_weird events do not have an "addl" parameter, so information may no longer be available in those cases -- to make it available again we'd need to either (1) define new events that contain such a parameter, or (2) change net_weird/flow_weird event signature (which is a breaking change for user-code at the moment). Also, the generic handling of binpac exceptions for analyzers which to not otherwise catch and handle them has been changed from a Weird to a ProtocolViolation. Finally, a new "file_weird" event has been added for reporting weirdness found during file analysis.
21 lines
514 B
C++
21 lines
514 B
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef WEIRDSTATE_H
|
|
#define WEIRDSTATE_H
|
|
|
|
#include <string>
|
|
#include <unordered_map>
|
|
|
|
struct WeirdState {
|
|
WeirdState() { count = 0; sampling_start_time = 0; }
|
|
uint64_t count = 0;
|
|
double sampling_start_time = 0;
|
|
};
|
|
|
|
using WeirdStateMap = std::unordered_map<std::string, WeirdState>;
|
|
|
|
bool PermitWeird(WeirdStateMap& wsm, const char* name, uint64_t threshold,
|
|
uint64_t rate, double duration);
|
|
|
|
#endif // WEIRDSTATE_H
|
|
|