mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 19:48:20 +00:00
e0da9fbe82
- Minor whitespace adjustments - Converted std::pair usage to anonymous struct to improve readability * 'scanned-file-device-and-inode' of https://github.com/awelzel/zeek: scan.l: Actually add <utility> include, too. ScannedFile: Identify already scanned files by device and inode
111 lines
3.7 KiB
C++
111 lines
3.7 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#pragma once
|
|
|
|
#include <list>
|
|
#include <vector>
|
|
#include <string>
|
|
#include <optional>
|
|
|
|
#include <sys/stat.h> // for ino_t
|
|
|
|
using std::string;
|
|
|
|
namespace iosource {
|
|
class IOSource;
|
|
class PktSrc;
|
|
class PktDumper;
|
|
}
|
|
|
|
class Packet;
|
|
|
|
extern void net_init(const std::optional<std::string>& interfaces,
|
|
const std::optional<std::string>& pcap_input_file,
|
|
const std::optional<std::string>& pcap_output_file,
|
|
bool do_watchdog);
|
|
extern void net_run();
|
|
extern void net_get_final_stats();
|
|
extern void net_finish(int drain_events);
|
|
extern void net_delete(); // Reclaim all memory, etc.
|
|
extern void net_update_time(double new_network_time);
|
|
extern void net_packet_dispatch(double t, const Packet* pkt,
|
|
iosource::PktSrc* src_ps);
|
|
extern void expire_timers(iosource::PktSrc* src_ps = 0);
|
|
extern void zeek_terminate_loop(const char* reason);
|
|
|
|
// Functions to temporarily suspend processing of live input (network packets
|
|
// and remote events/state). Turning this is on is sure to lead to data loss!
|
|
extern void net_suspend_processing();
|
|
extern void net_continue_processing();
|
|
|
|
extern int _processing_suspended; // don't access directly.
|
|
inline bool net_is_processing_suspended()
|
|
{ return _processing_suspended > 0; }
|
|
|
|
// Whether we're reading live traffic.
|
|
extern bool reading_live;
|
|
|
|
// Same but for reading from traces instead. We have two separate
|
|
// variables because it's possible that neither is true, and we're
|
|
// instead just running timers (per the variable after this one).
|
|
extern bool reading_traces;
|
|
|
|
// True if we have timers scheduled for the future on which we need
|
|
// to wait. "Need to wait" here means that we're running live (though
|
|
// perhaps not reading_live, but just running in real-time) as opposed
|
|
// to reading a trace (in which case we don't want to wait in real-time
|
|
// on future timers).
|
|
extern bool have_pending_timers;
|
|
|
|
// If > 0, we are reading from traces but trying to mimic real-time behavior.
|
|
// (In this case, both reading_traces and reading_live are true.) The value
|
|
// is the speedup (1 = real-time, 0.5 = half real-time, etc.).
|
|
extern double pseudo_realtime;
|
|
|
|
// When we started processing the current packet and corresponding event
|
|
// queue.
|
|
extern double processing_start_time;
|
|
|
|
// When the Bro process was started.
|
|
extern double bro_start_time;
|
|
|
|
// Time at which the Bro process was started with respect to network time,
|
|
// i.e. the timestamp of the first packet.
|
|
extern double bro_start_network_time;
|
|
|
|
// True if we're a in the process of cleaning-up just before termination.
|
|
extern bool terminating;
|
|
|
|
// True if Bro is currently parsing scripts.
|
|
extern bool is_parsing;
|
|
|
|
extern const Packet* current_pkt;
|
|
extern int current_dispatched;
|
|
extern double current_timestamp;
|
|
extern iosource::PktSrc* current_pktsrc;
|
|
extern iosource::IOSource* current_iosrc;
|
|
|
|
extern iosource::PktDumper* pkt_dumper; // where to save packets
|
|
|
|
// Script file we have already scanned (or are in the process of scanning).
|
|
// They are identified by device and inode number.
|
|
struct ScannedFile {
|
|
dev_t dev;
|
|
ino_t inode;
|
|
int include_level;
|
|
string name;
|
|
bool skipped; // This ScannedFile was @unload'd.
|
|
bool prefixes_checked; // If loading prefixes for this file has been tried.
|
|
|
|
ScannedFile(dev_t arg_dev, ino_t arg_inode, int arg_include_level,
|
|
const string& arg_name, bool arg_skipped = false,
|
|
bool arg_prefixes_checked = false)
|
|
: dev(arg_dev), inode(arg_inode),
|
|
include_level(arg_include_level),
|
|
name(arg_name), skipped(arg_skipped),
|
|
prefixes_checked(arg_prefixes_checked)
|
|
{ }
|
|
};
|
|
|
|
extern std::list<ScannedFile> files_scanned;
|
|
extern std::vector<string> sig_files;
|