mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 04:28:20 +00:00
cd201aa24e
These are non-functional changes. * accounting * activation * actual * added * addresult * aggregable * aligned * alternatively * ambiguous * analysis * analyzer * anticlimactic * apparently * application * appropriate * arithmetic * assignment * assigns * associated * authentication * authoritative * barrier * boundary * broccoli * buffering * caching * called * canonicalized * capturing * certificates * ciphersuite * columns * communication * comparison * comparisons * compilation * component * concatenating * concatenation * connection * convenience * correctly * corresponding * could * counting * data * declared * decryption * defining * dependent * deprecated * detached * dictionary * directional * directly * directory * discarding * disconnecting * distinguishes * documentation * elsewhere * emitted * empty * endianness * endpoint * enumerator * essentially * evaluated * everything * exactly * execute * explicit * expressions * facilitates * fiddling * filesystem * flag * flagged * for * fragments * guarantee * guaranteed * happen * happening * hemisphere * identifier * identifies * identify * implementation * implemented * implementing * including * inconsistency * indeterminate * indices * individual * information * initial * initialization * initialize * initialized * initializes * instantiate * instantiated * instantiates * interface * internal * interpreted * interpreter * into * it * iterators * length * likely * log * longer * mainly * mark * maximum * message * minimum * module * must * name * namespace * necessary * nonexistent * not * notifications * notifier * number * objects * occurred * operations * original * otherwise * output * overridden * override * overriding * overwriting * ownership * parameters * particular * payload * persistent * potential * precision * preexisting * preservation * preserved * primarily * probably * procedure * proceed * process * processed * processes * processing * propagate * propagated * prototype * provides * publishing * purposes * queue * reached * reason * reassem * reassemble * reassembler * recommend * record * reduction * reference * regularly * representation * request * reserved * retrieve * returning * separate * should * shouldn't * significant * signing * simplified * simultaneously * single * somebody * sources * specific * specification * specified * specifies * specify * statement * subdirectories * succeeded * successful * successfully * supplied * synchronization * tag * temporarily * terminating * that * the * transmitted * true * truncated * try * understand * unescaped * unforwarding * unknown * unknowndata * unspecified * update * usually * which * wildcard Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
66 lines
2.2 KiB
C++
66 lines
2.2 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#pragma once
|
|
|
|
#include <string>
|
|
|
|
#include "zeek/EventHandler.h"
|
|
#include "zeek/Val.h"
|
|
#include "zeek/file_analysis/Analyzer.h"
|
|
#include "zeek/file_analysis/File.h"
|
|
|
|
namespace zeek::file_analysis::detail
|
|
{
|
|
|
|
/**
|
|
* An analyzer to send file data to script-layer via events.
|
|
*/
|
|
class DataEvent : public file_analysis::Analyzer
|
|
{
|
|
public:
|
|
/**
|
|
* Generates the event, if any, specified by the "chunk_event" field of this
|
|
* analyzer's \c AnalyzerArgs. This is for non-sequential file data input.
|
|
* @param data pointer to start of file data chunk.
|
|
* @param len number of bytes in the data chunk.
|
|
* @param offset number of bytes from start of file at which chunk occurs.
|
|
* @return always true
|
|
*/
|
|
bool DeliverChunk(const u_char* data, uint64_t len, uint64_t offset) override;
|
|
|
|
/**
|
|
* Generates the event, if any, specified by the "stream_event" field of
|
|
* this analyzer's \c AnalyzerArgs. This is for sequential file data input.
|
|
* @param data pointer to start of file data chunk.
|
|
* @param len number of bytes in the data chunk.
|
|
* @return always true
|
|
*/
|
|
bool DeliverStream(const u_char* data, uint64_t len) override;
|
|
|
|
/**
|
|
* Create a new instance of a DataEvent analyzer.
|
|
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
|
* @param file the file to which the analyzer will be attached.
|
|
* @return the new DataEvent analyzer instance or a null pointer if
|
|
* no "chunk_event" or "stream_event" field was specified in \a args.
|
|
*/
|
|
static file_analysis::Analyzer* Instantiate(RecordValPtr args, file_analysis::File* file);
|
|
|
|
protected:
|
|
/**
|
|
* Constructor.
|
|
* @param args the \c AnalyzerArgs value which represents the analyzer.
|
|
* @param file the file to which the analyzer will be attached.
|
|
* @param ce pointer to event handler which will be called to receive
|
|
* non-sequential file data.
|
|
* @param se pointer to event handler which will be called to receive
|
|
* sequential file data.
|
|
*/
|
|
DataEvent(RecordValPtr args, file_analysis::File* file, EventHandlerPtr ce, EventHandlerPtr se);
|
|
|
|
private:
|
|
EventHandlerPtr chunk_event;
|
|
EventHandlerPtr stream_event;
|
|
};
|
|
|
|
} // namespace zeek::file_analysis::detail
|