mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
d5fd29edcd
While we support initializing records via coercion from an expression
list, e.g.,
local x: X = [$x1=1, $x2=2];
this can sometimes obscure the code to readers, e.g., when assigning to
value declared and typed elsewhere. The language runtime has a similar
overhead since instead of just constructing a known type it needs to
check at runtime that the coercion from the expression list is valid;
this can be slower than just writing the readible code in the first
place, see #4559.
With this patch we use explicit construction, e.g.,
local x = X($x1=1, $x2=2);
81 lines
3.1 KiB
Text
81 lines
3.1 KiB
Text
##! Input handling for the intelligence framework. This script implements the
|
|
##! import of intelligence data from files using the input framework.
|
|
|
|
@load ./main
|
|
|
|
module Intel;
|
|
|
|
export {
|
|
## Intelligence files that will be read off disk. The files are
|
|
## reread every time they are updated so updates must be atomic
|
|
## with "mv" instead of writing the file in place.
|
|
const read_files: set[string] = {} &redef;
|
|
|
|
## An optional path prefix for intel files. This prefix can, but
|
|
## need not be, absolute. The default is to leave any filenames
|
|
## unchanged. This prefix has no effect if a read_file entry is
|
|
## an absolute path. This prefix gets applied _before_ entering
|
|
## the input framework, so if the prefix is absolute, the input
|
|
## framework won't munge it further. If it is relative, then
|
|
## any path_prefix specified in the input framework will apply
|
|
## additionally.
|
|
const path_prefix = "" &redef;
|
|
|
|
## This event is raised each time the intel framework reads a new line
|
|
## from an intel file. It is used in the intel framework but can
|
|
## also be used in custom scripts for further checks.
|
|
##
|
|
## desc: The :zeek:type:`Input::EventDescription` record which generated the event.
|
|
##
|
|
## tpe: The type of input event.
|
|
##
|
|
## item: The intel item being read (of type :zeek:type:`Intel::Item`).
|
|
##
|
|
global read_entry: event(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item);
|
|
|
|
## This event is raised each time the input framework detects an error
|
|
## while reading the intel file. It can be used to implement further checks
|
|
## in custom scripts. Errors can be of different levels (information, warning, errors).
|
|
##
|
|
## desc: The :zeek:type:`Input::EventDescription` record which generated the error.
|
|
##
|
|
## message: An error message.
|
|
##
|
|
## level: The :zeek:type:`Reporter::Level` of the error.
|
|
##
|
|
global read_error: event(desc: Input::EventDescription, message: string, level: Reporter::Level);
|
|
}
|
|
|
|
event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item)
|
|
{
|
|
Intel::insert(item);
|
|
}
|
|
|
|
event zeek_init() &priority=5
|
|
{
|
|
if ( ! Cluster::is_enabled() ||
|
|
Cluster::local_node_type() == Cluster::MANAGER )
|
|
{
|
|
for ( a_file in read_files )
|
|
{
|
|
# Handle prefixing of the source file name. Note
|
|
# that this currently always uses the ASCII reader,
|
|
# so we know we're dealing with filenames.
|
|
local source = a_file;
|
|
|
|
# If we have a path prefix and the file doesn't
|
|
# already have an absolute path, prepend the prefix.
|
|
if ( |path_prefix| > 0 && sub_bytes(a_file, 0, 1) != "/" )
|
|
source = cat(rstrip(path_prefix, "/"), "/", a_file);
|
|
|
|
Input::add_event(Input::EventDescription($source=source,
|
|
$reader=Input::READER_ASCII,
|
|
$mode=Input::REREAD,
|
|
$name=cat("intel-", a_file),
|
|
$fields=Intel::Item,
|
|
$ev=Intel::read_entry,
|
|
$error_ev=Intel::read_error));
|
|
}
|
|
}
|
|
}
|
|
|