mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
61 lines
1.5 KiB
C++
61 lines
1.5 KiB
C++
#pragma once
|
|
|
|
#include "Reassem.h"
|
|
|
|
namespace zeek { class File; }
|
|
using BroFile [[deprecated("Remove in v4.1. Use zeek::File.")]] = zeek::File;
|
|
|
|
class Connection;
|
|
|
|
namespace file_analysis {
|
|
|
|
class File;
|
|
|
|
class FileReassembler final : public Reassembler {
|
|
public:
|
|
|
|
FileReassembler(File* f, uint64_t starting_offset);
|
|
~FileReassembler() override;
|
|
|
|
void Done();
|
|
|
|
// Checks if we have delivered all contents that we can possibly
|
|
// deliver for this endpoint.
|
|
void CheckEOF();
|
|
|
|
/**
|
|
* Discards all contents of the reassembly buffer. This will spin through
|
|
* the buffer and call File::DeliverStream() and File::Gap() wherever
|
|
* appropriate.
|
|
* @return the number of new bytes now detected as gaps in the file.
|
|
*/
|
|
uint64_t Flush();
|
|
|
|
/**
|
|
* Discards all contents of the reassembly buffer up to a given sequence
|
|
* number. This will spin through the buffer and call
|
|
* File::DeliverStream() and File::Gap() wherever appropriate.
|
|
* @param sequence the sequence number to flush until.
|
|
* @return the number of new bytes now detected as gaps in the file.
|
|
*/
|
|
uint64_t FlushTo(uint64_t sequence);
|
|
|
|
/**
|
|
* @return whether the reassembler is currently is the process of flushing
|
|
* out the contents of its buffer.
|
|
*/
|
|
bool IsCurrentlyFlushing() const
|
|
{ return flushing; }
|
|
|
|
protected:
|
|
FileReassembler();
|
|
|
|
void Undelivered(uint64_t up_to_seq) override;
|
|
void BlockInserted(DataBlockMap::const_iterator it) override;
|
|
void Overlap(const u_char* b1, const u_char* b2, uint64_t n) override;
|
|
|
|
File* the_file;
|
|
bool flushing;
|
|
};
|
|
|
|
} // namespace analyzer::*
|