mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 05:58:20 +00:00
99c89b42d7
Made some class templates for code that seemed duplicated between file/protocol tags and managers. Seems like it helps a bit and hopefully can be also be used to transition other things that have enum value "tags" (e.g. logging writers, input readers) to the plugin system.
57 lines
1 KiB
C++
57 lines
1 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#include <string>
|
|
|
|
#include "Hash.h"
|
|
#include "util.h"
|
|
#include "Event.h"
|
|
#include "file_analysis/Manager.h"
|
|
|
|
using namespace file_analysis;
|
|
|
|
Hash::Hash(RecordVal* args, File* file, HashVal* hv, const char* arg_kind)
|
|
: file_analysis::Analyzer(file_mgr->GetComponentTag(to_upper(arg_kind).c_str()), args, file), hash(hv), fed(false), kind(arg_kind)
|
|
{
|
|
hash->Init();
|
|
}
|
|
|
|
Hash::~Hash()
|
|
{
|
|
Unref(hash);
|
|
}
|
|
|
|
bool Hash::DeliverStream(const u_char* data, uint64 len)
|
|
{
|
|
if ( ! hash->IsValid() )
|
|
return false;
|
|
|
|
if ( ! fed )
|
|
fed = len > 0;
|
|
|
|
hash->Feed(data, len);
|
|
return true;
|
|
}
|
|
|
|
bool Hash::EndOfFile()
|
|
{
|
|
Finalize();
|
|
return false;
|
|
}
|
|
|
|
bool Hash::Undelivered(uint64 offset, uint64 len)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
void Hash::Finalize()
|
|
{
|
|
if ( ! hash->IsValid() || ! fed )
|
|
return;
|
|
|
|
val_list* vl = new val_list();
|
|
vl->append(GetFile()->GetVal()->Ref());
|
|
vl->append(new StringVal(kind));
|
|
vl->append(hash->Get());
|
|
|
|
mgr.QueueEvent(file_hash, vl);
|
|
}
|