mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
c44cbe1feb
This enables locating the headers within the install-tree using the dirs provided by `zeek-config --include_dir`. To enable locating these headers within the build-tree, this change also creates a 'build/src/include/zeek -> ..' symlink.
96 lines
2.5 KiB
C++
96 lines
2.5 KiB
C++
#include "zeek/analyzer/protocol/syslog/Syslog.h"
|
|
#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
|
|
|
|
#include "zeek/analyzer/protocol/syslog/events.bif.h"
|
|
|
|
namespace zeek::analyzer::syslog {
|
|
|
|
Syslog_Analyzer::Syslog_Analyzer(Connection* conn)
|
|
: Analyzer("SYSLOG", conn)
|
|
{
|
|
interp = new binpac::Syslog::Syslog_Conn(this);
|
|
did_session_done = 0;
|
|
//ADD_ANALYZER_TIMER(&Syslog_Analyzer::ExpireTimer,
|
|
// network_time + Syslog_session_timeout, true, TIMER_Syslog_EXPIRE);
|
|
}
|
|
|
|
Syslog_Analyzer::~Syslog_Analyzer()
|
|
{
|
|
delete interp;
|
|
}
|
|
|
|
void Syslog_Analyzer::Done()
|
|
{
|
|
Analyzer::Done();
|
|
|
|
if ( ! did_session_done )
|
|
Event(udp_session_done);
|
|
}
|
|
|
|
void Syslog_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint64_t seq, const IP_Hdr* ip, int caplen)
|
|
{
|
|
Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen);
|
|
interp->NewData(orig, data, data + len);
|
|
}
|
|
|
|
//void Syslog_Analyzer::ExpireTimer(double t)
|
|
// {
|
|
// // The - 1.0 in the following is to allow 1 second for the
|
|
// // common case of a single request followed by a single reply,
|
|
// // so we don't needlessly set the timer twice in that case.
|
|
// if ( t - Conn()->LastTime() >= Syslog_session_timeout - 1.0 || terminating )
|
|
// {
|
|
// Event(connection_timeout);
|
|
// sessions->Remove(Conn());
|
|
// }
|
|
// else
|
|
// ADD_ANALYZER_TIMER(&Syslog_Analyzer::ExpireTimer,
|
|
// t + Syslog_session_timeout, true, TIMER_Syslog_EXPIRE);
|
|
// }
|
|
|
|
//Syslog_tcp::TCP_Analyzer::Syslog_tcp::TCP_Analyzer(Connection* conn)
|
|
//: analyzer::tcp::TCP_ApplicationAnalyzer(conn)
|
|
// {
|
|
// interp = new binpac::Syslog_on_TCP::Syslog_TCP_Conn(this);
|
|
// }
|
|
|
|
//Syslog_tcp::TCP_Analyzer::~Syslog_tcp::TCP_Analyzer()
|
|
// {
|
|
// delete interp;
|
|
// }
|
|
|
|
//void Syslog_tcp::TCP_Analyzer::Done()
|
|
// {
|
|
// analyzer::tcp::TCP_ApplicationAnalyzer::Done();
|
|
//
|
|
// interp->FlowEOF(true);
|
|
// interp->FlowEOF(false);
|
|
// }
|
|
|
|
//void Syslog_tcp::TCP_Analyzer::EndpointEOF(tcp::TCP_Reassembler* endp)
|
|
// {
|
|
// analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(endp);
|
|
// interp->FlowEOF(endp->IsOrig());
|
|
// }
|
|
|
|
//void Syslog_tcp::TCP_Analyzer::DeliverStream(int len, const u_char* data,
|
|
// bool orig)
|
|
// {
|
|
// analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
|
//
|
|
// assert(TCP());
|
|
//
|
|
// if ( TCP()->IsPartial() || TCP()->HadGap(orig) )
|
|
// // punt-on-partial or stop-on-gap.
|
|
// return;
|
|
//
|
|
// interp->NewData(orig, data, data + len);
|
|
// }
|
|
|
|
//void Syslog_tcp::TCP_Analyzer::Undelivered(uint64_t seq, int len, bool orig)
|
|
// {
|
|
// analyzer::tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
|
// interp->NewGap(orig, len);
|
|
// }
|
|
|
|
} // namespace zeek::analyzer::syslog
|