mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
d5fd29edcd
While we support initializing records via coercion from an expression
list, e.g.,
local x: X = [$x1=1, $x2=2];
this can sometimes obscure the code to readers, e.g., when assigning to
value declared and typed elsewhere. The language runtime has a similar
overhead since instead of just constructing a known type it needs to
check at runtime that the coercion from the expression list is valid;
this can be slower than just writing the readible code in the first
place, see #4559.
With this patch we use explicit construction, e.g.,
local x = X($x1=1, $x2=2);
30 lines
1,016 B
Text
30 lines
1,016 B
Text
@load base/frameworks/intel
|
|
@load ./where-locations
|
|
|
|
event file_new(f: fa_file) &group="Intel::FILE_NAME"
|
|
{
|
|
# If there are connections attached, we'll be using
|
|
# file_over_new_connection() for reporting the
|
|
# filename instead as it's more likely to be populated.
|
|
if ( f?$conns && |f$conns| > 0 )
|
|
return;
|
|
|
|
if ( f?$info && f$info?$filename )
|
|
Intel::seen(Intel::Seen($indicator=f$info$filename,
|
|
$indicator_type=Intel::FILE_NAME,
|
|
$f=f,
|
|
$where=Files::IN_NAME));
|
|
}
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5 &group="Intel::FILE_NAME"
|
|
{
|
|
# Skip SMB, there's a custom implementation in smb-filenames.zeek
|
|
if ( f$source == "SMB" )
|
|
return;
|
|
|
|
if ( f?$info && f$info?$filename )
|
|
Intel::seen(Intel::Seen($indicator=f$info$filename,
|
|
$indicator_type=Intel::FILE_NAME,
|
|
$f=f,
|
|
$where=Files::IN_NAME));
|
|
}
|