mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
691622b3aa
The Info record now uses a "table[ActionArgs] of ActionResults", which allows for simultaneous actions of a given type as long as other args (fields in the ActionArgs record) are different.
34 lines
567 B
C++
34 lines
567 B
C++
#ifndef FILE_ANALYSIS_EXTRACT_H
|
|
#define FILE_ANALYSIS_EXTRACT_H
|
|
|
|
#include <string>
|
|
|
|
#include "Val.h"
|
|
#include "Info.h"
|
|
#include "Action.h"
|
|
|
|
namespace file_analysis {
|
|
|
|
/**
|
|
* An action to simply extract files to disk.
|
|
*/
|
|
class Extract : public Action {
|
|
public:
|
|
|
|
static Action* Instantiate(RecordVal* args, Info* info);
|
|
|
|
virtual ~Extract();
|
|
|
|
virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
|
|
|
|
protected:
|
|
|
|
Extract(RecordVal* args, Info* info, const string& arg_filename);
|
|
|
|
string filename;
|
|
int fd;
|
|
};
|
|
|
|
} // namespace file_analysis
|
|
|
|
#endif
|