mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 17:48:21 +00:00
641154f8e8
- FileAnalysis::Info is now just a record used for logging, the fa_file record type is defined in init-bare.bro as the analogue to a connection record. - Starting to transfer policy hook triggers and analyzer results to events.
35 lines
681 B
C++
35 lines
681 B
C++
#ifndef FILE_ANALYSIS_DATAEVENT_H
|
|
#define FILE_ANALYSIS_DATAEVENT_H
|
|
|
|
#include <string>
|
|
|
|
#include "Val.h"
|
|
#include "File.h"
|
|
#include "Action.h"
|
|
|
|
namespace file_analysis {
|
|
|
|
/**
|
|
* An action to send file data to script-layer events.
|
|
*/
|
|
class DataEvent : public Action {
|
|
public:
|
|
|
|
static Action* Instantiate(RecordVal* args, File* file);
|
|
|
|
virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
|
|
|
|
virtual bool DeliverStream(const u_char* data, uint64 len);
|
|
|
|
protected:
|
|
|
|
DataEvent(RecordVal* args, File* file,
|
|
EventHandlerPtr ce, EventHandlerPtr se);
|
|
|
|
EventHandlerPtr chunk_event;
|
|
EventHandlerPtr stream_event;
|
|
};
|
|
|
|
} // namespace file_analysis
|
|
|
|
#endif
|