Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Small cleanup of packet analysis.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-28 14:41:34 +02:00 • committed by Tim Wojtulewicz
parent 2d7280fabd
commit 0ec7516602
4 changed files with 13 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/base/init-bare.zeek
View file

@ -5340,24 +5340,24 @@ event net_done(t: time)
module PacketAnalyzer;
# Defines a mapping for the PacketAnalyzer's configuration tree. This
# maps from a parent analyzer to a child analyzer through a numeric
# identifier.
## Defines a mapping for the PacketAnalyzer's configuration tree. This
## maps from a parent analyzer to a child analyzer through a numeric
## identifier.
export {
type ConfigEntry : record {
# The parent analyzer. This analyzer will check for the *identifier* in the
# packet data to know whether to call the next analyzer. This field is optional.
# If it is not included, the identifier will attach to the "root" analyzer. The
# root analyzer uses the link layer identifier provided by the packet source to
# determine the protocol for the initial packet header.
## The parent analyzer. This analyzer will check for the *identifier* in the
## packet data to know whether to call the next analyzer. This field is optional.
## If it is not included, the identifier will attach to the "root" analyzer. The
## root analyzer uses the link layer identifier provided by the packet source to
## determine the protocol for the initial packet header.
parent : PacketAnalyzer::Tag &optional;
# A numeric identifier, which can be found in the packet data, that denotes the
# encapsulated protocol. This field is optional. If it is not included, the
# configured child analyzer will be used as default analyzer.
## A numeric identifier, which can be found in the packet data, that denotes the
## encapsulated protocol. This field is optional. If it is not included, the
## configured child analyzer will be used as default analyzer.
identifier : count &optional;
# The analyzer that corresponds to the above identifier.
## The analyzer that corresponds to the above identifier.
analyzer : PacketAnalyzer::Tag;
};

2
src/packet_analysis/Manager.cc
View file

@ -30,7 +30,7 @@ void Manager::InitPostScript()
if ( mapping_val->Size() == 0 )
return;
for (unsigned int i = 0; i < mapping_val->Size(); i++)
for ( unsigned int i = 0; i < mapping_val->Size(); i++ )
{
auto* rv = mapping_val->At(i)->AsRecordVal();
//TODO: Make that field a string for usability reasons

10
src/packet_analysis/Tag.cc
View file

@ -23,19 +23,9 @@ const IntrusivePtr<EnumVal>& Tag::AsVal() const
return zeek::Tag::AsVal(packet_mgr->GetTagType());
}
EnumVal* Tag::AsEnumVal() const
{
return AsVal().get();
}
Tag::Tag(IntrusivePtr<EnumVal> val)
: zeek::Tag(std::move(val))
{
}
Tag::Tag(EnumVal* val)
: zeek::Tag({NewRef {}, val})
{
}
}

20
src/packet_analysis/Tag.h
View file

@ -9,14 +9,6 @@ namespace zeek::plugin {
template <class T> class TaggedComponent;
template <class T, class C> class ComponentManager;
}
namespace plugin {
template <class T>
using TaggedComponent [[deprecated("Remove in v4.1. Use zeek::plugin::TaggedComponent instead.")]] =
zeek::plugin::TaggedComponent<T>;
template <class T, class C>
using ComponentManager [[deprecated("Remove in v4.1. Use zeek::plugin::ComponentManager instead.")]] =
zeek::plugin::ComponentManager<T, C>;
}
namespace zeek::packet_analysis {
@ -87,15 +79,6 @@ public:
*/
const IntrusivePtr<EnumVal>& AsVal() const;
/**
* Returns the \c Analyzer::Tag enum that corresponds to this tag.
* The returned value does not have its ref-count increased.
*
* @param etype the script-layer enum type associated with the tag.
*/
[[deprecated("Remove in v4.1. Use AsVal() instead.")]]
EnumVal* AsEnumVal() const;
static Tag Error;
protected:
@ -122,9 +105,6 @@ protected:
* @param val An enum value of script type \c Analyzer::Tag.
*/
explicit Tag(IntrusivePtr<EnumVal> val);
[[deprecated("Remove in v4.1. Construct from IntrusivePtr instead")]]
explicit Tag(EnumVal* val);
};
}