Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Infrastructure for modularizing protocol analyzers.

Browse source 
There's now a new directory "src/protocols/", and the plan is for each
protocol analyzer to eventually have its own subdirectory in there
that contains everything it defines (C++/pac/bif). The infrastructure
to make that happen is in place, and two analyzers have been
converted to the new model, HTTP and SSL; there's no further
HTTP/SSL-specific code anywhere else in the core anymore (I believe :-)

Further changes:

    - -N lists available plugins, -NN lists more details on what these
      plugins provide (analyzers, bif elements). (The latter does not
      work for analyzers that haven't been converted yet).

    - *.bif.bro files now go into scripts/base/bif/; and
      scripts/base/bif/plugins/ for bif files provided by plugins.

    - I've factored out the bifcl/binpac CMake magic from
      src/CMakeLists.txt to cmake/{BifCl,Binpac}

    - There's a new cmake/BroPlugin that contains magic to allow
      plugins to have a simple CMakeLists.txt. The hope is that
      eventually the same CMakeLists.txt can be used for compiling a
      plugin either statically or dynamically.

    - bifcl has a new option -c that changes the code it generates so
      that it can be used with a plugin.

TODOs:
    - "make install" is probably broken.
    - Broxygen is probably broken for plugin-defined events.
    - event groups are broken (do we want to keep them?)
This commit is contained in:
Robin Sommer 2013-03-28 21:47:44 -07:00
parent 2be985433c
commit 19c1816ebb
44 changed files with 974 additions and 663 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/main.cc
View file

@ -56,7 +56,6 @@ extern "C" void OPENSSL_add_all_algorithms_conf(void);
#include "input/Manager.h"
#include "logging/Manager.h"
#include "logging/writers/Ascii.h"
#include "analyzer/BuiltInAnalyzers.h"
#include "analyzer/Manager.h"
#include "analyzer/Tag.h"
#include "plugin/Manager.h"
@ -180,7 +179,7 @@ void usage()
fprintf(stderr, " -I|--print-id <ID name> | print out given ID\n");
fprintf(stderr, " -K|--md5-hashkey <hashkey> | set key for MD5-keyed hashing\n");
fprintf(stderr, " -L|--rule-benchmark | benchmark for rules\n");
fprintf(stderr, " -N|--print-plugins | print all available plugins and exit\n");
fprintf(stderr, " -N|--print-plugins | print available plugins and exit (-NN for verbose)\n");
fprintf(stderr, " -O|--optimize | optimize policy script\n");
fprintf(stderr, " -P|--prime-dns | prime DNS\n");
fprintf(stderr, " -R|--replay <events.bst> | replay events\n");
@ -238,7 +237,7 @@ void usage()
exit(1);
}
void show_plugins()
void show_plugins(int level)
{
plugin::Manager::plugin_list plugins = plugin_mgr->Plugins();
@ -250,10 +249,15 @@ void show_plugins()
ODesc d;
if ( level == 1 )
d.SetShort();
for ( plugin::Manager::plugin_list::const_iterator i = plugins.begin(); i != plugins.end(); i++ )
{
(*i)->Describe(&d);
d.NL();
if ( ! d.IsShort() )
d.Add("\n");
}
printf("%s", d.Description());
@ -641,7 +645,7 @@ int main(int argc, char** argv)
break;
case 'N':
print_plugins = 1;
++print_plugins;
break;
case 'O':
@ -785,7 +789,7 @@ int main(int argc, char** argv)
if ( optind == argc &&
read_files.length() == 0 && flow_files.length() == 0 &&
interfaces.length() == 0 &&
! (id_name || bst_file) && ! command_line_policy )
! (id_name || bst_file) && ! command_line_policy && ! print_plugins )
add_input_file("-");
// Process remaining arguments. X=Y arguments indicate script
@ -816,16 +820,8 @@ int main(int argc, char** argv)
log_mgr = new logging::Manager();
input_mgr = new input::Manager();
plugin_mgr = new plugin::Manager();
plugin_mgr->RegisterPlugin(new analyzer::BuiltinAnalyzers());
plugin_mgr->InitPlugins();
if ( print_plugins )
{
show_plugins();
exit(1);
}
analyzer_mgr->Init();
if ( events_file )
@ -846,6 +842,14 @@ int main(int argc, char** argv)
yyparse();
plugin_mgr->InitPluginsBif();
if ( print_plugins )
{
show_plugins(print_plugins);
exit(1);
}
#ifdef USE_PERFTOOLS_DEBUG
}
#endif