Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

analyzer: Move disabling_analyzer() hook into Analyzer module

Browse source 
When disabling_analyzer() was introduced, it was added to the GLOBAL
module. The awkward side-effect is that implementing a hook handler
in another module requires to prefix it with GLOBAL. Alternatively, one
can re-open the GLOBAL module and implement the handler in that scope.

Both are not great, and prefixing with GLOBAL is ugly, so move the
identifier to the Analyzer module and ask users to prefix with Analyzer.
This commit is contained in:
Arne Welzel 2023-01-23 12:09:47 +01:00
parent 80a3f5814b
commit 26b1558cd1
7 changed files with 81 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/scripts/base/protocols/ssl/prevent-disable-analyzer.test
View file

@ -17,7 +17,7 @@ global encrypted_data_wanted = 4;
# Prevent disabling the SSL analyzer for this connection until we've seen encrypted_data_wanted
# encrypted data events on it. Our ssl_encrypted_data event handler has the inverse condition.
hook disabling_analyzer(c: connection, atype: AllAnalyzers::Tag, aid: count)
hook Analyzer::disabling_analyzer(c: connection, atype: AllAnalyzers::Tag, aid: count)
{
print "disabling_analyzer", c$id, atype, aid;
if ( atype != Analyzer::ANALYZER_SSL || ! c?$ssl )
@ -37,9 +37,9 @@ event ssl_established(c: connection)
print "established", c$id;
}
event analyzer_confirmation(c: connection, atype: AllAnalyzers::Tag, aid: count)
event analyzer_confirmation_info(atype: AllAnalyzers::Tag, info: AnalyzerConfirmationInfo)
{
print "analyzer_confirmation", c$id, atype, aid;
print "analyzer_confirmation", info$c$id, atype, info$aid;
}
event ssl_encrypted_data(c: connection, is_client: bool, record_version: count, content_type: count, length: count)