Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add packet analyzer history

Browse source
This commit is contained in:
Jan Grashoefer 2024-08-12 11:59:30 +02:00
parent f943366e8e
commit 29bc84e1d6
5 changed files with 45 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/packet_analysis/Manager.h
View file

@ -176,6 +176,13 @@ public:
*/
uint64_t GetUnprocessedCount() const { return total_not_processed; }
/**
* Tracks the given analyzer for the current packet's analyzer history.
* The packet analyzer history is implemented in form of a stack, which is reset on a
* call to ProcessPacket() but maintained throughout calls to ProcessInnerPacket().
*/
void TrackAnalyzer(AnalyzerPtr analyzer) { analyzer_stack.push_back(std::move(analyzer)); }
private:
/**
* Instantiates a new analyzer instance.
@ -197,6 +204,14 @@ private:
*/
AnalyzerPtr InstantiateAnalyzer(const std::string& name);
/**
* Generates a string vector that represents the analyzer history of the
* current packet based on the analyzers' tags.
*
* @return A vector of strings representing the packet analyzer history.
*/
VectorValPtr BuildAnalyzerHistory() const;
bool PermitUnknownProtocol(const std::string& analyzer, uint32_t protocol);
std::map<std::string, AnalyzerPtr> analyzers;
@ -216,6 +231,8 @@ private:
uint64_t total_not_processed = 0;
iosource::PktDumper* unprocessed_dumper = nullptr;
std::vector<AnalyzerPtr> analyzer_stack;
};
} // namespace packet_analysis