Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Bring back default packet analysis.

Browse source 
Default analyzers can be configured per packet analyzer by omitting the
identifier in the ConfigEntry.
This commit is contained in:
Jan Grashoefer 2020-08-21 18:11:05 +02:00 • committed by Tim Wojtulewicz
parent d4ff5a236c
commit 462b1fe3a2
9 changed files with 81 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/packet_analysis/Analyzer.cc
View file

@ -47,14 +47,24 @@ bool Analyzer::RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer
return dispatcher.Register(identifier, std::move(analyzer));
}
void Analyzer::RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer)
{
this->default_analyzer = std::move(default_analyzer);
}
AnalyzerPtr Analyzer::Lookup(uint32_t identifier) const
{
return dispatcher.Lookup(identifier);
}
AnalyzerResult Analyzer::AnalyzeInnerPacket(Packet* packet,
const uint8_t*& data, uint32_t identifier) const
{
auto inner_analyzer = dispatcher.Lookup(identifier);
auto inner_analyzer = Lookup(identifier);
inner_analyzer = inner_analyzer ? inner_analyzer : default_analyzer;
if ( inner_analyzer == nullptr )
{
//TODO: Handle default analysis here
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s failed, could not find analyzer for identifier %#x.",
GetAnalyzerName(), identifier);
packet->Weird("no_suitable_analyzer_found");