Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 13:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Bring back default packet analysis.

Browse source 
Default analyzers can be configured per packet analyzer by omitting the
identifier in the ConfigEntry.
This commit is contained in:
Jan Grashoefer 2020-08-21 18:11:05 +02:00 • committed by Tim Wojtulewicz
parent d4ff5a236c
commit 462b1fe3a2
9 changed files with 81 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/packet_analysis/Analyzer.h
View file

@ -74,10 +74,17 @@ public:
*
* @param identifier The identifier an analyzer should be called for.
* @param analyzer The analyzer that should be called.
* @return True if the registration was successfull.
* @return True if the registration was successful.
*/
bool RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer);
/**
* Registers a default analyzer.
*
* @param default_analyzer The analyzer to use as default.
*/
void RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer);
/**
* Analyzes the given packet. The data reference points to the part of the
* raw packet to be analyzed. If the analyzed protocol encapsulates another
@ -95,6 +102,16 @@ public:
protected:
friend class Manager;
/**
* Looks up the analyzer for the encapsulated protocol based on the given
* identifier.
*
* @param identifier Identifier for the encapsulated protocol.
* @return The analyzer registered for the given identifier. Returns a
* nullptr if no analyzer is registered.
*/
AnalyzerPtr Lookup(uint32_t identifier) const;
/**
* Triggers analysis of the encapsulated packet. The encapsulated protocol
* is determined using the given identifier.
@ -105,12 +122,13 @@ protected:
*
* @return The outcome of the analysis.
*/
AnalyzerResult AnalyzeInnerPacket(Packet* packet, const uint8_t*& data,
uint32_t identifier) const;
virtual AnalyzerResult AnalyzeInnerPacket(Packet* packet, const uint8_t*& data,
uint32_t identifier) const;
private:
Tag tag;
Dispatcher dispatcher;
AnalyzerPtr default_analyzer = nullptr;
void Init(const Tag& tag);
};