diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek
index b89aa00f4c..b7a2b1b80c 100644
--- a/scripts/base/init-bare.zeek
+++ b/scripts/base/init-bare.zeek
@@ -5340,28 +5340,16 @@ event net_done(t: time)
module PacketAnalyzer;
-## Defines a mapping for the PacketAnalyzer's configuration tree. This
-## maps from a parent analyzer to a child analyzer through a numeric
-## identifier.
export {
- type ConfigEntry : record {
- ## The parent analyzer. This analyzer will check for the *identifier* in the
- ## packet data to know whether to call the next analyzer. This field is optional.
- ## If it is not included, the identifier will attach to the "root" analyzer. The
- ## root analyzer uses the link layer identifier provided by the packet source to
- ## determine the protocol for the initial packet header.
- parent : PacketAnalyzer::Tag;
+ type DispatchEntry : record {
+ ## The analyzer to dispatch.
+ analyzer : PacketAnalyzer::Tag;
+ };
- ## A numeric identifier, which can be found in the packet data, that denotes the
- ## encapsulated protocol. This field is optional. If it is not included, the
- ## configured child analyzer will be used as default analyzer.
- identifier : count;
-
- ## The analyzer that corresponds to the above identifier.
- analyzer : PacketAnalyzer::Tag;
- };
-
- const config_map : vector of PacketAnalyzer::ConfigEntry &redef;
+ ## A packet analyzer may extract a numeric identifier, which can be found in the
+ ## packet data and denotes the encapsulated protocol. A DispatchMap allows to map
+ ## the identifier to a child analyzer, which is defined using a DispatchEntry.
+ type DispatchMap : table[count] of DispatchEntry;
}
@load base/packet-protocols
diff --git a/scripts/base/packet-protocols/ethernet/main.zeek b/scripts/base/packet-protocols/ethernet/main.zeek
index 6723556708..6f1c31df90 100644
--- a/scripts/base/packet-protocols/ethernet/main.zeek
+++ b/scripts/base/packet-protocols/ethernet/main.zeek
@@ -10,19 +10,19 @@ export {
const novell_raw_analyzer: PacketAnalyzer::Tag &redef;
## IEEE 802.2 LLC analyzer
const llc_analyzer: PacketAnalyzer::Tag &redef;
+
+ ## Identifier mappings based on EtherType
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
}
-const DLT_EN10MB : count = 1;
-
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_EN10MB, $analyzer=PacketAnalyzer::ANALYZER_ETHERNET),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8847, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x88A8, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x9100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE),
+redef dispatch_map += {
+ [0x8847] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
+ [0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+ [0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+ [0x8100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
+ [0x88A8] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
+ [0x9100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
+ [0x8864] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPOE)
};
diff --git a/scripts/base/packet-protocols/fddi/main.zeek b/scripts/base/packet-protocols/fddi/main.zeek
index 30ab05331f..3104682102 100644
--- a/scripts/base/packet-protocols/fddi/main.zeek
+++ b/scripts/base/packet-protocols/fddi/main.zeek
@@ -4,9 +4,3 @@ export {
## Default analyzer
const default_analyzer: PacketAnalyzer::Tag = PacketAnalyzer::ANALYZER_IP &redef;
}
-
-const DLT_FDDI : count = 10;
-
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_FDDI, $analyzer=PacketAnalyzer::ANALYZER_FDDI),
-};
diff --git a/scripts/base/packet-protocols/ieee802_11/main.zeek b/scripts/base/packet-protocols/ieee802_11/main.zeek
index 292e26b34b..f46f89e377 100644
--- a/scripts/base/packet-protocols/ieee802_11/main.zeek
+++ b/scripts/base/packet-protocols/ieee802_11/main.zeek
@@ -1,11 +1,13 @@
module PacketAnalyzer::IEEE802_11;
-const DLT_IEEE802_11 : count = 105;
+export {
+ ## Identifier mappings based on EtherType
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_IEEE802_11, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP)
+redef dispatch_map += {
+ [0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+ [0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP)
};
diff --git a/scripts/base/packet-protocols/ieee802_11_radio/main.zeek b/scripts/base/packet-protocols/ieee802_11_radio/main.zeek
index 13c0cbe618..483a80acf0 100644
--- a/scripts/base/packet-protocols/ieee802_11_radio/main.zeek
+++ b/scripts/base/packet-protocols/ieee802_11_radio/main.zeek
@@ -1,9 +1,12 @@
module PacketAnalyzer::IEEE802_11_RADIO;
-const DLT_IEEE802_11_RADIO : count = 127;
+export {
+ ## Identifier mappings
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
const DLT_IEEE802_11 : count = 105;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_IEEE802_11_RADIO, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO, $identifier=DLT_IEEE802_11, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11)
+redef dispatch_map += {
+ [DLT_IEEE802_11] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11)
};
diff --git a/scripts/base/packet-protocols/ip/main.zeek b/scripts/base/packet-protocols/ip/main.zeek
index c7884db588..feb5fde73b 100644
--- a/scripts/base/packet-protocols/ip/main.zeek
+++ b/scripts/base/packet-protocols/ip/main.zeek
@@ -1,6 +1,11 @@
module PacketAnalyzer::IP;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IP, $identifier=4, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IP, $identifier=6, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+export {
+ ## Identifier mappings based on IP version (4 or 6)
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef dispatch_map += {
+ [4] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [6] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
};
diff --git a/scripts/base/packet-protocols/linux_sll/main.zeek b/scripts/base/packet-protocols/linux_sll/main.zeek
index ce693f6625..995c972ae6 100644
--- a/scripts/base/packet-protocols/linux_sll/main.zeek
+++ b/scripts/base/packet-protocols/linux_sll/main.zeek
@@ -1,12 +1,14 @@
-module PacketAnalyzer::LINUX_SLL;
+module PacketAnalyzer::LINUXSLL;
-const DLT_LINUX_SLL : count = 113;
+export {
+ ## Identifier mappings based on EtherType
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_LINUX_SLL, $analyzer=PacketAnalyzer::ANALYZER_LINUXSLL),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+redef dispatch_map += {
+ [0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
# RARP
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP)
+ [0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP)
};
diff --git a/scripts/base/packet-protocols/nflog/main.zeek b/scripts/base/packet-protocols/nflog/main.zeek
index d5da9f47c8..cecc0d466b 100644
--- a/scripts/base/packet-protocols/nflog/main.zeek
+++ b/scripts/base/packet-protocols/nflog/main.zeek
@@ -1,11 +1,14 @@
module PacketAnalyzer::NFLOG;
-const DLT_NFLOG : count = 239;
+export {
+ ## Identifier mappings
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
const AF_INET : count = 2;
const AF_INET6 : count = 10;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_NFLOG, $analyzer=PacketAnalyzer::ANALYZER_NFLOG),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NFLOG, $identifier=AF_INET, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NFLOG, $identifier=AF_INET6, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+redef dispatch_map += {
+ [AF_INET] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [AF_INET6] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
};
diff --git a/scripts/base/packet-protocols/null/main.zeek b/scripts/base/packet-protocols/null/main.zeek
index 35a4258f04..e1aff33dcd 100644
--- a/scripts/base/packet-protocols/null/main.zeek
+++ b/scripts/base/packet-protocols/null/main.zeek
@@ -1,19 +1,25 @@
module PacketAnalyzer::NULL;
-const DLT_NULL : count = 0;
-const AF_INET : count = 2;
-const AF_INET6 : count = 10;
+export {
+ ## Identifier mappings
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_NULL, $analyzer=PacketAnalyzer::ANALYZER_NULL),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=AF_INET, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+const DLT_NULL : count = 0;
+
+redef PacketAnalyzer::ROOT::dispatch_map += {
+ [DLT_NULL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_NULL)
+};
+
+redef dispatch_map += {
+ [2] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
## From the Wireshark Wiki: AF_INET6ANALYZER, unfortunately, has different values in
## {NetBSD,OpenBSD,BSD/OS}, {FreeBSD,DragonFlyBSD}, and {Darwin/Mac OS X}, so an IPv6
## packet might have a link-layer header with 24, 28, or 30 as the AF_ value. As we
## may be reading traces captured on platforms other than what we're running on, we
## accept them all here.
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=24, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=28, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=30, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+ [24] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [28] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [30] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
};
diff --git a/scripts/base/packet-protocols/ppp_serial/main.zeek b/scripts/base/packet-protocols/ppp_serial/main.zeek
index 75d97706fe..4c2ba042c0 100644
--- a/scripts/base/packet-protocols/ppp_serial/main.zeek
+++ b/scripts/base/packet-protocols/ppp_serial/main.zeek
@@ -1,10 +1,18 @@
module PacketAnalyzer::PPP_SERIAL;
+export {
+ ## Identifier mappings
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
const DLT_PPP_SERIAL : count = 50;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_PPP_SERIAL, $analyzer=PacketAnalyzer::ANALYZER_PPPSERIAL),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0281, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0021, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0057, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+redef PacketAnalyzer::ROOT::dispatch_map += {
+ [DLT_PPP_SERIAL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPSERIAL)
+};
+
+redef dispatch_map += {
+ [0x0281] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
+ [0x0021] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x0057] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
};
diff --git a/scripts/base/packet-protocols/pppoe/main.zeek b/scripts/base/packet-protocols/pppoe/main.zeek
index 425b857f2c..f8e8f76d44 100644
--- a/scripts/base/packet-protocols/pppoe/main.zeek
+++ b/scripts/base/packet-protocols/pppoe/main.zeek
@@ -1,6 +1,11 @@
module PacketAnalyzer::PPPOE;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPOE, $identifier=0x0021, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPOE, $identifier=0x0057, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+export {
+ ## Identifier mappings
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef dispatch_map += {
+ [0x0021] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x0057] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
};
diff --git a/scripts/base/packet-protocols/root/main.zeek b/scripts/base/packet-protocols/root/main.zeek
index 09edcc97b4..a53788804f 100644
--- a/scripts/base/packet-protocols/root/main.zeek
+++ b/scripts/base/packet-protocols/root/main.zeek
@@ -3,4 +3,24 @@ module PacketAnalyzer::ROOT;
export {
## Default analyzer (if we don't know the link type, we assume raw IP)
const default_analyzer: PacketAnalyzer::Tag = PacketAnalyzer::ANALYZER_IP &redef;
+
+ ## Identifier mappings based on link type
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
}
+
+const DLT_EN10MB : count = 1;
+const DLT_FDDI : count = 10;
+const DLT_IEEE802_11 : count = 105;
+const DLT_IEEE802_11_RADIO : count = 127;
+const DLT_LINUX_SLL : count = 113;
+const DLT_NFLOG : count = 239;
+
+redef dispatch_map += {
+ [DLT_EN10MB] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ETHERNET),
+ [DLT_FDDI] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_FDDI),
+ [DLT_IEEE802_11] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11),
+ [DLT_IEEE802_11_RADIO] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO),
+ [DLT_LINUX_SLL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_LINUXSLL),
+ [DLT_NFLOG] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_NFLOG)
+
+};
diff --git a/scripts/base/packet-protocols/vlan/main.zeek b/scripts/base/packet-protocols/vlan/main.zeek
index 927f381acf..7f564cfa0d 100644
--- a/scripts/base/packet-protocols/vlan/main.zeek
+++ b/scripts/base/packet-protocols/vlan/main.zeek
@@ -1,11 +1,16 @@
module PacketAnalyzer::VLAN;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8847, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE)
+export {
+ ## Identifier mappings based on EtherType
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef dispatch_map += {
+ [0x8847] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
+ [0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+ [0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+ [0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+ [0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+ [0x8100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
+ [0x8864] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPOE)
};
diff --git a/src/DebugLogger.h b/src/DebugLogger.h
index 1005c367a6..f7c3a04e55 100644
--- a/src/DebugLogger.h
+++ b/src/DebugLogger.h
@@ -30,26 +30,26 @@ namespace zeek {
// an entry to DebugLogger::streams in DebugLogger.cc.
enum DebugStream {
- DBG_SERIAL, // Serialization
- DBG_RULES, // Signature matching
- DBG_STRING, // String code
- DBG_NOTIFIERS, // Notifiers
- DBG_MAINLOOP, // Main IOSource loop
- DBG_ANALYZER, // Analyzer framework
- DBG_PACKET_ANALYSIS, // Packet analysis
- DBG_FILE_ANALYSIS, // File analysis
- DBG_TM, // Time-machine packet input via Brocolli
- DBG_LOGGING, // Logging streams
- DBG_INPUT, // Input streams
- DBG_THREADING, // Threading system
- DBG_PLUGINS, // Plugin system
- DBG_ZEEKYGEN, // Zeekygen
- DBG_PKTIO, // Packet sources and dumpers.
- DBG_BROKER, // Broker communication
- DBG_SCRIPTS, // Script initialization
- DBG_SUPERVISOR, // Process supervisor
+ DBG_SERIAL, // Serialization
+ DBG_RULES, // Signature matching
+ DBG_STRING, // String code
+ DBG_NOTIFIERS, // Notifiers
+ DBG_MAINLOOP, // Main IOSource loop
+ DBG_ANALYZER, // Analyzer framework
+ DBG_PACKET_ANALYSIS, // Packet analysis
+ DBG_FILE_ANALYSIS, // File analysis
+ DBG_TM, // Time-machine packet input via Brocolli
+ DBG_LOGGING, // Logging streams
+ DBG_INPUT, // Input streams
+ DBG_THREADING, // Threading system
+ DBG_PLUGINS, // Plugin system
+ DBG_ZEEKYGEN, // Zeekygen
+ DBG_PKTIO, // Packet sources and dumpers.
+ DBG_BROKER, // Broker communication
+ DBG_SCRIPTS, // Script initialization
+ DBG_SUPERVISOR, // Process supervisor
- NUM_DBGS // Has to be last
+ NUM_DBGS // Has to be last
};
namespace detail {
diff --git a/src/packet_analysis/Analyzer.cc b/src/packet_analysis/Analyzer.cc
index 12b446738f..9587423ea2 100644
--- a/src/packet_analysis/Analyzer.cc
+++ b/src/packet_analysis/Analyzer.cc
@@ -29,14 +29,37 @@ void Analyzer::Init(const Tag& _tag)
void Analyzer::Initialize()
{
- std::string ns = util::fmt("PacketAnalyzer::%s::", GetAnalyzerName());
+ default_analyzer = LoadAnalyzer("default_analyzer");
- default_analyzer = LoadAnalyzer(ns +"default_analyzer");
+ // Create dispatcher based on configuration
+ auto& mapping_id = zeek::id::find(GetModuleName() + "dispatch_map");
+ if ( ! mapping_id )
+ return;
+
+ auto mapping_val = mapping_id->GetVal()->AsTableVal();
+ auto mapping_tbl = mapping_val->AsTable();
+ auto c = mapping_tbl->InitForIteration();
+
+ zeek::detail::HashKey* k = nullptr;
+ TableEntryVal* v;
+ while ( (v = mapping_tbl->NextEntry(k, c)) )
+ {
+ auto key = mapping_val->RecreateIndex(*k);
+ delete k;
+
+ auto identifier = key->Idx(0)->AsCount();
+ auto config_entry_val = v->GetVal()->AsRecordVal();
+
+ auto mapped_tag = config_entry_val->GetField("analyzer")->AsEnumVal();
+ auto mapped_analyzer = packet_mgr->GetAnalyzer(mapped_tag);
+
+ dispatcher.Register(identifier, std::move(mapped_analyzer));
+ }
}
zeek::packet_analysis::AnalyzerPtr Analyzer::LoadAnalyzer(const std::string &name)
{
- auto& analyzer = zeek::id::find(name);
+ auto& analyzer = zeek::id::find(GetModuleName() + name);
if ( ! analyzer )
return nullptr;
@@ -65,16 +88,6 @@ bool Analyzer::IsAnalyzer(const char* name)
return packet_mgr->GetComponentName(tag) == name;
}
-void Analyzer::RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer)
- {
- dispatcher.Register(identifier, std::move(analyzer));
- }
-
-void Analyzer::RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer)
- {
- this->default_analyzer = std::move(default_analyzer);
- }
-
AnalyzerPtr Analyzer::Lookup(uint32_t identifier) const
{
return dispatcher.Lookup(identifier);
@@ -114,7 +127,7 @@ bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet) co
void Analyzer::DumpDebug() const
{
#ifdef DEBUG
- DBG_LOG(DBG_PACKET_ANALYSIS, "Debug info for %s", this->GetAnalyzerName());
+ DBG_LOG(DBG_PACKET_ANALYSIS, "Dispatcher for %s", this->GetAnalyzerName());
dispatcher.DumpDebug();
#endif
}
diff --git a/src/packet_analysis/Analyzer.h b/src/packet_analysis/Analyzer.h
index 8331784954..241787135e 100644
--- a/src/packet_analysis/Analyzer.h
+++ b/src/packet_analysis/Analyzer.h
@@ -63,21 +63,6 @@ public:
*/
bool IsAnalyzer(const char* name);
- /**
- * Registers an analyzer to be dispatched for the given identifier.
- *
- * @param identifier The identifier an analyzer should be called for.
- * @param analyzer The analyzer that should be called.
- */
- void RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer);
-
- /**
- * Registers a default analyzer.
- *
- * @param default_analyzer The analyzer to use as default.
- */
- void RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer);
-
/**
* Analyzes the given packet. A common case is that the analyzed protocol
* encapsulates another protocol, which can be determined by an identifier
@@ -119,6 +104,15 @@ protected:
*/
AnalyzerPtr LoadAnalyzer(const std::string& name);
+ /**
+ * Returns the module name corresponding to the analyzer, i.e. its script-land
+ * namespace. Configuration values for the analyzer are expected in this module.
+ * @return Analyzer's module name.
+ */
+ std::string GetModuleName() const {
+ return util::fmt("PacketAnalyzer::%s::", GetAnalyzerName());
+ };
+
/**
* Triggers analysis of the encapsulated packet. The encapsulated protocol
* is determined using the given identifier.
diff --git a/src/packet_analysis/Manager.cc b/src/packet_analysis/Manager.cc
index 5a7251d8ad..62574e7f8f 100644
--- a/src/packet_analysis/Manager.cc
+++ b/src/packet_analysis/Manager.cc
@@ -21,48 +21,6 @@ void Manager::InitPostScript()
analyzers.emplace(analyzerComponent->Name(), newAnalyzer);
}
- // Read in analyzer map and create dispatchers
- auto& analyzer_mapping = zeek::id::find("PacketAnalyzer::config_map");
- if ( ! analyzer_mapping )
- return;
-
- auto mapping_val = analyzer_mapping->GetVal()->AsVectorVal();
- if ( mapping_val->Size() == 0 )
- return;
-
- for ( unsigned int i = 0; i < mapping_val->Size(); i++ )
- {
- auto* rv = mapping_val->At(i)->AsRecordVal();
- //TODO: Make that field a string for usability reasons
- //TODO: Check error handling when fields are omitted
- auto& parent_val = rv->GetField("parent");
- std::string parent_name = Lookup(parent_val->AsEnumVal())->Name();
- auto& identifier_val = rv->GetField("identifier");
- auto analyzer_tag = rv->GetField("analyzer")->AsEnumVal();
- auto analyzer_name = Lookup(analyzer_tag)->Name();
-
- auto analyzer_it = analyzers.find(analyzer_name);
- if ( analyzer_it == analyzers.end() )
- {
- reporter->InternalWarning("Mapped analyzer %s not found.", analyzer_name.c_str());
- continue;
- }
- auto& analyzer = analyzer_it->second;
-
- auto parent_analyzer_it = analyzers.find(parent_name);
- if ( parent_analyzer_it == analyzers.end() )
- {
- reporter->InternalWarning("Parent analyzer %s not found.", parent_name.c_str());
- continue;
- }
- auto& parent_analyzer = parent_analyzer_it->second;
-
- if ( identifier_val )
- parent_analyzer->RegisterAnalyzerMapping(identifier_val->AsCount(), analyzer);
- else
- parent_analyzer->RegisterDefaultAnalyzer(analyzer);
- }
-
// Initialize all analyzers
for ( auto& [name, analyzer] : analyzers )
analyzer->Initialize();
@@ -79,12 +37,11 @@ void Manager::DumpDebug()
#ifdef DEBUG
DBG_LOG(DBG_PACKET_ANALYSIS, "Available packet analyzers after zeek_init():");
for ( auto& current : GetComponents() )
- {
DBG_LOG(DBG_PACKET_ANALYSIS, " %s", current->Name().c_str());
- }
- DBG_LOG(DBG_PACKET_ANALYSIS, "Root dispatcher:");
- root_analyzer->DumpDebug();
+ DBG_LOG(DBG_PACKET_ANALYSIS, "Packet analyzer debug information:");
+ for ( auto& [name, analyzer] : analyzers )
+ analyzer->DumpDebug();
#endif
}
diff --git a/src/packet_analysis/protocol/ethernet/Ethernet.cc b/src/packet_analysis/protocol/ethernet/Ethernet.cc
index 998eb3498f..68dd5b935f 100644
--- a/src/packet_analysis/protocol/ethernet/Ethernet.cc
+++ b/src/packet_analysis/protocol/ethernet/Ethernet.cc
@@ -15,9 +15,9 @@ void EthernetAnalyzer::Initialize()
{
Analyzer::Initialize();
- SNAPAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::snap_analyzer");
- NovellRawAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::novell_raw_analyzer");
- LLCAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::llc_analyzer");
+ SNAPAnalyzer = LoadAnalyzer("snap_analyzer");
+ NovellRawAnalyzer = LoadAnalyzer("novell_raw_analyzer");
+ LLCAnalyzer = LoadAnalyzer("llc_analyzer");
}
bool EthernetAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
index 23a92ba95e..8af64df840 100644
--- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
-#open 2020-09-01-11-19-11
+#open 2020-09-08-08-14-03
#fields name
#types string
scripts/base/init-bare.zeek
@@ -20,6 +20,8 @@ scripts/base/init-bare.zeek
build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
build/scripts/base/bif/event.bif.zeek
scripts/base/packet-protocols/__load__.zeek
+ scripts/base/packet-protocols/root/__load__.zeek
+ scripts/base/packet-protocols/root/main.zeek
scripts/base/packet-protocols/ip/__load__.zeek
scripts/base/packet-protocols/ip/main.zeek
scripts/base/packet-protocols/skip/__load__.zeek
@@ -214,4 +216,4 @@ scripts/base/init-frameworks-and-bifs.zeek
build/scripts/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
scripts/policy/misc/loaded-scripts.zeek
scripts/base/utils/paths.zeek
-#close 2020-09-01-11-19-11
+#close 2020-09-08-08-14-03
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index f45aefe579..c38a701e86 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
-#open 2020-09-22-17-11-19
+#open 2020-09-22-17-14-48
#fields name
#types string
scripts/base/init-bare.zeek
@@ -20,6 +20,8 @@ scripts/base/init-bare.zeek
build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
build/scripts/base/bif/event.bif.zeek
scripts/base/packet-protocols/__load__.zeek
+ scripts/base/packet-protocols/root/__load__.zeek
+ scripts/base/packet-protocols/root/main.zeek
scripts/base/packet-protocols/ip/__load__.zeek
scripts/base/packet-protocols/ip/main.zeek
scripts/base/packet-protocols/skip/__load__.zeek
@@ -410,4 +412,4 @@ scripts/base/init-default.zeek
scripts/base/misc/find-filtered-trace.zeek
scripts/base/misc/version.zeek
scripts/policy/misc/loaded-scripts.zeek
-#close 2020-09-22-17-11-19
+#close 2020-09-22-17-14-48
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index d6524ea28e..1dec4d4ae8 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -283,7 +283,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) ->
@@ -464,7 +464,7 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) ->
0.000000 MetaHookPost CallFunction(NetControl::init, , ()) ->
0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) ->
@@ -894,6 +894,7 @@
0.000000 MetaHookPost LoadFile(0, base<...>/reporter) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/reporter.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/rfb) -> -1
+0.000000 MetaHookPost LoadFile(0, base<...>/root) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/signatures) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/sip) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/site.zeek) -> -1
@@ -1227,7 +1228,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG))
@@ -1408,7 +1409,7 @@
0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ())
0.000000 MetaHookPre CallFunction(NetControl::init, , ())
0.000000 MetaHookPre CallFunction(Notice::want_pp, , ())
@@ -1838,6 +1839,7 @@
0.000000 MetaHookPre LoadFile(0, base<...>/reporter)
0.000000 MetaHookPre LoadFile(0, base<...>/reporter.bif.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/rfb)
+0.000000 MetaHookPre LoadFile(0, base<...>/root)
0.000000 MetaHookPre LoadFile(0, base<...>/signatures)
0.000000 MetaHookPre LoadFile(0, base<...>/sip)
0.000000 MetaHookPre LoadFile(0, base<...>/site.zeek)
@@ -2170,7 +2172,7 @@
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
@@ -2351,7 +2353,7 @@
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction NetControl::check_plugins()
0.000000 | HookCallFunction NetControl::init()
0.000000 | HookCallFunction Notice::want_pp()
@@ -2793,6 +2795,7 @@
0.000000 | HookLoadFile base<...>/reporter
0.000000 | HookLoadFile base<...>/reporter.bif.zeek
0.000000 | HookLoadFile base<...>/rfb
+0.000000 | HookLoadFile base<...>/root
0.000000 | HookLoadFile base<...>/signatures
0.000000 | HookLoadFile base<...>/sip
0.000000 | HookLoadFile base<...>/site.zeek
@@ -2825,7 +2828,7 @@
0.000000 | HookLoadFile base<...>/xmpp
0.000000 | HookLoadFile base<...>/zeek.bif.zeek
0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
-0.000000 | HookLogWrite packet_filter [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]
+0.000000 | HookLogWrite packet_filter [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]
0.000000 | HookQueueEvent NetControl::init()
0.000000 | HookQueueEvent filter_change_tracking()
0.000000 | HookQueueEvent zeek_init()
diff --git a/testing/btest/Baseline/plugins.packet-protocol/output_build b/testing/btest/Baseline/plugins.packet-protocol/output_build
index 9762ab88f0..a5aa53185b 100644
--- a/testing/btest/Baseline/plugins.packet-protocol/output_build
+++ b/testing/btest/Baseline/plugins.packet-protocol/output_build
@@ -1,6 +1,6 @@
PacketDemo::Bar - Demo packet analyzers (RawLayer, LLC). (dynamic, version 1.0.0)
- [Packet Analyzer] LLCDemo (ANALYZER_LLCDEMO)
- [Packet Analyzer] RawLayer (ANALYZER_RAWLAYER)
+ [Packet Analyzer] LLC_Demo (ANALYZER_LLC_DEMO)
+ [Packet Analyzer] Raw_Layer (ANALYZER_RAW_LAYER)
[Event] raw_layer_message
[Event] llc_demo_message
diff --git a/testing/btest/core/skip_analyzer.zeek b/testing/btest/core/skip_analyzer.zeek
index 9a152a9d4c..62652d0373 100644
--- a/testing/btest/core/skip_analyzer.zeek
+++ b/testing/btest/core/skip_analyzer.zeek
@@ -7,8 +7,8 @@
@load base/protocols/conn
@load base/frameworks/tunnels
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=1, $analyzer=PacketAnalyzer::ANALYZER_SKIP)
+redef PacketAnalyzer::ROOT::dispatch_map += {
+ [1] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_SKIP)
};
redef PacketAnalyzer::SKIP::skip_bytes: count = 38;
diff --git a/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/LLCDemo/base/main.zeek b/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/LLCDemo/base/main.zeek
index 46f5dba9f7..6269c4ff99 100644
--- a/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/LLCDemo/base/main.zeek
+++ b/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/LLCDemo/base/main.zeek
@@ -1,3 +1,3 @@
-module Packet_LLC_Demo;
+module PacketAnalyzer::LLC_DEMO;
-redef PacketAnalyzer::Ethernet::llc_analyzer = PacketAnalyzer::ANALYZER_LLCDEMO;
\ No newline at end of file
+redef PacketAnalyzer::ETHERNET::llc_analyzer = PacketAnalyzer::ANALYZER_LLC_DEMO;
\ No newline at end of file
diff --git a/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/RawLayer/base/main.zeek b/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/RawLayer/base/main.zeek
index b8c567836a..be32149e59 100644
--- a/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/RawLayer/base/main.zeek
+++ b/testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/RawLayer/base/main.zeek
@@ -1,6 +1,14 @@
-module Packet_Raw_Layer;
+module PacketAnalyzer::RAW_LAYER;
-redef PacketAnalyzer::config_map += {
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x88B5, $analyzer=PacketAnalyzer::ANALYZER_RAWLAYER),
- PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_RAWLAYER, $identifier=0x4950, $analyzer=PacketAnalyzer::ANALYZER_IP)
+export {
+ ## Identifier mapping
+ const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef PacketAnalyzer::ETHERNET::dispatch_map += {
+ [0x88B5] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_RAW_LAYER)
+};
+
+redef dispatch_map += {
+ [0x4950] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IP)
};
diff --git a/testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc b/testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc
index 391a2811f9..f8bc8be53f 100644
--- a/testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc
+++ b/testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc
@@ -6,7 +6,7 @@
using namespace zeek::packet_analysis::PacketDemo;
LLCDemo::LLCDemo()
- : zeek::packet_analysis::Analyzer("LLCDemo")
+ : zeek::packet_analysis::Analyzer("LLC_Demo")
{
}
diff --git a/testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc b/testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc
index 55a814a150..af88a438fa 100644
--- a/testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc
@@ -10,9 +10,9 @@ class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure()
{
- AddComponent(new zeek::packet_analysis::Component("RawLayer",
+ AddComponent(new zeek::packet_analysis::Component("Raw_Layer",
zeek::packet_analysis::PacketDemo::RawLayer::Instantiate));
- AddComponent(new zeek::packet_analysis::Component("LLCDemo",
+ AddComponent(new zeek::packet_analysis::Component("LLC_Demo",
zeek::packet_analysis::PacketDemo::LLCDemo::Instantiate));
zeek::plugin::Configuration config;
diff --git a/testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc b/testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc
index 800879b2bc..a1bb9af237 100644
--- a/testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc
+++ b/testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc
@@ -6,7 +6,7 @@
using namespace zeek::packet_analysis::PacketDemo;
RawLayer::RawLayer()
- : zeek::packet_analysis::Analyzer("RawLayer")
+ : zeek::packet_analysis::Analyzer("Raw_Layer")
{
}