Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Simplify packet analyzer config.

Browse source
This commit is contained in:
Jan Grashoefer 2020-09-07 20:46:14 +02:00 • committed by Tim Wojtulewicz
parent efa262a229
commit 7ede4f48bd
28 changed files with 233 additions and 213 deletions
Download patch file Download diff file Expand all files Collapse all files

28
scripts/base/init-bare.zeek
View file

@ -5340,28 +5340,16 @@ event net_done(t: time)
module PacketAnalyzer;
## Defines a mapping for the PacketAnalyzer's configuration tree. This
## maps from a parent analyzer to a child analyzer through a numeric
## identifier.
export {
type ConfigEntry : record {
## The parent analyzer. This analyzer will check for the *identifier* in the
## packet data to know whether to call the next analyzer. This field is optional.
## If it is not included, the identifier will attach to the "root" analyzer. The
## root analyzer uses the link layer identifier provided by the packet source to
## determine the protocol for the initial packet header.
parent : PacketAnalyzer::Tag;
type DispatchEntry : record {
## The analyzer to dispatch.
analyzer : PacketAnalyzer::Tag;
};
## A numeric identifier, which can be found in the packet data, that denotes the
## encapsulated protocol. This field is optional. If it is not included, the
## configured child analyzer will be used as default analyzer.
identifier : count;
## The analyzer that corresponds to the above identifier.
analyzer : PacketAnalyzer::Tag;
};
const config_map : vector of PacketAnalyzer::ConfigEntry &redef;
## A packet analyzer may extract a numeric identifier, which can be found in the
## packet data and denotes the encapsulated protocol. A DispatchMap allows to map
## the identifier to a child analyzer, which is defined using a DispatchEntry.
type DispatchMap : table[count] of DispatchEntry;
}
@load base/packet-protocols