Simplify packet analyzer config.

scripts/base/init-bare.zeek

@@ -5340,28 +5340,16 @@ event net_done(t: time)
 
 module PacketAnalyzer;
 
-## Defines a mapping for the PacketAnalyzer's configuration tree. This
-## maps from a parent analyzer to a child analyzer through a numeric
-## identifier.
 export {
-    type ConfigEntry : record {
+	type DispatchEntry : record {
-        ## The parent analyzer. This analyzer will check for the *identifier* in the
+		## The analyzer to dispatch.
-        ## packet data to know whether to call the next analyzer. This field is optional.
+		analyzer : PacketAnalyzer::Tag;
-        ## If it is not included, the identifier will attach to the "root" analyzer. The
+	};
-        ## root analyzer uses the link layer identifier provided by the packet source to
-        ## determine the protocol for the initial packet header.
-        parent : PacketAnalyzer::Tag;
 
-        ## A numeric identifier, which can be found in the packet data, that denotes the
+	## A packet analyzer may extract a numeric identifier, which can be found in the
-        ## encapsulated protocol. This field is optional. If it is not included, the
+	## packet data and denotes the encapsulated protocol. A DispatchMap allows to map
-        ## configured child analyzer will be used as default analyzer.
+	## the identifier to a child analyzer, which is defined using a DispatchEntry.
-        identifier : count;
+	type DispatchMap : table[count] of DispatchEntry;
-
-        ## The analyzer that corresponds to the above identifier.
-        analyzer : PacketAnalyzer::Tag;
-    };
-
-    const config_map : vector of PacketAnalyzer::ConfigEntry &redef;
 }
 
 @load base/packet-protocols

scripts/base/packet-protocols/ethernet/main.zeek

@@ -10,19 +10,19 @@ export {
 	const novell_raw_analyzer: PacketAnalyzer::Tag &redef;
 	## IEEE 802.2 LLC analyzer
 	const llc_analyzer: PacketAnalyzer::Tag &redef;
+
+	## Identifier mappings based on EtherType
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
 }
 
-const DLT_EN10MB : count = 1;
+redef dispatch_map += {
-
+	[0x8847] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
-redef PacketAnalyzer::config_map += {
+	[0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_EN10MB, $analyzer=PacketAnalyzer::ANALYZER_ETHERNET),
+	[0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8847, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
+	[0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+	[0x8100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+	[0x88A8] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+	[0x9100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
+	[0x8864] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPOE)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x88A8, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x9100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE),
 };

scripts/base/packet-protocols/fddi/main.zeek

@@ -4,9 +4,3 @@ export {
 	## Default analyzer
 	const default_analyzer: PacketAnalyzer::Tag = PacketAnalyzer::ANALYZER_IP &redef;
 }
-
-const DLT_FDDI : count = 10;
-
-redef PacketAnalyzer::config_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_FDDI, $analyzer=PacketAnalyzer::ANALYZER_FDDI),
-};

scripts/base/packet-protocols/ieee802_11/main.zeek

@@ -1,11 +1,13 @@
 module PacketAnalyzer::IEEE802_11;
 
-const DLT_IEEE802_11 : count = 105;
+export {
+	## Identifier mappings based on EtherType
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
 
-redef PacketAnalyzer::config_map += {
+redef dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_IEEE802_11, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11),
+	[0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+	[0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+	[0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP)
 };

scripts/base/packet-protocols/ieee802_11_radio/main.zeek

@@ -1,9 +1,12 @@
 module PacketAnalyzer::IEEE802_11_RADIO;
 
-const DLT_IEEE802_11_RADIO : count = 127;
+export {
+	## Identifier mappings
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
 const DLT_IEEE802_11 : count = 105;
 
-redef PacketAnalyzer::config_map += {
+redef dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_IEEE802_11_RADIO, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO),
+	[DLT_IEEE802_11] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO, $identifier=DLT_IEEE802_11, $analyzer=PacketAnalyzer::ANALYZER_IEEE802_11)
 };

scripts/base/packet-protocols/ip/main.zeek

@@ -1,6 +1,11 @@
 module PacketAnalyzer::IP;
 
-redef PacketAnalyzer::config_map += {
+export {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IP, $identifier=4, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	## Identifier mappings based on IP version (4 or 6)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_IP, $identifier=6, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef dispatch_map += {
+	[4] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[6] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
 };

scripts/base/packet-protocols/linux_sll/main.zeek

@@ -1,12 +1,14 @@
-module PacketAnalyzer::LINUX_SLL;
+module PacketAnalyzer::LINUXSLL;
 
-const DLT_LINUX_SLL : count = 113;
+export {
+	## Identifier mappings based on EtherType
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
 
-redef PacketAnalyzer::config_map += {
+redef dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_LINUX_SLL, $analyzer=PacketAnalyzer::ANALYZER_LINUXSLL),
+	[0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+	[0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
 	# RARP
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_LINUXSLL, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP)
+	[0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP)
 };

scripts/base/packet-protocols/nflog/main.zeek

@@ -1,11 +1,14 @@
 module PacketAnalyzer::NFLOG;
 
-const DLT_NFLOG : count = 239;
+export {
+	## Identifier mappings
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
 const AF_INET : count = 2;
 const AF_INET6 : count = 10;
 
-redef PacketAnalyzer::config_map += {
+redef dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_NFLOG, $analyzer=PacketAnalyzer::ANALYZER_NFLOG),
+	[AF_INET] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NFLOG, $identifier=AF_INET, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[AF_INET6] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NFLOG, $identifier=AF_INET6, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
 };

scripts/base/packet-protocols/null/main.zeek

@@ -1,19 +1,25 @@
 module PacketAnalyzer::NULL;
 
-const DLT_NULL : count = 0;
+export {
-const AF_INET : count = 2;
+	## Identifier mappings
-const AF_INET6 : count = 10;
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
 
-redef PacketAnalyzer::config_map += {
+const DLT_NULL : count = 0;
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_NULL, $analyzer=PacketAnalyzer::ANALYZER_NULL),
+
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=AF_INET, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+redef PacketAnalyzer::ROOT::dispatch_map += {
+	[DLT_NULL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_NULL)
+};
+
+redef dispatch_map += {
+	[2] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
 	
 	## From the Wireshark Wiki: AF_INET6ANALYZER, unfortunately, has different values in
 	## {NetBSD,OpenBSD,BSD/OS}, {FreeBSD,DragonFlyBSD}, and {Darwin/Mac OS X}, so an IPv6
 	## packet might have a link-layer header with 24, 28, or 30 as the AF_ value. As we
 	## may be reading traces captured on platforms other than what we're running on, we
 	## accept them all here.
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=24, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+	[24] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=28, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+	[28] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_NULL, $identifier=30, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+	[30] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
 };

scripts/base/packet-protocols/ppp_serial/main.zeek

@@ -1,10 +1,18 @@
 module PacketAnalyzer::PPP_SERIAL;
 
+export {
+	## Identifier mappings
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
 const DLT_PPP_SERIAL : count = 50;
 
-redef PacketAnalyzer::config_map += {
+redef PacketAnalyzer::ROOT::dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=DLT_PPP_SERIAL, $analyzer=PacketAnalyzer::ANALYZER_PPPSERIAL),
+	[DLT_PPP_SERIAL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPSERIAL)
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0281, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
+};
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0021, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPSERIAL, $identifier=0x0057, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+redef dispatch_map += {
+	[0x0281] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
+	[0x0021] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[0x0057] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
 };

scripts/base/packet-protocols/pppoe/main.zeek

@@ -1,6 +1,11 @@
 module PacketAnalyzer::PPPOE;
 
-redef PacketAnalyzer::config_map += {
+export {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPOE, $identifier=0x0021, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	## Identifier mappings
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_PPPOE, $identifier=0x0057, $analyzer=PacketAnalyzer::ANALYZER_IPV6)
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef dispatch_map += {
+	[0x0021] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	[0x0057] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6)
 };

scripts/base/packet-protocols/root/main.zeek

@@ -3,4 +3,24 @@ module PacketAnalyzer::ROOT;
 export {
 	## Default analyzer (if we don't know the link type, we assume raw IP)
 	const default_analyzer: PacketAnalyzer::Tag = PacketAnalyzer::ANALYZER_IP &redef;
+
+	## Identifier mappings based on link type
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
 }
+
+const DLT_EN10MB : count = 1;
+const DLT_FDDI : count = 10;
+const DLT_IEEE802_11 : count = 105;
+const DLT_IEEE802_11_RADIO : count = 127;
+const DLT_LINUX_SLL : count = 113;
+const DLT_NFLOG : count = 239;
+
+redef dispatch_map += {
+	[DLT_EN10MB] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ETHERNET),
+	[DLT_FDDI] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_FDDI),
+	[DLT_IEEE802_11] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11),
+	[DLT_IEEE802_11_RADIO] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IEEE802_11_RADIO),
+	[DLT_LINUX_SLL] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_LINUXSLL),
+	[DLT_NFLOG] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_NFLOG)
+
+};

scripts/base/packet-protocols/vlan/main.zeek

@@ -1,11 +1,16 @@
 module PacketAnalyzer::VLAN;
 
-redef PacketAnalyzer::config_map += {
+export {
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8847, $analyzer=PacketAnalyzer::ANALYZER_MPLS),
+	## Identifier mappings based on EtherType
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x0800, $analyzer=PacketAnalyzer::ANALYZER_IPV4),
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x86DD, $analyzer=PacketAnalyzer::ANALYZER_IPV6),
+}
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x0806, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8035, $analyzer=PacketAnalyzer::ANALYZER_ARP),
+redef dispatch_map += {
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8100, $analyzer=PacketAnalyzer::ANALYZER_VLAN),
+   [0x8847] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_MPLS),
-   PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_VLAN, $identifier=0x8864, $analyzer=PacketAnalyzer::ANALYZER_PPPOE)
+   [0x0800] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV4),
+   [0x86DD] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IPV6),
+   [0x0806] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+   [0x8035] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_ARP),
+   [0x8100] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_VLAN),
+   [0x8864] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_PPPOE)
 };

src/DebugLogger.h

@@ -30,26 +30,26 @@ namespace zeek {
 // an entry to DebugLogger::streams in DebugLogger.cc.
 
 enum DebugStream {
-	DBG_SERIAL,     // Serialization
+	DBG_SERIAL,		// Serialization
-	DBG_RULES,      // Signature matching
+	DBG_RULES,		// Signature matching
-	DBG_STRING,     // String code
+	DBG_STRING,		// String code
-	DBG_NOTIFIERS,  // Notifiers
+	DBG_NOTIFIERS,	// Notifiers
-	DBG_MAINLOOP,   // Main IOSource loop
+	DBG_MAINLOOP,	// Main IOSource loop
-	DBG_ANALYZER,   // Analyzer framework
+	DBG_ANALYZER,	// Analyzer framework
-	DBG_PACKET_ANALYSIS,  // Packet analysis
+	DBG_PACKET_ANALYSIS,	// Packet analysis
-	DBG_FILE_ANALYSIS,    // File analysis
+	DBG_FILE_ANALYSIS,		// File analysis
-	DBG_TM,         // Time-machine packet input via Brocolli
+	DBG_TM,			// Time-machine packet input via Brocolli
-	DBG_LOGGING,    // Logging streams
+	DBG_LOGGING,	// Logging streams
-	DBG_INPUT,      // Input streams
+	DBG_INPUT,		// Input streams
-	DBG_THREADING,  // Threading system
+	DBG_THREADING,	// Threading system
-	DBG_PLUGINS,    // Plugin system
+	DBG_PLUGINS,	// Plugin system
-	DBG_ZEEKYGEN,   // Zeekygen
+	DBG_ZEEKYGEN,	// Zeekygen
-	DBG_PKTIO,      // Packet sources and dumpers.
+	DBG_PKTIO,		// Packet sources and dumpers.
-	DBG_BROKER,     // Broker communication
+	DBG_BROKER,		// Broker communication
-	DBG_SCRIPTS,    // Script initialization
+	DBG_SCRIPTS,	// Script initialization
-	DBG_SUPERVISOR, // Process supervisor
+	DBG_SUPERVISOR,	// Process supervisor
 
-	NUM_DBGS // Has to be last
+	NUM_DBGS	// Has to be last
 };
 
 namespace detail {

src/packet_analysis/Analyzer.cc

@@ -29,14 +29,37 @@ void Analyzer::Init(const Tag& _tag)
 
 void Analyzer::Initialize()
 	{
-	std::string ns = util::fmt("PacketAnalyzer::%s::", GetAnalyzerName());
+	default_analyzer = LoadAnalyzer("default_analyzer");
 
-	default_analyzer = LoadAnalyzer(ns +"default_analyzer");
+	// Create dispatcher based on configuration
+	auto& mapping_id = zeek::id::find(GetModuleName() + "dispatch_map");
+	if ( ! mapping_id )
+		return;
+
+	auto mapping_val = mapping_id->GetVal()->AsTableVal();
+	auto mapping_tbl = mapping_val->AsTable();
+	auto c = mapping_tbl->InitForIteration();
+
+	zeek::detail::HashKey* k = nullptr;
+	TableEntryVal* v;
+	while ( (v = mapping_tbl->NextEntry(k, c)) )
+		{
+		auto key = mapping_val->RecreateIndex(*k);
+		delete k;
+
+		auto identifier = key->Idx(0)->AsCount();
+		auto config_entry_val = v->GetVal()->AsRecordVal();
+
+		auto mapped_tag = config_entry_val->GetField("analyzer")->AsEnumVal();
+		auto mapped_analyzer = packet_mgr->GetAnalyzer(mapped_tag);
+
+		dispatcher.Register(identifier, std::move(mapped_analyzer));
+		}
 	}
 
 zeek::packet_analysis::AnalyzerPtr Analyzer::LoadAnalyzer(const std::string &name)
 	{
-	auto& analyzer = zeek::id::find(name);
+	auto& analyzer = zeek::id::find(GetModuleName() + name);
 	if ( ! analyzer )
 		return nullptr;
 
@@ -65,16 +88,6 @@ bool Analyzer::IsAnalyzer(const char* name)
 	return packet_mgr->GetComponentName(tag) == name;
 	}
 
-void Analyzer::RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer)
-	{
-	dispatcher.Register(identifier, std::move(analyzer));
-	}
-
-void Analyzer::RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer)
-	{
-	this->default_analyzer = std::move(default_analyzer);
-	}
-
 AnalyzerPtr Analyzer::Lookup(uint32_t identifier) const
 	{
 	return dispatcher.Lookup(identifier);
@@ -114,7 +127,7 @@ bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet) co
 void Analyzer::DumpDebug() const
 	{
 #ifdef DEBUG
-	DBG_LOG(DBG_PACKET_ANALYSIS, "Debug info for %s", this->GetAnalyzerName());
+	DBG_LOG(DBG_PACKET_ANALYSIS, "Dispatcher for %s", this->GetAnalyzerName());
 	dispatcher.DumpDebug();
 #endif
 	}

src/packet_analysis/Analyzer.h

@@ -63,21 +63,6 @@ public:
 	 */
 	bool IsAnalyzer(const char* name);
 
-	/**
-	 * Registers an analyzer to be dispatched for the given identifier.
-	 *
-	 * @param identifier The identifier an analyzer should be called for.
-	 * @param analyzer The analyzer that should be called.
-	 */
-	void RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer);
-
-	/**
-	 * Registers a default analyzer.
-	 *
-	 * @param default_analyzer The analyzer to use as default.
-	 */
-	void RegisterDefaultAnalyzer(AnalyzerPtr default_analyzer);
-
 	/**
 	 * Analyzes the given packet. A common case is that the analyzed protocol
 	 * encapsulates another protocol, which can be determined by an identifier
@@ -119,6 +104,15 @@ protected:
 	 */
 	AnalyzerPtr LoadAnalyzer(const std::string& name);
 
+	/**
+	 * Returns the module name corresponding to the analyzer, i.e. its script-land
+	 * namespace. Configuration values for the analyzer are expected in this module.
+	 * @return Analyzer's module name.
+	 */
+	std::string GetModuleName() const {
+		return util::fmt("PacketAnalyzer::%s::", GetAnalyzerName());
+	};
+
 	/**
 	 * Triggers analysis of the encapsulated packet. The encapsulated protocol
 	 * is determined using the given identifier.

src/packet_analysis/Manager.cc

@@ -21,48 +21,6 @@ void Manager::InitPostScript()
 			analyzers.emplace(analyzerComponent->Name(), newAnalyzer);
 		}
 
-	// Read in analyzer map and create dispatchers
-	auto& analyzer_mapping = zeek::id::find("PacketAnalyzer::config_map");
-	if ( ! analyzer_mapping )
-		return;
-
-	auto mapping_val = analyzer_mapping->GetVal()->AsVectorVal();
-	if ( mapping_val->Size() == 0 )
-		return;
-
-	for ( unsigned int i = 0; i < mapping_val->Size(); i++ )
-		{
-		auto* rv = mapping_val->At(i)->AsRecordVal();
-		//TODO: Make that field a string for usability reasons
-		//TODO: Check error handling when fields are omitted
-		auto& parent_val = rv->GetField("parent");
-		std::string parent_name = Lookup(parent_val->AsEnumVal())->Name();
-		auto& identifier_val = rv->GetField("identifier");
-		auto analyzer_tag = rv->GetField("analyzer")->AsEnumVal();
-		auto analyzer_name = Lookup(analyzer_tag)->Name();
-
-		auto analyzer_it = analyzers.find(analyzer_name);
-		if ( analyzer_it == analyzers.end() )
-			{
-			reporter->InternalWarning("Mapped analyzer %s not found.", analyzer_name.c_str());
-			continue;
-			}
-		auto& analyzer = analyzer_it->second;
-
-		auto parent_analyzer_it = analyzers.find(parent_name);
-		if ( parent_analyzer_it == analyzers.end() )
-			{
-			reporter->InternalWarning("Parent analyzer %s not found.", parent_name.c_str());
-			continue;
-			}
-		auto& parent_analyzer = parent_analyzer_it->second;
-
-		if ( identifier_val )
-			parent_analyzer->RegisterAnalyzerMapping(identifier_val->AsCount(), analyzer);
-		else
-			parent_analyzer->RegisterDefaultAnalyzer(analyzer);
-		}
-
 	// Initialize all analyzers
 	for ( auto& [name, analyzer] : analyzers )
 		analyzer->Initialize();
@@ -79,12 +37,11 @@ void Manager::DumpDebug()
 #ifdef DEBUG
 	DBG_LOG(DBG_PACKET_ANALYSIS, "Available packet analyzers after zeek_init():");
 	for ( auto& current : GetComponents() )
-		{
 		DBG_LOG(DBG_PACKET_ANALYSIS, "    %s", current->Name().c_str());
-		}
 
-	DBG_LOG(DBG_PACKET_ANALYSIS, "Root dispatcher:");
+	DBG_LOG(DBG_PACKET_ANALYSIS, "Packet analyzer debug information:");
-	root_analyzer->DumpDebug();
+	for ( auto& [name, analyzer] : analyzers )
+		analyzer->DumpDebug();
 #endif
 	}
 

src/packet_analysis/protocol/ethernet/Ethernet.cc

@@ -15,9 +15,9 @@ void EthernetAnalyzer::Initialize()
 	{
 	Analyzer::Initialize();
 
-	SNAPAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::snap_analyzer");
+	SNAPAnalyzer = LoadAnalyzer("snap_analyzer");
-	NovellRawAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::novell_raw_analyzer");
+	NovellRawAnalyzer = LoadAnalyzer("novell_raw_analyzer");
-	LLCAnalyzer = LoadAnalyzer("PacketAnalyzer::Ethernet::llc_analyzer");
+	LLCAnalyzer = LoadAnalyzer("llc_analyzer");
 	}
 
 bool EthernetAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)

testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log

@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2020-09-01-11-19-11
+#open	2020-09-08-08-14-03
 #fields	name
 #types	string
 scripts/base/init-bare.zeek
@@ -20,6 +20,8 @@ scripts/base/init-bare.zeek
   build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
   build/scripts/base/bif/event.bif.zeek
   scripts/base/packet-protocols/__load__.zeek
+    scripts/base/packet-protocols/root/__load__.zeek
+      scripts/base/packet-protocols/root/main.zeek
     scripts/base/packet-protocols/ip/__load__.zeek
       scripts/base/packet-protocols/ip/main.zeek
     scripts/base/packet-protocols/skip/__load__.zeek
@@ -214,4 +216,4 @@ scripts/base/init-frameworks-and-bifs.zeek
     build/scripts/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
 scripts/policy/misc/loaded-scripts.zeek
   scripts/base/utils/paths.zeek
-#close	2020-09-01-11-19-11
+#close	2020-09-08-08-14-03

testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log

@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2020-09-22-17-11-19
+#open	2020-09-22-17-14-48
 #fields	name
 #types	string
 scripts/base/init-bare.zeek
@@ -20,6 +20,8 @@ scripts/base/init-bare.zeek
   build/scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek
   build/scripts/base/bif/event.bif.zeek
   scripts/base/packet-protocols/__load__.zeek
+    scripts/base/packet-protocols/root/__load__.zeek
+      scripts/base/packet-protocols/root/main.zeek
     scripts/base/packet-protocols/ip/__load__.zeek
       scripts/base/packet-protocols/ip/main.zeek
     scripts/base/packet-protocols/skip/__load__.zeek
@@ -410,4 +412,4 @@ scripts/base/init-default.zeek
   scripts/base/misc/find-filtered-trace.zeek
   scripts/base/misc/version.zeek
 scripts/policy/misc/loaded-scripts.zeek
-#close	2020-09-22-17-11-19
+#close	2020-09-22-17-14-48

testing/btest/Baseline/plugins.hooks/output

@@ -283,7 +283,7 @@
 0.000000   MetaHookPost  CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
-0.000000   MetaHookPost  CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
+0.000000   MetaHookPost  CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::add_default_filter, <frame>, (Config::LOG)) -> <no result>
@@ -464,7 +464,7 @@
 0.000000   MetaHookPost  CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
 0.000000   MetaHookPost  CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
-0.000000   MetaHookPost  CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
+0.000000   MetaHookPost  CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
 0.000000   MetaHookPost  CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
 0.000000   MetaHookPost  CallFunction(NetControl::init, <null>, ()) -> <no result>
 0.000000   MetaHookPost  CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
@@ -894,6 +894,7 @@
 0.000000   MetaHookPost  LoadFile(0, base<...>/reporter) -> -1
 0.000000   MetaHookPost  LoadFile(0, base<...>/reporter.bif.zeek) -> -1
 0.000000   MetaHookPost  LoadFile(0, base<...>/rfb) -> -1
+0.000000   MetaHookPost  LoadFile(0, base<...>/root) -> -1
 0.000000   MetaHookPost  LoadFile(0, base<...>/signatures) -> -1
 0.000000   MetaHookPost  LoadFile(0, base<...>/sip) -> -1
 0.000000   MetaHookPost  LoadFile(0, base<...>/site.zeek) -> -1
@@ -1227,7 +1228,7 @@
 0.000000   MetaHookPre   CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
 0.000000   MetaHookPre   CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
 0.000000   MetaHookPre   CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
-0.000000   MetaHookPre   CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]))
+0.000000   MetaHookPre   CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]))
 0.000000   MetaHookPre   CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
 0.000000   MetaHookPre   CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
 0.000000   MetaHookPre   CallFunction(Log::add_default_filter, <frame>, (Config::LOG))
@@ -1408,7 +1409,7 @@
 0.000000   MetaHookPre   CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
 0.000000   MetaHookPre   CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
 0.000000   MetaHookPre   CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
-0.000000   MetaHookPre   CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]))
+0.000000   MetaHookPre   CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]))
 0.000000   MetaHookPre   CallFunction(NetControl::check_plugins, <frame>, ())
 0.000000   MetaHookPre   CallFunction(NetControl::init, <null>, ())
 0.000000   MetaHookPre   CallFunction(Notice::want_pp, <frame>, ())
@@ -1838,6 +1839,7 @@
 0.000000   MetaHookPre   LoadFile(0, base<...>/reporter)
 0.000000   MetaHookPre   LoadFile(0, base<...>/reporter.bif.zeek)
 0.000000   MetaHookPre   LoadFile(0, base<...>/rfb)
+0.000000   MetaHookPre   LoadFile(0, base<...>/root)
 0.000000   MetaHookPre   LoadFile(0, base<...>/signatures)
 0.000000   MetaHookPre   LoadFile(0, base<...>/sip)
 0.000000   MetaHookPre   LoadFile(0, base<...>/site.zeek)
@@ -2170,7 +2172,7 @@
 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
 0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])
 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
 0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
@@ -2351,7 +2353,7 @@
 0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
 0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
 0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T])
 0.000000 | HookCallFunction NetControl::check_plugins()
 0.000000 | HookCallFunction NetControl::init()
 0.000000 | HookCallFunction Notice::want_pp()
@@ -2793,6 +2795,7 @@
 0.000000 | HookLoadFile  base<...>/reporter
 0.000000 | HookLoadFile  base<...>/reporter.bif.zeek
 0.000000 | HookLoadFile  base<...>/rfb
+0.000000 | HookLoadFile  base<...>/root
 0.000000 | HookLoadFile  base<...>/signatures
 0.000000 | HookLoadFile  base<...>/sip
 0.000000 | HookLoadFile  base<...>/site.zeek
@@ -2825,7 +2828,7 @@
 0.000000 | HookLoadFile  base<...>/xmpp
 0.000000 | HookLoadFile  base<...>/zeek.bif.zeek
 0.000000 | HookLogInit   packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
-0.000000 | HookLogWrite  packet_filter [ts=1600794672.656797, node=zeek, filter=ip or not ip, init=T, success=T]
+0.000000 | HookLogWrite  packet_filter [ts=1600794881.771065, node=zeek, filter=ip or not ip, init=T, success=T]
 0.000000 | HookQueueEvent NetControl::init()
 0.000000 | HookQueueEvent filter_change_tracking()
 0.000000 | HookQueueEvent zeek_init()

testing/btest/Baseline/plugins.packet-protocol/output_build

@@ -1,6 +1,6 @@
 PacketDemo::Bar - Demo packet analyzers (RawLayer, LLC). (dynamic, version 1.0.0)
-    [Packet Analyzer] LLCDemo (ANALYZER_LLCDEMO)
+    [Packet Analyzer] LLC_Demo (ANALYZER_LLC_DEMO)
-    [Packet Analyzer] RawLayer (ANALYZER_RAWLAYER)
+    [Packet Analyzer] Raw_Layer (ANALYZER_RAW_LAYER)
     [Event] raw_layer_message
     [Event] llc_demo_message
 

testing/btest/core/skip_analyzer.zeek

@@ -7,8 +7,8 @@
 @load base/protocols/conn
 @load base/frameworks/tunnels
 
-redef PacketAnalyzer::config_map += {
+redef PacketAnalyzer::ROOT::dispatch_map += {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ROOT, $identifier=1, $analyzer=PacketAnalyzer::ANALYZER_SKIP)
+	[1] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_SKIP)
 };
 
 redef PacketAnalyzer::SKIP::skip_bytes: count = 38;

testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/LLCDemo/base/main.zeek

@@ -1,3 +1,3 @@
-module Packet_LLC_Demo;
+module PacketAnalyzer::LLC_DEMO;
 
-redef PacketAnalyzer::Ethernet::llc_analyzer = PacketAnalyzer::ANALYZER_LLCDEMO;
+redef PacketAnalyzer::ETHERNET::llc_analyzer = PacketAnalyzer::ANALYZER_LLC_DEMO;

testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/RawLayer/base/main.zeek

@@ -1,6 +1,14 @@
-module Packet_Raw_Layer;
+module PacketAnalyzer::RAW_LAYER;
 
-redef PacketAnalyzer::config_map += {
+export {
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=0x88B5, $analyzer=PacketAnalyzer::ANALYZER_RAWLAYER),
+	## Identifier mapping
-	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_RAWLAYER, $identifier=0x4950, $analyzer=PacketAnalyzer::ANALYZER_IP)
+	const dispatch_map: PacketAnalyzer::DispatchMap = {} &redef;
+}
+
+redef PacketAnalyzer::ETHERNET::dispatch_map += {
+	[0x88B5] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_RAW_LAYER)
+};
+
+redef dispatch_map += {
+	[0x4950] = PacketAnalyzer::DispatchEntry($analyzer=PacketAnalyzer::ANALYZER_IP)
 };

testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc

@@ -6,7 +6,7 @@
 using namespace zeek::packet_analysis::PacketDemo;
 
 LLCDemo::LLCDemo()
-	: zeek::packet_analysis::Analyzer("LLCDemo")
+	: zeek::packet_analysis::Analyzer("LLC_Demo")
 	{
 	}
 

testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc

@@ -10,9 +10,9 @@ class Plugin : public zeek::plugin::Plugin {
 public:
 	zeek::plugin::Configuration Configure()
 		{
-		AddComponent(new zeek::packet_analysis::Component("RawLayer",
+		AddComponent(new zeek::packet_analysis::Component("Raw_Layer",
 		                 zeek::packet_analysis::PacketDemo::RawLayer::Instantiate));
-		AddComponent(new zeek::packet_analysis::Component("LLCDemo",
+		AddComponent(new zeek::packet_analysis::Component("LLC_Demo",
 		                 zeek::packet_analysis::PacketDemo::LLCDemo::Instantiate));
 
 		zeek::plugin::Configuration config;

testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc

@@ -6,7 +6,7 @@
 using namespace zeek::packet_analysis::PacketDemo;
 
 RawLayer::RawLayer()
-	: zeek::packet_analysis::Analyzer("RawLayer")
+	: zeek::packet_analysis::Analyzer("Raw_Layer")
 	{
 	}