mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Rename IPBasedTransportAnalyzer to SessionAdapter
This also also combines the old TransportLayerAnalyzer class into SessionAdapter, and removes the old class. This requires naming changes in a few places but no functionality changes.
This commit is contained in:
parent
c56fb3e8e4
commit
b22ce6848f
24 changed files with 340 additions and 329 deletions
102
src/packet_analysis/protocol/ip/SessionAdapter.h
Normal file
102
src/packet_analysis/protocol/ip/SessionAdapter.h
Normal file
|
@ -0,0 +1,102 @@
|
|||
#pragma once
|
||||
|
||||
#include "zeek/analyzer/Analyzer.h"
|
||||
|
||||
namespace zeek::analyzer::pia { class PIA; }
|
||||
|
||||
namespace zeek::packet_analysis::IP {
|
||||
|
||||
class IPBasedAnalyzer;
|
||||
|
||||
/**
|
||||
* This class represents the interface between the packet analysis framework and
|
||||
* the session analysis framework. One of these should be implemented for each
|
||||
* packet analyzer that intends to forward into the session analysis.
|
||||
*/
|
||||
class SessionAdapter : public analyzer::Analyzer {
|
||||
|
||||
public:
|
||||
|
||||
SessionAdapter(const char* name, Connection* conn)
|
||||
: analyzer::Analyzer(name, conn) { }
|
||||
|
||||
/**
|
||||
* Overridden from parent class.
|
||||
*/
|
||||
virtual void Done() override;
|
||||
|
||||
/**
|
||||
* Sets the parent packet analyzer for this session adapter. This can't be passed to
|
||||
* the constructor due to the way that SessionAdapter gets instantiated.
|
||||
*
|
||||
* @param p The parent packet analyzer to store
|
||||
*/
|
||||
void SetParent(IPBasedAnalyzer* p) { parent = p; }
|
||||
|
||||
/**
|
||||
* Returns true if the analyzer determines that in fact a new connection has started
|
||||
* without the connection statement having terminated the previous one, i.e., the new
|
||||
* data is arriving at what's the analyzer for the previous instance. This is used only
|
||||
* for TCP.
|
||||
*/
|
||||
virtual bool IsReuse(double t, const u_char* pkt);
|
||||
|
||||
/**
|
||||
* Pure virtual method to allow extra session analzyers to be added to this analyzer's
|
||||
* tree of children. This is used by analyzer::Manager when creating the session analyzer
|
||||
* tree.
|
||||
*/
|
||||
virtual void AddExtraAnalyzers(Connection* conn) = 0;
|
||||
|
||||
/**
|
||||
* Associates a file with the analyzer in which to record all
|
||||
* analyzed input. This must only be called with derived classes that
|
||||
* overide the method; the default implementation will abort.
|
||||
*
|
||||
* @param direction One of the CONTENTS_* constants indicating which
|
||||
* direction of the input stream is to be recorded.
|
||||
*
|
||||
* @param f The file to record to.
|
||||
*
|
||||
*/
|
||||
virtual void SetContentsFile(unsigned int direction, FilePtr f);
|
||||
|
||||
/**
|
||||
* Returns an associated contents file, if any. This must only be
|
||||
* called with derived classes that overide the method; the default
|
||||
* implementation will abort.
|
||||
*
|
||||
* @param direction One of the CONTENTS_* constants indicating which
|
||||
* direction the query is for.
|
||||
*/
|
||||
virtual FilePtr GetContentsFile(unsigned int direction) const;
|
||||
|
||||
/**
|
||||
* Associates a PIA with this analyzer. A PIA takes the
|
||||
* transport-layer input and determine which protocol analyzer(s) to
|
||||
* use for parsing it.
|
||||
*/
|
||||
void SetPIA(analyzer::pia::PIA* arg_PIA) { pia = arg_PIA; }
|
||||
|
||||
/**
|
||||
* Returns the associated PIA, or null of none. Does not take
|
||||
* ownership.
|
||||
*/
|
||||
analyzer::pia::PIA* GetPIA() const { return pia; }
|
||||
|
||||
/**
|
||||
* Helper to raise a \c packet_contents event.
|
||||
*
|
||||
* @param data The dass to pass to the event.
|
||||
*
|
||||
* @param len The length of \a data.
|
||||
*/
|
||||
void PacketContents(const u_char* data, int len);
|
||||
|
||||
protected:
|
||||
|
||||
IPBasedAnalyzer* parent;
|
||||
analyzer::pia::PIA* pia;
|
||||
};
|
||||
|
||||
} // namespace zeek::packet_analysis::IP
|
Loading…
Add table
Add a link
Reference in a new issue