Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1215: Remove dispatch_map from packet analysis, replace with BIF methods for registering dispatches

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-10-27 12:43:36 -07:00 • committed by Tim Wojtulewicz
parent 43821a8957
commit cd06bf34c7
34 changed files with 3770 additions and 3623 deletions
Download patch file Download diff file Expand all files Collapse all files

49
src/packet_analysis/packet_analysis.bif Normal file
View file

@ -0,0 +1,49 @@
module PacketAnalyzer;
%%{
#include "zeek/packet_analysis/Analyzer.h"
#include "zeek/packet_analysis/Manager.h"
%%}
## Add an entry to parent's dispatcher that maps a protocol/index to a next-stage child analyzer.
##
## parent: The parent analyzer being modified
## identifier: The identifier for the protocol being registered
## child: The analyzer that will be called for the identifier
##
function register_packet_analyzer%(parent: PacketAnalyzer::Tag, identifier: count, child: PacketAnalyzer::Tag%): bool
%{
packet_analysis::AnalyzerPtr parent_analyzer = packet_mgr->GetAnalyzer(parent->AsEnumVal());
if ( ! parent_analyzer )
return zeek::val_mgr->False();
packet_analysis::AnalyzerPtr child_analyzer = packet_mgr->GetAnalyzer(child->AsEnumVal());
if ( ! child_analyzer )
return zeek::val_mgr->False();
parent_analyzer->RegisterProtocol(identifier, child_analyzer);
return zeek::val_mgr->True();
%}
## Attempts to add an entry to `parent`'s dispatcher that maps a protocol/index to a next-stage `child` analyzer.
## This may fail if either of the two names does not respond to a known analyzer.
##
## parent: The parent analyzer being modified
## identifier: The identifier for the protocol being registered
## child: The analyzer that will be called for the identifier
##
function try_register_packet_analyzer_by_name%(parent: string, identifier: count, child: string%): bool
%{
packet_analysis::AnalyzerPtr parent_analyzer = packet_mgr->GetAnalyzer(parent->ToStdString());
if ( ! parent_analyzer )
return zeek::val_mgr->False();
packet_analysis::AnalyzerPtr child_analyzer = packet_mgr->GetAnalyzer(child->ToStdString());
if ( ! child_analyzer )
return zeek::val_mgr->False();
parent_analyzer->RegisterProtocol(identifier, child_analyzer);
return zeek::val_mgr->True();
%}