mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 19:48:20 +00:00
A set of file analysis extensions.
- Enable manager to associate analyzers with a MIME type. With that, one can now say enable all analyzers for, e.g., "image/gif". This is exposed to script-land as Files::add_analyzers_for_mime_type(f: fa_file, mtype: string) For MIME types identified via libmagic, this happens automatically (via the file_new() handler in files/main.bro). - Extend the analyzer API to better match that of protocol analyzers: - Adding unique analyzer IDs so that we can refer to instances from script-land. - Adding subtypes to Components so that a single analyzer implementation can support different types of analyzers internally. - Add an analyzer method SetTag() that allows to set the tag after construction. - Adding Init() and Done() methods for consistency with what other classes offer. - Add debug logging to the file_analysis stream. TODO: test cases missing for the new script-land functionality.
This commit is contained in:
parent
f0fe270029
commit
d34f23c8d4
12 changed files with 337 additions and 30 deletions
|
@ -8,13 +8,15 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
Component::Component(const char* arg_name, factory_callback arg_factory)
|
||||
Component::Component(const char* arg_name, factory_callback arg_factory, Tag::subtype_t subtype)
|
||||
: plugin::Component(plugin::component::FILE_ANALYZER),
|
||||
plugin::TaggedComponent<file_analysis::Tag>()
|
||||
plugin::TaggedComponent<file_analysis::Tag>(subtype)
|
||||
{
|
||||
name = copy_string(arg_name);
|
||||
canon_name = canonify_name(arg_name);
|
||||
factory = arg_factory;
|
||||
|
||||
file_mgr->RegisterComponent(this, "ANALYZER_");
|
||||
}
|
||||
|
||||
Component::Component(const Component& other)
|
||||
|
@ -24,6 +26,8 @@ Component::Component(const Component& other)
|
|||
name = copy_string(other.name);
|
||||
canon_name = copy_string(other.canon_name);
|
||||
factory = other.factory;
|
||||
|
||||
// TODO: Do we need the RegisterComponent() call here?
|
||||
}
|
||||
|
||||
Component::~Component()
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue