Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add method for packet analyzers to register for protocol detection

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-06-10 16:31:29 -07:00
parent a7d3cb48ef
commit d4f57a6100
3 changed files with 99 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/packet_analysis/packet_analysis.bif
View file

@ -28,8 +28,8 @@ function register_packet_analyzer%(parent: PacketAnalyzer::Tag, identifier: coun
return zeek::val_mgr->True();
%}
## Attempts to add an entry to `parent`'s dispatcher that maps a protocol/index to a next-stage `child` analyzer.
## This may fail if either of the two names does not respond to a known analyzer.
## Attempts to add an entry to `parent`'s dispatcher that maps a protocol/index to a next-stage `child`
## analyzer. This may fail if either of the two names does not respond to a known analyzer.
##
## parent: The parent analyzer being modified
## identifier: The identifier for the protocol being registered
@ -58,3 +58,22 @@ function PacketAnalyzer::__set_ignore_checksums_nets%(v: subnet_set%) : bool
zeek::packet_analysis::IP::IPBasedAnalyzer::SetIgnoreChecksumsNets(zeek::IntrusivePtr{zeek::NewRef{}, v->AsTableVal()});
return zeek::val_mgr->True();
%}
## Registers a child analyzer with a parent analyzer to perform packet detection when determining whether
## to forward from parent to child.
##
## parent: The parent analyzer being modified
## child: The analyzer that will use protocol detection
function register_protocol_detection%(parent: PacketAnalyzer::Tag, child: PacketAnalyzer::Tag%): bool
%{
packet_analysis::AnalyzerPtr parent_analyzer = packet_mgr->GetAnalyzer(parent->AsEnumVal());
if ( ! parent_analyzer )
return zeek::val_mgr->False();
packet_analysis::AnalyzerPtr child_analyzer = packet_mgr->GetAnalyzer(child->AsEnumVal());
if ( ! child_analyzer )
return zeek::val_mgr->False();
parent_analyzer->RegisterProtocolDetection(child_analyzer);
return zeek::val_mgr->True();
%}