Further simplified the packet analysis API.

This is still WIP and includes the following changes:
* Dispatchers are now part of analyzers (moving dispatching logic from
  the manager to the analyzers)
* All available analyzers are instantiated on start up
* Removal of configuration class
This commit is contained in:
Jan Grashoefer 2020-08-20 18:40:37 +02:00 committed by Tim Wojtulewicz
parent 9feda100b9
commit d4ff5a236c
12 changed files with 104 additions and 340 deletions

View file

@ -10,9 +10,9 @@ namespace zeek::packet_analysis {
/**
* Result of packet analysis.
*/
//TODO: Replace with bool?
enum class AnalyzerResult {
Failed, // Analysis failed
Continue, // Analysis succeeded and an encapsulated protocol was determined
Terminate // Analysis succeeded and there is no further analysis to do
};
@ -41,6 +41,13 @@ public:
*/
virtual ~Analyzer() = default;
/**
* Initialize the analyzer. This method is called after the configuration
* was read. Derived classes can override this method to implement custom
* initialization.
*/
virtual void Initialize() { };
/**
* Returns the tag associated with the analyzer's type.
*/
@ -62,6 +69,15 @@ public:
*/
bool IsAnalyzer(const char* name);
/**
* Registers an analyzer to be dispatched for the given identifier.
*
* @param identifier The identifier an analyzer should be called for.
* @param analyzer The analyzer that should be called.
* @return True if the registration was successfull.
*/
bool RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer);
/**
* Analyzes the given packet. The data reference points to the part of the
* raw packet to be analyzed. If the analyzed protocol encapsulates another
@ -90,9 +106,11 @@ protected:
* @return The outcome of the analysis.
*/
AnalyzerResult AnalyzeInnerPacket(Packet* packet, const uint8_t*& data,
uint32_t identifier) const;
uint32_t identifier) const;
private:
Tag tag;
Dispatcher dispatcher;
void Init(const Tag& tag);
};