Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Further simplified the packet analysis API.

Browse source 
This is still WIP and includes the following changes:
* Dispatchers are now part of analyzers (moving dispatching logic from
  the manager to the analyzers)
* All available analyzers are instantiated on start up
* Removal of configuration class
This commit is contained in:
Jan Grashoefer 2020-08-20 18:40:37 +02:00 • committed by Tim Wojtulewicz
parent 9feda100b9
commit d4ff5a236c
12 changed files with 104 additions and 340 deletions
Download patch file Download diff file Expand all files Collapse all files

37
src/packet_analysis/Manager.h
View file

@ -2,23 +2,16 @@
#pragma once
#include <queue>
#include <vector>
#include "Config.h"
#include "Tag.h"
#include "Component.h"
#include "plugin/ComponentManager.h"
#include "iosource/Packet.h"
#include "Dict.h"
#include "net_util.h"
#include "Dispatcher.h"
namespace zeek::packet_analysis {
class Analyzer;
class Dispatcher;
using AnalyzerPtr = std::shared_ptr<Analyzer>;
using DispatcherPtr = std::shared_ptr<Dispatcher>;
class Manager : public plugin::ComponentManager<Tag, Component> {
public:
@ -30,7 +23,7 @@ public:
/**
* Destructor.
*/
~Manager();
~Manager() = default;
/**
* Second-stage initialization of the manager. This is called late
@ -50,14 +43,6 @@ public:
*/
void DumpDebug(); // Called after zeek_init() events.
/**
* Returns the tag associated with an analyer name, or the tag
* associated with an error if no such analyzer exists.
*
* @param name The canonical analyzer name to check.
*/
Tag GetAnalyzerTag(const char* name);
/**
* Instantiates a new analyzer instance.
*
@ -87,18 +72,7 @@ public:
*/
void ProcessPacket(Packet* packet);
/**
* Looks up a packet analyzer by identifier considering the context
* as given by current_state.
*
* @param identifier The identifier to look up.
*
* @return The analyzer corresponding to the identifier.
*/
AnalyzerPtr Dispatch(uint32_t identifier);
private:
/**
* Skips a fixed amount of packet data that is defined by encap_hdr_size.
* It is assumed that an IP header follows.
@ -109,13 +83,8 @@ private:
*/
void CustomEncapsulationSkip(Packet* packet, const uint8_t* data);
DispatcherPtr GetDispatcher(Config& configuration, const std::string& dispatcher_name);
std::map<std::string, AnalyzerPtr> analyzers;
std::map<std::string, DispatcherPtr> dispatchers;
DispatcherPtr root_dispatcher = nullptr;
DispatcherPtr default_dispatcher = nullptr;
DispatcherPtr current_state = nullptr;
Dispatcher root_dispatcher;
AnalyzerPtr default_analyzer = nullptr;
};