mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
file_analysis/Analyzer: Limit maximum number of violations
Just the same as for protocol analyzers, prevent from violation event overload.
This commit is contained in:
parent
e688bfcf73
commit
fa956efa79
7 changed files with 58 additions and 5 deletions
|
@ -83,6 +83,11 @@ public:
|
|||
*/
|
||||
zeek::Tag Tag() const { return tag; }
|
||||
|
||||
/**
|
||||
* @return the name of the analyzer.
|
||||
*/
|
||||
const char* GetAnalyzerName() const;
|
||||
|
||||
/**
|
||||
* Returns the analyzer instance's internal ID. These IDs are unique
|
||||
* across all analyzers instantiated and can thus be used to
|
||||
|
@ -165,6 +170,12 @@ public:
|
|||
virtual void AnalyzerViolation(const char* reason, const char* data = nullptr, int len = 0,
|
||||
zeek::Tag tag = zeek::Tag());
|
||||
|
||||
/**
|
||||
* Convenience function that forwards directly to the corresponding
|
||||
* reporter->Weird(file, ...).
|
||||
*/
|
||||
void Weird(const char* name, const char* addl = "");
|
||||
|
||||
protected:
|
||||
/**
|
||||
* Constructor. Only derived classes are meant to be instantiated.
|
||||
|
@ -195,6 +206,8 @@ private:
|
|||
bool skip;
|
||||
bool analyzer_confirmed;
|
||||
|
||||
uint64_t analyzer_violations = 0;
|
||||
|
||||
static ID id_counter;
|
||||
};
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue