file_analysis/Analyzer: Limit maximum number of violations

Just the same as for protocol analyzers, prevent from violation event overload.
This commit is contained in:
Arne Welzel 2022-10-17 10:23:01 +02:00 committed by Tim Wojtulewicz
parent e688bfcf73
commit fa956efa79
7 changed files with 58 additions and 5 deletions

View file

@ -83,6 +83,11 @@ public:
*/
zeek::Tag Tag() const { return tag; }
/**
* @return the name of the analyzer.
*/
const char* GetAnalyzerName() const;
/**
* Returns the analyzer instance's internal ID. These IDs are unique
* across all analyzers instantiated and can thus be used to
@ -165,6 +170,12 @@ public:
virtual void AnalyzerViolation(const char* reason, const char* data = nullptr, int len = 0,
zeek::Tag tag = zeek::Tag());
/**
* Convenience function that forwards directly to the corresponding
* reporter->Weird(file, ...).
*/
void Weird(const char* name, const char* addl = "");
protected:
/**
* Constructor. Only derived classes are meant to be instantiated.
@ -195,6 +206,8 @@ private:
bool skip;
bool analyzer_confirmed;
uint64_t analyzer_violations = 0;
static ID id_counter;
};