Add SkipAnalyzer.

This is WIP: The test case would require a new pcap or the possibility
to overwrite analyzer mappings. The CustomEncapsulationSkip method and
the corresponding options need to be removed.
This commit is contained in:
Jan Grashoefer 2020-08-25 17:03:20 +02:00 committed by Tim Wojtulewicz
parent 6f6e5b4df0
commit fc814bd7e2
11 changed files with 113 additions and 1 deletions

View file

@ -0,0 +1,27 @@
// See the file "COPYING" in the main distribution directory for copyright.
#pragma once
#include <packet_analysis/Analyzer.h>
#include <packet_analysis/Component.h>
namespace zeek::packet_analysis::Skip {
class SkipAnalyzer : public Analyzer {
public:
SkipAnalyzer();
~SkipAnalyzer() override = default;
void Initialize() override;
AnalyzerResult Analyze(Packet* packet, const uint8_t*& data) override;
static zeek::packet_analysis::AnalyzerPtr Instantiate()
{
return std::make_shared<SkipAnalyzer>();
}
private:
bro_uint_t skip_bytes = 0;
};
}