Commit graph

15 commits

Author SHA1 Message Date
Tim Wojtulewicz
2c46d3139c Merge remote-tracking branch 'origin/topic/timw/3417-packet-analysis-detail'
* origin/topic/timw/3417-packet-analysis-detail:
  Move packet_analysis::Dispatcher to detail namespace
2024-05-08 09:55:16 -07:00
Robin Sommer
ccfeffaf2b
Fix packet analyzer replacement.
Also reworking the existing test, which was pretty odd/broken.
2024-05-06 09:45:11 +02:00
Tim Wojtulewicz
6900f3301e Move packet_analysis::Dispatcher to detail namespace 2024-04-26 13:11:45 -07:00
Arne Welzel
9bebd93c06 packet_analysis/Dispatcher: Do not index table twice
It's okay to return the nullptr that's in the table, no need to check
for != nullptr before dereferencing again.
2023-11-01 12:03:55 +01:00
Arne Welzel
e56ef0fd9b packet_analysis: Avoid shared_ptr copying for analyzer lookups
For deeply encapsulated connections (think AWS traffic mirroring format
like IP,UDP,GENEVE,IP,UDP,VXLAN,ETH,IP,TCP), the Dispatcher::Lookup()
method is fairly visible in profiles when running in bare mode.

This changes the Analyzer::Lookup() and Dispatcher::Lookup() return value
breaking the API in favor of the performance improvement.

Relates to zeek/zeek#3379.
2023-11-01 12:03:02 +01:00
Benjamin Bannier
f5a76c1aed Reformat Zeek in Spicy style
This largely copies over Spicy's `.clang-format` configuration file. The
one place where we deviate is header include order since Zeek depends on
headers being included in a certain order.
2023-10-30 09:40:55 +01:00
Jan Grashoefer
bfa466f2eb Reintroduce info when overriding packet analyzer mappings.
In #2464 the warning when overriding a packet analyzer mapping was
removed. While a warning seems indeed excessive, some info would still
be nice to have.
2023-03-30 16:19:39 +02:00
Robin Sommer
a84d06a2c3 Suppress warning on an existing packet analyzer being remapped.
There was a check generating an internal warning if a new packet
analyzer mapping overwrote an existing one. However, replacing
an existing analyzer with a new one seems a legitimate use case (and
will be supported by Spicy soon). So removing that warning.
2022-10-10 08:25:51 +02:00
Tim Wojtulewicz
b2f171ec69 Reformat the world 2021-09-16 15:35:39 -07:00
Tim Wojtulewicz
96d9115360 GH-1079: Use full paths starting with zeek/ when including files 2020-11-12 12:15:26 -07:00
Jan Grashoefer
54961b5ea2 Allow to overwrite packet analysis mappings. 2020-09-23 11:13:28 -07:00
Jan Grashoefer
fc814bd7e2 Add SkipAnalyzer.
This is WIP: The test case would require a new pcap or the possibility
to overwrite analyzer mappings. The CustomEncapsulationSkip method and
the corresponding options need to be removed.
2020-09-23 11:13:28 -07:00
Jan Grashoefer
d4ff5a236c Further simplified the packet analysis API.
This is still WIP and includes the following changes:
* Dispatchers are now part of analyzers (moving dispatching logic from
  the manager to the analyzers)
* All available analyzers are instantiated on start up
* Removal of configuration class
2020-09-23 11:13:28 -07:00
Tim Wojtulewicz
c2500d03d6 Remove packet_analysis/Defines.h
- Replace uses of identifier_t with uint32_t
- Replace repeated usage of tuple type for Analysis results with type alias
2020-09-23 11:13:28 -07:00
Tim Wojtulewicz
b46e600775 Move VectorDispatcher to be the only dispatcher 2020-09-23 11:13:28 -07:00
Renamed from src/packet_analysis/dispatchers/VectorDispatcher.cc (Browse further)