mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
d34f23c8d4
- Enable manager to associate analyzers with a MIME type. With that,
one can now say enable all analyzers for, e.g., "image/gif". This is
exposed to script-land as
Files::add_analyzers_for_mime_type(f: fa_file, mtype: string)
For MIME types identified via libmagic, this happens automatically
(via the file_new() handler in files/main.bro).
- Extend the analyzer API to better match that of protocol analyzers:
- Adding unique analyzer IDs so that we can refer to instances
from script-land.
- Adding subtypes to Components so that a single analyzer
implementation can support different types of analyzers
internally.
- Add an analyzer method SetTag() that allows to set the tag after
construction.
- Adding Init() and Done() methods for consistency with what other
classes offer.
- Add debug logging to the file_analysis stream.
TODO: test cases missing for the new script-land functionality.
99 lines
2.8 KiB
C++
99 lines
2.8 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef FILE_ANALYZER_PLUGIN_COMPONENT_H
|
|
#define FILE_ANALYZER_PLUGIN_COMPONENT_H
|
|
|
|
#include "Tag.h"
|
|
#include "plugin/Component.h"
|
|
#include "plugin/TaggedComponent.h"
|
|
|
|
#include "Val.h"
|
|
|
|
#include "../config.h"
|
|
#include "../util.h"
|
|
|
|
namespace file_analysis {
|
|
|
|
class File;
|
|
class Analyzer;
|
|
|
|
/**
|
|
* Component description for plugins providing file analyzers.
|
|
*
|
|
* A plugin can provide a specific file analyzer by registering this
|
|
* analyzer component, describing the analyzer.
|
|
*/
|
|
class Component : public plugin::Component,
|
|
public plugin::TaggedComponent<file_analysis::Tag> {
|
|
public:
|
|
typedef Analyzer* (*factory_callback)(RecordVal* args, File* file);
|
|
|
|
/**
|
|
* Constructor.
|
|
*
|
|
* @param name The name of the provided analyzer. This name is used
|
|
* across the system to identify the analyzer, e.g., when calling
|
|
* file_analysis::Manager::InstantiateAnalyzer with a name.
|
|
*
|
|
* @param factory A factory function to instantiate instances of the
|
|
* analyzer's class, which must be derived directly or indirectly
|
|
* from file_analysis::Analyzer. This is typically a static \c
|
|
* Instatiate() method inside the class that just allocates and
|
|
* returns a new instance.
|
|
*
|
|
* @param subtype A subtype associated with this component that
|
|
* further distinguishes it. The subtype will be integrated into the
|
|
* analyzer::Tag that the manager associates with this analyzer, and
|
|
* analyzer instances can accordingly access it via analyzer::Tag().
|
|
* If not used, leave at zero.
|
|
*/
|
|
Component(const char* name, factory_callback factory, Tag::subtype_t subtype = 0);
|
|
|
|
/**
|
|
* Copy constructor.
|
|
*/
|
|
Component(const Component& other);
|
|
|
|
/**
|
|
* Destructor.
|
|
*/
|
|
~Component();
|
|
|
|
/**
|
|
* Returns the name of the analyzer. This name is unique across all
|
|
* analyzers and used to identify it. The returned name is derived
|
|
* from what's passed to the constructor but upper-cased and
|
|
* canonified to allow being part of a script-level ID.
|
|
*/
|
|
virtual const char* Name() const { return name; }
|
|
|
|
/**
|
|
* Returns a canonocalized version of the analyzer's name. The
|
|
* returned name is derived from what's passed to the constructor but
|
|
* upper-cased and transformed to allow being part of a script-level
|
|
* ID.
|
|
*/
|
|
const char* CanonicalName() const { return canon_name; }
|
|
|
|
/**
|
|
* Returns the analyzer's factory function.
|
|
*/
|
|
factory_callback Factory() const { return factory; }
|
|
|
|
/**
|
|
* Generates a human-readable description of the component's main
|
|
* parameters. This goes into the output of \c "bro -NN".
|
|
*/
|
|
virtual void Describe(ODesc* d) const;
|
|
|
|
Component& operator=(const Component& other);
|
|
|
|
private:
|
|
const char* name; // The analyzer's name.
|
|
const char* canon_name; // The analyzer's canonical name.
|
|
factory_callback factory; // The analyzer's factory callback.
|
|
};
|
|
|
|
}
|
|
|
|
#endif
|