mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 00:58:19 +00:00
d4ff5a236c
This is still WIP and includes the following changes: * Dispatchers are now part of analyzers (moving dispatching logic from the manager to the analyzers) * All available analyzers are instantiated on start up * Removal of configuration class
69 lines
No EOL
1.5 KiB
C++
69 lines
No EOL
1.5 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#include "Analyzer.h"
|
|
|
|
namespace zeek::packet_analysis {
|
|
|
|
Analyzer::Analyzer(std::string name)
|
|
{
|
|
Tag t = packet_mgr->GetComponentTag(name);
|
|
|
|
if ( ! t )
|
|
reporter->InternalError("unknown packet_analysis name %s", name.c_str());
|
|
|
|
Init(t);
|
|
}
|
|
|
|
Analyzer::Analyzer(const Tag& tag)
|
|
{
|
|
Init(tag);
|
|
}
|
|
|
|
void Analyzer::Init(const Tag& _tag)
|
|
{
|
|
tag = _tag;
|
|
}
|
|
|
|
const Tag Analyzer::GetAnalyzerTag() const
|
|
{
|
|
assert(tag);
|
|
return tag;
|
|
}
|
|
|
|
const char* Analyzer::GetAnalyzerName() const
|
|
{
|
|
assert(tag);
|
|
return packet_mgr->GetComponentName(tag).c_str();
|
|
}
|
|
|
|
bool Analyzer::IsAnalyzer(const char* name)
|
|
{
|
|
assert(tag);
|
|
return packet_mgr->GetComponentName(tag) == name;
|
|
}
|
|
|
|
bool Analyzer::RegisterAnalyzerMapping(uint32_t identifier, AnalyzerPtr analyzer)
|
|
{
|
|
return dispatcher.Register(identifier, std::move(analyzer));
|
|
}
|
|
|
|
AnalyzerResult Analyzer::AnalyzeInnerPacket(Packet* packet,
|
|
const uint8_t*& data, uint32_t identifier) const
|
|
{
|
|
auto inner_analyzer = dispatcher.Lookup(identifier);
|
|
|
|
if ( inner_analyzer == nullptr )
|
|
{
|
|
//TODO: Handle default analysis here
|
|
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s failed, could not find analyzer for identifier %#x.",
|
|
GetAnalyzerName(), identifier);
|
|
packet->Weird("no_suitable_analyzer_found");
|
|
return AnalyzerResult::Failed;
|
|
}
|
|
|
|
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s succeeded, next layer identifier is %#x.",
|
|
GetAnalyzerName(), identifier);
|
|
return inner_analyzer->Analyze(packet, data);
|
|
}
|
|
|
|
} |