Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Improve packet analysis data flow.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-31 20:28:06 +02:00 • committed by Tim Wojtulewicz
parent 90eb97876f
commit 38337d799b
43 changed files with 141 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/plugins/packet-protocol-plugin/src/Bar.cc
View file

@ -10,14 +10,14 @@ Bar::Bar()
{
}
zeek::packet_analysis::AnalyzerResult Bar::AnalyzePacket(size_t len,
bool Bar::AnalyzePacket(size_t len,
const uint8_t* data, Packet* packet)
{
// Rudimentary parsing of 802.2 LLC
if ( 17 >= len )
{
packet->Weird("truncated_llc_header");
return AnalyzerResult::Failed;
return false;
}
auto dsap = data[14];
@ -29,5 +29,5 @@ zeek::packet_analysis::AnalyzerResult Bar::AnalyzePacket(size_t len,
val_mgr->Count(ssap),
val_mgr->Count(control));
return AnalyzerResult::Terminate;
return true;
}

2
testing/btest/plugins/packet-protocol-plugin/src/Bar.h
View file

@ -10,7 +10,7 @@ public:
Bar();
~Bar() override = default;
AnalyzerResult AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) override;
bool AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) override;
static AnalyzerPtr Instantiate()
{