From 3a70289e91b09640cda77a0534aa997a15fff40f Mon Sep 17 00:00:00 2001
From: Johanna Amann <johanna@icir.org>
Date: Wed, 27 Apr 2016 06:51:04 -0700
Subject: [PATCH] ARP: remove unnecessary variables and add testcase

BIT-1573 #close
---
 src/analyzer/protocol/arp/ARP.cc                  |   3 ---
 src/analyzer/protocol/arp/ARP.h                   |   4 ----
 .../scripts.base.protocols.arp.basic/.stdout      |   2 ++
 testing/btest/Traces/arp-who-has.pcap             | Bin 0 -> 158 bytes
 .../btest/scripts/base/protocols/arp/basic.test   |  13 +++++++++++++
 5 files changed, 15 insertions(+), 7 deletions(-)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.arp.basic/.stdout
 create mode 100644 testing/btest/Traces/arp-who-has.pcap
 create mode 100644 testing/btest/scripts/base/protocols/arp/basic.test

diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc
index 5cbb25451b..b9af26ecfa 100644
--- a/src/analyzer/protocol/arp/ARP.cc
+++ b/src/analyzer/protocol/arp/ARP.cc
@@ -10,9 +10,6 @@ using namespace analyzer::arp;
 
 ARP_Analyzer::ARP_Analyzer()
 	{
-	bad_arp = internal_handler("bad_arp");
-	arp_request = internal_handler("arp_request");
-	arp_reply = internal_handler("arp_reply");
 	}
 
 ARP_Analyzer::~ARP_Analyzer()
diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h
index c4deddee03..1bdd382714 100644
--- a/src/analyzer/protocol/arp/ARP.h
+++ b/src/analyzer/protocol/arp/ARP.h
@@ -50,10 +50,6 @@ protected:
 	StringVal* EthAddrToStr(const u_char* addr);
 	void BadARP(const struct arp_pkthdr* hdr, const char* string);
 	void Corrupted(const char* string);
-
-	EventHandlerPtr arp_corrupted_packet;
-	EventHandlerPtr arp_request;
-	EventHandlerPtr arp_reply;
 };
 
 } } // namespace analyzer::* 
diff --git a/testing/btest/Baseline/scripts.base.protocols.arp.basic/.stdout b/testing/btest/Baseline/scripts.base.protocols.arp.basic/.stdout
new file mode 100644
index 0000000000..d45f9ba0d7
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.arp.basic/.stdout
@@ -0,0 +1,2 @@
+78:31:c1:c6:3f:c2, ff:ff:ff:ff:ff:ff, 10.0.0.2, 78:31:c1:c6:3f:c2, 10.0.0.1, 00:00:00:00:00:00
+f8:ed:a5:c0:a4:f1, 78:31:c1:c6:3f:c2, 10.0.0.1, f8:ed:a5:c0:a4:f1, 10.0.0.2, 78:31:c1:c6:3f:c2
diff --git a/testing/btest/Traces/arp-who-has.pcap b/testing/btest/Traces/arp-who-has.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..085dddf1fe6dce2a581b1d8d2e413ca3e069cc4a
GIT binary patch
literal 158
zcmca|c+)~A1{MYw`2U}Qff2|#cSs@p)F*ZZEg&0&|ARq=;lX3}hd9_67&#c&SQr=~
yd@cqCCWw9@ixH$#oP&eG1}Fr=5H&yEE<Ld1BU~pFgbz}WZU)381_pWVgmVDQPbvEV

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/arp/basic.test b/testing/btest/scripts/base/protocols/arp/basic.test
new file mode 100644
index 0000000000..9ef1404567
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/arp/basic.test
@@ -0,0 +1,13 @@
+# @TEST-EXEC: bro -r $TRACES/arp-who-has.pcap %INPUT
+# @TEST-EXEC: btest-diff .stdout
+
+event arp_request(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)
+	{
+	print mac_src, mac_dst, SPA, SHA, TPA, THA;
+	}
+
+event arp_reply(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string)
+	{
+	print mac_src, mac_dst, SPA, SHA, TPA, THA;
+	}
+