Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Spicy: Map Spicy's Protocol enum to Zeek's transport_proto.

Browse source 
We now hardcode this specific enum mapping to make Zeek-side usage
more convenient.

Closes #3606.
This commit is contained in:
Robin Sommer 2024-04-24 10:48:50 +02:00
parent 9132cdacd5
commit 5a74db30ef
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
5 changed files with 85 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
testing/btest/Baseline/spicy.export-protocol-enum/output Normal file
View file

@ -0,0 +1,9 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
icmp, 3
icmp, 3
tcp, 1
tcp, 1
udp, 2
udp, 2
unknown_transport, 0
unknown_transport, 0

52
testing/btest/spicy/export-protocol-enum.zeek Normal file
View file

@ -0,0 +1,52 @@
# @TEST-REQUIRES: have-spicy
#
# @TEST-EXEC: spicyz -d -o test.hlto dtest.spicy ./dtest.evt
# @TEST-EXEC: zeek -r ${TRACES}/ssh/single-conn.trace test.hlto %INPUT | sort >output
# @TEST-EXEC: btest-diff output
#
# @TEST-DOC: Test special-casing the mapping of spicy::Protocol to Zeek's transport_proto.
event dtest_one(x: transport_proto) {
print x, enum_to_int(x);
}
event zeek_init() {
Analyzer::register_for_port(Analyzer::ANALYZER_SPICY_DTEST, 22/tcp);
}
# @TEST-START-FILE dtest.evt
import spicy;
protocol analyzer spicy::dtest over TCP:
parse originator with dtest::Message;
on dtest::Message -> event dtest_one(spicy::Protocol::TCP);
on dtest::Message -> event dtest_one(spicy::Protocol::UDP);
on dtest::Message -> event dtest_one(spicy::Protocol::ICMP);
on dtest::Message -> event dtest_one(spicy::Protocol::Undef);
on dtest::Message -> event dtest_one(self.p_tcp);
on dtest::Message -> event dtest_one(self.p_udp);
on dtest::Message -> event dtest_one(self.p_icmp);
on dtest::Message -> event dtest_one(self.p_undef);
export spicy::Protocol;
# @TEST-END-FILE
# @TEST-START-FILE dtest.spicy
module dtest;
import spicy;
public type Message = unit {
sswitch: uint8;
result: uint8;
var p_tcp: spicy::Protocol = spicy::Protocol::TCP;
var p_udp: spicy::Protocol = spicy::Protocol::UDP;
var p_icmp: spicy::Protocol = spicy::Protocol::ICMP;
var p_undef: spicy::Protocol = cast<spicy::Protocol>(42);
};
# @TEST-END-FILE