Adding a test building a file analyzer plugin.

Also cleaning up, and moving, the other plugin tests.
This commit is contained in:
Robin Sommer 2014-06-18 14:08:28 -07:00
parent 55de5c60f4
commit c24bb9cacd
28 changed files with 203 additions and 2336 deletions

View file

@ -0,0 +1,26 @@
#include "Foo.h"
#include <events.bif.h>
#include <file_analysis/Manager.h>
using namespace plugin::Demo_Foo;
Foo::Foo(RecordVal* args, file_analysis::File* file)
: file_analysis::Analyzer(file_mgr->GetComponentTag("FOO"), args, file)
{
}
file_analysis::Analyzer* Foo::Instantiate(RecordVal* args, file_analysis::File* file)
{
return new Foo(args, file);
}
bool Foo::DeliverStream(const u_char* data, uint64 len)
{
val_list* args = new val_list;
args->append(GetFile()->GetVal()->Ref());
args->append(new StringVal(new BroString(data, len, 0)));
mgr.QueueEvent(foo_piece, args);
return true;
}

View file

@ -0,0 +1,23 @@
#ifndef BRO_PLUGIN_DEMO_FOO_H
#define BRO_PLUGIN_DEMO_FOO_H
#include <Val.h>
#include <file_analysis/Analyzer.h>
namespace plugin {
namespace Demo_Foo {
class Foo : public file_analysis::Analyzer {
public:
virtual bool DeliverStream(const u_char* data, uint64 len);
static file_analysis::Analyzer* Instantiate(RecordVal* args, file_analysis::File* file);
protected:
Foo(RecordVal* args, file_analysis::File* file);
};
} }
#endif

View file

@ -0,0 +1,25 @@
#include <plugin/Plugin.h>
#include "Foo.h"
namespace plugin {
namespace Demo_Foo {
class Plugin : public plugin::Plugin {
public:
plugin::Configuration Configure()
{
AddComponent(new ::file_analysis::Component("Foo", ::plugin::Demo_Foo::Foo::Instantiate));
plugin::Configuration config;
config.name = "Demo::Foo";
config.description = "A Foo test analyzer";
config.version.major = 1;
config.version.minor = 0;
return config;
}
} plugin;
}
}

View file

@ -0,0 +1,2 @@
event foo_piece%(f: fa_file, data: string%);