Adding a test building a file analyzer plugin.

Also cleaning up, and moving, the other plugin tests.

testing/btest/plugins/protocol-plugin/CMakeLists.txt

@@ -0,0 +1,20 @@
+
+project(Bro-Plugin-Demo-Foo)
+
+cmake_minimum_required(VERSION 2.6.3)
+
+if ( NOT BRO_DIST )
+    message(FATAL_ERROR "BRO_DIST not set")
+endif ()
+
+set(CMAKE_MODULE_PATH ${BRO_DIST}/cmake)
+
+include(BroPlugin)
+
+bro_plugin_begin(Demo Foo)
+bro_plugin_cc(src/Plugin.cc)
+bro_plugin_cc(src/Foo.cc)
+bro_plugin_bif(src/events.bif)
+bro_plugin_bif(src/functions.bif)
+bro_plugin_pac(src/foo.pac src/foo-protocol.pac src/foo-analyzer.pac)
+bro_plugin_end()

testing/btest/plugins/protocol-plugin/scripts/Demo/Foo/base/main.bro

@@ -0,0 +1,7 @@
+
+const ports = { 4242/tcp };
+
+event bro_init() &priority=5
+	{
+	Analyzer::register_for_ports(Analyzer::ANALYZER_FOO, ports);
+	}

testing/btest/plugins/protocol-plugin/scripts/__load__.bro

@@ -0,0 +1 @@
+@load Demo/Foo/base/main

testing/btest/plugins/protocol-plugin/src/Foo.cc

@@ -0,0 +1,59 @@
+
+#include "Foo.h"
+#include "foo_pac.h"
+#include "events.bif.h"
+
+#include <analyzer/protocol/tcp/TCP_Reassembler.h>
+
+using namespace plugin::Demo_Foo;
+
+Foo::Foo(Connection* conn)
+    : analyzer::tcp::TCP_ApplicationAnalyzer("Foo", conn)
+	{
+	interp = new binpac::Foo::Foo_Conn(this);
+	}
+
+Foo::~Foo()
+	{
+	delete interp;
+	}
+
+void Foo::Done()
+	{
+	analyzer::tcp::TCP_ApplicationAnalyzer::Done();
+
+	interp->FlowEOF(true);
+	interp->FlowEOF(false);
+	}
+
+void Foo::EndpointEOF(bool is_orig)
+	{
+	analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
+	interp->FlowEOF(is_orig);
+	}
+
+void Foo::DeliverStream(int len, const u_char* data, bool orig)
+	{
+	analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
+
+	assert(TCP());
+
+	if ( TCP()->IsPartial() )
+		// punt on partial.
+		return;
+
+	try
+		{
+		interp->NewData(orig, data, data + len);
+		}
+	catch ( const binpac::Exception& e )
+		{
+		ProtocolViolation(fmt("Binpac exception: %s", e.c_msg()));
+		}
+	}
+
+void Foo::Undelivered(int seq, int len, bool orig)
+	{
+	analyzer::tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
+	interp->NewGap(orig, len);
+	}

testing/btest/plugins/protocol-plugin/src/Foo.h

@@ -0,0 +1,32 @@
+
+#ifndef BRO_PLUGIN_DEMO_FOO_H
+#define BRO_PLUGIN_DEMO_FOO_H
+
+#include "analyzer/protocol/tcp/TCP.h"
+#include "analyzer/protocol/pia/PIA.h"
+
+namespace binpac  { namespace Foo { class Foo_Conn; } }
+
+namespace plugin {
+namespace Demo_Foo {
+
+class Foo : public analyzer::tcp::TCP_ApplicationAnalyzer {
+public:
+	Foo(Connection* conn);
+	~Foo();
+
+	virtual void Done();
+	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	virtual void Undelivered(int seq, int len, bool orig);
+	virtual void EndpointEOF(bool is_orig);
+
+	static analyzer::Analyzer* Instantiate(Connection* conn)
+		{ return new Foo(conn); }
+
+protected:
+	binpac::Foo::Foo_Conn* interp;
+};
+
+} }
+
+#endif

testing/btest/plugins/protocol-plugin/src/Plugin.cc

@@ -0,0 +1,25 @@
+
+#include <plugin/Plugin.h>
+
+#include "Foo.h"
+
+namespace plugin {
+namespace Demo_Foo {
+
+class Plugin : public plugin::Plugin {
+public:
+	plugin::Configuration Configure()
+		{
+		AddComponent(new ::analyzer::Component("Foo", plugin::Demo_Foo::Foo::Instantiate));
+
+		plugin::Configuration config;
+		config.name = "Demo::Foo";
+		config.description = "A Foo test analyzer";
+		config.version.major = 1;
+		config.version.minor = 0;
+		return config;
+		}
+} plugin;
+
+}
+}

testing/btest/plugins/protocol-plugin/src/events.bif

@@ -0,0 +1,2 @@
+
+event foo_message%(c: connection, data: string%);

testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac

@@ -0,0 +1,15 @@
+
+refine connection Foo_Conn += {
+
+	function Foo_data(msg: Foo_Message): bool
+		%{
+		StringVal* data = new StringVal(${msg.data}.length(), (const char*) ${msg.data}.data());
+		BifEvent::generate_foo_message(bro_analyzer(), bro_analyzer()->Conn(), data);
+		return true;
+		%}
+
+};
+
+refine typeattr Foo_Message += &let {
+	proc: bool = $context.connection.Foo_data(this);
+};

testing/btest/plugins/protocol-plugin/src/foo-protocol.pac

@@ -0,0 +1,4 @@
+
+type Foo_Message(is_orig: bool) = record {
+	data: bytestring &restofdata;
+};

testing/btest/plugins/protocol-plugin/src/foo.pac

@@ -0,0 +1,26 @@
+%include binpac.pac
+%include bro.pac
+
+%extern{
+#include "Foo.h"
+
+#include "events.bif.h"
+%}
+
+analyzer Foo withcontext {
+    connection: Foo_Conn;
+    flow:       Foo_Flow;
+};
+
+connection Foo_Conn(bro_analyzer: BroAnalyzer) {
+    upflow   = Foo_Flow(true);
+    downflow = Foo_Flow(false);
+};
+
+%include foo-protocol.pac
+
+flow Foo_Flow(is_orig: bool) {
+	datagram = Foo_Message(is_orig) withcontext(connection, this);
+};
+
+%include foo-analyzer.pac