Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding a test building a file analyzer plugin.

Browse source 
Also cleaning up, and moving, the other plugin tests.
This commit is contained in:
Robin Sommer 2014-06-18 14:08:28 -07:00
parent 55de5c60f4
commit c24bb9cacd
28 changed files with 203 additions and 2336 deletions
Download patch file Download diff file Expand all files Collapse all files

59
testing/btest/plugins/protocol-plugin/src/Foo.cc Normal file
View file

@ -0,0 +1,59 @@
#include "Foo.h"
#include "foo_pac.h"
#include "events.bif.h"
#include <analyzer/protocol/tcp/TCP_Reassembler.h>
using namespace plugin::Demo_Foo;
Foo::Foo(Connection* conn)
: analyzer::tcp::TCP_ApplicationAnalyzer("Foo", conn)
{
interp = new binpac::Foo::Foo_Conn(this);
}
Foo::~Foo()
{
delete interp;
}
void Foo::Done()
{
analyzer::tcp::TCP_ApplicationAnalyzer::Done();
interp->FlowEOF(true);
interp->FlowEOF(false);
}
void Foo::EndpointEOF(bool is_orig)
{
analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
interp->FlowEOF(is_orig);
}
void Foo::DeliverStream(int len, const u_char* data, bool orig)
{
analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
assert(TCP());
if ( TCP()->IsPartial() )
// punt on partial.
return;
try
{
interp->NewData(orig, data, data + len);
}
catch ( const binpac::Exception& e )
{
ProtocolViolation(fmt("Binpac exception: %s", e.c_msg()));
}
}
void Foo::Undelivered(int seq, int len, bool orig)
{
analyzer::tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
interp->NewGap(orig, len);
}