Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-1184: Add 'source' field to weird log denoting where the weird was reported

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-11-05 13:18:54 -07:00
parent eccbbb4476
commit e27008ef26
72 changed files with 964 additions and 890 deletions
Download patch file Download diff file Expand all files Collapse all files

7
testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc
View file

@ -1,6 +1,7 @@
#include "LLCDemo.h"
#include "Event.h"
#include "Val.h"
#include "zeek/Event.h"
#include "zeek/Val.h"
#include "zeek/Sessions.h"
#include "events.bif.h"
using namespace zeek::packet_analysis::PacketDemo;
@ -15,7 +16,7 @@ bool LLCDemo::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
// Rudimentary parsing of 802.2 LLC
if ( 17 >= len )
{
packet->Weird("truncated_llc_header");
sessions->Weird("truncated_llc_header", packet);
return false;
}

4
testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.h
View file

@ -1,7 +1,7 @@
#pragma once
#include <packet_analysis/Analyzer.h>
#include <packet_analysis/Component.h>
#include "zeek/packet_analysis/Analyzer.h"
#include "zeek/packet_analysis/Component.h"
namespace zeek::packet_analysis::PacketDemo {

8
testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc
View file

@ -1,6 +1,8 @@
#include "RawLayer.h"
#include "Event.h"
#include "Val.h"
#include "zeek/Event.h"
#include "zeek/Val.h"
#include "zeek/Sessions.h"
#include "events.bif.h"
using namespace zeek::packet_analysis::PacketDemo;
@ -15,7 +17,7 @@ bool RawLayer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
constexpr auto layer_size = 21;
if ( layer_size >= len )
{
packet->Weird("truncated_raw_layer");
sessions->Weird("truncated_raw_layer", packet);
return false;
}

4
testing/btest/plugins/packet-protocol-plugin/src/RawLayer.h
View file

@ -1,7 +1,7 @@
#pragma once
#include <packet_analysis/Analyzer.h>
#include <packet_analysis/Component.h>
#include "zeek/packet_analysis/Analyzer.h"
#include "zeek/packet_analysis/Component.h"
namespace zeek::packet_analysis::PacketDemo {