Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Renamed LL-Analyzers to Packet Analyzers.

Browse source
This commit is contained in:
Jan Grashoefer 2020-07-13 16:44:39 +02:00 • committed by Tim Wojtulewicz
parent b2e6c9ac9a
commit e53ec46c23
148 changed files with 587 additions and 587 deletions
Download patch file Download diff file Expand all files Collapse all files

20
testing/btest/Baseline/plugins.hooks/output
View file

@ -283,7 +283,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Broker::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG)) -> <no result>
0.000000 MetaHookPost CallFunction(Log::add_default_filter, <frame>, (Config::LOG)) -> <no result>
@ -464,7 +464,7 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T])) -> <no result>
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(NetControl::init, <null>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(Notice::want_pp, <frame>, ()) -> <no result>
@ -861,7 +861,6 @@
0.000000 MetaHookPost LoadFile(0, base<...>/irc) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/krb) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/linux_sll) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/llprotocols) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/logging) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/logging.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/main.zeek) -> -1
@ -879,6 +878,7 @@
0.000000 MetaHookPost LoadFile(0, base<...>/openflow) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/option.bif.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/packet-filter) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/packet-protocols) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/paths.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/patterns.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/pe) -> -1
@ -1225,7 +1225,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::__write, <frame>, (PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Broker::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, <frame>, (Config::LOG))
@ -1406,7 +1406,7 @@
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::create_stream, <frame>, (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]))
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::write, <frame>, (PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, <frame>, ())
0.000000 MetaHookPre CallFunction(NetControl::init, <null>, ())
0.000000 MetaHookPre CallFunction(Notice::want_pp, <frame>, ())
@ -1803,7 +1803,6 @@
0.000000 MetaHookPre LoadFile(0, base<...>/irc)
0.000000 MetaHookPre LoadFile(0, base<...>/krb)
0.000000 MetaHookPre LoadFile(0, base<...>/linux_sll)
0.000000 MetaHookPre LoadFile(0, base<...>/llprotocols)
0.000000 MetaHookPre LoadFile(0, base<...>/logging)
0.000000 MetaHookPre LoadFile(0, base<...>/logging.bif.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/main.zeek)
@ -1821,6 +1820,7 @@
0.000000 MetaHookPre LoadFile(0, base<...>/openflow)
0.000000 MetaHookPre LoadFile(0, base<...>/option.bif.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/packet-filter)
0.000000 MetaHookPre LoadFile(0, base<...>/packet-protocols)
0.000000 MetaHookPre LoadFile(0, base<...>/paths.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/patterns.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/pe)
@ -2166,7 +2166,7 @@
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Config::LOG)
@ -2347,7 +2347,7 @@
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction NetControl::check_plugins()
0.000000 | HookCallFunction NetControl::init()
0.000000 | HookCallFunction Notice::want_pp()
@ -2756,7 +2756,6 @@
0.000000 | HookLoadFile base<...>/irc
0.000000 | HookLoadFile base<...>/krb
0.000000 | HookLoadFile base<...>/linux_sll
0.000000 | HookLoadFile base<...>/llprotocols
0.000000 | HookLoadFile base<...>/logging
0.000000 | HookLoadFile base<...>/logging.bif.zeek
0.000000 | HookLoadFile base<...>/main.zeek
@ -2774,6 +2773,7 @@
0.000000 | HookLoadFile base<...>/openflow
0.000000 | HookLoadFile base<...>/option.bif.zeek
0.000000 | HookLoadFile base<...>/packet-filter
0.000000 | HookLoadFile base<...>/packet-protocols
0.000000 | HookLoadFile base<...>/paths.zeek
0.000000 | HookLoadFile base<...>/patterns.zeek
0.000000 | HookLoadFile base<...>/pe
@ -2819,7 +2819,7 @@
0.000000 | HookLoadFile base<...>/xmpp
0.000000 | HookLoadFile base<...>/zeek.bif.zeek
0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)}
0.000000 | HookLogWrite packet_filter [ts=1600793171.441844, node=zeek, filter=ip or not ip, init=T, success=T]
0.000000 | HookLogWrite packet_filter [ts=1600793375.962139, node=zeek, filter=ip or not ip, init=T, success=T]
0.000000 | HookQueueEvent NetControl::init()
0.000000 | HookQueueEvent filter_change_tracking()
0.000000 | HookQueueEvent zeek_init()

4
testing/btest/Baseline/plugins.ll-protocol/output → testing/btest/Baseline/plugins.packet-protocol/output
View file

@ -1,5 +1,5 @@
LLDemo::Bar - A Bar LL-test-analyzer. (dynamic, version 1.0.0)
[Low-Layer Analyzer] Bar (LLANALYZER_BAR, enabled)
PacketDemo::Bar - A Bar packet analyzer. (dynamic, version 1.0.0)
[Packet Analyzer] Bar (ANALYZER_BAR, enabled)
[Event] bar_message
===

5
testing/btest/plugins/ll-protocol-plugin/scripts/LLDemo/Bar/base/main.zeek
View file

@ -1,5 +0,0 @@
module LL_BAR;
redef LLAnalyzer::config_map += {
LLAnalyzer::ConfigEntry($parent=LLAnalyzer::LLANALYZER_ETHERNET, $identifier=1501, $analyzer=LLAnalyzer::LLANALYZER_BAR),
};

1
testing/btest/plugins/ll-protocol-plugin/scripts/__load__.zeek
View file

@ -1 +0,0 @@
@load LLDemo/Bar/base/main

0
testing/btest/plugins/ll-protocol-plugin/.btest-ignore → testing/btest/plugins/packet-protocol-plugin/.btest-ignore
View file

4
testing/btest/plugins/ll-protocol-plugin/CMakeLists.txt → testing/btest/plugins/packet-protocol-plugin/CMakeLists.txt
View file

@ -1,5 +1,5 @@
project(Zeek-LL-Plugin-Demo-Bar)
project(Zeek-Packet-Plugin-Demo-Bar)
cmake_minimum_required(VERSION 2.6.3)
@ -11,7 +11,7 @@ set(CMAKE_MODULE_PATH ${ZEEK_DIST}/cmake)
include(ZeekPlugin)
zeek_plugin_begin(LLDemo Bar)
zeek_plugin_begin(PacketDemo Bar)
zeek_plugin_cc(src/Plugin.cc)
zeek_plugin_cc(src/Bar.cc)
zeek_plugin_bif(src/events.bif)

5
testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/Bar/base/main.zeek Normal file
View file

@ -0,0 +1,5 @@
module Packet_BAR;
redef PacketAnalyzer::config_map += {
PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=1501, $analyzer=PacketAnalyzer::ANALYZER_BAR),
};

1
testing/btest/plugins/packet-protocol-plugin/scripts/__load__.zeek Normal file
View file

@ -0,0 +1 @@
@load PacketDemo/Bar/base/main

6
testing/btest/plugins/ll-protocol-plugin/src/Bar.cc → testing/btest/plugins/packet-protocol-plugin/src/Bar.cc
View file

@ -3,14 +3,14 @@
#include "Val.h"
#include "events.bif.h"
using namespace zeek::llanalyzer::LLDemo;
using namespace zeek::packet_analysis::PacketDemo;
Bar::Bar()
: zeek::llanalyzer::Analyzer("Bar")
: zeek::packet_analysis::Analyzer("Bar")
{
}
std::tuple<zeek::llanalyzer::AnalyzerResult, zeek::llanalyzer::identifier_t> Bar::Analyze(Packet* packet)
std::tuple<zeek::packet_analysis::AnalyzerResult, zeek::packet_analysis::identifier_t> Bar::Analyze(Packet* packet)
{
auto& pdata = packet->cur_pos;
auto end_of_data = packet->GetEndOfData();

6
testing/btest/plugins/ll-protocol-plugin/src/Bar.h → testing/btest/plugins/packet-protocol-plugin/src/Bar.h
View file

@ -1,9 +1,9 @@
#pragma once
#include <llanalyzer/Analyzer.h>
#include <llanalyzer/Component.h>
#include <packet_analysis/Analyzer.h>
#include <packet_analysis/Component.h>
namespace zeek::llanalyzer::LLDemo {
namespace zeek::packet_analysis::PacketDemo {
class Bar : public Analyzer {
public:

12
testing/btest/plugins/ll-protocol-plugin/src/Plugin.cc → testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc
View file

@ -1,21 +1,21 @@
#include "Plugin.h"
#include "llanalyzer/Component.h"
#include "packet_analysis/Component.h"
#include "Bar.h"
namespace zeek::plugin::LLDemo_Bar {
namespace zeek::plugin::PacketDemo_Bar {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure()
{
AddComponent(new zeek::llanalyzer::Component("Bar",
zeek::llanalyzer::LLDemo::Bar::Instantiate));
AddComponent(new zeek::packet_analysis::Component("Bar",
zeek::packet_analysis::PacketDemo::Bar::Instantiate));
zeek::plugin::Configuration config;
config.name = "LLDemo::Bar";
config.description = "A Bar LL-test-analyzer.";
config.name = "PacketDemo::Bar";
config.description = "A Bar packet analyzer.";
config.version.major = 1;
config.version.minor = 0;
config.version.patch = 0;

0
testing/btest/plugins/ll-protocol-plugin/src/events.bif → testing/btest/plugins/packet-protocol-plugin/src/events.bif
View file

6
testing/btest/plugins/ll-protocol.zeek → testing/btest/plugins/packet-protocol.zeek
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: ${DIST}/auxil/zeek-aux/plugin-support/init-plugin -u . LLDemo Bar
# @TEST-EXEC: cp -r %DIR/ll-protocol-plugin/* .
# @TEST-EXEC: ${DIST}/auxil/zeek-aux/plugin-support/init-plugin -u . PacketDemo Bar
# @TEST-EXEC: cp -r %DIR/packet-protocol-plugin/* .
# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -NN LLDemo::Bar >>output
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -NN PacketDemo::Bar >>output
# @TEST-EXEC: echo === >>output
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -r $TRACES/raw_packets.trace %INPUT >>output
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff output