Renamed LL-Analyzers to Packet Analyzers.

testing/btest/plugins/packet-protocol-plugin/CMakeLists.txt

@@ -0,0 +1,18 @@
+
+project(Zeek-Packet-Plugin-Demo-Bar)
+
+cmake_minimum_required(VERSION 2.6.3)
+
+if ( NOT ZEEK_DIST )
+    message(FATAL_ERROR "ZEEK_DIST not set")
+endif ()
+
+set(CMAKE_MODULE_PATH ${ZEEK_DIST}/cmake)
+
+include(ZeekPlugin)
+
+zeek_plugin_begin(PacketDemo Bar)
+zeek_plugin_cc(src/Plugin.cc)
+zeek_plugin_cc(src/Bar.cc)
+zeek_plugin_bif(src/events.bif)
+zeek_plugin_end()

testing/btest/plugins/packet-protocol-plugin/scripts/PacketDemo/Bar/base/main.zeek

@@ -0,0 +1,5 @@
+module Packet_BAR;
+
+redef PacketAnalyzer::config_map += {
+	PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_ETHERNET, $identifier=1501, $analyzer=PacketAnalyzer::ANALYZER_BAR),
+};

testing/btest/plugins/packet-protocol-plugin/scripts/__load__.zeek

@@ -0,0 +1 @@
+@load PacketDemo/Bar/base/main

testing/btest/plugins/packet-protocol-plugin/src/Bar.cc

@@ -0,0 +1,35 @@
+#include "Bar.h"
+#include "Event.h"
+#include "Val.h"
+#include "events.bif.h"
+
+using namespace zeek::packet_analysis::PacketDemo;
+
+Bar::Bar()
+	: zeek::packet_analysis::Analyzer("Bar")
+	{
+	}
+
+std::tuple<zeek::packet_analysis::AnalyzerResult, zeek::packet_analysis::identifier_t> Bar::Analyze(Packet* packet)
+	{
+	auto& pdata = packet->cur_pos;
+	auto end_of_data = packet->GetEndOfData();
+
+	// Rudimentary parsing of 802.2 LLC
+	if ( pdata + 17 >= end_of_data )
+		{
+		packet->Weird("truncated_llc_header");
+		return { AnalyzerResult::Failed, 0 };
+		}
+
+	auto dsap = pdata[14];
+	auto ssap = pdata[15];
+	auto control = pdata[16];
+
+	mgr.Enqueue(bar_message,
+		val_mgr->Count(dsap),
+		val_mgr->Count(ssap),
+		val_mgr->Count(control));
+
+	return std::make_tuple(AnalyzerResult::Terminate, 0);
+	}

testing/btest/plugins/packet-protocol-plugin/src/Bar.h

@@ -0,0 +1,22 @@
+#pragma once
+
+#include <packet_analysis/Analyzer.h>
+#include <packet_analysis/Component.h>
+
+namespace zeek::packet_analysis::PacketDemo {
+
+class Bar : public Analyzer {
+public:
+	Bar();
+	~Bar() override = default;
+
+	std::tuple<AnalyzerResult, identifier_t> Analyze(Packet* packet) override;
+
+	static Analyzer* Instantiate()
+		{
+		return new Bar();
+		}
+};
+
+}
+

testing/btest/plugins/packet-protocol-plugin/src/Plugin.cc

@@ -0,0 +1,27 @@
+
+#include "Plugin.h"
+#include "packet_analysis/Component.h"
+
+#include "Bar.h"
+
+namespace zeek::plugin::PacketDemo_Bar {
+
+class Plugin : public zeek::plugin::Plugin {
+public:
+	zeek::plugin::Configuration Configure()
+		{
+		AddComponent(new zeek::packet_analysis::Component("Bar",
+		                 zeek::packet_analysis::PacketDemo::Bar::Instantiate));
+
+		zeek::plugin::Configuration config;
+		config.name = "PacketDemo::Bar";
+		config.description = "A Bar packet analyzer.";
+		config.version.major = 1;
+		config.version.minor = 0;
+		config.version.patch = 0;
+		return config;
+		}
+
+} plugin;
+
+}

testing/btest/plugins/packet-protocol-plugin/src/events.bif

@@ -0,0 +1,2 @@
+
+event bar_message%(dsap: count, ssap: count, control: count%);