Commit graph

2 commits

Author SHA1 Message Date
Jon Siwek
995368e68c Remove variable content from weird names
This changes many weird names to move non-static content from the
weird name into the "addl" field to help ensure the total number of
weird names is reasonably bounded.  Note the net_weird and flow_weird
events do not have an "addl" parameter, so information may no longer
be available in those cases -- to make it available again we'd need
to either (1) define new events that contain such a parameter, or
(2) change net_weird/flow_weird event signature (which is a breaking
change for user-code at the moment).

Also, the generic handling of binpac exceptions for analyzers which
to not otherwise catch and handle them has been changed from a Weird
to a ProtocolViolation.

Finally, a new "file_weird" event has been added for reporting
weirdness found during file analysis.
2019-04-01 18:30:11 -07:00
Jon Siwek
defed7b6f3 Adjustments to modbus test cases.
- Added a test for binpac exception handling -- the generated code
  should use "binpac::Exception" and not "Exception" for exception
  handling logic to avoid accidental overshadowing by
  the analyzer-specific type "binpac::ModbusTCP::Exception", which
  could lead to interesting asserts being triggered in binpac.

- Update baseline for the event coverage test -- seems that more
  events get generated with working exception handling in the generated
  binpac parser code.

- Coverage baseline was giving wrong number of events covered.
2012-11-12 11:51:42 -06:00