zeek/src/analyzer/protocol/mysql/mysql-analyzer.pac

refine flow MySQL_Flow += {
	function proc_mysql_handshakev10(msg: Handshake_v10): bool
		%{
		if ( mysql_server_version ) 
			BifEvent::generate_mysql_server_version(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
								bytestring_to_val(${msg.server_version}));
		connection()->bro_analyzer()->ProtocolConfirmation();
		return true;
		%}

	function proc_mysql_handshake_response_packet(msg: Handshake_Response_Packet): bool
		%{
		if ( mysql_handshake_response )
			{
			if ( ${msg.version} == 10 )
				BifEvent::generate_mysql_handshake_response(connection()->bro_analyzer(), 
									    connection()->bro_analyzer()->Conn(),
								    	    bytestring_to_val(${msg.v10_response.username}));
			if ( ${msg.version} == 9 )
				BifEvent::generate_mysql_handshake_response(connection()->bro_analyzer(), 
									    connection()->bro_analyzer()->Conn(),
								    	    bytestring_to_val(${msg.v9_response.username}));
			}
		return true;
		%}

	function proc_mysql_command_request_packet(msg: Command_Request_Packet): bool
		%{
		if ( mysql_command_request )
			BifEvent::generate_mysql_command_request(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
								${msg.command}, bytestring_to_val(${msg.arg}));
		return true;
		%}

	function proc_err_packet(msg: ERR_Packet): bool
		%{
		if ( mysql_error )
			BifEvent::generate_mysql_error(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
						       ${msg.code}, bytestring_to_val(${msg.msg}));
		return true;
		%}

	function proc_ok_packet(msg: OK_Packet): bool
		%{
		if ( mysql_ok )
			BifEvent::generate_mysql_ok(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.rows});
		return true;
		%}
	
	function proc_resultset(msg: Resultset): bool
		%{
		if ( mysql_command_response )
			BifEvent::generate_mysql_command_response(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.rows}->size());
		return true;
		%}

};

refine typeattr Handshake_v10 += &let {
	proc = $context.flow.proc_mysql_handshakev10(this);
};

refine typeattr Handshake_Response_Packet += &let {
	proc = $context.flow.proc_mysql_handshake_response_packet(this);
};

refine typeattr Command_Request_Packet += &let {
	proc = $context.flow.proc_mysql_command_request_packet(this);
};

refine typeattr ERR_Packet += &let {
	proc = $context.flow.proc_err_packet(this);
};

refine typeattr OK_Packet += &let {
	proc = $context.flow.proc_ok_packet(this);
};

refine typeattr Resultset += &let {
	debug = $context.flow.proc_resultset(this);
};