mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
a2ae9c4b02
This extends the ability to feed new payload back into Zeek's analyzer pipeline from TCP to now also UDP. Note: We don't extend this further to ICMP because the ICMP analyzer cannot be dynamically instantiated (Zeek aborts when trying so). As ICMP isn't very interesting from use-case perspective anyways, that seems fine. Closes #3561.
59 lines
1.6 KiB
Text
59 lines
1.6 KiB
Text
# @TEST-REQUIRES: have-spicy
|
|
#
|
|
# @TEST-EXEC: spicyz -d -o test.hlto test.evt test.spicy
|
|
# @TEST-EXEC: zeek -B dpd -s test.sig -r ${TRACES}/ssh/single-conn.trace test.hlto %INPUT Spicy::enable_print=T >&2
|
|
# @TEST-EXEC: btest-diff syslog.log
|
|
|
|
event zeek_init() {
|
|
Analyzer::register_for_port(Analyzer::ANALYZER_SPICY_SSH, 22/tcp);
|
|
}
|
|
|
|
# @TEST-START-FILE test.sig
|
|
signature dpd_syslog {
|
|
payload /.*C1/
|
|
enable "Syslog"
|
|
}
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE test.spicy
|
|
module Test;
|
|
|
|
import spicy;
|
|
import zeek;
|
|
|
|
public type Foo = unit {
|
|
};
|
|
|
|
on Foo::%init {
|
|
# Specify analyzer.
|
|
zeek::protocol_begin("Syslog", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(True, b"A1 orig", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(False, b"A1 resp", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(True, b"A2 orig", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(False, b"A2 resp", spicy::Protocol::UDP);
|
|
zeek::protocol_end();
|
|
|
|
# Use explicit handle.
|
|
local syslog = zeek::protocol_handle_get_or_create("syslog", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(True, b"B1 orig", syslog);
|
|
zeek::protocol_data_in(False, b"B1 resp", syslog);
|
|
zeek::protocol_handle_close(syslog);
|
|
|
|
# DPD.
|
|
zeek::protocol_begin(spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(True, b"C1 orig", spicy::Protocol::UDP);
|
|
zeek::protocol_data_in(False, b"C1 resp", spicy::Protocol::UDP);
|
|
zeek::protocol_end();
|
|
|
|
}
|
|
# @TEST-END-FILE
|
|
|
|
# @TEST-START-FILE test.evt
|
|
|
|
import zeek;
|
|
|
|
protocol analyzer spicy::SSH over TCP:
|
|
parse originator with Test::Foo,
|
|
replaces SSH;
|
|
|
|
# @TEST-END-FILE
|