diff --git a/analyzer/protobuf.spicy b/analyzer/protobuf.spicy index 013610a..daa326d 100644 --- a/analyzer/protobuf.spicy +++ b/analyzer/protobuf.spicy @@ -1,29 +1,21 @@ module protobuf; -import zeek; - public type Packet = unit { payload: Message; on %done { - # Feed into Zeek's next-layer packet analysis. - - # KBK HERE - Comment out so we can build - #zeek::forward_packet(self.payload); + print self; } }; # message := (tag value)* # A message is encoded as a sequence of zero or more pairs of tags and values. - -# -# KBK - This should parse a sequence of zero or more TagAndValue pairs until end-of-data. -# type Message = unit { - message: TagAndValue[] &eod; # <==== KBK HERE + message: bytes &eod; + #message: TagAndValue[] &eod; }; -type TagAndValue = unit { # <==== KBK HERE +type TagAndValue = unit { tag: Tag; value: Value; }; diff --git a/test-data/protobuf_udp_addressbook.raw b/test-data/protobuf_udp_addressbook.raw new file mode 100644 index 0000000..c1d4c5f --- /dev/null +++ b/test-data/protobuf_udp_addressbook.raw @@ -0,0 +1,9 @@ + +B +JasonéJason@example.com" +87561234" + 13588886666*¡‹—ü +: +LilyêLily@example.com" +62858875" + 18822228888 \ No newline at end of file diff --git a/testing/Traces/protobuf_tcp_addressbook.pcapng b/testing/Traces/protobuf_tcp_addressbook.pcapng new file mode 100644 index 0000000..d65ca9d Binary files /dev/null and b/testing/Traces/protobuf_tcp_addressbook.pcapng differ diff --git a/testing/Traces/protobuf_udp_addressbook.pcapng b/testing/Traces/protobuf_udp_addressbook.pcapng new file mode 100644 index 0000000..f7af0a8 Binary files /dev/null and b/testing/Traces/protobuf_udp_addressbook.pcapng differ