[Bro] Confusing binPAC error...

Dane Wullen brot212 at googlemail.com
Wed Oct 19 04:45:11 PDT 2016


Hi there,

I've tried to implement a little test analyzer to detect TCP payload 
with 2 bytes in it, just to know how binpac works.

Here's my protocol.pac:

type t_header = record {
     b1 : uint8;
     b2 : uint8;
}

type TEST_PDU(is_orig: bool) = record {
     data : t_header;
} &byteorder = bigendian

Here's my analyzer.pac

refine flow TEST_Flow += {
     function proc_test_message(msg: TEST_PDU): bool
         %{
         printf("Read TEST_PDU\n");
BifEvent::generate_test_event(connection()->bro_analyzer(), 
connection()->bro_analyzer()->Conn());
         return true;
         %}
};

refine typeattr TEST_PDU += &let {
     proc: bool = $context.flow.proc_test_message(this);
};

Everything works fine, but when I want to print my byte-values ( 
printf("Val 1: %d, Val 2: %d, Val 3: %d", ${msg.b1}, ${msg.b2}, 
${msg.b3}); ),
I get an error while making the file which says that " 'b1' undeclared".
Even if I put an if-statement to check if those values are undeclared ( 
if( ${msg.b1} != NULL && ${msg.b2} != NULL && ${msg.b3} != NULL)),
I still get the same error.
Can someone help me? :D Or tell me how to proper use C++ code in binPAC?

Thanks!



More information about the Bro mailing list