@@ -7,20 +7,75 @@ import zeek;
7
7
# which the data then follows subsequently. (This is just what our test trace
8
8
# happens to contain). Adapt as suitable.
9
9
public type Packet = unit {
10
- payload: bytes &size=19;
11
- protocol: uint16; # next-layer protocol, values need to be mapped to analyzers in Zeek scriptland
10
+ payload: bytes &eod;
12
11
13
12
on %done {
14
13
# Feed into Zeek's next-layer packet analysis.
15
- zeek::forward_packet(self.protocol );
14
+ zeek::forward_packet(self.payload );
16
15
}
17
16
};
18
17
19
- type WireType = enum {
20
- VARINT = 0x00,
21
- I64 = 0x01,
22
- LEN = 0x02,
23
- SGROUP = 0x03, # deprecated
24
- EGROUP = 0x04, # deprecated
25
- I32 = 0x05
18
+
19
+ # TODO:
20
+ # message := (tag value)*
21
+ type Message = unit {
22
+ };
23
+
24
+ # TODO:
25
+ # tag := (field << 3) bit-or wire_type;
26
+ # encoded as uint32 varint
27
+ type Tag = unit {
28
+ };
29
+
30
+ # TODO:
31
+ # value := varint for wire_type == VARINT,
32
+ # i32 for wire_type == I32,
33
+ # i64 for wire_type == I64,
34
+ # len-prefix for wire_type == LEN,
35
+ # <empty> for wire_type == SGROUP or EGROUP
36
+ type Value = unit {
37
+ };
38
+
39
+ # TODO:
40
+ # varint := int32 | int64 | uint32 | uint64 | bool | enum | sint32 | sint64;
41
+ # encoded as varints (sintN are ZigZag-encoded first)
42
+ type VarInt = unit {
43
+ };
44
+
45
+ # TODO:
46
+ # i32 := sfixed32 | fixed32 | float;
47
+ # encoded as 4-byte little-endian;
48
+ # memcpy of the equivalent C types (u?int32_t, float)
49
+ type I32 = unit {
50
+ };
51
+
52
+ # TODO:
53
+ # i64 := sfixed64 | fixed64 | double;
54
+ # encoded as 8-byte little-endian;
55
+ # memcpy of the equivalent C types (u?int64_t, double)
56
+ type I64 = unit {
57
+ };
58
+
59
+ # TODO:
60
+ # len-prefix := size (message | string | bytes | packed);
61
+ # size encoded as int32 varint
62
+ type LenPrefix = unit {
63
+ };
64
+
65
+ # TODO:
66
+ # string := valid UTF-8 string (e.g. ASCII);
67
+ # max 2GB of bytes
68
+ type String = unit {
69
+ };
70
+
71
+ # TODO:
72
+ # bytes := any sequence of 8-bit bytes;
73
+ # max 2GB of bytes
74
+ type Bytes = unit {
75
+ };
76
+
77
+ # TODO:
78
+ # packed := varint* | i32* | i64*,
79
+ # consecutive values of the type specified in `.proto`
80
+ type Packed = unit {
26
81
};
0 commit comments