Hi there,
I'm trying to create a new protocol analyzer as a plugin but stumble to get it running. I run into following exception:
/home/user/plugin/build///lib/plugin-Test.linux-x86_64.so did not instantiate a plugin
This is my code:
Plugin.cc
#include "zeek/plugin/Plugin.h"
#include "zeek/analyzer/Component.h"
#include "Test.h"
namespace zeek::plugin::Test_Plugin {
class Plugin : public zeek::plugin::Plugin \{
public:
zeek::plugin::Configuration Configure\(\) override \{
AddComponent\(new zeek::analyzer::Component\("Test", zeek::analyzer::Test::Test\_Analyzer::Instantiate\)\);
zeek::plugin::Configuration config;
config\.name = "Plugin::Test\_Analyzer";
config\.description = "<Beep Boop>";
config\.version\.major = 1;
config\.version\.minor = 0;
return config;
\}
\} plugin;
}
Test.h
#pragma once
#include <stdio.h>
#include <zeek/analyzer/protocol/tcp/TCP.h>
#include <zeek/analyzer/Analyzer.h>
typedef unsigned char u_char;
typedef unsigned short u_int16;
typedef short int16;
typedef unsigned int u_int32;
typedef int int32;
namespace zeek::analyzer { namespace Test {
class Test\_Analyzer : public analyzer::tcp::TCP\_ApplicationAnalyzer \{
public:
Test\_Analyzer\(Connection\* conn\);
virtual \~Test\_Analyzer\(\);
virtual void Done\(\);
virtual void Init\(\);
virtual void DeliverStream\(int len, const u\_char\* data, bool orig\);
static Analyzer\* Instantiate\(Connection\* conn\)
\{
return new Test\_Analyzer\(conn\);
\}
protected:
int offset;
\};
} } //end namespaces
I followed the guide on how to develop a plugin and looked up some other analyzer in Github, it compiles without error or warning but when I run zeek -N it runs into this error. I even recompiled Zeek, but that didn't help.
Thanks!
Dane