Hi there,
I’m trying to create a new protocol analyzer as a plugin but stumble to get it running. I run into following exception:
/home/user/plugin/build///lib/plugin-Test.linux-x86_64.so did not instantiate a plugin
This is my code:
Plugin.cc
#include “zeek/plugin/Plugin.h”
#include “zeek/analyzer/Component.h”
#include “Test.h”
namespace zeek::plugin::Test_Plugin {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override {
AddComponent(new zeek::analyzer::Component(“Test”, zeek::analyzer::Test::Test_Analyzer::Instantiate));
zeek::plugin::Configuration config;
config.name = “Plugin::Test_Analyzer”;
config.description = “”;
config.version.major = 1;
config.version.minor = 0;
return config;
}
} plugin;
}
Test.h
#pragma once
#include <stdio.h>
#include <zeek/analyzer/protocol/tcp/TCP.h>
#include <zeek/analyzer/Analyzer.h>
typedef unsigned char u_char;
typedef unsigned short u_int16;
typedef short int16;
typedef unsigned int u_int32;
typedef int int32;
namespace zeek::analyzer { namespace Test {
class Test_Analyzer : public analyzer::tcp::TCP_ApplicationAnalyzer {
public:
Test_Analyzer(Connection* conn);
virtual ~Test_Analyzer();
virtual void Done();
virtual void Init();
virtual void DeliverStream(int len, const u_char* data, bool orig);
static Analyzer* Instantiate(Connection* conn)
{
return new Test_Analyzer(conn);
}
protected:
int offset;
};
} } //end namespaces
I followed the guide on how to develop a plugin and looked up some other analyzer in Github, it compiles without error or warning but when I run zeek -N it runs into this error. I even recompiled Zeek, but that didn’t help.
Thanks!
Dane
PS: Sorry for crossposting in zeek-dev-mailing list. I thought that was the right one…