Wire it up: Enable iterative testing of the parser

[TnekRex]

Description:

Updated the code base so iterative testing can be performed while the parser portion of the application is being developed. The code base now:

• by-passes integration with Zeek as this can happen once parsing of the protobuf protocol has been figured out.
• leverages spicy-driver to execute the parser. See Command section below
• takes as input just the protobuf data portion of the protobuf_udp_addressbook.pcapng packet capture. See file the Input Data section below as well as the test-data/protobuf_udp_addressbook.raw in the code base.
• temporarily just prints out the bytes received as input. Further parser development is required.

Command:

spicy-driver ./analyzer/protobuf.spicy -f ./test-data/protobuf_udp_addressbook.raw
[$payload=[$message=b"\x0aB\x0a\x05Jason\x10\xe9\x07\x1a\[email protected]\"\x0c\x0a\x0887561234\x10\x01\"\x0d\x0a\x0b13588886666*\x06\x08\xa1\x8b\x97\xfc\x05\x0a:\x0a\x04Lily\x10\xea\x07\x1a\[email protected]\"\x0c\x0a\x0862858875\x10\x01\"\x0f\x0a\x0b18822228888\x10\x02"]]

Input Data:

$ hexdump -C ./test-data/protobuf_udp_addressbook.raw

00000000  0a 42 0a 05 4a 61 73 6f  6e 10 e9 07 1a 11 4a 61  |.B..Jason.....Ja|
00000010  73 6f 6e 40 65 78 61 6d  70 6c 65 2e 63 6f 6d 22  |[email protected]"|
00000020  0c 0a 08 38 37 35 36 31  32 33 34 10 01 22 0d 0a  |...87561234.."..|
00000030  0b 31 33 35 38 38 38 38  36 36 36 36 2a 06 08 a1  |.13588886666*...|
00000040  8b 97 fc 05 0a 3a 0a 04  4c 69 6c 79 10 ea 07 1a  |.....:..Lily....|
00000050  10 4c 69 6c 79 40 65 78  61 6d 70 6c 65 2e 63 6f  |[email protected]|
00000060  6d 22 0c 0a 08 36 32 38  35 38 38 37 35 10 01 22  |m"...62858875.."|
00000070  0f 0a 0b 31 38 38 32 32  32 32 38 38 38 38 10 02  |...18822228888..|
00000080

Wireshark - source of input data

References:

• https://wiki.wireshark.org/Protobuf
• https://ask.wireshark.org/question/15787/how-to-decode-protobuf-by-wireshark/