From 64efa4a038cdcbf17e0d1586c36d876312665b22 Mon Sep 17 00:00:00 2001 From: Evan Typanski Date: Wed, 7 Aug 2024 13:53:12 -0400 Subject: [PATCH] Fix up some minor spicy tutorial docs --- devel/spicy/tutorial.rst | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/devel/spicy/tutorial.rst b/devel/spicy/tutorial.rst index 1a100b2d4..e72220e9c 100644 --- a/devel/spicy/tutorial.rst +++ b/devel/spicy/tutorial.rst @@ -24,7 +24,7 @@ package with a skeleton of everything needed for an analyzer. Before proceeding, make sure that your Zeek comes with Spicy support built-in---which is the default since Zeek version 5.0:: - # zeek - N Zeek::Spicy + # zeek -N Zeek::Spicy Zeek::Spicy - Support for Spicy parsers (*.hlto) (built-in) You should also have ``spicyz`` in your ``PATH``:: @@ -82,7 +82,7 @@ protocol analyzer. We follow the same scheme here and put the following into ``tftp.evt``, the analyzer definition file: .. literalinclude:: autogen/tftp.evt - :lines: 3-5 + :lines: 5-7 :language: spicy-evt The first line provides our analyzer with a Zeek-side name @@ -184,7 +184,7 @@ unit parameter, we can easily separate the two by gating event generation through an additional ``if`` condition: .. literalinclude:: autogen/tftp.evt - :lines: 9-10 + :lines: 11-12 :language: spicy-evt This now defines two separate events, each being generated only for @@ -208,8 +208,16 @@ function that Spicy makes available once we have successfully parsed a request: :spicylink:`spicy::accept_input `. That function signals the host application---i.e., Zeek in our case—--that the parser is -processing the expected protocol. With that, our request looks like -this now: +processing the expected protocol. + +First, we need to make sure the Spicy standard library is imported +in ``tftp.spicy``, so that we will have its functions available: + +.. code:: + + import spicy; + +With that, our request looks like this now: .. code-block:: @@ -241,7 +249,7 @@ events for them as well. The following is our complete ``tftp.evt`` file: .. literalinclude:: autogen/tftp.evt - :lines: 3- + :lines: 5- :language: spicy-evt