// See the file "COPYING" in the main distribution directory for copyright.

#pragma once

#include "zeek/analyzer/protocol/rpc/RPC.h"

namespace zeek::analyzer::rpc {
namespace detail {

class MOUNT_Interp : public RPC_Interpreter {
public:
    explicit MOUNT_Interp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) {}

protected:
    bool RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) override;
    bool RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, const u_char*& buf, int& n, double start_time,
                        double last_time, int reply_len) override;

    // Returns a new arg list that already has a conn_val, rpc_status and
    // mount_status. These are the first parameters for each mount_* event
    // ...
    Args event_common_vl(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, BifEnum::MOUNT3::status_t mount_status,
                         double rep_start_time, double rep_last_time, int reply_len, int extra_elements);

    // These methods parse the appropriate MOUNTv3 "type" out of buf. If
    // there are any errors (i.e., buffer to short, etc), buf will be set
    // to 0. However, the methods might still return an allocated Val * !
    // So, you might want to Unref() the Val if buf is 0. Method names
    // are based on the type names of RFC 1813.
    EnumValPtr mount3_auth_flavor(const u_char*& buf, int& n);
    StringValPtr mount3_fh(const u_char*& buf, int& n);
    RecordValPtr mount3_dirmntargs(const u_char*& buf, int& n);
    StringValPtr mount3_filename(const u_char*& buf, int& n);

    RecordValPtr mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status);
};

} // namespace detail

class MOUNT_Analyzer : public RPC_Analyzer {
public:
    explicit MOUNT_Analyzer(Connection* conn);
    void Init() override;

    static analyzer::Analyzer* Instantiate(Connection* conn) { return new MOUNT_Analyzer(conn); }
};

} // namespace zeek::analyzer::rpc
