Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix typos and a broken link in the file analysis doc

Browse source
This commit is contained in:
Daniel Thayer 2013-10-10 12:23:34 -05:00
parent 1a36031874
commit 0d712b35d8
1 changed files with 18 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/base/frameworks/files/main.bro
View file

@ -50,9 +50,9 @@ export {
## Connection UIDS over which the file was transferred. ## Connection UIDS over which the file was transferred.
conn_uids: set[string] &log; conn_uids: set[string] &log;
## An identification of the source of the file data. E.g. it may be ## An identification of the source of the file data. E.g. it
## a network protocol over which it was transferred, or a local file ## may be a network protocol over which it was transferred, or a
## path which was read, or some other input source. ## local file path which was read, or some other input source.
source: string &log &optional; source: string &log &optional;
## A value to represent the depth of this file in relation ## A value to represent the depth of this file in relation
@ -79,12 +79,12 @@ export {
## If the source of this file is a network connection, this field ## If the source of this file is a network connection, this field
## indicates if the data originated from the local network or not as ## indicates if the data originated from the local network or not as
## determined by the configured bro:see:`Site::local_nets`. ## determined by the configured :bro:see:`Site::local_nets`.
local_orig: bool &log &optional; local_orig: bool &log &optional;
## If the source of this file is a network connection, this field ## If the source of this file is a network connection, this field
## indicates if the file is being sent by the originator of the connection ## indicates if the file is being sent by the originator of the
## or the responder. ## connection or the responder.
is_orig: bool &log &optional; is_orig: bool &log &optional;
## Number of bytes provided to the file analysis engine for the file. ## Number of bytes provided to the file analysis engine for the file.
@ -116,15 +116,15 @@ export {
## The salt concatenated to unique file handle strings generated by ## The salt concatenated to unique file handle strings generated by
## :bro:see:`get_file_handle` before hashing them in to a file id ## :bro:see:`get_file_handle` before hashing them in to a file id
## (the *id* field of :bro:see:`fa_file`). ## (the *id* field of :bro:see:`fa_file`).
## Provided to help mitigate the possiblility of manipulating parts of ## Provided to help mitigate the possibility of manipulating parts of
## network connections that factor in to the file handle in order to ## network connections that factor in to the file handle in order to
## generate two handles that would hash to the same file id. ## generate two handles that would hash to the same file id.
const salt = "I recommend changing this." &redef; const salt = "I recommend changing this." &redef;
## Sets the *timeout_interval* field of :bro:see:`fa_file`, which is ## Sets the *timeout_interval* field of :bro:see:`fa_file`, which is
## used to determine the length of inactivity that is allowed for a file ## used to determine the length of inactivity that is allowed for a file
## before internal state related to it is cleaned up. When used within a ## before internal state related to it is cleaned up. When used within
## :bro:see:`file_timeout` handler, the analysis will delay timing out ## a :bro:see:`file_timeout` handler, the analysis will delay timing out
## again for the period specified by *t*. ## again for the period specified by *t*.
## ##
## f: the file. ## f: the file.
@ -167,11 +167,12 @@ export {
## f: the file. ## f: the file.
## ##
## Returns: true if analysis for the given file will be ignored for the ## Returns: true if analysis for the given file will be ignored for the
## rest of it's contents, or false if analysis for the *id* ## rest of its contents, or false if analysis for the *id*
## isn't currently active. ## isn't currently active.
global stop: function(f: fa_file): bool; global stop: function(f: fa_file): bool;
## Translates an file analyzer enum value to a string with the analyzer's name. ## Translates a file analyzer enum value to a string with the analyzer's
## name.
## ##
## tag: The analyzer tag. ## tag: The analyzer tag.
## ##
@ -183,7 +184,7 @@ export {
## ##
## f: The file to be described. ## f: The file to be described.
## ##
## Returns a text description regarding metadata of the file. ## Returns: a text description regarding metadata of the file.
global describe: function(f: fa_file): string; global describe: function(f: fa_file): string;
type ProtoRegistration: record { type ProtoRegistration: record {
@ -198,7 +199,7 @@ export {
&default=function(f: fa_file): string { return ""; }; &default=function(f: fa_file): string { return ""; };
}; };
## Register callbacks for protocols that work with the Files framework. ## Register callbacks for protocols that work with the Files framework.
## The callbacks must uniquely identify a file and each protocol can ## The callbacks must uniquely identify a file and each protocol can
## only have a single callback registered for it. ## only have a single callback registered for it.
## ##
@ -209,10 +210,10 @@ export {
## Returns: true if the protocol being registered was not previously registered. ## Returns: true if the protocol being registered was not previously registered.
global register_protocol: function(tag: Analyzer::Tag, reg: ProtoRegistration): bool; global register_protocol: function(tag: Analyzer::Tag, reg: ProtoRegistration): bool;
## Register a callback for file analyzers to use if they need to do some manipulation ## Register a callback for file analyzers to use if they need to do some
## when they are being added to a file before the core code takes over. This is ## manipulation when they are being added to a file before the core code
## unlikely to be interesting for users and should only be called by file analyzer ## takes over. This is unlikely to be interesting for users and should
## authors but it *not required*. ## only be called by file analyzer authors but is *not required*.
## ##
## tag: Tag for the file analyzer. ## tag: Tag for the file analyzer.
## ##