mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 00:58:19 +00:00
Remove the 'net' type from Bro (addresses #535).
Incremented the serialization data format version in the process.
This commit is contained in:
parent
82f94881c0
commit
1730496d12
28 changed files with 20 additions and 227 deletions
|
@ -615,10 +615,6 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
|
||||||
pval = new AddrVal(addr_val);
|
pval = new AddrVal(addr_val);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case TYPE_NET:
|
|
||||||
pval = new NetVal(addr_val);
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
default:
|
||||||
reporter->InternalError("bad internal address in CompositeHash::RecoverOneVal()");
|
reporter->InternalError("bad internal address in CompositeHash::RecoverOneVal()");
|
||||||
pval = 0;
|
pval = 0;
|
||||||
|
|
|
@ -2046,7 +2046,6 @@ EqExpr::EqExpr(BroExprTag arg_tag, Expr* arg_op1, Expr* arg_op2)
|
||||||
case TYPE_STRING:
|
case TYPE_STRING:
|
||||||
case TYPE_PORT:
|
case TYPE_PORT:
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_SUBNET:
|
case TYPE_SUBNET:
|
||||||
case TYPE_ERROR:
|
case TYPE_ERROR:
|
||||||
break;
|
break;
|
||||||
|
|
|
@ -122,7 +122,6 @@ bool LogVal::IsCompatibleType(BroType* t, bool atomic_only)
|
||||||
case TYPE_COUNTER:
|
case TYPE_COUNTER:
|
||||||
case TYPE_PORT:
|
case TYPE_PORT:
|
||||||
case TYPE_SUBNET:
|
case TYPE_SUBNET:
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_DOUBLE:
|
case TYPE_DOUBLE:
|
||||||
case TYPE_TIME:
|
case TYPE_TIME:
|
||||||
|
@ -205,7 +204,6 @@ bool LogVal::Read(SerializationFormat* fmt)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
{
|
{
|
||||||
uint32 addr[4];
|
uint32 addr[4];
|
||||||
|
@ -319,7 +317,6 @@ bool LogVal::Write(SerializationFormat* fmt) const
|
||||||
fmt->Write(val.subnet_val.width, "width");
|
fmt->Write(val.subnet_val.width, "width");
|
||||||
}
|
}
|
||||||
|
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
{
|
{
|
||||||
uint32 addr[4];
|
uint32 addr[4];
|
||||||
|
@ -1051,7 +1048,6 @@ LogVal* LogMgr::ValToLogVal(Val* val, BroType* ty)
|
||||||
lval->val.subnet_val = *val->AsSubNet();
|
lval->val.subnet_val = *val->AsSubNet();
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
{
|
{
|
||||||
addr_type t = val->AsAddr();
|
addr_type t = val->AsAddr();
|
||||||
|
|
|
@ -136,7 +136,6 @@ bool LogWriterAscii::DoWriteOne(ODesc* desc, LogVal* val, const LogField* field)
|
||||||
desc->Add(val->val.subnet_val.width);
|
desc->Add(val->val.subnet_val.width);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
desc->Add(dotted_addr(val->val.addr_val));
|
desc->Add(dotted_addr(val->val.addr_val));
|
||||||
break;
|
break;
|
||||||
|
|
|
@ -91,16 +91,15 @@ SERIAL_VAL(VAL, 1)
|
||||||
SERIAL_VAL(INTERVAL_VAL, 2)
|
SERIAL_VAL(INTERVAL_VAL, 2)
|
||||||
SERIAL_VAL(PORT_VAL, 3)
|
SERIAL_VAL(PORT_VAL, 3)
|
||||||
SERIAL_VAL(ADDR_VAL, 4)
|
SERIAL_VAL(ADDR_VAL, 4)
|
||||||
SERIAL_VAL(NET_VAL, 5)
|
SERIAL_VAL(SUBNET_VAL, 5)
|
||||||
SERIAL_VAL(SUBNET_VAL, 6)
|
SERIAL_VAL(STRING_VAL, 6)
|
||||||
SERIAL_VAL(STRING_VAL, 7)
|
SERIAL_VAL(PATTERN_VAL, 7)
|
||||||
SERIAL_VAL(PATTERN_VAL, 8)
|
SERIAL_VAL(LIST_VAL, 8)
|
||||||
SERIAL_VAL(LIST_VAL, 9)
|
SERIAL_VAL(TABLE_VAL, 9)
|
||||||
SERIAL_VAL(TABLE_VAL, 10)
|
SERIAL_VAL(RECORD_VAL, 10)
|
||||||
SERIAL_VAL(RECORD_VAL, 11)
|
SERIAL_VAL(ENUM_VAL, 11)
|
||||||
SERIAL_VAL(ENUM_VAL, 12)
|
SERIAL_VAL(VECTOR_VAL, 12)
|
||||||
SERIAL_VAL(VECTOR_VAL, 13)
|
SERIAL_VAL(MUTABLE_VAL, 13)
|
||||||
SERIAL_VAL(MUTABLE_VAL, 14)
|
|
||||||
|
|
||||||
#define SERIAL_EXPR(name, val) SERIAL_CONST(name, val, EXPR)
|
#define SERIAL_EXPR(name, val) SERIAL_CONST(name, val, EXPR)
|
||||||
SERIAL_EXPR(EXPR, 1)
|
SERIAL_EXPR(EXPR, 1)
|
||||||
|
|
|
@ -123,7 +123,7 @@ protected:
|
||||||
|
|
||||||
// This will be increased whenever there is an incompatible change
|
// This will be increased whenever there is an incompatible change
|
||||||
// in the data format.
|
// in the data format.
|
||||||
static const uint32 DATA_FORMAT_VERSION = 19;
|
static const uint32 DATA_FORMAT_VERSION = 20;
|
||||||
|
|
||||||
ChunkedIO* io;
|
ChunkedIO* io;
|
||||||
|
|
||||||
|
|
|
@ -28,7 +28,7 @@ const char* type_name(TypeTag t)
|
||||||
"string", "pattern",
|
"string", "pattern",
|
||||||
"enum",
|
"enum",
|
||||||
"timer",
|
"timer",
|
||||||
"port", "addr", "net", "subnet",
|
"port", "addr", "subnet",
|
||||||
"any",
|
"any",
|
||||||
"table", "union", "record", "types",
|
"table", "union", "record", "types",
|
||||||
"func",
|
"func",
|
||||||
|
@ -86,7 +86,6 @@ BroType::BroType(TypeTag t, bool arg_base_type)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_NET:
|
|
||||||
internal_tag = TYPE_INTERNAL_ADDR;
|
internal_tag = TYPE_INTERNAL_ADDR;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
@ -1687,7 +1686,6 @@ int same_type(const BroType* t1, const BroType* t2, int is_init)
|
||||||
case TYPE_TIMER:
|
case TYPE_TIMER:
|
||||||
case TYPE_PORT:
|
case TYPE_PORT:
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_SUBNET:
|
case TYPE_SUBNET:
|
||||||
case TYPE_ANY:
|
case TYPE_ANY:
|
||||||
case TYPE_ERROR:
|
case TYPE_ERROR:
|
||||||
|
@ -1863,7 +1861,6 @@ int is_assignable(BroType* t)
|
||||||
case TYPE_TIMER:
|
case TYPE_TIMER:
|
||||||
case TYPE_PORT:
|
case TYPE_PORT:
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_SUBNET:
|
case TYPE_SUBNET:
|
||||||
case TYPE_RECORD:
|
case TYPE_RECORD:
|
||||||
case TYPE_FUNC:
|
case TYPE_FUNC:
|
||||||
|
@ -1941,7 +1938,6 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
|
||||||
case TYPE_TIMER:
|
case TYPE_TIMER:
|
||||||
case TYPE_PORT:
|
case TYPE_PORT:
|
||||||
case TYPE_ADDR:
|
case TYPE_ADDR:
|
||||||
case TYPE_NET:
|
|
||||||
case TYPE_SUBNET:
|
case TYPE_SUBNET:
|
||||||
case TYPE_BOOL:
|
case TYPE_BOOL:
|
||||||
case TYPE_ANY:
|
case TYPE_ANY:
|
||||||
|
|
|
@ -23,7 +23,7 @@ typedef enum {
|
||||||
TYPE_STRING, TYPE_PATTERN,
|
TYPE_STRING, TYPE_PATTERN,
|
||||||
TYPE_ENUM,
|
TYPE_ENUM,
|
||||||
TYPE_TIMER,
|
TYPE_TIMER,
|
||||||
TYPE_PORT, TYPE_ADDR, TYPE_NET, TYPE_SUBNET,
|
TYPE_PORT, TYPE_ADDR, TYPE_SUBNET,
|
||||||
TYPE_ANY,
|
TYPE_ANY,
|
||||||
TYPE_TABLE,
|
TYPE_TABLE,
|
||||||
TYPE_UNION,
|
TYPE_UNION,
|
||||||
|
|
78
src/Val.cc
78
src/Val.cc
|
@ -1099,84 +1099,6 @@ static uint32 parse_dotted(const char* text, int& dots)
|
||||||
return a;
|
return a;
|
||||||
}
|
}
|
||||||
|
|
||||||
NetVal::NetVal(const char* text) : AddrVal(TYPE_NET)
|
|
||||||
{
|
|
||||||
int dots;
|
|
||||||
uint32 a = parse_dotted(text, dots);
|
|
||||||
|
|
||||||
if ( addr_to_net(a) != a )
|
|
||||||
reporter->Error("bad net address", text);
|
|
||||||
|
|
||||||
Init(uint32(htonl(a)));
|
|
||||||
}
|
|
||||||
|
|
||||||
NetVal::NetVal(uint32 addr) : AddrVal(TYPE_NET)
|
|
||||||
{
|
|
||||||
Init(addr);
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef BROv6
|
|
||||||
NetVal::NetVal(const uint32* addr) : AddrVal(TYPE_NET)
|
|
||||||
{
|
|
||||||
Init(addr);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
Val* NetVal::SizeVal() const
|
|
||||||
{
|
|
||||||
uint32 addr;
|
|
||||||
|
|
||||||
#ifdef BROv6
|
|
||||||
if ( ! is_v4_addr(val.addr_val) )
|
|
||||||
{
|
|
||||||
Error("|net| for IPv6 addresses not supported");
|
|
||||||
return new Val(0.0, TYPE_DOUBLE);
|
|
||||||
}
|
|
||||||
|
|
||||||
addr = to_v4_addr(val.addr_val);
|
|
||||||
#else
|
|
||||||
addr = val.addr_val;
|
|
||||||
#endif
|
|
||||||
addr = ntohl(addr);
|
|
||||||
|
|
||||||
if ( (addr & 0xFFFFFFFF) == 0L )
|
|
||||||
return new Val(4294967296.0, TYPE_DOUBLE);
|
|
||||||
|
|
||||||
if ( (addr & 0x00FFFFFF) == 0L )
|
|
||||||
return new Val(double(0xFFFFFF + 1), TYPE_DOUBLE);
|
|
||||||
|
|
||||||
if ( (addr & 0x0000FFFF) == 0L )
|
|
||||||
return new Val(double(0xFFFF + 1), TYPE_DOUBLE);
|
|
||||||
|
|
||||||
if ( (addr & 0x000000FF) == 0L )
|
|
||||||
return new Val(double(0xFF + 1), TYPE_DOUBLE);
|
|
||||||
|
|
||||||
return new Val(1.0, TYPE_DOUBLE);
|
|
||||||
}
|
|
||||||
|
|
||||||
void NetVal::ValDescribe(ODesc* d) const
|
|
||||||
{
|
|
||||||
#ifdef BROv6
|
|
||||||
d->Add(dotted_net6(val.addr_val));
|
|
||||||
#else
|
|
||||||
d->Add(dotted_net(val.addr_val));
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
IMPLEMENT_SERIAL(NetVal, SER_NET_VAL);
|
|
||||||
|
|
||||||
bool NetVal::DoSerialize(SerialInfo* info) const
|
|
||||||
{
|
|
||||||
DO_SERIALIZE(SER_NET_VAL, AddrVal);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
bool NetVal::DoUnserialize(UnserialInfo* info)
|
|
||||||
{
|
|
||||||
DO_UNSERIALIZE(AddrVal);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
SubNetVal::SubNetVal(const char* text) : Val(TYPE_SUBNET)
|
SubNetVal::SubNetVal(const char* text) : Val(TYPE_SUBNET)
|
||||||
{
|
{
|
||||||
const char* sep = strchr(text, '/');
|
const char* sep = strchr(text, '/');
|
||||||
|
|
22
src/Val.h
22
src/Val.h
|
@ -30,7 +30,6 @@ class SerialInfo;
|
||||||
|
|
||||||
class PortVal;
|
class PortVal;
|
||||||
class AddrVal;
|
class AddrVal;
|
||||||
class NetVal;
|
|
||||||
class SubNetVal;
|
class SubNetVal;
|
||||||
|
|
||||||
class IntervalVal;
|
class IntervalVal;
|
||||||
|
@ -244,7 +243,7 @@ public:
|
||||||
// ... in network byte order
|
// ... in network byte order
|
||||||
const addr_type AsAddr() const
|
const addr_type AsAddr() const
|
||||||
{
|
{
|
||||||
if ( type->Tag() != TYPE_ADDR && type->Tag() != TYPE_NET )
|
if ( type->Tag() != TYPE_ADDR )
|
||||||
BadTag("Val::AsAddr", type_name(type->Tag()));
|
BadTag("Val::AsAddr", type_name(type->Tag()));
|
||||||
return val.addr_val;
|
return val.addr_val;
|
||||||
}
|
}
|
||||||
|
@ -284,7 +283,6 @@ public:
|
||||||
|
|
||||||
CONVERTER(TYPE_PATTERN, PatternVal*, AsPatternVal)
|
CONVERTER(TYPE_PATTERN, PatternVal*, AsPatternVal)
|
||||||
CONVERTER(TYPE_PORT, PortVal*, AsPortVal)
|
CONVERTER(TYPE_PORT, PortVal*, AsPortVal)
|
||||||
CONVERTER(TYPE_NET, NetVal*, AsNetVal)
|
|
||||||
CONVERTER(TYPE_SUBNET, SubNetVal*, AsSubNetVal)
|
CONVERTER(TYPE_SUBNET, SubNetVal*, AsSubNetVal)
|
||||||
CONVERTER(TYPE_TABLE, TableVal*, AsTableVal)
|
CONVERTER(TYPE_TABLE, TableVal*, AsTableVal)
|
||||||
CONVERTER(TYPE_RECORD, RecordVal*, AsRecordVal)
|
CONVERTER(TYPE_RECORD, RecordVal*, AsRecordVal)
|
||||||
|
@ -302,7 +300,6 @@ public:
|
||||||
|
|
||||||
CONST_CONVERTER(TYPE_PATTERN, PatternVal*, AsPatternVal)
|
CONST_CONVERTER(TYPE_PATTERN, PatternVal*, AsPatternVal)
|
||||||
CONST_CONVERTER(TYPE_PORT, PortVal*, AsPortVal)
|
CONST_CONVERTER(TYPE_PORT, PortVal*, AsPortVal)
|
||||||
CONST_CONVERTER(TYPE_NET, NetVal*, AsNetVal)
|
|
||||||
CONST_CONVERTER(TYPE_SUBNET, SubNetVal*, AsSubNetVal)
|
CONST_CONVERTER(TYPE_SUBNET, SubNetVal*, AsSubNetVal)
|
||||||
CONST_CONVERTER(TYPE_TABLE, TableVal*, AsTableVal)
|
CONST_CONVERTER(TYPE_TABLE, TableVal*, AsTableVal)
|
||||||
CONST_CONVERTER(TYPE_RECORD, RecordVal*, AsRecordVal)
|
CONST_CONVERTER(TYPE_RECORD, RecordVal*, AsRecordVal)
|
||||||
|
@ -575,23 +572,6 @@ protected:
|
||||||
DECLARE_SERIAL(AddrVal);
|
DECLARE_SERIAL(AddrVal);
|
||||||
};
|
};
|
||||||
|
|
||||||
class NetVal : public AddrVal {
|
|
||||||
public:
|
|
||||||
NetVal(const char* text);
|
|
||||||
NetVal(uint32 addr);
|
|
||||||
NetVal(const uint32* addr);
|
|
||||||
|
|
||||||
Val* SizeVal() const;
|
|
||||||
|
|
||||||
protected:
|
|
||||||
friend class Val;
|
|
||||||
NetVal() {}
|
|
||||||
|
|
||||||
void ValDescribe(ODesc* d) const;
|
|
||||||
|
|
||||||
DECLARE_SERIAL(NetVal);
|
|
||||||
};
|
|
||||||
|
|
||||||
class SubNetVal : public Val {
|
class SubNetVal : public Val {
|
||||||
public:
|
public:
|
||||||
SubNetVal(const char* text);
|
SubNetVal(const char* text);
|
||||||
|
|
|
@ -12,7 +12,6 @@ DEFINE_BIF_TYPE(TYPE_DOUBLE, "double", "double", "double", "%s->AsDouble()",
|
||||||
DEFINE_BIF_TYPE(TYPE_FILE, "file", "file", "BroFile*", "%s->AsFile()", "new Val(%s)")
|
DEFINE_BIF_TYPE(TYPE_FILE, "file", "file", "BroFile*", "%s->AsFile()", "new Val(%s)")
|
||||||
DEFINE_BIF_TYPE(TYPE_INT, "int", "int", "bro_int_t", "%s->AsInt()", "new Val(%s, TYPE_BOOL)")
|
DEFINE_BIF_TYPE(TYPE_INT, "int", "int", "bro_int_t", "%s->AsInt()", "new Val(%s, TYPE_BOOL)")
|
||||||
DEFINE_BIF_TYPE(TYPE_INTERVAL, "interval", "interval", "double", "%s->AsInterval()", "new IntervalVal(%s, Seconds)")
|
DEFINE_BIF_TYPE(TYPE_INTERVAL, "interval", "interval", "double", "%s->AsInterval()", "new IntervalVal(%s, Seconds)")
|
||||||
DEFINE_BIF_TYPE(TYPE_NET, "net", "net", "addr_type", "%s->AsAddr()", "new NetVal(%s)")
|
|
||||||
DEFINE_BIF_TYPE(TYPE_PACKET, "packet", "packet", "TCP_TracePacket*", "%s->AsRecordVal()->GetOrigin()", "%s->PacketVal()")
|
DEFINE_BIF_TYPE(TYPE_PACKET, "packet", "packet", "TCP_TracePacket*", "%s->AsRecordVal()->GetOrigin()", "%s->PacketVal()")
|
||||||
DEFINE_BIF_TYPE(TYPE_PATTERN, "pattern", "pattern", "RE_Matcher*", "%s->AsPattern()", "new PatternVal(%s)")
|
DEFINE_BIF_TYPE(TYPE_PATTERN, "pattern", "pattern", "RE_Matcher*", "%s->AsPattern()", "new PatternVal(%s)")
|
||||||
// DEFINE_BIF_TYPE(TYPE_PORT, "port", "port", "uint32", "%s->AsPortVal()->Port()", "incomplete data")
|
// DEFINE_BIF_TYPE(TYPE_PORT, "port", "port", "uint32", "%s->AsPortVal()->Port()", "incomplete data")
|
||||||
|
|
60
src/bro.bif
60
src/bro.bif
|
@ -588,53 +588,6 @@ function raw_bytes_to_v4_addr%(b: string%): addr
|
||||||
return new AddrVal(htonl(a));
|
return new AddrVal(htonl(a));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function to_net%(a: addr%): net
|
|
||||||
%{
|
|
||||||
#ifdef BROv6
|
|
||||||
if ( ! is_v4_addr(a) )
|
|
||||||
{
|
|
||||||
builtin_error("conversion of non-IPv4 address to net", @ARG@[0]);
|
|
||||||
return new NetVal(uint32(0));
|
|
||||||
}
|
|
||||||
|
|
||||||
uint32 addr = to_v4_addr(a);
|
|
||||||
#else
|
|
||||||
uint32 addr = a;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
addr = htonl(addr_to_net(ntohl(addr)));
|
|
||||||
|
|
||||||
return new NetVal(addr);
|
|
||||||
%}
|
|
||||||
|
|
||||||
function net_to_subnet%(a: net%): subnet
|
|
||||||
%{
|
|
||||||
#ifdef BROv6
|
|
||||||
if ( ! is_v4_addr(a) )
|
|
||||||
{
|
|
||||||
builtin_error("conversion of non-IPv4 address to subnet", @ARG@[0]);
|
|
||||||
return new SubNetVal(uint32(0), 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
uint32 addr = to_v4_addr(a);
|
|
||||||
#else
|
|
||||||
uint32 addr = a;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
switch ( addr_to_class(ntohl(addr)) ) {
|
|
||||||
case 'A':
|
|
||||||
return new SubNetVal(addr, 8);
|
|
||||||
case 'B':
|
|
||||||
return new SubNetVal(addr, 16);
|
|
||||||
case 'C':
|
|
||||||
case 'D':
|
|
||||||
return new SubNetVal(addr, 24);
|
|
||||||
|
|
||||||
default:
|
|
||||||
return new SubNetVal(addr, 0);
|
|
||||||
}
|
|
||||||
%}
|
|
||||||
|
|
||||||
function to_port%(num: count, proto: transport_proto%): port
|
function to_port%(num: count, proto: transport_proto%): port
|
||||||
%{
|
%{
|
||||||
return new PortVal(num, (TransportProto)proto->AsEnum());
|
return new PortVal(num, (TransportProto)proto->AsEnum());
|
||||||
|
@ -1740,19 +1693,6 @@ function preserve_subnet%(a: subnet%): any
|
||||||
return 0;
|
return 0;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function preserve_net%(a: net%): any
|
|
||||||
%{
|
|
||||||
#ifdef BROv6
|
|
||||||
builtin_error("preserve_net() not supported with --enable-BROv6");
|
|
||||||
#else
|
|
||||||
AnonymizeIPAddr* ip_anon = ip_anonymizer[PREFIX_PRESERVING_A50];
|
|
||||||
if ( ip_anon )
|
|
||||||
ip_anon->PreserveNet(a);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
%}
|
|
||||||
|
|
||||||
# Anonymize given IP address.
|
# Anonymize given IP address.
|
||||||
function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
|
function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
|
||||||
%{
|
%{
|
||||||
|
|
|
@ -11,7 +11,7 @@
|
||||||
%token TOK_CONSTANT TOK_COPY TOK_COUNT TOK_COUNTER TOK_DEFAULT TOK_DELETE
|
%token TOK_CONSTANT TOK_COPY TOK_COUNT TOK_COUNTER TOK_DEFAULT TOK_DELETE
|
||||||
%token TOK_DOUBLE TOK_ELSE TOK_ENUM TOK_EVENT TOK_EXPORT TOK_FILE TOK_FOR
|
%token TOK_DOUBLE TOK_ELSE TOK_ENUM TOK_EVENT TOK_EXPORT TOK_FILE TOK_FOR
|
||||||
%token TOK_FUNCTION TOK_GLOBAL TOK_ID TOK_IF TOK_INT
|
%token TOK_FUNCTION TOK_GLOBAL TOK_ID TOK_IF TOK_INT
|
||||||
%token TOK_INTERVAL TOK_LIST TOK_LOCAL TOK_MODULE TOK_MATCH TOK_NET
|
%token TOK_INTERVAL TOK_LIST TOK_LOCAL TOK_MODULE TOK_MATCH
|
||||||
%token TOK_NEXT TOK_OF TOK_PATTERN TOK_PATTERN_TEXT
|
%token TOK_NEXT TOK_OF TOK_PATTERN TOK_PATTERN_TEXT
|
||||||
%token TOK_PORT TOK_PRINT TOK_RECORD TOK_REDEF
|
%token TOK_PORT TOK_PRINT TOK_RECORD TOK_REDEF
|
||||||
%token TOK_REMOVE_FROM TOK_RETURN TOK_SCHEDULE TOK_SET
|
%token TOK_REMOVE_FROM TOK_RETURN TOK_SCHEDULE TOK_SET
|
||||||
|
@ -787,11 +787,6 @@ type:
|
||||||
$$ = base_type(TYPE_ADDR);
|
$$ = base_type(TYPE_ADDR);
|
||||||
}
|
}
|
||||||
|
|
||||||
| TOK_NET {
|
|
||||||
set_location(@1);
|
|
||||||
$$ = base_type(TYPE_NET);
|
|
||||||
}
|
|
||||||
|
|
||||||
| TOK_SUBNET {
|
| TOK_SUBNET {
|
||||||
set_location(@1);
|
set_location(@1);
|
||||||
$$ = base_type(TYPE_SUBNET);
|
$$ = base_type(TYPE_SUBNET);
|
||||||
|
|
|
@ -265,7 +265,6 @@ list return TOK_LIST;
|
||||||
local return TOK_LOCAL;
|
local return TOK_LOCAL;
|
||||||
match return TOK_MATCH;
|
match return TOK_MATCH;
|
||||||
module return TOK_MODULE;
|
module return TOK_MODULE;
|
||||||
net return TOK_NET;
|
|
||||||
next return TOK_NEXT;
|
next return TOK_NEXT;
|
||||||
of return TOK_OF;
|
of return TOK_OF;
|
||||||
pattern return TOK_PATTERN;
|
pattern return TOK_PATTERN;
|
||||||
|
@ -439,8 +438,6 @@ F RET_CONST(new Val(false, TYPE_BOOL))
|
||||||
RET_CONST(new PortVal(p, TRANSPORT_UNKNOWN))
|
RET_CONST(new PortVal(p, TRANSPORT_UNKNOWN))
|
||||||
}
|
}
|
||||||
|
|
||||||
{D}"."{D}"." RET_CONST(new NetVal(yytext))
|
|
||||||
({D}"."){2}{D} RET_CONST(new NetVal(yytext))
|
|
||||||
({D}"."){3}{D} RET_CONST(new AddrVal(yytext))
|
({D}"."){3}{D} RET_CONST(new AddrVal(yytext))
|
||||||
|
|
||||||
({HEX}:){7}{HEX} RET_CONST(new AddrVal(yytext))
|
({HEX}:){7}{HEX} RET_CONST(new AddrVal(yytext))
|
||||||
|
|
|
@ -4,7 +4,6 @@ Hallihallo
|
||||||
1.2.3.4
|
1.2.3.4
|
||||||
1.2.0.0/16
|
1.2.0.0/16
|
||||||
3.14
|
3.14
|
||||||
131.159
|
|
||||||
42.0 secs
|
42.0 secs
|
||||||
{
|
{
|
||||||
[2] = uiop,
|
[2] = uiop,
|
||||||
|
|
|
@ -4,7 +4,6 @@ Hallihallo
|
||||||
1.2.3.4
|
1.2.3.4
|
||||||
1.2.0.0/16
|
1.2.0.0/16
|
||||||
3.14
|
3.14
|
||||||
131.159
|
|
||||||
42.0 secs
|
42.0 secs
|
||||||
{
|
{
|
||||||
[2] = uiop,
|
[2] = uiop,
|
||||||
|
|
|
@ -1,14 +1,13 @@
|
||||||
==== atomic
|
==== atomic
|
||||||
-10
|
-10
|
||||||
2
|
2
|
||||||
1311279327.7675
|
1313624487.48817
|
||||||
2.0 mins
|
2.0 mins
|
||||||
F
|
F
|
||||||
1.5
|
1.5
|
||||||
Servus
|
Servus
|
||||||
5555/tcp
|
5555/tcp
|
||||||
6.7.6.5
|
6.7.6.5
|
||||||
0.0
|
|
||||||
192.168.0.0/16
|
192.168.0.0/16
|
||||||
==== record
|
==== record
|
||||||
[a=42, b=6.6.7.7]
|
[a=42, b=6.6.7.7]
|
||||||
|
|
|
@ -1,38 +1,35 @@
|
||||||
==== atomic a 1 ====
|
==== atomic a 1 ====
|
||||||
-4L -4
|
-4L -4
|
||||||
42 42
|
42 42
|
||||||
1311279327.7680
|
1313624487.4889
|
||||||
60.0
|
60.0
|
||||||
True True
|
True True
|
||||||
3.14
|
3.14
|
||||||
'Hurz' Hurz
|
'Hurz' Hurz
|
||||||
'12345/udp' 12345/udp
|
'12345/udp' 12345/udp
|
||||||
'1.2.3.4' 1.2.3.4
|
'1.2.3.4' 1.2.3.4
|
||||||
'X.X.X' X.X.X
|
|
||||||
'22.33.44.0/24' 22.33.44.0/24
|
'22.33.44.0/24' 22.33.44.0/24
|
||||||
==== atomic a 2 ====
|
==== atomic a 2 ====
|
||||||
-10L -10
|
-10L -10
|
||||||
2 2
|
2 2
|
||||||
1311279327.7675
|
1313624487.4882
|
||||||
120.0
|
120.0
|
||||||
False False
|
False False
|
||||||
1.5
|
1.5
|
||||||
'Servus' Servus
|
'Servus' Servus
|
||||||
'5555/tcp' 5555/tcp
|
'5555/tcp' 5555/tcp
|
||||||
'6.7.6.5' 6.7.6.5
|
'6.7.6.5' 6.7.6.5
|
||||||
'X.X.X' X.X.X
|
|
||||||
'192.168.0.0/16' 192.168.0.0/16
|
'192.168.0.0/16' 192.168.0.0/16
|
||||||
==== atomic b 2 ====
|
==== atomic b 2 ====
|
||||||
-10L -10
|
-10L -10
|
||||||
<broccoli.count instance at > 2
|
<broccoli.count instance at > 2
|
||||||
<broccoli.time instance at > 1311279327.7675
|
<broccoli.time instance at > 1313624487.4882
|
||||||
<broccoli.interval instance at > 120.0
|
<broccoli.interval instance at > 120.0
|
||||||
False False
|
False False
|
||||||
1.5
|
1.5
|
||||||
'Servus' Servus
|
'Servus' Servus
|
||||||
<broccoli.port instance at > 5555/tcp
|
<broccoli.port instance at > 5555/tcp
|
||||||
<broccoli.addr instance at > 6.7.6.5
|
<broccoli.addr instance at > 6.7.6.5
|
||||||
<broccoli.net instance at > X.X.X
|
|
||||||
<broccoli.subnet instance at > 192.168.0.0/16
|
<broccoli.subnet instance at > 192.168.0.0/16
|
||||||
==== record 1 ====
|
==== record 1 ====
|
||||||
<broccoli.record instance at >
|
<broccoli.record instance at >
|
||||||
|
|
|
@ -4,7 +4,6 @@ Jodel
|
||||||
4.3.2.1
|
4.3.2.1
|
||||||
4.0.0.0/8
|
4.0.0.0/8
|
||||||
21.0
|
21.0
|
||||||
192.150.186
|
|
||||||
42.0 secs
|
42.0 secs
|
||||||
{
|
{
|
||||||
[1] = asdfg2,
|
[1] = asdfg2,
|
||||||
|
|
|
@ -4,7 +4,6 @@ Jodel
|
||||||
4.3.2.1
|
4.3.2.1
|
||||||
4.0.0.0/8
|
4.0.0.0/8
|
||||||
21.0
|
21.0
|
||||||
192.150.186
|
|
||||||
42.0 secs
|
42.0 secs
|
||||||
{
|
{
|
||||||
[1] = asdfg2,
|
[1] = asdfg2,
|
||||||
|
|
|
@ -7,7 +7,6 @@ File 21.000000
|
||||||
Function add_interface: 2
|
Function add_interface: 2
|
||||||
Integer -10: 10
|
Integer -10: 10
|
||||||
Interval -5.0 secs: 5.000000
|
Interval -5.0 secs: 5.000000
|
||||||
Net 192.168.0: 65536.000000
|
|
||||||
Port 80/tcp: 65616
|
Port 80/tcp: 65616
|
||||||
Record [i=10, j=<uninitialized>, k=<uninitialized>]: 3
|
Record [i=10, j=<uninitialized>, k=<uninitialized>]: 3
|
||||||
Set: 3
|
Set: 3
|
||||||
|
|
|
@ -1,2 +1,2 @@
|
||||||
# b i e c p sn n a d t iv s sc ss se vc ve
|
# b i e c p sn a d t iv s sc ss se vc ve
|
||||||
T -42 Test::TEST 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1312565184.899030 100.0 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
|
T -42 Test::TEST 21 123 10.0.0.0/24 1.2.3.4 3.14 1313623666.027768 100.0 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY
|
||||||
|
|
Binary file not shown.
|
@ -18,7 +18,6 @@ event bro_done()
|
||||||
print out, foo4;
|
print out, foo4;
|
||||||
print out, foo5;
|
print out, foo5;
|
||||||
print out, foo6;
|
print out, foo6;
|
||||||
print out, foo7;
|
|
||||||
print out, foo8;
|
print out, foo8;
|
||||||
print out, foo9;
|
print out, foo9;
|
||||||
print out, foo10;
|
print out, foo10;
|
||||||
|
@ -43,7 +42,6 @@ global foo3: string &persistent &synchronized;
|
||||||
global foo4: addr &persistent &synchronized;
|
global foo4: addr &persistent &synchronized;
|
||||||
global foo5: subnet &persistent &synchronized;
|
global foo5: subnet &persistent &synchronized;
|
||||||
global foo6: double &persistent &synchronized;
|
global foo6: double &persistent &synchronized;
|
||||||
global foo7: net &persistent &synchronized;
|
|
||||||
global foo8: interval &persistent &synchronized;
|
global foo8: interval &persistent &synchronized;
|
||||||
global foo9: table[count] of string &persistent &synchronized;
|
global foo9: table[count] of string &persistent &synchronized;
|
||||||
global foo10: file &persistent &synchronized;
|
global foo10: file &persistent &synchronized;
|
||||||
|
@ -79,7 +77,6 @@ global foo3 = "Hallihallo" &persistent &synchronized;
|
||||||
global foo4 = 1.2.3.4 &persistent &synchronized;
|
global foo4 = 1.2.3.4 &persistent &synchronized;
|
||||||
global foo5 = 1.2.0.0/16 &persistent &synchronized;
|
global foo5 = 1.2.0.0/16 &persistent &synchronized;
|
||||||
global foo6 = 3.14 &persistent &synchronized;
|
global foo6 = 3.14 &persistent &synchronized;
|
||||||
global foo7 = 131.159. &persistent &synchronized;
|
|
||||||
global foo8 = 42 secs &persistent &synchronized;
|
global foo8 = 42 secs &persistent &synchronized;
|
||||||
global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
|
global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
|
||||||
global foo10 = open("test") &persistent &synchronized;
|
global foo10 = open("test") &persistent &synchronized;
|
||||||
|
|
|
@ -17,7 +17,6 @@ global foo3 = "Hallihallo" &persistent &synchronized;
|
||||||
global foo4 = 1.2.3.4 &persistent &synchronized;
|
global foo4 = 1.2.3.4 &persistent &synchronized;
|
||||||
global foo5 = 1.2.0.0/16 &persistent &synchronized;
|
global foo5 = 1.2.0.0/16 &persistent &synchronized;
|
||||||
global foo6 = 3.14 &persistent &synchronized;
|
global foo6 = 3.14 &persistent &synchronized;
|
||||||
global foo7 = 131.159. &persistent &synchronized;
|
|
||||||
global foo8 = 42 secs &persistent &synchronized;
|
global foo8 = 42 secs &persistent &synchronized;
|
||||||
global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
|
global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
|
||||||
global foo10 = open("test") &persistent &synchronized;
|
global foo10 = open("test") &persistent &synchronized;
|
||||||
|
@ -60,7 +59,6 @@ event bro_done()
|
||||||
print out, foo4;
|
print out, foo4;
|
||||||
print out, foo5;
|
print out, foo5;
|
||||||
print out, foo6;
|
print out, foo6;
|
||||||
print out, foo7;
|
|
||||||
print out, foo8;
|
print out, foo8;
|
||||||
print out, foo9;
|
print out, foo9;
|
||||||
print out, foo10;
|
print out, foo10;
|
||||||
|
@ -93,8 +91,6 @@ function modify()
|
||||||
|
|
||||||
foo6 = 21;
|
foo6 = 21;
|
||||||
|
|
||||||
foo7 = 192.150.186;
|
|
||||||
|
|
||||||
foo9[3] = "asdfg1";
|
foo9[3] = "asdfg1";
|
||||||
foo9[1] = "asdfg2";
|
foo9[1] = "asdfg2";
|
||||||
delete foo9[2];
|
delete foo9[2];
|
||||||
|
|
|
@ -26,7 +26,6 @@ global d: double = -1.23;
|
||||||
global f: file = open_log_file("sizeof_demo");
|
global f: file = open_log_file("sizeof_demo");
|
||||||
global i: int = -10;
|
global i: int = -10;
|
||||||
global iv: interval = -5sec;
|
global iv: interval = -5sec;
|
||||||
global n: net = 192.168.;
|
|
||||||
global p: port = 80/tcp;
|
global p: port = 80/tcp;
|
||||||
global r: example_record [ $i = 10 ];
|
global r: example_record [ $i = 10 ];
|
||||||
global si: set[int];
|
global si: set[int];
|
||||||
|
@ -82,10 +81,6 @@ print fmt("Integer %s: %d", i, |i|);
|
||||||
# Size of interval: returns double representation of the interval
|
# Size of interval: returns double representation of the interval
|
||||||
print fmt("Interval %s: %f", iv, |iv|);
|
print fmt("Interval %s: %f", iv, |iv|);
|
||||||
|
|
||||||
# Size of net: returns size of class N network as a double
|
|
||||||
# (so that 2^32 can be expressed too).
|
|
||||||
print fmt("Net %s: %f", n, |n|);
|
|
||||||
|
|
||||||
# Size of port: returns port number as a count.
|
# Size of port: returns port number as a count.
|
||||||
print fmt("Port %s: %d", p, |p|);
|
print fmt("Port %s: %d", p, |p|);
|
||||||
|
|
||||||
|
|
|
@ -24,7 +24,6 @@ export {
|
||||||
c: count;
|
c: count;
|
||||||
p: port;
|
p: port;
|
||||||
sn: subnet;
|
sn: subnet;
|
||||||
n: net;
|
|
||||||
a: addr;
|
a: addr;
|
||||||
d: double;
|
d: double;
|
||||||
t: time;
|
t: time;
|
||||||
|
@ -63,7 +62,6 @@ event remote_connection_handshake_done(p: event_peer)
|
||||||
$c=21,
|
$c=21,
|
||||||
$p=123/tcp,
|
$p=123/tcp,
|
||||||
$sn=10.0.0.1/24,
|
$sn=10.0.0.1/24,
|
||||||
$n=10.0.,
|
|
||||||
$a=1.2.3.4,
|
$a=1.2.3.4,
|
||||||
$d=3.14,
|
$d=3.14,
|
||||||
$t=network_time(),
|
$t=network_time(),
|
||||||
|
|
|
@ -18,7 +18,6 @@ export {
|
||||||
c: count;
|
c: count;
|
||||||
p: port;
|
p: port;
|
||||||
sn: subnet;
|
sn: subnet;
|
||||||
n: net;
|
|
||||||
a: addr;
|
a: addr;
|
||||||
d: double;
|
d: double;
|
||||||
t: time;
|
t: time;
|
||||||
|
@ -55,7 +54,6 @@ event bro_init()
|
||||||
$c=21,
|
$c=21,
|
||||||
$p=123/tcp,
|
$p=123/tcp,
|
||||||
$sn=10.0.0.1/24,
|
$sn=10.0.0.1/24,
|
||||||
$n=10.0.,
|
|
||||||
$a=1.2.3.4,
|
$a=1.2.3.4,
|
||||||
$d=3.14,
|
$d=3.14,
|
||||||
$t=network_time(),
|
$t=network_time(),
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue