From 5383e8f75bae11bc5da30acf0b77493b90e5f71c Mon Sep 17 00:00:00 2001
From: Matthias Vallentin <vallentin@icir.org>
Date: Wed, 24 Jul 2013 11:21:10 +0200
Subject: [PATCH 01/10] Add bloomfilter_clear() BiF.

---
 src/OpaqueVal.cc                   |  5 +++++
 src/OpaqueVal.h                    |  1 +
 src/probabilistic/BloomFilter.cc   | 10 ++++++++++
 src/probabilistic/BloomFilter.h    | 11 +++++++++++
 src/probabilistic/CounterVector.cc |  5 +++++
 src/probabilistic/CounterVector.h  |  5 +++++
 src/probabilistic/bloom-filter.bif | 16 ++++++++++++++++
 7 files changed, 53 insertions(+)

diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index efdd890f70..19a372c005 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -578,6 +578,11 @@ size_t BloomFilterVal::Count(const Val* val) const
 	return cnt;
 	}
 
+void BloomFilterVal::Clear()
+	{
+	bloom_filter->Clear();
+	}
+
 BloomFilterVal* BloomFilterVal::Merge(const BloomFilterVal* x,
                                       const BloomFilterVal* y)
 	{
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index ea704cb70a..cfb184fc77 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -125,6 +125,7 @@ public:
 
 	void Add(const Val* val);
 	size_t Count(const Val* val) const;
+	void Clear();
 
 	static BloomFilterVal* Merge(const BloomFilterVal* x,
 				     const BloomFilterVal* y);
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index 5613dcce05..c78cd4193d 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -74,6 +74,11 @@ size_t BasicBloomFilter::K(size_t cells, size_t capacity)
 	return std::ceil(frac * std::log(2));
 	}
 
+void BasicBloomFilter::Clear()
+	{
+	bits->Clear();
+	}
+
 BasicBloomFilter* BasicBloomFilter::Merge(const BasicBloomFilter* x,
                                           const BasicBloomFilter* y)
 	{
@@ -191,3 +196,8 @@ size_t CountingBloomFilter::CountImpl(const Hasher::digest_vector& h) const
 
 	return min;
 	}
+
+void CountingBloomFilter::Clear()
+	{
+	cells->Clear();
+	}
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 4a6b01c484..55bc76fca7 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -47,6 +47,11 @@ public:
 		return CountImpl((*hasher)(x));
 		}
 
+	/**
+	 * Removes all elements, i.e., resets all bits in the underlying bit vector.
+	 */
+	virtual void Clear() = 0;
+
 	/**
 	 * Serializes the Bloom filter.
 	 *
@@ -147,6 +152,9 @@ public:
 	 */
 	static size_t K(size_t cells, size_t capacity);
 
+	// Overridden from BloomFilter.
+	virtual void Clear();
+
 	/**
 	 * Merges two basic Bloom filters.
 	 *
@@ -188,6 +196,9 @@ public:
 	 */
 	CountingBloomFilter(const Hasher* hasher, size_t cells, size_t width);
 
+	// Overridden from BloomFilter.
+	virtual void Clear();
+
 	/**
 	 * Merges two counting Bloom filters.
 	 *
diff --git a/src/probabilistic/CounterVector.cc b/src/probabilistic/CounterVector.cc
index 570ed1f8ea..00fa7fb8c0 100644
--- a/src/probabilistic/CounterVector.cc
+++ b/src/probabilistic/CounterVector.cc
@@ -70,6 +70,11 @@ bool CounterVector::Decrement(size_type cell, count_type value)
 	return carry;
 	}
 
+void CounterVector::Clear()
+	{
+	bits->Clear();
+	}
+
 CounterVector::count_type CounterVector::Count(size_type cell) const
 	{
 	assert(cell < Size());
diff --git a/src/probabilistic/CounterVector.h b/src/probabilistic/CounterVector.h
index 178a68e8f2..896f98ef1e 100644
--- a/src/probabilistic/CounterVector.h
+++ b/src/probabilistic/CounterVector.h
@@ -77,6 +77,11 @@ public:
 	 */
 	count_type Count(size_type cell) const;
 
+	/**
+	 * Sets all counters to 0.
+	 */
+	void Clear();
+
 	/**
 	 * Retrieves the number of cells in the storage.
 	 *
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index cbbff85d7d..9df168be0e 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -121,6 +121,22 @@ function bloomfilter_lookup%(bf: opaque of bloomfilter, x: any%): count
 	return new Val(0, TYPE_COUNT);
 	%}
 
+## Removes all elements from a Bloom filter. This function sets resets all bits
+## in the underlying bitvector to 0 but does not change the parameterization of
+## the Bloom filter, such as the element type and the hasher seed.
+##
+## bf: The Bloom filter handle.
+function bloomfilter_clear%(bf: opaque of bloomfilter%): any
+	%{
+	BloomFilterVal* bfv = static_cast<BloomFilterVal*>(bf);
+
+	if ( bfv->Type() ) // Untyped Bloom filters are already empty.
+		bfv->Clear();
+
+	return 0;
+	%}
+
+
 ## Merges two Bloom filters.
 ##
 ## bf1: The first Bloom filter handle.

From 5736aef440574389dda6555642ee7e938156dcf1 Mon Sep 17 00:00:00 2001
From: Matthias Vallentin <vallentin@icir.org>
Date: Wed, 24 Jul 2013 13:05:38 +0200
Subject: [PATCH 02/10] Refactor Bloom filter merging.

---
 src/OpaqueVal.cc                 | 31 ++++++++---
 src/OpaqueVal.h                  | 22 --------
 src/probabilistic/BloomFilter.cc | 92 +++++++++++++++++++++++---------
 src/probabilistic/BloomFilter.h  | 36 +++++++------
 4 files changed, 109 insertions(+), 72 deletions(-)

diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index 19a372c005..feff4f3cc0 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -584,21 +584,36 @@ void BloomFilterVal::Clear()
 	}
 
 BloomFilterVal* BloomFilterVal::Merge(const BloomFilterVal* x,
-                                      const BloomFilterVal* y)
+		const BloomFilterVal* y)
 	{
 	if ( ! same_type(x->Type(), y->Type()) )
+		{
 		reporter->InternalError("cannot merge Bloom filters with different types");
+		return 0;
+		}
 
-	BloomFilterVal* result;
+	if ( typeid(*x->bloom_filter) != typeid(*y->bloom_filter) )
+		{
+		reporter->InternalError("cannot merge different Bloom filter types");
+		return 0;
+		}
 
-	if ( (result = DoMerge<probabilistic::BasicBloomFilter>(x, y)) )
-		return result;
+	probabilistic::BloomFilter* copy = x->bloom_filter->Clone();
+	bool success = copy->Merge(y->bloom_filter);
+	if ( ! success )
+		{
+		reporter->InternalError("failed to merge Bloom filter");
+		return 0;
+		}
 
-	else if ( (result = DoMerge<probabilistic::CountingBloomFilter>(x, y)) )
-		return result;
+	BloomFilterVal* merged = new BloomFilterVal(copy);
+	if ( ! merged->Typify(x->Type()) )
+		{
+		reporter->InternalError("failed to set type on merged Bloom filter");
+		return 0;
+		}
 
-	reporter->InternalError("failed to merge Bloom filters");
-	return 0;
+	return merged;
 	}
 
 BloomFilterVal::~BloomFilterVal()
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index cfb184fc77..360bb69803 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -142,28 +142,6 @@ private:
 	BloomFilterVal(const BloomFilterVal&);
 	BloomFilterVal& operator=(const BloomFilterVal&);
 
-	template <typename T>
-	static BloomFilterVal* DoMerge(const BloomFilterVal* x,
-				       const BloomFilterVal* y)
-		{
-		if ( typeid(*x->bloom_filter) != typeid(*y->bloom_filter) )
-			reporter->InternalError("cannot merge different Bloom filter types");
-
-		if ( typeid(T) != typeid(*x->bloom_filter) )
-			return 0;
-
-		const T* a = static_cast<const T*>(x->bloom_filter);
-		const T* b = static_cast<const T*>(y->bloom_filter);
-
-		BloomFilterVal* merged = new BloomFilterVal(T::Merge(a, b));
-		assert(merged);
-
-		if ( ! merged->Typify(x->Type()) )
-			reporter->InternalError("failed to set type on merged Bloom filter");
-
-		return merged;
-		}
-
 	BroType* type;
 	CompositeHash* hash;
 	probabilistic::BloomFilter* bloom_filter;
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index c78cd4193d..132cf376ec 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -79,17 +79,37 @@ void BasicBloomFilter::Clear()
 	bits->Clear();
 	}
 
-BasicBloomFilter* BasicBloomFilter::Merge(const BasicBloomFilter* x,
-                                          const BasicBloomFilter* y)
+bool BasicBloomFilter::Merge(const BloomFilter* other)
 	{
-	if ( ! x->hasher->Equals(y->hasher) )
-		reporter->InternalError("incompatible hashers during BasicBloomFilter merge");
+	if ( typeid(*this) != typeid(*other) )
+		return 0;
 
-	BasicBloomFilter* result = new BasicBloomFilter();
-	result->hasher = x->hasher->Clone();
-	result->bits = new BitVector(*x->bits | *y->bits);
+	const BasicBloomFilter* o = static_cast<const BasicBloomFilter*>(other);
 
-	return result;
+	if ( ! hasher->Equals(o->hasher) )
+		{
+		reporter->InternalError("incompatible hashers in BasicBloomFilter merge");
+		return false;
+		}
+	else if ( bits->Size() != o->bits->Size() )
+		{
+		reporter->InternalError("different bitvector size in BasicBloomFilter merge");
+		return false;
+		}
+
+	(*bits) |= *o->bits;
+
+	return true;
+	}
+
+BasicBloomFilter* BasicBloomFilter::Clone() const
+	{
+	BasicBloomFilter* copy = new BasicBloomFilter();
+
+	copy->hasher = hasher->Clone();
+	copy->bits = new BitVector(*bits);
+
+	return copy;
 	}
 
 BasicBloomFilter::BasicBloomFilter()
@@ -135,19 +155,6 @@ size_t BasicBloomFilter::CountImpl(const Hasher::digest_vector& h) const
 	return 1;
 	}
 
-CountingBloomFilter* CountingBloomFilter::Merge(const CountingBloomFilter* x,
-						const CountingBloomFilter* y)
-	{
-	if ( ! x->hasher->Equals(y->hasher) )
-		reporter->InternalError("incompatible hashers during CountingBloomFilter merge");
-
-	CountingBloomFilter* result = new CountingBloomFilter();
-	result->hasher = x->hasher->Clone();
-	result->cells = new CounterVector(*x->cells | *y->cells);
-
-	return result;
-	}
-
 CountingBloomFilter::CountingBloomFilter()
 	{
 	cells = 0;
@@ -160,6 +167,44 @@ CountingBloomFilter::CountingBloomFilter(const Hasher* hasher,
 	cells = new CounterVector(width, arg_cells);
 	}
 
+void CountingBloomFilter::Clear()
+	{
+	cells->Clear();
+	}
+
+bool CountingBloomFilter::Merge(const BloomFilter* other)
+	{
+	if ( typeid(*this) != typeid(*other) )
+		return 0;
+
+	const CountingBloomFilter* o = static_cast<const CountingBloomFilter*>(other);
+
+	if ( ! hasher->Equals(o->hasher) )
+		{
+		reporter->InternalError("incompatible hashers in CountingBloomFilter merge");
+		return false;
+		}
+	else if ( cells->Size() != o->cells->Size() )
+		{
+		reporter->InternalError("different bitvector size in CountingBloomFilter merge");
+		return false;
+		}
+
+	(*cells) |= *o->cells;
+
+	return true;
+	}
+
+CountingBloomFilter* CountingBloomFilter::Clone() const
+	{
+	CountingBloomFilter* copy = new CountingBloomFilter();
+
+	copy->hasher = hasher->Clone();
+	copy->cells = new CounterVector(*cells);
+
+	return copy;
+	}
+
 IMPLEMENT_SERIAL(CountingBloomFilter, SER_COUNTINGBLOOMFILTER)
 
 bool CountingBloomFilter::DoSerialize(SerialInfo* info) const
@@ -196,8 +241,3 @@ size_t CountingBloomFilter::CountImpl(const Hasher::digest_vector& h) const
 
 	return min;
 	}
-
-void CountingBloomFilter::Clear()
-	{
-	cells->Clear();
-	}
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 55bc76fca7..2ab5b89941 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -52,6 +52,22 @@ public:
 	 */
 	virtual void Clear() = 0;
 
+	/**
+	 * Merges another Bloom filter into a copy of this one.
+	 *
+	 * @param other The other Bloom filter.
+	 *
+	 * @return `true` on success.
+	 */
+	virtual bool Merge(const BloomFilter* other) = 0;
+
+	/**
+	 * Constructs a copy of this Bloom filter.
+	 *
+	 * @return A copy of `*this`.
+	 */
+	virtual BloomFilter* Clone() const = 0;
+
 	/**
 	 * Serializes the Bloom filter.
 	 *
@@ -154,14 +170,8 @@ public:
 
 	// Overridden from BloomFilter.
 	virtual void Clear();
-
-	/**
-	 * Merges two basic Bloom filters.
-	 *
-	 * @return The merged Bloom filter.
-	 */
-	static BasicBloomFilter* Merge(const BasicBloomFilter* x,
-				       const BasicBloomFilter* y);
+	virtual bool Merge(const BloomFilter* other);
+	virtual BasicBloomFilter* Clone() const;
 
 protected:
 	DECLARE_SERIAL(BasicBloomFilter);
@@ -198,14 +208,8 @@ public:
 
 	// Overridden from BloomFilter.
 	virtual void Clear();
-
-	/**
-	 * Merges two counting Bloom filters.
-	 *
-	 * @return The merged Bloom filter.
-	 */
-	static CountingBloomFilter* Merge(const CountingBloomFilter* x,
-					  const CountingBloomFilter* y);
+	virtual bool Merge(const BloomFilter* other);
+	virtual CountingBloomFilter* Clone() const;
 
 protected:
 	DECLARE_SERIAL(CountingBloomFilter);

From 5769c32f1eeb319e599996e05e0e63b30af34823 Mon Sep 17 00:00:00 2001
From: Matthias Vallentin <vallentin@icir.org>
Date: Wed, 24 Jul 2013 13:18:19 +0200
Subject: [PATCH 03/10] Support emptiness check on Bloom filters.

---
 src/OpaqueVal.cc                   |  5 +++++
 src/OpaqueVal.h                    |  1 +
 src/probabilistic/BitVector.cc     |  8 ++++++++
 src/probabilistic/BitVector.h      |  6 ++++++
 src/probabilistic/BloomFilter.cc   | 10 ++++++++++
 src/probabilistic/BloomFilter.h    |  9 +++++++++
 src/probabilistic/CounterVector.cc |  5 +++++
 src/probabilistic/CounterVector.h  |  6 ++++++
 src/probabilistic/bloom-filter.bif |  3 +++
 9 files changed, 53 insertions(+)

diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index feff4f3cc0..a42892e2b2 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -583,6 +583,11 @@ void BloomFilterVal::Clear()
 	bloom_filter->Clear();
 	}
 
+bool BloomFilterVal::Empty() const
+	{
+	return bloom_filter->Empty();
+	}
+
 BloomFilterVal* BloomFilterVal::Merge(const BloomFilterVal* x,
 		const BloomFilterVal* y)
 	{
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 360bb69803..52c9583fc7 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -126,6 +126,7 @@ public:
 	void Add(const Val* val);
 	size_t Count(const Val* val) const;
 	void Clear();
+	bool Empty() const;
 
 	static BloomFilterVal* Merge(const BloomFilterVal* x,
 				     const BloomFilterVal* y);
diff --git a/src/probabilistic/BitVector.cc b/src/probabilistic/BitVector.cc
index 98f008b24b..13cd1aa3bb 100644
--- a/src/probabilistic/BitVector.cc
+++ b/src/probabilistic/BitVector.cc
@@ -463,6 +463,14 @@ bool BitVector::Empty() const
 	return bits.empty();
 	}
 
+bool BitVector::AllZero() const
+	{
+	for ( size_t i = 0; i < bits.size(); ++i )
+		if ( bits[i] )
+			return false;
+	return true;
+	}
+
 BitVector::size_type BitVector::FindFirst() const
 	{
 	return find_from(0);
diff --git a/src/probabilistic/BitVector.h b/src/probabilistic/BitVector.h
index 9eefe1b633..d9c55d53c6 100644
--- a/src/probabilistic/BitVector.h
+++ b/src/probabilistic/BitVector.h
@@ -253,6 +253,12 @@ public:
 	 */
 	bool Empty() const;
 
+	/**
+	 * Checks whether all bits are 0.
+	 * @return `true` iff all bits in all blocks are 0.
+	 */
+	bool AllZero() const;
+
 	/**
 	 * Finds the bit position of of the first 1-bit.
 	 * @return The position of the first bit that equals to one or `npos` if no
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index 132cf376ec..7f769cbf7c 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -74,6 +74,11 @@ size_t BasicBloomFilter::K(size_t cells, size_t capacity)
 	return std::ceil(frac * std::log(2));
 	}
 
+bool BasicBloomFilter::Empty() const
+	{
+	return bits->AllZero();
+	}
+
 void BasicBloomFilter::Clear()
 	{
 	bits->Clear();
@@ -167,6 +172,11 @@ CountingBloomFilter::CountingBloomFilter(const Hasher* hasher,
 	cells = new CounterVector(width, arg_cells);
 	}
 
+bool CountingBloomFilter::Empty() const
+	{
+	return cells->AllZero();
+	}
+
 void CountingBloomFilter::Clear()
 	{
 	cells->Clear();
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 2ab5b89941..b6cf18672f 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -47,6 +47,13 @@ public:
 		return CountImpl((*hasher)(x));
 		}
 
+	/**
+	 * Checks whether the Bloom filter is empty.
+	 *
+	 * @return `true` if the Bloom filter contains no elements.
+	 */
+	virtual bool Empty() const = 0;
+
 	/**
 	 * Removes all elements, i.e., resets all bits in the underlying bit vector.
 	 */
@@ -169,6 +176,7 @@ public:
 	static size_t K(size_t cells, size_t capacity);
 
 	// Overridden from BloomFilter.
+	virtual bool Empty() const;
 	virtual void Clear();
 	virtual bool Merge(const BloomFilter* other);
 	virtual BasicBloomFilter* Clone() const;
@@ -207,6 +215,7 @@ public:
 	CountingBloomFilter(const Hasher* hasher, size_t cells, size_t width);
 
 	// Overridden from BloomFilter.
+	virtual bool Empty() const;
 	virtual void Clear();
 	virtual bool Merge(const BloomFilter* other);
 	virtual CountingBloomFilter* Clone() const;
diff --git a/src/probabilistic/CounterVector.cc b/src/probabilistic/CounterVector.cc
index 00fa7fb8c0..24c9ff3638 100644
--- a/src/probabilistic/CounterVector.cc
+++ b/src/probabilistic/CounterVector.cc
@@ -70,6 +70,11 @@ bool CounterVector::Decrement(size_type cell, count_type value)
 	return carry;
 	}
 
+bool CounterVector::AllZero() const
+	{
+	return bits->AllZero();
+	}
+
 void CounterVector::Clear()
 	{
 	bits->Clear();
diff --git a/src/probabilistic/CounterVector.h b/src/probabilistic/CounterVector.h
index 896f98ef1e..df6fc57ac2 100644
--- a/src/probabilistic/CounterVector.h
+++ b/src/probabilistic/CounterVector.h
@@ -77,6 +77,12 @@ public:
 	 */
 	count_type Count(size_type cell) const;
 
+	/**
+	 * Checks whether all counters are 0.
+	 * @return `true` iff all counters have the value 0.
+	 */
+	bool AllZero() const;
+
 	/**
 	 * Sets all counters to 0.
 	 */
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index 9df168be0e..dd21688fdd 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -109,6 +109,9 @@ function bloomfilter_lookup%(bf: opaque of bloomfilter, x: any%): count
 	%{
 	const BloomFilterVal* bfv = static_cast<const BloomFilterVal*>(bf);
 
+	if ( bfv->Empty() )
+		return new Val(0, TYPE_COUNT);
+
 	if ( ! bfv->Type() )
 		reporter->Error("cannot perform lookup on untyped Bloom filter");
 

From d8226169b8266b554c73b2804d480d10c4a9e456 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Wed, 24 Jul 2013 16:34:52 -0700
Subject: [PATCH 04/10] Fixing random number generation so that it returns same
 numbers as before.

That broke a lot of tests.
---
 src/H3.h    | 16 ++++++++++++++--
 src/util.cc |  2 +-
 src/util.h  |  2 +-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/H3.h b/src/H3.h
index 8ea5848816..321fda924b 100644
--- a/src/H3.h
+++ b/src/H3.h
@@ -66,17 +66,29 @@
 template <typename T, int N>
 class H3 {
 public:
-	H3(T seed = bro_random())
+	H3()
+		{
+		Init(false, 0);
+		}
+
+	H3(T seed)
+		{
+		Init(true, seed);
+		}
+
+	void Init(bool have_seed, T seed)
 		{
 		T bit_lookup[N * CHAR_BIT];
 
 		for ( size_t bit = 0; bit < N * CHAR_BIT; bit++ )
 			{
 			bit_lookup[bit] = 0;
-			seed = bro_prng(seed);
 			for ( size_t i = 0; i < sizeof(T)/2; i++ )
+				{
+				seed = have_seed ? bro_prng(seed) : bro_random();
 				// assume random() returns at least 16 random bits
 				bit_lookup[bit] = (bit_lookup[bit] << 16) | (seed & 0xFFFF);
+				}
 			}
 
 		for ( size_t byte = 0; byte < N; byte++ )
diff --git a/src/util.cc b/src/util.cc
index 6bea2eb7f1..23abbacc3f 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -829,7 +829,7 @@ bool have_random_seed()
 	return bro_rand_determistic;
 	}
 
-long int bro_prng(long int state)
+unsigned int bro_prng(unsigned int  state)
 	{
 	// Use our own simple linear congruence PRNG to make sure we are
 	// predictable across platforms.
diff --git a/src/util.h b/src/util.h
index aaad2d9403..05b3f032d0 100644
--- a/src/util.h
+++ b/src/util.h
@@ -175,7 +175,7 @@ extern bool have_random_seed();
 
 // A simple linear congruence PRNG. It takes its state as argument and
 // returns a new random value, which can serve as state for subsequent calls.
-long int bro_prng(long int state);
+unsigned int bro_prng(unsigned int state);
 
 // Replacement for the system random(), to which is normally falls back
 // except when a seed has been given. In that case, the function bro_prng.

From 33e6435329c9c629b47069fd48fd97139f21a2e4 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Wed, 24 Jul 2013 16:39:22 -0700
Subject: [PATCH 05/10] Updating tests.

---
 doc/scripts/DocSourcesList.cmake                             | 1 +
 .../canonified_loaded_scripts.log                            | 5 +++--
 .../canonified_loaded_scripts.log                            | 5 +++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/scripts/DocSourcesList.cmake b/doc/scripts/DocSourcesList.cmake
index 529b03ca83..26a88027ef 100644
--- a/doc/scripts/DocSourcesList.cmake
+++ b/doc/scripts/DocSourcesList.cmake
@@ -17,6 +17,7 @@ rest_target(${psd} base/init-default.bro internal)
 rest_target(${psd} base/init-bare.bro internal)
 
 rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/analyzer.bif.bro)
+rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/bloom-filter.bif.bro)
 rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/bro.bif.bro)
 rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/const.bif.bro)
 rest_target(${CMAKE_BINARY_DIR}/scripts base/bif/event.bif.bro)
diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
index b7585a1477..04316da023 100644
--- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-05-05-20-50
+#open	2013-07-24-23-38-28
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -12,6 +12,7 @@ scripts/base/init-bare.bro
   build/scripts/base/bif/strings.bif.bro
   build/scripts/base/bif/bro.bif.bro
   build/scripts/base/bif/reporter.bif.bro
+  build/scripts/base/bif/bloom-filter.bif.bro
   build/scripts/base/bif/event.bif.bro
   build/scripts/base/bif/plugins/__load__.bro
     build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
@@ -89,4 +90,4 @@ scripts/base/init-bare.bro
       build/scripts/base/bif/file_analysis.bif.bro
 scripts/policy/misc/loaded-scripts.bro
   scripts/base/utils/paths.bro
-#close	2013-07-05-05-20-50
+#close	2013-07-24-23-38-28
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index 999fd7c841..66212643f3 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-10-21-18-31
+#open	2013-07-24-23-38-33
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -12,6 +12,7 @@ scripts/base/init-bare.bro
   build/scripts/base/bif/strings.bif.bro
   build/scripts/base/bif/bro.bif.bro
   build/scripts/base/bif/reporter.bif.bro
+  build/scripts/base/bif/bloom-filter.bif.bro
   build/scripts/base/bif/event.bif.bro
   build/scripts/base/bif/plugins/__load__.bro
     build/scripts/base/bif/plugins/Bro_ARP.events.bif.bro
@@ -195,4 +196,4 @@ scripts/base/init-default.bro
   scripts/base/protocols/tunnels/__load__.bro
   scripts/base/misc/find-checksum-offloading.bro
 scripts/policy/misc/loaded-scripts.bro
-#close	2013-07-10-21-18-31
+#close	2013-07-24-23-38-33

From febb7e83957aa14fbc14d59782b33ac3690388b3 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Thu, 25 Jul 2013 09:55:15 -0700
Subject: [PATCH 06/10] Covenience make target to update the three coverage
 tests that usually need tweaking when scripts get added/removed.

---
 testing/btest/Makefile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/testing/btest/Makefile b/testing/btest/Makefile
index ff63bdb601..47451fbf27 100644
--- a/testing/btest/Makefile
+++ b/testing/btest/Makefile
@@ -24,4 +24,11 @@ cleanup:
 update-doc-sources:
 	../../doc/scripts/genDocSourcesList.sh ../../doc/scripts/DocSourcesList.cmake
 
+# Updates the three coverage tests that usually need tweaking when
+# scripts get added/removed.
+update-coverage-tests: update-doc-sources
+	btest -qU coverage.bare-load-baseline
+	btest -qU coverage.default-load-baseline
+	@echo "Use 'git diff' to check updates look right."
+
 .PHONY: all btest-verbose brief btest-brief coverage cleanup

From 4a7046848caf6f0b97149c91902e42b770c97b3c Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Thu, 25 Jul 2013 09:45:10 -0700
Subject: [PATCH 07/10] bif files declared with bif_target() are now
 automatically compiled in.

No more manual includes to pull them in.

(It doesn't quite work fully automatically yet for some bifs that need
script-level types defined, like the input and logging frameworks.
They still do a manual "@load foo.bif" in their main.bro to get the
order right. It's a bit tricky to fix that and would probably need
splitting main.bro into two parts; not sure that's worth it.)
---
 CHANGES                                        | 10 ++++++++++
 VERSION                                        |  2 +-
 aux/binpac                                     |  2 +-
 cmake                                          |  2 +-
 scripts/base/init-bare.bro                     |  2 ++
 src/CMakeLists.txt                             | 18 +++++++++++++++++-
 src/Func.cc                                    |  4 ++++
 src/analyzer/Manager.cc                        |  1 -
 src/file_analysis/Manager.cc                   |  1 -
 .../canonified_loaded_scripts.log              |  5 +++--
 .../canonified_loaded_scripts.log              |  5 +++--
 11 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7cbbc74e4f..92d16d7776 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,14 @@
 
+2.1-826 | 2013-07-25 10:12:26 -0700
+
+  * bif files declared with bif_target() are now automatically
+    compiled in. No more manual includes to pull them in. (Robin
+    Sommer)
+
+  * Covenience make target in testing/btest to update the three
+    coverage tests that usually need tweaking when scripts get
+    added/removed. (Robin Sommer)
+
 2.1-824 | 2013-07-22 14:25:14 -0400
 
   * Fixed a scriptland state issue that manifested especially badly on proxies. (Seth Hall)
diff --git a/VERSION b/VERSION
index d35eaf1454..71d91b2ea8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.1-824
+2.1-826
diff --git a/aux/binpac b/aux/binpac
index c39bd478b9..0c91feea55 160000
--- a/aux/binpac
+++ b/aux/binpac
@@ -1 +1 @@
-Subproject commit c39bd478b9d0ecd05b1b83aa9d09a7887893977c
+Subproject commit 0c91feea55d00d3a1787203b3a43e3f9044d66e0
diff --git a/cmake b/cmake
index 0187b33a29..026639f836 160000
--- a/cmake
+++ b/cmake
@@ -1 +1 @@
-Subproject commit 0187b33a29d5ec824f940feff60dc5d8c2fe314f
+Subproject commit 026639f8368e56742c0cb5d9fb390ea64e60ec50
diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro
index 60ed0d2fd1..cffa6d80f1 100644
--- a/scripts/base/init-bare.bro
+++ b/scripts/base/init-bare.bro
@@ -3050,3 +3050,5 @@ const snaplen = 8192 &redef;
 @load base/frameworks/input
 @load base/frameworks/analyzer
 @load base/frameworks/file-analysis
+
+@load base/bif
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index e353dd4695..4644bab80a 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -6,6 +6,9 @@ include_directories(BEFORE
 # This collects generated bif and pac files from subdirectories.
 set(bro_ALL_GENERATED_OUTPUTS  CACHE INTERNAL "automatically generated files" FORCE)
 
+# This collects bif inputs that we'll load automatically.
+set(bro_AUTO_BIFS CACHE INTERNAL "BIFs for automatic inclusion" FORCE)
+
 # If TRUE, use CMake's object libraries for sub-directories instead of
 # static libraries. This requires CMake >= 2.8.8.
 set(bro_HAVE_OBJECT_LIBRARIES FALSE)
@@ -382,8 +385,21 @@ set(BRO_EXE bro
     CACHE STRING "Bro executable binary" FORCE)
 
 # Target to create all the autogenerated files.
+add_custom_target(generate_outputs_stage1)
+add_dependencies(generate_outputs_stage1 ${bro_ALL_GENERATED_OUTPUTS})
+
+# Target to create the joint includes files that pull in the bif code.
+bro_bif_create_includes(generate_outputs_stage2 ${CMAKE_CURRENT_BINARY_DIR} "${bro_AUTO_BIFS}")
+add_dependencies(generate_outputs_stage2 generate_outputs_stage1)
+
+# Global target to trigger creation of autogenerated code.
 add_custom_target(generate_outputs)
-add_dependencies(generate_outputs ${bro_ALL_GENERATED_OUTPUTS})
+add_dependencies(generate_outputs generate_outputs_stage2)
+
+# Build __load__.bro files for standard *.bif.bro.
+bro_bif_create_loader(bif_loader ${CMAKE_BINARY_DIR}/scripts/base/bif)
+add_dependencies(bif_loader ${bro_SUBDIRS})
+add_dependencies(bro bif_loader)
 
 # Build __load__.bro files for plugins/*.bif.bro.
 bro_bif_create_loader(bif_loader_plugins ${CMAKE_BINARY_DIR}/scripts/base/bif/plugins)
diff --git a/src/Func.cc b/src/Func.cc
index f3718fe231..7859e8d2ad 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -560,6 +560,8 @@ void builtin_error(const char* msg, BroObj* arg)
 #include "reporter.bif.func_def"
 #include "strings.bif.func_def"
 
+#include "__all__.bif.cc" // Autogenerated for compiling in the bif_target() code.
+
 void init_builtin_funcs()
 	{
 	bro_resources = internal_type("bro_resources")->AsRecordType();
@@ -574,6 +576,8 @@ void init_builtin_funcs()
 #include "reporter.bif.func_init"
 #include "strings.bif.func_init"
 
+#include "__all__.bif.init.cc" // Autogenerated for compiling in the bif_target() code.
+
 	did_builtin_init = true;
 	}
 
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index 5695dec625..8b290e2341 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -103,7 +103,6 @@ void Manager::InitPreScript()
 
 void Manager::InitPostScript()
 	{
-	#include "analyzer.bif.init.cc"
 	}
 
 void Manager::DumpDebug()
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index ea1ed954ed..a7f7a29c18 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -60,7 +60,6 @@ void Manager::RegisterAnalyzerComponent(Component* component)
 
 void Manager::InitPostScript()
 	{
-	#include "file_analysis.bif.init.cc"
 	}
 
 void Manager::Terminate()
diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
index b7585a1477..724de75027 100644
--- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-05-05-20-50
+#open	2013-07-25-17-10-49
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -87,6 +87,7 @@ scripts/base/init-bare.bro
   scripts/base/frameworks/file-analysis/__load__.bro
     scripts/base/frameworks/file-analysis/main.bro
       build/scripts/base/bif/file_analysis.bif.bro
+  build/scripts/base/bif/__load__.bro
 scripts/policy/misc/loaded-scripts.bro
   scripts/base/utils/paths.bro
-#close	2013-07-05-05-20-50
+#close	2013-07-25-17-10-49
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index 999fd7c841..a3e89b4d60 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-10-21-18-31
+#open	2013-07-25-17-10-50
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -87,6 +87,7 @@ scripts/base/init-bare.bro
   scripts/base/frameworks/file-analysis/__load__.bro
     scripts/base/frameworks/file-analysis/main.bro
       build/scripts/base/bif/file_analysis.bif.bro
+  build/scripts/base/bif/__load__.bro
 scripts/base/init-default.bro
   scripts/base/utils/site.bro
     scripts/base/utils/patterns.bro
@@ -195,4 +196,4 @@ scripts/base/init-default.bro
   scripts/base/protocols/tunnels/__load__.bro
   scripts/base/misc/find-checksum-offloading.bro
 scripts/policy/misc/loaded-scripts.bro
-#close	2013-07-10-21-18-31
+#close	2013-07-25-17-10-50

From c11bf3d9226fed28dbf2676c123cadd52bd13a68 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Thu, 25 Jul 2013 11:28:30 -0700
Subject: [PATCH 08/10] Fixing serialization bug introduced during earlier
 merge.

---
 src/OpaqueVal.cc                                   |  6 +++---
 src/probabilistic/BitVector.cc                     |  6 +++---
 src/probabilistic/CounterVector.cc                 |  6 +++---
 .../canonified_loaded_scripts.log                  | 14 +++++++-------
 .../canonified_loaded_scripts.log                  | 14 +++++++-------
 5 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index b70cfee086..66b3c081e7 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -656,11 +656,11 @@ bool BloomFilterVal::DoUnserialize(UnserialInfo* info)
 
 	if ( is_typed )
 		{
-		BroType* type = BroType::Unserialize(info);
-		if ( ! Typify(type) )
+		BroType* t = BroType::Unserialize(info);
+		if ( ! Typify(t) )
 			return false;
 
-		Unref(type);
+		Unref(t);
 		}
 
 	bloom_filter = probabilistic::BloomFilter::Unserialize(info);
diff --git a/src/probabilistic/BitVector.cc b/src/probabilistic/BitVector.cc
index c0285eced3..6e642e62c1 100644
--- a/src/probabilistic/BitVector.cc
+++ b/src/probabilistic/BitVector.cc
@@ -568,11 +568,11 @@ bool BitVector::DoUnserialize(UnserialInfo* info)
 		bits[i] = static_cast<block_type>(block);
 		}
 
-	uint64 num_bits;
-	if ( ! UNSERIALIZE(&num_bits) )
+	uint64 n;
+	if ( ! UNSERIALIZE(&n) )
 		return false;
 
-	num_bits = static_cast<size_type>(num_bits);
+	num_bits = static_cast<size_type>(n);
 
 	return true;
 	}
diff --git a/src/probabilistic/CounterVector.cc b/src/probabilistic/CounterVector.cc
index 24c9ff3638..d5635fc0f2 100644
--- a/src/probabilistic/CounterVector.cc
+++ b/src/probabilistic/CounterVector.cc
@@ -183,11 +183,11 @@ bool CounterVector::DoUnserialize(UnserialInfo* info)
 	if ( ! bits )
 		return false;
 
-	uint64 width;
-	if ( ! UNSERIALIZE(&width) )
+	uint64 w;
+	if ( ! UNSERIALIZE(&w) )
 		return false;
 
-	width = static_cast<size_t>(width);
+	width = static_cast<size_t>(w);
 
 	return true;
 	}
diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
index 3236b39acd..5879c504e2 100644
--- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-25-17-17-10
+#open	2013-07-25-17-54-33
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -23,28 +23,28 @@ scripts/base/init-bare.bro
     build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_DNS.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_File.events.bif.bro
     build/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Finger.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
-    build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
     build/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
     build/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
     build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
     build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
     build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
@@ -91,4 +91,4 @@ scripts/base/init-bare.bro
   build/scripts/base/bif/__load__.bro
 scripts/policy/misc/loaded-scripts.bro
   scripts/base/utils/paths.bro
-#close	2013-07-25-17-17-10
+#close	2013-07-25-17-54-33
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index cb4ccba850..2a820f4270 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-25-17-17-11
+#open	2013-07-25-17-54-33
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -23,28 +23,28 @@ scripts/base/init-bare.bro
     build/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_DNS.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_File.events.bif.bro
     build/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Finger.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_FTP.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro
-    build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
     build/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro
     build/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Ident.events.bif.bro
     build/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_IRC.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Login.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Login.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_MIME.events.bif.bro
     build/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NCP.events.bif.bro
+    build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro
     build/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
     build/scripts/base/bif/plugins/Bro_NetFlow.events.bif.bro
-    build/scripts/base/bif/plugins/Bro_NTP.events.bif.bro
     build/scripts/base/bif/plugins/Bro_PIA.events.bif.bro
     build/scripts/base/bif/plugins/Bro_POP3.events.bif.bro
     build/scripts/base/bif/plugins/Bro_RPC.events.bif.bro
@@ -197,4 +197,4 @@ scripts/base/init-default.bro
   scripts/base/protocols/tunnels/__load__.bro
   scripts/base/misc/find-checksum-offloading.bro
 scripts/policy/misc/loaded-scripts.bro
-#close	2013-07-25-17-17-11
+#close	2013-07-25-17-54-33

From 7dd5771384d6e45693e602efaebc18ffbabe8c47 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Thu, 25 Jul 2013 12:02:41 -0700
Subject: [PATCH 09/10] Protection about broken traces with empty pcap headers.

---
 CHANGES       | 5 +++++
 VERSION       | 2 +-
 src/PktSrc.cc | 6 ++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 3529576088..912d7d301f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,9 @@
 
+2.1-888 | 2013-07-25 12:02:41 -0700
+
+  * Protection about broken traces with empty pcap headers. (Matt
+    Thompson)
+
 2.1-887 | 2013-07-25 11:33:27 -0700
 
   * Support for Bloom filter. (Matthias Vallentin)
diff --git a/VERSION b/VERSION
index 2ced22d6f4..4f0ea7a5ac 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.1-887
+2.1-888
diff --git a/src/PktSrc.cc b/src/PktSrc.cc
index 105dc90d30..48b382565b 100644
--- a/src/PktSrc.cc
+++ b/src/PktSrc.cc
@@ -77,6 +77,12 @@ int PktSrc::ExtractNextPacket()
 
 	data = last_data = pcap_next(pd, &hdr);
 
+	if ( data && (hdr.len == 0 || hdr.caplen == 0) )
+		{
+		sessions->Weird("empty_pcap_header", &hdr, data);
+		return 0;
+		}
+
 	if ( data )
 		next_timestamp = hdr.ts.tv_sec + double(hdr.ts.tv_usec) / 1e6;
 

From 8d729a378bd149206326f470fa76c1d4447e038f Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Thu, 25 Jul 2013 12:08:01 -0700
Subject: [PATCH 10/10] Updating submodule(s).

 [nomail]
---
 aux/binpac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/aux/binpac b/aux/binpac
index 0c91feea55..896ddedde5 160000
--- a/aux/binpac
+++ b/aux/binpac
@@ -1 +1 @@
-Subproject commit 0c91feea55d00d3a1787203b3a43e3f9044d66e0
+Subproject commit 896ddedde55c48ec2163577fc258b49c418abb3e