Merge remote-tracking branch 'origin/master' into J-Gras-topic/jgras/bit-1507

# Conflicts:
#	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log

scripts/base/utils/geoip-distance.bro

@@ -0,0 +1,26 @@
+##! Functions to calculate distance between two locations, based on GeoIP data.
+
+## Returns the distance between two IP addresses using the haversine formula,
+## based on GeoIP database locations.  Requires Bro to be built with libgeoip.
+##
+## a1: First IP address.
+##
+## a2: Second IP address.
+##
+## Returns: The distance between *a1* and *a2* in miles, or -1.0 if GeoIP data
+##          is not available for either of the IP addresses.
+##
+## .. bro:see:: haversine_distance lookup_location
+function haversine_distance_ip(a1: addr, a2: addr): double
+	{
+	local loc1 = lookup_location(a1);
+	local loc2 = lookup_location(a2);
+	local miles: double;
+
+	if ( loc1?$latitude && loc1?$longitude && loc2?$latitude && loc2?$longitude )
+		miles = haversine_distance(loc1$latitude, loc1$longitude, loc2$latitude, loc2$longitude);
+	else
+		miles = -1.0;
+
+	return miles;
+	}

scripts/base/utils/json.bro

@@ -0,0 +1,105 @@
+##! Functions to assist with generating JSON data from Bro data scructures.
+# We might want to implement this in core somtime, this looks... hacky at best.
+
+@load base/utils/strings
+
+## A function to convert arbitrary Bro data into a JSON string.
+##
+## v: The value to convert to JSON.  Typically a record.
+##
+## only_loggable: If the v value is a record this will only cause
+##                fields with the &log attribute to be included in the JSON.
+##
+## returns: a JSON formatted string.
+function to_json(v: any, only_loggable: bool &default=F, field_escape_pattern: pattern &default=/^_/): string
+	{
+	local tn = type_name(v);
+	switch ( tn )
+		{
+		case "type":
+		return "";
+
+		case "string":
+		return cat("\"", gsub(gsub(clean(v), /\\/, "\\\\"), /\"/, "\\\""), "\"");
+
+		case "port":
+		return cat(port_to_count(to_port(cat(v))));
+
+		case "addr":
+		fallthrough;
+		case "subnet":
+		return cat("\"", v, "\"");
+
+		case "int":
+		fallthrough;
+		case "count":
+		fallthrough;
+		case "time":
+		fallthrough;
+		case "double":
+		fallthrough;
+		case "bool":
+		fallthrough;
+		case "enum":
+		return cat(v);
+
+		default:
+		break;
+		}
+
+	if ( /^record/ in tn )
+		{
+		local rec_parts: string_vec = vector();
+
+		local ft = record_fields(v);
+		for ( field in ft )
+			{
+			local field_desc = ft[field];
+			# replace the escape pattern in the field.
+			if( field_escape_pattern in field )
+				field = cat(sub(field, field_escape_pattern, ""));
+			if ( field_desc?$value && (!only_loggable || field_desc$log) )
+				{
+				local onepart = cat("\"", field, "\": ", to_json(field_desc$value, only_loggable));
+				rec_parts[|rec_parts|] = onepart;
+				}
+			}
+			return cat("{", join_string_vec(rec_parts, ", "), "}");
+		}
+
+	# None of the following are supported.
+	else if ( /^set/ in tn )
+		{
+		local set_parts: string_vec = vector();
+		local sa: set[bool] = v;
+		for ( sv in sa )
+			{
+			set_parts[|set_parts|] = to_json(sv, only_loggable);
+			}
+		return cat("[", join_string_vec(set_parts, ", "), "]");
+		}
+	else if ( /^table/ in tn )
+		{
+		local tab_parts: vector of string = vector();
+		local ta: table[bool] of any = v;
+		for ( ti in ta )
+			{
+			local ts = to_json(ti);
+			local if_quotes = (ts[0] == "\"") ? "" : "\"";
+			tab_parts[|tab_parts|] = cat(if_quotes, ts, if_quotes, ": ", to_json(ta[ti], only_loggable));
+			}
+		return cat("{", join_string_vec(tab_parts, ", "), "}");
+		}
+	else if ( /^vector/ in tn )
+		{
+		local vec_parts: string_vec = vector();
+		local va: vector of any = v;
+		for ( vi in va )
+			{
+			vec_parts[|vec_parts|] = to_json(va[vi], only_loggable);
+			}
+		return cat("[", join_string_vec(vec_parts, ", "), "]");
+		}
+
+	return "\"\"";
+	}

scripts/base/utils/numbers.bro

@@ -1,10 +1,26 @@
-## Extract the first integer found in the given string.
-## If no integer can be found, 0 is returned.
-function extract_count(s: string): count
+
+## Extract an integer from a string.
+## 
+## s: The string to search for a number.
+## 
+## get_first: Provide `F` if you would like the last number found.
+##
+## Returns: The request integer from the given string or 0 if
+##          no integer was found.
+function extract_count(s: string, get_first: bool &default=T): count
 	{
-	local parts = split_string_n(s, /[0-9]+/, T, 1);
-	if ( 1 in parts )
-		return to_count(parts[1]);
+	local extract_num_pattern = /[0-9]+/;
+	if ( get_first )
+		{
+		local first_parts = split_string_n(s, extract_num_pattern, T, 1);
+		if ( 1 in first_parts )
+			return to_count(first_parts[1]);
+		}
 	else
-		return 0;
+		{
+		local last_parts = split_string_all(s, extract_num_pattern);
+		if ( |last_parts| > 1 )
+			return to_count(last_parts[|last_parts|-2]);
+		}
+	return 0;
 	}