Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Remove broxygen Sphinx integration

Browse source 
The broxygen-generated files now live in the git repo, have tests
that check that they are up-to-date, and a script to re-generate
them on-demand.
This commit is contained in:
Jon Siwek 2018-12-17 16:25:41 -06:00
parent 9e5e9d04b7
commit 7e9d48f532
549 changed files with 89909 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

14
doc/scripts/base/protocols/dhcp/__load__.bro.rst Normal file
View file

@ -0,0 +1,14 @@
:tocdepth: 3
base/protocols/dhcp/__load__.bro
================================
:Imports: :doc:`base/protocols/dhcp/consts.bro </scripts/base/protocols/dhcp/consts.bro>`, :doc:`base/protocols/dhcp/main.bro </scripts/base/protocols/dhcp/main.bro>`
Summary
~~~~~~~
Detailed Interface
~~~~~~~~~~~~~~~~~~

227
doc/scripts/base/protocols/dhcp/consts.bro.rst Normal file
View file

@ -0,0 +1,227 @@
:tocdepth: 3
base/protocols/dhcp/consts.bro
==============================
.. bro:namespace:: DHCP
Types, errors, and fields for analyzing DHCP data. A helper file
for DHCP analysis scripts.
:Namespace: DHCP
Summary
~~~~~~~
Constants
#########
================================================================================================================== ===================================
:bro:id:`DHCP::message_types`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Types of DHCP messages.
:bro:id:`DHCP::option_types`: :bro:type:`table` :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional` Option types mapped to their names.
================================================================================================================== ===================================
Detailed Interface
~~~~~~~~~~~~~~~~~~
Constants
#########
.. bro:id:: DHCP::message_types
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`string`
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
:Default:
::
{
[2] = "OFFER",
[9] = "FORCERENEW",
[17] = "LEASEQUERYSTATUS",
[6] = "NAK",
[11] = "LEASEUNASSIGNED",
[14] = "BULKLEASEQUERY",
[4] = "DECLINE",
[1] = "DISCOVER",
[8] = "INFORM",
[7] = "RELEASE",
[15] = "LEASEQUERYDONE",
[5] = "ACK",
[10] = "LEASEQUERY",
[3] = "REQUEST",
[12] = "LEASEUNKNOWN",
[13] = "LEASEACTIVE",
[18] = "TLS",
[16] = "ACTIVELEASEQUERY"
}
Types of DHCP messages. See :rfc:`1533`, :rfc:`3203`,
:rfc:`4388`, :rfc:`6926`, and :rfc:`7724`.
.. bro:id:: DHCP::option_types
:Type: :bro:type:`table` [:bro:type:`int`] of :bro:type:`string`
:Attributes: :bro:attr:`&default` = :bro:type:`function` :bro:attr:`&optional`
:Default:
::
{
[124] = "V-I Vendor Class",
[7] = "Log Server",
[22] = "Max DG Assembly",
[211] = "Reboot Time",
[213] = "OPTION_V4_ACCESS_DOMAIN",
[51] = "Address Time",
[3] = "Router",
[75] = "StreetTalk-Server",
[156] = "dhcp-state",
[4] = "Time Server",
[48] = "X Window Font",
[26] = "MTU Interface",
[10] = "Impress Server",
[11] = "RLP Server",
[90] = "Authentication",
[125] = "V-I Vendor-Specific Information",
[212] = "OPTION_6RD",
[123] = "GeoConf Option",
[175] = "Etherboot (Tentatively Assigned - 2005-06-23)",
[45] = "NETBIOS Dist Srv",
[39] = "Keepalive Data",
[62] = "NetWare/IP Domain",
[132] = "IEEE 802.1Q VLAN ID",
[35] = "ARP Timeout",
[93] = "Client System",
[129] = "PXE - undefined (vendor specific)",
[34] = "Trailers",
[97] = "UUID/GUID",
[153] = "start-time-of-state",
[1] = "Subnet Mask",
[30] = "Mask Supplier",
[65] = "NIS-Server-Addr",
[42] = "NTP Servers",
[142] = "OPTION-IPv4_Address-ANDSF",
[76] = "STDA-Server",
[137] = "OPTION_V4_LOST",
[209] = "Configuration File",
[56] = "DHCP Message",
[46] = "NETBIOS Node Type",
[100] = "PCode",
[146] = "RDNSS Selection",
[220] = "Subnet Allocation Option",
[151] = "status-code",
[67] = "Bootfile-Name",
[81] = "Client FQDN",
[144] = "GeoLoc",
[70] = "POP3-Server",
[2] = "Time Offset",
[15] = "Domain Name",
[210] = "Path Prefix",
[119] = "Domain Search",
[83] = "iSNS",
[36] = "Ethernet",
[79] = "Service Scope",
[32] = "Router Request",
[23] = "Default IP TTL",
[221] = "Virtual Subnet Selection (VSS) Option",
[120] = "SIP Servers DHCP Option",
[40] = "NIS Domain",
[16] = "Swap Server",
[80] = "Rapid Commit",
[159] = "OPTION_V4_PORTPARAMS",
[94] = "Client NDI",
[8] = "Quotes Server",
[131] = "PXE - undefined (vendor specific)",
[78] = "Directory Agent",
[134] = "Diffserv Code Point (DSCP) for VoIP signalling and media streams",
[141] = "SIP UA Configuration Service Domains",
[69] = "SMTP-Server",
[59] = "Rebinding Time",
[154] = "query-start-time",
[55] = "Parameter List",
[155] = "query-end-time",
[77] = "User-Class",
[49] = "X Window Manager",
[50] = "Address Request",
[113] = "Netinfo Tag",
[9] = "LPR Server",
[0] = "Pad",
[66] = "Server-Name",
[138] = "OPTION_CAPWAP_AC_V4",
[139] = "OPTION-IPv4_Address-MoS",
[20] = "SrcRte On/Off",
[18] = "Extension File",
[37] = "Default TCP TTL",
[89] = "BCMCS Controller IPv4 address option",
[98] = "User-Auth",
[122] = "CCC",
[158] = "OPTION_V4_PCP_SERVER",
[255] = "End",
[63] = "NetWare/IP Option",
[53] = "DHCP Msg Type",
[128] = "PXE - undefined (vendor specific)",
[60] = "Class Id",
[136] = "OPTION_PANA_AGENT",
[72] = "WWW-Server",
[116] = "Auto-Config",
[130] = "PXE - undefined (vendor specific)",
[85] = "NDS Servers",
[73] = "Finger-Server",
[88] = "BCMCS Controller Domain Name list",
[208] = "PXELINUX Magic",
[19] = "Forward On/Off",
[112] = "Netinfo Address",
[54] = "DHCP Server Id",
[68] = "Home-Agent-Addrs",
[5] = "Name Server",
[114] = "URL",
[44] = "NETBIOS Name Srv",
[13] = "Boot File Size",
[47] = "NETBIOS Scope",
[58] = "Renewal Time",
[29] = "Mask Discovery",
[12] = "Hostname",
[17] = "Root Path",
[135] = "HTTP Proxy for phone-specific applications",
[61] = "Client Id",
[99] = "GEOCONF_CIVIC",
[25] = "MTU Plateau",
[121] = "Classless Static Route Option",
[71] = "NNTP-Server",
[117] = "Name Service Search",
[118] = "Subnet Selection Option",
[176] = "IP Telephone (Tentatively Assigned - 2005-06-23)",
[38] = "Keepalive Time",
[57] = "DHCP Max Msg Size",
[252] = "auto-proxy-config",
[52] = "Overload",
[150] = "TFTP server address",
[140] = "OPTION-IPv4_FQDN-MoS",
[43] = "Vendor Specific",
[41] = "NIS Servers",
[101] = "TCode",
[87] = "NDS Context",
[74] = "IRC-Server",
[6] = "Domain Server",
[177] = "PacketCable and CableHome (replaced by 122)",
[91] = "client-last-transaction-time option",
[82] = "Relay Agent Information",
[161] = "OPTION_MUD_URL_V4 (TEMPORARY - registered 2016-11-17)",
[64] = "NIS-Domain-Name",
[95] = "LDAP",
[133] = "IEEE 802.1D/p Layer 2 Priority",
[14] = "Merit Dump File",
[27] = "MTU Subnet",
[31] = "Router Discovery",
[24] = "MTU Timeout",
[152] = "base-time",
[160] = "DHCP Captive-Portal",
[145] = "FORCERENEW_NONCE_CAPABLE",
[28] = "Broadcast Address",
[33] = "Static Route",
[92] = "associated-ip option",
[21] = "Policy Filter",
[157] = "data-source",
[86] = "NDS Tree Name"
}
Option types mapped to their names.

23
doc/scripts/base/protocols/dhcp/index.rst Normal file
View file

@ -0,0 +1,23 @@
:orphan:
Package: base/protocols/dhcp
============================
Support for Dynamic Host Configuration Protocol (DHCP) analysis.
:doc:`/scripts/base/protocols/dhcp/__load__.bro`
:doc:`/scripts/base/protocols/dhcp/consts.bro`
Types, errors, and fields for analyzing DHCP data. A helper file
for DHCP analysis scripts.
:doc:`/scripts/base/protocols/dhcp/main.bro`
Analyze DHCP traffic and provide a log that is organized around
the idea of a DHCP "conversation" defined by messages exchanged within
a relatively short period of time using the same transaction ID.
The log will have information from clients and servers to give a more
complete picture of what happened.

257
doc/scripts/base/protocols/dhcp/main.bro.rst Normal file
View file

@ -0,0 +1,257 @@
:tocdepth: 3
base/protocols/dhcp/main.bro
============================
.. bro:namespace:: DHCP
Analyze DHCP traffic and provide a log that is organized around
the idea of a DHCP "conversation" defined by messages exchanged within
a relatively short period of time using the same transaction ID.
The log will have information from clients and servers to give a more
complete picture of what happened.
:Namespace: DHCP
:Imports: :doc:`base/frameworks/cluster </scripts/base/frameworks/cluster/index>`, :doc:`base/protocols/dhcp/consts.bro </scripts/base/protocols/dhcp/consts.bro>`
Summary
~~~~~~~
Runtime Options
###############
============================================================================ ===============================================================
:bro:id:`DHCP::max_txid_watch_time`: :bro:type:`interval` :bro:attr:`&redef` The maximum amount of time that a transation ID will be watched
for to try and tie messages together into a single DHCP
transaction narrative.
============================================================================ ===============================================================
State Variables
###############
================================================ ========================================================
:bro:id:`DHCP::log_info`: :bro:type:`DHCP::Info` This is a global variable that is only to be used in the
:bro::see::`DHCP::aggregate_msgs` event.
================================================ ========================================================
Types
#####
========================================== =================================================================
:bro:type:`DHCP::Info`: :bro:type:`record` The record type which contains the column fields of the DHCP log.
========================================== =================================================================
Redefinitions
#############
================================================================= =
:bro:type:`DHCP::Info`: :bro:type:`record`
:bro:type:`Log::ID`: :bro:type:`enum`
:bro:type:`connection`: :bro:type:`record`
:bro:id:`likely_server_ports`: :bro:type:`set` :bro:attr:`&redef`
================================================================= =
Events
######
================================================= ================================================================
:bro:id:`DHCP::aggregate_msgs`: :bro:type:`event` This event is used internally to distribute data around clusters
since DHCP doesn't follow the normal "connection" model used by
most protocols.
:bro:id:`DHCP::log_dhcp`: :bro:type:`event` Event that can be handled to access the DHCP
record as it is sent on to the logging framework.
================================================= ================================================================
Detailed Interface
~~~~~~~~~~~~~~~~~~
Runtime Options
###############
.. bro:id:: DHCP::max_txid_watch_time
:Type: :bro:type:`interval`
:Attributes: :bro:attr:`&redef`
:Default: ``30.0 secs``
The maximum amount of time that a transation ID will be watched
for to try and tie messages together into a single DHCP
transaction narrative.
State Variables
###############
.. bro:id:: DHCP::log_info
:Type: :bro:type:`DHCP::Info`
:Default:
::
{
ts=<uninitialized>
uids={
}
client_addr=<uninitialized>
server_addr=<uninitialized>
client_port=<uninitialized>
server_port=<uninitialized>
mac=<uninitialized>
host_name=<uninitialized>
client_fqdn=<uninitialized>
domain=<uninitialized>
requested_addr=<uninitialized>
assigned_addr=<uninitialized>
lease_time=<uninitialized>
client_message=<uninitialized>
server_message=<uninitialized>
msg_types=[]
duration=0 secs
last_message_ts=<uninitialized>
msg_orig=<uninitialized>
client_software=<uninitialized>
server_software=<uninitialized>
circuit_id=<uninitialized>
agent_remote_id=<uninitialized>
subscriber_id=<uninitialized>
}
This is a global variable that is only to be used in the
:bro::see::`DHCP::aggregate_msgs` event. It can be used to avoid
looking up the info record for a transaction ID in every event handler
for :bro:see::`DHCP::aggregate_msgs`.
Types
#####
.. bro:type:: DHCP::Info
:Type: :bro:type:`record`
ts: :bro:type:`time` :bro:attr:`&log`
The earliest time at which a DHCP message over the
associated connection is observed.
uids: :bro:type:`set` [:bro:type:`string`] :bro:attr:`&log`
A series of unique identifiers of the connections over which
DHCP is occurring. This behavior with multiple connections is
unique to DHCP because of the way it uses broadcast packets
on local networks.
client_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
IP address of the client. If a transaction
is only a client sending INFORM messages then
there is no lease information exchanged so this
is helpful to know who sent the messages.
Getting an address in this field does require
that the client sources at least one DHCP message
using a non-broadcast address.
server_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
IP address of the server involved in actually
handing out the lease. There could be other
servers replying with OFFER messages which won't
be represented here. Getting an address in this
field also requires that the server handing out
the lease also sources packets from a non-broadcast
IP address.
client_port: :bro:type:`port` :bro:attr:`&optional`
Client port number seen at time of server handing out IP (expected
as 68/udp).
server_port: :bro:type:`port` :bro:attr:`&optional`
Server port number seen at time of server handing out IP (expected
as 67/udp).
mac: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
Client's hardware address.
host_name: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
Name given by client in Hostname option 12.
client_fqdn: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
FQDN given by client in Client FQDN option 81.
domain: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
Domain given by the server in option 15.
requested_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
IP address requested by the client.
assigned_addr: :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&optional`
IP address assigned by the server.
lease_time: :bro:type:`interval` :bro:attr:`&log` :bro:attr:`&optional`
IP address lease interval.
client_message: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
Message typically accompanied with a DHCP_DECLINE
so the client can tell the server why it rejected
an address.
server_message: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
Message typically accompanied with a DHCP_NAK to let
the client know why it rejected the request.
msg_types: :bro:type:`vector` of :bro:type:`string` :bro:attr:`&log` :bro:attr:`&default` = ``[]`` :bro:attr:`&optional`
The DHCP message types seen by this DHCP transaction
duration: :bro:type:`interval` :bro:attr:`&log` :bro:attr:`&default` = ``0 secs`` :bro:attr:`&optional`
Duration of the DHCP "session" representing the
time from the first message to the last.
last_message_ts: :bro:type:`time` :bro:attr:`&optional`
msg_orig: :bro:type:`vector` of :bro:type:`addr` :bro:attr:`&log` :bro:attr:`&default` = ``[]`` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/msg-orig.bro` is loaded)
The address that originated each message from the
`msg_types` field.
client_software: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/software.bro` is loaded)
Software reported by the client in the `vendor_class` option.
server_software: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/software.bro` is loaded)
Software reported by the server in the `vendor_class` option.
circuit_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
Added by DHCP relay agents which terminate switched or
permanent circuits. It encodes an agent-local identifier
of the circuit from which a DHCP client-to-server packet was
received. Typically it should represent a router or switch
interface number.
agent_remote_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
A globally unique identifier added by relay agents to identify
the remote host end of the circuit.
subscriber_id: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
(present if :doc:`/scripts/policy/protocols/dhcp/sub-opts.bro` is loaded)
The subscriber ID is a value independent of the physical
network configuration so that a customer's DHCP configuration
can be given to them correctly no matter where they are
physically connected.
The record type which contains the column fields of the DHCP log.
Events
######
.. bro:id:: DHCP::aggregate_msgs
:Type: :bro:type:`event` (ts: :bro:type:`time`, id: :bro:type:`conn_id`, uid: :bro:type:`string`, is_orig: :bro:type:`bool`, msg: :bro:type:`DHCP::Msg`, options: :bro:type:`DHCP::Options`)
This event is used internally to distribute data around clusters
since DHCP doesn't follow the normal "connection" model used by
most protocols. It can also be handled to extend the DHCP log.
:bro:see::`DHCP::log_info`.
.. bro:id:: DHCP::log_dhcp
:Type: :bro:type:`event` (rec: :bro:type:`DHCP::Info`)
Event that can be handled to access the DHCP
record as it is sent on to the logging framework.